Detect the flat layout in history; refuse it without the legacy capability (issue 2)

.ddd/seams/seam-rust-ledger-cli-src-commands-verify-rs.yaml

@@ -24,3 +24,9 @@ bindings:
   after: sha256:f6f3e91d7c7a4d62879b72c501f573fe83dcd8e961b5fe6e7aeb5f71fb6f9671
   base_revision: 88b3de113c03fa70091d00fef217e55d44ccac3e
   hash: sha256:2848d2674f2097fb042c05ddd593a86fd580d98ceeb07990822599ebec82cea0
+- symbol: legacy_layout
+  file: ledger-cli/src/commands/verify.rs
+  before: sha256:f6f3e91d7c7a4d62879b72c501f573fe83dcd8e961b5fe6e7aeb5f71fb6f9671
+  after: sha256:715a87a4601fb9b95cd50c5f51f8749a684935110771775692b5bf24a068568d
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:6789df6cbef5073d922b5a3697cdf55428d8fe89207fa7a7b92b757b834c65a5

.ddd/seams/seam-rust-ledger-core-src-blame-rs.yaml

@@ -0,0 +1,14 @@
+format: 2
+id: seam/rust/ledger-core-src-blame-rs
+boundary: contract surface of ledger-core/src/blame.rs
+verdict_knowledge: 'Callers learn git blame attribution follows a file along its lineage: with the legacy capability the pickaxe also names the flat path the file had before the re-layout, so the introducing author is the original one and never the re-layout commit''s (LP-3.35).'
+contract_location: ledger-core/src/blame.rs
+obligations: []
+metadata: {}
+bindings:
+- symbol: introducing_author
+  file: ledger-core/src/blame.rs
+  before: sha256:12d4ae9b7ddb2af8423df3ca1bc1f2b0fdc942c95539d6622a18c6811c408a6b
+  after: sha256:bd37b146167ee5eecaaa06c8ced110c1a7199e6921d2e9a56c1f19b53a09c9a3
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:cc0047860f00c1d511d995adefb15ba8b5abf8db6e2b5eec73b15e84e8f95163

.ddd/seams/seam-rust-ledger-core-src-changeset-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-core-src-changeset-rs
 boundary: contract surface of ledger-core/src/changeset.rs
-verdict_knowledge: "Consumers learn a change-set carries the format-6 authority lists beside decisions, versions, acceptances and revocations, with empty() and entry counts covering every kind."
+verdict_knowledge: Consumers learn a change-set carries the format-6 authority lists beside decisions, versions, acceptances and revocations, with empty() and entry counts covering every kind.
 contract_location: ledger-core/src/changeset.rs
 obligations: []
 metadata: {}
@@ -60,3 +60,9 @@ bindings:
   after: sha256:2938b1158a1b74fa565a3e7ce98bd1a6cc0ac1040e0186ddcf60ccbf7439494b
   base_revision: e33398d874ec5ddd52404c4f2c16039d5ed7cdbb
   hash: sha256:370983173de896f16fe302261036f485b1e78a7dd877b7d02f4982478b49586d
+- symbol: namespace_hint
+  file: ledger-core/src/changeset.rs
+  before: sha256:60d4f5850702a7873ba96aa09bf7c94e717a0d15537303db7a8c4140791fbb1b
+  after: sha256:773050254a354008bf7ff67fcfc116e019dc374381f6ecedb22c1ccb0d10df5f
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:643d517323816382107be0d7d7bfd9264517849a14141ce2f1b393f8337c8698

