14 Commits

Include renames

Author	SHA1	Message	Date
osobhandClaude Sonnet 5	4ea1cbed2e	Add shutdown-prep button to dashboard-v2 NodeDetail ... Wires safe-shutdown-prep.sh into the dashboard so an operator can prep a node for hardware maintenance from a browser instead of SSH. New RPC methods (0x20/0x21): - ShutdownPrepCheck runs `--dry-run` to completion and returns the full report. Never stops anything, safe to call repeatedly. - ShutdownPrepExecute starts the real run detached (`systemd-run --user --scope --collect`), placing it in a cgroup outside claw-store.service's own -- the script's own step 6 stops that service, i.e. the process that would otherwise be running it, so it has to survive its own parent dying. Returns immediately with a "started" message; full output lands in /var/lib/claw-store/shutdown-prep.log for whoever's at the machine once it's gone dark, since there's no way to stream a live result past the point the daemon stops itself. - Execute double-checks confirm_node_name against the peer's own configured name server-side, on top of the aggregator's own path match -- defense in depth for a highly consequential action. Aggregator endpoints (admin-token gated, AuthedCaller::require_admin): POST /api/v2/node/:name/shutdown-prep/check POST /api/v2/node/:name/shutdown-prep/execute Frontend: ShutdownPrepPanel on NodeDetail. Check button always enabled; the real "stop services" button only unlocks after a ready check, and additionally requires typing the exact node name to confirm before it's clickable. Also fixes a script bug found while testing this against the live daemon process (not caught in manual interactive-shell testing): the zpool-detection line parsed raw `mount` output positionally, which returned the wrong field under the daemon's process context for reasons that didn't reproduce interactively. Switched to `df --output=source`, which is stable across both. Verified end-to-end against tank, architect, and morpheus, including cross-node targeting (tank's dashboard successfully triggered a check on morpheus over the fleet RPC layer). Co-Authored-By: Claude Sonnet 5 <[email protected]>	2026-07-31 14:46:57 -07:00
osobh	c3f6b500fc	Phase 9 R1: RepoEnsure — peer RPC + aggregator fan-out (#106)	2026-07-15 11:19:35 +00:00
Omar Sobh	1211f0d891	dashboard-v2: DashboardStorage RPC + aggregated /storage/* endpoints ... Storage tabs 404'd because the aggregator only had /fleet + /node/:name after the pivot. Adds: * New RPC method DashboardStorage = 0x1d — one round trip returns tags (full), snapshots (full), ref-tracking (full), blobs (first 200 by id), refs (first 200 by fp) for the responding daemon. * Client wrapper call_dashboard_storage. * Aggregator fans out to every peer, tags each row with the originating node, sorts + returns: GET /api/v2/storage/blobs GET /api/v2/storage/tags GET /api/v2/storage/refs GET /api/v2/storage/snapshots GET /api/v2/storage/ref-tracking QuicClient promoted to Arc<QuicClient> inside V2State so the per-peer JoinSet can hand it to spawned tasks without recreating the endpoint.	2026-07-14 16:39:45 -07:00
