ms2k/remora
SHA256
Watch
0
Code Releases Activity

Tighten failure and manifest contracts

Browse source
This commit is contained in:
ms2k 2026-07-13 17:23:32 +09:00
commit a44b687897
1 changed files with 47 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

3
docs/spec/architecture.md
View file

@ -100,6 +100,7 @@ flowchart TD
- Every successful job is represented by one immutable `ResultManifest`. A single-object transfer uses a one-member manifest.
- A manifest is the exact inventory of immutable member identities and carries sufficient integrity metadata to validate the aggregate.
- Manifest member paths are NFC-normalized relative POSIX segment sequences. Empty segments, dot segments, traversal, leading or trailing separators, and backslashes are invalid rather than normalized into aliases.
- Manifest construction uses memory bounded independently of member count and total result size.
- Remora resolves a result only from its `CommittedResult`; it never derives one by listing a target bucket or prefix.
- An authorized reader may access committed members directly in `TargetStore` using exact manifest identities or time-limited URLs.
@ -127,7 +128,7 @@ flowchart TD
- Attempt-reported runtime failures carry a durable permanent or retryable disposition into `JobProtocol`. The model is the sole definition of how that disposition affects execution phase and attempt budget.
- Authorization, source-not-found, and source-changed runtime failures are permanent. Transient-source, transient-target, integrity, capacity, and internal failures are retryable. Unrecognized runtime errors map to a redacted internal failure.
- Validation normally rejects submission before a job exists. Cancellation and lost attempts follow their dedicated `JobProtocol` behavior rather than a worker-selected failure disposition.
- All retryable work uses the model-wide attempt bound. Source adapters may vary connect, response-start, no-progress, bounded full-jitter, and bounded server-hint timing without changing that bound.
- All retryable work uses the model-wide attempt bound. Source adapters may vary connect, response-start, no-progress, bounded full-jitter, and bounded server-hint timing without changing that bound. Invalid or excessive server hints are ignored or capped; they never change a retryable disposition into a permanent failure.
- Remora has no elapsed wall-clock job deadline. Per-operation timeouts produce a structured runtime failure and remain subject to `JobProtocol`.
- Public failure details are constructed from per-class allowlists. Credentials, upstream bodies, raw URLs, and internal exception text are excluded.