- cubesys/src/bin/cube.rs: route known command words (prog/write/run/ls/stat/
seal/open/query/begin/commit/rollback/stats/audit) straight to Session::exec
from argv, making the coordinate-addressed 'open <path> <K.Z.Y.X> <tf>' surface
(Phase 3 'open by CZYX + flags') a real CLI command, not REPL/script-only.
Verified: ./check green; cube open/cube bogus both behave; dispatch reaches
crypto/run layer over in-process and durable daemon (cubec) paths.
- STARTUP-README.md: add verification points per standing directive; mark
Phase 2 FS + durability VERIFIED, Phase 3 surface DONE, boot-substrate IN PROGRESS.
- Guest binaries synced to host HEAD f40b448 + this change; OS state now persists
on the cube store in the VM (/cubefs/c200/...), durable across daemon restart.
cargo clippy --fix applied style nits (redundant return, ?-operator,
map_or simplify) plus doc-comment list indentation. The full ./check gate
(fmt+test+clippy -D warnings) now passes; R5 read-gate + grant tests
remain green (39 cubesys lib tests).
Closes the read-privacy gap flagged in plan R1/R5. Rather than fork the
FUSE uid/gid Acl model (whose identity is POSIX uid, incompatible with the
daemon's name-based HELLO identity), read-gating is done owner/grant-native:
- commands.rs: new admit_read(coord) mirroring admit_mutate (owner ->
read-grant -> deny; unowned records world-readable). Wired into
(read+execute) and (metadata read), gated by enforce_owner exactly
like writes.
- Tests: read_gate_blocks_non_owner_and_allows_read_grant (bob denied,
allowed after alice grants read), read_gate_requires_identity_under_enforce
(anonymous stat rejected under --require-identity).
- Full ./check quick green: 39 cubesys lib tests, clippy -D warnings clean.
Note in plan: Acl lift (R1) is NOT a literal fork; the daemon reuses the
owner/grant enforcement concept, not the POSIX Acl struct.
- ./check stress spins a fresh cube-server+cubec built from this tree on a
throwaway socket/store and drives ~150s of real prog/run traffic while
sampling the per-command latency + per-C telemetry.
- tools/stress.sh: never touches the production daemon; STRESS_SECONDS override.
- Fixed latent control-flow bug: the old '|| exit 0' guards made 'bench' and
'mount' subcommands unreachable after the gate (they exited early). Now uses
explicit run_* flags and only exits at the true end.
hermes