tensorfs 0.3.2__tar.gz → 0.3.3__tar.gz

{tensorfs-0.3.2 → tensorfs-0.3.3}/Cargo.lock

@@ -392,7 +392,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "fs2",
  "minicbor",
@@ -404,7 +404,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.2"
+version = "0.3.3"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.2 → tensorfs-0.3.3}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.2"
+version = "0.3.3"
 edition = "2021"

{tensorfs-0.3.2 → tensorfs-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.2
+Version: 0.3.3
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -336,35 +336,78 @@ pub fn cmd_url(root: &Path, id: &str, length: &str, url: &str, flags: &Flags) ->
     ExitCode::SUCCESS
 }
 
-/// `tfs push <root> <sha256> --url <presigned|-> [--manifest]` — the upload half: one
-/// verified store object to one exact presigned destination, 412 a success under
-/// `If-None-Match: *`.
-pub fn cmd_push(root: &Path, id: &str, flags: &Flags) -> ExitCode {
+/// The push destination, reaching the child exactly the way the credential does (tfs-050) —
+/// never argv, which is world-readable in `/proc`, and a presigned PUT is a bearer secret.
+/// A minted grant is a destination AND the headers its signature covers, so the two travel
+/// as ONE document and there is no spelling that spends the URL without its conditions:
+/// `--grant-file <path>` or one deliberately-set `TFS_PUSH_GRANT`, the URL on the first
+/// line then one `name: value` per signed header. `--url <presigned|->` remains for a bare
+/// destination that signs nothing, `-` reading it from stdin. Exactly one of the three.
+fn grant_of(flags: &Flags) -> Result<transport::UploadGrant, ExitCode> {
     use std::io::BufRead;
+    let file = flag(flags, "grant-file");
+    let environment = std::env::var("TFS_PUSH_GRANT").unwrap_or_default();
+    let url = flag(flags, "url");
+    let given = [
+        file.is_some(),
+        !environment.trim().is_empty(),
+        url.is_some(),
+    ];
+    if given.iter().filter(|named| **named).count() != 1 {
+        eprintln!(
+            "exactly one of --grant-file <path>, TFS_PUSH_GRANT, or --url <presigned|-> \
+             names the destination"
+        );
+        return Err(ExitCode::from(2));
+    }
+    let document = match file {
+        Some(path) => match fs::read_to_string(path) {
+            Ok(text) => Some(text),
+            Err(error) => {
+                eprintln!("REFUSED IO_FAILED: read {path}: {error}");
+                return Err(ExitCode::FAILURE);
+            }
+        },
+        None if !environment.trim().is_empty() => Some(environment),
+        None => None,
+    };
+    if let Some(document) = document {
+        return match transport::UploadGrant::parse(&document) {
+            Ok(grant) => Ok(grant),
+            Err(refusal) => {
+                eprintln!("REFUSED {refusal}");
+                Err(ExitCode::FAILURE)
+            }
+        };
+    }
+    let url = url.unwrap_or_default();
+    if url != "-" {
+        return Ok(transport::UploadGrant::to(url));
+    }
+    let mut line = String::new();
+    if io::stdin().lock().read_line(&mut line).is_err() {
+        eprintln!("REFUSED SOURCE_NOT_ALLOWED: could not read the URL from stdin");
+        return Err(ExitCode::FAILURE);
+    }
+    Ok(transport::UploadGrant::to(line.trim()))
+}
+
+/// `tfs push <root> <sha256> --grant-file <path> [--manifest]` — the upload half: one
+/// verified store object to the one destination a grant names, under the exact headers
+/// its signature covers, 412 a success under `If-None-Match: *`.
+pub fn cmd_push(root: &Path, id: &str, flags: &Flags) -> ExitCode {
     let store = ok!(Store::open(root));
     let sha256 = ok!(tensorfs_core::ids::hex64("push object", id));
-    let Some(url_flag) = flag(flags, "url") else {
-        eprintln!("--url <presigned-put|-> is required");
-        return ExitCode::from(2);
-    };
-    let stdin_url;
-    let url = if url_flag == "-" {
-        let mut line = String::new();
-        if io::stdin().lock().read_line(&mut line).is_err() {
-            eprintln!("REFUSED SOURCE_NOT_ALLOWED: could not read the URL from stdin");
-            return ExitCode::FAILURE;
-        }
-        stdin_url = line.trim().to_string();
-        stdin_url.as_str()
-    } else {
-        url_flag
+    let grant = match grant_of(flags) {
+        Ok(grant) => grant,
+        Err(code) => return code,
     };
     let ledger = transport::Ledger::new();
     let pushed = ok!(transport::push_object(
         &store,
         &sha256,
         crate::flag_on(flags, "manifest"),
-        url,
+        &grant,
         &policy_of(flags),
         &Anonymous,
         deadline_of(flags),

