canopycms 0.0.68-int.98 → 0.1.0

package/dist/worker/rebase.js

@@ -1,6 +1,5 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { simpleGit } from 'simple-git';
 import { BranchMetadataFileManager, buildMergedBranchUpdate, getBranchMetadataFileManager, } from '../branch-metadata.js';
 import { extractIdFromFilename } from '../content-id-index.js';
 import { invalidateBranchContentCaches } from '../content-index-generation.js';
@@ -14,6 +13,7 @@ import { isCanopyInternalPath, isRebaseInProgress } from '../utils/git.js';
 import { TRACKED_CANOPY_STATE_FIX, restoreRetiredSchemaCache, splitByUpstreamTracking, trackedCanopyStateChanges, } from './canopy-state.js';
 import { enqueueGitHubPush, forcePublishToLocalRemote, markHistoryRewritten, readPublishedSha, reconcilePendingRewrite, } from './history-rewrite.js';
 import { workerLog, workerLogWarn } from './log.js';
+import { SHARED_REPO_STATUS_ARGS, assertNoIncomingSubmodules, assertSharedRepoConfig, fetchFromRemoteGit, sharedRepoGit, } from './shared-repo-git.js';
 /**
  * Poll GitHub for a submitted/approved branch's PR resolution. Those branches
  * sit outside the rebase loop and get no other signal that their PR resolved --
@@ -32,12 +32,7 @@ export async function pollMergeState(ctx, branchDir, branchPath, metaFile) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), ctx.taskTimeoutMs);
     try {
-        const { data } = await ctx.octokit().pulls.get({
-            owner: ctx.githubOwner,
-            repo: ctx.githubRepo,
-            pull_number: prNumber,
-            request: { signal: controller.signal },
-        });
+        const data = await ctx.github().getPullRequest(prNumber, controller.signal);
         if (data.merged) {
             const meta = getBranchMetadataFileManager(branchPath, ctx.contentBranchesPath);
             // GitHub's actual merge time when available; buildMergedBranchUpdate
@@ -176,7 +171,7 @@ async function runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, isLock
         }
         catch (rebaseErr) {
             nextAction = 'continue';
-            const st = await branchGit.status();
+            const st = await branchGit.status([...SHARED_REPO_STATUS_ARGS]);
             if (st.conflicted.length > 0) {
                 await ctx.afterConflictDetectedForTesting();
                 // During rebase, --theirs = the branch being replayed (the editor's
@@ -199,20 +194,23 @@ async function runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, isLock
                 //
                 // A per-file resolution that STILL fails routes into the `!completed`
                 // path below, which aborts and records, rather than escaping.
+                //
+                // `--sparse` on add/rm: a conflicted path outside a sparse clone's cone
+                // is materialised for the conflict, but git refuses to stage it without.
                 const conflictKind = new Map(st.files.map((f) => [f.path, `${f.index}${f.working_dir}`]));
                 let resolutionFailure;
                 for (const file of st.conflicted) {
                     const kind = conflictKind.get(file);
                     try {
                         if (kind === 'UD') {
-                            await branchGit.raw(['rm', '-f', '--', file]);
+                            await branchGit.raw(['rm', '-f', '--sparse', '--', file]);
                         }
                         else if (kind === 'DU') {
-                            await branchGit.add(file);
+                            await branchGit.raw(['add', '--sparse', '--', file]);
                         }
                         else {
-                            await branchGit.raw(['checkout', '--theirs', file]);
-                            await branchGit.add(file);
+                            await branchGit.raw(['checkout', '--theirs', '--', file]);
+                            await branchGit.raw(['add', '--sparse', '--', file]);
                         }
                     }
                     catch (resolveErr) {
@@ -242,9 +240,7 @@ async function runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, isLock
                 else {
                     // Unexpected error — abort and leave the branch behind.
                     // conflictStatus/conflictFiles are deliberately not updated: the
-                    // rebase did not complete, so the true conflict state is unknown, and
-                    // the existing (possibly stale) metadata is preserved until the next
-                    // successful rebase cycle corrects it.
