backend: refactor: map store paths at the boundary

.gitignore

@@ -4,7 +4,8 @@ backend/test-store
 
 /proxy/
 /gradjoeng/
-/gradient-hypervisor/
+/hypervisor/
+/hosted/
 
 # ---> Python
 # Byte-compiled / optimized / DLL files

backend/Cargo.toml

@@ -242,6 +242,10 @@ publish.workspace     = true
 [lints]
 workspace = true
 
+[lib]
+name = "gradient_server"
+path = "src/lib.rs"
+
 [[bin]]
 name = "gradient-server"
 path = "src/main.rs"

backend/gradient-cache/src/eval_cache.rs

@@ -110,8 +110,8 @@ impl EvalCacheSweep {
         let mut freed: u64 = 0;
         let mut evicted = 0usize;
         for row in models {
-            if let Err(e) = self.nar_storage.delete_eval_cache(&row.fingerprint).await {
-                warn!(fingerprint = %row.fingerprint, error = ?e, "eval-cache sweep: blob delete failed");
+            if let Err(e) = self.nar_storage.delete_eval_cache(&row.storage_path).await {
+                warn!(key = %row.storage_path, error = ?e, "eval-cache sweep: blob delete failed");
             }
 
             match EEvalCacheStore::delete_by_id(row.id).exec(&self.db).await {

backend/gradient-cache/src/schedule.rs

@@ -35,6 +35,7 @@ pub(crate) fn child_specs(state: &ServerState) -> Vec<ChildSpec> {
         ChildSpec::pass(SignSweep {
             db: state.worker_db.clone(),
             config: Arc::clone(config),
+            store_path_mapping: Arc::clone(&state.extensions.store_path_mapping),
             period: secs(config.cache.sign_sweep_interval_secs),
         }),
         ChildSpec::pass(DebugIndex {

backend/gradient-cache/src/signatures.rs

@@ -55,6 +55,7 @@ ON CONFLICT (cached_path, cache) DO NOTHING
 pub(crate) struct SignSweep {
     pub(crate) db: WorkerDb,
     pub(crate) config: Arc<RuntimeConfig>,
+    pub(crate) store_path_mapping: Arc<dyn StorePathMapping>,
     pub(crate) period: Duration,
 }
 
@@ -185,8 +186,14 @@ impl SignSweep {
 
             let nar_hash_nix32 = normalize_nar_hash(nar_hash);
 
-            let sig_bytes =
-                signer.sign_narinfo_raw(&store_path, &nar_hash_nix32, nar_size as u64, &refs);
+            let mapper = StorePathMapper::for_cache(Arc::clone(&self.store_path_mapping), cache.id);
+            let sig_bytes = signer.sign_stored_narinfo(
+                &mapper,
+                &store_path,
+                &nar_hash_nix32,
+                nar_size as u64,
+                &refs,
+            );
 
             let mut am = row.into_active_model();
             am.signature = Set(Some(sig_bytes));