Omar Sobh	a2114b918d	dashboard-v2 PR 3: fleet aggregator via DashboardStatus RPC ... Pivot from per-node dashboard to single-pane-of-glass. The aggregator (typically the operator's laptop) holds a fleet-CA leaf cert + the peer list; each dashboard request fans out to every peer over the existing QUIC/mTLS cluster port and issues the new DashboardStatus RPC. Peers don't need to run any HTTP server of their own. Backend: * New RPC method DashboardStatus = 0x1c * Server handler reads BlobStore / TagStore / RefStore / SnapshotStore / RefTracking counts + on-disk bytes + rustc release. Cheap: 5 filesystem walks per request. * Client wrapper call_dashboard_status * serve_v2 rewritten as aggregator: V2State holds a QuicClient + peer list from `[[cluster.peers]]`. Endpoints: GET /api/v2/fleet fan-out to every peer, parallel GET /api/v2/node/:name/status one peer, on-demand Failed peers surface as { online: false, error: "..." } cards instead of dropping. serve.rs graceful degrade: v2 aggregator routes only mount when [cluster.tls] is set. Static SPA still serves at /v2/* even without an aggregator config so operators see the SPA's built-in "config missing" error. Deployment model (this session): * Aggregator runs on quantum (Mac) with a signed leaf. * Fleet daemons run cluster-only — no HTTP dashboard anywhere on tank/architect/morpheus. The clawstor-dashboard.service systemd units on the fleet are being retired. Frontend rework to consume /api/v2/fleet ships in the next PR.	2026-07-14 16:19:27 -07:00
Omar SobhandClaude Opus 4.7	4630925040	Phase 4b follow-on: pin --ttl RPC + CLI ... Closes Phase 4b by exposing the TTL sidecar written by Phase 4b primitives on the wire and via `claw-cargo pin`. Wire additions: * Method::SetTagExpiry (0x1a) — payload `key_len:u16 || key || expires_at:u64 (LE)`. Reply single-byte OK. `expires_at == 0` clears the sidecar. * Method::GetTagExpiry (0x1b) — payload raw key bytes. Reply 8 bytes (u64 LE) on hit; NotFound when no sidecar is present. Both accept writes even when the stamped tag itself is absent, matching `TagStore::set_stamped_expiry` semantics — the sidecar takes effect the moment the tag lands. CLI: * `claw-cargo pin --ttl <duration>` — humantime-style duration (`30d`, `1h30m`, `2w`, ...). Applied to both the primary tag and its `.fingerprint` companion so eviction treats them as one lifetime. `--ttl 0` / `clear` / `none` clears an existing sidecar without touching the value. Tests: encode/decode roundtrip + malformed-input rejection for `encode_expiry_record`, method-byte stability, NotConfigured without a tag store, end-to-end set/get/overwrite/clear over QUIC, and a real-pin flow that publishes a stamped tag then attaches TTL. Duration parser is unit-tested for single/compound forms, case-insensitive units, bad input, and clock alignment. No new deps — the humantime-style parser is 60 lines in-tree. Co-Authored-By: Claude Opus 4.7 <[email protected]>	2026-07-13 17:12:27 -07:00
Omar Sobh	2c3cd2ab38	Phase 3c + 3e: stamped tags + namespaced ref keys — closes Phase 3 ... Ships the last two pieces from the arch doc's Phase 3 scope for the cargo-cache use case: ## 3c: Stamped tags (CRDT-merge on PutTag) Mirror of Phase 3a/3b for TagStore. Two concurrent `claw-cargo pin` calls on the same tag now race deterministically instead of silently clobbering. * `StampedTagValue` — same 48-byte (value, clock, node) tuple as StampedRef. * `TagStore::put_stamped(key, StampedTagValue) -> TagPutOutcome` and `TagStore::get_stamped(key)` — data lives under `tags-v2/` (separate from `tags/` for cutover safety). * New wire methods `PutTagVersioned = 0x18` + `GetTagVersioned = 0x19`. * `call_put_tag_versioned` / `call_get_tag_versioned` client helpers. * `claw-cargo pin` now writes stamped tags. Concurrent pin gets AlreadyExists and moves on (blob content is content-addressed so both winners agree on the payload). ## 3e: Namespaced ref keys Opt-in `--namespace <slug>` on peer-facing subcommands. When set, the ref key becomes `blake3("clawstor.ns.v1" || namespace || fp)` so two runners on different namespaces (`clawverse/main` vs `clawverse/pr-42`) don't collide on