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/bin/tfs/main.rs

@@ -10,6 +10,10 @@
 //! --range <off>:<len> --rate <f> --pass <n> --slow-ms <n>
 //! --size <bytes> --small <n>, plus the dev-only kill points --fault <stage> --ready <path>.
 //!
+//! A Store is created only where someone said to: `tfs store init|ensure <root>`, or the same
+//! verbs over `TENSORFS_HOME`. Every other command REFUSES a root that does not exist, and the
+//! `~/.tensorfs` fallback is opened, never conjured (tfs-053).
+//!
 //!   tfs store init|info <root>
 //!   tfs store ensure [<root>]
 //!   tfs store prepare-readers [<root>]
@@ -36,7 +40,10 @@
 //!   tfs fetch <root> <ref>       closure -> plan -> presign(wanted) -> N-way walk -> proof
 //!   tfs fetch plan-objects <root> <session> --refs <jsonl>   HELD/WANTED, no manifest
 //!   tfs fetch url <root> <sha256> <length> <url|->           one granted object
-//!   tfs push <root> <sha256> --url <presigned|-> [--manifest] [--content-type ct]
+//!   tfs push <root> <sha256> --grant-file <path> [--manifest] [--content-type ct]
+//!            the grant is the destination on line one, then one "name: value" per header
+//!            its signature covers; TFS_PUSH_GRANT carries the same text, and
+//!            --url <presigned|-> is a bare destination that signs no conditions
 //!   tfs source list <hf://org/repo@rev | civitai://id> [--api <base>]  provider listing
 //!   tfs source pull <root> <uri> [--api <base>] [--allow-local]        tfs-052 handlers
 //!   tfs bench-store <root>       put/read/range/rehash throughput + peak RSS
@@ -558,8 +565,10 @@ fn cmd_home_migrate(source: &Path, flags: &Flags) -> ExitCode {
     ExitCode::SUCCESS
 }
 
+/// The no-root spelling of a `store` verb. It uses `TENSORFS_HOME`, or an existing
+/// `$HOME/.tensorfs` — never a Store it would have to invent (tfs-053).
 fn cmd_store_default(verb: &str) -> ExitCode {
-    cmd_store(&ok!(tensorfs_core::home::resolve(None)), verb)
+    cmd_store(&ok!(tensorfs_core::home::store_root(None)), verb)
 }
 
 fn cmd_store(root: &Path, verb: &str) -> ExitCode {
@@ -574,7 +583,7 @@ fn cmd_store(root: &Path, verb: &str) -> ExitCode {
 }
 
 fn cmd_store_prepare_readers(explicit: Option<&Path>) -> ExitCode {
-    let root = ok!(tensorfs_core::home::resolve(explicit));
+    let root = ok!(tensorfs_core::home::store_root(explicit));
     let store = ok!(Store::open(&root));
     ok!(store.prepare_readers());
     println!("root:       {}", store.root().display());
@@ -583,7 +592,7 @@ fn cmd_store_prepare_readers(explicit: Option<&Path>) -> ExitCode {
 }
 
 fn cmd_store_complete_cozytensors(explicit: Option<&Path>) -> ExitCode {
-    let root = ok!(tensorfs_core::home::resolve(explicit));
+    let root = ok!(tensorfs_core::home::store_root(explicit));
     let store = ok!(Store::open(&root));
     for manifest in ok!(store.complete_cozytensors_manifests()) {
         println!("{manifest}");