+                    // rebase did not complete, so it replaced nothing to record.
                     workerLogWarn(`  Unexpected rebase error in ${branchDir}: ${msg || 'Unknown error'}`);
                     failureReason = msg || 'Unknown error';
                     await branchGit.rebase(['--abort']).catch(() => { });
@@ -304,6 +300,21 @@ function conflictFilesToContentIds(conflictedFiles, contentRoot) {
         .filter((id) => id !== null);
     return [...new Set(conflictIds)];
 }
+/**
+ * The conflict record after a rebase: the IDs already recorded plus this
+ * rebase's. A conflict means this branch's version replaced base's change to
+ * that entry, which a later clean rebase does not undo, so the record only
+ * grows until the branch merges (buildMergedBranchUpdate clears it).
+ *
+ * Pure.
+ */
+function recordConflicts(recorded, found) {
+    const conflictFiles = [...new Set([...(recorded ?? []), ...found])];
+    return {
+        conflictStatus: conflictFiles.length > 0 ? 'conflicts-detected' : 'clean',
+        conflictFiles,
+    };
+}
 /**
  * [SYNC-H1] Carry a just-rebased history forward into `remote.git`, and queue
  * the GitHub hop.
@@ -378,6 +389,12 @@ export async function runRebaseCycle(ctx) {
         return { rebased, skippedDirty, skippedLocked, failed };
     }
     for (const branchDir of branchDirs) {
+        // A draining worker finishes the branch it is rebasing and starts no other:
+        // a rebase killed mid-branch is recovered lossily on the next boot.
+        if (ctx.isDraining()) {
+            workerLog('  Rebase cycle stopped: the worker is draining');
+            break;
+        }
         // Known structural entries under content-branches/, not branch workspaces:
         // branches.json (registry snapshot) and dot-prefixed entries
         // (.canopy-meta/, transient lock dirs). Skipped SILENTLY so the no-.git
@@ -436,7 +453,7 @@ export async function runRebaseCycle(ctx) {
 /**
  * {@link rebaseOneBranch} under the branch's provisioning lock, so no git step races a clone of
  * this directory. A branch whose lock is held elsewhere is `skippedLocked` and retried next cycle;
- * one with no `branch.json` yet is skipped as not provisioned. Lock order: provisioning, then the
+ * one with no `branch.json` is skipped. Lock order: provisioning, then the
  * content-write lock inside it; see `provisioned-workspace.ts` for why that order cannot deadlock.
  * Never throws, like rebaseOneBranch.
  */
@@ -455,10 +472,10 @@ async function holdAndRebaseOneBranch(ctx, branchDir, branchPath) {
         workerLog(`  Skipping ${branchDir}: provisioning lock held elsewhere (retrying next cycle)`);
         return { kind: 'skippedLocked' };
     }
-    if (hold.kind === 'not-provisioned') {
-        workerLog(`  Skipping ${branchDir}: not yet provisioned (no branch.json)`);
+    // Silent: a directory without branch.json is a staging-era leftover, which
+    // repairBranchDirResidue (git-sync.ts) quarantines and logs at the cycle's start.
+    if (hold.kind === 'not-provisioned')
         return { kind: 'none' };
-    }
     try {
         return await rebaseOneBranch(ctx, branchDir, branchPath, hold.isCompromised);
     }
@@ -499,15 +516,11 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             workerLog(`  Skipping ${branchDir} (${branchStatus})`);
             return { kind: 'none' };
         }
-        const branchGit = simpleGit({
-            baseDir: branchPath,
-            // Keep git non-interactive during rebase/merge so it never blocks on an
-            // editor. simple-git >=3.32 requires opting in to set core.editor; the
-            // value is a hardcoded literal ("true", the shell no-op), not user input,
-            // so allowUnsafeEditor carries no injection risk here.
-            config: ['core.editor=true'],
-            unsafe: { allowUnsafeEditor: true },
-        });
+        // Throws into the catch below, which records the refusal on the branch: a planted key here
+        // would run in this worker's rebase, merge and checkout.
+        await assertSharedRepoConfig(branchPath, 'worktree');
+        // The pins also keep git non-interactive (core.editor=true): a rebase never waits on an editor.
