Conversation
Per keyhive's causal-encryption record, the entry point to a document is a set of (head, content key) pairs, not every key ever held: chunk_keys becomes that head set, moved by seal and by open — parents' keys ride inside their descendants' envelopes, so an entry is pruned once a descendant this device holds carries it. Keys learned for commits that have not arrived yet are retained (one entry per out-of-order arrival) because nothing else would carry them. The frontier advances only after the commit is in the sedimentree. A concurrent branch sealed under an older epoch is a partition, not a loss: when a batch lands content that leaves the document diverged, the engine writes one empty automerge commit — a merge anchor whose envelope carries both branches' keys under the current epoch — so members who joined after that epoch read it without anyone writing again. An anchor carries no operations and so never triggers another; concurrent anchors rest as two heads until the next real write. A linear old-epoch write (no divergence) stays dark for a later member until the next local mutation; recorded as the known gap. Drive syncs pull → ingest → push. Design record: 'Read-back and partitions'.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements keyhive's own causal-encryption design (design/causal_encryption.md §Key Management / §Decryption Head / §Multiple Heads) in place of the full key map:
chunk_keys→ a head set pruned as descendants carry their parents' keys; a merge anchor (Automerge::empty_commit) on absorbing diverging content connects an old-epoch concurrent branch for members who joined later; Drive pulls before pushing.Review-driven fixes: ancestor keys for not-yet-arrived commits are retained (a parent delivered after its child was otherwise unopenable forever); the frontier advances only after
add_commitssucceeds; pruning driven by successful decrypts only.Known gap, recorded: a linear old-epoch write (no divergence) stays dark for a later member until the next local mutation. Sedimentree fragments remain the eventual wire/store roll-up.
Tests: 17 engine (chained history → one entry; two branches → two; cross-batch parent-after-child; the anchor scenario across separate batches). e2e 16/16 ×2. Automerge armed.