I’ve added a way for Potbot to read a retained file in small, checked pieces. A client can keep the pieces it already has, ask for the missing ones after reconnecting and check that the complete file still has the same SHA-256 hash.
This follows the signed record of tool work. The next practical question was how to inspect an output that is too large to fit inside one ordinary tool response.
There are three new SYN Cogs: open a read lease, read a byte range and close the lease. Each range carries its offset, length and hash. Access is tied to the authenticated workspace, owner, policy revision and exact artifact. A lease alone doesn’t grant permission.
The test file contains 131,106 deliberately synthetic binary bytes, above Potbot’s 16 KiB inline work-output limit. Each read requests at most 8 KiB of raw bytes. After retaining the first two pieces, fresh controller and service instances continue the read. The remaining pieces arrive in reverse order, and the first piece arrives again.
The client keeps 17 unique ranges, checks every chunk and reconstructs the exact original bytes. The complete SHA-256 matches. The demonstration repeats that check in the browser using the retained CI data. This tests controller-instance recreation within one Python test process; process crash recovery has its own qualification.
The reader checks the whole source before returning each slice, using read requests no larger than 64 KiB. It retains the requested slice rather than loading the whole source through the ordinary buffer API. That is a deliberate trade-off: repeated verification adds I/O work. The measured logical verification counts don’t establish peak process memory or physical disk traffic; those quantities remain unavailable.
Expiry and revocation are checked again after the file read. The tests reject a closed or expired lease, a different workspace or policy, missing bytes and corruption beyond the requested range. Revoking access during the read also prevents the result from returning. Closing a lease preserves the artifact itself.
Each admitted Cog still records its start, actual progress and completion or failure through the existing work ledger. The test reads those observations through REST and WebSocket interfaces, including a workflow’s child calls. A denied read cannot become a successful empty result.
The 0.5.0.dev7 source preview and artifact-range guide retain the implementation and its limits. This qualifies bounded reads on the existing local POSIX backend. Network transports, resumable uploads, physical retention and other backends remain separate work.
Leave a Reply