[tee8z]

Restore authorized snapshot plaintext into a fresh, owner-only, read-only Git mirror. The reader validates the archive before staging, reserves explicit work/store capacity, imports and verifies self-contained bundles, and publishes with atomic no-replacement semantics. Local history, branches, shallow boundaries and working diffs survive. Excluded tracked files stay absent without appearing deleted; genuine deletions remain visible.

This layer follows archive-plan #171. It exposes the library API needed by the next snapshot CLI consumer; it adds no user restore command. check_git().await refuses unsupported platforms or unavailable/denied Git before a request. Linux and macOS require Git 2.29+. Paseo keeps its host-tools=on prerequisite.

Restore uses a private staging area, fixed bounded Git commands, full object integrity/inventory checks, explicit cancellation with cleanup, and owner-only 0400/0500 output. Each store serializes restores. Filesystem free space and configured budgets both gate admission; free space does not reveal an emptyDir quota. Callers cancel the token and await completion instead of aborting the future. Delivered local copies remain after grant expiry.

Validation:

• All 526 CLI tests pass; all-target Clippy, formatting, diff and three lockfile metadata checks pass.
• Nine restore journeys pass in the hardened image with UID 10001, a read-only root, no network, dropped capabilities and a 1 GiB memory cap. They include restoration of the actual packaged producer archive.
• Real SHA-1/SHA-256 repositories cover dirty files, genuine deletions, excluded tracked paths, executable files, internal links, local branches and shallow history.
• Destination-creation races, existing-store/work limits, deep empty repository directory costs, malformed refs, cancellation and isolated Git process teardown are covered.
• Six production guard mutations fail: work admission, atomic publication, excluded-path index flags, Git integrity checks, deep-directory admission and null ref IDs.
• Native just ci passed full workspace all-target Clippy in 10m10s, then stopped at a noninteractive pnpm dependency refresh. Fresh worktree dependencies are installed; the remaining broad gate retry is pending. This draft does not claim the broad gate is green.

The PR carries two already-reviewed prerequisites without rewriting published history: #168 Docker-context fix 1a1d563de as 129d5f3f4, and #170 encrypted-frame fix 119b065cc as 5e471aa9a. Their owning PRs remain authoritative.

The diff has 1,608 changed lines: 199 carried prerequisite lines, and 1,409 for this layer including 496 realistic test lines. The bounded archive parser was already split into #171. The remaining staging, Git validation, cleanup and atomic publication form one filesystem safety boundary; splitting them would expose an incomplete restore API.

Independent final-source review and human integrated testing remain pending. Draft status is preserved; no deployment or review attestation.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tee8z]

Independent agent review of b426b84f3 against the read-only snapshot restore contract.

No blocking correctness, security, or agreed-contract findings remain. Minimalism: 9/10. Elegance: 9/10. Correctness: 9/10.

I inspected the archive-plan boundary, capacity accounting, neutral Git import, process-group teardown, cancellation, safe-link ordering, read-only permissions, and atomic no-replacement publication. The final platform source matches the reviewed freeze (94a107102508e1e9e84147e0aa1b0741d604290371415597a52c56b751a9f8e2). Ref creation uses NUL-delimited transactions and refuses null object IDs. SDK header validation already rejects whitespace/control characters before restore.

Independent runtime checks from the pinned final executable:

• Eight automatic restore tests passed in 3.60 seconds. These exercise real SHA-1/SHA-256 repositories, local branches, explicit shallow boundaries, excluded tracked paths, working-tree deletions, safe links, capacity refusal, cancellation, Git process boundaries, and destination races.
• The exact packaged producer archive restored its history and working diff in 0.05 seconds. This fixture test is intentionally separate from the automatic suite.
• The isolated child-driver test is invoked by its automatic parent; its direct ignored status does not omit that boundary.

Logs: /tmp/buzz-snapshot-restore-independent.log and /tmp/buzz-snapshot-restore-packaged-independent.log.

This evidence covers the restore foundation. It does not attest the unfinished CLI request/download flow, full ACP snapshot journey, final combined CI, native Paseo interaction, or human acceptance. Keep this PR draft until the repository checklist is satisfied.

[tee8z]

Follow-up review of the executable-mode correction in 5876c9bd3 and producer carry 6a3d89561.

The reproduced case is concrete: a source file with mode 0654 is non-executable to Git. Converting any 0111 bit into owner execute introduced a false Git mode change. Restore now uses owner 0100 at both permission-freeze points. The owning producer correction is PR #168 at e094c955e and is carried here without rewriting published history.

I inspected both deltas and independently ran the pinned final production-seam regression, nonowner_execute_bits_do_not_invent_git_mode_changes: PASS, 0.07 seconds. It checks real Git diffs and exact 0400 output. Log: /tmp/buzz-snapshot-restore-owner-exec-independent.log.

No remaining blocker in the reviewed restore delta. Minimalism, elegance, and correctness remain 9/10. Corrected normal-image producer validation and the complete upload/CLI journey remain separate checks; keep this PR draft pending those gates and human testing.