Implement local workspace restore and GCS checkpointing #5

Project

Cloud computer platform

Source: Cloud computer scale architecture audit

Outcome

Provide durable workspaces without making a database-backed FUSE mount the active dependency tree. Store control metadata and checkpoint references durably, store encrypted content-addressed checkpoints in Google Cloud Storage, and run tools against local copy-on-write storage.

Scope

• Define checkpoint manifests, content digests, parent revisions, image digests, workspace generations, byte counts, and retention metadata.
• Restore the current committed checkpoint into local ext4 or equivalent copy-on-write storage when a runtime lease starts.
• Use a pinned, signed, read-only base image plus a writable overlay instead of copying a full root filesystem for every run.
• Create incremental checkpoints at explicit boundaries and bounded intervals.
• Upload content before committing the new checkpoint reference through a generation compare-and-swap.
• Retain the previous committed checkpoint until the replacement passes integrity checks.
• Keep credentials, environment secrets, transient sockets, provider metadata, and other runtime-only state out of checkpoints.
• Encrypt checkpoints with a workspace-scoped key and enforce owner and tenant scope on restore and fork.
• Cache base images, toolchains, and common dependency layers at the host or cluster layer.
• Meter checkpoint bytes, duration, restore time, storage age, and garbage collection.

Deliverables

• Checkpoint manifest and storage contracts.
• GCS upload, download, integrity, retention, and garbage-collection implementation.
• Local restore and copy-on-write workspace implementation.
• Stop, resume, fork, host-replacement, and failed-commit flows.
• Fault tests for partial upload, lost acknowledgement, corrupt content, stale generation, cross-owner restore, and orphan cleanup.

Acceptance criteria

• An uploaded checkpoint whose durable commit fails can be reused safely on retry.
• A committed checkpoint whose acknowledgement is lost returns the existing committed result by idempotency identity.
• A stale runtime cannot replace the current checkpoint.
• A restored workspace reproduces all admitted files and Git metadata without restoring secrets or runtime credentials.
• Dependency installation and large-file benchmarks use local storage and record checkpoint overhead separately.
• Destroy removes or tombstones all retained checkpoints according to policy and produces verifiable deletion evidence.

Dependencies

Depends on #3. Coordinate the durable metadata boundary with OpenAgentsInc/openagents.com#37.