Repository navigation
Legacy-plaintext migration: batched migration with free-space admission and step-up timing #448
Description
Split out of #444 design v3 (/tmp/444-design-v3.md §10), source at bfefe92. Found by Codex's cross-family review of design v2. This is an existing gap, not introduced by #444. Irzhy should judge whether it must move to 0.8.0.
- FU7: batched legacy migration that lifts the 16 MiB, 64 MiB and 64-file per-run limits safely (
auth.rs:75-77,:7376-7445,:7808-7810; capacity:8321). Home cannot start, update or show Recovery with a file over 16 MiB (or 64 MiB total) in Library folders #444 v3 refuses by name and asks for manual moves and repeated runs. - FU3: online migration free-space admission before protection is created (
api/auth_gateway.rs:1453-1472;auth.rs:5060), and Recovery export step-up timing at high file counts (:1548-1574,api/gateway_passkey_step_up.rs:475-476). A full disk after protection is created leaves a protected root with plaintext; the scan before the 180 s token grows with file count.
Done means: old Homes with many or large legacy files migrate in bounded memory, are admitted only when space suffices, and Recovery export completes within its token.
Activity
andersalm commentedon Oct 19, 2026
Scan bounds and cost, added from #444 review:
auth.rs:5240-5272).auth_gateway.rs:2241-2267). The M1 guard does not refuse Damaged files in that state; the only reachable case is non-canonical authentic envelopes. Optional hardening: refuse whenrecovery_archive_from_protection(&p).is_none().Source: #444 security review (
security-reviewer, reviewed453f56eb2and fix deltade2cf6276; local report/tmp/sec444.md) and Codex review/tmp/codex-runs/c444fix.final.md. Line refs atde2cf6276onfix/444-check-at-open.irzhywau commentedon Oct 21, 2026
Irzhy's decision from the #444 review: (a) Home encrypts an existing unencrypted file of up to 100 MiB, Library's upload limit, one large file per step with Library-upload memory use. (b) When Home cannot encrypt a file (over 100 MiB, or not enough space), it names the file in a notice and starts, as #444 does for Unchecked files; Recovery status shows the fix.
This stays in After 0.8.0. It needs a Codex cross-family review and an independent human security review before any release takes it, plus installed proof on Mac and Linux.