+        const branchGit = sharedRepoGit(branchPath, 'worktree');
         // [SYNC-C1] Take the branch's cross-host content-write lock BEFORE the
         // dirty check, and hold it for the whole rebase. The dirty check alone is
         // check-then-act, and its residual window spans fetch, replay and N
@@ -574,7 +587,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             // happen SILENTLY, so anything modified beyond the rebase's own conflict
             // state is logged by path first. That log is the operator's only record.
             if (await isRebaseInProgress(branchPath)) {
-                const preAbort = await branchGit.status().catch(() => null);
+                const preAbort = await branchGit.status([...SHARED_REPO_STATUS_ARGS]).catch(() => null);
                 // Keyed on the WORKING-TREE column ONLY. The two porcelain columns mean
                 // different things here, and conflating them reports false data loss on
                 // essentially every conflict-wedged recovery (verified against real
@@ -621,10 +634,10 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             // Skip dirty branches — the editor has changes that cannot be rebased.
             // Inside the lock, so no write can land between this check and the rebase
             // below. canopycms's own untracked state is not dirt.
-            let dirtyCheck = await branchGit.status();
+            let dirtyCheck = await branchGit.status([...SHARED_REPO_STATUS_ARGS]);
             if (await restoreRetiredSchemaCache(branchGit, dirtyCheck)) {
                 workerLog(`  ${branchDir}: restored the retired in-tree schema cache`);
-                dirtyCheck = await branchGit.status();
+                dirtyCheck = await branchGit.status([...SHARED_REPO_STATUS_ARGS]);
             }
             const editorDirt = dirtyCheck.files.filter((f) => !isCanopyInternalPath(f.path));
             if (editorDirt.length > 0) {
@@ -638,7 +651,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             // the bytes stay untouched, and the wedge is recorded for an operator.
             const trackedState = trackedCanopyStateChanges(dirtyCheck);
             if (trackedState.length > 0) {
-                await branchGit.fetch(ctx.remoteGitPath, ctx.baseBranch);
+                await fetchFromRemoteGit(branchGit, ctx.remoteGitPath, ctx.baseBranch);
                 const baseTip = (await branchGit.revparse(['FETCH_HEAD'])).trim();
                 const { stillTracked } = await splitByUpstreamTracking(branchGit, trackedState, baseTip);
                 const reason = stillTracked.length > 0
@@ -672,7 +685,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                     marker: metaFile.branch.historyRewrittenFrom,
                 });
             }
-            await branchGit.fetch(ctx.remoteGitPath, ctx.baseBranch);
+            await fetchFromRemoteGit(branchGit, ctx.remoteGitPath, ctx.baseBranch);
             // rev-list, not status.behind, which needs an upstream tracking branch
             // that checkoutBranch's fallback paths do not always configure. Against
             // the just-fetched tip: a fetch by path updates no remote-tracking ref.
@@ -691,26 +704,17 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
                 // `metaFile` snapshot from before the fetch/rev-list above, so a
                 // concurrent editor-driven metadata change in that window is not
                 // clobbered by a stale skip decision.
+                //
+                // Catching up leaves the conflict record alone: it names entries whose
+                // base change this branch's version replaced, which stays true until
+                // the branch merges (see recordConflicts). A lingering rebaseFailure
+                // is cleared, or it sticks as a stale warning forever: nothing else
+                // touches a caught-up branch, so no other save site clears it.
                 const currentMeta = await BranchMetadataFileManager.loadOnly(branchPath);
-                const conflictStatus = currentMeta?.branch.conflictStatus;
-                const conflictFiles = currentMeta?.branch.conflictFiles;
-                const conflictAlreadyClean = (conflictStatus === undefined || conflictStatus === 'clean') &&
-                    (conflictFiles === undefined || conflictFiles.length === 0);
-                // A lingering rebaseFailure must also be cleared once the branch
-                // catches up clean, or it sticks as a stale warning forever: nothing
-                // else touches a caught-up branch, so no other save site clears it.