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/catalog.rs

@@ -861,10 +861,38 @@ pub struct WriterGuard {
     _recovery: File,
 }
 
+/// `tmp/writers` inside a root that already exists.
+///
+/// A writer marker is never the thing that brings a root into being: pointed at an absent path
+/// this used to lay down a directory tree wherever the caller happened to be (tfs-053).
+fn writer_markers(root: &Path) -> Result<PathBuf> {
+    match fs::symlink_metadata(root) {
+        Ok(metadata) if metadata.is_dir() && !metadata.file_type().is_symlink() => {}
+        Ok(_) => {
+            return refuse(
+                Code::STORE_ERA,
+                format!("{} is not a real Store directory", root.display()),
+            )
+        }
+        Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
+            return refuse(
+                Code::STORE_ROOT_ABSENT,
+                format!(
+                    "{} does not exist; create the root before writing into it",
+                    root.display()
+                ),
+            )
+        }
+        Err(error) => return Err(io(format!("stat root {}", root.display()), error)),
+    }
+    let directory = root.join("tmp/writers");
+    fs::create_dir_all(&directory).map_err(|error| io("mkdir writer markers", error))?;
+    Ok(directory)
+}
+
 impl WriterGuard {
     pub fn acquire(root: &Path) -> Result<Self> {
-        let directory = root.join("tmp/writers");
-        fs::create_dir_all(&directory).map_err(|error| io("mkdir writer markers", error))?;
+        let directory = writer_markers(root)?;
         let recovery = File::options()
             .create(true)
             .truncate(false)
@@ -894,8 +922,7 @@ impl WriterGuard {
     }
 
     pub fn lock_rebuild(root: &Path) -> Result<RebuildGuard> {
-        let directory = root.join("tmp/writers");
-        fs::create_dir_all(&directory).map_err(|error| io("mkdir writer markers", error))?;
+        let directory = writer_markers(root)?;
         let recovery = File::options()
             .create(true)
             .truncate(false)

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/err.rs

@@ -83,6 +83,7 @@ codes![
     VECTOR_MISMATCH,
     // object store
     STORE_ERA,
+    STORE_ROOT_ABSENT,
     OBJECT_ABSENT,
     OBJECT_CORRUPT,
     RANGE_BOUNDS,

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/home.rs

@@ -2,6 +2,12 @@
 //!
 //! Core Store operations remain explicit-root. This resolver exists for user-facing entrypoints
 //! and never consults another product's home or configuration.
+//!
+//! A root the operator NAMED — a positional argument or `TENSORFS_HOME` — is a place they asked
+//! for. `$HOME/.tensorfs` is a guess, so it is only ever OPENED: no command conjures a Store
+//! there, and nothing creates a Store in whatever directory a process happens to be run from
+//! (tfs-053). Creation stays with the verbs that say so, `tfs store init` and `tfs store ensure`,
+//! over a root that was named.
 
 use std::fs;
 use std::os::unix::fs::MetadataExt;
@@ -19,10 +25,43 @@ pub struct MoveReport {
     pub destination: PathBuf,
 }
 
+/// Where a resolved root came from. `Named` roots were asked for; `Fallback` is a guess.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Origin {
+    Named,
+    Fallback,
+}
+
 /// Resolve an optional caller-supplied Store root.
 ///
-/// Precedence is explicit argument, `TENSORFS_HOME`, then `$HOME/.tensorfs`.
+/// Precedence is explicit argument, `TENSORFS_HOME`, then `$HOME/.tensorfs`. This answers WHERE
+/// a Store would live; it neither requires nor creates one. `tfs home` prints exactly this.
 pub fn resolve(explicit: Option<&Path>) -> Result<PathBuf> {
+    Ok(resolve_env(explicit)?.0)
+}
+
+/// The Store root of a command that needs a Store.
+///
+/// A named root — argument or `TENSORFS_HOME` — is used as given, and `tfs store init`/`ensure`
+/// may bring it into existence. The `$HOME/.tensorfs` fallback is accepted only for a Store that
+/// ALREADY exists: with nothing named and nothing there, every command refuses instead of
+/// materializing a database nobody asked for.
+pub fn store_root(explicit: Option<&Path>) -> Result<PathBuf> {
+    let (root, origin) = resolve_env(explicit)?;
+    if origin == Origin::Named || root.is_dir() {
+        return Ok(root);
+    }
+    refuse(
+        Code::STORE_ROOT_ABSENT,
+        format!(
+            "no Store root was given and the default {} does not exist: name a root, set {ENV}, \
+             or create one with `tfs store init <root>`",
+            root.display()
+        ),
+    )
+}
+
+fn resolve_env(explicit: Option<&Path>) -> Result<(PathBuf, Origin)> {
     resolve_values(
         explicit,
         std::env::var_os(ENV).map(PathBuf::from).as_deref(),
@@ -34,15 +73,17 @@ fn resolve_values(
     explicit: Option<&Path>,
     tensorfs_home: Option<&Path>,
     user_home: Option<&Path>,
-) -> Result<PathBuf> {
+) -> Result<(PathBuf, Origin)> {
     if let Some(root) = explicit {
-        return nonempty("explicit TensorFS root", root);
+        return Ok((nonempty("explicit TensorFS root", root)?, Origin::Named));
     }
     if let Some(root) = tensorfs_home {
-        return nonempty(ENV, root);
+        return Ok((nonempty(ENV, root)?, Origin::Named));
     }
     match user_home {
-        Some(root) if !root.as_os_str().is_empty() => Ok(root.join(".tensorfs")),
+        Some(root) if !root.as_os_str().is_empty() => {
+            Ok((root.join(".tensorfs"), Origin::Fallback))
+        }
         _ => refuse(
             Code::IO_FAILED,
             "TensorFS root is absent: pass one explicitly, set TENSORFS_HOME, or set HOME",
@@ -162,7 +203,7 @@ mod tests {
                 Some(Path::new("/user")),
             )
             .unwrap(),
-            Path::new("/explicit"),
+            (PathBuf::from("/explicit"), Origin::Named),
         );
         assert_eq!(
             resolve_values(
@@ -171,11 +212,11 @@ mod tests {
                 Some(Path::new("/user"))
             )
             .unwrap(),
-            Path::new("/environment"),
+            (PathBuf::from("/environment"), Origin::Named),
         );
         assert_eq!(
             resolve_values(None, None, Some(Path::new("/user"))).unwrap(),
-            Path::new("/user/.tensorfs"),
+            (PathBuf::from("/user/.tensorfs"), Origin::Fallback),
         );
     }
 

