@bevel-software/platform-core-backend 0.28.0 → 0.29.0

package/src/core/lifecycle.ts

@@ -425,13 +425,18 @@ export interface CoreStopDeps {
   /** The lease loop from {@link holdCommitWorkerLease}: its stop finishes the in-flight commit and releases the lease. */
   commitWorker: Pick<LeaseLoopHandle, 'stop'>;
   /**
-   * Background work to wind down before the pool goes — the join-request
-   * sweep and its jobs, today. The timer is stopped first so nothing new is
-   * scheduled, then the jobs already running are awaited (within the budget)
-   * so the pool is not ended under a clone or a push that is still writing
-   * to it. Optional: a caller that has not built them yet passes nothing.
+   * The plugin join-request jobs, whose sweep must be wound down before the
+   * pool goes. The timer is stopped first so nothing new is scheduled, then
+   * the jobs already running are awaited (within the budget) so the pool is
+   * not ended under a clone or a push that is still writing to it. Optional:
+   * a caller that has not built them yet passes nothing.
+   *
+   * Named as `CoreServices` names it, because the graph IS what is passed
+   * here (`stopCore(graph.core)`): under another name the slot stayed empty,
+   * the sweep outlived every stopped graph, and a multi-tenant host gained
+   * one more sweeper querying an ended pool, every minute, per eviction.
    */
-  backgroundJobs?: { stopSweeping(): void; drain(): Promise<void> };
+  pluginJoinRequestJobs?: { stopSweeping(): void; drain(): Promise<void> };
   /**
    * The agent upload store, whose own sweep deletes staged bytes nobody
    * applied. Stopped with this graph because the next graph for the same
@@ -532,7 +537,7 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   // server is closed (or the tenant is no longer routed to), so this is the
   // earliest point the interval is dead weight. Synchronous and unfailing
   // — it just clears an interval — so it needs no budget of its own.
-  deps.backgroundJobs?.stopSweeping();
+  deps.pluginJoinRequestJobs?.stopSweeping();
   // And the upload store's sweep, for the same reason and in the same breath:
   // synchronous, and it only clears an interval and tells a sweep already
   // running to stop deleting.
@@ -548,11 +553,18 @@ async function releaseCore(deps: CoreStopDeps, remaining: () => number, log: (m:
   // Clearing the interval stops future ticks; it does nothing to a job a
   // tick already started, which holds a claim it heartbeats through the
   // pool and is mid-clone or mid-push. Awaited here, in the budget: a job
-  // that finishes releases or marks its row; one that cannot in time is
-  // killed with the process and its claim goes stale for the next sweep
-  // — which is the recovery every crash already gets.
-  if (deps.backgroundJobs) {
-    await bounded(deps.backgroundJobs.drain(), remaining(), 'finishing the background jobs', log);
+  // that finishes releases or marks its row. One that cannot in time is
+  // NOT cancelled — the bounded wait only stops waiting — and what becomes
+  // of it depends on who is stopping: a process shutting down takes it
+  // along; a tenant host evicting one graph ends the pool under it, which
+  // cancels nothing already running — a clone or push in flight finishes
+  // on its own — but its next heartbeat or database write fails, so from
+  // there the job records nothing and stops. Either way its claim goes
+  // stale and the next sweep — the next boot's, or a live graph's — picks
+  // the row up and does the whole thing again, which is the recovery every
+  // crash already gets (and why each step is written to be redone).
+  if (deps.pluginJoinRequestJobs) {
+    await bounded(deps.pluginJoinRequestJobs.drain(), remaining(), 'finishing the join-request jobs', log);
   }
   // The sweep in flight when the interval was cleared: awaited so the next
   // graph for this tenant cannot start staging bytes while a store it has

package/src/modules/access/__tests__/access-control.admin-root-floor.test.ts

@@ -133,11 +133,31 @@ describe('Admin write floor at the repository root', () => {
       expect(await service().canWrite(WS, ADMIN, 'README.md')).toBe(true);
     });
 
