{"record":{"id":"80d40dfa91aa5288","repo":"astrid-runtime/astrid","slug":"legacy-audit-tree-contains-a-redirect-or-boundary","errorCode":null,"errorMessage":"legacy audit tree contains a redirect or boundary: {}","messagePattern":"legacy audit tree contains a redirect or boundary: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-kernel/src/legacy_migration_barrier/host_fs.rs","lineNumber":539,"sourceCode":"    }\n    if device_id(&metadata) != root_device || active_mountpoint(path)? {\n        return Err(io::Error::new(\n            io::ErrorKind::InvalidData,\n            format!(\n                \"legacy audit tree crosses a filesystem or mount boundary: {}\",\n                path.display()\n            ),\n        ));\n    }\n    astrid_core::platform_fs::verify_no_redirects(path)?;\n    for entry in fs::read_dir(path).map_err(io::Error::other)? {\n        let child = entry.map_err(io::Error::other)?.path();\n        let child_metadata = fs::symlink_metadata(&child).map_err(io::Error::other)?;\n        if child_metadata.file_type().is_symlink()\n            || device_id(&child_metadata) != root_device\n            || active_mountpoint(&child)?\n        {\n            return Err(io::Error::new(\n                io::ErrorKind::InvalidData,\n                format!(\n                    \"legacy audit tree contains a redirect or boundary: {}\",\n                    child.display()\n                ),\n            ));\n        }\n        if child_metadata.is_dir() {\n            validate_audit_tree(&child, root_device)?;\n        } else if child_metadata.is_file() {\n            astrid_core::platform_fs::verify_no_redirects(&child)?;\n        } else {\n            return Err(io::Error::new(\n                io::ErrorKind::InvalidData,\n                format!(\n                    \"legacy audit tree contains a special file: {}\",\n                    child.display()\n                ),","sourceCodeStart":521,"sourceCodeEnd":557,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-kernel/src/legacy_migration_barrier/host_fs.rs#L521-L557","documentation":"While recursively validating the legacy audit tree, validate_audit_tree inspects each child with symlink_metadata and rejects any child that is a symlink, lives on a different device, or is an active mountpoint. This prevents redirected or cross-filesystem entries from being swept into the rename/delete, which could affect data outside the legacy audit layout.","triggerScenarios":"Retiring or preflighting an audit tree that contains a symlinked file/subdirectory, a bind-mounted child, or any entry on another device — detected during the recursive read_dir descent.","commonSituations":"Symlinked log or artifact files inside the audit directory pointing elsewhere; per-directory mounts; container bind mounts over subdirectories.","solutions":["Replace symlinks inside the audit tree with real copies of the target data (cp -L then remove the link).","Unmount any mount covering entries inside the audit tree.","Move cross-device entries onto the same filesystem as the audit root, or delete them if unneeded."],"exampleFix":"// before\ncurrent.log -> /var/log/audit/current.log (symlink)\n// after\ncp -L /var/log/audit/current.log ~/.astrid/principal/audit/current.log\nrm ~/.astrid/principal/audit/current.log  # remove symlink, keep the copy","handlingStrategy":"validation","validationCode":"fn children_are_plain(root: &Path) -> std::io::Result<bool> {\n    use std::os::unix::fs::MetadataExt;\n    let root_dev = std::fs::symlink_metadata(root)?.dev();\n    for entry in std::fs::read_dir(root)? {\n        let m = std::fs::symlink_metadata(entry?.path())?;\n        if m.file_type().is_symlink() || m.dev() != root_dev { return Ok(false); }\n    }\n    Ok(true)\n}","typeGuard":null,"tryCatchPattern":"if let Err(e) = migrate_legacy_audit(&home, &source) {\n    if e.to_string().contains(\"contains a redirect or boundary\") {\n        // the message names the offending child; fix that entry and retry\n    }\n}","preventionTips":["Copy (cp -L) instead of linking files into the audit tree.","Audit for symlinks with `find <audit-dir> -type l` pre-migration.","Avoid per-subdirectory mounts inside legacy trees."],"tags":["filesystem","symlink","mount","security"],"backgroundTag":"incompatible-source-type","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}