worktree-controller 1.30.4__py3-none-any.whl

worktree_controller/governance.py

@@ -0,0 +1,365 @@
+"""Advisory worktree classification and reviewed release routing."""
+
+from __future__ import annotations
+
+import stat
+from dataclasses import asdict, replace
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+from .controller import _environment_first, _repository_payload, envelope
+from .git_backend import inventory
+from .lifecycle import RELEASABLE_STATES, build_release_plan, governance_release_plan_id, release
+from .lifecycle_observation import observe_repository_orphans, observe_worktree
+from .models import (
+    ControllerError,
+    MetadataRecord,
+    MetadataSnapshot,
+    RepositoryInventory,
+    WorktreeGitState,
+    WorktreePolicy,
+)
+from .mount_diagnostics import diagnose_mounts
+from .policy import load_policy
+from .registration_prune import apply_prune, build_prune_plan
+from .semantics import record_for as _record_for
+from .store import MetadataStore
+
+
+def _candidate_diagnostics(
+    repository: RepositoryInventory,
+    item: WorktreeGitState,
+    requested_diagnostics: dict[str, Any],
+    *,
+    namespace_pid: int | None,
+) -> dict[str, Any]:
+    """Probe each registered checkout's own mounts without another Git inventory."""
+    reason = "CANDIDATE_PRUNABLE" if item.prunable else "CANDIDATE_PATH_UNAVAILABLE"
+    if not item.prunable:
+        try:
+            if stat.S_ISDIR(item.path.lstat().st_mode):
+                if item.path == repository.requested_path:
+                    return requested_diagnostics
+                return diagnose_mounts(
+                    replace(repository, requested_path=item.path), namespace_pid=namespace_pid
+                )
+        except OSError:
+            pass
+    return {
+        "environment": {"code": "UNKNOWN", "facts": [reason]},
+        "namespace": {"comparison": "UNKNOWN", "pid": namespace_pid},
+    }
+
+
+def _candidate(
+    item: WorktreeGitState,
+    record: MetadataRecord | None,
+    snapshot: MetadataSnapshot,
+    policy: WorktreePolicy,
+    diagnostics: dict[str, Any],
+    now_at: datetime,
+) -> dict[str, Any]:
+    allocation_id = record.allocation_id if record else None
+    writer = snapshot.writer_leases.get(allocation_id) if allocation_id else None
+    publication = snapshot.publication_lease
+    if publication is not None and publication.allocation_id != allocation_id:
+        publication = None
+    blockers: list[str] = []
+    if item.canonical:
+        blockers.append("CANONICAL_PROTECTED")
+    if item.prunable:
+        blockers.append("PRUNABLE_REGISTRATION")
+    if record is None:
+        blockers.append("METADATA_MISSING")
+    if item.detached:
+        blockers.append("DETACHED_WORKTREE")
+    if item.locked:
+        blockers.append("LOCKED_WORKTREE")
+    if not item.clean and not item.prunable:
+        blockers.append("DIRTY_WORKTREE")
+    if record is not None:
+        if record.lifecycle not in RELEASABLE_STATES:
+            blockers.append("LIFECYCLE_NOT_RELEASABLE")
+        if record.external_bindings:
+            blockers.append("EXTERNAL_BINDING")
+    if writer is not None:
+        blockers.append("WRITER_LEASE_PRESENT")
+    if publication is not None:
+        blockers.append("PUBLICATION_LEASE_PRESENT")
+    observation = observe_worktree(
+        item,
+        record,
+        snapshot,
+        policy,
+        now_at=now_at,
+        namespace_healthy=diagnostics["environment"]["code"] == "HEALTHY",
+    )
+    return {
+        "allocation_id": allocation_id,
+        "path": str(item.path),
+        "branch": item.branch,
+        "head": item.head,
+        "record_version": record.record_version if record else None,
+        "lifecycle": record.lifecycle if record else None,
+        "owner": record.owner if record else None,
+        "session": observation["session"],
+        "dirty": None if item.prunable else not item.clean,
+        "lease": {
+            "writer": {
+                "lease_id": writer.lease_id,
+                "owner": writer.owner,
+                "holder_pid": writer.holder.pid,
+                "session_id": writer.holder.session_id,
+                "run_id": writer.holder.run_id,
+                "renewed_at": writer.renewed_at,
+                "expires_at": writer.expires_at,
+            }
+            if writer
+            else None,
+            "publication": {"lease_id": publication.lease_id} if publication else None,
+        },
+        "external_bindings": list(record.external_bindings) if record else [],
+        "lifecycle_observation": observation,
+        "stale_facts": observation["stale_facts"],
+        "orphan_facts": observation["orphan_facts"],
+        "filesystem_health": diagnostics["environment"],
+        "namespace_health": {
+            "comparison": diagnostics["namespace"]["comparison"],
+            "pid": diagnostics["namespace"]["pid"],
+        },
+        "classification": "BLOCKED" if blockers else "REVIEW_REQUIRED",
+        "candidate_reason": blockers[0] if blockers else "RELEASE_PREFLIGHT_REQUIRED",
+        "blocking_facts": list(blockers),
+        "blockers": blockers or ["RELEASE_PREFLIGHT_REQUIRED"],
+        "gc_plan_id": None,
+    }
+
+
+def gc_plan(
+    repository_path: Path,
+    *,
+    target: Path | None = None,
+    owner_release: str | None = None,
+    release_intent_id: str | None = None,
+    namespace_pid: int | None = None,
+) -> dict[str, Any]:
+    """Classify registered worktrees; preflight only an explicitly selected target."""
