design-15 S2: line_uuid metadata model + sidecar renderer - #13
Merged
Conversation
D1/§4 slice: persist the line_hash_id -> line_uuid mapping in the vpnmeta/lineuuid KV bucket, attach LineUUID/DownstreamLineUUID to the Lines read model (allocation degrades, never fails the read), render the lattice.singbox-metadata.v2 sidecar deterministically per node, and add the reviewed apply-task helper (atomic tmp+mv, .bak backup) without wiring any trigger yet. Pins lattice-sdk @60c69bd (draft PR lattice-sdk#7) for the new SingBoxNode line_uuid/downstream_line_uuid fields.
This was referenced Jul 18, 2026
The prior workflow overrode go.mod with an SDK checkout chosen from the server branch name, then silently fell back to SDK main when that unrelated branch did not exist. Testing the declared module version keeps cross-repository slices reproducible and makes dependency pin failures honest. Constraint: Design-15 server branches depend on a pushed SDK pseudo-version with a different branch name Rejected: Add mirrored branch names in lattice-sdk | couples CI correctness to naming conventions Confidence: high Scope-risk: narrow Directive: Cross-repository CI must not override go.mod with an unrelated default-branch checkout Tested: GOWORK=off go mod verify; go vet ./...; go test -race -cover ./...; YAML parse; git diff --check
Removing the SDK workspace does not require changing gosec's invocation root. Preserve the repository-prefixed scan target so the dependency fix does not also alter analyzer behavior. Constraint: CI dependency resolution and static-analysis semantics must change independently Confidence: high Scope-risk: narrow Tested: Workflow diff review; prior successful main CI gosec evidence
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
design-15 D1/§4 server slice:
vpnmeta/lineuuid:ensureLineUUIDget-or-allocate UUIDv4 (crypto/rand, no new deps), idempotent, mutex-serialized; allocation failure degrades the read model field, never the read.Line.LineUUID/Line.DownstreamLineUUID;buildLineGroupsfills both (discovered passthrough from agent inventory).renderLineMetadataJSON(nodeID): deterministiclattice.singbox-metadata.v2output (sorted inbounds, fixed reserved block); schema-invalid renders fail closed.newLineMetadataApplyTask: reviewed sh script (atomic tmp+mv,.bakbackup, 0644 root) — no trigger wired (later slice).Pins
lattice-sdk@60c69bd(draft PR lattice-sdk#7) forSingBoxNode.line_uuid/downstream_line_uuid.Verification
gofmt -l .clean;go vet ./...cleango test ./internal/server/ok (19.8s) — new linemeta tests: allocation idempotency + reopen persistence, UUID v4 format, buildLineGroups fill, renderer contract shape, degraded-store path, apply-task script shapego test ./...all okRefs LatticeNet/lattice#2, LatticeNet/lattice-sdk#7. Next: S3 agent sidecar read + enrichment, then trigger wiring (S2b).