043-patched-dependency-adoption

Patched dependency adoption: the N=1 cell runs the published, provenance-pinned hiqlite and Rauthy builds, crosses their cache boundary only through a fenced, resumable, backed-up transition, keeps every accepted revocation through it, and stops within a validated budget with an honest outcome

Lifecycle approvedImplementation in-progressVerification unknownQualification unknown

rahi's application store runs hiqlite 0.14.0 through a root git patch that registry consumers never inherit, and its co-deployed identity provider runs upstream Rauthy 0.36.2. Published downstream builds exist for both, hiqlite-patched 0.15.0-patched.1 and rauthy-patched 0.36.2-patched.2, each qualified by its producer at N=1. This spec adopts exactly those two artifacts for the N=1 cell under a narrow recorded exception to 011's no-fork rule. It crosses the one incompatible on-disk boundary (the cache raft log) by relocating the app store behind a permanent fence that every pre-043 binary refuses at its old path, installed whole and verified quiescent before anything moves, and a second fence at rahi's rendered Rauthy environment that makes every published pre-043 supervisor that reads it afterwards exit before it spawns Rauthy; it names what neither fence can stop (an old process already past its read or its lock-free start phase, and the two destructive hiqlite variables in an old process's environment) as preconditions the operator establishes by stopping and removing every old process first. Every new-binary entry point takes its locks before it reads the state file; Rauthy moves its own cache under consent, and the resumable upgrade is released only on a Rauthy build whose interrupted move is repaired. It keeps every revocation accepted before the upgrade refused by a permanent issued-at floor that needs no historical lifetime, bounds every admitted token by an enforced lifetime ceiling and a hard 86,400-second maximum, keeps durable revocations against a backward clock step after any prune (retained, or pruned under a persisted watermark, by owner choice), states the restore boundary, including what a stale Rauthy restore revives, turns a proven terminal storage failure into a bounded exit, and reports every stop's observed outcome with a non-zero exit when completion is not confirmed. It changes no topology and claims no N=3 support.

Read the full pinned specification ↗

Relationships

depends on

depended on by

Claimed units

establishes

{
  "kind": "file",
  "path": "crates/rahi-ops/src/upgrade.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-ops/src/cell_lock.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-ops/src/stop.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-ops/tests/upgrade.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-ops/tests/cell_lock.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-cli/tests/terminal.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-cli/tests/stop_budget.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-cli/tests/stop_outcome.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-cli/tests/stop_fixture/mod.rs"
}

establishes

{
  "kind": "file",
  "path": "docker/upgrade-live.sh"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-idp/tests/revocation_durable.rs"
}

establishes

{
  "kind": "file",
  "path": "crates/rahi-store/tests/dependency_identity.rs"
}

extends

{
  "nature": "amending",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "kind": "file",
    "path": "Cargo.toml"
  }
}

extends

{
  "nature": "amending",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "kind": "file",
    "path": "deny.toml"
  }
}

extends

{
  "nature": "amending",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-types/src/config.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "010-workspace-and-core-types",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-types/tests/config.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/Cargo.toml"
  }
}

extends

{
  "nature": "amending",
  "spec": "011-store-hiqlite",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-store/src/store.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "011-store-hiqlite",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-store/src/error.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "011-store-hiqlite",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-store/src/lib.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "016-store-binary-values-and-extensions",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-store/tests/blob.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "025-api-tokens-and-resource-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/bearer.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "025-api-tokens-and-resource-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/tests/bearer.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "038-native-clients-and-bearer-revocation",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/tests/native.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "042-ledger-lifetime-identity",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ledger/tests/identity.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "038-native-clients-and-bearer-revocation",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/revoke.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "021-idp-proxy-and-discovery",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-idp/src/lib.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/lib.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/preflight.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/restore.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/tests/restore.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "037-identity-recovery-and-live-proof",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/tests/rauthy_restore.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/lib.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/verbs.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/src/serve.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "030-operational-verbs",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/tests/cli.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "035-denials-survive-shutdown",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/tests/shutdown.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/supervise.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/first_boot.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-ops/src/rauthy_env.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "docker/Dockerfile"
  }
}

extends

{
  "nature": "additive",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": ".github/workflows/image.yml"
  }
}

extends

{
  "nature": "amending",
  "spec": "039-release-and-out-of-tree-packaging",
  "unit": {
    "kind": "file",
    "path": "docker/runtime.Dockerfile"
  }
}

extends

{
  "nature": "amending",
  "spec": "032-cluster-topology",
  "unit": {
    "kind": "file",
    "path": "deploy/README.md"
  }
}

extends

{
  "nature": "amending",
  "spec": "032-cluster-topology",
  "unit": {
    "kind": "file",
    "path": "deploy/k8s/statefulset.yaml"
  }
}

extends

{
  "nature": "additive",
  "spec": "037-identity-recovery-and-live-proof",
  "unit": {
    "kind": "file",
    "path": ".github/workflows/live.yml"
  }
}

extends

{
  "nature": "amending",
  "spec": "020-edge-server",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-edge/src/probes.rs"
  }
}

extends

{
  "nature": "additive",
  "spec": "023-observability",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-edge/src/obs/metrics.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "036-manifest-and-schema-evolution",
  "unit": {
    "kind": "file",
    "path": "crates/rahi-cli/tests/evolution.rs"
  }
}

extends

{
  "nature": "amending",
  "spec": "031-single-container-packaging",
  "unit": {
    "kind": "file",
    "path": "docker/smoke.sh"
  }
}

Source headings

043: Patched dependency adoption
1. Purpose
2. Territory
3. Behavior
Identities
Crossing the cache boundary
Revocation across cache loss
Terminal storage failure
Stopping
4. Functional requirements
5. Acceptance criteria
6. Out of scope
7. Resolved decisions
7.1 Proposals (2026-09-23)
7.2 Evidence recorded for the decisions
7.3 Revision 2 corrections (2026-09-23)
7.4 Revision 3 corrections (2026-09-23)
7.5 Revision 4 corrections (2026-09-23)
Verification

Frozen anchors

No frozen anchors declared.