-    it('is write only: read and download still answer to the access tree', async () => {
-      await write(repo, 'access.md', '---\n---\nwrite:\n  - deny Admin\n');
+    it('is write and the read it implies: download still answers to the access tree', async () => {
+      await write(repo, 'access.md', '---\n---\nwrite:\n  - deny Admin\nread:\n  - deny Admin\n');
       const svc = service();
-      expect(await svc.canDownload(WS, ADMIN, 'README.md')).toBe(false);
+      for (const who of [ADMIN, OWNER]) {
+        expect(await svc.canRead(WS, who, 'README.md')).toBe(true);
+        expect(await svc.canRead(WS, who, 'Knowledge/Foo.md')).toBe(true);
+        expect(await svc.canDownload(WS, who, 'README.md')).toBe(false);
+      }
       expect(await svc.canWrite(WS, ENGINEER, 'README.md')).toBe(false);
+      expect(await svc.canRead(WS, ENGINEER, 'README.md')).toBe(false);
+      // Who may read, for the banner: the floor's holders, and nobody else.
+      expect((await svc.eligibleReaders(WS, 'Knowledge/Foo.md')).roles).toEqual(['Admin']);
+    });
+
+    it('the deployment owner, absent from roles.yaml, reads where the Admin role reads and not where it is excluded', async () => {
+      await write(repo, 'access.md', '---\n---\nread:\n  - Engineer\n');
+      await write(repo, 'HR/access.md', '---\n---\nread:\n  - Engineer\n  - deny Admin\n');
+      await write(repo, 'Ops/access.md', '---\n---\nread:\n  - deny everyone\n  - Admin\n');
+      const svc = service();
+      for (const who of [ADMIN, OWNER]) {
+        expect(await svc.canRead(WS, who, 'Knowledge/Foo.md')).toBe(true);
+        expect(await svc.canRead(WS, who, 'HR/Salaries.md')).toBe(false);
+        expect(await svc.canRead(WS, who, 'Ops/Runbook.md')).toBe(true);
+      }
+      expect(await svc.canRead(WS, ENGINEER, 'Ops/Runbook.md')).toBe(false);
     });
 
     describe('a subfolder that excludes Admin', () => {

package/src/modules/access/__tests__/access-control.atref-cache.test.ts

@@ -18,11 +18,16 @@ import { AccessUnreadableError } from '../../access-model/access-errors.js';
  * the process boundary, which is the cost this cache exists to remove.
  * `injected.failNext` makes ONE matching spawn fail the way a transient git
  * error does, so the cache's behaviour under a failed read can be pinned
- * without a flaky fixture.
+ * without a flaky fixture. `injected.rewriteNext` lets ONE matching spawn
+ * run for real and rewrites what it printed before the service reads it,
+ * for replies a healthy git cannot be made to give.
  */
 const { spawnLog, injected } = vi.hoisted(() => ({
   spawnLog: [] as string[][],
-  injected: { failNext: null as null | ((argv: string[]) => boolean) },
+  injected: {
+    failNext: null as null | ((argv: string[]) => boolean),
+    rewriteNext: null as null | ((argv: string[]) => null | ((stdout: Buffer, stdin: string) => Buffer)),
+  },
 }));
 
