Complete Milestone 8 bounded replication closeout

.github/workflows/ci.yml

@@ -9,7 +9,7 @@ jobs:
         os: [ubuntu-latest, windows-latest]
         node: [22, 24]
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 10
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
         with:
@@ -25,3 +25,22 @@ jobs:
       # Advance this only when the next sequential milestone gate is accepted.
       # Later smoke/fault/performance suites intentionally fail when empty.
       - run: pnpm validate:accepted
+  m7-real-fuse:
+    # This label contract denotes a privileged Linux host with a writable
+    # /dev/fuse and fusermount. Hosted or userspace-only shims do not qualify.
+    runs-on: [self-hosted, linux, x64, fuse]
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.32.1
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm build
+      - run: pnpm test:m7:fuse

README.md

@@ -7,6 +7,7 @@
 [![M4 accepted](https://img.shields.io/badge/M4-accepted-2ea44f)](./docs/evidence/m4/exit.md)
 [![M5 accepted](https://img.shields.io/badge/M5-accepted-2ea44f)](./docs/evidence/m5/exit.md)
 [![M6 accepted](https://img.shields.io/badge/M6-accepted-2ea44f)](./docs/evidence/m6/exit.md)
+[![M7 accepted](https://img.shields.io/badge/M7-accepted-2ea44f)](./docs/evidence/m7/exit.md)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 
 Ephemeral AI FS gives Ephemeral AI Computer a durable workspace layer where agents can
@@ -124,20 +125,22 @@ M2 SQLite storage   ✅
 M3 filesystem I/O   ✅
 M4 branches         ✅
 M5 maintenance      ✅
-M6 Cloudflare parity ✅  latest accepted milestone
-M7–M10 integration  ⏳
+M6 Cloudflare parity ✅
+M7 Node VFS         ✅  latest accepted milestone
+M8–M10 integration  ⏳
 ```
 
-| Milestone | Scope                                                         | Status                 |
-| --------- | ------------------------------------------------------------- | ---------------------- |
-| M0        | Repository and test foundation                                | ✅ Accepted            |
-| M1        | CAS, CDC, COW, patches, and manifests                         | ✅ Accepted            |
-| M2        | Transactional SQLite storage and Node driver                  | ✅ Accepted            |
-| M3        | Filesystem namespace, revisions, and I/O                      | ✅ Accepted            |
-| M4        | Branches and publication                                      | ✅ Accepted            |
-| M5        | Maintenance, recovery, and bounded scale                      | ✅ Accepted            |
-| M6        | Cloudflare Durable Object SQLite parity                       | ✅ **Latest accepted** |
-| M7–M10    | Node VFS/FUSE, replication, release, and Computer integration | ⏳ In progress         |
+| Milestone | Scope                                          | Status                 |
+| --------- | ---------------------------------------------- | ---------------------- |
+| M0        | Repository and test foundation                 | ✅ Accepted            |
+| M1        | CAS, CDC, COW, patches, and manifests          | ✅ Accepted            |
+| M2        | Transactional SQLite storage and Node driver   | ✅ Accepted            |
+| M3        | Filesystem namespace, revisions, and I/O       | ✅ Accepted            |
+| M4        | Branches and publication                       | ✅ Accepted            |
+| M5        | Maintenance, recovery, and bounded scale       | ✅ Accepted            |
+| M6        | Cloudflare Durable Object SQLite parity        | ✅ Accepted            |
+| M7        | Node VFS and real mounted FUSE                 | ✅ **Latest accepted** |
+| M8–M10    | Replication, release, and Computer integration | ⏳ In progress         |
 
 M6 adds the faithful local Cloudflare Durable Object adapter and runtime suite using
 `ctx.storage.sql` and `transactionSync`, including real runtime eviction,
@@ -150,6 +153,33 @@ See the [implementation plan](./docs/implementation/implementation-plan.md),
 [M6 exit record](./docs/evidence/m6/exit.md), and
 [M6 handoff](./docs/implementation/m6-handoff.md).
 
+M7 adds the synchronous Node VFS provider, opaque core bridge, coordinated namespace and
+inode semantics, bounded multi-edit COW, fault/resource coverage, and the exact
+real-kernel FUSE profile. Candidate-bound evidence records 23 local tests and the full
+9,056-operation mounted profile in 24.8 seconds. See the
+[M7 evidence](./docs/evidence/m7/exit.md) and
+[M7 handoff](./docs/implementation/m7-handoff.md).
