backup: require manifest adapters/exclusions sections (PR #712, round 4)

Codex P2 #146 round 3: ReadManifest accepted manifests where the
adapters and/or exclusions sections were omitted entirely from
the JSON, because they were decoded into non-pointer struct
fields and validate() only checked scalar policy fields. The
empty zero-value sections were treated as valid, hiding
truncated or corrupted MANIFEST files and dropping provenance
about which scopes/filters the producer used.

Manifest.Adapters and Manifest.Exclusions are now *Adapters /
*Exclusions pointer types. validateRequiredFields rejects nil
for either with ErrInvalidManifest. NewPhase0SnapshotManifest
seeds them as &Adapters{} / &Exclusions{} so producers continue
to satisfy the contract by default; populating individual
scopes reaches in via the now-non-nil pointer.

Tests TestReadManifest_RejectsMissingAdapters and
TestReadManifest_RejectsMissingExclusions cover the new
validation path.

Author: bootjp

internal/backup/manifest.go

@@ -132,19 +132,24 @@ type Exclusions struct {
 // Manifest is the on-disk MANIFEST.json structure. Field tags match the
 // spec in docs/design/2026_04_29_proposed_snapshot_logical_decoder.md.
 type Manifest struct {
-	FormatVersion     uint32     `json:"format_version"`
-	Phase             string     `json:"phase"`
-	ElastickvVersion  string     `json:"elastickv_version,omitempty"`
-	ClusterID         string     `json:"cluster_id,omitempty"`
-	SnapshotIndex     uint64     `json:"snapshot_index,omitempty"`
-	LastCommitTS      uint64     `json:"last_commit_ts,omitempty"`
-	WallTimeISO       string     `json:"wall_time_iso"`
-	Source            *Source    `json:"source,omitempty"`
-	Live              *Live      `json:"live,omitempty"`
-	Adapters          Adapters   `json:"adapters"`
-	Exclusions        Exclusions `json:"exclusions"`
-	ChecksumAlgorithm string     `json:"checksum_algorithm"`
-	ChecksumFormat    string     `json:"checksum_format"`
+	FormatVersion    uint32  `json:"format_version"`
+	Phase            string  `json:"phase"`
+	ElastickvVersion string  `json:"elastickv_version,omitempty"`
+	ClusterID        string  `json:"cluster_id,omitempty"`
+	SnapshotIndex    uint64  `json:"snapshot_index,omitempty"`
+	LastCommitTS     uint64  `json:"last_commit_ts,omitempty"`
+	WallTimeISO      string  `json:"wall_time_iso"`
+	Source           *Source `json:"source,omitempty"`
+	Live             *Live   `json:"live,omitempty"`
+	// Adapters and Exclusions are pointer types so ReadManifest can
+	// distinguish "section omitted entirely" (a corrupted or
+	// truncated dump that should fail validation) from "section
+	// present but populated with default values" (legitimate
+	// scope-everything-excluded). Codex P2 #146 (round 3).
+	Adapters          *Adapters   `json:"adapters"`
+	Exclusions        *Exclusions `json:"exclusions"`
+	ChecksumAlgorithm string      `json:"checksum_algorithm"`
+	ChecksumFormat    string      `json:"checksum_format"`
 
 	EncodedFilenameCharset string `json:"encoded_filename_charset"`
 	KeySegmentMaxBytes     uint32 `json:"key_segment_max_bytes"`
@@ -163,12 +168,17 @@ var ErrInvalidManifest = errors.New("backup: manifest invalid")
 
 // NewPhase0SnapshotManifest seeds a manifest with the Phase 0a defaults.
 // Callers fill in scope (Adapters), Source/wall time and exclusions before
-// passing it to WriteManifest.
+// passing it to WriteManifest. Adapters and Exclusions are seeded to
+// non-nil zero values so the resulting manifest passes the
+// "section-present" validation; callers populating individual scopes
+// reach in via the now-non-nil pointer.
 func NewPhase0SnapshotManifest(now time.Time) Manifest {
 	return Manifest{
 		FormatVersion:          CurrentFormatVersion,
 		Phase:                  PhasePhase0SnapshotDecode,
 		WallTimeISO:            now.UTC().Format(time.RFC3339Nano),
+		Adapters:               &Adapters{},
+		Exclusions:             &Exclusions{},
 		ChecksumAlgorithm:      ChecksumAlgorithmSHA256,
 		ChecksumFormat:         ChecksumFormatSha256sum,
 		EncodedFilenameCharset: EncodedFilenameCharsetRFC3986,
@@ -266,6 +276,15 @@ func (m Manifest) validateRequiredFields() error {
 	if _, err := time.Parse(time.RFC3339Nano, m.WallTimeISO); err != nil {
 		return errors.Wrapf(ErrInvalidManifest, "wall_time_iso unparseable: %v", err)
 	}
+	// Adapters and Exclusions are required structural sections.
+	// A manifest that omits either is treated as truncated/corrupted
+	// (Codex P2 #146 round 3).
+	if m.Adapters == nil {
+		return errors.Wrap(ErrInvalidManifest, "adapters section missing")
+	}
+	if m.Exclusions == nil {
+		return errors.Wrap(ErrInvalidManifest, "exclusions section missing")
+	}
 	return nil
 }
 