the same fingerprint. Empty namespace = pre-3e behavior, so this is 100% backward compat. * `refs::namespaced_ref_key(namespace, fingerprint) -> RefKey` primitive. * `PeerArgs::namespace: Option<String>` CLI flag flows through to `cmd_status`, `cmd_prefetch`, `cmd_build`. * `peer_lookup` now takes a `RefKey` directly (was `&Fingerprint`) so the namespace resolution stays in the caller — the daemon never sees "namespace" as a concept. ## 3d: Deferred Full vector clocks per namespace are noted in the arch doc as a Phase-3 goal; scalar wall-clock (clock + node stamp) is sufficient for the cargo-cache use case (single-key LWW merge). NTP-synced runners see monotonic ordering; skewed runners lose an ordering but the CRDT semantics still guarantee no data corruption. Full VC is deferred to a future phase. +9 tests, 280 total (baseline +8: 7 unit + 1 e2e over real QUIC).	2026-07-13 12:32:46 -07:00
Omar Sobh	ac51e3e9b5	Phase 3b: thread stamped refs through claw-cargo + forwarding ... Runner + prewarm use PutRefVersioned/GetRefVersioned; daemon GetRefVersioned forwards on miss + pulls blob transparently. New GetRefVersionedLocal (0x17) prevents recursion. Backward-compat: existing GetRef/PutRef path unchanged; two on-disk namespaces coexist (refs/ and refs-v2/). +1 test, 272 total (unchanged from 3a because we reused existing scaffolding).	2026-07-13 12:05:55 -07:00
Omar Sobh	af5350ac17	Phase 3a: Lamport-stamped refs with CRDT-merge on PutRef ... Concurrent PutRef safety via (clock, node) total order. New wire methods PutRefVersioned (0x15) + GetRefVersioned (0x16). Existing PutRef/GetRef unchanged for backward compat. Data in refs-v2/ namespace so the two coexist during cutover. +8 tests, 272 total (baseline +8).	2026-07-13 07:34:28 -07:00
Omar Sobh	58c5bc341b	GetRef: transparent ref-forwarding on local miss ... Cross-runner cache silos (tank + architect measured on 2026-07-13): same fingerprint, same rustc, but each runner's daemon only knows about the refs its own runner uploaded. Every runner that lands on a peer that isn't tank re-uploads a duplicate blob. Fix: on `GetRef` miss the daemon fans out to alive gossip peers via a strict-local `GetRefLocal` variant, and the FIRST peer that has the ref triggers a transparent pull — chunks + manifest into the local blob store, then `PutRef` locally — before returning the value to the caller. Subsequent lookups are pure-local hits. * `Method::GetRefLocal = 0x14` — new wire method, identical shape to GetRef but the peer MUST NOT recurse. Loop prevention: our forwarding only calls `GetRefLocal` on peers, so chain depth is always 1. * `RpcRouter::with_outbound_client(Arc<QuicClient>)` — dependency injection point for the forwarding dial path. `None` disables forwarding entirely (GetRef becomes GetRefLocal-equivalent). * `RpcRouter::forward_get_ref(key)` — concurrent peer probes via `JoinSet`, 3s timeout per dial, first successful pull wins, remaining tasks aborted. * `pull_blob_locally` — walks manifest, fetches only chunks the local store lacks (`has_chunk`), commits via `put_manifest_verified`. Bounded memory: one 4 MiB chunk at a time. * `ClusterServices::start` loads NodeIdentity twice — server takes ownership; outbound client gets its own copy for TLS presentation on peer dials. Wires the outbound client into the router when TLS material is available. * `call_get_ref_local(conn, key)` client helper (used by daemon forwarding + available to any RPC consumer that wants the no-recursion semantics). +3 tests in `rpc/tests_forwarding.rs`: - Local hit works without forwarding; local miss with no peers returns None. Guards the base cases. - GetRefLocal never forwards even when outbound is configured (no peers reachable → miss returns None immediately, no attempted fan-out). - Method byte 0x14 encoding is stable across releases. Full end-to-end forwarding is exercised in the pilot deploy: two daemons on the fleet-CA, tank populates a ref, architect's runner GetRef → tank forwards → architect pulls → HIT locally next time. 264 tests pass (baseline +3). Pre-existing macOS failure unchanged.	2026-07-13 06:50:53 -07:00
