tensorfs 0.3.73__tar.gz → 0.3.74__tar.gz

{tensorfs-0.3.73 → tensorfs-0.3.74}/Cargo.lock

@@ -439,7 +439,7 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tensorfs-core"
-version = "0.3.73"
+version = "0.3.74"
 dependencies = [
  "fs2",
  "libc",
@@ -454,7 +454,7 @@ dependencies = [
 
 [[package]]
 name = "tensorfs-py"
-version = "0.3.73"
+version = "0.3.74"
 dependencies = [
  "pyo3",
  "tensorfs-core",

{tensorfs-0.3.73 → tensorfs-0.3.74}/Cargo.toml

@@ -3,5 +3,5 @@ resolver = "2"
 members = ["crates/tensorfs-core", "crates/tensorfs-py"]
 
 [workspace.package]
-version = "0.3.73"
+version = "0.3.74"
 edition = "2021"

{tensorfs-0.3.73 → tensorfs-0.3.74}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tensorfs
-Version: 0.3.73
+Version: 0.3.74
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: Implementation :: CPython
 Classifier: Programming Language :: Rust

{tensorfs-0.3.73 → tensorfs-0.3.74}/crates/tensorfs-core/src/bin/tfs/fetch.rs

@@ -192,9 +192,8 @@ fn deadline_of(flags: &Flags) -> Deadline {
 
 /// The ONE credential spelling, reaching the child explicitly (tfs-050): `--credential-file
 /// <path>` or the deliberately-set `TFS_CREDENTIAL` — never argv (world-readable in /proc),
-/// never the inherited environment at large. The value is `bearer <token>`, scoped to
-/// exactly the named hosts, or empty for anonymous — which is what a rented pod passes,
-/// the hub's closure and presign routes taking no credential at all.
+/// never the inherited environment at large. The value is `bearer <token>` or
+/// `worker <id> <token>`, scoped to exactly the named hosts, or empty for anonymous.
 fn credential_of(
     flags: &Flags,
     hosts: Vec<String>,

{tensorfs-0.3.73 → tensorfs-0.3.74}/crates/tensorfs-core/src/bin/tfs/main.rs

@@ -39,8 +39,8 @@
 //!   tfs fill <root> <plan>       resumable fill: skip only verified objects
 //!
 //! The ONE transport (tfs-048/tfs-049/tfs-050). The credential is `--credential-file` or
-//! TFS_CREDENTIAL (`bearer <token>`, or empty for anonymous), never bare argv; a
-//! URL of `-` arrives on stdin. Flags: --hub <base> --lane --session --streams <n>
+//! TFS_CREDENTIAL (`bearer <token>`, `worker <id> <token>`, or empty for anonymous), never
+//! bare argv; a URL of `-` arrives on stdin. Flags: --hub <base> --lane --session --streams <n>
 //! --streams-start <n> --timeout <s> --allow-hosts a,b,.c --allow-local --max-redirects <n>.
 //! `--streams` is the most objects in flight (default 128, memory-bounded); the walk starts
 //! at `--streams-start` (default 16) and doubles while measured goodput follows.

{tensorfs-0.3.73 → tensorfs-0.3.74}/crates/tensorfs-core/src/transport/hub.rs

@@ -36,9 +36,10 @@
 //! **The credential arrives as a provider trait, never a credential type**, so one
 //! implementation serves whatever a caller holds. It is asked per host, so a credential
 //! stays scoped to the hosts its provider names and cannot leak onto a presigned object
-//! host or a redirect target. A rented pod holds nothing at all: the hub's closure and
-//! presign routes are PUBLIC (tensorhub owner ruling 2026-09-03, which deleted the signed
-//! DownloadDelegation these calls used to present), so the pod fetches as `Anonymous`.
+//! host or a redirect target. Published checkpoints need none; a machine reads its
+//! owner's unpublished checkpoints by presenting its worker capability
+//! (`worker <id> <token>` → `x-cozy-worker-id` + `x-cozy-worker-token`), which the hub
+//! scopes to the machine owner's account.
 
 use crate::canon::{self, as_arr, as_obj, as_str, as_uint, Value};
 use crate::err::{refuse, Code, Refusal, Result};
@@ -103,9 +104,10 @@ impl CredentialProvider for ScopedHeaders {
 /// The ONE credential spelling every surface passes (tfs-050): exactly one scoped value,
 /// handed explicitly — a file, one deliberately-set variable — never inherited.
 ///
-/// - `bearer <token>` → `authorization: Bearer <token>`
-/// - empty            → anonymous, which is what a rented pod uses: the hub's closure and
-///   presign routes take no credential.
+/// - `bearer <token>`      → `authorization: Bearer <token>`
+/// - `worker <id> <token>` → `x-cozy-worker-id` + `x-cozy-worker-token`: a machine's
+///   worker capability, which the hub's closure and presign read as its owner's grant
+/// - empty                 → anonymous: published checkpoints only.
 pub fn credential_from_spec(spec: &str, hosts: Vec<String>) -> Result<ScopedHeaders> {
     let spec = spec.trim();
     if spec.is_empty() {
@@ -114,16 +116,20 @@ pub fn credential_from_spec(spec: &str, hosts: Vec<String>) -> Result<ScopedHead
             headers: Vec::new(),
         });
     }
-    let mut parts = spec.split_whitespace();
-    let headers = match (parts.next(), parts.next()) {
-        (Some("bearer"), Some(token)) if parts.next().is_none() => {
+    let parts: Vec<&str> = spec.split_whitespace().collect();
+    let headers = match parts.as_slice() {
+        ["bearer", token] => {
             vec![("authorization".to_string(), format!("Bearer {token}"))]
         }
+        ["worker", id, token] => vec![
+            ("x-cozy-worker-id".to_string(), id.to_string()),
+            ("x-cozy-worker-token".to_string(), token.to_string()),
+        ],
         _ => {
             return refuse(
                 Code::CREDENTIAL_REQUIRED,
-                "a credential is `bearer <token>` or empty — one scoped value, passed \
-                 explicitly",
+                "a credential is `bearer <token>`, `worker <id> <token>` or empty — one \
+                 scoped value, passed explicitly",
             )
         }
     };