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/transport/mod.rs

@@ -53,4 +53,4 @@ pub use policy::{base_host, blocked, is_loopback_origin, resolve, CheckedUrl, So
 pub use pull::{
     fetch_url, fetch_wanted, pull, Fetched, PullReport, PullRequest, WalkOutcome, RETRYABLE_STATUS,
 };
-pub use push::{push_object, Pushed, PUT_ATTEMPTS};
+pub use push::{push_object, Pushed, UploadGrant, MAX_GRANT_BYTES, PUT_ATTEMPTS};

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/transport/push.rs

@@ -14,6 +14,16 @@
 //! silence bound is the ledger's floor — the same derived noise floor `egress.py` used —
 //! never an invented constant. Authority stays where it was: `podweights` (or whoever
 //! minted the grant) decided WHETHER these bytes may go; this module only moves them.
+//!
+//! **A grant is a URL AND the headers its signature covers, together.** tensorhub signs
+//! `if-none-match: *` and `x-amz-checksum-sha256: <base64 of the raw digest>` into every
+//! upload grant it mints (`podweights.validateGrant` demands exactly those two), and a
+//! SigV4 store answers 400 to a PUT that omits a signed header. A mover that carried the
+//! URL and dropped the conditions therefore could not spend ANY minted grant — which is
+//! what th-132 found. So the destination and its conditions are ONE value, `UploadGrant`,
+//! and no spelling reaches this function with one and not the other. The headers cross the
+//! wire verbatim, exactly once each, on every attempt, and they win over this module's own
+//! defaults and over the credential's: the grant's spelling is what the signature covers.
 
 use crate::err::{refuse, Code, Refusal, Result};
 use crate::ids::{Doc, ObjectRef};
@@ -30,6 +40,88 @@ pub const PUT_ATTEMPTS: u32 = 4;
 
 const HTTP_PRECONDITION_FAILED: u16 = 412;
 