Omar Sobh	846ecffe10	Pi deploy follow-ups: XDG default_path + parallel restore ... Two fixes surfaced by the vision-02 Pi 5 measurement: ## XDG default_path `Manifest::default_path` was hardcoded to `/var/lib/claw-store/projects.toml`. That path is read-only under the user-mode systemd unit's `ProtectSystem=strict`, and creating it needs root — awful for a runner install. Precedence, matching XDG Base Directory: 1. `$XDG_STATE_HOME/claw-store/projects.toml` 2. `$HOME/.local/state/claw-store/projects.toml` 3. `/var/lib/claw-store/projects.toml` (system fallback) User-mode installs now write in $HOME by default; system installs (root, no HOME set) still land in /var/lib. +1 test: `default_path_honours_xdg_state_home` — covers all three precedence branches. Env mutation is process-global so the test saves + restores. ## Parallel restore on cache HIT Pi restore of 947 MiB via `BlobGetStream` took ~18s (~53 MiB/s) single-stream. Per-stream throughput ceilings on the connection type cap sequential fetches; parallel chunk fetches stack their contributions. - New `call_blob_get_parallel(conn, blob_id, concurrency) -> Option<Vec<u8>>` in `rpc/client.rs`. `JoinSet` + `Semaphore`, reassembles by chunk index at manifest-known offsets so out-of-order arrival is fine. - `claw-cargo build --parallel-restore N` (default 8). `N <= 1` falls through to `BlobGetStream` for parity. - Memory: `total_size + 4 MiB × in-flight` — dominated by the reassembly buffer, not the fanout. +1 test: `parallel_blob_get_reassembles_multi_chunk_blob_byte_equal` covers roundtrip byte-equality vs BlobGetStream, tail-chunk offset, concurrency=1 correctness, and NotFound → None. 259 tests pass (+2). Pre-existing macOS failure unchanged.	2026-07-12 07:42:57 -07:00
Omar Sobh	54e9da4d62	Phase 5k: parallel-fanout chunk transfer for prewarm ... Pilot 2026-07-12 measured 109 MiB/s on the sequential prewarm path — ~11% of a 10G fabric. `quinn::Connection` is cheap-Clone (internal Arc), so we can run the has→get→put pipeline per chunk in concurrent tasks under a bounded semaphore. - `prewarm_missing_chunks_between_parallel(up, down, id, concurrency)` in `rpc/client.rs`. `concurrency <= 1` degrades to the sequential path (kept for diagnostic parity). - `claw-cargo prewarm --parallel N` (default 8). Ignored with `--buffered`. Memory ceiling: 4 MiB × in-flight = 32 MiB @ 8, 128 MiB @ 32. - Uses `tokio::task::JoinSet` + `Arc<Semaphore>`; permit held for the whole per-chunk pipeline so we never over-commit. - Retry pass on `put_manifest` mismatch stays sequential — small, correctness-critical. - Errors: JoinSet drains completely + returns first task error so a mid-fanout failure doesn't leave zombie tasks. +1 test: `end_to_end_parallel_prewarm_copies_chunks_and_matches_sequential` runs 5-chunk payload with concurrency=3, verifies byte-equal restore, then reruns with concurrency=8 → 0 uploads (has_chunk dedup), then concurrency=0 → 0 uploads (sequential fallback path). 254 tests pass (+1 from previous). Pre-existing macOS failure unchanged.	2026-07-12 06:13:28 -07:00