 vi.mock('node:child_process', async (importOriginal) => {
@@ -64,6 +69,41 @@ vi.mock('node:child_process', async (importOriginal) => {
     });
     return child as unknown as ReturnType<typeof actual.spawn>;
   };
+  type Child = ReturnType<typeof actual.spawn>;
+  const realSpawn = actual.spawn as unknown as (...a: unknown[]) => Child;
+  /**
+   * The real child, with what it was fed on stdin recorded and its stdout
+   * handed to `fn` whole, once it has exited, before the service sees it.
+   */
+  const rewriting = (file: string, args: string[], options: unknown, fn: (stdout: Buffer, stdin: string) => Buffer) => {
+    const real = realSpawn(file, args, options);
+    const fed: Buffer[] = [];
+    const out: Buffer[] = [];
+    const child = Object.assign(new EventEmitter(), {
+      pid: real.pid,
+      exitCode: null as number | null,
+      signalCode: null,
+      stdin: Object.assign(new EventEmitter(), {
+        write: (chunk: string | Buffer) => {
+          fed.push(Buffer.from(chunk));
+          return real.stdin!.write(chunk);
+        },
+        end: () => real.stdin!.end(),
+      }),
+      stdout: new PassThrough(),
+      stderr: new PassThrough(),
+      kill: (signal?: NodeJS.Signals | number) => real.kill(signal),
+    });
+    real.stdout!.on('data', (chunk: Buffer) => out.push(chunk));
+    real.stderr!.pipe(child.stderr);
+    real.on('error', (err) => child.emit('error', err));
+    real.on('close', (code, signal) => {
+      child.stdout.end(fn(Buffer.concat(out), Buffer.concat(fed).toString('utf-8')));
+      child.exitCode = code;
+      child.emit('close', code, signal);
+    });
+    return child as unknown as Child;
+  };
   const spawn = ((file: string, args: string[], options: unknown) => {
     if (file === 'git') {
       spawnLog.push(args ?? []);
@@ -71,8 +111,13 @@ vi.mock('node:child_process', async (importOriginal) => {
         injected.failNext = null;
         return failing();
       }
+      const rewrite = injected.rewriteNext?.(args);
+      if (rewrite) {
+        injected.rewriteNext = null;
+        return rewriting(file, args, options, rewrite);
+      }
     }
-    return (actual.spawn as unknown as (...a: unknown[]) => unknown)(file, args, options);
+    return realSpawn(file, args, options);
   }) as unknown as typeof actual.spawn;
   return { ...actual, execFile, spawn };
 });
@@ -84,20 +129,58 @@ function lsTreeBuilds(): number {
   return spawnLog.filter((argv) => argv.includes('ls-tree')).length;
 }
 
-function rolesReads(): number {
-  return spawnLog.filter((argv) => argv.includes('show') && argv.some((a) => a.endsWith(':roles.yaml')))
-    .length;
+/** Batched reads of a commit's access tree: one per build. */
+function catFileBatches(): number {
+  return spawnLog.filter((argv) => argv.includes('cat-file')).length;
+}
+
+/**
+ * Single-file reads of the MODEL's files at a ref (roles, groups, any
+ * access.md, any plugin manifest): none, since the build reads them in one
+ * batch. The one `show` a single-path gate makes afterwards, for the asked
+ * file's own frontmatter, is not the model's and is not counted.
+ */
+function fileShows(): number {
+  return spawnLog.filter(
+    (argv) =>
+      argv.includes('show') &&
+      argv.some((a) => /:(roles\.yaml|groups\.yaml|synced-groups\.yaml|(.*\/)?access\.md|.*\/plugin\.json)$/.test(a)),
+  ).length;
+}
+
+/**
+ * Rewrite ONE record of a `git cat-file --batch` reply — the one answering
+ * the stdin spec `which` matches — as `<spec> missing`, or as the same
+ * object reported with type `tree`. The reply is index-aligned with the
+ * specs fed on stdin, each record `<oid> <type> <size>\n<size bytes>\n` or
+ * `<spec> missing\n`, so the records are walked by the specs.
+ */
+function rewriteBatchRecord(which: RegExp, as: 'missing' | 'tree') {
+  return (stdout: Buffer, stdin: string): Buffer => {
+    const parts: Buffer[] = [];
+    let off = 0;
+    for (const spec of stdin.split('\n').filter(Boolean)) {
+      const nl = stdout.indexOf(0x0a, off);
+      const header = stdout.subarray(off, nl).toString('utf-8');
+      const end = header.endsWith(' missing') ? nl + 1 : nl + 1 + Number(header.split(' ')[2]) + 1;
+      if (!which.test(spec)) parts.push(stdout.subarray(off, end));
+      else if (as === 'missing') parts.push(Buffer.from(`${spec} missing\n`));
+      else parts.push(Buffer.from(header.replace(' blob ', ' tree ')), stdout.subarray(nl, end));
+      off = end;
+    }
+    return Buffer.concat(parts);
+  };
 }
 