-                const alreadyClean = conflictAlreadyClean && currentMeta?.branch.rebaseFailure === undefined;
-                if (alreadyClean) {
+                if (currentMeta?.branch.rebaseFailure === undefined) {
                     return { kind: 'none' };
                 }
-                await meta.save({
-                    branch: {
-                        name: branchDir,
-                        conflictStatus: 'clean',
-                        conflictFiles: [],
-                        rebaseFailure: undefined,
-                    },
-                });
+                await meta.save({ branch: { name: branchDir, rebaseFailure: undefined } });
                 return { kind: 'none' };
             }
             workerLog(`Rebasing ${branchDir} (${behindCount} commits behind)...`);
@@ -720,6 +724,7 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             // the rebase makes unreadable.
             const preRebaseHead = (await branchGit.revparse(['HEAD'])).trim();
             const publishedSha = canPublish ? await readPublishedSha(ctx, branchRef) : null;
+            await assertNoIncomingSubmodules(branchGit, branchPath, preRebaseHead, fetchedBaseTip);
             const { completed, conflictedFiles, failureReason } = await runRebaseRounds(ctx, branchGit, branchDir, fetchedBaseTip, lockCompromised);
             // Outside the round loop's try/catch, so a throwing test hook can
             // never be misread as a rebase error.
@@ -785,16 +790,15 @@ async function rebaseOneBranch(ctx, branchDir, branchPath, isProvisioningLockCom
             workerLog(hadConflicts
                 ? `  Rebased ${branchDir} (kept branch version for ${conflictIdsDeduped.length} conflicting file(s))`
                 : `  Rebased ${branchDir} successfully`);
-            await meta.save({
+            await meta.update((existing) => ({
                 branch: {
                     name: branchDir,
-                    conflictStatus: hadConflicts ? 'conflicts-detected' : 'clean',
-                    conflictFiles: conflictIdsDeduped,
+                    ...recordConflicts(existing?.branch.conflictFiles, conflictIdsDeduped),
                     // The cycle completed, so clear any prior failure record regardless
                     // of the conflict outcome.
                     rebaseFailure: undefined,
                 },
-            });
+            }));
             didRebase = true;
             await carryForwardRewrittenHistory(ctx, {
                 branchPath,

package/dist/worker/remote-git-maintenance.d.ts

@@ -0,0 +1,3 @@
+import { type BareRemoteRepackResult } from '../git-manager.js';
+/** The worker's per-cycle repack of `remote.git` (git-manager.ts owns the rule), logged. */
+export declare function maintainRemoteGit(gitDir: string): Promise<BareRemoteRepackResult>;

package/dist/worker/remote-git-maintenance.js

@@ -0,0 +1,12 @@
+import { repackBareRemoteIfNeeded } from '../git-manager.js';
+import { workerLog } from './log.js';
+import { sharedRepoGit } from './shared-repo-git.js';
+/** The worker's per-cycle repack of `remote.git` (git-manager.ts owns the rule), logged. */
+export async function maintainRemoteGit(gitDir) {
+    const result = await repackBareRemoteIfNeeded(gitDir, sharedRepoGit(gitDir, 'bare'));
+    if (result.repacked) {
+        workerLog(`remote.git maintenance: loose ${result.before.loose}→${result.after.loose} ` +
+            `packs ${result.before.packs}→${result.after.packs} in ${result.ms} ms`);
+    }
+    return result;
+}

package/dist/worker/schema-gate.d.ts

@@ -0,0 +1,49 @@
+import type { simpleGit } from 'simple-git';
+import type { BaseSchemaHold } from '../types.js';
+/** How long the base branch may wait for its oldest missing schema before the worker advances it anyway. */
+export declare const DEFAULT_SCHEMA_HOLD_MAX_MS: number;
+type Git = ReturnType<typeof simpleGit>;
+export type SchemaGateDecision = {
+    kind: 'advance';
+}
+/** Advance anyway: the oldest missing schema has waited its bound. `hold` names them all. */
+ | {
+    kind: 'advance-expired';
+    hold: BaseSchemaHold;
+} | {
+    kind: 'hold';
+    hold: BaseSchemaHold;
+};
+/**
+ * The hold in the status file a previous worker process left, so a restart or a lock takeover
+ * keeps each schema's first-seen time and cannot reset the bound. Tolerant: an unreadable or
+ * malformed file carries nothing.
+ */
+export declare function readCarriedBaseHold(taskDir: string): Promise<BaseSchemaHold | undefined>;
+/**
+ * Whether the base branch may fast-forward from `currentSha` to `incomingSha` while the serving
+ * editor runs the registry in the schema-registry record (schema-registry-record.ts).