+/// One upload grant: the exact destination and the exact headers its signature covers.
+/// The pair is indivisible — a presigned PUT spent without its signed conditions is not a
+/// degraded push, it is a 400 — so this is the only way to name a push destination.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct UploadGrant {
+    pub url: String,
+    /// Lowercase names in the grant's own order, each sent verbatim exactly once.
+    pub headers: Vec<(String, String)>,
+}
+
+/// A grant is a URL, a few signed headers and nothing else; anything larger is not one.
+pub const MAX_GRANT_BYTES: usize = 64 * 1024;
+
+impl UploadGrant {
+    /// A destination that signs no conditions — a plain PUT target, not a minted grant.
+    pub fn to(url: &str) -> UploadGrant {
+        UploadGrant {
+            url: url.to_string(),
+            headers: Vec::new(),
+        }
+    }
+
+    /// The grant as its minter writes it, in the line grammar the credential file already
+    /// uses: the destination on the first line, then one `name: value` per line for each
+    /// header the signature covers. No escaping, no canonical-bytes question — a presigned
+    /// URL is full of `&` and a base64 checksum of `+/=`, and a grammar that can mangle
+    /// either is a grammar that loses the signature.
+    ///
+    /// ```text
+    /// https://bucket.s3.amazonaws.com/o/<key>?X-Amz-Algorithm=...&X-Amz-Signature=...
+    /// if-none-match: *
+    /// x-amz-checksum-sha256: 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
+    /// ```
+    pub fn parse(text: &str) -> Result<UploadGrant> {
+        if text.len() > MAX_GRANT_BYTES {
+            return refuse(
+                Code::SIZE_CAP,
+                format!(
+                    "{} bytes is not an upload grant — one is a URL and a few headers",
+                    text.len()
+                ),
+            );
+        }
+        let mut lines = text.lines().map(str::trim).filter(|line| !line.is_empty());
+        let Some(url) = lines.next() else {
+            return refuse(
+                Code::SOURCE_NOT_ALLOWED,
+                "an upload grant is a destination on the first line, then one \
+                 `name: value` per signed header",
+            );
+        };
+        let mut grant = UploadGrant::to(url);
+        for line in lines {
+            let Some((name, value)) = line.split_once(':') else {
+                return refuse(
+                    Code::SOURCE_NOT_ALLOWED,
+                    format!("upload grant line {line:?} is not `name: value`"),
+                );
+            };
+            let (name, value) = (name.trim(), value.trim());
+            if name.is_empty() || name != name.to_ascii_lowercase() || value.is_empty() {
+                return refuse(
+                    Code::SOURCE_NOT_ALLOWED,
+                    format!(
+                        "upload grant header {name:?} is not one canonical lowercase name \
+                         with a value — send the grant's headers exactly as its signature \
+                         spells them"
+                    ),
+                );
+            }
+            if grant.headers.iter().any(|(held, _)| held == name) {
+                return refuse(
+                    Code::SOURCE_NOT_ALLOWED,
+                    format!("upload grant repeats the signed header {name:?}"),
+                );
+            }
+            grant.headers.push((name.to_string(), value.to_string()));
+        }
+        Ok(grant)
+    }
+}
+
 fn shared_client() -> &'static Client {
     static CLIENT: OnceLock<Client> = OnceLock::new();
     CLIENT.get_or_init(Client::new)
@@ -88,13 +180,14 @@ fn verified_bytes(store: &Store, sha256: &str, manifest: bool) -> Result<(Vec<u8
     }
 }
 
-/// Stream one verified store object to one exact presigned URL.
+/// Stream one verified store object to the one destination a grant names, under the exact
+/// headers that grant's signature covers.
 #[allow(clippy::too_many_arguments)]
 pub fn push_object(
     store: &Store,
     sha256: &str,
     manifest: bool,
-    url: &str,
+    grant: &UploadGrant,
     policy: &SourcePolicy,
     credential: &dyn CredentialProvider,
     deadline: Deadline,
@@ -107,7 +200,7 @@ pub fn push_object(
     let mut last_refusal: Option<Refusal> = None;
     for attempt in 1..=PUT_ATTEMPTS {
         let last = attempt == PUT_ATTEMPTS;
-        let checked = policy.check(url)?;
+        let checked = policy.check(&grant.url)?;
         let mut headers = vec![
             (
                 "content-type".to_string(),
@@ -120,6 +213,14 @@ pub fn push_object(
             ("if-none-match".to_string(), "*".to_string()),
         ];
         headers.extend(credential.headers(&checked.host));
+        // The grant's own spelling is the one the signature covers, so it replaces a
+        // default or a credential header of the same name rather than joining it.
+        for (name, value) in &grant.headers {
+            match headers.iter_mut().find(|(held, _)| held == name) {
+                Some(slot) => slot.1 = value.clone(),
+                None => headers.push((name.clone(), value.clone())),
+            }
+        }
         let sent = http::request(
             client,
             &checked,