 /**
  * The at-ref access model — `canWriteAtRef` / `canWriteBatchAtRef` /
  * `eligibleWritersForPathsAtRef`, the gates every change-request read and
  * every approval click run — is a pure function of the tree at the commit
- * the ref resolves to. Building it costs one `ls-tree` plus one `git show`
- * per `access.md`, so it must be built ONCE per commit and shared by every
- * gate call that lands on that commit, while a push that moves the ref is
- * still seen on the very next call, and a build that saw a git read fail
- * is never pinned.
+ * the ref resolves to. Building it costs two git calls, one `ls-tree` plus
+ * one `cat-file --batch` for every file the model reads, so it must be built
+ * ONCE per commit and shared by every gate call that lands on that commit,
+ * while a push that moves the ref is still seen on the very next call, and a
+ * build that saw a git read fail is never pinned.
  *
  * Every test seeds its own bare origin, workspace clone, and second clone
  * (`other`, standing in for another user's push), so each one holds alone.
@@ -110,6 +193,8 @@ describe('AccessControlService — at-ref model cache', () => {
   const workspaceId = 'ws-atref-cache';
   const admin = 'razvan@bevel.software';
   const DOC = 'Team/Doc.md';
+  const QUOTED_DIR = 'Équipe';
+  const QUOTED_DOC = `${QUOTED_DIR}/Doc.md`;
 
   async function git(cwd: string, ...args: string[]): Promise<string> {
     const { stdout } = await execFileAsync('git', ['-C', cwd, ...args], { encoding: 'utf-8' });
@@ -137,6 +222,14 @@ describe('AccessControlService — at-ref model cache', () => {
     await fs.writeFile(path.join(repo, 'access.md'), '---\nwrite:\n  - Admin\n---\n');
     await fs.writeFile(path.join(repo, 'Team/access.md'), '---\nwrite:\n  - Admin\n---\n');
     await fs.writeFile(path.join(repo, DOC), '# doc\n');
+    // A folder git would C-quote in its default listing, with an access.md
+    // that DENIES the admin: read as it is, or the denial is missed.
+    await fs.mkdir(path.join(repo, QUOTED_DIR), { recursive: true });
+    await fs.writeFile(path.join(repo, QUOTED_DIR, 'access.md'), '---\nwrite:\n  - deny Admin\n---\n');
+    await fs.writeFile(path.join(repo, QUOTED_DOC), '# doc\n');
+    // A plugin, whose manifest the model reads too.
+    await fs.mkdir(path.join(repo, 'Plugins/Demo'), { recursive: true });
+    await fs.writeFile(path.join(repo, 'Plugins/Demo/plugin.json'), '{ "name": "Demo" }\n');
     await execFileAsync('git', ['init', '-b', 'main', repo]);
     await git(repo, 'config', 'user.email', 'test@example.com');
     await git(repo, 'config', 'user.name', 'Test');
@@ -160,10 +253,12 @@ describe('AccessControlService — at-ref model cache', () => {
     svc = new AccessControlService(stub, PROCESS_MAP_DIR, new NodeFs());
     spawnLog.length = 0;
     injected.failNext = null;
+    injected.rewriteNext = null;
   });
 