.ddd/seams/seam-rust-ledger-core-src-landing-rs.yaml

@@ -1,7 +1,7 @@
 format: 2
 id: seam/rust/ledger-core-src-landing-rs
 boundary: contract surface of ledger-core/src/landing.rs
-verdict_knowledge: "Callers learn when an entity entered the record (D6): the first first-parent commit whose version of its file holds it, positions ordered by landing then at, computed against a base so a branch reads as its merge would."
+verdict_knowledge: 'Callers learn when an entity entered the record (D6): the first first-parent commit whose version of its file holds it, positions ordered by landing then at, computed against a base so a branch reads as its merge would.'
 contract_location: ledger-core/src/landing.rs
 obligations: []
 metadata: {}
@@ -222,3 +222,39 @@ bindings:
   after: sha256:164acf3c23ea8bdcafe66807f6a57f9fe56fc6ed105c503daeacb184deff58d9
   base_revision: 88b3de113c03fa70091d00fef217e55d44ccac3e
   hash: sha256:3cad8354bec6d565b07d261b4376cf848f5a9404cdf884f59e24b35b96767221
+- symbol: content_at_any
+  file: ledger-core/src/landing.rs
+  before: sha256:8020dbe3933d7a0be4a146e0c615cee9799f7faddb9000ad2e9101823ddc90d8
+  after: sha256:3375480dcd06034118add6b0bbbdf4daa320bf9f72fa7ce9f01e4285b9cbb984
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:01069fe69813aa064bd8459e88c9352f39641a00094e73ca6c34aaf66e44a287
+- symbol: lineage
+  file: ledger-core/src/landing.rs
+  before: sha256:8020dbe3933d7a0be4a146e0c615cee9799f7faddb9000ad2e9101823ddc90d8
+  after: sha256:3375480dcd06034118add6b0bbbdf4daa320bf9f72fa7ce9f01e4285b9cbb984
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:27742c9d7a1815d039264febf14b21f752ef5f8025a2d7c5672b9eeff81e6ba3
+- symbol: lineage_versions
+  file: ledger-core/src/landing.rs
+  before: sha256:8020dbe3933d7a0be4a146e0c615cee9799f7faddb9000ad2e9101823ddc90d8
+  after: sha256:3375480dcd06034118add6b0bbbdf4daa320bf9f72fa7ce9f01e4285b9cbb984
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:dbc2be26a748cce2b4e422b86f3e6176a5c2152253fa7aa8f294dfa242fe559b
+- symbol: touched_after_landing
+  file: ledger-core/src/landing.rs
+  before: sha256:8020dbe3933d7a0be4a146e0c615cee9799f7faddb9000ad2e9101823ddc90d8
+  after: sha256:3375480dcd06034118add6b0bbbdf4daa320bf9f72fa7ce9f01e4285b9cbb984
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:c18d08e81be611cec65fc0fd846b82a940c2ca1c187db8e294b301c676bd4cf3
+- symbol: legacy
+  file: ledger-core/src/landing.rs
+  before: sha256:8020dbe3933d7a0be4a146e0c615cee9799f7faddb9000ad2e9101823ddc90d8
+  after: sha256:3375480dcd06034118add6b0bbbdf4daa320bf9f72fa7ce9f01e4285b9cbb984
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:90b7fe1994140099a9bebd35061bfe4ff4a4fcd9520031509d187f603438d341
+- symbol: compute
+  file: ledger-core/src/landing.rs
+  before: sha256:8020dbe3933d7a0be4a146e0c615cee9799f7faddb9000ad2e9101823ddc90d8
+  after: sha256:3375480dcd06034118add6b0bbbdf4daa320bf9f72fa7ce9f01e4285b9cbb984
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:a2645b9b81dc991a63ce1af1332d0469eff7b3ca96810b3c9b140e4283bdfdd4

