Struct RepositoryLayout 

pub struct RepositoryLayout { /* private fields */ }

Repository layout paths.

Implementations

impl RepositoryLayout

pub fn new(root: impl Into<PathBuf>) -> Result<Self>

Create a layout for a working tree root.

pub fn init(root: impl Into<PathBuf>) -> Result<Self>

Initialize a repository layout on disk.

pub fn open(root: impl Into<PathBuf>) -> Result<Self>

Open an existing repository layout.

pub const fn format(&self) -> RepositoryFormat

Return the repository format selected when this layout was opened.

pub fn require_current_format(&self) -> Result<()>

Refuse ordinary repository/worktree mutation in legacy format 1.

pub fn root(&self) -> &Path

Return the working tree root.

pub fn prikk_dir(&self) -> &Path

Return the .prikk directory.

pub fn format_path(&self) -> PathBuf

Return the repository format marker path.

pub fn worktree_unclean_shutdown_marker_path(&self) -> PathBuf

Return the unclean-shutdown worktree marker path (RFC 102 Stage 1). Created empty at init; non-empty means worktree materialization was interrupted and commit-authoring must refuse to infer deletion from absence until the worktree is re-verified against its baseline. Always updated by append/truncate (fsutil::append_file_required/truncate_file_empty_required), never by atomic_replace – RFC 102 §3’s correction: atomic_replace renames over the destination unconditionally, which is a new-name event whose Windows durability is DC-87 §3.4’s still-open question, exactly the gap this marker exists to close.

pub fn active_dir(&self) -> PathBuf

Return the active-session root directory.

pub fn default_active_dir(&self) -> PathBuf

Return the default active-session directory.

pub fn default_queue_wal_path(&self) -> PathBuf

Return the default active WAL path.

pub fn default_active_lock_path(&self) -> PathBuf

Return the default active lock path.

pub fn default_active_ref_name_path(&self) -> PathBuf

Return the default active-session ref-name metadata path.

pub fn refs_dir(&self) -> PathBuf

Return the ref root directory.

pub fn cache_dir(&self) -> PathBuf

Return the cache directory.

pub fn containers_dir(&self) -> PathBuf

Return the container root directory (RFC 102 Stage 3, design-v1.md §2).

pub fn container_type_dir(&self, object_type: ObjectType) -> PathBuf

Return the container directory for a persisted object type.

pub fn container_slot_path( &self, object_type: ObjectType, slot: ContainerSlot, ) -> PathBuf

Return one object type’s container file for a given slot. Every slot’s name is allocated at init, including B, even though Stage 3 only ever writes A – compaction (Stage 6, not authorized) is what would ever target B; the RFC’s §3.2 fixed-name-set requirement applies to the whole RFC, not per stage, so the name exists now regardless of when it is first used.

pub fn container_index_path(&self) -> PathBuf

Return the object index’s container path. Single file, no A/B slot – design-v1.md §4 / RFC 102’s own §6.7 answer #2: the index’s publication shape is plain append-only (“A/B” for an index reduces to “append-only wearing an A/B costume, not a second option” once forced through this codebase’s real primitives), so unlike the six object-type containers it needs only one name.

pub fn container_generation_log_path(&self) -> PathBuf

Return the small, fixed-name compaction generation log (design-v1.md §4: “compaction publishes by appending a generation record to a small fixed-name log; readers take the last complete generation record”). Reserved, not used, by Stage 3 – its name must still be allocated at init because compaction (Stage 6) is not authorized to create any name later. Absent any generation record (the only state Stage 3 ever produces), every container type’s slot A is live by construction – there is nothing for an empty log to disambiguate yet.

pub fn refs_containers_dir(&self) -> PathBuf

Return the ref-container root directory (RFC 102 Stage 4). Kept under refs/, sibling to the now-vestigial by-id//logs//tmp//locks/ directories, rather than under the object containers/ tree – ref containers are not object containers and the two are never confused for the same purpose.

pub fn ref_log_container_slot_path(&self, slot: ContainerSlot) -> PathBuf

Return the shared ref-log container file for a given slot (Step 0 §13.2: one container holds every ref’s log records, forced by acceptance criterion 1 – ref names do not exist at init, so a per-ref container is architecturally impossible). Both slots allocated at init, matching Stage 3’s own A/B convention exactly (container_slot_path’s own doc comment) – Stage 4 only ever writes A.

pub fn ref_pointer_index_slot_path(&self, slot: ContainerSlot) -> PathBuf

Return the ref-pointer-index container path for a given slot (RFC 102 Stage 6 Step 1, design-v1.md §15.6: this is one of the three genuine compaction targets – ref_pointer_index is last-entry-wins, and every ref update strands the previous entry, §15.1’s own finding. A/B slots mirror container_slot_path’s own naming shape). Reads and writes resolve which slot is live through generation.rs’s resolver; Step 1 always resolves A because no generation record has ever been written – see ref_pointer_index_generation_log_path.

pub fn ref_pointer_index_generation_log_path(&self) -> PathBuf

Return the ref-pointer-index generation log path (RFC 102 Stage 6 Step 1, design-v1.md §15.6 item 3/§4: readers take the last complete generation record; empty until Step 2’s compactor ever writes one, at which point A stops being the unconditional answer). Its own name, not the pre-existing container_generation_log_path() – that name was allocated for object- container compaction, which §15.1 establishes will never happen under the current content- addressed, no-GC data model, and a shared log across independently-compacting containers would let one corrupt record take down slot resolution for all of them at once (§15.6’s own blast-radius reasoning).

pub fn received_index_slot_path(&self, slot: ContainerSlot) -> PathBuf

Return the received-ref-index container path for a given slot (RFC 102 Stage 6 Step 1, design-v1.md §15.6: the second of the three genuine compaction targets, same last-entry-wins shape as the ref pointer index). Formerly received_index_path, single-name – RFC 102 Stage 5, design-v1.md §14.1/Step 0 item 2’s own reasoning for why received.rs belongs on the refs container+pointer-index pattern is unaffected by gaining a slot; only the publication shape (single-name vs. resolver-selected) changed.

pub fn received_index_generation_log_path(&self) -> PathBuf

Return the received-ref-index generation log path. Its own name, for the same blast-radius reason ref_pointer_index_generation_log_path has its own.

pub fn required_directories(&self) -> Vec<PathBuf>

Return all required directories for layout creation.