   afterEach(async () => {
     injected.failNext = null;
+    injected.rewriteNext = null;
     // Spies are restored here, not at the end of the test that made them:
     // a failing assertion would otherwise leave a console.warn mock in place
     // for every test after it (this config sets no `restoreMocks`).
@@ -233,10 +328,13 @@ describe('AccessControlService — at-ref model cache', () => {
     const map = await svc.eligibleWritersForPathsAtRef(workspaceId, 'feature', [DOC]);
     expect(map).not.toBeNull();
     expect(map!.get(DOC)!.roles).toContain('Admin');
-    expect(lsTreeBuilds()).toBe(1);
-    // ...and the fallthrough result is cached under origin/feature's commit.
+    // Two commits were read: the local tip, found to carry no roles.yaml,
+    // then origin/feature's.
+    expect(lsTreeBuilds()).toBe(2);
+    // ...and both answers are remembered: the fallthrough result under
+    // origin/feature's commit, the local tip as a commit with no roles.
     expect(await svc.canWriteAtRef(workspaceId, 'feature', admin, DOC)).toBe(true);
-    expect(lsTreeBuilds()).toBe(1);
+    expect(lsTreeBuilds()).toBe(2);
   });
 
   it('refuses to decide from a build that lost a git read, and never caches it', async () => {
@@ -246,18 +344,19 @@ describe('AccessControlService — at-ref model cache', () => {
       fs.writeFile(path.join(other, 'Team/access.md'), '---\nwrite:\n  - deny Admin\n---\n'),
     );
 
-    // Lose exactly that read, once, to a simulated transient failure. The
-    // gate must not answer from the partial tree (which would grant what the
-    // lost file denies): it fails closed with an AccessUnreadableError...
-    injected.failNext = (argv) => argv.includes('show') && argv.some((a) => a.endsWith(':Team/access.md'));
+    // Lose the batched read of the tree, once, to a simulated transient
+    // failure. The gate must not answer from a partial tree (which would
+    // grant what the lost file denies): it fails closed with an
+    // AccessUnreadableError...
+    injected.failNext = (argv) => argv.includes('cat-file');
     const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
     await expect(svc.canWriteAtRef(workspaceId, 'origin/main', admin, DOC)).rejects.toBeInstanceOf(
       AccessUnreadableError,
     );
     expect(injected.failNext).toBeNull();
     expect(lsTreeBuilds()).toBe(1);
-    // ...and says so in the logs, naming the read it lost.
-    expect(warn).toHaveBeenCalledWith(expect.stringMatching(/Team\/access\.md failed; refusing to decide/));
+    // ...and says so in the logs.
+    expect(warn).toHaveBeenCalledWith(expect.stringMatching(/access tree failed; refusing to decide/));
 
     // Nothing was pinned: the next call rebuilds, answers correctly, and
     // that healthy build is the one that gets cached.
@@ -267,7 +366,7 @@ describe('AccessControlService — at-ref model cache', () => {
     expect(lsTreeBuilds()).toBe(2);
   });
 