{tensorfs-0.3.73 → tensorfs-0.3.74}/crates/tensorfs-core/src/transport/tests.rs

@@ -3,7 +3,7 @@
 //! no hub. The ledger tests run at millisecond resolution: the cadence is configuration,
 //! the RULE under test is production's.
 
-use super::hub::{Anonymous, HostToken};
+use super::hub::{credential_from_spec, Anonymous, HostToken};
 use super::ledger::{Deadline, Ledger};
 use super::policy::{self, blocked, SourcePolicy};
 use super::pull::{absolute_location, fetch_url, pull, ObjectSource, PullRequest};
@@ -2134,6 +2134,56 @@ fn credential_headers_reach_the_hub_and_not_the_object_host() {
     let _ = std::fs::remove_dir_all(root);
 }
 
+#[test]
+fn a_worker_capability_reaches_the_hub_calls_as_its_two_headers() {
+    let root = temporary("worker-cred");
+    let store = Store::init(&root).unwrap();
+    let checkpoint = Arc::new(checkpoint(1, 4 * 1024));
+    let checkpoint_for = Arc::clone(&checkpoint);
+    let base_slot: Arc<Mutex<String>> = Arc::default();
+    let dispatch_base = Arc::clone(&base_slot);
+    let dispatch: Dispatch = Arc::new(move |request: &Request| {
+        let base = dispatch_base.lock().unwrap().clone();
+        let machine = request.header("x-cozy-worker-id") == Some("om-machine")
+            && request.header("x-cozy-worker-token") == Some("worker-token");
+        match (request.method.as_str(), request.path.as_str()) {
+            ("POST", _) if !machine => status(
+                401,
+                br#"{"error":{"code":"worker.unauthorized","message":"m"}}"#,
+            ),
+            ("POST", "/v1/tensorfs/closure") => ok_json(&closure_value(&checkpoint_for, &base)),
+            ("POST", "/v1/tensorfs/presign") => ok_json(&presign_value(&request.body, &base)),
+            ("GET", path) => match checkpoint_for.bodies.get(&path["/obj/".len()..]) {
+                Some(body) => status(200, body),
+                None => status(404, b"absent"),
+            },
+            _ => status(404, b"no route"),
+        }
+    });
+    let origin = origin(dispatch);
+    *base_slot.lock().unwrap() = origin.base.clone();
+    let policy = SourcePolicy::default();
+    let credential =
+        credential_from_spec("worker om-machine worker-token", vec!["127.0.0.1".into()]).unwrap();
+    let mut request = PullRequest::new(&store, &origin.base, "acme/model", &credential, &policy);
+    request.sample_seconds = 0.025;
+    pull(&request).unwrap();
+    let anonymous_root = temporary("worker-cred-anon");
+    let anonymous = Store::init(&anonymous_root).unwrap();
+    let mut refused = PullRequest::new(&anonymous, &origin.base, "acme/model", &Anonymous, &policy);
+    refused.sample_seconds = 0.025;
+    assert!(pull(&refused)
+        .unwrap_err()
+        .detail
+        .contains("worker.unauthorized"));
+    for spec in ["worker om-machine", "worker a b c", "machine a b"] {
+        let refusal = credential_from_spec(spec, vec![]).err().unwrap();
+        assert_eq!(refusal.code, Code::CREDENTIAL_REQUIRED, "{spec}");
+    }
+    let _ = std::fs::remove_dir_all(root);
+    let _ = std::fs::remove_dir_all(anonymous_root);
+}
+
 // ---------------------------------------------------------------- the predicate
 
 #[test]

{tensorfs-0.3.73 → tensorfs-0.3.74}/crates/tensorfs-py/src/store.rs

@@ -3590,9 +3590,9 @@ pub fn transfer_streams(wanted: usize) -> usize {
 /// plan against the real store, the 16-way walk presigning `wanted` as it reaches it, and
 /// the completion proof, all in the compiled core.
 ///
-/// `credential` is the one spelling (`bearer <token>`, or empty for anonymous — which is
-/// what a rented pod uses, the hub's closure and presign routes taking no credential),
-/// scoped to the hub's host. `timeout` is the caller's deadline or None for none —
+/// `credential` is the one spelling (`bearer <token>`, `worker <id> <token>` — a machine's
+/// worker capability, which reads its owner's unpublished checkpoints — or empty for
+/// anonymous, published only), scoped to the hub's host. `timeout` is the caller's deadline or None for none —
 /// nothing below invents a number of seconds. `sample_seconds` is the liveness ledger's
 /// RESOLUTION (configuration, never a verdict); leave it defaulted outside tests.
 #[pyfunction]

{tensorfs-0.3.73 → tensorfs-0.3.74}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "tensorfs"
-version = "0.3.73"
+version = "0.3.74"
 description = "TensorFS — canonical tensor artifact substrate"
 requires-python = ">=3.12"
 classifiers = [