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/src/transport/tests.rs

@@ -7,7 +7,7 @@ use super::hub::{Anonymous, HostToken};
 use super::ledger::{Deadline, Ledger};
 use super::policy::{blocked, SourcePolicy};
 use super::pull::{fetch_url, pull, PullRequest};
-use super::push::push_object;
+use super::push::{push_object, UploadGrant};
 use crate::canon::Value;
 use crate::dtype::Dtype;
 use crate::err::Code;
@@ -933,7 +933,7 @@ fn push_streams_a_verified_object_and_412_is_the_object_being_durable() {
         &store,
         &object.sha256,
         false,
-        &format!("{}/put/{}", origin.base, object.sha256),
+        &UploadGrant::to(&format!("{}/put/{}", origin.base, object.sha256)),
         &local_policy(),
         &Anonymous,
         Deadline::none(),
@@ -967,7 +967,7 @@ fn push_streams_a_verified_object_and_412_is_the_object_being_durable() {
         &store,
         &object.sha256,
         false,
-        &format!("{}/put/x", origin.base),
+        &UploadGrant::to(&format!("{}/put/x", origin.base)),
         &local_policy(),
         &Anonymous,
         Deadline::none(),
@@ -985,7 +985,7 @@ fn push_streams_a_verified_object_and_412_is_the_object_being_durable() {
         &store,
         &object.sha256,
         false,
-        &format!("{}/put/x", origin.base),
+        &UploadGrant::to(&format!("{}/put/x", origin.base)),
         &local_policy(),
         &Anonymous,
         Deadline::none(),
@@ -1007,7 +1007,7 @@ fn push_streams_a_verified_object_and_412_is_the_object_being_durable() {
         &store,
         &object.sha256,
         false,
-        &format!("{}/put/x", origin.base),
+        &UploadGrant::to(&format!("{}/put/x", origin.base)),
         &local_policy(),
         &Anonymous,
         Deadline::none(),
@@ -1019,6 +1019,141 @@ fn push_streams_a_verified_object_and_412_is_the_object_being_durable() {
     let _ = std::fs::remove_dir_all(root);
 }
 
