Close the cross-stream gaps the parallel fix round left open

Three items each of which fell between two agents' file lists.

`scrub_secrets_from_snapshots` was the third unsynchronised writer of
`triple-c-snapshot-{id}:latest`, after a recreate's commit and a
compaction. It has the same read-modify-write shape — create a scratch
container from the snapshot, commit back over the same tag — and loses
the same race, which here means re-baking the very credential it exists
to remove. It now takes the project's claim, under a new
`ProjectOp::SecretScrub`, and reports a snapshot it had to skip rather
than rewriting it unsafely.

Its scratch container also now carries `triple-c.scrub=true`, so the
Disk panel's reclaim bucket discriminates by label and by the live claim
rather than by a clock. The 15-minute age gate stays as the backstop for
the cross-process case the claim cannot see.

The store plugin is unregistered and its dependency dropped. Its
capability grants were removed as a host-file-write primitive; the
registration without a grant was unreachable but dead.

Finally, container.rs's fold test was pinning a fold that no longer
exists — disk.rs now emits the JSON exec form. It asserts the stronger
property instead: the script a compaction runs is byte-for-byte the one
snapshot_scrub_script() produces, so the two files cannot drift silently.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
This commit is contained in:
shadow-testandClaude Opus 5 committed 2026-08-23 11:53:25 -07:00
1 parent 17f031a5d7
commit a76f2c0a17
11 files changed
+169 -417

