[Cipher208]

Scope

This PR completes the apply half of the graph-layer migration tool. It does not touch Hermes, Mimocode, CowAgent, or any live database.

The operator flow is now:

1. inventory — read-only snapshot + evidence manifest;
2. human edits candidate decision values in the exact manifest;
3. confirm-token --manifest PATH — token from the exact reviewed bytes;
4. apply --confirm TOKEN — snapshot + lock-time fingerprint + transactional move.

Safety properties

• exact manifest-byte confirmation, separate from DB freshness fingerprint;
• schema/layer/label/user/node/decision preflight before writes;
• BEGIN IMMEDIATE before the authoritative snapshot;
• exclusive private 0600 snapshot reservation, SQLite backup including WAL, file+directory fsync;
• report recovery file fsynced before SQLite commit;
• rollback on pre-commit report/snapshot failure;
• recovery report retained and named when final report installation fails after commit;
• all unapproved node IDs/layers checked, not only manifest candidates;
• only approved user → agent node layer changes; epi_edges never modified;
• cross-layer edge count and sample reported after the move;
• chunked node lookups work beyond SQLite's 32,766-variable limit;
• output/report/snapshot aliases of DB, WAL, SHM and journal refused;
• snapshot directory must be outside the live data directory;
• apply is explicitly rejected when there is no move set.

Verification

The blind verifier exercised 22 preflight/postcondition guards with mutation probes. The final cleanup verifier additionally proved:

• final snapshot directory fsync errors preserve the original error;
• installed snapshot remains valid for recovery;
• staging directories and reserved FDs are cleaned on parent-fsync/fchmod errors;
• no live database was touched.

pytest -q            2818 passed
ruff check / format  clean / 750 files
mypy source dirs     clean; repository baseline remains 63 errors outside touched source

Explicit non-goal

No live apply is performed by CI or this PR. After merge, we will run inventory with the approved marker/exclusion files, review the three manifests, then request a separate explicit write authorization before applying to each base.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Cipher208/a-memory
• Branch: feat/migrate-apply
• File: .coderabbit.yaml
• Commit: 1f8ec58
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 60a569c6-8e57-45e7-a5fa-af561d9debf4

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn