Module manifest 

Layer: Trust contract

Public JSON manifest written next to every cloud-or-local-file run’s output. Defines the wire schema and the in-memory builder; the actual writer (atomic rename / atomic PUT) lives next to the destination implementations.

Invariants are documented in [docs/adr/0012-cloud-manifest-contract.md]. This module owns only the data types and a tiny set of pure helpers — ordering, atomicity, and _SUCCESS semantics belong to the writer.

The manifest is read by:

• --resume (decision matrix M8: skip / rewrite / quarantine)
• --validate (M5: every listed part exists at recorded size)
• --reconcile (manifest row counts vs source COUNT(*))
• the run report (informational; not a verdict source)

Forward compatibility: callers MUST ignore unknown fields when reading. Field additions are non-breaking; field removals or type changes require a MANIFEST_VERSION bump.

Structs

ColumnChecksum

One per-column Form B checksum, keyed by column name (not position) so a column reorder between export and validate can never silently misalign the comparison (the positional Vec<String> it replaced could). checksum is the per-column xxh3, XOR-combined over the whole export, as a decimal string (JSON-stable).

ManifestDestination

ManifestPart

One committed (or quarantined) output part.

ManifestSource

RunManifest

Public, stable JSON shape for the run manifest.

Enums

ManifestInconsistency

Self-consistency failures detected by RunManifest::validate_self_consistency.

ManifestStatus

Terminal status of the run as recorded by the writer.

PartStatus

Constants

DOCTOR_PROBE_FILENAME

Writability probe rivet doctor drops at the destination prefix. It is a Rivet-internal sidecar (like MANIFEST_FILENAME / SUCCESS_FILENAME), so the manifest-aware --validate pass must not flag it as an untracked foreign object when a run follows a doctor against the same prefix.

MANIFEST_FILENAME

File name of the manifest at the destination prefix.

MANIFEST_VERSION

Current manifest schema version. See ADR-0012 §Manifest schema.

QUARANTINE_PREFIX

Prefix under which untracked / corrupt parts are moved on resume (M9). Layout: <prefix>/_quarantine/<run_id>/<original-name>.

SUCCESS_FILENAME

File name of the success marker. Written after the manifest per M2; its presence implies M5 (every listed part exists at recorded size).

Functions

join_key

Join a manifest-relative key (e.g. a part path, MANIFEST_FILENAME) onto a destination sub-directory. An empty dir returns key unchanged — the common case, since production callers pass "" (the manifest lives at the prefix root). Shared by the destination-verification and resume-reconciliation paths so both speak the same key namespace.

parse_success_marker

Parse the fingerprint out of a _SUCCESS marker body.

success_marker_body

Compute the body of the _SUCCESS marker for a given serialized manifest.