Repository navigation
Reject incompatible storage schemas before actors write state #1671
Description
Audit reference: I27
What can go wrong
Actors could interpret unversioned or incompatible bytes as current state and begin writing before anyone checked the on-disk schema.
When it happens
This is an upgrade and rollback hazard at process startup, before actor construction and replay.
What changed
A schema preflight now runs first, stamps only genuinely fresh stores, and rejects missing, older, or newer protocol schemas.
Why the change works
No actor can mutate state until the binary has proved it understands that state, preserving a possible rollback or explicit migration path.
Checks
Fresh, current, missing, older, newer, and actor-startup tests pass.
Activity
hmzakhalid commentedon Jul 13, 2026
Fixed in fae83d0fa6
hmzakhalid commentedon Jul 14, 2026
Re-verified: direct DAppNode upgrade still lacked a schema-marker bridge, and the refactor additionally moved state from /data/.enclave to /data/.interfold. Fixed in 4cca970c0: the package pins the published v0.2.3 bridge release, atomically migrates the legacy namespace, preserves existing encrypted identities, lets v0.2.3 stamp schema v1, and refuses ambiguous dual-root state. The required upgrade hop is documented and covered by DAppNode hardening tests.