+/// th-132's other half, proven at the socket: a tensorhub upload grant is a presigned URL
+/// AND the exact headers its signature covers — `if-none-match: *` and
+/// `x-amz-checksum-sha256` (podweights.validateGrant refuses a grant without them, and a
+/// SigV4 store refuses a PUT without them) — so the mover sends them verbatim, once each,
+/// on every attempt. The origin here DEMANDS them: without the checksum header it answers
+/// 400 and the push fails, which is exactly what made an upload grant unspendable.
+#[test]
+fn push_spends_a_grant_the_origin_refuses_without_its_signed_headers() {
+    let root = temporary("push-grant-headers");
+    let store = Store::init(&root).unwrap();
+    let body = b"granted bytes".to_vec();
+    let object = ObjectRef::of(&body);
+    store
+        .put_stream(&mut body.as_slice(), Some(&object), &Default::default())
+        .unwrap();
+    let raw: Vec<u8> = object
+        .sha256
+        .as_bytes()
+        .chunks(2)
+        .map(|pair| u8::from_str_radix(std::str::from_utf8(pair).unwrap(), 16).unwrap())
+        .collect();
+    let checksum = crate::b64::encode(&raw);
+
+    type SeenHeaders = Arc<Mutex<Vec<Vec<(String, String)>>>>;
+    let seen: SeenHeaders = Arc::default();
+    let seen_for = Arc::clone(&seen);
+    let checksum_for = checksum.clone();
+    let demanding: Dispatch = Arc::new(move |request: &Request| {
+        seen_for.lock().unwrap().push(request.headers.clone());
+        // The store's side of the contract, exactly as S3 enforces it: no signed
+        // checksum, no PUT.
+        if request.header("x-amz-checksum-sha256") != Some(checksum_for.as_str())
+            || request.header("if-none-match") != Some("*")
+        {
+            return status(400, b"InvalidRequest: the signed headers are required");
+        }
+        status(200, b"")
+    });
+    let origin = origin(demanding);
+    let ledger = Ledger::with_resolution(Duration::from_millis(25));
+    let destination = format!("{}/put/{}", origin.base, object.sha256);
+
+    // Without the grant's headers this origin refuses — the gap th-132 recorded.
+    let refusal = push_object(
+        &store,
+        &object.sha256,
+        false,
+        &UploadGrant::to(&destination),
+        &local_policy(),
+        &Anonymous,
+        Deadline::none(),
+        &ledger,
+        "",
+    )
+    .unwrap_err();
+    assert_eq!(refusal.code, Code::TRANSFER_FAILED);
+    assert!(refusal.detail.contains("400"), "{refusal}");
+
+    // The grant as its minter writes it — url and headers in one document, so the URL
+    // cannot be spent without its conditions.
+    let document = format!("{destination}\nif-none-match: *\nx-amz-checksum-sha256: {checksum}\n");
+    let grant = UploadGrant::parse(&document).unwrap();
+    assert_eq!(grant.url, destination);
+    assert_eq!(grant.headers.len(), 2);
+    seen.lock().unwrap().clear();
+    let pushed = push_object(
+        &store,
+        &object.sha256,
+        false,
+        &grant,
+        &local_policy(),
+        &Anonymous,
+        Deadline::none(),
+        &ledger,
+        "",
+    )
+    .unwrap();
+    assert_eq!(pushed.http_status, 200);
+    assert_eq!(pushed.bytes_sent, object.length);
+    {
+        let seen = seen.lock().unwrap();
+        assert_eq!(seen.len(), 1);
+        let of = |name: &str| -> Vec<&str> {
+            seen[0]
+                .iter()
+                .filter(|(held, _)| held == name)
+                .map(|(_, value)| value.as_str())
+                .collect()
+        };
+        // The grant's own if-none-match replaced the built-in — sent exactly once.
+        assert_eq!(of("if-none-match"), vec!["*"]);
+        assert_eq!(of("x-amz-checksum-sha256"), vec![checksum.as_str()]);
+    }
+    let _ = std::fs::remove_dir_all(root);
+}
+
+/// A grant document is refused for the first thing it gets wrong, before any byte moves —
+/// and the grammar survives what a real grant actually contains: a presigned URL full of
+/// `&` and `=`, and a base64 checksum ending in `=`.
+#[test]
+fn a_grant_document_is_refused_for_the_first_disagreeing_thing() {
+    let presigned = "https://bucket.s3.amazonaws.com/o/k?X-Amz-Algorithm=AWS4-HMAC-SHA256\
+                     &X-Amz-Signature=deadbeef&X-Amz-SignedHeaders=host%3Bif-none-match";
+    let checksum = "47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=";
+    let grant = UploadGrant::parse(&format!(
+        "{presigned}\n\nif-none-match: *\nx-amz-checksum-sha256: {checksum}\n"
+    ))
+    .unwrap();
+    assert_eq!(grant.url, presigned);
+    assert_eq!(
+        grant.headers,
+        vec![
+            ("if-none-match".to_string(), "*".to_string()),
+            ("x-amz-checksum-sha256".to_string(), checksum.to_string()),
+        ]
+    );
+
+    // A name that is not its own canonical lowercase self is not the name the signature
+    // covers; an empty value, a line that is not `name: value`, a repeat, and an empty
+    // document are each the grant saying something this mover will not guess at.
+    for bad in [
+        "https://s3.example/put\nX-Amz-Checksum-Sha256: abc",
+        "https://s3.example/put\nif-none-match:",
+        "https://s3.example/put\nif-none-match",
+        "https://s3.example/put\nif-none-match: *\nif-none-match: *",
+        "   \n\n",
+    ] {
+        let refusal = UploadGrant::parse(bad).unwrap_err();
+        assert_eq!(refusal.code, Code::SOURCE_NOT_ALLOWED, "{bad:?}");
+    }
+    // The cap is the parser's, so every door gets it — file, environment, and any caller.
+    let refusal = UploadGrant::parse(&"x".repeat(super::MAX_GRANT_BYTES + 1)).unwrap_err();
+    assert_eq!(refusal.code, Code::SIZE_CAP);
+}
+
 // ---------------------------------------------------------------- TLS
 
 #[test]