internal/backup/manifest_test.go

@@ -19,13 +19,13 @@ func TestManifest_Phase0RoundTrip(t *testing.T) {
 	m.SnapshotIndex = 18432021
 	m.LastCommitTS = 4517352099840000
 	m.Source = &Source{FSMPath: "/data/fsm-snap/0000000000000064.fsm", FSMCRC32C: "deadbeef"}
-	m.Adapters = Adapters{
+	m.Adapters = &Adapters{
 		DynamoDB: &Adapter{Tables: []string{"orders", "users"}},
 		S3:       &Adapter{Buckets: []string{"photos"}},
 		Redis:    &Adapter{Databases: []uint32{0}},
 		SQS:      &Adapter{Queues: []string{"orders-fifo.fifo"}},
 	}
-	m.Exclusions = Exclusions{} // all defaults
+	m.Exclusions = &Exclusions{} // all defaults
 
 	var buf bytes.Buffer
 	if err := WriteManifest(&buf, m); err != nil {
@@ -311,6 +311,52 @@ func TestAdaptersStruct_NilVsEmptyDistinguishedOnDisk(t *testing.T) {
 	}
 }
 
+func TestReadManifest_RejectsMissingAdapters(t *testing.T) {
+	t.Parallel()
+	// Adapters section omitted from the JSON entirely — Codex P2
+	// #146 round 3. With Adapters as a pointer the omission decodes
+	// as nil; validation must surface ErrInvalidManifest rather than
+	// treat an empty zero-value section as valid.
+	body := `{
+		"format_version": 1,
+		"phase": "phase0-snapshot-decode",
+		"wall_time_iso": "2026-04-29T00:00:00Z",
+		"exclusions": {"include_incomplete_uploads":false,"include_orphans":false,"preserve_sqs_visibility":false,"include_sqs_side_records":false},
+		"checksum_algorithm": "sha256",
+		"checksum_format": "sha256sum",
+		"encoded_filename_charset": "rfc3986-unreserved-plus-percent",
+		"key_segment_max_bytes": 240,
+		"s3_meta_suffix": ".elastickv-meta.json",
+		"s3_collision_strategy": "leaf-data-suffix",
+		"dynamodb_layout": "per-item"
+	}`
+	_, err := ReadManifest(strings.NewReader(body))
+	if !errors.Is(err, ErrInvalidManifest) {
+		t.Fatalf("err=%v want ErrInvalidManifest for missing adapters", err)
+	}
+}
+
+func TestReadManifest_RejectsMissingExclusions(t *testing.T) {
+	t.Parallel()
+	body := `{
+		"format_version": 1,
+		"phase": "phase0-snapshot-decode",
+		"wall_time_iso": "2026-04-29T00:00:00Z",
+		"adapters": {},
+		"checksum_algorithm": "sha256",
+		"checksum_format": "sha256sum",
+		"encoded_filename_charset": "rfc3986-unreserved-plus-percent",
+		"key_segment_max_bytes": 240,
+		"s3_meta_suffix": ".elastickv-meta.json",
+		"s3_collision_strategy": "leaf-data-suffix",
+		"dynamodb_layout": "per-item"
+	}`
+	_, err := ReadManifest(strings.NewReader(body))
+	if !errors.Is(err, ErrInvalidManifest) {
+		t.Fatalf("err=%v want ErrInvalidManifest for missing exclusions", err)
+	}
+}
+
 func TestWriteManifest_ProducesPrettyJSON(t *testing.T) {
 	t.Parallel()
 	m := NewPhase0SnapshotManifest(time.Now())