+    repository = inventory(repository_path)
+    diagnostics = diagnose_mounts(repository, namespace_pid=namespace_pid)
+    policy = load_policy(repository.canonical_path)
+    try:
+        snapshot = MetadataStore(repository.common_dir).load()
+    except ControllerError as exc:
+        raise _environment_first(exc, diagnostics["environment"]) from exc
+    result = envelope("gc-plan")
+    result["mount_diagnostics"] = diagnostics
+    result["environment_diagnosis"] = diagnostics["environment"]
+    result["repository"] = _repository_payload(repository, policy, snapshot)
+    result["orphan_observations"] = observe_repository_orphans(repository, snapshot)
+    now_at = datetime.now(UTC)
+    candidates = [
+        _candidate(
+            item,
+            _record_for(item, snapshot),
+            snapshot,
+            policy,
+            _candidate_diagnostics(repository, item, diagnostics, namespace_pid=namespace_pid),
+            now_at,
+        )
+        for item in repository.worktrees
+    ]
+    result["candidates"] = candidates
+    if target is None:
+        result["decision"] = {
+            "code": "GC_CLASSIFIED",
+            "total": len(candidates),
+            "blocked": sum(row["classification"] == "BLOCKED" for row in candidates),
+            "review_required": sum(
+                row["classification"] == "REVIEW_REQUIRED" for row in candidates
+            ),
+            "reason": "advisory inventory; each release requires an exact target preflight",
+        }
+        return result
+    selected = target.expanduser().resolve(strict=False)
+    row = next((candidate for candidate in candidates if Path(candidate["path"]) == selected), None)
+    if row is None:
+        raise ControllerError("UNREGISTERED_WORKTREE", f"GC target is not registered: {selected}")
+    result["candidate"] = row
+    item = next(item for item in repository.worktrees if item.path == selected)
+    if item.prunable:
+        if release_intent_id is not None:
+            result["decision"] = {"code": "GC_BLOCKED", "blockers": ["INVALID_RELEASE_INTENT"]}
+            return result
+        record = _record_for(item, snapshot)
+        if record is None:
+            result["decision"] = {"code": "GC_BLOCKED", "blockers": ["METADATA_MISSING"]}
+            return result
+        try:
+            prune_plan = build_prune_plan(repository, snapshot, policy, item, record, owner_release)
+        except ControllerError as exc:
+            row["blockers"] = [exc.code]
+            row["blocking_facts"] = list(row["blockers"])
+            row["candidate_reason"] = exc.code
+            result["decision"] = {
+                "code": "GC_BLOCKED",
+                "blockers": row["blockers"],
+                "reason": str(exc),
+            }
+            return result
+        row["classification"] = "PREFLIGHT_READY"
+        row["blockers"] = []
+        row["blocking_facts"] = []
+        row["candidate_reason"] = "MISSING_NO_CHANGE_AUDIT"
+        row["gc_plan_id"] = prune_plan["gc_plan_id"]
+        result["registration_prune_plan"] = prune_plan
+        result["decision"] = {
+            "code": "GC_PREFLIGHT_READY",
+            "gc_plan_id": prune_plan["gc_plan_id"],
+            "allocation_id": record.allocation_id,
+            "reason": "missing audit registration has owner and retained-ref evidence",
+        }
+        return result
+    if row["classification"] == "BLOCKED":
+        result["decision"] = {"code": "GC_BLOCKED", "blockers": row["blockers"]}
+        return result
+    if owner_release is None and release_intent_id is None:
+        row["blockers"] = ["OWNER_RELEASE_OR_INTENT_REQUIRED"]