Dead-surface consolidation: objects/ and its six type subdirectories, refs/by-id/, refs/logs/, and quarantine/ are no longer created here – nothing in a format-3 repository writes into any of them (containers replaced loose objects and per-ref files years ago). This is not a format change: required_directories() is consulted only here, at init; nothing validates it at open, so an existing repository keeps its now-unused directories harmlessly, and only a newly initialized one has fewer. refs/tmp/ stays – refs/verify.rs’s candidate_issues still scans it on every verify.

pub fn object_path(&self, object_type: ObjectType, id: ObjectId) -> PathBuf

Return the storage path for a persisted object ID and type.

No production caller by design, not by omission: this addresses the pre-container, format-1/2 loose-object layout, which nothing in a live format-3 repository writes or reads. Kept pub specifically so prikk-cli’s format-transition fixtures (tests/format_transition_support/, a different crate) can construct legacy-shaped repositories without duplicating the private hex-prefixing scheme (hex_prefix, layout.rs) this method wraps.

pub fn ref_pointer_path(&self, ref_name: &str) -> PathBuf

Return the flat ref pointer path for a human-readable ref name.

No production caller by design: this addresses the pre-container, format-1/2 flat-pointer-file layout containers replaced. Kept pub so prikk-cli’s format-transition fixtures (a different crate) can construct legacy-shaped repositories without reimplementing the private ref_name_storage_key hash this method wraps – that helper is pub(crate), unreachable from outside this crate.

pub fn ref_log_path(&self, ref_name: &str) -> PathBuf

Return the ref log path for a human-readable ref name.

No production caller by design, for the same reason as ref_pointer_path: a legacy-format path builder kept pub for prikk-cli’s cross-crate format-transition fixtures.

pub fn ref_lock_path(&self, ref_name: &str) -> PathBuf

Return the ref lock path for a human-readable ref name.

pub fn ref_tmp_path(&self, ref_name: &str) -> PathBuf

Return the ref temporary candidate path for a human-readable ref name.

No production writer since Stage 4 removed the candidate-write-then-promote mechanism, but this is not dead the way ref_pointer_path/ref_log_path are: refs/tmp/ itself stays in required_directories() because refs/verify.rs’s candidate_issues scans it on every verify, and this accessor is what several of that scan’s own regression tests (refs/tests/publication_recovery/candidate_cleanup.rs) use to construct debris inside it.

pub fn trust_dir(&self) -> PathBuf

Return the publication trust-store directory.

pub fn trust_key_container_path(&self) -> PathBuf

Return the trust key-material container path (RFC 102 Stage 5, design-v1.md §14/§14.9). Replaces the one-file-per-key-id trust/keys/maintainer/*.pub directory entirely – format 5 rejects every repository old enough to have one, so no repository this code can open ever contains that directory’s contents (§14.9 §3’s own reasoning, applied here as it was to refs/received/, not Stage 4’s “keep, dead” precedent).

pub fn author_key_container_path(&self) -> PathBuf

Return the AUTHOR key-material container path (DC-53 Stage 1, .git-exclude/reviewed/DC-53-stage-1-report-ruling-v1.md §5). Its own container, not a third role folded into trust_key_container_path – that one is MAINTAINER key material with a policy layered over it; this one is material only, populated by the authoring path rather than an adoption command (author_key_index.rs’s own module doc). A repository initialized before this container existed has no such file, which author_key_index.rs reads identically to an empty one, not a structural defect.

pub fn trust_policy_container_slot_path(&self, slot: ContainerSlot) -> PathBuf

Return the trust policy container path for a given slot (RFC 102 Stage 5, design-v1.md §14/§14.9, gaining a slot in Stage 6 Step 1, design-v1.md §15.6 – the third of the three genuine compaction targets: one complete snapshot appended per add/remove, every earlier snapshot dead, §15.1’s own finding). Each append is a complete snapshot of the adopted key id list, not an incremental log entry – see trust_index.rs’s own module doc for why that is what makes revocation representable without a tombstone record; that property is unaffected by gaining a slot.

pub fn trust_policy_generation_log_path(&self) -> PathBuf

Return the trust-policy generation log path. Its own name, for the same blast-radius reason ref_pointer_index_generation_log_path has its own – and distinct from trust_key_container_ path, which is not one of the three compacting containers and gains no slot: TOFU history must persist across removal (trust.rs:77), which compacting the key container would break.

pub fn lockable_container_lock_path( &self, container: LockableContainer, ) -> PathBuf

Return the lock file path for one of Stage 6 Step 2’s four LockableContainers (design-v1.md §15.8). Ephemeral, like every other lock file in this codebase (ActiveLock/RefLock): created on acquire, removed on release, never pre-allocated at init – criterion 2’s “every name created at init” obligation is about durability-bearing container names, not transient mutual-exclusion markers, and ActiveLock/RefLock already establish that a lock file is exempt from it.

Trait Implementations

impl Clone for RepositoryLayout

fn clone(&self) -> RepositoryLayout

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for RepositoryLayout

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for RepositoryLayout

impl PartialEq for RepositoryLayout

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.