REL-WSF-001 — Make file history recover content
| Field | Value |
|---|---|
| Status | Open; live-confirmed and source-verified |
| Severity | Critical |
| Components | sparqd/platform-stacks, object storage, sparqd/workspace-file-management-backend, sparqd/oqullus |
| Associated issues | Not opened |
Concrete observed case
Oqullus exposes Version History, View Changes, and Restore. In
w-t5e2kcxjd, all 173 history records and all 17 current file records had a
null s3_version_id on 4 September 2026. A live OSS
GetBucketVersioning request returned HTTP 200 with an empty
VersioningConfiguration, confirming that w-t5e2kcxjd-workspace remains in
the default unversioned state.
The platform-stacks object-storage contract can create or adopt a bucket but has no versioning property or postcondition. Its AliCloud path stops after finding or creating the OSS bucket, and its AWS path likewise creates an S3 bucket without enabling versioning. Workspace-file deployment only injects the provider, bucket, region, endpoint, and prefix. The backend returns and stores the version identifier supplied by an upload, so the observed null values are not introduced by a separate application-side discard. The backend then rejects revert entries without a content version.
View Changes has a separate false-success path when a version identifier is
missing; see REL-WSF-004.
Expected condition
An exposed version is retrievable and immutable for its documented retention. The Workspace bucket declares versioning as a required provider-neutral postcondition. Provisioning reconciles both new and existing buckets, verifies the resulting state, and fails clearly when permissions or provider constraints prevent enablement. Diff and revert are tested end to end before the controls are shown.
Why it matters
The history list creates a false recovery promise. Repeated saves overwrite the only object content, so users cannot recover an earlier notebook after a bad save or concurrent overwrite. Enabling versioning later protects subsequent writes but cannot reconstruct content that was already overwritten.
Existing controls and workarounds
History preserves event metadata only. Users must keep external copies until content versioning is operational. Existing null-version history remains unrecoverable after enablement and must not be relabelled as restored coverage.
Alternatives considered
- Recommended: add a required versioning property to the shared bucket contract; enable and verify S3/OSS versioning for new and adopted Workspace buckets; grant the provisioning identity the provider-specific get/put versioning permissions; and apply reviewed lifecycle rules for noncurrent versions and delete markers.
- Store immutable content-addressed objects and point the current file record at a version; clearer cross-provider semantics but a larger backend change.
- Hide diff/revert and label history as activity-only; acceptable interim but not content recovery.
Component involvement
- Platform stacks owns the provider-neutral versioning requirement, applies the provider-specific configuration, verifies the postcondition, and governs noncurrent-version retention.
- The backend refuses to advertise recoverable versions without retrievable bytes, persists every returned version identity, and validates version writes.
- Oqullus hides or relabels unavailable actions and presents recovery failures.
Reproduction and verification
Follow WSF-S005.
Resolution conditions
Close when KCL tests prove versioning is required and reconciled for new and existing Workspace buckets, deployment fails if the postcondition is unmet, and deployed create, multiple save, diff, revert, delete, retention, and restore tests recover exact bytes on both supported providers. Existing unversioned history is explicitly excluded from recoverable coverage.
Validation and blockers
Null version coverage, the live unversioned OSS state, and the missing KCL contract are confirmed. The AliCloud provisioning identity's ability to set versioning remains unverified. Policy decisions are required for version duration, storage cost, delete-marker cleanup, deletion obligations, and any bucket features incompatible with versioning.
Provider reference: Alibaba Cloud OSS bucket versioning.