+
+### Accepted real-FUSE timings
+
+The accepted Linux x64 real-FUSE run used a 16 MiB deterministic payload with SQLite on
+`tmpfs`. Operating-system cache dropping was unavailable, so the restart read below is
+not presented as a guaranteed cold-cache result.
+
+| Mounted operation                   | Workload                        |             Accepted time |
+| ----------------------------------- | ------------------------------- | ------------------------: |
+| Initial write and `fsync`           | 16 MiB                          | 1,134.418 ms (14.1 MiB/s) |
+| Full read and SHA-256 after restart | 16 MiB                          |  101.370 ms (157.8 MiB/s) |
+| Full-file materialization           | Same mounted read after restart |                101.370 ms |
+| COW edits and final `fsync`         | 5,000 one-byte write callbacks  |    Not timed as one phase |
+| Complete mounted profile            | 9,056 operations and 3 restarts |                 24,767 ms |
+
+The evidence records every one-byte edit callback and one successful flush. Individual
+edit calls were below 27.266 ms, the cutoff of the retained ten slowest operations, but
+the run did not retain an aggregate edit-phase time or edit p50/p95. See the raw
+[real-FUSE log](./docs/evidence/m7/logs/m7-real-fuse.log) for the exact environment,
+resource peaks, digests, and operation counts.
+
 ## 📊 Benchmark progress
 
 The mini-benchmark measures the file-backed Node SQLite engine directly. It does not
@@ -246,6 +276,14 @@ Run the accepted local Durable Object suite directly:
 pnpm test:m6
 ```
 
+Run the M7 local selection, or the mandatory real-FUSE target on a qualifying Linux
+host:
+
+```bash
+pnpm test:m7:local
+pnpm test:m7:fuse
+```
+
 Run the storage engine benchmark:
 
 ```bash
@@ -285,10 +323,16 @@ docs/benchmarks/              Benchmark plans, results, and improvement targets
 - [M5 acceptance evidence](./docs/evidence/m5/exit.md)
 - [M6 acceptance evidence](./docs/evidence/m6/exit.md)
 - [M6 implementation handoff](./docs/implementation/m6-handoff.md)
+- [M7 acceptance evidence](./docs/evidence/m7/exit.md)
+- [M7 implementation handoff](./docs/implementation/m7-handoff.md)
 - [Full implementation plan](./docs/implementation/implementation-plan.md)
 
-The next milestone is M7 Node VFS readiness and real mounted-FUSE validation on
-privileged Linux.
+The next milestone is M8 replication. Its Computer compatibility profile now includes
+authenticated fresh-replica provisioning, one shared filesystem runtime, exact active
+branch mounts with read-only replica main, durable resume, bounded Cap'n Web framing,
+generation-guarded publication, live-mount activation semantics, and an end-to-end gate
+through the pinned Ephemeral AI Computer fork and real FUSE. M10 remains the production
+cutover milestone.
 
 ## 📄 License
 

docs/benchmarks/release-benchmarks.md

@@ -231,6 +231,8 @@ Measure:
 - sequential 100 MiB transfer;
 - transfer of an already-present 100 MiB file;
 - catch-up across 1,000 revisions;
+- authenticated empty-replica provisioning and restart;
+- active-branch transfer plus generation-guarded publication;
 - dropped response and resume in every phase; and
 - abandoned staging followed by bounded collection.
 
@@ -242,6 +244,12 @@ Peak replication buffers must remain at or below the negotiated limit. Envelope
 must not retain a second complete copy. Report first durable progress, transferred and
 reused bytes, batches, receipts, retries, staging, memory, and physical growth.
 
+For the Computer carrier profile, additionally report raw and decompressed frame bytes,
+decoded envelope bytes, JSON/base64 expansion, transport high-water memory, live RPC
+stubs after disconnect, and combined process RSS. Run maximum-sized and one-byte-over
+maximum frames through the actual pinned Cap'n Web carrier; a custom binary loopback is
+not a substitute.
+
 ## 13. B08: Concurrency and bounded resources
 
 Under deliberately small budgets, run:
@@ -267,11 +275,12 @@ Run the same engine-neutral fixtures through:
 
 ```text
 workspace.fs
-  -> replication
+  -> authenticated bounded Cap'n Web carrier
+  -> shared-runtime replication
   -> computerd
-  -> real FUSE
+  -> exact branch through real FUSE
   -> shell or Git
-  -> pull
+  -> generation-guarded pull and publication
   -> restart and reconnect
 ```
 
@@ -288,6 +297,13 @@ On the reference Computer runner:
 Correctness, durability, no-materialization, and memory gates remain mandatory even if
 the DOFS control does not satisfy them.
