PR6: Blob-storage reclaim GC - #90
Closed
Diego Colombo (colombod) wants to merge 1 commit into
Closed
Conversation
Add POST /admin/blobs/reclaim, a protocol-only garbage collector for blob-store artifacts no longer referenced by the graph. Enumeration runs through BlobStore.scan() and deletion through the fenced BlobStore.delete(uri, if_unmodified=ref) compare-and-delete -- no filesystem path, glob, or os.unlink, and it never reaches the queue / identity / lease stores or graph data. Safety gates: a graph-wide reference scan over the blob-carrier allowlist, a not-live / durable is_fully_drained session gate, a hard min_age_minutes floor (>= 15), a destructive-apply single-flight (409 on overlap), a required max_delete blast-radius cap, and dry_run=true by default. One structured audit line per delete records only the ci-blob:// URI, never blob contents. Fold in the blob-carrier allowlist (BLOB_REF_CARRIER_PROPERTIES in blob_processor), reclaim's only consumer: the single source of truth for which graph properties may carry a ci-blob:// reference, validated at import and enforced at the mint site so an unregistered carrier fails loud instead of becoming a silent reclaim-GC hole. The reference-scan Cypher is generated from this tuple, so the two can never drift. Version 7.4.0. 🤖 Generated with [Amplifier](https://github.com/microsoft/amplifier) Co-Authored-By: Amplifier <amplifier@microsoft.com>
Diego Colombo (colombod)
force-pushed
the
feat/blob-reclaim-gc
branch
from
August 26, 2026 17:06
4394851 to
caf89ac
Compare
Diego Colombo (colombod)
marked this pull request as draft
August 27, 2026 15:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Last of the progressive split of #79. Stacks on PR4 (#89) → PR3 (#88) → PR2 (#87) → PR1 (#85) → #81 → #78.
Delivers
/admin/blobs/reclaim— a focused orphaned-blob garbage collector, dormant unless an operator calls it. Safety gates: graph-wide reference scan over the blob-carrier allowlist · not-live (registry.active_sessions) + durableis_fully_drained· hard 15-minute min-age floor · fenceddelete(uri, if_unmodified=ref)· destructive-apply single-flight (409 on overlap) · requiredmax_deletewhen applying ·dry_run=truedefault; the apply path does its own fresh authoritative rescan; one audit line per delete (URI only).blob_processor.py) — folded here because reclaim is its only consumer; a passive mint-time tripwire on an already-registered field.admin.pydocstring path-leak (raw fs path → theci-blob://URI abstraction).Storage-agnosticism (verified by reading, not just the guard)
glob/os.unlink/Path/shutilin shipped code. Enumerate viablob_store.scan()(streamsBlobReference), delete via the fencedblob_store.delete(uri, if_unmodified=ref). Reclaims blob-store artifacts only — never the queue/identity/lease stores or graph data. The PR4 storage-boundary guard stays green.Scope
Surface
Verification
/version→ 7.4.0, dry-run/admin/blobs/reclaimreturnsdeleted: 0without deleting).