Omar Sobh	6fb16286dd	Phase 5h: streaming chunk-level prewarm ... Bounded-memory cross-peer prewarm: instead of buffering the whole blob in RAM (previous 5f path), iterate the upstream manifest chunk by chunk, ask downstream `HasChunk`, stream missing chunks one at a time. Memory ceiling is 1 chunk (4 MiB) regardless of blob size — a 5 GiB target dir no longer needs 5 GiB of mediator RAM. * rpc/client.rs: new `prewarm_missing_chunks_between(upstream, downstream, blob_id)` helper. Returns `(uploaded, total)` — the difference is the dedup save. Retries once if the downstream `PutManifest` reports missing chunks after our push (guards a narrow eviction race); a second failure surfaces as `Err`. * claw_cargo.rs: `prewarm` now streams by default; new `--buffered` flag for the old whole-blob path (kept for diagnostic comparability during rollout). Human-readable output shows the mode + dedup count. +2 tests: - cold downstream: 3-chunk payload (with a partial tail chunk) is copied exactly, reassembly is byte-equal to source - partial dedup: pre-seed 1 of 3 chunks on downstream → uploaded=2; rerun is a full no-op (uploaded=0), proving idempotence 251 tests pass (+2 from Phase 5j). Pre-existing macOS failure unchanged. Follow-ons: (1) parallel chunk transfer (uploaded chunks in fan-out) would speed multi-GB prewarms further; (2) exposing an accurate transferred-bytes counter needs router-side accounting instead of the current chunk-count × CHUNK_SIZE approximation.	2026-07-12 04:48:55 -07:00
Omar Sobh	d36cec11a6	Phase 5g: cache metrics + GetMetrics RPC + peer-metrics CLI ... Every RPC handler that answers a hit-or-miss question now increments lock-free atomic counters. The GetMetrics RPC (0x13) returns a JSON snapshot of every counter; the new claw-cargo peer-metrics CLI prints hit rates, byte volumes, and counter uptime. Placement engines can now poll these across the fleet to bias runner scheduling toward whichever node has the warmest cache for a given repo/tag combination. ## New module: cluster/metrics.rs (268 lines) Types: - CacheMetrics — atomic counters, all AtomicU64, Relaxed ordering (metrics are advisory, not consistency-critical) - MetricsReply — JSON snapshot returned by GetMetrics Public API: - CacheMetrics::new() — timestamped start, all counters at 0 - record_get_ref_hit / _miss - record_get_tag_hit / _miss - record_blob_get_bytes / record_blob_put_bytes - record_get_chunk_hit / _miss - record_has_chunk_hit / _miss - snapshot() — atomic-load every field into a MetricsReply MetricsReply derived helpers: - get_ref_hit_rate() / get_tag_hit_rate() / has_chunk_hit_rate() — Option<f64> so 0/0 returns None instead of NaN ## RPC method - GetMetrics (0x13): payload = empty; reply = JSON MetricsReply Wire-level instrumentation added to RpcRouter dispatch: - GetRef → record_get_ref_hit / _miss - GetTag → record_get_tag_hit / _miss - BlobGet → record_blob_get_bytes (on hit) - BlobPut → record_blob_put_bytes - HasChunk → record_has_chunk_hit / _miss - GetChunk → record_get_chunk_hit + record_blob_get_bytes on hit / record_get_chunk_miss RpcRouter grows Arc<CacheMetrics> unconditionally — every router has metrics, so a fresh node with no traffic still returns a valid snapshot with all zeros + started_unix. Streaming variants (BlobPutStream / BlobGetStream) don't yet track byte counts — they'd require plumbing the count out of put_stream / stream_to. Follow-on if it turns out to matter for placement. ## Client helper + CLI - call_get_metrics(&conn) → Result<MetricsReply> - claw-cargo peer-metrics [--peer ...] [--peer-addr ...] [--tls-dir ...] Fetches + pretty-prints: counter uptime: 42s GetRef hits/misses: 123 / 45 hit rate: 73.21% GetTag