feat(rustfs): mirror workflows and pkg with a writer that retires with the mirror #516

Merged

binjovi-bot merged 1 commit from sean/rustfs-workflows-pkg-mirror into trunk 2026-09-10 01:00:34 +00:00 AGit

Conversation 0 Commits 1 Files changed 7 +586 -1

sean commented 2026-09-10 00:54:13 +00:00

Owner

Copy link

The last two buckets: a whole-bucket migration-writer identity (the package identities are prefix-scoped and cannot copy a bucket), its chain and converge key, and two mirror Jobs built from forgejo's. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

The last two buckets: a whole-bucket migration-writer identity (the package identities are prefix-scoped and cannot copy a bucket), its chain and converge key, and two mirror Jobs built from forgejo's. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit 2026-09-10 00:54:13 +00:00

feat(rustfs): mirror workflows and pkg with a writer that retires with the mirror ... 5f3d1999fe

Stage 3, the last two buckets, the copy. 489 MiB in 1,131 objects and 3.0 GiB
in 2,244 -- minutes each at the measured rate.

THE DESTINATION KEY IS NEW, AND IT IS NOT ROOT. Every mirror so far wrote with
its consumer's own scoped key. The thirteen package identities are
prefix-scoped inside these two shared buckets -- workflows/zdns/staging/*,
pkg/rpg-*/ and so on -- so none of them can copy a whole bucket, and the
migration never holds a root credential on either side. migration-writer is
declared in object-store.json with write over exactly these two buckets, is
refused the canary like every other identity, and is consumed in namespace
rustfs by these two Jobs alone, so its chain carries no ClusterSecretStore and
admits no second namespace. It is deleted from object-store.json and from
rustfs-identities/ in the same commit that deletes rustfs-mirror/.

Both Jobs are the forgejo Job with the names changed, so they carry everything
that directory has learned: stdout redirected, a directional gate, a bounded
residual for the bulk pass and zero for the cutover, a failed pass waited out
in-process, a run that compared nothing refused, and stale multipart uploads
swept before the first mirror call. Seven mirrors, seventy behaviours executed
against the stub, nineteen identities through the class guard.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit 5f3d1999fe into trunk 2026-09-10 01:00:34 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!516

No description provided.