Reject corrupt MST/2 verified facts and preserve raw content

.github/workflows/repository-gates.yml

@@ -0,0 +1,79 @@
+name: Repository gates
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: repository-gates-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  linux:
+    name: Linux repository gates
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    env:
+      CARGO_TERM_COLOR: always
+      CARGO_INCREMENTAL: "0"
+      CARGO_BUILD_JOBS: "2"
+      CARGO_PROFILE_DEV_DEBUG: "0"
+      CARGO_PROFILE_TEST_DEBUG: "0"
+      RUST_BACKTRACE: "1"
+      NO_PROXY: localhost,127.0.0.1,::1,host.docker.internal
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y pkg-config libssl-dev protobuf-compiler
+
+      - uses: dtolnay/rust-toolchain@nightly
+        with:
+          components: rustfmt
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+
+      - uses: Swatinem/rust-cache@v2
+        with:
+          save-if: "true"
+
+      - name: Check formatting
+        run: cargo +nightly fmt --all --check
+
+      - name: Check all targets and features
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: Build
+        run: cargo build
+
+      - name: Build tests
+        run: cargo build --tests
+
+      - name: Start isolated test dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+          source scripts/lib/mega2-it.sh
+          mega2_it_ensure_env_test
+          mega2_it_prepare_git_workdir
+          docker compose -p mega2-it -f docker/docker-compose.test.yml --profile git \
+            up -d --build --wait postgres redis rustfs rustfs-init git-cli
+
+      - name: Run repository tests with test environment
+        shell: bash
+        run: |
+          set -euo pipefail
+          source .env.test
+          export no_proxy="$NO_PROXY"
+          cargo test --all
+
+      - name: Stop isolated test dependencies
+        if: always()
+        run: docker compose -p mega2-it -f docker/docker-compose.test.yml --profile git down -v

src/callisto/mst2_verified_object.rs

@@ -2,9 +2,9 @@
 //!
 //! One row per verified object: Git identity + raw content digest + 64-bit
 //! size + verification state. The natural key is
-//! `(storage_domain, git_oid, object_kind)`; rows are insert-only with
-//! ON CONFLICT DO NOTHING — a row only ever appears after the content was
-//! fetched and hashed by this service (write-through verification).
+//! `(storage_domain, git_oid, object_kind)`. Current-generation facts retain
+//! first-write-wins semantics; valid legacy facts can be atomically upgraded
+//! only after this service fetches and hashes the raw body again.
 
 use sea_orm::entity::prelude::*;
 use serde::{Deserialize, Serialize};

src/ceres/pack/import_repo.rs

@@ -452,6 +452,10 @@ impl RepoHandler for ImportRepo {
     }
 }
 
+#[allow(
+    clippy::double_must_use,
+    reason = "async_recursion adds must_use to the generated boxed Future"
+)]
 #[async_recursion]
 pub(crate) async fn collect_git_blob_filepaths(
     storage: GitDbStorage,

src/ceres/snapshot/error.rs

@@ -34,6 +34,8 @@ pub enum SnapshotErrorCode {
     DigestMismatch,
     RangeNotSupported,
     SymlinkTraversal,
+    ObjectUnavailable,
+    IntegrityError,
     Internal,
 }
 
@@ -60,6 +62,8 @@ impl SnapshotErrorCode {
             SnapshotErrorCode::DigestMismatch => "EXPECTED_DIGEST_MISMATCH",
             SnapshotErrorCode::RangeNotSupported => "RANGE_NOT_SUPPORTED",
             SnapshotErrorCode::SymlinkTraversal => "SYMLINK_TRAVERSAL",
+            SnapshotErrorCode::ObjectUnavailable => "OBJECT_UNAVAILABLE",
+            SnapshotErrorCode::IntegrityError => "INTEGRITY_ERROR",
             SnapshotErrorCode::Internal => "INTERNAL",
         }
     }
@@ -79,6 +83,7 @@ impl SnapshotErrorCode {
             | SnapshotErrorCode::PathNotFound
             | SnapshotErrorCode::LeaseUnknown => 404,
             SnapshotErrorCode::SnapshotNotReady => 503,
+            SnapshotErrorCode::ObjectUnavailable => 503,
             SnapshotErrorCode::NotDirectory
             | SnapshotErrorCode::Conflict
             | SnapshotErrorCode::CursorStale
@@ -87,6 +92,7 @@ impl SnapshotErrorCode {
             SnapshotErrorCode::UnsupportedEntry => 422,
             SnapshotErrorCode::LimitExceeded | SnapshotErrorCode::ProofBudgetExceeded => 413,
             SnapshotErrorCode::LeaseExpired | SnapshotErrorCode::SnapshotGone => 410,
+            SnapshotErrorCode::IntegrityError => 502,
             SnapshotErrorCode::Internal => 500,
         }
     }

src/ceres/snapshot/mod.rs

@@ -1,12 +1,13 @@
 //! MST/2 snapshot domain (spec 02/03): fixed views over pinned Git trees.
 //!
-//! Slice scope (T02-a): native monorepo views only — no bindings, imports or
-//! release policy yet (T04/T05). Everything here resolves against fixed OIDs;
-//! no code path in this module may read current refs.
+//! Serving remains native-only. The independent namespace index is an unwired
+//! composition seam; identity, attestation and publication integration remain
+//! separate gates. Fixed-source readers must never look up current refs.
 pub mod chunks;
 pub mod descriptor;
 pub mod error;
 pub mod frame_stream;
+pub mod namespace;
 pub mod pages;
 pub mod publication;
 pub mod resolver;