Artifact 292ee5328e3828ae457aa4d8dfbf08e210153d8f04b3a039b6f35ce2ccc71059:
- File
src/root.zig
— part of check-in
[562cf5be74]
at
2026-07-31 04:56:22
on branch sub-manifest
— merge trunk: shun, the release-assert guard, and the split test lanes
Trunk since d186a44e brought the repository shun table and its whole- branch verification fixes, the release-assert guard, the `test`/`gate` lane split, the structurally bounded logstore priority window, and the vendored crc32. Eight files conflicted. The decisions worth naming:
Lanes. `git-import-e2e` was a compile-only proof hanging off `test`; that is exactly the cost trunk moved to `gate`, so it moves with `e2e` and `smoke`. `import-git-bench` stays on `test` because it registers a real unit-test run rather than a compile proof. `declared_steps` is the union plus `gate`.
Sync ingest. Both sides rewrote it: trunk added the §7.7 receive-side shun admission, this branch added §7.1 phantom minting for a pushed tree's missing sub-manifests. They compose in one direction — admission is asked first, so a card §7.7 refuses is never stored and mints no phantoms either. The S references of an artifact this repository declines to hold are not names it should then go begging for.
Client construction. Trunk factored the three verbs' `Client` literal into `syncClient` and threaded `RepoAdmission`; this branch had widened `project_code` into `RepoSyncIdentity`. The helper now carries both, which is what trunk's own comment asked for: three copies of that literal is how a repository filter comes to be wired into two verbs and not the third.
Per-round server refresh. Trunk made the snapshot mandatory — `error.ServerStorage` rather than serving with no shun table — where this branch read its four sub-manifest fields through fail-open defaults. Trunk's reading wins for all six fields: serving a stale default is the failure, not the fallback.
Two guards trunk owns caught real defects in this branch's code, which is the whole point of them:
The total switch in `shunConsequence` refused to compile against the `submanifest` artifact type, exactly as its comment promised. It has an arm now.
The release-assert guard found nine asserts on untrusted input across six functions. Two were reachable faults, not style: `lookupTree` asserted §4.4 on a sub-manifest a peer supplies, so a malformed node panicked a ReleaseSafe reader and was walked anyway under `--release=fast`. It returns `SubUnresolvable` now, which §5.2 already defines as "absent, or is not a SUBMANIFEST". The empty-S-run assert became an early `null`. The two sub-manifest writers refuse an empty group through a new `SubmanifestWriteError` rather than asserting; the builder's internal path keeps its allocation-only surface through `serializeLeafCore`, since the partitioner is what establishes non- emptiness there. The rest were tautologies or restatements of invariants the card parser already enforces, and now say so in a comment instead of carrying a panic.
Verified on the merged tree: `gate`, `e2e`, `dst` (6 seeds x 1000 steps), `smoke` (S1-S10, including trunk's new shun interop), and `git- import-e2e` all green, `zig fmt --check` clean. Beyond the suite, the importer was run for real: the empty-email repro imports and its check- in carries `U mohye77`, and marktext imports end to end with the analyzed pin at k=5. (user: dmestas, size: 7890) [annotate] [blame] [check-ins using] [more...]
//! zit — a Fossil version-control system implemented in Zig. //! //! zit is a direct port of the Fossil formats and protocol as specified by //! four companion Internet-Drafts, kept in `docs/rfcs/`: //! //! * delta — draft-fossil-delta-format-00 (byte-level delta encoding) //! * artifact— draft-fossil-artifact-format-00 (manifest/control-artifact cards) //! * reposta.— draft-fossil-repo-state-00 (derived branch/tag/leaf/trunk views) //! * sync — draft-fossil-sync-protocol-00 (HTTP sync/clone protocol) //! //! Implementation order follows the RFC dependency layering: //! delta -> artifact -> repostate -> sync //! //! Each module cites the section of its RFC that governs a given rule. const std = @import("std"); /// The §4.1 zlib container codec — a leaf below delta/artifact/repostate/sync, /// the single home for the container framing those layers store and transmit. pub const container = @import("container.zig"); pub const delta = @import("delta.zig"); pub const artifact = @import("artifact.zig"); pub const repostate = @import("repostate.zig"); pub const sync = @import("sync.zig"); pub const control_paths = @import("control_paths.zig"); pub const managed = @import("managed.zig"); /// The persistence layers, folded into the one embeddable `zit` module so a /// library consumer wires a single dependency instead of five peers: the /// content-addressed on-disk file (`storage`), the framed append-only log over /// it (`logstore`), the `.zit-checkout` working-state record (`checkout`), and /// the working-tree materializer (`update`). Circular file-level imports among /// these and the per-RFC modules are legal within one module; only cross-module /// edges may not cycle. pub const storage = @import("storage.zig"); pub const logstore = @import("logstore.zig"); /// Importer modules cross the executable/library module boundary. Zig module /// privacy requires exporting them here so the CLI and embedders share one set /// of type identities instead of compiling duplicate file modules. pub const git_fast_export = @import("git_fast_export.zig"); pub const git_import = @import("git_import.zig"); pub const submanifest_editor = @import("submanifest_editor.zig"); /// The vendored CRC-32/ISO-HDLC every on-disk checksum in the store is defined /// in terms of. Exported for the same reason `storestat` is: the benchmark that /// measures the checksum must measure the one the product actually runs, and a /// file can belong to only one module — so `warmread_benchmark.zig` cannot /// import it by path. Not a promise about the algorithm; the guarantee is only /// that it is bit-identical to `std.hash.Crc32`, which the formats already fix. /// /// NOT a precedent for exporting other leaf modules — the default stays the one /// `repocache.zig` sets, which is no export. This line is forced rather than /// chosen: `crc32.zig` is a `zit` member (`logstore`, `repocache`, `bisect` and /// `undo` all import it by path), and its two out-of-module consumers — the /// benchmark's `phaseCrc` and `crc32_fuzz.zig`'s differential-against-std lane, /// both of which live in their own root modules — have no other way to reach /// it. `@import("crc32.zig")` from either is `error: file exists in modules /// 'zit' and 'root'`. Reverting this export does not close the surface; it /// deletes the only benchmark of the hot checksum and the only test in the tree /// that diffs against an outside oracle. Add an export here only when a leaf /// module acquires an out-of-module consumer with the same no-alternative /// shape. pub const crc32 = @import("crc32.zig"); /// The store's own byte accounting — the single physical frame walk behind /// both `zit stat` and the storage benchmark, so the two can never drift into /// reporting different totals for the same file. pub const storestat = @import("storestat.zig"); pub const checkout = @import("checkout.zig"); pub const update = @import("update.zig"); pub const bisect = @import("bisect.zig"); /// The `zit pack` re-deltification pass (storage-delta-base-selection.md §6): /// the pure store-to-store generational rewrite that re-bases every artifact /// through `logstore`'s `pickBase` policy. In the module so the CLI wiring /// (main.zig) and the DST/fuzz harnesses drive the identical transform. pub const pack = @import("pack.zig"); /// The repository facade — the deep module the north star names as the public /// repo surface: open a repository, resolve a name, read the derived view, list /// and cat content. `repoview` (the derived-view loader) is re-exported as its /// public collaborator; `repocache` stays library-internal, reached only /// through `Repository`. pub const Repository = @import("repository.zig").Repository; pub const repoview = @import("repoview.zig"); /// The zero-parse read image — the materialized hot query answers a warm read /// reloads without re-deriving. Re-exported for the simulation harness, which /// pins the round-trip property (a materialized image is query-equivalent to /// the derived state it was made from). pub const repoimage = @import("repoimage.zig"); pub const repo_filename = @import("repository.zig").repo_filename; /// draft-fossil-submanifests-00 §6.3/§8.1 — the writer-side sub-manifest /// settings, the emission decision they determine, and the §6.3 analysis pass /// that measures k. Beside the repository facade, not inside `RepoView`: see /// the namespace's own doc comment for why the derived view is the wrong home. pub const submanifest = @import("repository.zig").submanifest; /// Suite version of the specifications this implementation targets. pub const rfc_revision = "00"; test { // Aggregate every module's tests into the library test binary. _ = @import("container.zig"); _ = @import("container_test.zig"); _ = @import("delta.zig"); _ = @import("delta_test.zig"); _ = @import("artifact.zig"); _ = @import("artifact_test.zig"); // Importer foundation tests remain test-only; none of their private // implementation modules enter the shipped `zit` API. _ = @import("submanifest_editor_test.zig"); _ = @import("git_fast_export_test.zig"); _ = @import("repostate.zig"); _ = @import("repostate_test.zig"); _ = @import("sync.zig"); _ = @import("sync_test.zig"); _ = @import("managed.zig"); // The folded store layers and their sibling public-surface test files. _ = @import("storage.zig"); _ = @import("logstore.zig"); _ = @import("logstore_test.zig"); _ = @import("storestat.zig"); _ = @import("pack.zig"); _ = @import("checkout.zig"); _ = @import("update.zig"); _ = @import("update_test.zig"); // The repository facade and its derived-view collaborators. _ = @import("repoview.zig"); _ = @import("repoimage.zig"); _ = @import("repocache.zig"); // The vendored CRC-32/ISO-HDLC the storage formats are checksummed with. _ = @import("crc32.zig"); _ = @import("repository.zig"); _ = @import("repository_test.zig"); // The checkout-local bisection state module (`.zit-bisect`). _ = @import("bisect.zig"); // Structural pins over the shipped source distribution (LICENSE, the // package manifest's `.paths`, the versioned ignore-glob). _ = @import("packaging_test.zig"); // Structural pins over the CI workflow (the battery it runs, the pinned // toolchain, and the build steps it deliberately skips). _ = @import("ci_test.zig"); // The dead-file guard: every src/**/*.zig must be reachable from a test root, // so a moved file cannot silently stop running its tests. _ = @import("tidy.zig"); // The release-assert guard: no NEW `std.debug.assert` may stand in for // validation of untrusted input in a `pub fn` that returns an error union. _ = @import("release_assert_test.zig"); }