swaitsandClaude Fable 5.1
5f5dd8f7da
Windows step 1 and 2 of D-62. Where Unix keeps the books' private folder at mode 0700 and refuses one others can open, Windows now makes the same promise with a DACL: `winsec::set_owner_only` gives the folder (and, inherited, everything made in it) one protected allow entry for this account's SID; `winsec::is_private` reads the effective DACL and owner back and answers false for anything else (a missing DACL, an entry for Everyone), so `Root::open` refuses a loosened root and `Root::setup` makes it private again, exactly as the 0700 checks do. Every question the system cannot answer is "not private". The root itself comes from the shell's known folders (`SHGetKnownFolderPath`: the profile, and LocalAppData wherever it was redirected), never from environment variables the process that started us chose. `rename_new` (the move that must never go over what is there, renameat2 RENAME_NOREPLACE on Linux) is `MoveFileExW` without the replace flag on Windows, written through. File locking sat behind `libc::flock` in ops.rs alone (the rest already used std's File::try_lock, which is LockFileEx on Windows). It now goes through `lock.rs`, which uses only std, so there is no second unsafe copy of either call. New dependency: windows-sys 0.61 behind cfg(windows), the raw bindings only (no runtime), already in the lockfile through other crates; the smallest Microsoft crate that covers SIDs, DACLs, the known-folder API, pipe process ids and MoveFileExW. mise.toml adds the Windows target to the pinned toolchain so `cargo check --target x86_64-pc-windows-msvc` type-checks this arm on Linux. CHOICE (P11c): nothing above the root is checked on Windows (the Unix rule about folders above it being swappable has no Windows authority; the profile's folders belong to the account and the Administrators). Tests: tests/windows_root.rs (Windows job only), the cross-platform `a_viewer_s_presence_is_a_shared_lock_others_can_see` in ops.rs. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp
26 lines
1.1 KiB
TOML
26 lines
1.1 KiB
TOML
# Everything needed to build, test, prove, and ship wanderbooks.
|
|
# `mise install` in this directory, then `just` lists the recipes.
|
|
|
|
[tools]
|
|
# Workspace toolchain (clippy and rustfmt for `just check`).
|
|
rust = [
|
|
{ version = "1.99", components = "clippy,rustfmt", targets = "x86_64-pc-windows-msvc" },
|
|
# Fuzzing (cargo-fuzz) and Miri need nightly; pinned so runs repeat.
|
|
{ version = "nightly-2026-10-01", components = "miri,rust-src" },
|
|
]
|
|
just = "1"
|
|
# `just deploy` runs the Netlify CLI through npx.
|
|
node = "26"
|
|
# `just prove`: Kani model-checks the accounting kernel. Kani fetches its
|
|
# own pinned nightly and CBMC under ~/.kani on first run.
|
|
"cargo:kani-verifier" = "0.68.0"
|
|
# `just prove`: Lean proves the accounting laws (verify/lean). Matches
|
|
# verify/lean/lean-toolchain.
|
|
"github:leanprover/lean4" = "4.34.1"
|
|
# Mutation testing and fuzzing (docs/oracle.md).
|
|
"cargo:cargo-mutants" = "27.1.0"
|
|
"cargo:cargo-fuzz" = "0.13.2"
|
|
# A compile cache shared by every jj workspace's target dir: point
|
|
# cargo's build.rustc-wrapper at it (~/.cargo/config.toml).
|
|
sccache = "0.18.0"
|