feat: zaino-store — block store with LMDB persistence, Lean formaliza…

.gitignore

@@ -18,3 +18,5 @@ target/
 .failed-tests
 **/proptest-regressions/**
 /result
+data/
+zaino.code-workspace

CLAUDE.md

@@ -172,6 +172,15 @@ Reach for `grep` only as a fallback — when the server is genuinely
 unavailable, still indexing, or the target isn't code it understands — and
 say so when you do.
 
+## Dead code
+
+- **StateService** (`packages/zaino-state/src/backends/state.rs`) is dead code.
+  It is never used in production — only `FetchService` is. Do not modify, fix, or
+  add features to StateService. The project has no intent to revive the Zebra
+  backend.
+
+## Multi-workspace caveat
+
 **Multi-workspace caveat (this repo):** the tree has three *separate* Cargo
 workspaces — `Cargo.toml` (root, `packages/*` production), `integration-tests/Cargo.toml`
 (walletless tests), and `integration-tests/wallet-tests/Cargo.toml` (wallet

Cargo.toml

@@ -7,6 +7,8 @@ members = [
     "packages/zaino-state",
     "packages/zaino-fetch",
     "packages/zaino-proto",
+    "packages/zaino-store",
+    "packages/zaino-admin",
 ]
 exclude = [
     "integration-tests",
@@ -62,6 +64,7 @@ tracing-subscriber = { version = "0.3.20", features = [
 ] }
 tracing-futures = "0.2"
 tracing-tree = "0.4"
+tracing-journald = "0.3"
 nu-ansi-term = "0.50"
 time = { version = "0.3", features = ["macros", "formatting"] }
 
@@ -129,6 +132,7 @@ zaino-fetch = { path = "packages/zaino-fetch", version = "0.2.0" }
 zaino-proto = { path = "packages/zaino-proto", version = "0.1.1" }
 zaino-state = { path = "packages/zaino-state", version = "0.3.0" }
 zaino-serve = { path = "packages/zaino-serve", version = "0.2.0" }
+zaino-store = { path = "packages/zaino-store", version = "0.1.0" }
 wire_serialized_transaction_test_data = "1.0.0"
 config = { version = "0.15", default-features = false, features = ["toml"] }
 nonempty = "0.11.0"
@@ -139,6 +143,7 @@ zip32 = "0.2.1"
 slab = "0.4.11"
 anyhow = "1.0"
 arc-swap = "1.7.1"
+im = "15"
 cargo-lock = "10.1.0"
 derive_more = "2.0.1"
 lazy_static = "1.5.0"

Dockerfile

@@ -4,7 +4,7 @@
 # Global build args
 ############################
 # RUST_VERSION must be supplied via --build-arg. Canonical source is
-# rust-toolchain.toml's `channel`, surfaced by tools/scripts/get-rust-version.sh
+# rust-toolchain.toml's `channel`, surfaced by the workbench get-rust-version bin
 # — no default is set so a stale literal cannot drift from the workspace's
 # pinned toolchain. See README for the recommended build invocation.
 ARG RUST_VERSION
@@ -36,7 +36,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
       clang=1:14.0-55.7~deb12u1 \
       cmake=3.25.1-1 \
       make=4.3-4.1 \
-      libssl-dev=3.0.20-1~deb12u1 \
       ca-certificates=20230311+deb12u1 \
       protobuf-compiler=3.21.12-3 \
   && rm -rf /var/lib/apt/lists/*
@@ -74,7 +73,6 @@ ARG HOME
 RUN apt-get -qq update && \
     apt-get -qq install -y --no-install-recommends \
       ca-certificates=20230311+deb12u1 \
-      libssl3=3.0.20-1~deb12u1 \
       libgcc-s1=12.2.0-14+deb12u1 \
     && rm -rf /var/lib/apt/lists/*
 

