Module bootstrap_format 

Bounded publication-package codec and keyless completeness checks.

Persistence belongs to the never-dispatched database package owner. The capture candidate ID is the bootstrap ID, not a freshly minted specimen identity. This codec provides no authorization: membership predecessor bytes are context only. seed_claim::Publication authenticates that context and the descriptor; bootstrap_staging owns server publication.

Profile 1 byte contract

Integers are unsigned big-endian. Byte strings use a U64 length. IDs in descriptor/chunk context are raw 32 bytes; catalog domain IDs are nonempty UTF-8 byte strings, at most 256 bytes. Flags are exactly 0 or 1. No compression. All parsers reject trailing bytes. SHA-256 commits exact bytes, not decoded JSON.

• Descriptor: AVBP || U16(2) || U8(1 suite), vault, stream, generation, capture bootstrap, predecessor membership commitment, U64 prefix count, three catalog declarations in class order, then manifest artifact descriptor. At most MAX_DESCRIPTOR_BYTES. Other versions are refused as unsupported, never reinterpreted.
• Declaration: U8 class, U64 record count, U64 byte length, aggregate SHA-256, then one SHA-256 per transfer slice. Slices are contiguous 1 MiB byte ranges with a final remainder; their count follows from the length. A hash-valid slice proves nothing about its catalog until the complete bytes match the aggregate and decode canonically.
• Catalog: AVBC || U16(1) || U8(class) || U64(record count), followed by length-prefixed records. Class 1 has one U8(1 state) + artifact descriptor; class 2 records are U64 rank + ID, ordered densely from 1. Class 3 groups object, parent, reference records, with U8 discriminators 1, 2, 3.
• Artifact: U64 plaintext total, aggregate SHA-256, U64 chunk count, followed by U64 index, U64 record length, record SHA-256, raw nonce[24] per chunk. The recipe reconstructs the existing 198-byte authenticated chunk header.
• Object: ID[32], U8 selection (1 current, 2 extra), artifact. Both selections require bytes. Sort by raw ID. Context is inherited from the descriptor.
• Parent: workspace ID, task ID, deleted flag, protected flag, version-present flag and optional version ID. Sort by (workspace, task) UTF-8 bytes.
• Reference: workspace ID, task ID, reference ID, deleted flag, mapped flag, optional object[32]. Sort by (workspace, reference). Unmapped references preserve unavailable metadata and create no byte or download obligation.
• Encrypted state: AVBD || U16(1), then every section in domain.rs order. Each section has U16 type, U64 count and length-prefixed strict JSON rows, sorted by complete encoded payload bytes. Struct field order, explicit nulls, UTF-8, and serde_json escaping are canonical. Unknown/duplicate/missing fields, alternate encodings and duplicate rows are rejected. Rows can span transport chunks. Export versions/defaults and device inventory flags are not wire fields; internal conversions only adapt shared domain validators.
• Encrypted manifest: AVBM || U16(1), descriptor through catalog declarations (excluding its own artifact), U16 section count, then U16 section, U64 row count, U64 encoded section length. This binds domain totals and catalogs without a circular ciphertext commitment.

Hard codec resource caps: 256 MiB state, 1 MiB manifest, 16 MiB per catalog, 1,000,000 total domain rows, 1,000,000 records per catalog, 1,024 selected images, 25 MiB per image and 256 MiB image plaintext in aggregate. Ciphertext includes exactly 222 bytes overhead per chunk. Prefix counts also leave room for a positive signed-64-bit tail position. These are refusal limits, not domain validity rules or production transport/reservation policy. This in-memory codec has bounded multiple-copy overhead and is not a streaming installer or a measured mobile resource profile.

Modules

download

Download recipes use the publication codec, not a second snapshot format.

Structs

Completeness

Structural completeness only. It does not authenticate membership or prove domain correctness, durable storage, quota admission, or permission to publish.

ImageRecords

Package

Exact upload components. Catalog array order is data, prefix, images. Records within artifacts are in canonical index order, images in object order. Clear bytes contain only the permitted metadata; encrypted bytes are opaque.

Enums

Error

Privacy-safe failures. Resource refusal says nothing about domain validity.

Constants

DOMAIN_VERSION

Version of the encrypted AVBD domain, independent of plaintext sync/export.

MAX_DESCRIPTOR_BYTES

Header, five IDs, prefix count, three declarations and the manifest recipe.

Functions

authenticate

Authenticates all domain, manifest and image bytes under the supplied key and expected context. This does not establish membership authorization.

validate_against_capture

Client-side check against the immutable source, not live rows. Also checks encrypted manifest/catalog agreement and private image hashes. This is not join installation and does not establish any trusted membership anchor.

validate_keyless

Checks exact clear commitments, framing, canonical coverage and all selected image-byte obligations without a key. Catalogs are aggregate-verified before any records are trusted. No partial catalog can establish completeness.