backend/gradient-cache/src/storage_migrations/eval_cache_per_cache.rs

@@ -0,0 +1,80 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Wavelens GmbH <info@wavelens.io>
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+use anyhow::Result;
+use futures::FutureExt as _;
+use futures::future::BoxFuture;
+use gradient_db::DbContext;
+use tracing::warn;
+
+use super::StorageMigration;
+
+const FLAT_KEYS: &str = "flat-keys";
+
+pub(super) struct EvalCachePerCache;
+
+impl StorageMigration for EvalCachePerCache {
+    fn name(&self) -> &'static str {
+        "m20261019_000000_eval_cache_per_cache"
+    }
+
+    fn units(&self) -> Vec<String> {
+        vec![FLAT_KEYS.to_owned()]
+    }
+
+    fn migrate<'a>(&'a self, db: &'a DbContext, _unit: &'a str) -> BoxFuture<'a, Result<()>> {
+        delete_flat_keys(db).boxed()
+    }
+}
+
+fn is_flat(key: &str) -> bool {
+    key.strip_prefix("eval-cache/")
+        .is_some_and(|rest| !rest.is_empty() && !rest.contains('/'))
+}
+
+async fn delete_flat_keys(db: &DbContext) -> Result<()> {
+    let store = &db.storage.nar_storage;
+    for key in store.list_eval_cache_keys().await? {
+        if is_flat(&key)
+            && let Err(e) = store.delete_eval_cache(&key).await
+        {
+            warn!(%key, error = %e, "flat eval-cache blob delete failed");
+        }
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::test_support::test_server_state;
+    use gradient_fixtures::mock::empty_db;
+    use gradient_storage::NarStore;
+    use gradient_types::ids::CacheId;
+
+    #[tokio::test]
+    async fn only_eval_cache_blobs_without_a_cache_are_deleted() {
+        let tmp = tempfile::tempdir().unwrap();
+        let nar = NarStore::local(tmp.path()).unwrap();
+        let per_cache = format!("eval-cache/{}/fp2", CacheId::now_v7());
+        nar.put_eval_cache("eval-cache/fp1", b"flat".to_vec())
+            .await
+            .unwrap();
+        nar.put_eval_cache(&per_cache, b"kept".to_vec())
+            .await
+            .unwrap();
+        let state = test_server_state(nar, empty_db(), |_| {});
+
+        EvalCachePerCache
+            .migrate(&state.db(), "flat-keys")
+            .await
+            .unwrap();
+
+        let store = &state.db().storage.nar_storage;
+        assert_eq!(store.get_eval_cache("eval-cache/fp1").await.unwrap(), None);
+        assert!(store.get_eval_cache(&per_cache).await.unwrap().is_some());
+    }
+}

backend/gradient-cache/src/storage_migrations/mod.rs

@@ -7,6 +7,8 @@
 //! Storage migrations are to the NAR, log and blob layout what database migrations are to the
 //! schema. Apply them in order and before any deep GC unit.
 
+mod eval_cache_per_cache;
+
 use crate::units::{Step, next_unit};
 use anyhow::{Context, Result};
 use futures::future::BoxFuture;
@@ -25,7 +27,7 @@ pub(crate) trait StorageMigration: Send + Sync {
 }
 
 fn migrations() -> Vec<Box<dyn StorageMigration>> {
-    Vec::new()
+    vec![Box::new(eval_cache_per_cache::EvalCachePerCache)]
 }
 
 pub(super) async fn step(db: &DbContext) -> Result<Step> {

backend/gradient-ci/src/actions/tests/fixtures.rs

@@ -174,6 +174,7 @@ pub fn make_ctx_with(worker: sea_orm::MockDatabase) -> crate::CiContext {
         events: gradient_types::EventBus::default(),
         wake: Default::default(),
         memory: Default::default(),
+        store_path_mapping: std::sync::Arc::new(gradient_entity::IdentityMapping),
     };
     CiContext {
         db,

backend/gradient-core/src/extensions.rs

@@ -0,0 +1,22 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Wavelens GmbH <info@wavelens.io>
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+use std::sync::Arc;
+
+use gradient_entity::{IdentityMapping, StorePathMapping};
+
+#[derive(Clone, Debug)]
+pub struct ServerExtensions {
+    pub store_path_mapping: Arc<dyn StorePathMapping>,
+}
+
+impl Default for ServerExtensions {
+    fn default() -> Self {
+        Self {
+            store_path_mapping: Arc::new(IdentityMapping),
+        }
+    }
+}

backend/gradient-core/src/lib.rs

@@ -4,10 +4,12 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 
+pub mod extensions;
 pub mod state_root;
 pub mod upstream;
 pub mod upstream_source;
 
