[Duplicate] Define the bundled-core and user-local storage/index boundary #37

New issue

Closed

opened 2026-07-31 01:21:14 -04:00 by JackFrostbyte · 1 comment

JackFrostbyte commented

2026-07-31 01:21:14 -04:00

Owner

Goal

Specify a hard architectural boundary between Arkive's redistributable core and
content acquired locally by an end user.

Required model

Arkive has two distribution domains:

Bundled core
- committed, released, mirrored, and redistributable according to existing policy;
- reproducible core manifests and indexes.
User-local overlay
- raw acquisitions, derived documents, chunks, indexes, and provenance that stay
  on the user's machine;
- excluded from source control, release archives, mirrors, caches, diagnostics,
  and support bundles by default.

The runtime may query both domains, but storage, manifests, index generation, and
citation resolution remain independently identifiable.

Decisions to document

Canonical directories and configurable paths.
Ownership and permissions.
Manifest boundaries and stable identifiers.
How the shared processing pipeline receives an explicit distribution context.
How deletion, reprocessing, recipe withdrawal, and stale indexes are handled.
Backup/export warnings and safe defaults.
How container volumes and portable installations preserve the separation.
How release tooling fails closed if local content appears in a bundle input path.

Acceptance criteria

No command can silently promote a local artifact into the bundled core.
Core builds do not enumerate or hash user-local content.
User-local data paths are ignored by version control and excluded from releases.
Runtime results can always identify their originating domain.
Container and non-container deployments follow the same boundary.
The design reuses one processing pipeline rather than creating two divergent
implementations.

Out of scope

Acquisition implementation.
Index generation.
Federated ranking.

## Goal Specify a hard architectural boundary between Arkive's redistributable core and content acquired locally by an end user. ## Required model Arkive has two distribution domains: 1. **Bundled core** - committed, released, mirrored, and redistributable according to existing policy; - reproducible core manifests and indexes. 2. **User-local overlay** - raw acquisitions, derived documents, chunks, indexes, and provenance that stay on the user's machine; - excluded from source control, release archives, mirrors, caches, diagnostics, and support bundles by default. The runtime may query both domains, but storage, manifests, index generation, and citation resolution remain independently identifiable. ## Decisions to document - Canonical directories and configurable paths. - Ownership and permissions. - Manifest boundaries and stable identifiers. - How the shared processing pipeline receives an explicit distribution context. - How deletion, reprocessing, recipe withdrawal, and stale indexes are handled. - Backup/export warnings and safe defaults. - How container volumes and portable installations preserve the separation. - How release tooling fails closed if local content appears in a bundle input path. ## Acceptance criteria - [ ] No command can silently promote a local artifact into the bundled core. - [ ] Core builds do not enumerate or hash user-local content. - [ ] User-local data paths are ignored by version control and excluded from releases. - [ ] Runtime results can always identify their originating domain. - [ ] Container and non-container deployments follow the same boundary. - [ ] The design reuses one processing pipeline rather than creating two divergent implementations. ## Out of scope - Acquisition implementation. - Index generation. - Federated ranking.

JackFrostbyte added this to the User-Acquired Content Overlay v0.1 milestone

2026-07-31 01:21:14 -04:00

JackFrostbyte added the

area/deployment

type/design

labels

2026-07-31 01:21:14 -04:00