.ddd/seams/seam-rust-ledger-core-src-layout-rs.yaml

@@ -156,3 +156,39 @@ bindings:
   after: sha256:59ba9bd3f17cd6ac0a9388a82e33aaff1137703f223e829c13c09851ba31781e
   base_revision: 70395dfe317cb9a00665433813766ca763f3c58a
   hash: sha256:d8280851d3938727e513a912caa8b9a94fedad29bf46a227ec623b7dc9e6d29e
+- symbol: FLAT_TRACKED
+  file: ledger-core/src/layout.rs
+  before: sha256:59ba9bd3f17cd6ac0a9388a82e33aaff1137703f223e829c13c09851ba31781e
+  after: sha256:387c4847112a3705992e8b129d3a5b719995e80a994250b3dcd55891e6dc174d
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:ebf7600830e77b4620fe516e217409afcc672ceca8853af041579db2588231c5
+- symbol: classify_flat
+  file: ledger-core/src/layout.rs
+  before: sha256:59ba9bd3f17cd6ac0a9388a82e33aaff1137703f223e829c13c09851ba31781e
+  after: sha256:387c4847112a3705992e8b129d3a5b719995e80a994250b3dcd55891e6dc174d
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:78dc38fe8fbd21c85cfe1bf4d1fefa5086d2f95f81d11c5b6bfacdb9bfc0cd90
+- symbol: flat_counterpart
+  file: ledger-core/src/layout.rs
+  before: sha256:59ba9bd3f17cd6ac0a9388a82e33aaff1137703f223e829c13c09851ba31781e
+  after: sha256:387c4847112a3705992e8b129d3a5b719995e80a994250b3dcd55891e6dc174d
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:7103837e2c1bba7671458e636e4cfc838785f5f080c5298ee2ac2064109ac37b
+- symbol: flat_history
+  file: ledger-core/src/layout.rs
+  before: sha256:59ba9bd3f17cd6ac0a9388a82e33aaff1137703f223e829c13c09851ba31781e
+  after: sha256:387c4847112a3705992e8b129d3a5b719995e80a994250b3dcd55891e6dc174d
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:16c971037cd98f29f2a8ea49827b25e84d2718df6b8f1df6289c9bbfab6a67c7
+- symbol: moved_to
+  file: ledger-core/src/layout.rs
+  before: sha256:59ba9bd3f17cd6ac0a9388a82e33aaff1137703f223e829c13c09851ba31781e
+  after: sha256:387c4847112a3705992e8b129d3a5b719995e80a994250b3dcd55891e6dc174d
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:9fb33d6cb75edf885846288e61d6f2ab1c37ef50da014cfe3aec1d2236833aef
+- symbol: moved_to_a_namespace
+  file: ledger-core/src/layout.rs
+  before: sha256:59ba9bd3f17cd6ac0a9388a82e33aaff1137703f223e829c13c09851ba31781e
+  after: sha256:387c4847112a3705992e8b129d3a5b719995e80a994250b3dcd55891e6dc174d
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:9cde5daa6c7c09e4832001770a66465c2c1e4af1cbe75586368a6b65c03efacd

.ddd/seams/seam-rust-ledger-core-src-verify-integrity-rs.yaml

@@ -0,0 +1,14 @@
+format: 2
+id: seam/rust/ledger-core-src-verify-integrity-rs
+boundary: contract surface of ledger-core/src/verify/integrity.rs
+verdict_knowledge: 'Callers learn the blame-consistency check takes the legacy flag so that, in a repository whose history holds the flat layout, an entity''s introducing author is read across the re-layout rather than from the move (LP-3.35).'
+contract_location: ledger-core/src/verify/integrity.rs
+obligations: []
+metadata: {}
+bindings:
+- symbol: blame_consistency
+  file: ledger-core/src/verify/integrity.rs
+  before: sha256:c014372bf22afda6daaeeea21a4bf6e8a91a272a0c774abae734b2427ac56663
+  after: sha256:ae758c7c418b13c7bd4843c27a0c4aa8fe211e8e2164782afc9baf1dbf24e551
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:231feb826f40caf6825079b1143f2cbc2e8de3b0cd5a902d7c5a06e1e02719d7

.ddd/seams/seam-rust-ledger-core-src-verify-mod-rs.yaml

@@ -126,3 +126,9 @@ bindings:
   after: sha256:770850c2399abca19404cfdf31c4dfebcbc398e8d746a1d2aa710fe9dc8566d6
   base_revision: c4b9c904c0389a9e3b484e92436dd01637346118
   hash: sha256:039b19c6fd36f4909fe03bfd67b932a80edcd516b103326cad8a46f46bbebcbf
+- symbol: legacy_layout
+  file: ledger-core/src/verify/mod.rs
+  before: sha256:77b45a4c3de98cc4e558d1cc07c6b1d76e42d7ff882d79b2fabbe5a48f4de89a
+  after: sha256:eb8a89495dc2394ff2e7b1e744dbb9b6618025467690ac07e743848a575804c3
+  base_revision: 15c24ade6ff251ca8618d52c8e77a1e8b4cf4020
+  hash: sha256:48a5f6a970da933c6a8ba1cd334c4e59a07f8c2342652f13268192259ae96bad

ledger-cli/src/commands/cli_enum.rs

@@ -348,6 +348,11 @@ pub enum Commands {
         /// Judge acceptance expiry against this date instead of today
         #[arg(long, value_name = "DATE")]
         today: Option<String>,
+        /// Verify as an implementation without the legacy capability of
+        /// ruling 82 would: a history holding the flat layout of revision
+        /// v1.8 is refused with exit 2, naming its first flat commit
+        #[arg(long)]
+        no_legacy_layout: bool,
         /// Skip the git blame pass (class L009)
         #[arg(long)]
         no_blame: bool,

ledger-cli/src/commands/mod.rs

@@ -136,8 +136,8 @@ fn dispatch_read(command: Commands, root: Option<PathBuf>) -> Result<i32, String
             inspect::show(root, inspect::ShowFlags { decision, set, group, json, today })
         }
         Commands::Status { today } => inspect::status(root, today.as_deref()),
-        Commands::Verify { gate, json, today, no_blame, export, base } => {
-            verify::run(root, verify::Args { gate, json, today, blame: !no_blame, export, base })
+        Commands::Verify { gate, json, today, no_legacy_layout, no_blame, export, base } => {
+            verify::run(root, verify::Args { gate, json, today, blame: !no_blame, export, base, legacy_layout: !no_legacy_layout })
         }
         // Every writing verb is handled by `dispatch`, which routes here
         // only for what is left. Reaching this arm means a variant was

ledger-cli/src/commands/verify.rs

@@ -21,17 +21,24 @@ pub struct Args {
     /// The base landing is computed against (D6); default `origin/HEAD`
     /// when the clone has it.
     pub base: Option<String>,
+    /// Whether this run has the legacy capability of ruling 82 (LP-3.35):
+    /// without it, a history holding the flat layout is refused with exit 2.
+    pub legacy_layout: bool,
 }
 
 pub fn run(root: Option<PathBuf>, args: Args) -> Result<i32, String> {
     let repo_root = resolve_root(root)?;
     let base = args.base.or_else(|| ledger_core::landing::Landing::default_base(&repo_root));
+    if !args.legacy_layout {
+        refuse_flat_history(&repo_root, base.as_deref())?;
+    }
     let options = Options {
         gate: args.gate.as_deref().map(parse_gate).transpose()?,
         today: parse_today(args.today.as_deref())?,
         blame: args.blame,
         history: true,
         base: base.clone(),
+        legacy_layout: args.legacy_layout,
     };
     let mut loaded = store::load(&repo_root);
     match &base {
@@ -64,6 +71,24 @@ pub fn run(root: Option<PathBuf>, args: Args) -> Result<i32, String> {
     Ok(if report.is_conformant() { EXIT_OK } else { EXIT_VIOLATIONS })
 }
 
+/// A verifier without the legacy capability cannot verify a repository
+/// whose history holds the flat layout of revision v1.8: it refuses before
+/// reading anything, names the first flat commit, and never reports the
+/// repository conformant (LP-3.35; rulings 82, 97). Exit 2: the gate could
+/// not run, which is the verifier's limit and not a finding about the store.
+fn refuse_flat_history(root: &std::path::Path, base: Option<&str>) -> Result<(), String> {
+    let mut revs = vec!["HEAD"];
+    revs.extend(base);
+    match ledger_core::layout::flat_history(root, &revs) {
+        None => Ok(()),
+        Some(commit) => Err(format!(
+            "this repository's history holds the flat layout of revision v1.8, first at commit {commit}, and this run has no \
+             legacy capability to read it (ruling 82) — the repository cannot be verified by it; a verifier with the capability \
+             (this one, without `--no-legacy-layout`) reads both path patterns in history (LP-3.35)"
+        )),
+    }
+}
+
 fn parse_gate(name: &str) -> Result<Gate, String> {
     match name {
         "readiness" => Ok(Gate::Readiness),

ledger-cli/tests/binding_accounting.rs

@@ -27,7 +27,7 @@ enum Expect {
 fn accounted(repo: &Repo) -> Vec<(String, Expect)> {
     let store = ledger_core::store::load(repo.path());
     let today = Utc::now().date_naive();
-    let landing = ledger_core::landing::Landing::compute(repo.path(), None).expect("landing");
+    let landing = ledger_core::landing::Landing::compute(repo.path(), None, true).expect("landing");
     let trusted: Vec<String> =
         ledger_core::signing::check::check(&store, &landing, today).trusted.iter().map(|b| b.id.to_string()).collect();
     let report = ledger_core::verify::verify(&store, &ledger_core::verify::Options::full(today));