+pub use extensions::ServerExtensions;
 pub use gradient_graph::Graph;
 pub use state_root::{
     AppState, BUILD_PROGRESS_TTL, EVAL_PROGRESS_TTL, InstanceMemory, LAST_USED_STAMP_INTERVAL,
@@ -57,7 +59,10 @@ pub enum InitError {
     LocalStorage(String),
 }
 
-pub async fn init_state(cli: Cli) -> Result<Arc<ServerState>, InitError> {
+pub async fn init_state(
+    cli: Cli,
+    extensions: ServerExtensions,
+) -> Result<Arc<ServerState>, InitError> {
     if cli.secrets.crypt_file.is_empty() || cli.secrets.jwt_file.is_empty() {
         return Err(InitError::MissingSecrets);
     }
@@ -219,6 +224,7 @@ pub async fn init_state(cli: Cli) -> Result<Arc<ServerState>, InitError> {
         events: gradient_types::EventBus::default(),
         wake: Default::default(),
         graph: Graph::new(),
+        extensions,
         memory: InstanceMemory {
             db: DbMemory {
                 probe_requests: gradient_db::ProbeRequests::channel(),

backend/gradient-core/src/state_root.rs

@@ -18,6 +18,8 @@ use gradient_ci::CiContext;
 use gradient_ci::manifest_state::{ManifestStateStore, PendingCredentialsStore};
 use gradient_db::metrics::cache_traffic::CacheTraffic;
 use gradient_db::{CacheDb, DbContext, DbMemory, Wakeups, WebDb, WorkerDb};
+use gradient_entity::ids::{CacheId, ProjectId};
+use gradient_entity::{MappingError, StorePathMapper};
 use gradient_git_host::GitHostRegistry;
 use gradient_graph::Graph;
 use gradient_notify::EmailSender;
@@ -30,6 +32,8 @@ use gradient_util::debounce::Debounce;
 use gradient_util::latest::Latest;
 use gradient_util::shutdown::Shutdown;
 
+use crate::ServerExtensions;
+
 #[derive(Debug)]
 pub struct InstanceMemory {
     pub db: DbMemory,
@@ -66,6 +70,7 @@ pub struct AppState {
     pub graph: Arc<Graph>,
     pub memory: InstanceMemory,
     pub wake: Wakeups,
+    pub extensions: ServerExtensions,
 }
 
 pub type ServerState = AppState;
@@ -106,9 +111,21 @@ impl AppState {
             events: self.events.clone(),
             wake: self.wake.clone(),
             memory: self.memory.db.clone(),
+            store_path_mapping: Arc::clone(&self.extensions.store_path_mapping),
         }
     }
 
+    pub fn cache_mapper(&self, cache: CacheId) -> StorePathMapper {
+        StorePathMapper::for_cache(Arc::clone(&self.extensions.store_path_mapping), cache)
+    }
+
+    pub async fn project_mapper(
+        &self,
+        project: ProjectId,
+    ) -> Result<StorePathMapper, MappingError> {
+        StorePathMapper::for_project(Arc::clone(&self.extensions.store_path_mapping), project).await
+    }
+
     pub fn ci(&self) -> CiContext {
         CiContext {
             db: self.db(),
@@ -126,3 +143,23 @@ impl AppState {
         self.db().record_evaluation_created(eval).await;
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Arc;
+
+    use gradient_entity::ids::ProjectId;
+    use gradient_entity::{EXAMPLE_ORIGINAL_HASH, EXAMPLE_STORED_HASH, RotatedHashMapping};
+
+    #[tokio::test]
+    async fn the_server_mapping_reaches_the_database_context() {
+        let state = gradient_test_support::state::TestState::new()
+            .store_path_mapping(Arc::new(RotatedHashMapping))
+            .build();
+        let mapper = state.db().project_mapper(ProjectId::nil()).await.unwrap();
+        assert_eq!(
+            mapper.outbound_text(EXAMPLE_STORED_HASH).unwrap(),
+            EXAMPLE_ORIGINAL_HASH
+        );
+    }
+}