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-core/tests/home.rs

@@ -193,3 +193,95 @@ fn migration_refuses_a_source_symlink_without_following_it() {
     assert!(!destination.exists());
     fs::remove_dir_all(root).unwrap();
 }
+
+/// tfs-053. An empty skeleton Store once materialized inside a source checkout because a
+/// process ran a store verb with no root from its own working directory. A verb that needs a
+/// Store now refuses when nothing was named and nothing is there, and writes nothing at all.
+fn refuse_without_a_named_root(name: &str, args: &[&str]) {
+    let root = temporary(name);
+    let home = root.join("home");
+    let cwd = root.join("cwd");
+    fs::create_dir_all(&home).unwrap();
+    fs::create_dir_all(&cwd).unwrap();
+
+    let output = Command::new(env!("CARGO_BIN_EXE_tfs"))
+        .args(args)
+        .current_dir(&cwd)
+        .env("HOME", &home)
+        .env_remove("TENSORFS_HOME")
+        .output()
+        .unwrap();
+
+    let stderr = String::from_utf8(output.stderr).unwrap();
+    assert!(!output.status.success(), "tfs {args:?} did not refuse");
+    assert!(stderr.contains("STORE_ROOT_ABSENT"), "{stderr}");
+    assert_eq!(
+        fs::read_dir(&cwd).unwrap().count(),
+        0,
+        "tfs {args:?} wrote into its working directory"
+    );
+    assert!(
+        !home.join(".tensorfs").exists(),
+        "tfs {args:?} conjured a home Store"
+    );
+    fs::remove_dir_all(root).unwrap();
+}
+
+#[test]
+fn store_verbs_refuse_and_write_nothing_when_no_root_is_named() {
+    for (name, args) in [
+        ("no-root-init", &["store", "init"][..]),
+        ("no-root-ensure", &["store", "ensure"][..]),
+        ("no-root-info", &["store", "info"][..]),
+        ("no-root-readers", &["store", "prepare-readers"][..]),
+        ("no-root-complete", &["store", "complete-cozytensors"][..]),
+    ] {
+        refuse_without_a_named_root(name, args);
+    }
+}
+
+#[test]
+fn rebuild_refuses_an_absent_census_root_instead_of_creating_one() {
+    refuse_without_a_named_root(
+        "absent-census",
+        &["store", "rebuild", "census", "--rows", "rows.jsonl"],
+    );
+}
+
+#[test]
+fn a_named_root_still_creates_and_store_ensure_stays_idempotent() {
+    let root = temporary("named-root");
+    let named = root.join("named");
+    let environment = root.join("environment");
+    let home = root.join("home");
+    fs::create_dir_all(&home).unwrap();
+
+    let run = |args: &[&str], tensorfs_home: Option<&Path>| {
+        let mut command = Command::new(env!("CARGO_BIN_EXE_tfs"));
+        command.args(args).env("HOME", &home);
+        match tensorfs_home {
+            Some(value) => command.env("TENSORFS_HOME", value),
+            None => command.env_remove("TENSORFS_HOME"),
+        };
+        let output = command.output().unwrap();
+        assert!(
+            output.status.success(),
+            "{}",
+            String::from_utf8_lossy(&output.stderr)
+        );
+    };
+
+    run(&["store", "init", named.to_str().unwrap()], None);
+    assert!(named.join("blobs").is_dir());
+    run(&["store", "ensure"], Some(&environment));
+    run(&["store", "ensure"], Some(&environment));
+    assert!(environment.join("blobs").is_dir());
+
+    // The `$HOME/.tensorfs` fallback is opened once it exists; only creating it needs a name.
+    run(
+        &["store", "init", home.join(".tensorfs").to_str().unwrap()],
+        None,
+    );
+    run(&["store", "info"], None);
+    fs::remove_dir_all(root).unwrap();
+}

{tensorfs-0.3.2 → tensorfs-0.3.3}/crates/tensorfs-py/src/store.rs

@@ -500,21 +500,21 @@ impl PyStore {
     #[staticmethod]
     #[pyo3(signature = (root = None))]
     fn ensure(py: Python<'_>, root: Option<PathBuf>) -> PyResult<PyStore> {
-        let root = tensorfs_core::home::resolve(root.as_deref()).or_refuse(py)?;
+        let root = tensorfs_core::home::store_root(root.as_deref()).or_refuse(py)?;
         open_store(py, root, CoreStore::ensure)
     }
 
     #[staticmethod]
     #[pyo3(signature = (root = None))]
     fn open(py: Python<'_>, root: Option<PathBuf>) -> PyResult<PyStore> {
-        let root = tensorfs_core::home::resolve(root.as_deref()).or_refuse(py)?;
+        let root = tensorfs_core::home::store_root(root.as_deref()).or_refuse(py)?;
         open_store(py, root, CoreStore::open)
     }
 
     #[staticmethod]
     #[pyo3(signature = (root = None))]
     fn init(py: Python<'_>, root: Option<PathBuf>) -> PyResult<PyStore> {
-        let root = tensorfs_core::home::resolve(root.as_deref()).or_refuse(py)?;
+        let root = tensorfs_core::home::store_root(root.as_deref()).or_refuse(py)?;
         open_store(py, root, CoreStore::init)
     }
 

{tensorfs-0.3.2 → tensorfs-0.3.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "tensorfs"
-version = "0.3.2"
+version = "0.3.3"
 description = "TensorFS — canonical tensor artifact substrate"
 requires-python = ">=3.12"
 classifiers = [