-  it('does not cache a commit with no roles.yaml, and keeps answering null for it', async () => {
+  it('remembers a commit with no roles.yaml, and keeps answering null for it without another read', async () => {
     await git(other, 'checkout', '-qb', 'bare');
     await git(other, 'rm', '-q', 'roles.yaml');
     await git(other, 'commit', '-qm', 'no roles here');
@@ -276,9 +375,188 @@ describe('AccessControlService — at-ref model cache', () => {
     spawnLog.length = 0;
     expect(await svc.canWriteAtRef(workspaceId, 'origin/bare', admin, DOC)).toBeNull();
     expect(await svc.canWriteAtRef(workspaceId, 'origin/bare', admin, DOC)).toBeNull();
-    // Each call went back to git for roles.yaml (nothing was remembered),
-    // and neither ever got as far as walking the tree.
-    expect(rolesReads()).toBe(2);
-    expect(lsTreeBuilds()).toBe(0);
+    // Git said "missing" for roles.yaml at that commit once, which is as
+    // final as the commit; the second call read nothing.
+    expect(lsTreeBuilds()).toBe(1);
+    expect(catFileBatches()).toBe(1);
+    expect(fileShows()).toBe(0);
+  });
+
+  it('reads the whole access tree at a commit in two git calls, never one per file', async () => {
+    // The seed holds roles.yaml and two access.md files; a read per file was
+    // what the build used to cost, and what a server forking a large heap
+    // cannot afford.
+    expect(await svc.canWriteAtRef(workspaceId, 'origin/main', admin, DOC)).toBe(true);
+    expect(lsTreeBuilds()).toBe(1);
+    expect(catFileBatches()).toBe(1);
+    expect(fileShows()).toBe(0);
+    // Both access files were read through the batch: Team's denial is seen.
+    await pushFromOther('deny Admin in Team', () =>
+      fs.writeFile(path.join(other, 'Team/access.md'), '---\nwrite:\n  - deny Admin\n---\n'),
+    );
+    expect(await svc.canWriteAtRef(workspaceId, 'origin/main', admin, DOC)).toBe(false);
+    expect(lsTreeBuilds()).toBe(2);
+    expect(catFileBatches()).toBe(2);
+    expect(fileShows()).toBe(0);
+  });
+
+  it('honours an access.md under a folder git would quote in its listing', async () => {
+    // `git ls-tree` prints "\303\211quipe/access.md" unless told `-z`; read
+    // under that spelling nothing comes back, and a denial would be missed.
+    expect(await svc.canWriteAtRef(workspaceId, 'origin/main', admin, QUOTED_DOC)).toBe(false);
+    expect(await svc.canWriteBatchAtRef(workspaceId, 'origin/main', admin, [QUOTED_DOC, DOC])).toEqual(
+      new Map([
+        [QUOTED_DOC, false],
+        [DOC, true],
+      ]),
+    );
+    expect(lsTreeBuilds()).toBe(1);
+    expect(fileShows()).toBe(0);
+  });
+
+  it('answers null for a ref whose roles.yaml is a directory, and never falls through to origin for it', async () => {
+    // `feature` on origin grants the admin; the LOCAL `feature` replaced
+    // roles.yaml with a directory of that name. That is malformed config, as
+    // a roles file that does not parse is: the gate answers null for the
+    // ref, rather than reading the next candidate and granting from it.
+    await git(repo, 'checkout', '-q', '-b', 'feature');
+    await git(repo, 'push', '-q', '-u', 'origin', 'feature');
+    await git(repo, 'rm', '-q', 'roles.yaml');
+    await fs.mkdir(path.join(repo, 'roles.yaml'));
+    await fs.writeFile(path.join(repo, 'roles.yaml/README.md'), 'not roles\n');
+    await git(repo, 'add', '-A');
+    await git(repo, 'commit', '-qm', 'roles.yaml is a folder now');
+
+    spawnLog.length = 0;
+    expect(await svc.canWriteAtRef(workspaceId, 'feature', admin, DOC)).toBeNull();
+    expect(lsTreeBuilds()).toBe(1);
+  });
+
+  it('refuses to decide, twice, for a ref whose roles.yaml blob is lost, and never falls through to a granting origin', async () => {
+    // `feature` on origin carries a roles.yaml that grants the admin. The
+    // LOCAL `feature` is one commit ahead, with a roles.yaml of its own
