feat: evidence-bound provider cache reclaim

[seonghobae]

Purpose

Evidence-bound provider-cache reclaim for exact, regenerable local caches. Preserve classification, planning, reversible Trash, receipt, stale-content, and recovery evidence while refusing irreversible provider-cache deletion until mutation authority is same-object and recovery-complete.

Current owner state — 2026-09-07 KST

• protected main: 0e90f9cebadbd7f59606baaec4ca1d2f178c899a;
• release/Test owner fix: verify Windows release artifact namespace #264: 3e33229b4157a084a1985a1c7e952f98a64f25e3;
• reusable filesystem owner security: restore object-bound private evidence publication #344: 736da6db1fb0918d998b3f4d240c63936c91b11d, exact Test 34050767861 terminal success on Ubuntu test, Windows windows-home-resolution, and Ubuntu llm-engine-build;
• exact feat: evidence-bound provider cache reclaim #303 head after ordinary non-force owner adoption: 5164b847ed95661a4b40a69c66b520639f58d970;
• compare evidence from security: restore object-bound private evidence publication #344 736da6db... to feat: evidence-bound provider cache reclaim #303 5164b847... has merge base exactly 736da6db... and shows only the provider-cache consumer delta. The reusable owner delta is inherited rather than copied;
• exact post-adoption Test 34054137067 is current and non-terminal; Draft Release 34054137078 is skipped and non-passing;
• canonical docs owner docs: establish canonical DiskSage product requirements #315 must project this adoption and current exact evidence.

Review / safety boundary

All shipped Rust facade, Tauri, TypeScript, and headless CLI provider-cache contracts remain Trash-only. The crate-private executor rejects PermanentPurge before planning/receipt mutation and historical pathname-staged purge helpers remain test-only.

The adopted #344 point keeps descriptor-relative create-new private publication distinct from mutable replacement: existing-record replacement returns stable object-bound-replace-source-identity-unavailable before lookup/mutation; invalid private modes fail earlier; non-Unix replacement remains unsupported. Provider-cache final receipts are create-new and do not infer mutable-record replacement or irreversible deletion authority.

Current #344 semantics now inherited here include nonblocking final visible-name inspection, exact path admission, bounded encoded.len()+1 final descriptor reads with real enlarged-file regressions, streaming 8 MiB private-JSON serialization enforcement, the narrow production core shim, and the Rust 1.98 Read::by_ref compile repair.

Permanent provider-cache deletion remains unavailable. Issue #170 stays open for cross-platform same-object Trash/future irreversible mutation, durable journal/recovery/undo, and Windows/Linux/macOS parity.

Exact-head evidence and next action

Pre-adoption Test 34037987035 on 68ac5af... was terminal failure and is not transferable. Exact post-adoption Test 34054137067 must supply the consumer's own terminal evidence. If it fails, RCA and minimal causal fix belong on this consumer head; owner #344 GREEN is not a substitute.

#264 remains separately blocked by the canonical .github CodeQL metadata-binding owner path; leaf reruns are not a substitute for that owner repair. Keep Draft until one unchanged exact head and prerequisites have terminal passing applicable Test/security/SAST/CodeQL/coverage/review evidence. No self-approval, force-push, destructive rebase, gate weakening, administrative bypass, pathname fallback, or predecessor-evidence transfer.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

📝 Walkthrough

Walkthrough

Provider 캐시 회수 기능을 세 가지 캐시 종류로 제한했습니다. 계획은 증거와 지문을 수집합니다. 실행은 재계획과 콘텐츠 재검증 후 휴지통 또는 영구 삭제를 수행합니다. Podman 저장소 손상은 repair-required로 처리합니다. CLI, Tauri 명령 및 TypeScript API를 제공합니다.

Changes

Provider 캐시 회수

Layer / File(s)	Summary
증거 모델과 회수 계획 src-tauri/src/provider_cache_reclaim.rs, src/lib/api.ts, docs/architecture/adr/..., docs/product-technical-gap-baseline.md, CHANGELOG.md	OneDrive 임시 캐시를 제거하고 Podman AppleHV 시드, superseded Edge 설치 복사본, Edge crx_cache만 후보로 인정합니다. 활성 이미지, symlink 경로, 불일치 digest 및 불완전한 디렉터리 증거를 제외합니다.
Podman 저장소 무결성 상태 src-tauri/src/podman_reclaim.rs, src-tauri/src/podman_reclaim_public.rs, CHANGELOG.md	podman system df 실패를 repair-required로 표시합니다. podman system check --quick만 권장합니다. 관련 상태와 권장 조치를 테스트합니다.
승인 및 안전한 삭제 실행 src-tauri/src/provider_cache_reclaim.rs, src-tauri/tests/*	실행 전에 요청 수, 계획 지문, 후보 콘텐츠와 활성 사용 상태를 검증합니다. 영구 삭제는 Podman 시드로 제한합니다. staged 콘텐츠 변경 시 삭제를 중단하고, 복구 시 재생성된 경로를 덮어쓰지 않습니다. 불변 영수증을 생성합니다.
CLI와 Tauri API 통합 src-tauri/src/bin/disksage-provider-cache-reclaim.rs, src-tauri/src/commands.rs, src-tauri/src/lib.rs, src/lib/api.ts, src/lib/api.test.ts	매니페스트 입력을 2MiB로 제한합니다. plan과 execute Tauri 명령을 등록합니다. TypeScript API에서 계획과 실행 결과를 제공합니다.