 
+The Ephemeral AI FS trial MUST start with a genuinely empty persistent Node SQLite
+replica, adopt the authority's exact genesis, and derive replication plus branch Node
+VFS from one runtime budget. It MUST include replica-main read-only enforcement, branch
+isolation, same-branch remount, dropped-message resume, pinned-reader activation, a
+dirty writer conflict, guarded publication replay, and zero live sessions, leases,
+reservations, or RPC stubs after cleanup.
+
 ## 15. Regression policy
 
 After version 0.1 establishes a baseline, a candidate MUST NOT regress p50 or p95

docs/evidence/m7/correctness.json

@@ -0,0 +1,166 @@
+{
+  "schema": "efs-m7-evidence-v1",
+  "status": "passed",
+  "candidate": "ce9035e49037f60a8c52d2775fd2d88d34e57cd4",
+  "candidateParent": "891fd0691a824144dde9adb469d5c480325ace6a",
+  "predecessorCandidate": "082f4e98711035c2be2bd7d2f668f6c23e7a5b16",
+  "candidateOwnedTreeDigest": "676ab7afbc4315e6d1645d2e7b8bfc3221d502d889f96dafd80013f839340c11",
+  "schemaVersion": 13,
+  "formatVersion": "efs-merkle-manifest-v1",
+  "driver": "sqlite-node",
+  "adapter": "Node SQLite 3.50.4",
+  "commands": ["pnpm validate:m6", "pnpm test:m7:local", "pnpm test:m7:fuse"],
+  "capabilities": {
+    "supportsDirectRangeIo": true,
+    "supportsWriteSessions": true,
+    "supportsDataSync": false,
+    "sharedAdmissionController": true,
+    "sharedContentCache": true,
+    "durablePinnedReadLease": true,
+    "boundedManifestCursor": true,
+    "realMountedFuseRequired": true
+  },
+  "limits": {
+    "maxWriteSessionBytes": 16777216,
+    "maxPendingWriteBytes": 67108864,
+    "maxManagedResidentBytes": 134217728,
+    "maxOpenNodeVfsSessions": 256
+  },
+  "cowPageBytes": [4096, 8192, 16384],
+  "seeds": {
+    "conformance": 0,
+    "cowFixtureFormula": 131,
+    "cowEditPositionStep": 104729,
+    "cowEditValueStep": 37,
+    "faultMatrix": 0,
+    "realFuse": 1592614637
+  },
+  "fixtureDigest": "dbd3abb6b32a319a2156c5312956281c6939d950f823eb6f7e039eaf4e9d0435",
+  "faultPoint": "after-sql-statement",
+  "passed": 23,
+  "failed": 0,
+  "metrics": {
+    "predecessorElapsedMs": 1090158,
+    "predecessorNodeTargetElapsedMs": 540853,
+    "predecessorM6TargetElapsedMs": 545257,
+    "localElapsedMs": 85549,
+    "localGateElapsedMs": 90271,
+    "localDeadlineMs": 600000,
+    "nodeVfsTests": 23,
+    "sharedConformanceCases": 7,
+    "threeSessionCommitCloseOrders": 36,
+    "faultStagePositions": 152,
+    "faultCommitPositions": 203,
+    "largeFixtureBytes": 104857600,
+    "cowEditCount": 1000,
+    "totalCowEditSourceBytes": 576093118,
+    "largeEditSourceBytes": 576094,
+    "peakManagedResidentBytes": 102983960,
+    "defaultPressurePeakManagedResidentBytes": 78556130,
+    "defaultPressureResidentBytes": 67108864
+  },
+  "environment": {
+    "platform": "win32",
+    "architecture": "x64",
+    "node": "v24.11.1",
+    "pnpm": "10.32.1",
+    "sqlite": "3.50.4",
+    "cpu": "AMD Ryzen Threadripper 7960X 24-Cores",
+    "totalMemoryBytes": 137438953472
+  },
+  "logs": [
+    {
+      "name": "accepted-m6-predecessor",
+      "command": "pnpm validate:m6",
+      "path": "docs/evidence/m7/logs/predecessor-m6.log",
+      "sha256": "c61c7d01c2959f0c89d21a8eb51fb7d5a81ccb7e0f11fd0e5990b488fd3c618c",
+      "exitCode": 0,
+      "elapsedMs": 1090158
+    },
+    {
+      "name": "m7-local",