No files matched your search

+1 -1
View File
@@ -1 +1 @@
{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-reLine truncated
{"core":{"default_permission":{"identifier":"default","description":"Default core plugins set.","permissions":["core:path:default","core:event:default","core:window:default","core:webview:default","core:app:default","core:image:default","core:resources:default","core:menu:default","core:tray:default"]},"permissions":{},"permission_sets":{},"global_scope_schema":null},"core:app":{"default_permission":{"identifier":"default","description":"Default permissions for the plugin.","permissions":["allow-version","allow-name","allow-tauri-version","allow-identifier","allow-bundle-type","allow-register-listener","allow-remove-listener","allow-supports-multiple-windows"]},"permissions":{"allow-app-hide":{"identifier":"allow-app-hide","description":"Enables the app_hide command without any pre-configured scope.","commands":{"allow":["app_hide"],"deny":[]}},"allow-app-show":{"identifier":"allow-app-show","description":"Enables the app_show command without any pre-configured scope.","commands":{"allow":["app_show"],"deny":[]}},"allow-bundle-type":{"identifier":"allow-bundle-type","description":"Enables the bundle_type command without any pre-configured scope.","commands":{"allow":["bundle_type"],"deny":[]}},"allow-default-window-icon":{"identifier":"allow-default-window-icon","description":"Enables the default_window_icon command without any pre-configured scope.","commands":{"allow":["default_window_icon"],"deny":[]}},"allow-fetch-data-store-identifiers":{"identifier":"allow-fetch-data-store-identifiers","description":"Enables the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":["fetch_data_store_identifiers"],"deny":[]}},"allow-identifier":{"identifier":"allow-identifier","description":"Enables the identifier command without any pre-configured scope.","commands":{"allow":["identifier"],"deny":[]}},"allow-name":{"identifier":"allow-name","description":"Enables the name command without any pre-configured scope.","commands":{"allow":["name"],"deny":[]}},"allow-register-listener":{"identifier":"allow-register-listener","description":"Enables the register_listener command without any pre-configured scope.","commands":{"allow":["register_listener"],"deny":[]}},"allow-remove-data-store":{"identifier":"allow-remove-data-store","description":"Enables the remove_data_store command without any pre-configured scope.","commands":{"allow":["remove_data_store"],"deny":[]}},"allow-remove-listener":{"identifier":"allow-remove-listener","description":"Enables the remove_listener command without any pre-configured scope.","commands":{"allow":["remove_listener"],"deny":[]}},"allow-set-app-theme":{"identifier":"allow-set-app-theme","description":"Enables the set_app_theme command without any pre-configured scope.","commands":{"allow":["set_app_theme"],"deny":[]}},"allow-set-dock-visibility":{"identifier":"allow-set-dock-visibility","description":"Enables the set_dock_visibility command without any pre-configured scope.","commands":{"allow":["set_dock_visibility"],"deny":[]}},"allow-supports-multiple-windows":{"identifier":"allow-supports-multiple-windows","description":"Enables the supports_multiple_windows command without any pre-configured scope.","commands":{"allow":["supports_multiple_windows"],"deny":[]}},"allow-tauri-version":{"identifier":"allow-tauri-version","description":"Enables the tauri_version command without any pre-configured scope.","commands":{"allow":["tauri_version"],"deny":[]}},"allow-version":{"identifier":"allow-version","description":"Enables the version command without any pre-configured scope.","commands":{"allow":["version"],"deny":[]}},"deny-app-hide":{"identifier":"deny-app-hide","description":"Denies the app_hide command without any pre-configured scope.","commands":{"allow":[],"deny":["app_hide"]}},"deny-app-show":{"identifier":"deny-app-show","description":"Denies the app_show command without any pre-configured scope.","commands":{"allow":[],"deny":["app_show"]}},"deny-bundle-type":{"identifier":"deny-bundle-type","description":"Denies the bundle_type command without any pre-configured scope.","commands":{"allow":[],"deny":["bundle_type"]}},"deny-default-window-icon":{"identifier":"deny-default-window-icon","description":"Denies the default_window_icon command without any pre-configured scope.","commands":{"allow":[],"deny":["default_window_icon"]}},"deny-fetch-data-store-identifiers":{"identifier":"deny-fetch-data-store-identifiers","description":"Denies the fetch_data_store_identifiers command without any pre-configured scope.","commands":{"allow":[],"deny":["fetch_data_store_identifiers"]}},"deny-identifier":{"identifier":"deny-identifier","description":"Denies the identifier command without any pre-configured scope.","commands":{"allow":[],"deny":["identifier"]}},"deny-name":{"identifier":"deny-name","description":"Denies the name command without any pre-configured scope.","commands":{"allow":[],"deny":["name"]}},"deny-register-listener":{"identifier":"deny-reLine truncated
@@ -2491,180 +2491,6 @@
"type": "string",
"const": "opener:deny-reveal-item-in-dir",
"markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
},
{
"description": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`",
"type": "string",
"const": "store:default",
"markdownDescription": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`"
},
{
"description": "Enables the clear command without any pre-configured scope.",
"type": "string",
"const": "store:allow-clear",
"markdownDescription": "Enables the clear command without any pre-configured scope."
},
{
"description": "Enables the delete command without any pre-configured scope.",
"type": "string",
"const": "store:allow-delete",
"markdownDescription": "Enables the delete command without any pre-configured scope."
},
{
"description": "Enables the entries command without any pre-configured scope.",
