commit 102c38f72bf9398618a284d8c35e94c4b2d90daf
parent 4d31f327c9659240d93ab01e9343b8c0171249ea
Author: triesap <tyson@radroots.org>
Date: Tue, 25 Aug 2026 21:47:52 +0000
service-sqlite: bind the native qualification matrix
- qualify macOS aarch64 as the current developer runtime
- require Linux x86_64 for process-level storage evidence
- leave every other platform outside the active support gate
- bind the exact matrix in the package boundary regression
Diffstat:
3 files changed, 18 insertions(+), 10 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
@@ -339,10 +339,11 @@ Before editing code:
`SIGKILL`, and retain a parent kill-on-drop watchdog. Cover writer-lock death
and the exact pre-marker, prepared, marker-scratch, installed-replacement,
and terminal-marker restore topologies under a permissive child umask.
- Require Linux execution for OS-level qualification; macOS is developer
- evidence only. Do not ship a helper binary, add production signal/process
- behavior, poll filesystem state for crash timing, or claim abrupt power-loss
- durability from process-death tests.
+ Require Linux x86_64 execution for OS-level qualification; macOS aarch64 on
+ the current machine is developer evidence only. No other platform or
+ architecture is an active qualification gate. Do not ship a helper binary,
+ add production signal/process behavior, poll filesystem state for crash
+ timing, or claim abrupt power-loss durability from process-death tests.
- Runtime-management flows consume a sealed `RuntimeContext` for every service
instance. They must not reconstruct service paths from raw identifiers,
ambient selectors, or manager-owned roots, and registries must not persist
diff --git a/crates/service_sqlite/README.md b/crates/service_sqlite/README.md
@@ -259,7 +259,9 @@ and is constrained to `1..=i64::MAX`; it has no default. The value
implicit universal threshold. On Linux and macOS the platform adapter opens the
owner-owned state directory that is not group/other writable without following
links, retains and revalidates its identity, and uses `fstatvfs` to measure
-bytes available to the unprivileged service user. Other platforms fail closed.
+bytes available to the unprivileged service user. The current native
+qualification matrix is macOS aarch64 and Linux x86_64; other platforms fail
+closed and successful compilation outside that matrix is not support evidence.
A successful immutable snapshot is `ready` when available bytes are greater
than or equal to the configured minimum and `low_disk` when they are below it.
@@ -301,10 +303,11 @@ durable marker, prepared rollback, interrupted marker-scratch promotion,
installed-replacement recovery, and terminal-marker cleanup. A permissive
child umask cannot broaden the fixed `0700` state directory or `0600` lock,
database, stage, backup, marker, and marker-scratch artifacts. Linux execution
-is required for OS-level qualification; macOS execution is developer evidence,
-and unsupported targets compile the production library without the native
-process harness. These tests exercise process death at named durable edges and
-do not claim abrupt power-loss or storage-device durability behavior.
+on x86_64 is required for OS-level qualification; macOS aarch64 execution on
+the current machine is developer evidence. No other platform or architecture
+is an active qualification gate. These tests exercise process death at named
+durable edges and do not claim abrupt power-loss or storage-device durability
+behavior.
The crate owns mechanics only. Service-specific tables, SQL, repositories,
backup content policy, identity material, process lifecycle, and readiness
diff --git a/crates/service_sqlite/tests/package_boundary.rs b/crates/service_sqlite/tests/package_boundary.rs
@@ -315,6 +315,8 @@ fn service_sqlite_is_unpublished_lint_governed_and_dependency_bounded() {
"`268435456` is the exact governed configuration and test vector, not an implicit universal threshold",
"owner-owned state directory that is not group/other writable",
"uses `fstatvfs` to measure bytes available to the unprivileged service user",
+ "current native qualification matrix is macOS aarch64 and Linux x86_64",
+ "successful compilation outside that matrix is not support evidence",
"successful immutable snapshot is `ready` when available bytes are greater than or equal",
"`low_disk` when they are below it",
"measurement failure is a typed unavailable error and is never fabricated as low-disk evidence",
@@ -341,7 +343,9 @@ fn service_sqlite_is_unpublished_lint_governed_and_dependency_bounded() {
"orphan-stage refusal before a durable marker",
"interrupted marker-scratch promotion",
"permissive child umask cannot broaden",
- "Linux execution is required for OS-level qualification",
+ "Linux execution on x86_64 is required for OS-level qualification",
+ "macOS aarch64 execution on the current machine is developer evidence",
+ "No other platform or architecture is an active qualification gate",
"do not claim abrupt power-loss or storage-device durability behavior",
] {
assert!(