Dockerfile.workspace

@@ -0,0 +1,112 @@
+# syntax=docker/dockerfile:1
+
+############################
+# Global build args
+############################
+# RUST_VERSION must be supplied via --build-arg. Canonical source is
+# rust-toolchain.toml's `channel`, surfaced by tools/scripts/get-rust-version.sh
+# — no default is set so a stale literal cannot drift from the workspace's
+# pinned toolchain. See README for the recommended build invocation.
+ARG RUST_VERSION
+ARG UID=1000
+ARG GID=1000
+ARG USER=container_user
+ARG HOME=/home/container_user
+
+############################
+# Builder
+############################
+FROM docker.io/library/rust:${RUST_VERSION}-bookworm AS builder
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+WORKDIR /app
+
+# Toggle to build without TLS feature if needed
+ARG NO_TLS=false
+
+# Extra cargo features to enable (comma-separated, e.g. "prometheus,no_tls_with_prometheus").
+# Takes precedence over NO_TLS when set.
+ARG CARGO_FEATURES=""
+
+# Build deps incl. protoc for prost-build
+# Versions pinned (DL3008) for reproducibility / supply-chain hygiene. Pins
+# match the candidate versions in docker.io/library/rust:1.95.0-bookworm; bump
+# them together with the base image (query with `apt-cache policy <pkg>`).
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      pkg-config=1.8.1-1 \
+      clang=1:14.0-55.7~deb12u1 \
+      cmake=3.25.1-1 \
+      make=4.3-4.1 \
+      libssl-dev=3.0.20-1~deb12u1 \
+      ca-certificates=20230311+deb12u1 \
+      protobuf-compiler=3.21.12-3 \
+  && rm -rf /var/lib/apt/lists/*
+
+# Copy entire workspace (prevents missing members)
+COPY . .
+
+# Build all workspace binaries with default features.
+# If CARGO_FEATURES or NO_TLS is set, rebuild just zainod with those features
+# on top of the default build (reuses cached deps from the first pass).
+RUN cargo build --release --locked --workspace --bins && \
+    if [ -n "${CARGO_FEATURES}" ]; then \
+      cargo build --release --locked -p zainod --bin zainod --features "${CARGO_FEATURES}"; \
+    elif [ "${NO_TLS}" = "true" ]; then \
+      cargo build --release --locked -p zainod --bin zainod --features no_tls_use_unencrypted_traffic; \
+    fi
+
+############################
+# Runtime
+############################
+FROM docker.io/library/debian:bookworm-slim AS runtime
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+
+ARG UID
+ARG GID
+ARG USER
+ARG HOME
+
+# Runtime deps
+# Versions pinned (DL3008) to the candidates in
+# docker.io/library/debian:bookworm-slim; bump together with the base image.
+RUN apt-get -qq update && \
+    apt-get -qq install -y --no-install-recommends \
+      ca-certificates=20230311+deb12u1 \
+      libssl3=3.0.20-1~deb12u1 \
+      libgcc-s1=12.2.0-14+deb12u1 \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create non-root user
+RUN addgroup --gid "${GID}" "${USER}" && \
+    adduser  --uid "${UID}" --gid "${GID}" --home "${HOME}" \
+             --disabled-password --gecos "" "${USER}"
+
+ENV HOME=${HOME}
+
+WORKDIR ${HOME}
+
+# Create ergonomic mount points with symlinks to XDG defaults
+# Users mount to /app/config and /app/data, zaino uses ~/.config/zaino and ~/.cache/zaino
+RUN mkdir -p /app/config /app/data && \
+    mkdir -p ${HOME}/.config ${HOME}/.cache && \
+    ln -s /app/config ${HOME}/.config/zaino && \
+    ln -s /app/data ${HOME}/.cache/zaino && \
+    chown -R ${UID}:${GID} /app ${HOME}/.config ${HOME}/.cache
+
+# Copy all workspace binaries
+COPY --from=builder /app/target/release/zainod /usr/local/bin/zainod
+COPY --from=builder /app/target/release/zaino-admin /usr/local/bin/zaino-admin
+COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+# Default ports
+ARG ZAINO_GRPC_PORT=8137
+ARG ZAINO_JSON_RPC_PORT=8237
+EXPOSE ${ZAINO_GRPC_PORT} ${ZAINO_JSON_RPC_PORT}
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD /usr/local/bin/zainod --version >/dev/null 2>&1 || exit 1
+
+USER ${USER}
+
+ENTRYPOINT ["/entrypoint.sh"]
+CMD ["start"]

docs/.gitignore

@@ -0,0 +1 @@
+.lake/