+        row["blocking_facts"] = list(row["blockers"])
+        row["candidate_reason"] = row["blockers"][0]
+        result["decision"] = {"code": "GC_REVIEW_REQUIRED", "blockers": row["blockers"]}
+        return result
+    try:
+        release_plan = build_release_plan(
+            repository_path,
+            target=selected,
+            expected_record_version=row["record_version"],
+            owner_release=owner_release,
+            release_intent_id=release_intent_id,
+        )
+    except ControllerError as exc:
+        row["classification"] = "BLOCKED"
+        row["blockers"] = [exc.code]
+        row["blocking_facts"] = list(row["blockers"])
+        row["candidate_reason"] = exc.code
+        result["decision"] = {"code": "GC_BLOCKED", "blockers": row["blockers"], "reason": str(exc)}
+        return result
+    row["classification"] = "PREFLIGHT_READY"
+    row["blockers"] = []
+    row["blocking_facts"] = []
+    row["candidate_reason"] = "EXISTING_RELEASE_PREFLIGHT_PASSED"
+    row["gc_plan_id"] = governance_release_plan_id(release_plan)
+    result["release_plan"] = asdict(release_plan)
+    result["decision"] = {
+        "code": "GC_PREFLIGHT_READY",
+        "gc_plan_id": row["gc_plan_id"],
+        "allocation_id": row["allocation_id"],
+        "reason": "existing release preflight passed without mutation",
+    }
+    return result
+
+
+def _replay_reviewed_release(
+    repository_path: Path,
+    *,
+    target: Path,
+    expected_gc_plan_id: str,
+    owner_release: str | None,
+    release_intent_id: str | None,
+) -> dict[str, Any] | None:
+    """The existing receipt when the exact reviewed plan already completed elsewhere.
+
+    A background pass or an interrupted earlier apply may have executed the very plan
+    that was reviewed. Only a completed receipt whose ReleasePlan hashes to the reviewed
+    GC identity qualifies; release() then re-verifies that evidence (released record,
+    retained branch, teardown receipt) before answering ALREADY_RELEASED. A release made
+    from any other plan stays GC_PLAN_DRIFT, which names the receipt that did happen.
+    """
+
+    repository = inventory(repository_path)
+    snapshot = MetadataStore(repository.common_dir).load()
+    selected = target.expanduser().resolve(strict=False)
+    completed = [
+        (receipt, snapshot.release_plans.get(receipt.plan_id))
+        for receipt in snapshot.release_receipts.values()
+        if receipt.result == "RELEASED" and Path(receipt.target_path) == selected
+    ]
+    matches = [
+        (receipt, plan)
+        for receipt, plan in completed
+        if plan is not None and governance_release_plan_id(plan) == expected_gc_plan_id
+    ]
+    if len(matches) != 1:
+        if completed:
+            raise ControllerError(
+                "GC_PLAN_DRIFT",
+                "GC target was released by a different plan: "
+                + ", ".join(sorted(receipt.receipt_id for receipt, _ in completed)),
+            )
+        return None
+    _receipt, plan = matches[0]
+    payload = release(
+        repository_path,
+        target=selected,
+        expected_record_version=plan.expected_record_version,
+        owner_release=owner_release,
+        release_intent_id=release_intent_id,
+    )
+    payload["command"] = "gc-apply"
+    payload["decision"]["gc_plan_id"] = expected_gc_plan_id
+    return payload
+
+
+def gc_apply(
+    repository_path: Path,
+    *,
+    target: Path,
+    expected_gc_plan_id: str,
+    owner_release: str | None = None,
+    release_intent_id: str | None = None,
+) -> dict[str, Any]:
+    """Revalidate review identity and delegate the only removal to release()."""
