Module manifest 

Layer: Trust contract

Public JSON manifest written next to every cloud-or-local-file run’s output. Defines the wire schema and the in-memory builder; the actual writer (atomic rename / atomic PUT) lives next to the destination implementations.

Invariants are documented in [docs/adr/0012-cloud-manifest-contract.md]. This module owns only the data types and a tiny set of pure helpers — ordering, atomicity, and _SUCCESS semantics belong to the writer.

The manifest is read by:

• --resume (decision matrix M8: skip / rewrite / quarantine)
• --validate (M5: every listed part exists at recorded size)
• --reconcile (manifest row counts vs source COUNT(*))
• the run report (informational; not a verdict source)

Forward compatibility: callers MUST ignore unknown fields when reading. Field additions are non-breaking; field removals or type changes require a MANIFEST_VERSION bump.

Structs

ManifestDestination

ManifestPart

One committed (or quarantined) output part.

ManifestSource

RunManifest

Public, stable JSON shape for the run manifest.

Enums

ManifestInconsistency

Self-consistency failures detected by RunManifest::validate_self_consistency.

ManifestStatus

Terminal status of the run as recorded by the writer.

PartStatus

Constants

MANIFEST_FILENAME

File name of the manifest at the destination prefix.

MANIFEST_VERSION

Current manifest schema version. See ADR-0012 §Manifest schema.

QUARANTINE_PREFIX

Prefix under which untracked / corrupt parts are moved on resume (M9). Layout: <prefix>/_quarantine/<run_id>/<original-name>.

SUCCESS_FILENAME

File name of the success marker. Written after the manifest per M2; its presence implies M5 (every listed part exists at recorded size).

Functions

parse_success_marker

Parse the fingerprint out of a _SUCCESS marker body.

success_marker_body

Compute the body of the _SUCCESS marker for a given serialized manifest.