+      "command": "pnpm test:m7:local",
+      "path": "docs/evidence/m7/logs/m7-local.log",
+      "sha256": "084c340cca0861f5024eecd91002d617127e1b86c1cb4487ef5701da82304529",
+      "exitCode": 0,
+      "elapsedMs": 90547
+    },
+    {
+      "name": "m7-real-fuse-selection",
+      "command": "pnpm test:m7:fuse",
+      "path": "docs/evidence/m7/logs/m7-real-fuse.log",
+      "sha256": "c7f62044bc39267568d2ca50aae00999a13352c3361120538cc2435e1be5b180",
+      "exitCode": 0,
+      "elapsedMs": 25181
+    }
+  ],
+  "realFuse": {
+    "required": true,
+    "available": true,
+    "smokePassed": true,
+    "selectionDeadlineMs": 600000,
+    "smokeDeadlineMs": 60000,
+    "platform": "linux",
+    "architecture": "x64",
+    "kernel": "6.6.87.2-microsoft-standard-WSL2",
+    "node": "v22.22.1",
+    "fuseVersion": "2.2.6",
+    "device": "/dev/fuse",
+    "fusermount": "/usr/bin/fusermount",
+    "storage": "tmpfs",
+    "uid": 0,
+    "schemaVersion": 13,
+    "sqlite": "3.51.2",
+    "mountIdentity": [
+      "334 135 0:88 / /tmp/efs-real-fuse-B4AKB6/mnt rw,nosuid,nodev,relatime - fuse /dev/fuse rw,user_id=0,group_id=0,default_permissions",
+      "334 135 0:88 / /tmp/efs-real-fuse-B4AKB6/mnt rw,nosuid,nodev,relatime - fuse /dev/fuse rw,user_id=0,group_id=0,default_permissions",
+      "334 135 0:88 / /tmp/efs-real-fuse-B4AKB6/mnt rw,nosuid,nodev,relatime - fuse /dev/fuse rw,user_id=0,group_id=0,default_permissions",
+      "334 135 0:88 / /tmp/efs-real-fuse-B4AKB6/mnt rw,nosuid,nodev,relatime - fuse /dev/fuse rw,user_id=0,group_id=0,default_permissions"
+    ],
+    "mountCycleIds": [1, 2, 3, 4],
+    "processPids": [533, 549, 582, 610],
+    "processRestarts": 3,
+    "fixtureBytes": 16777216,
+    "fixtureDigest": "488a3edec4c7a4c4648fc4e3517bf99774efda366ff54d70b7fd9be6076571d8",
+    "finalPayloadDigest": "3238fa53923434d162289488f802739eecc4a45303799b7ca4c4b38fddba5d1a",
+    "namespaceDigest": "7fa2da4de419a8e1f156cd3f413906598d2cb71072af3797a9ca40eb7038d472",
+    "completedOperationCount": 9056,
+    "namespaceOperationCount": 2000,
+    "oneByteEditCount": 5000,
+    "mountedPayloadOneByteWriteCallbacks": 5000,
+    "editBatchProof": {
+      "callbackCount": 5000,
+      "flushCountDelta": 1,
+      "failedFlushCountDelta": 0,
+      "cowEditCountDelta": 1,
+      "cowEditSourceBytesDelta": 17263580,
+      "coreBatchCountDelta": 2
+    },
+    "providerCowEditCount": 17,
+    "transactionCount": 49987,
+    "readerActors": 16,
+    "writerActors": 16,
+    "operationsPerActor": 64,
+    "fsyncCrashVerified": true,
+    "fsyncCloseNoopVerified": true,
+    "closeDurabilityVerified": true,
+    "collectionInterrupted": true,
+    "collectionResumed": true,
+    "finalCollectionComplete": true,
+    "finalCollectionCommittedBatches": 2,
+    "usageVerified": true,
+    "elapsedMs": 24767,
+    "gateElapsedMs": 24815,
+    "selectionElapsedMs": 25181,
+    "peakManagedResidentBytes": 59762873,
+    "peakRssBytes": 180404224,
+    "aggregateLimitBytes": 134217728
+  },
+  "deviations": [],
+  "acceptance": {
+    "preEvidenceValidateAccepted": "pnpm validate:m6",
+    "postEvidenceValidateAccepted": "pnpm validate:m7",
+    "m7Accepted": false,
+    "reason": "All mandatory predecessor, local Node VFS, and exact real mounted-FUSE gates passed on the candidate; acceptance follows only after this evidence commit validates."
+  }
+}