Estimated code review effort: 4 (Complex) | ~60 minutes

Merge Risk: 🟡 Moderate · up to 7f91b

The PR adds permanent deletion for selected provider caches. A concurrent mutation could cause content different from the approved manifest to be removed, while interrupted cleanup may leave staged data without enough journal detail for deterministic recovery; a CI test also depends on external host tools. Merge should wait for these risks to be fixed or explicitly accepted.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant TauriCommands
  participant ProviderCacheReclaim
  participant FileSystem
  participant ReceiptStore
  Client->>TauriCommands: planProviderCacheReclaim()
  TauriCommands->>ProviderCacheReclaim: plan_with_runtime()
  ProviderCacheReclaim->>FileSystem: 캐시와 활성 사용 증거 검사
  ProviderCacheReclaim-->>Client: ProviderCacheReclaimPlan 반환
  Client->>TauriCommands: executeProviderCacheReclaim()
  TauriCommands->>ProviderCacheReclaim: 승인 정보와 요청 전달
  ProviderCacheReclaim->>ProviderCacheReclaim: 재계획과 콘텐츠 검증
  ProviderCacheReclaim->>FileSystem: 휴지통 이동 또는 영구 삭제
  ProviderCacheReclaim->>ReceiptStore: 불변 영수증 생성
  ProviderCacheReclaim-->>Client: ProviderCacheCleanupResult 반환

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 44.93% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 69 functions across 12 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 증거 기반 Provider 캐시 회수 기능이라는 PR의 주요 변경 사항을 정확히 요약하며, 짧고 명확합니다.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/evidence-backed-local-reclaim

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Owner-authority refresh, 2026-09-07 KST: current reusable filesystem owner #344 is exact 666cedae424454671e601a1117c3199e1bc2aaf9. Fresh compare keeps merge base 20177e3a92c6b3dcdd2996ab0e3fd8c5f23145be; current #344 is 18 owner commits ahead of that merge base. #344 exact Test 34047647718 is not terminal GREEN: Windows 101525500311 succeeded, while Ubuntu test 101525500336 and llm-engine-build 101525500100 remain runner-unassigned queued. Keep #303 unchanged until current #344 GREEN; then adopt it by ordinary non-force ancestry and reacquire #303's own exact Test/security evidence. Permanent provider-cache deletion remains unavailable.

[seonghobae]

Fresh consumer repair/evidence sweep on 2026-09-07 KST:

• predecessor exact 8490010d3eaa291246fba6cfe149e061e955e274, Test 34072122822, was terminal failure only in Ubuntu test 101591265505; Windows and llm-engine-build succeeded;
• current-source verification found two stale integration-test accesses to the removed public DTO field ProviderCacheReclaimPlan::exact_approval_phrase. The public product contract intentionally omits irreversible approval rather than exposing it as None;
• 0ede7c9d6e978f1ebb8e575634e10a7269f55d2a repairs the receipt-permission regression by asserting serialized key absence while preserving real Trash/receipt mode checks;
• d278298850a1f41cb7b1e0acaef7d6592501aedf applies the same public-boundary assertion to the macOS Edge directory fixture without weakening its content-preservation proof;
• exact Test 34078422774 is current. Windows 101608965911 is terminal success. Ubuntu test 101608965944 and llm-engine-build 101608965720 have now received hosted runners and are executing; no GREEN claim is made before both terminate successfully;
• all currently returned review threads are resolved;
• release/Test owner fix: verify Windows release artifact namespace #264 has advanced to fea9144a15234035fbdf37e9fa914e5fd51efdec. This consumer still has merge base 3e33229b4157a084a1985a1c7e952f98a64f25e3 against that current owner and is behind_by=2; those two owner commits affect only the release artifact verifier and its contract test. Normal readiness still requires ordinary non-force owner restack/adoption after current consumer evidence, not source copying or predecessor-check transfer.

Keep Draft. Permanent provider-cache deletion remains unavailable; these repairs do not add irreversible mutation authority.