+ *
+ * Holds only for a name that a `.collection.json` changed between the two tips references at the
+ * incoming one, that the record lacks, and that the current base does not already reference:
+ * holding cannot repair a reference already live, and a merge that changes no collection meta
+ * reads no meta blob but those of symlinks.
+ *
+ * Fails open: with no readable record (an editor too old to write one, one not yet started, a
+ * failed write), or when the trees cannot be read, the base advances as if there were no gate.
+ * When each name was first seen missing is carried in `previous.firstSeen` across cycles and
+ * worker restarts; once the oldest missing name has waited `maxHoldMs` the base advances with an
+ * error naming them, since a name no deploy will ever supply would otherwise freeze every content
+ * update.
+ */
+export declare function decideBaseAdvance(input: {
+    git: Git;
+    contentBranchesPath: string;
+    baseBranch: string;
+    currentSha: string;
+    incomingSha: string;
+    previous: BaseSchemaHold | undefined;
+    maxHoldMs: number;
+    now?: Date;
+}): Promise<SchemaGateDecision>;
+export {};

package/dist/worker/schema-gate.js

@@ -0,0 +1,226 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { readSchemaRegistryRecord } from '../schema-registry-record.js';
+import { WORKER_STATUS_FILE } from '../task-queue/worker-status.js';
+import { getErrorMessage } from '../utils/error.js';
+import { MAX_REPORTED_PATHS } from './canopy-state.js';
+import { workerLogError, workerLogWarn } from './log.js';
+/** How long the base branch may wait for its oldest missing schema before the worker advances it anyway. */
+export const DEFAULT_SCHEMA_HOLD_MAX_MS = 30 * 60_000;
+const COLLECTION_META_FILE = '.collection.json';
+const SYMLINK_MODE = '120000';
+/**
+ * `contentRoot` as a literal pathspec: repo-relative with no `./` or trailing slash, or null for
+ * the repository root. Literal, so a directory named like pathspec magic (`:x`) reads as itself.
+ */
+function contentPathspec(contentRoot) {
+    const normalized = path.posix.normalize(contentRoot.replace(/\\/g, '/')).replace(/\/+$/, '');
+    return normalized === '.' || normalized === '' ? null : `:(literal)${normalized}`;
+}
+function withPathspec(args, pathspec) {
+    return pathspec ? [...args, '--', pathspec] : args;
+}
+/** Schema names a `.collection.json` blob's entry types reference; none when it does not parse. */
+function referencedSchemas(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return [];
+    }
+    if (typeof parsed !== 'object' || parsed === null || !('entries' in parsed))
+        return [];
+    const { entries } = parsed;
+    if (!Array.isArray(entries))
+        return [];
+    const names = [];
+    for (const entry of entries) {
+        if (typeof entry !== 'object' || entry === null || !('schema' in entry))
+            continue;
+        if (typeof entry.schema === 'string' && entry.schema.length > 0)
+            names.push(entry.schema);
+    }
+    return names;
+}
+/** Every `.collection.json` under `pathspec` at `commit`, by repo-relative path. */
+async function listCollectionMeta(git, commit, pathspec) {
+    const listing = await git.raw(withPathspec(['ls-tree', '-r', '-z', '--full-tree', commit], pathspec));
+    const entries = new Map();
+    for (const line of listing.split('\0')) {
+        // `<mode> <type> <oid>\t<path>`
+        const tab = line.indexOf('\t');
+        if (tab < 0)
+            continue;
+        const filePath = line.slice(tab + 1);
+        if (path.posix.basename(filePath) !== COLLECTION_META_FILE)
+            continue;
+        const [mode, type, oid] = line.slice(0, tab).split(' ');
+        if (type === 'blob' && mode && oid)
+            entries.set(filePath, { mode, oid });
+    }
+    return entries;
+}
+/**
+ * The schema names one meta file references at `commit`. A symlink is followed one hop, to a
+ * relative target inside the repository; the editor's `fs.readFile` follows every hop, so a
+ * longer chain or an absolute target reads as no references and fails open.