hits/misses: 8 / 2 hit rate: 80.00% HasChunk hits/miss: 512 / 88 hit rate: 85.33% GetChunk hits/miss: 47 / 12 Blob GET bytes: 1.23 GiB Blob PUT bytes: 3.45 GiB human_bytes() helper picks GiB / MiB / KiB / B based on magnitude. Subcommand count now 9: build / prefetch / status / fingerprint / pin / unpin / list-tags / prewarm / peer-metrics. ## Tests (13 new, all real filesystem / real QUIC — no mocks) CacheMetrics (6): - new_starts_all_counters_at_zero_except_timestamp - recorders_increment_the_right_field (every recorder × 1-2 counts) - hit_rates_none_when_zero_events (avoids 0/0 NaN) - hit_rates_compute_correctly (3 hits / 1 miss → 75%) - snapshot_round_trips_through_json - snapshots_across_threads_are_consistent_up_to_relaxed_ordering (8 threads × 1000 increments → exactly 8000) RPC integration (7): - phase_5g_method_byte_encoding - get_metrics_returns_empty_snapshot_before_any_activity - get_ref_records_hit_and_miss_counters (2 hits + 1 miss) - get_tag_records_hit_and_miss_counters - blob_get_and_blob_put_record_byte_counts - has_chunk_and_get_chunk_record_hit_miss_counters - **end_to_end_get_metrics_over_real_quic** — seed activity locally, fire GetRef/GetTag/BlobGet dispatches to move the counters, then fetch metrics through real QUIC + mTLS and verify each field including the 0.5 hit rate calculation 238 tests pass. Pre-existing macOS-only failure unchanged. File sizes (all under 1300-line ceiling): - cluster/metrics.rs: 268 - cluster/rpc.rs: 818 - cluster/rpc/tests_phase5.rs: 905 - claw_cargo.rs: 894 ## What this enables Fleet-wide visibility into which peer is actually serving traffic: # From anywhere with connectivity + fleet mTLS claw-cargo peer-metrics --peer tank claw-cargo peer-metrics --peer architect claw-cargo peer-metrics --peer morpheus Compare hit rates side by side to see which node's cache is warmest. A placement engine can automate this — poll every 30s, feed the scheduler. ## Follow-on - 5h: streaming variant of prewarm (fixed-memory ceiling for many-GB blobs) - 5i: metrics also published via gossip so PeerView carries hit rate without a per-peer GetMetrics roundtrip - 5j: prometheus /metrics endpoint on the daemon for existing dash integrations - 6: FUSE mount for warm-tier git worktrees	2026-07-12 04:06:17 -07:00
Omar Sobh	b7904b59a5	Phase 5d: named tags + pin/unpin/list-tags CLI ... Human-readable pins on top of the raw 32-byte ref layer. Operators publish `clawverse:main:latest-cache` → BlobId once, then everything downstream (CI runners, dev laptops) references the tag instead of passing 64-char hex hashes around. ## Module: cluster/tags.rs (433 lines) TagStore for string-key → 32-byte-value: - open(root) — creates layout, safe on existing stores - put(key, value) / get(key) / delete(key) / contains(key) - list() — sorted by key - Atomic writes via tempfile + rename - Key length capped at MAX_TAG_KEY_BYTES (4 KiB); empty keys rejected On-disk record: `key_len:u16 (LE) || key_bytes || value:32bytes`. Filename is `blake3(key)` hex so arbitrary UTF-8 keys land at deterministic paths without shell escaping. TagEntry type (public, serde) for list results: `{ key, value_hex }`. Includes `decode_value() → Result<[u8;32]>`. ## RPC methods - PutTag (0x0f): payload = encoded record → STREAM_STATUS_OK / err - GetTag (0x10): payload = key bytes → 32-byte value / NotFound - DeleteTag (0x11): payload = key bytes → STREAM_STATUS_OK / NotFound - ListTags (0x12): payload = empty → JSON Vec<TagEntry> RpcRouter grows optional Arc<TagStore> via `.with_tag_store(store)`. ## Services + config ClusterServices auto-opens a TagStore at `<blob_store_root>/tags-db` alongside the ref store. `tag_store` field on ClusterServices, same enable-with-blob-store semantics. ## claw-cargo new subcommands - `claw-cargo pin --name clawverse:main:latest` Compute current fingerprint → look up its BlobId via GetRef → publish TagStore mapping. Errors cleanly if the fingerprint hasn't been built yet (nothing to point at). - `claw-cargo unpin --name clawverse:main:latest` Delete the tag. Prints "no such tag" if it wasn't set. - `claw-cargo list-tags` Print every tag with its 32-byte hex value. Total subcommand count now 7: build / prefetch / status / fingerprint / pin / unpin / list-tags. All share the layered config from Phase 5c. ## Client helpers - call_put_tag / call_get_tag / call_delete_tag / call_list_tags - All follow the same error-mapping conventions as prior client helpers (NotFound → Ok(None) or Ok(false), everything else → Err) ## Housekeeping rpc.rs was pushing past the 1300-line ceiling with the tag methods added. Client helpers moved to `cluster/rpc/client.rs` with a re-export (`pub use client::*;`) so external callers still write `cluster::rpc::call_*`. Result: - rpc.rs: 773 (was 1343) - rpc/client.rs: 593 (new) - rpc/tests.rs: 1235 - All under ceiling. ## Tests (33 new, all real filesystem / real QUIC — no mocks) TagStore (16 in cluster/tags.rs): - open_creates_layout - get_returns_none_for_missing (+ contains false) - put_and_get_round_trip - put_overwrites_prior_value - delete_returns_true_for_existing_and_false_for_missing - put_rejects_empty_key - put_rejects_oversize_key - list_returns_all_tags_sorted - list_is_empty_on_fresh_store - keys_with_slashes_and_colons_round_trip (real-world tag shape) - encode_and_decode_round_trip (raw wire format) - decode_rejects_short_record - decode_rejects_length_mismatch - decode_rejects_non_utf8_key - tag_entry_decode_value_round_trip - tag_entry_decode_value_rejects_bad_hex RPC dispatch (7 new): - phase_5d_method_byte_encoding - tag_rpcs_return_not_configured_without_store - put_tag_stores_and_get_tag_reads_back - get_tag_returns_not_found_for_missing - get_tag_rejects_empty_key - delete_tag_removes_and_returns_not_found_after - list_tags_returns_json_sorted End-to-end over real QUIC (1): - **end_to_end_pin_lookup_delete_over_real_quic** — publish tag → look up → list → delete → confirm gone. Full round trip through the wire layer including JSON deserialization of the list. Also 8 downstream tests continued passing after the client.rs split (no test moved, they were untouched). 223 tests pass. Pre-existing macOS-only failure unchanged. ## What this enables Operator flow: # Build once on the primary $ claw-cargo build → cache MISS → cargo build (50 min) → capture + upload → summary: fingerprint 4a3b…, blob 8c2f…, uploaded 3.2 GiB # Publish a friendly name $ claw-cargo pin --name clawverse:main:2026-07-12 pinned: clawverse:main:2026-07-12 fingerprint: 4a3b2c… blob: 8c2f1a… # Anyone else can now find it via list-tags $ claw-cargo list-tags clawverse:main:2026-07-12 8c2f1a… clawverse:main:latest 8c2f1a… # CI runner sees the same fingerprint in its workspace state, hits # the ref directly via GetRef — the tag is for operator visibility ## Follow-on - 5e: prefetch --pin <tag> — bypass fingerprint compute, download the tagged BlobId directly (useful when you want an old cache to test regression scenarios) - 5f: gitea webhook pre-fetch — daemon pre-warms cache for known fingerprints before CI runner starts - 3: full CRDT metadata layer (namespaces, versioned pointers, vector clocks) if the plain-tag model turns out to have real-world conflict scenarios	2026-07-12 00:07:33 -07:00