Repository navigation
Conversation
Make the Runtime-owned protect/media/custody/decrypt plane with Chain rights evidence the only protected-content authority, and remove the provisional one in the same slice. No fallback, dual route, or compatibility decoder survives. Removed: - the drm-provider, rights-provider, key-provider and decrypt-provider capsules, and their startup spawn/registration in server_infra; - the elastos_common::protected_content DTO module; - the elastos://drm|rights|key|decrypt capability mappings, which now fail closed as unsupported schemes; - those four names from the provider registry's RESERVED_SUB_NAMES allowlist, so a later provider cannot re-register the routes and quietly recreate a second authority; - the Library share provider chain and its readiness projections; - the content plane's "sealed" object kind, whose descriptor validation could not outlive SealedObjectV1. Nothing published one: the canonical mint publishes encrypted payloads through the ordinary content path; - the four providers from components.json, the publish/build sets and the capsule catalog; - scripts/protected-content-provider-contract-smoke.sh, which asserted that capsules that no longer exist stay fail-closed. The gates now assert the inverse of what they asserted before. setup.rs, publish.rs, check-wci-alignment.sh and the installed static audit fail if any retired name reappears in a capsule tree, components.json, an install profile, or the capability mapping. The entropy check's decode-time invariant moves from the deleted DTO to the canonical provider contracts, which carry the same deny_unknown_fields guarantee. Library share of plain published content is unchanged. Its projections and the share dialog now say protected content is published through Runtime custody publish, instead of offering a permanently disabled option and reporting a provider chain that could never be configured. The custody state root keeps its on-disk path protected-content/custody-provider/inactive: provisioned hosts and the container harness already hold state there, so the directory name is frozen and documented as historical. Docs, state.md, TASKS.md gate 9, the changelog and the system map are aligned in this slice. The map gains a protected-content open dynamic view drawn as installed product structure, with its change-gate record. The same slice drops the 10% free-space floor. Capsule and model preparation, the IPFS provider's private capacity check and the Runtime's recheck of it, Browser image preparation and packaging, release staging, media-tools and the update-hop comparison now require only that the work fits in the free space. Hosted egress history no longer refuses to record below 10% free, the release preparation script no longer refuses a volume below 10%, and the local pre-push check always runs the Rust suites. AGENTS.md, TASKS.md, state.md and the content distribution contract no longer require the floor; absolute minimums such as setup's 16 GiB and the media build's 4 GiB are unchanged.
Every item removed here had exactly one occurrence in the repository — its own definition — across all file types, and none was executed by any test. rustc cannot flag these: the dead_code lint assumes a public item has callers outside the crate, and in this closed workspace none of them do. Notable removals, all dead rather than merely untested: - three set_*_for_testing hooks on RunningVm that no test calls; - an auth challenge store (store/load/consume_challenge) and rotate_session_grant, superseded by the current session path; - start_tls_proxy, download_verified, publish_directory_via_provider and start_local_principal_runtime_session_with_transport, entry points nothing reaches; - three Documents request structs with no route behind them; - assorted unused builders and accessors (with_key, with_gateway, with_cache_limit, from_hex, new_unchecked, ok_with_data, after_mins). is_plaintext_root looked unreferenced by the same measure but is used by elastos/capsules/localhost-provider, so it stays. Imports orphaned by the removals are dropped in the same change. The suite is unchanged at 3751 passing, which is the expected result when what is deleted was never executed.
This was referenced Oct 2, 2026
Collaborator
Author
|
Local result for this branch alone: all 23 checks pass. That covers |
This was referenced Oct 7, 2026
This was referenced Oct 15, 2026
Open
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Protected content now has exactly one authority: the Runtime-owned protect, media, custody and decrypt plane, with Chain rights evidence. The provisional providers (
drm,rights,key,decrypt) and their routes are removed in the same slice, with no fallback or dual route left behind. The gates now fail if any retired name reappears.The same PR removes the 10% free-space floor everywhere it was enforced. Each check now requires only that the work fits in the free space. That covers capsule and model preparation, the IPFS provider's private capacity check and the Runtime's recheck of it, Browser image preparation and packaging, release staging, media-tools and update-hop tooling. Hosted egress history no longer refuses to record below 10% free, and
ci-local-prepush.shalways runs the Rust suites. Absolute minimums are unchanged, such as setup's 16 GiB and the media build's 4 GiB.Commits
feat(protected-content): atomic cutover to the Runtime-owned authority, which also drops the 10% floorchore: remove 42 unreferenced public items found by the coverage auditStack
First of four, based on
develop:Supersedes #59, which was rebuilt on the current
develop. Closes ELACITY-2299.Verification
The whole stack (top of PR 4) passes locally:
cargo fmt --checkand workspace clippy with-D warningsjust test-elastosandjust test-capsules(21 capsules)source-gatescript and the capsule browser testsjust product-ui-sourceThe same checks are running on this branch alone; I'll post the result as a comment. GitHub CI is the arbiter.