fix(registry): make operation migration authoritative

Author: wolfy-j

api/registry/provenance.go

@@ -15,19 +15,26 @@ import (
 // through OperationFormatHistory; it is a property of the store, not of one
 // row.
 const (
+	OperationRegistryMetadataVersion = 1
+
+	OperationModeTransition OperationMode = "transition"
+	OperationModeReconcile  OperationMode = "reconcile"
+
 	// OperationFormatLegacy is the shape written before registry-owned
-	// provenance: operations carry no provenance fields, and an ns.dependency
-	// entry states its deployment root through Entry.DependencyRoot. Such a
-	// store also holds updates for entries the current baseline no longer
-	// declares, which replay applies as upserts.
+	// provenance. Such a store also holds updates for entries the current
+	// baseline no longer declares, which replay applies as upserts.
 	OperationFormatLegacy = 1
 	// OperationFormatProvenance is the shape written by a runtime that owns
 	// provenance: every operation carries its own record, so replay holds the
 	// same total-map invariant a live transition holds.
 	OperationFormatProvenance = 2
+	// OperationFormatRegistryMetadata stores registry-owned state in its own
+	// versioned operation block instead of adding fields to the entry or the
+	// operation envelope.
+	OperationFormatRegistryMetadata = 3
 	// OperationFormatCurrent is the format this runtime writes. A wire-format
 	// change bumps it together with the migration that re-stamps the store.
-	OperationFormatCurrent = OperationFormatProvenance
+	OperationFormatCurrent = OperationFormatRegistryMetadata
 )
 
 // OperationFormatSnapshot is the complete, source-verified view a semantic
@@ -74,6 +81,60 @@ var ErrOperationFormatMigrationConflict = errors.New("operation format migration
 // until all branches have been rewritten.
 var ErrOperationFormatMigrationIncomplete = errors.New("operation format migration does not cover complete history")
 
+// NewOperationRegistryMetadata creates the versioned registry-owned portion
+// of an operation. The records are copied so callers retain no mutable alias.
+func NewOperationRegistryMetadata(current, previous *EntryProvenance) *OperationRegistryMetadata {
+	if current == nil && previous == nil {
+		return nil
+	}
+	return NewOperationRegistryMetadataWithMode(OperationModeTransition, current, previous)
+}
+
+// NewOperationRegistryMetadataWithMode creates registry-owned operation state
+// with explicit application semantics.
+func NewOperationRegistryMetadataWithMode(mode OperationMode, current, previous *EntryProvenance) *OperationRegistryMetadata {
+	metadata := &OperationRegistryMetadata{Version: OperationRegistryMetadataVersion, Mode: mode}
+	if current != nil {
+		copy := *current
+		metadata.Current = &copy
+	}
+	if previous != nil {
+		copy := *previous
+		metadata.Previous = &copy
+	}
+	return metadata
+}
+
+// OperationMode returns the registry application semantics carried by the
+// operation. An empty value is invalid in the current operation format.
+func (o Operation) OperationMode() OperationMode {
+	if o.Registry == nil {
+		return ""
+	}
+	return o.Registry.Mode
+}
+
+// CurrentProvenance returns the registry state produced by the operation.
+func (o Operation) CurrentProvenance() *EntryProvenance {
+	if o.Registry == nil {
+		return nil
+	}
+	return o.Registry.Current
+}
+
+// PreviousProvenance returns the registry state replaced by the operation.
+func (o Operation) PreviousProvenance() *EntryProvenance {
+	if o.Registry == nil {
+		return nil
+	}
+	return o.Registry.Previous
+}
+
+// SetRegistryMetadata replaces the registry-owned portion of an operation.
+func (o *Operation) SetRegistryMetadata(current, previous *EntryProvenance) {
+	o.Registry = NewOperationRegistryMetadata(current, previous)
+}
+
 // ErrMissingProvenance reports a state entry without a provenance record — a
 // violation of the ProvenanceMap total-map invariant.
 var ErrMissingProvenance = errors.New("entry has no provenance record")

api/registry/registry.go

@@ -114,24 +114,34 @@ type (
 		Meta attrs.Bag       `json:"meta"`
 		ID   ID              `json:"id"`
 		Kind Kind            `json:"kind"`
-		// DependencyRoot identifies an ns.dependency selected as a deployment
-		// root. It is independent of package ownership, so a published app entry
-		// can retain meta.module while remaining a root.
-		DependencyRoot bool `json:"dependency_root,omitempty"`
 	}
 
 	// ChangeSet represents a set of operations to transition the registry from one state to another
 	ChangeSet []Operation
 