+    // whose blob is then lost from the object store (real git: the loose
+    // object file removed). The tree still names roles.yaml, so the batch's
+    // "missing" is an unreadable file, not an absent one: the build must
+    // fail closed on both attempts, remember nothing for the commit, and
+    // never read the next candidate, origin/feature, which would grant.
+    await git(repo, 'checkout', '-q', '-b', 'feature');
+    await fs.writeFile(path.join(repo, 'roles.yaml'), 'roles:\n  Admin:\n    - razvan@bevel.software\n# on origin\n');
+    await git(repo, 'commit', '-qam', 'roles on origin/feature');
+    await git(repo, 'push', '-q', '-u', 'origin', 'feature');
+    await fs.writeFile(path.join(repo, 'roles.yaml'), 'roles:\n  Admin:\n    - razvan@bevel.software\n# local only\n');
+    await git(repo, 'commit', '-qam', 'roles on the local feature tip');
+    const lost = await git(repo, 'rev-parse', 'HEAD:roles.yaml');
+    await fs.rm(path.join(repo, '.git/objects', lost.slice(0, 2), lost.slice(2)));
+
+    spawnLog.length = 0;
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    for (const attempt of [1, 2]) {
+      await expect(svc.canWriteAtRef(workspaceId, 'feature', admin, DOC)).rejects.toBeInstanceOf(
+        AccessUnreadableError,
+      );
+      // One listing per attempt: the local tip, and never origin/feature.
+      expect(lsTreeBuilds()).toBe(attempt);
+      expect(catFileBatches()).toBe(attempt);
+    }
+    expect(warn).toHaveBeenCalledWith(expect.stringMatching(/roles\.yaml is in the tree but its blob could not be read/));
+  });
+
+  it.each(['synced-groups.yaml', 'groups.yaml'])(
+    'refuses to decide, twice, for a ref whose %s blob is lost, and never reads it as absent',
+    async (file) => {
+      // The groups source the model reads at origin/main — the synced file,
+      // which supersedes a manual one still naming a retired team, or the
+      // manual file alone — has its blob lost from the workspace's object
+      // store (real git: the loose object file removed after the fetch).
+      // The tree still names it, so the batch's "missing" is an unreadable
+      // file, not an absent one: the build fails closed on both attempts and
+      // remembers nothing. Reading the synced file as absent would revive
+      // the manual groups; reading the manual one as absent would drop what
+      // it grants.
+      await pushFromOther(`${file} on main`, async () => {
+        if (file === 'synced-groups.yaml') {
+          await fs.writeFile(path.join(other, 'synced-groups.yaml'), 'groups:\n  Platform:\n    - zoe@x.io\n');
+        }
+        await fs.writeFile(path.join(other, 'groups.yaml'), 'groups:\n  Retired Team:\n    - ghost@x.io\n');
+      });
+      await git(repo, 'fetch', '-q', 'origin');
+      const lost = await git(repo, 'rev-parse', `origin/main:${file}`);
+      await fs.rm(path.join(repo, '.git/objects', lost.slice(0, 2), lost.slice(2)));
+
+      spawnLog.length = 0;
+      const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+      for (const attempt of [1, 2]) {
+        await expect(svc.canWriteAtRef(workspaceId, 'origin/main', admin, DOC)).rejects.toBeInstanceOf(
+          AccessUnreadableError,
+        );
+        expect(lsTreeBuilds()).toBe(attempt);
+        expect(catFileBatches()).toBe(attempt);
+      }
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringMatching(new RegExp(`${file.replaceAll('.', '\\.')} is in the tree but its blob could not be read`)),
+      );
+    },
+  );
+
+  it('refuses to decide when a groups source is a directory rather than a file', async () => {
+    await pushFromOther('groups.yaml as a folder', async () => {
+      await fs.mkdir(path.join(other, 'groups.yaml'));
+      await fs.writeFile(path.join(other, 'groups.yaml/README.md'), 'not groups\n');
+    });
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    await expect(svc.canWriteAtRef(workspaceId, 'origin/main', admin, DOC)).rejects.toBeInstanceOf(
