I2530 — The derivation store is bounded and measured: its size and hit rate are read by a capability, and only an explicit command removes entries

✕BLOCKED wave 7 · p2 · implementation profile · parallel safe

Part of a-derivation-computed-once-is-reused — A derivation computed once is reused by every worktree and by CI, and the incremental path becomes the default on evidence.

Objective

Make the store a quantity the repository measures and reclaims like its other accumulating directories: report its size, entries, hits, misses and time saved or spent, and remove entries by age and quota only through one explicit mutating command that spares entries in use.

Why

campaigns/majordomus-incremental-derive-prompt-pack/05_05_CAS_STORE.md asks for eviction bounded by quota and age that never destroys an entry in use and for gc as a separate authorised action, and 06_06_CLI_EXPLAIN.md asks for derive stats and derive cache gc. ADR 0055 makes disk a measured quantity reclaimed by predicate and bounded before a build, and a gate in .ai/repo/ci/gates.yaml requires that every self-accumulating quantity keeps its measuring command. A store shared by every worktree accumulates by construction.

Current state

The store of I2529 grows without limit and nothing reports it. The environment capabilities measure disk and the reclaimable build directories (apps/majordomus-cli/src/environment).

Desired state

derive.stats answers, from records the runs leave, entries and bytes in the store, hits, misses with reasons, bytes restored and the duration of each node's last run; majordomus derive stats prints it. majordomus derive store gc is declared with a mutating effect, removes entries older than a declared age or beyond a declared quota, oldest first, skips an entry a live run holds, and with --dry-run names what it would remove. The limits are declared in the repository's policy or environment declaration, not in code. The environment's disk report counts the store.

Scope

• apps/majordomus-cli/src/derivation/store.rs
• apps/majordomus-cli/src/derivation/stats.rs
• apps/majordomus-cli/src/capability/builtin/derive.rs
• apps/majordomus-cli/src/commands/derive.rs
• apps/majordomus-cli/src/cli.rs
• apps/majordomus-cli/src/environment
• apps/majordomus-cli/tests/derivation_store.rs
• .ai/repo/policy.yaml
• docs/DERIVE.md
• docs/ENVIRONMENT.md
• .ai/repo/project/issues/I2530.yaml

Out of scope

• Eviction as a side effect of a derive or of any read
• Removing anything outside the store directory
• A background process that prunes

Dependencies

• I2529✕BLOCKED A node's outputs are kept under its key and restored only after every digest is verified

Acceptance criteria

• derive stats reports the store's entry count and bytes equal to what is on disk in a fixture
• derive store gc --dry-run removes nothing and names the entries a real run would remove
• gc removes entries beyond the declared age or quota, oldest first, and leaves an entry held by a running derive
• A derive that starts while gc runs either restores a whole entry or regenerates, and never restores a partial one
• The command is refused for a caller that may not mutate, by the same effect check as every other mutating capability
• The environment's disk report includes the store's bytes

Validation

• bin/majordomus plan validate
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --lib derivation::stats
• cargo test --manifest-path apps/majordomus-cli/Cargo.toml --test derivation_store --test environment
• majordomus generate --check

Evidence required

• store_size_reported_and_reclaimed
• gc_spares_entries_in_use

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I2530.yaml. Read it back with majordomus plan show I2530.