+ */
+async function metaReferences(git, commit, filePath, entry, blobCache) {
+    if (entry.mode !== SYMLINK_MODE) {
+        const cached = blobCache.get(entry.oid);
+        if (cached)
+            return cached;
+        const names = referencedSchemas(await git.raw(['cat-file', 'blob', entry.oid]));
+        blobCache.set(entry.oid, names);
+        return names;
+    }
+    const linkText = await git.raw(['cat-file', 'blob', entry.oid]);
+    const target = path.posix.normalize(path.posix.join(path.posix.dirname(filePath), linkText));
+    if (target.startsWith('../') || path.posix.isAbsolute(target))
+        return [];
+    try {
+        return referencedSchemas(await git.raw(['cat-file', 'blob', `${commit}:${target}`]));
+    }
+    catch {
+        return [];
+    }
+}
+const isString = (value) => typeof value === 'string';
+const isStringArray = (value) => Array.isArray(value) && value.every(isString);
+function isBaseSchemaHold(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const hold = value;
+    const { firstSeen, editorBuild } = hold;
+    return (isString(hold.since) &&
+        typeof firstSeen === 'object' &&
+        firstSeen !== null &&
+        Object.values(firstSeen).every(isString) &&
+        isString(hold.incomingSha) &&
+        isStringArray(hold.missingSchemas) &&
+        isStringArray(hold.files) &&
+        typeof hold.fileCount === 'number' &&
+        typeof editorBuild === 'object' &&
+        editorBuild !== null &&
+        'canopycmsVersion' in editorBuild &&
+        isString(editorBuild.canopycmsVersion) &&
+        isString(hold.editorRecordedAt) &&
+        (hold.expired === undefined || hold.expired === true));
+}
+/**
+ * The hold in the status file a previous worker process left, so a restart or a lock takeover
+ * keeps each schema's first-seen time and cannot reset the bound. Tolerant: an unreadable or
+ * malformed file carries nothing.
+ */
+export async function readCarriedBaseHold(taskDir) {
+    try {
+        const parsed = JSON.parse(await fs.readFile(path.join(taskDir, WORKER_STATUS_FILE), 'utf-8'));
+        if (typeof parsed !== 'object' || parsed === null || !('baseHold' in parsed))
+            return undefined;
+        return isBaseSchemaHold(parsed.baseHold) ? parsed.baseHold : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Whether the base branch may fast-forward from `currentSha` to `incomingSha` while the serving
+ * editor runs the registry in the schema-registry record (schema-registry-record.ts).
+ *
+ * Holds only for a name that a `.collection.json` changed between the two tips references at the
+ * incoming one, that the record lacks, and that the current base does not already reference:
+ * holding cannot repair a reference already live, and a merge that changes no collection meta
+ * reads no meta blob but those of symlinks.
+ *
+ * Fails open: with no readable record (an editor too old to write one, one not yet started, a
+ * failed write), or when the trees cannot be read, the base advances as if there were no gate.
+ * When each name was first seen missing is carried in `previous.firstSeen` across cycles and
+ * worker restarts; once the oldest missing name has waited `maxHoldMs` the base advances with an
+ * error naming them, since a name no deploy will ever supply would otherwise freeze every content
+ * update.
+ */
+export async function decideBaseAdvance(input) {
+    const { git, baseBranch, currentSha, incomingSha, previous, maxHoldMs } = input;
+    const now = input.now ?? new Date();
+    let record;
+    try {
+        record = await readSchemaRegistryRecord(input.contentBranchesPath);
+    }
+    catch (err) {
+        workerLogWarn(`Schema gate (${baseBranch}): could not read the schema-registry record, not holding: ${getErrorMessage(err)}`);
+        return { kind: 'advance' };
+    }
+    if (!record)
+        return { kind: 'advance' };
+    // Name -> the incoming meta files referencing it, for names the record lacks.
+    const missing = new Map();
+    try {
+        const pathspec = contentPathspec(record.contentRoot);
+        const diff = await git.raw(withPathspec(['diff-tree', '-r', '-z', '--name-only', '--no-renames', currentSha, incomingSha], pathspec));
+        const changed = new Set(diff.split('\0').filter((file) => path.posix.basename(file) === COLLECTION_META_FILE));
+        const incomingMeta = await listCollectionMeta(git, incomingSha, pathspec);
+        // A symlink's target can change without the link itself changing.