"type": "string",
"const": "store:allow-entries",
"markdownDescription": "Enables the entries command without any pre-configured scope."
},
{
"description": "Enables the get command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get",
"markdownDescription": "Enables the get command without any pre-configured scope."
},
{
"description": "Enables the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get-store",
"markdownDescription": "Enables the get_store command without any pre-configured scope."
},
{
"description": "Enables the has command without any pre-configured scope.",
"type": "string",
"const": "store:allow-has",
"markdownDescription": "Enables the has command without any pre-configured scope."
},
{
"description": "Enables the keys command without any pre-configured scope.",
"type": "string",
"const": "store:allow-keys",
"markdownDescription": "Enables the keys command without any pre-configured scope."
},
{
"description": "Enables the length command without any pre-configured scope.",
"type": "string",
"const": "store:allow-length",
"markdownDescription": "Enables the length command without any pre-configured scope."
},
{
"description": "Enables the load command without any pre-configured scope.",
"type": "string",
"const": "store:allow-load",
"markdownDescription": "Enables the load command without any pre-configured scope."
},
{
"description": "Enables the reload command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reload",
"markdownDescription": "Enables the reload command without any pre-configured scope."
},
{
"description": "Enables the reset command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reset",
"markdownDescription": "Enables the reset command without any pre-configured scope."
},
{
"description": "Enables the save command without any pre-configured scope.",
"type": "string",
"const": "store:allow-save",
"markdownDescription": "Enables the save command without any pre-configured scope."
},
{
"description": "Enables the set command without any pre-configured scope.",
"type": "string",
"const": "store:allow-set",
"markdownDescription": "Enables the set command without any pre-configured scope."
},
{
"description": "Enables the values command without any pre-configured scope.",
"type": "string",
"const": "store:allow-values",
"markdownDescription": "Enables the values command without any pre-configured scope."
},
{
"description": "Denies the clear command without any pre-configured scope.",
"type": "string",
"const": "store:deny-clear",
"markdownDescription": "Denies the clear command without any pre-configured scope."
},
{
"description": "Denies the delete command without any pre-configured scope.",
"type": "string",
"const": "store:deny-delete",
"markdownDescription": "Denies the delete command without any pre-configured scope."
},
{
"description": "Denies the entries command without any pre-configured scope.",
"type": "string",
"const": "store:deny-entries",
"markdownDescription": "Denies the entries command without any pre-configured scope."
},
{
"description": "Denies the get command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get",
"markdownDescription": "Denies the get command without any pre-configured scope."
},
{
"description": "Denies the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get-store",
"markdownDescription": "Denies the get_store command without any pre-configured scope."
},
{
"description": "Denies the has command without any pre-configured scope.",
"type": "string",
"const": "store:deny-has",
"markdownDescription": "Denies the has command without any pre-configured scope."
},
{
"description": "Denies the keys command without any pre-configured scope.",
"type": "string",
"const": "store:deny-keys",
"markdownDescription": "Denies the keys command without any pre-configured scope."
},
{
"description": "Denies the length command without any pre-configured scope.",
"type": "string",
"const": "store:deny-length",
"markdownDescription": "Denies the length command without any pre-configured scope."
},
{
"description": "Denies the load command without any pre-configured scope.",
"type": "string",
"const": "store:deny-load",
"markdownDescription": "Denies the load command without any pre-configured scope."
},
{
"description": "Denies the reload command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reload",
"markdownDescription": "Denies the reload command without any pre-configured scope."
},
{
"description": "Denies the reset command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reset",
"markdownDescription": "Denies the reset command without any pre-configured scope."
},
{
"description": "Denies the save command without any pre-configured scope.",
"type": "string",
"const": "store:deny-save",
"markdownDescription": "Denies the save command without any pre-configured scope."
},
{
"description": "Denies the set command without any pre-configured scope.",
"type": "string",
"const": "store:deny-set",
"markdownDescription": "Denies the set command without any pre-configured scope."
},
{
"description": "Denies the values command without any pre-configured scope.",
"type": "string",
"const": "store:deny-values",
"markdownDescription": "Denies the values command without any pre-configured scope."
}
]
},
-174
View File
@@ -2491,180 +2491,6 @@
"type": "string",
"const": "opener:deny-reveal-item-in-dir",
"markdownDescription": "Denies the reveal_item_in_dir command without any pre-configured scope."
},
{
"description": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`",
"type": "string",
"const": "store:default",
"markdownDescription": "This permission set configures what kind of\noperations are available from the store plugin.\n\n#### Granted Permissions\n\nAll operations are enabled by default.\n\n\n#### This default permission set includes:\n\n- `allow-load`\n- `allow-get-store`\n- `allow-set`\n- `allow-get`\n- `allow-has`\n- `allow-delete`\n- `allow-clear`\n- `allow-reset`\n- `allow-keys`\n- `allow-values`\n- `allow-entries`\n- `allow-length`\n- `allow-reload`\n- `allow-save`"