+    pruned = apply_prune(
+        repository_path,
+        target=target,
+        expected_gc_plan_id=expected_gc_plan_id,
+        owner_release=owner_release,
+    )
+    if pruned is not None:
+        return pruned
+    try:
+        planned = gc_plan(
+            repository_path,
+            target=target,
+            owner_release=owner_release,
+            release_intent_id=release_intent_id,
+        )
+    except ControllerError as exc:
+        if exc.code in {"INVALID_TARGET", "UNREGISTERED_WORKTREE"}:
+            replayed = _replay_reviewed_release(
+                repository_path,
+                target=target,
+                expected_gc_plan_id=expected_gc_plan_id,
+                owner_release=owner_release,
+                release_intent_id=release_intent_id,
+            )
+            if replayed is not None:
+                return replayed
+            raise ControllerError("GC_PLAN_DRIFT", "GC target changed since review") from exc
+        raise
+    if planned["decision"]["code"] != "GC_PREFLIGHT_READY":
+        raise ControllerError("GC_PLAN_DRIFT", "GC target no longer passes release preflight")
+    observed = planned["decision"]["gc_plan_id"]
+    if observed != expected_gc_plan_id:
+        raise ControllerError("GC_PLAN_DRIFT", "GC plan identity changed since review")
+    receipt = release(
+        repository_path,
+        target=target,
+        expected_record_version=planned["candidate"]["record_version"],
+        owner_release=owner_release,
+        release_intent_id=release_intent_id,
+        expected_governance_plan_id=expected_gc_plan_id,
+    )
+    receipt["command"] = "gc-apply"
+    receipt["decision"]["gc_plan_id"] = expected_gc_plan_id
+    return receipt

worktree_controller/hardlinks.py

@@ -0,0 +1,294 @@
+"""Pre-deletion, allocation-scoped hardlink topology and exact unlink effects."""
+
+from __future__ import annotations
+
+import copy
+import errno
+import os
+import stat
+from pathlib import Path
+from typing import Any
+
+from . import preservation as p
+from .models import ControllerError
+
+CONTRACT = "cleanup-hardlink-topology/v1"
+EXTERNAL_CONTRACT = "cleanup-hardlink-topology/v2"
+MUTATION_CONTRACT = "cleanup-induced-hardlink-mutation/v1"
+EXTERNAL_MUTATION_CONTRACT = "cleanup-induced-hardlink-mutation/v2"
+
+
+def _blocked(message: str) -> ControllerError:
+    return ControllerError("HARDLINK_TOPOLOGY_BLOCKED", message)
+
+
+def _effects(group: dict[str, Any], resources: list[str]) -> dict[str, Any]:
+    owners = {m[0] for m in group["members"]}
+    classification = (
+        "single-link"
+        if len(group["members"]) == 1
+        else "same-resource"
+        if len(owners) == 1
+        else "typed-preserved"
+        if ".venv" in owners
+        else "typed-typed"
+    )
+    surviving = group["members"]
+    steps = []
+    for resource in resources:
+        removed = [m for m in surviving if m[0] == resource]
+        if removed:
+            surviving = [m for m in surviving if m[0] != resource]
+            steps.append(
+                {
+                    "resource": resource,
+                    "deleted_links": removed,
+                    "surviving_paths": surviving,
+                    "expected_nlink": len(surviving) + group.get("external_links", 0),
+                }
+            )
+    return {"classification": classification, "expected_steps": steps}
+
+
+def inventory(root: Path, resources: list[str]) -> dict[str, Any]:
+    """Record every non-directory inode and all its in-scope names; hash opaque bytes.
+
+    Names outside the exact cleanup resources are never searched or authorized.
+    Version 2 records their link-count remainder. Every unlink of such an inode
+    requires the pinned inode's unchanged bytes and exact metadata decrement.
+    Directory identity remains bound by the FD-relative deletion primitive.