+        for (const [file, entry] of incomingMeta)
+            if (entry.mode === SYMLINK_MODE)
+                changed.add(file);
+        const known = new Set(record.schemas);
+        const blobCache = new Map();
+        for (const file of changed) {
+            const entry = incomingMeta.get(file);
+            if (!entry)
+                continue;
+            for (const name of await metaReferences(git, incomingSha, file, entry, blobCache)) {
+                if (!known.has(name))
+                    missing.set(name, [...(missing.get(name) ?? []), file]);
+            }
+        }
+        if (missing.size > 0) {
+            for (const [file, entry] of await listCollectionMeta(git, currentSha, pathspec)) {
+                for (const name of await metaReferences(git, currentSha, file, entry, blobCache)) {
+                    missing.delete(name);
+                }
+            }
+        }
+    }
+    catch (err) {
+        workerLogWarn(`Schema gate (${baseBranch}): could not read collection meta, not holding: ${getErrorMessage(err)}`);
+        return { kind: 'advance' };
+    }
+    if (missing.size === 0)
+        return { kind: 'advance' };
+    const missingSchemas = [...missing.keys()].sort();
+    const carried = previous?.firstSeen ?? {};
+    const firstSeenAt = missingSchemas.map((name) => {
+        const at = Object.prototype.hasOwnProperty.call(carried, name)
+            ? Date.parse(carried[name])
+            : Number.NaN;
+        // An unparseable or future carried time restarts that name's wait, never freezes it.
+        return [name, Number.isFinite(at) && at <= now.getTime() ? at : now.getTime()];
+    });
+    // The oldest missing name bounds the hold: past its bound, holding cannot help it, and
+    // waiting on newer names as well would let a stream of schema merges hold the base for good.
+    const sinceMs = Math.min(...firstSeenAt.map(([, at]) => at));
+    const waiting = now.getTime() - sinceMs < maxHoldMs;
+    const files = [...new Set([...missing.values()].flat())].sort();
+    const hold = {
+        since: new Date(sinceMs).toISOString(),
+        // fromEntries defines own properties, so a name like `__proto__` is recorded as itself.
+        firstSeen: Object.fromEntries(firstSeenAt.map(([name, at]) => [name, new Date(at).toISOString()])),
+        incomingSha,
+        missingSchemas,
+        files: files.slice(0, MAX_REPORTED_PATHS),
+        fileCount: files.length,
+        editorBuild: record.build,
+        editorRecordedAt: record.recordedAt,
+    };
+    if (waiting)
+        return { kind: 'hold', hold };
+    workerLogError(`Schema gate (${baseBranch}): held since ${hold.since} for ${missingSchemas.join(', ')} ` +
+        `(referenced by ${hold.files.join(', ')}${files.length > hold.files.length ? ', …' : ''}), ` +
+        `which the serving editor` +
+        `${record.build.sourceRevision ? ` (built from ${record.build.sourceRevision})` : ''} ` +
+        `does not define. Advancing anyway; content types using them are unavailable until an editor ` +
+        `image defining them is deployed.`);
+    return { kind: 'advance-expired', hold: { ...hold, expired: true } };
+}

package/dist/worker/self-checks.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The boot self-checks of the worker process split (.claude/future-tasks/resolved/
+ * worker-shared-repo-git-process-split.md §5): each proves a sandbox layer the split rests on took
+ * effect, because systemd applies some directives silently or not at all (`IPAddressDeny` without
+ * cgroup-BPF). Every check fails closed: what it cannot read counts against it. They only report;
+ * the entrypoint that runs them decides to stop (D3: they are fatal).
+ *
+ * Every path is read under `root` (`/` on an instance), so a test can stand in a fake tree.
+ */
+/** One check's outcome. `detail` names what was seen, never a secret's value. */
+export interface SelfCheckResult {
+    check: SelfCheckName;
+    ok: boolean;
+    detail: string;
+}
+export type SelfCheckName = 'imds' | 'network-namespace' | 'proc' | 'home' | 'secrets-in-env' | 'efs-unreadable' | 'core-pattern' | 'core-limit' | 'socket-access';
+/**
+ * How a TCP connect ended: it connected, it failed with an errno code, or it timed out.
+ * @internal Exported for tests.