 	// Operation represents a single operation within a ChangeSet
 	Operation struct {
-		OriginalEntry      *Entry           `json:"original_entry,omitempty"`
-		Provenance         *EntryProvenance `json:"provenance,omitempty"`
-		OriginalProvenance *EntryProvenance `json:"original_provenance,omitempty"`
-		Kind               event.Kind       `json:"kind"`
-		Entry              Entry            `json:"entry"`
+		OriginalEntry *Entry                     `json:"original_entry,omitempty"`
+		Registry      *OperationRegistryMetadata `json:"registry,omitempty"`
+		Kind          event.Kind                 `json:"kind"`
+		Entry         Entry                      `json:"entry"`
 	}
 
+	// OperationRegistryMetadata is registry-owned transition state. It is kept
+	// outside the author-owned entry and versioned independently so additional
+	// registry invariants do not enlarge the entry schema.
+	OperationRegistryMetadata struct {
+		Current  *EntryProvenance `json:"current,omitempty"`
+		Previous *EntryProvenance `json:"previous,omitempty"`
+		Mode     OperationMode    `json:"mode"`
+		Version  int              `json:"version"`
+	}
+
+	// OperationMode defines how persisted registry state is applied. Live
+	// transitions are exact; migrated history converges the stored declaration
+	// independently of the deployment baseline present during replay.
+	OperationMode string
+
 	// DependencyPattern defines a pattern for extracting dependencies from entries
 	DependencyPattern struct {
 		// Path is the location in entry metadata/data to search (e.g., "meta.server", "data.fs")

api/registry/resolution.go

@@ -50,6 +50,7 @@ type DependencyRoot struct {
 type DependencyResolution struct {
 	Digest         string           `json:"digest"`
 	InputDigest    string           `json:"input_digest"`
+	BaselineModel  string           `json:"baseline_model,omitempty"`
 	BaselineDigest string           `json:"baseline_digest,omitempty"`
 	Roots          []DependencyRoot `json:"roots"`
 	// References are root-shaped declarations folded into an existing root for
@@ -75,7 +76,8 @@ func CanRebaseDependencyResolution(existing, next *DependencyResolution) bool {
 	if next.BaselineDigest == "" || existing.Digest == next.Digest {
 		return false
 	}
-	return existing.BaselineDigest == "" || existing.BaselineDigest != next.BaselineDigest
+	return (existing.BaselineModel == "" && next.BaselineModel != "") ||
+		existing.BaselineDigest == "" || existing.BaselineDigest != next.BaselineDigest
 }
 
 // Canonical returns a detached, deterministically ordered resolution and
@@ -86,6 +88,7 @@ func (r *DependencyResolution) Canonical() *DependencyResolution {
 	}
 	out := &DependencyResolution{
 		InputDigest:    r.InputDigest,
+		BaselineModel:  r.BaselineModel,
 		BaselineDigest: r.BaselineDigest,
 		Roots:          append([]DependencyRoot(nil), r.Roots...),
 		References:     append([]DependencyRoot(nil), r.References...),
@@ -220,6 +223,7 @@ func constraintPermitsSelection(constraint, selected string) bool {
 func (r *DependencyResolution) computeDigest() string {
 	payload := struct {
 		InputDigest    string           `json:"input_digest"`
+		BaselineModel  string           `json:"baseline_model,omitempty"`
 		BaselineDigest string           `json:"baseline_digest,omitempty"`
 		Roots          []DependencyRoot `json:"roots"`
 		// omitempty keeps a reference-free digest byte-identical to prior
@@ -229,6 +233,7 @@ func (r *DependencyResolution) computeDigest() string {
 		Modules    []ResolvedModule `json:"modules"`
 	}{
 		InputDigest:    r.InputDigest,
+		BaselineModel:  r.BaselineModel,
 		BaselineDigest: r.BaselineDigest,
 		Roots:          r.Roots,
 		References:     r.References,

boot/build/stages/link_fixture_test.go

@@ -10,11 +10,12 @@ import (
 	"github.com/wippyai/runtime/api/registry"
 )
 
-// Fixtures declare who owns an entry with a "module" meta key and with
-// Entry.DependencyRoot. linkFixtureProvenance moves those declarations into the
-// provenance the stage reads and removes them from the entries, so a fixture
-// can never make the stage read ownership from author payload.
-const fixtureModuleKey = "module"
+// Fixtures declare registry-owned state in metadata used only while arranging
+// a test. linkFixtureProvenance removes it before the stage sees the entries.
+const (
+	fixtureModuleKey = "module"
+	fixtureRootKey   = "dependency_root"
+)
 