+    """
+    if len(resources) != len(set(resources)):
+        raise _blocked("invalid or overlapping cleanup resources")
+    for name in resources:
+        p.source_relative_path(name)
+        if any(name != other and Path(name).is_relative_to(Path(other)) for other in resources):
+            raise _blocked("invalid or overlapping cleanup resources")
+    groups: dict[str, dict[str, Any]] = {}
+    anchors = {}
+    for resource in resources:
+        with p._absolute_source(root / resource) as chain:
+            tree = p.scan_tree(chain[-1], chain)
+            tree.require_complete()
+            anchors[resource] = {
+                "worktree": chain[-len(Path(resource).parts) - 1].identity,
+                "resource": chain[-1].identity,
+            }
+        for row in tree.manifest:
+            identity = tree.identities[row["path"]]
+            if stat.S_ISDIR(identity[2]):
+                continue
+            key = f"{identity[0]}:{identity[1]}"
+            content = {k: row[k] for k in ("content_sha256", "target") if k in row}
+            member = [resource, row["path"]]
+            if key in groups:
+                group = groups[key]
+                if group["identity"] != identity or group["content"] != content:
+                    raise _blocked("inode identity changed during topology scan")
+                group["members"].append(member)
+            else:
+                groups[key] = {"identity": identity, "content": content, "members": [member]}
+    external = any(g["identity"][8] > len(g["members"]) for g in groups.values())
+    for group in groups.values():
+        group["members"].sort()
+        if group["identity"][8] < len(group["members"]):
+            raise _blocked("hardlink topology is unstable")
+        if external:
+            group["external_links"] = group["identity"][8] - len(group["members"])
+        group.update(_effects(group, resources))
+    payload = {
+        "contract": EXTERNAL_CONTRACT if external else CONTRACT,
+        "resources": resources,
+        "anchors": anchors,
+        "groups": groups,
+    }
+    return {**payload, "sha256": p._sha(payload)}
+
+
+def validate(graph: dict[str, Any]) -> None:
+    if graph.get("contract") not in {CONTRACT, EXTERNAL_CONTRACT} or graph.get("sha256") != p._sha(
+        {k: v for k, v in graph.items() if k != "sha256"}
+    ):
+        raise _blocked("topology evidence changed")
+    for key, group in graph["groups"].items():
+        identity = group["identity"]
+        members = group["members"]
+        external = group.get("external_links", 0)
+        if (
+            key != f"{identity[0]}:{identity[1]}"
+            or type(external) is not int
+            or external < 0
+            or (graph["contract"] == CONTRACT and "external_links" in group)
+            or (graph["contract"] == EXTERNAL_CONTRACT and "external_links" not in group)
+            or len(members) + external != identity[8]
+            or len({tuple(m) for m in members}) != len(members)
+            or any(m[0] not in graph["resources"] for m in members)
+        ):
+            raise _blocked("incomplete topology evidence")
+        if any(group.get(k) != v for k, v in _effects(group, graph["resources"]).items()):
+            raise _blocked("invalid expected link-count effects")
+
+
+def verify(root: Path, expected: dict[str, Any]) -> None:
+    validate(expected)
+    try:
+        actual = inventory(root, expected["resources"])
+    except OSError as exc:
+        if exc.errno in {errno.ENOENT, errno.ENOTDIR, errno.ELOOP, errno.ESTALE}:
+            raise ControllerError(
+                "RESOURCE_PLAN_MISMATCH", "resource path identity changed"
+            ) from exc
+        raise
+    if actual["anchors"] != expected["anchors"]:
+        raise ControllerError("RESOURCE_PLAN_MISMATCH", "resource directory identity changed")
+    if actual != expected:
+        raise _blocked("topology changed since the last recorded baseline")
+
+
+def transition(
+    before: dict[str, Any],
+    after: dict[str, Any],
+    resource: str,
+    external_survivors: dict[str, Any] | None = None,
+) -> dict[str, Any]:
+    """Accept only the exact removal of one recorded resource's inode names."""