},
{
"description": "Enables the clear command without any pre-configured scope.",
"type": "string",
"const": "store:allow-clear",
"markdownDescription": "Enables the clear command without any pre-configured scope."
},
{
"description": "Enables the delete command without any pre-configured scope.",
"type": "string",
"const": "store:allow-delete",
"markdownDescription": "Enables the delete command without any pre-configured scope."
},
{
"description": "Enables the entries command without any pre-configured scope.",
"type": "string",
"const": "store:allow-entries",
"markdownDescription": "Enables the entries command without any pre-configured scope."
},
{
"description": "Enables the get command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get",
"markdownDescription": "Enables the get command without any pre-configured scope."
},
{
"description": "Enables the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:allow-get-store",
"markdownDescription": "Enables the get_store command without any pre-configured scope."
},
{
"description": "Enables the has command without any pre-configured scope.",
"type": "string",
"const": "store:allow-has",
"markdownDescription": "Enables the has command without any pre-configured scope."
},
{
"description": "Enables the keys command without any pre-configured scope.",
"type": "string",
"const": "store:allow-keys",
"markdownDescription": "Enables the keys command without any pre-configured scope."
},
{
"description": "Enables the length command without any pre-configured scope.",
"type": "string",
"const": "store:allow-length",
"markdownDescription": "Enables the length command without any pre-configured scope."
},
{
"description": "Enables the load command without any pre-configured scope.",
"type": "string",
"const": "store:allow-load",
"markdownDescription": "Enables the load command without any pre-configured scope."
},
{
"description": "Enables the reload command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reload",
"markdownDescription": "Enables the reload command without any pre-configured scope."
},
{
"description": "Enables the reset command without any pre-configured scope.",
"type": "string",
"const": "store:allow-reset",
"markdownDescription": "Enables the reset command without any pre-configured scope."
},
{
"description": "Enables the save command without any pre-configured scope.",
"type": "string",
"const": "store:allow-save",
"markdownDescription": "Enables the save command without any pre-configured scope."
},
{
"description": "Enables the set command without any pre-configured scope.",
"type": "string",
"const": "store:allow-set",
"markdownDescription": "Enables the set command without any pre-configured scope."
},
{
"description": "Enables the values command without any pre-configured scope.",
"type": "string",
"const": "store:allow-values",
"markdownDescription": "Enables the values command without any pre-configured scope."
},
{
"description": "Denies the clear command without any pre-configured scope.",
"type": "string",
"const": "store:deny-clear",
"markdownDescription": "Denies the clear command without any pre-configured scope."
},
{
"description": "Denies the delete command without any pre-configured scope.",
"type": "string",
"const": "store:deny-delete",
"markdownDescription": "Denies the delete command without any pre-configured scope."
},
{
"description": "Denies the entries command without any pre-configured scope.",
"type": "string",
"const": "store:deny-entries",
"markdownDescription": "Denies the entries command without any pre-configured scope."
},
{
"description": "Denies the get command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get",
"markdownDescription": "Denies the get command without any pre-configured scope."
},
{
"description": "Denies the get_store command without any pre-configured scope.",
"type": "string",
"const": "store:deny-get-store",
"markdownDescription": "Denies the get_store command without any pre-configured scope."
},
{
"description": "Denies the has command without any pre-configured scope.",
"type": "string",
"const": "store:deny-has",
"markdownDescription": "Denies the has command without any pre-configured scope."
},
{
"description": "Denies the keys command without any pre-configured scope.",
"type": "string",
"const": "store:deny-keys",
"markdownDescription": "Denies the keys command without any pre-configured scope."
},
{
"description": "Denies the length command without any pre-configured scope.",
"type": "string",
"const": "store:deny-length",
"markdownDescription": "Denies the length command without any pre-configured scope."
},
{
"description": "Denies the load command without any pre-configured scope.",
"type": "string",
"const": "store:deny-load",
"markdownDescription": "Denies the load command without any pre-configured scope."
},
{
"description": "Denies the reload command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reload",
"markdownDescription": "Denies the reload command without any pre-configured scope."
},
{
"description": "Denies the reset command without any pre-configured scope.",
"type": "string",
"const": "store:deny-reset",
"markdownDescription": "Denies the reset command without any pre-configured scope."
},
{
"description": "Denies the save command without any pre-configured scope.",
"type": "string",
"const": "store:deny-save",
"markdownDescription": "Denies the save command without any pre-configured scope."
},
{
"description": "Denies the set command without any pre-configured scope.",
"type": "string",
"const": "store:deny-set",
"markdownDescription": "Denies the set command without any pre-configured scope."
},
{
"description": "Denies the values command without any pre-configured scope.",
"type": "string",
"const": "store:deny-values",
"markdownDescription": "Denies the values command without any pre-configured scope."
}
]
},