+ */
+export type ConnectOutcome = 'connected' | 'timeout' | {
+    code: string;
+};
+export interface SelfCheckEnvironment {
+    /** Where `/proc`, `/home` and `/mnt/efs` are read from. Default `/`. */
+    root?: string;
+    /** The process environment the secret check reads. Default `process.env`. */
+    env?: Readonly<Record<string, string | undefined>>;
+    /** The uid every visible process must have. Default this process's. */
+    uid?: number;
+    /** Test seam: the TCP connect the IMDS check makes. */
+    connect?: (host: string, port: number, timeoutMs: number) => Promise<ConnectOutcome>;
+    /**
+     * The gateway's listening descriptor when systemd passed it (socket activation), which the
+     * `socket-access` check reads. Unset, that check is skipped: a gateway that binds its own path
+     * owns the socket by construction (development).
+     */
+    listenFd?: number;
+}
+/** The worker unit's checks, in the plan's order. */
+export declare function workerSelfChecks(environment?: SelfCheckEnvironment): Promise<SelfCheckResult[]>;
+/** The gateway unit's checks. */
+export declare function gatewaySelfChecks(environment?: SelfCheckEnvironment): Promise<SelfCheckResult[]>;
+/** Throw one error naming every failed check, or return. */
+export declare function assertSelfChecks(results: readonly SelfCheckResult[]): void;
+/**
+ * A TCP connect to IMDS fails with no route (`ENETUNREACH`, or `EAFNOSUPPORT` under
+ * `RestrictAddressFamilies=AF_UNIX`) or times out. Any other outcome, a refusal included, means a
+ * route exists.
+ * @internal Exported for tests.
+ */
+export declare function imdsUnreachable(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * `/proc/self/net/dev` lists only `lo`: `PrivateNetwork=` took effect. Not `/sys/class/net`, which
+ * `PrivateNetwork=` does not remount, so it shows the host's interfaces even inside the cut.
+ * @internal Exported for tests.
+ */
+export declare function onlyLoopback(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * Every process `/proc` lists is this uid's: `ProtectProc=invisible` took effect.
+ * @internal Exported for tests.
+ */
+export declare function procShowsOnlyOwnProcesses(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * `/home` is empty: `ProtectHome=tmpfs`'s always-observable effect. `/run/user`, which it also
+ * hides, is empty anyway whenever nobody is logged in.
+ * @internal Exported for tests.
+ */
+export declare function homeIsEmpty(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * No GitHub or Clerk secret, nor the ARN or JSON field naming one, is in the worker's environment:
+ * they belong to the gateway's env file. Nor is a conventional credential variable (a GitHub token,
+ * the AWS SDK's static credentials). Names only are reported.
+ * @internal Exported for tests.
+ */
+export declare function noSecretsInEnv(environment?: SelfCheckEnvironment): SelfCheckResult;
+/**
+ * The gateway cannot list `/mnt/efs`: `InaccessiblePaths=/mnt/efs` took effect.
+ * @internal Exported for tests.
+ */
+export declare function efsUnreadable(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * `kernel.core_pattern` does not begin with `|`: a piped pattern would hand a crashing gateway
+ * git's memory (the credential file's contents) to a helper.
+ * @internal Exported for tests.
+ */
+export declare function corePatternNotPiped(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * `/proc/self/limits` shows a zero core limit, soft and hard: `LimitCORE=0` took effect.
+ * @internal Exported for tests.
+ */
+export declare function coreLimitZero(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * The socket systemd passed is one only another user (and root) can connect to: its node is not
+ * this process's uid, and grants no group or other access. Whoever owns it is the worker, so a
+ * gateway running as that user (a unit without `User=canopy-github`) would hand the worker its
+ * own environment and memory. A socket's own descriptor reports the creating process (systemd,
+ * root), not the node's owner, so the node is found by the socket's inode in
+ * `/proc/self/net/unix`.
+ * @internal Exported for tests.
+ */
+export declare function socketAccessIsOthers(environment?: SelfCheckEnvironment): Promise<SelfCheckResult>;
+/**
+ * One TCP connect, as the IMDS check makes it.
+ * @internal Exported for tests.
+ */
+export declare function tcpConnect(host: string, port: number, timeoutMs: number): Promise<ConnectOutcome>;