I3952 — A dependency install is restored before and saved after, verified by its digest, local level first and a trusted store second

✕BLOCKED wave 2 · p0 · implementation profile · runs alone

Part of builds-reuse-the-mesh-cache — Builds reuse the mesh cache: compiled Rust, the cargo build directory, mix deps and npm packages, keyed by platform, toolchain and inputs.

Objective

majordomus mesh build-cache ensure <kind> -- <install command> for npm node_modules, mix deps and the cargo build directory: an install whose key is already in place is skipped, a hit is restored from the local archive level or the selected store after its recorded SHA-256 matches, a miss runs the command and saves its result to both; MAJORDOMUS_BUILD_CACHE=off bypasses every level.

Why

The owner, 2026-10-22, after lundra (the build and deploy host) reached zero free bytes: the shared cache must be part of Majordomus — used when MinIO is available, enforced, dynamic, derived — for compiled Rust, the shared cargo build directory, mix deps.get and npm install, keyed by a triplet for the most reuse. Decided the same day after critique: the store is trusted only through a signed offer (I2671), the build directory archive is measured before it is built (I3955), and the dependency cache is generic and wired first into prismatic-platform. See ADR 0157 and intent a-build-reuses-what-the-mesh-already-built.

Current state

Measured on master 2034d4a3f0b on 2026-10-22: no key derivation, no S3 client and no dependency cache exist in the crate; I2670 (#1118) holds the offer model and the pure selection only.

Desired state

npm ci and mix deps.get are restored in seconds on a hit and run as before on a miss, in any supervised repository; the local level lives under ~/.cache/majordomus/build-cache, is bounded by policy and is reclaimed by scripts/reap-orphans; a restore passes the build's free-space floor.

Scope

• apps/majordomus-cli/src/mesh/build_cache.rs
• apps/majordomus-cli/src/mesh/build_cache/
• apps/majordomus-cli/src/capability/builtin/mesh.rs
• apps/majordomus-cli/src/cli.rs
• apps/majordomus-cli/src/commands/mesh.rs
• docs/generated
• site/content/docs
• site/data
• scripts/reap-orphans
• .ai/repo/policy.yaml
• share/schemas/majordomus/policy
• share/skeleton/policy.yaml
• .ai/repo/rules/project/cache-is-invisible.v1.md
• .ai/repo/rules/project/cache-is-invisible.v2.md
• .ai/repo/rules/project/no-screen-waits-for-a-source.v1.md
• apps/majordomus-cli/src/policy.rs
• docs/CLI.md
• .ai/repo/project/intents/a-build-reuses-what-the-mesh-already-built.yaml
• test/cases/3952_a_dependency_install_is_restored_and_saved.sh

Out of scope

• Caching a workspace's own incremental compilation

Dependencies

• I3950✕BLOCKED A cache key is a versioned triplet of platform, toolchain and inputs, derived from the host and the repository
• I3951✕BLOCKED The mesh store is spoken natively: signed S3 requests, bounded in time, with the credential read from a private file and never answered
• I2671✕BLOCKED A provider offers its cache as a signed, expiring mesh record, and a stopped provider goes stale

What waits on this

• I3953✕BLOCKED Every local build path of the repository goes through the cache, and a gate refuses a new bypass

Acceptance criteria

• Cold, warm and bypassed runs leave the same file list and contents in the target directory (the equivalence case project.cache-is-invisible requires)
• An archive whose SHA-256 does not match the digest recorded when it was saved is discarded and the install runs
• An archive entry that is absolute, climbs with .., or is a link leaving the target is refused and the install runs
• Two nodes sharing one stub store: what the first saved, the second restores
• A cargo build directory is restored only when it is cold, under cargo's own lock, extracted beside it and renamed into place with cargo's CACHEDIR.TAG; an archive larger than one PUT is not saved, and says so
• The local archive level stays under its declared bound, and scripts/reap-orphans measures and reduces it
• The rule cache-is-invisible is amended for a cache outside .ai/local/, shared across a machine's checkouts

Validation

• bin/majordomus plan validate
• MJ_TEST_JOBS=2 bash test/run.sh 3952_a_dependency_install_is_restored_and_saved

Evidence required

• restore_save_case
• equivalence_case

Evidence

None recorded. Every token above needs a command or an artifact behind it before this issue can be completed; narrative is refused.

Timeline

started

—

verified

—

completed

—

Those three fields, the evidence above and the state of the dependencies are all the status is made of. There is no status field to disagree with them.

Canonical record: .ai/repo/project/issues/I3952.yaml. Read it back with majordomus plan show I3952.