Skip to content

feat(v0.13): State Engine V2 durability and migration - #92

Draft
eybersjp wants to merge 179 commits into
mainfrom
feature/v0.13-state-engine-v2
Draft

eybersjp wants to merge 179 commits into
mainfrom
feature/v0.13-state-engine-v2

Conversation

@eybersjp

Copy link
Copy Markdown
Owner

DKF130-T04 — State Engine V2

First v0.13 priority, rebased from the released v0.12.1 line.

Scope

  • canonical append-only State Engine V2 ledger
  • rebuildable snapshot and acceleration index
  • legacy state migration/cutover
  • Autopilot and orchestration persistence adapters
  • journal-less torn-tail recovery
  • persistent hash-chained legacy-restore transaction log
  • full Windows restore path on positively identified supported storage
  • Windows native durability helper with literal process arguments
  • v0.13 high-assurance Development Contract
  • dedicated v0.13 regression lane

Preserved

All released v0.12.1 T01–T03/T05–T10 semantics remain in place. Historical v0.12 State Engine branches are source material only.

Explicitly not claimed yet

This PR is not accepted merely because CI passes. T04 remains risk level 3 and requires independent code, architecture, and security review plus security-control evidence bound to the exact reviewed source.

Deferred/out of scope

  • application-specific state semantics
  • distributed locking
  • same-account hostile writer hardening tracked separately
  • v0.13 release publication

eybersjp commented Nov 1, 2026

Copy link
Copy Markdown
Owner Author

Independent exact-final-source review request — v0.13 T04 risk-3, 1 Nov 2026. Authoritative integration HEAD is 6b5d31d47db0a07f3eb565dbb93bd5cf97ffe051. H76/H77 adversarial RED (Ubuntu+Windows) CI #41264569817 and corrected full GREEN (Ubuntu+Windows) CI #41264602042 are source-bound to diagnostic PR #173, with exact verified source/test blobs ported to this head. Please perform genuine independent, authenticated, distinct (1) code correctness/concurrency, (2) architecture/legacy restore/migration, and (3) security/ACL/path/journal/Windows durability reviews against the full exact 40-character SHA, not a prior commit. Record reviewer identity, role, source SHA, findings and decision in the governance review register; review comments or resolved threads are not approvals. Explicitly examine H75/H76/H77 read-only recovery/witness boundaries, H66 acknowledged-history protection, and Issue #73 physical NTFS sudden-power-loss requirement. Do not mark ACCEPTED or merge based on automated suggestions, CI alone or simulated process crashes. Two independent full final-SHA Ubuntu/Windows executions are in progress (PR #92 and CI-only witness PR #174).

eybersjp commented Nov 1, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Please perform a fresh independent diagnostic code/security/architecture review of authoritative draft PR #92 at exact commit 26de8b35758540a93d58207c7b6bbfbabb6050d0, especially the H78 NTFS restore path preflight, canonical ledger and witness semantics, Windows native helper/ACL and original-tree preservation, concurrent migration, and v0.13 compatibility. Report reproducible findings with exact source lines and severity. This request does not confer or substitute for three distinct authenticated risk-3 CODE/ARCHITECTURE/SECURITY approvals, controlled physical NTFS power-loss evidence or persisted ACCEPTED. Do not merge or release.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 26de8b3575

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

eybersjp commented Nov 1, 2026

Copy link
Copy Markdown
Owner Author

@codex review

Request fresh independent diagnostic code/security/architecture scrutiny of exact v0.13 T04 integration SHA d8b1e7e02e451f1c6aa1f6bce0c1bd616c67a344, specifically H80 candidate content witness and recovery acknowledgement, H79 Windows read-only stage/ACL durability, canonical/legacy compatibility, symlink/path confinement, cross-process migration gating, and retained originals/journals. H80 test-first RED both platforms CI #41271235511, corrected diagnostic GREEN both platforms CI #41271297676, final integration and CI-only witness runs #41271967891/#41271973237 currently in progress. This request does NOT constitute the mandatory three distinct authenticated role approvals, physical NTFS power-loss evidence or ACCEPTED. Keep PR draft/unmerged and gates fail-closed.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d8b1e7e02e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

eybersjp commented Nov 1, 2026

Copy link
Copy Markdown
Owner Author

Exact-source independent review request — v0.13 T04 risk-3 (1 Nov 2026). Current authoritative integration SHA: bf0cbcb9599a4f7f79feb88f840f89aeb2780d5b. @codex review the exact immutable source and adversarial tests, focusing on Windows H79 read-only staged durability flush, ACL restoration, physical-identity/path races, interrupted hash-chained journal recovery, concurrency, canonical ledger fail-closed witnesses and v0.13 compatibility. Please report source-bound findings with severity and reproducible cases; this request is diagnostic only and must not be counted as any of the three distinct authenticated independent code, architecture, security approval receipts. Separate reviewers in those roles must independently inspect this exact SHA and provide signed/authenticated source-bound decisions; controlled NTFS physical sudden-power-loss evidence under Issue #73 is also mandatory. No approval, acceptance, merge or release is implied.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf0cbcb959

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

const loadedSnapshot = loadStateSnapshot(rootDir, { rebuildIfNeeded });
if (!loadedSnapshot && !rebuildIfNeeded) return null;
const snapshot = loadedSnapshot ?? emptySnapshot();
const paths = statePaths(rootDir);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Disable bootstrap recovery in read-only index preflight

If an initializer publishes a bootstrap hard link and exits between the snapshot read and this second path lookup, loadStateIndex(rootDir, { rebuildIfNeeded: false }) still mutates recovery evidence because statePaths() defaults to enabling bootstrap recovery. Reproduced on Linux against the requested tree: initialize an empty layout, remove index.db, then have a child publish its bootstrap index link and exit before unlinking the staging name during the snapshot read. The read-only index lookup succeeds, deletes the staging entry, and reduces the canonical link count from two to one. Unlike the corrected scale-context GET path, this public index reader therefore retains a recovery-enabled preflight. Pass recoverBootstrapIfNeeded: rebuildIfNeeded here so the read-only call fails closed without consuming the interrupted initializer's evidence.

Useful? React with 👍 / 👎.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant