sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal by doge-rgb · Pull Request #52 · cocoonstack/sandbox

sandboxd: let the node's root token drive the sandbox lifecycle

doge-rgb

committed

485e055

sandboxd: gossip checkpoint ownership so a branch can find its node

doge-rgb

committed

d9ff169

sandboxd: pull a checkpoint from a peer when no owner can serve the branch

doge-rgb

committed

6f7f22c

simplify: drop the dead tar export and the tier-memory parser

CMGS

committed

1904cf9

review: comment budget, declaration layout and the lint/asl gates

CMGS

committed

838220c

simplify: drop a dead archive filter and three copy-forward duplications

CMGS

committed

a2a5a56

review: propagate ctx into CheckpointIDs, dedup the owners scans

CMGS

committed

2383e9d

review: propagate ctx through UpdateSelf

CMGS

committed

48d9aaf

review: carry the daemon ctx into mesh for callback logging

CMGS

committed

0feb179

sandboxd: heal only after redirect cannot answer, gossip from memory

CMGS

committed

c72dae8

sdk: follow a checkpoint redirect instead of claiming nothing

CMGS

committed

6850744

sandboxd: one credential type instead of paired operator verbs

CMGS

committed

eeaed37

sandboxd: probe peers for a checkpoint instead of gossiping every id

CMGS

committed

b961e3b

sandboxd: bound the heal, gate the blob, and let a delete reach a replica

CMGS

committed

19f6a86

review: cut the comment budget back to the repo's own density

CMGS

committed

14a4f88

config: a healed replica needs a finite life, and a fleet-agreed one

CMGS

committed

c483590

sandboxd: make a delete and a heal of one id wait on each other

CMGS

committed

a19d72e

sdk: name the candidate's failure in the fallback test

CMGS

committed

b3a7ec9

sandboxd: pull outside the record lock, and let a delete veto the publish

CMGS

committed

1f9bc40

mesh: a redirect spends the warmth it was promised

CMGS

committed

60ee474

sandboxd: give the ownership probe a boundary

CMGS

committed

c020050

test: a delete must evict the probe cache, forwarded or not

CMGS

committed

1e78e1f

docs: the checkpoint placement protocol, as it actually behaves

CMGS

committed

e61268e

Revert "mesh: a redirect spends the warmth it was promised"

CMGS

committed

cf3efbf

sandboxd: bound the single-owner probe and fence the cache against a delete

CMGS

committed

489bacf

sandboxd: close the operator races, heal validation, and lock leak a third review found

CMGS

committed

177d5dd

sandboxd: reject a non-branchable or contentless healed record, and finish the docs

CMGS

committed

1dfc1e8

sandboxd: give the record transfer a completion marker

CMGS

committed

a25df7d

review: tighten comment budget and dedup the peer URL plumbing

CMGS

committed

171cd0f

docs: the three operator read/wake endpoints, and the probe fan-out as built

CMGS

committed

66268da

sdk: a redirect candidate's 401 is a rotation transient, not a verdict

CMGS

committed

7f2b97a

Navigation Menu

Repository navigation

sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal - #52

sandboxd: cross-node snapshot placement — operator-token lifecycle, gossip redirect, peer heal#52
CMGS merged 31 commits into
mainfrom
feat/cross-node-snapshot-placement

Commits on Jul 26, 2026

sandboxd: let the node's root token drive the sandbox lifecycle

sandboxd: gossip checkpoint ownership so a branch can find its node

sandboxd: pull a checkpoint from a peer when no owner can serve the branch

simplify: drop the dead tar export and the tier-memory parser

review: comment budget, declaration layout and the lint/asl gates

simplify: drop a dead archive filter and three copy-forward duplications

review: propagate ctx into CheckpointIDs, dedup the owners scans

review: propagate ctx through UpdateSelf

review: carry the daemon ctx into mesh for callback logging

sandboxd: heal only after redirect cannot answer, gossip from memory

sdk: follow a checkpoint redirect instead of claiming nothing

sandboxd: one credential type instead of paired operator verbs

sandboxd: probe peers for a checkpoint instead of gossiping every id

sandboxd: bound the heal, gate the blob, and let a delete reach a replica

review: cut the comment budget back to the repo's own density

config: a healed replica needs a finite life, and a fleet-agreed one

sandboxd: make a delete and a heal of one id wait on each other

sdk: name the candidate's failure in the fallback test

sandboxd: pull outside the record lock, and let a delete veto the publish

mesh: a redirect spends the warmth it was promised

sandboxd: give the ownership probe a boundary

test: a delete must evict the probe cache, forwarded or not

docs: the checkpoint placement protocol, as it actually behaves

Revert "mesh: a redirect spends the warmth it was promised"

sandboxd: bound the single-owner probe and fence the cache against a delete

sandboxd: close the operator races, heal validation, and lock leak a third review found

sandboxd: reject a non-branchable or contentless healed record, and finish the docs

sandboxd: give the record transfer a completion marker

review: tighten comment budget and dedup the peer URL plumbing

docs: the three operator read/wake endpoints, and the probe fan-out as built

sdk: a redirect candidate's 401 is a rotation transient, not a verdict