 func fixtureEntryModule(entry registry.Entry) string {
 	if entry.Meta == nil {
@@ -27,9 +28,12 @@ func fixtureEntryModule(entry registry.Entry) string {
 func linkFixtureProvenance(prov registry.ProvenanceMap, entries *[]registry.Entry) {
 	for i := range *entries {
 		entry := &(*entries)[i]
-		record := registry.EntryProvenance{Module: fixtureEntryModule(*entry), Root: entry.DependencyRoot}
-		entry.DependencyRoot = false
+		record := registry.EntryProvenance{Module: fixtureEntryModule(*entry)}
+		if entry.Meta != nil {
+			record.Root, _ = entry.Meta[fixtureRootKey].(bool)
+		}
 		delete(entry.Meta, fixtureModuleKey)
+		delete(entry.Meta, fixtureRootKey)
 		prov[entry.ID] = record
 	}
 }

boot/build/stages/linking_test.go

@@ -2031,10 +2031,9 @@ func TestLink_RootParameterBeatsTransitiveBareAliasSpelling(t *testing.T) {
 
 	entries := []registry.Entry{
 		{
-			ID:             registry.NewID("app.deps", "telegram_root"),
-			Kind:           registry.NamespaceDependency,
-			Meta:           map[string]any{"module": "acme/app"},
-			DependencyRoot: true,
+			ID:   registry.NewID("app.deps", "telegram_root"),
+			Kind: registry.NamespaceDependency,
+			Meta: map[string]any{"module": "acme/app", fixtureRootKey: true},
 			Data: payload.New(map[string]any{
 				"component": "butschster/telegram",
 				"parameters": []any{

boot/deps/hub/dependency_boot_test.go

@@ -67,8 +67,8 @@ modules:
 	baseline := func(selected string) regapi.ProvenancedState {
 		root := regapi.Entry{
 			ID: regapi.NewID("app.deps", "app"), Kind: regapi.NamespaceDependency,
-			DependencyRoot: true,
-			Data:           payload.New(map[string]any{"component": "acme/app", "version": selected}),
+			Meta: attrs.NewBagFrom(map[string]any{fixtureRootKey: true}),
+			Data: payload.New(map[string]any{"component": "acme/app", "version": selected}),
 		}
 		service := regapi.Entry{
 			ID: regapi.NewID("acme.app", "service"), Kind: "service",
@@ -330,11 +330,10 @@ func TestDependencyHandler_ApplyVersionReconciliationSemantics(t *testing.T) {
 		reg, runner, baselineVersion, hostID := newLegacyArtifactRollbackRegistry(ctx, t)
 
 		addonRoot := regapi.Entry{
-			ID:             regapi.NewID("app.deps", "addon"),
-			Kind:           regapi.NamespaceDependency,
-			DependencyRoot: true,
+			ID:   regapi.NewID("app.deps", "addon"),
+			Kind: regapi.NamespaceDependency,
 			Meta: attrs.NewBagFrom(map[string]any{
-				fixtureModuleKey: "acme/deployment", fixtureModuleVersionKey: "v1.0.0",
+				fixtureModuleKey: "acme/deployment", fixtureModuleVersionKey: "v1.0.0", fixtureRootKey: true,
 			}),
 			Data: payload.New(map[string]any{"component": "acme/addon", "version": "v1.0.0"}),
 		}
@@ -508,9 +507,8 @@ modules:
 	)
 	root := regapi.Entry{
 		ID: regapi.NewID("app.deps", "app"), Kind: regapi.NamespaceDependency,
-		DependencyRoot: true,
 		Meta: attrs.NewBagFrom(map[string]any{
-			fixtureModuleKey: "acme/deployment", fixtureModuleVersionKey: "v1.0.0",
+			fixtureModuleKey: "acme/deployment", fixtureModuleVersionKey: "v1.0.0", fixtureRootKey: true,
 		}),
 		Data: payload.New(map[string]any{"component": "acme/app", "version": "v1.0.0"}),
 	}

boot/deps/hub/dependency_control.go

@@ -15,10 +15,11 @@ func isRootDependency(entry regapi.Entry, prov regapi.EntryProvenance) bool {
 	return entry.Kind == regapi.NamespaceDependency && prov.Root
 }
 
-// collectControlledModules returns the dependency graph reachable from the
-// state's deployment roots. A root's package owner is provenance, not part of
-// that graph: the root controls its declared component, while ordinary owned
-// dependencies extend the graph from owner to component.
+// collectControlledModules returns the deployment-lock cleanup boundary plus
+// components reachable through registry dependency declarations. A root's
+// package owner is provenance, not part of that graph: the root controls its
+// declared component, while ordinary owned dependencies extend the graph from
+// owner to component.
 func (h *DependencyHandler) collectControlledModules(
 	ctx context.Context,
 	snapshot regapi.ProvenancedState,