+      AccessUnreadableError,
+    );
+    expect(warn).toHaveBeenCalledWith(expect.stringMatching(/groups\.yaml is a tree, not a file; refusing to decide/));
   });
+
+  it.each([
+    ['access.md', 'missing', /:Team\/access\.md$/, /Team\/access\.md is in the tree but its blob could not be read/],
+    ['access.md', 'a tree', /:Team\/access\.md$/, /Team\/access\.md is a tree, not a file/],
+    ['plugin manifest', 'missing', /:Plugins\/Demo\/plugin\.json$/, /Plugins\/Demo\/plugin\.json is in the tree but its blob could not be read/],
+    ['plugin manifest', 'a tree', /:Plugins\/Demo\/plugin\.json$/, /Plugins\/Demo\/plugin\.json is a tree, not a file/],
+  ])('refuses to decide when a listed %s comes back %s from the batch, and never caches it', async (_what, how, spec, warned) => {
+    // A healthy git cannot be made to answer this: the listing names blobs
+    // only, and a commit's objects do not change between two reads of it.
+    // The batch's reply is rewritten at the process boundary instead, so the
+    // build's refusal of a listed path it could not read is pinned all the
+    // same: a model missing that file could grant what the file denies.
+    injected.rewriteNext = (argv) =>
+      argv.includes('cat-file') ? rewriteBatchRecord(spec, how === 'missing' ? 'missing' : 'tree') : null;
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+    const batchesBefore = catFileBatches();
+    await expect(svc.canWriteAtRef(workspaceId, 'origin/main', admin, DOC)).rejects.toBeInstanceOf(
+      AccessUnreadableError,
+    );
+    expect(injected.rewriteNext).toBeNull();
+    expect(warn).toHaveBeenCalledWith(expect.stringMatching(warned));
+    // ...and nothing was pinned: the next call, with git answering in full,
+    // builds again and answers.
+    expect(await svc.canWriteAtRef(workspaceId, 'origin/main', admin, DOC)).toBe(true);
+    expect(catFileBatches()).toBe(batchesBefore + 2);
+  });
+
+  it('holds the models of far more commits than one listing resolves', async () => {
+    // A listing resolves access at every open change request's two refs: a
+    // knowledge base with a hundred open requests spans a hundred commits.
+    // Under the old bound of 64 that evicted in a cycle, so every listing
+    // rebuilt every model. Each commit here is a distinct tip; after seventy
+    // of them, past that old bound, the first is still held.
+    const shas: string[] = [];
+    for (let i = 0; i < 70; i++) {
+      await fs.writeFile(path.join(other, 'Team/Doc.md'), `# doc ${i}\n`);
+      await git(other, 'add', '-A');
+      await git(other, 'commit', '-qm', `edit ${i}`);
+      shas.push(await git(other, 'rev-parse', 'HEAD'));
+    }
+    await git(other, 'push', '-q', 'origin', 'HEAD');
+    await git(repo, 'fetch', '-q', 'origin');
+    spawnLog.length = 0;
+    for (const sha of shas) expect(await svc.canWriteAtRef(workspaceId, sha, admin, DOC)).toBe(true);
+    expect(lsTreeBuilds()).toBe(70);
+    expect(await svc.canWriteAtRef(workspaceId, shas[0]!, admin, DOC)).toBe(true);
+    expect(await svc.canWriteAtRef(workspaceId, shas[35]!, admin, DOC)).toBe(true);
+    expect(lsTreeBuilds()).toBe(70);
+  }, 120_000);
 });

package/src/modules/access/__tests__/access-control.download-read.test.ts

@@ -102,7 +102,9 @@ describe('download implies read', () => {
         'access.md': '---\n---\ndownload:\n  - Product Manager\n',
       });
       expect(await svc.canRead(workspaceId, 'pm@x.io', 'Knowledge/Deal.md')).toBe(true);
-      expect(await svc.canRead(workspaceId, 'admin@x.io', 'Knowledge/Deal.md')).toBe(false);
+      // Nobody else: the fold adds no grant that was not written. (An admin
+      // reads here too, through the root floor, not through this fold.)
+      expect(await svc.canRead(workspaceId, 'mallory@x.io', 'Knowledge/Deal.md')).toBe(false);
     });
 
     it('for a GROUP grant', async () => {