+    validate(before)
+    validate(after)
+    if resource not in before["resources"] or after["resources"] != [
+        r for r in before["resources"] if r != resource
+    ]:
+        raise _blocked("unexpected cleanup action or resource set")
+    if after["anchors"] != {k: v for k, v in before["anchors"].items() if k != resource}:
+        raise _blocked("surviving directory identity changed")
+    expected_keys = set()
+    mutations = {}
+    proofs = external_survivors or {}
+    expected_proofs = set()
+    for key, old in before["groups"].items():
+        members = [m for m in old["members"] if m[0] != resource]
+        removed = len(old["members"]) - len(members)
+        external = old.get("external_links", 0)
+        if external and removed:
+            expected_proofs.add(key)
+        if not members and not external:
+            continue
+        if members:
+            expected_keys.add(key)
+            current = after["groups"].get(key)
+        else:
+            current = proofs.get(key)
+        if current is None or current["content"] != old["content"]:
+            raise _blocked("surviving path, inode, content or symlink literal changed")
+        if members and (
+            current["members"] != members or current.get("external_links", 0) != external
+        ):
+            raise _blocked("surviving hardlink membership changed")
+        wanted = list(old["identity"])
+        wanted[8] -= removed
+        if removed:
+            wanted[5] = current["identity"][5]
+        if current["identity"] != wanted:
+            raise _blocked("unrecorded metadata or link-count mutation")
+        if (
+            external
+            and removed
+            and proofs.get(key) != {"identity": current["identity"], "content": current["content"]}
+        ):
+            raise _blocked("pinned external inode verification is missing or differs")
+        if removed:
+            mutations[key] = {
+                "removed_links": removed,
+                "before": old["identity"],
+                "after": current["identity"],
+                "surviving_paths": members,
+            }
+    if set(after["groups"]) != expected_keys:
+        raise _blocked("unexpected surviving inode set")
+    if set(proofs) != expected_proofs:
+        raise _blocked("unexpected or missing pinned external inode evidence")
+    return {
+        "contract": mutation_contract(before),
+        "completed_resource": resource,
+        "before_sha256": before["sha256"],
+        "after_sha256": after["sha256"],
+        "mutations": mutations,
+        **({"external_survivors": proofs} if before["contract"] == EXTERNAL_CONTRACT else {}),
+    }
+
+
+def mutation_contract(graph: dict[str, Any]) -> str:
+    return (
+        EXTERNAL_MUTATION_CONTRACT if graph["contract"] == EXTERNAL_CONTRACT else MUTATION_CONTRACT
+    )
+
+
+def external_contents(graph: dict[str, Any], resource: str) -> dict[str, dict[str, Any]]:
+    validate(graph)
+    return {
+        path: group["content"]
+        for group in graph["groups"].values()
+        if group.get("external_links", 0)
+        for name, path in group["members"]
+        if name == resource
+    }
+
+
+def pinned_content(pin: int, expected: list[int]) -> dict[str, Any]:
+    """Observe the authorized inode, including after its last in-scope name is gone.
+
+    The kernel FD is the only handle: no external pathname is discovered, followed,
+    opened or changed. FIFO endpoints remain unopened. This is an observation at
+    the unlink boundary, not a claim that external writers are globally excluded.
+    """
+    if p._identity(os.fstat(pin)) != expected:
+        raise _blocked("pinned inode changed before content verification")
+    if stat.S_ISREG(expected[2]):
+        fd = os.open(f"/proc/self/fd/{pin}", os.O_RDONLY | os.O_CLOEXEC | os.O_NOATIME)
+        try:
+            if p._identity(os.fstat(fd)) != expected:
+                raise _blocked("pinned content identity changed")
+            size, digest = p._transfer(fd)
+            if size != expected[3] or p._identity(os.fstat(fd)) != expected:
+                raise _blocked("pinned bytes changed during verification")
+            content = {"content_sha256": digest}
+        finally:
+            os.close(fd)
+    elif stat.S_ISLNK(expected[2]):
+        content = {"target": os.readlink("", dir_fd=pin)}
+    elif stat.S_ISFIFO(expected[2]):
+        content = {}
+    else:
+        raise _blocked("unsupported pinned inode type")
+    if p._identity(os.fstat(pin)) != expected:
+        raise _blocked("pinned inode changed during content verification")
+    return content
+
+
+def identities(graph: dict[str, Any], resource: str) -> dict[str, list[int]]:
+    validate(graph)
+    return {
+        path: group["identity"]
+        for group in graph["groups"].values()
+        for name, path in group["members"]
+        if name == resource
+    }
+
+
+def source_baseline(
+    manifest: dict[str, Any], graph: dict[str, Any], *, resource: str = ".venv"
+) -> dict[str, Any]:
+    """Overlay a previously verified, recorded graph; never changes the receipt."""
+    expected = copy.deepcopy(manifest)
+    current = identities(graph, resource)
+    if resource not in graph["resources"] or set(current) != {
+        name for name, identity in manifest["source_identities"].items() if not stat.S_ISDIR(identity[2])
+    }:
+        raise _blocked("preserved source topology coverage is incomplete")
+    for path, identity in current.items():
+        old = expected["source_identities"].get(path)
+        if old is None or any(
+            a != b for i, (a, b) in enumerate(zip(old, identity, strict=True)) if i not in {5, 8}
+        ):
+            raise _blocked("preserved source identity cannot be rebased")
+        expected["source_identities"][path] = identity
+    return expected