Repository navigation
Conversation
Save atomic per-file inventory and expose print-only inspection with a protected exact-version execution loop. Co-authored-by: dessert <7d616e7e143e5d408159614dccff1371350a1c1bd36c8de838a45ece5aca0aca@buzz.block.builderlab.xyz> Signed-off-by: Ravneet Arora <rarora@squareup.com>
Allow larger read-only inventories while preserving atomic failure when the source scan exceeds its budget. Co-authored-by: dessert <7d616e7e143e5d408159614dccff1371350a1c1bd36c8de838a45ece5aca0aca@buzz.block.builderlab.xyz> Signed-off-by: Ravneet Arora <rarora@squareup.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add
buzz-admin user-deletions media --pubkey <npub-or-hex> --mode print-onlyto inspect a person's media across communities. It saves a resumable inventory and prints JSON after classification, without deleting source records or storage objects.One new table,
entity_deletion_media_files, stores each file's evidence, status, exact deletion targets and errors. Discovery rows and the completion marker commit together, including an empty inventory. Retries reuse the saved inventory. The shared handler supportsprint-only,printandno-print, and retries deletion of the same recorded object versions after a crash.This draft does not enable production deletion. The execution loop requires a
ProtectedMediaprovider. Durable reservations respected by every writer, approved downstream removal selectors and retention checks still need integration. Standalone preview keeps proven shared files and leaves unresolved filesunknown; it never manufactures an executable deletion plan. Direct destructive modes are rejected before connecting to services.The operator guide lists every source table, control-table write, mode and crash boundary. Source reads can use a separate read-only database connection while the journal stays local. No production database or bucket was accessed.
Related issue
Related: #8959 implements standalone agent database deletion. This PR adds the separate media inventory and recovery journal. No duplicate media-inventory PR was found.
Testing
Exercised the actual command against isolated local PostgreSQL and an HTTP S3 fixture. It found an unposted upload recorded only in a historical storage version, saved its inventory, and resumed with storage offline. The fixture rejects storage mutations. No human testing yet; keep this PR in draft.
To test with operator-provided source and storage connections, use a migrated local control database and run
cargo run -p buzz-admin -- user-deletions media --pubkey <npub> --include-owned-agents --mode print-only. Stdout should contain inventory JSON. Exit 2 means decisions remain unresolved. Resume the saved observation with the printed--run-id; use a new run ID to observe changed data. Larger source databases can use--max-source-rows 10000000 --scan-timeout-secs 900; exceeding any budget publishes no partial inventory.Broad local validation is not clean: an existing connection-pool test timed out, and an admission test process was killed during the database suite. The new inventory and recovery checks passed. The draft does not claim repository-wide validation or human testing is complete.
Generated with Codex