Repository navigation
Remaining correctness follow-ups from #519 #529
Description
Objective
Track the remaining correctness follow-ups identified in #519, under the operator's authorization to implement, validate and publish independent or stacked PRs. #519 remains closed; #523 stays unchanged while awaiting current-head human approval.
Delivery slices
- V12: external bound actions must not implicitly create missing entities; preserve trusted internal creation.
- V9: non-strict PATCH/PUT must not shadow spec-owned counters/booleans or runtime-owned fields; preserve live/replay consistency and legitimate writes.
- CI dependency isolation check passes when cargo tree fails #528: dependency-isolation CI must fail on Cargo query failure and forbidden dependencies, using supported arguments.
- V13: typed storage/authentication failure classification; preserve fail-closed authorization and commit uncertainty. Coordinate with fix(kernel): name Cedar policies in denials, close policy/actor-directory races #418.
- V11: explicit create-only lifecycle behavior for existing/deleted IDs. Coordinate with fix(stores): uniform deleted-entity listing + non-poisoning Redis appends (ARN-192) #350.
- V1/V3/V4: authoritative reads, projection recovery, and truthful post-commit outcomes. Reuse/review relevant fix(stores): uniform deleted-entity listing + non-poisoning Redis appends (ARN-192) #350 work rather than import its whole branch.
- V14 and remaining V5 ambiguity: end-to-end request budgets with explicit admitted/unknown outcomes; timeouts are not cancellation or proof of non-commit.
- V8: bounded reread/reauthorization for stale authorization, retaining the safety fence.
- V7: define and implement a bounded operational design for durable key-retention/reuse semantics; no unbounded journal scans or merely enlarged cache.
- Make post-commit cross-entity reactions durable and observable #414: durable, observable cross-entity reaction obligations/recovery; no external-provider exactly-once claim.
Current execution
First wave: isolated V12, V9 and #528 writers, each with discriminating RED/GREEN regressions and fresh independent review. Read-only investigation will partition overlapping and larger contracts before later writer handoffs. Parent owns integration, explicit staging, signed commits, publication and finding disposition. Keep proofs source-bound, preserve first failures, and do not weaken assertions/lint baselines.
Known automatic PostgreSQL fixtures require explicit scoped execution/resource accounting; focused first-wave validation will not start containers. All unrelated processes/containers and existing source/evidence are protected. Only finished task-owned build caches may be reclaimed.
Relevant completed work: #524, #525, #526 and #527 merged. #523 head cc7a7bf is signed, CI-green and has no unresolved review threads, but still needs human approval of that head. Maintainer merges remain human-owned.
Activity
gabrik commentedon Oct 9, 2026
First-wave status (all work by isolated writers with fresh independent reviews; parent owns integration/publication):
b63ee545, based on main). RED proved the original CI block swallowed a Cargo exit42 and printed OK;19/19 corrected regression cases and all three real supportedcargo tree --edges no-devqueries pass on the pinned toolchain. Note: the saved OAuth credential lacksworkflowscope, so the CI-file push used the same gabrik identity over SSH.Constraints remain: #523 (cc7a7bf) is frozen pending current-head human review; no durable-exactly-once/all-backend claims; focused non-DB validation only in writer phases, with authorized broader gates before each publication.
gabrik commentedon Oct 9, 2026
Publication update:
Each writer slice had discriminating pre-fix REDs, fresh independent review, and a targeted re-review of its corrections (both OK with notes; deferred P2 performance notes are recorded in the PR bodies). V13 (typed identity dependency errors) is in progress. #523 still awaits current-head human approval; merge order is #523 → #531 → #532, with #530 independent.
gabrik commentedon Oct 9, 2026
Status and new review-derived follow-ups:
Lanes: V13 (typed identity-authority 503) is implemented, module-split and review-clean (OK with notes); its publication plus #531's review-clean native-endpoint test follow-up are frozen on a recurred local SSH signing-agent outage (no bypass; operator alerted). #530 is CI-green. #531 CI currently fails only the native-endpoint fixture test that the frozen follow-up corrects; #532 will be rebased after that lands.
Follow-ups recorded from the V13 independent review (all pre-existing, outside that delta's blast radius):
TrustedIssuerreads can turn into 401s, and — more seriously — a respawningPrincipalGenerationactor can read generation 0, so a revoked/stale token may be accepted (revocation fail-open under outage). Smallest real fix: route both reads through the strict authoritative-state path (StrictFullJournal, whose read errors always surface) like the credential reads — not merely adding a fault-injection test seam.entity_ops.rs:879pre-existing.unwrap()) instead of classifying as Unavailable like the opaque path now does.entity_existspre-check. Both fail closed; should converge on the opaque contract.Also noted from the V12 lane: dispatch-entry classification of every action-entry family is archived in the #531 evidence (native/WASM endpoint admission confirmed external-strict per docs/schema; spec-governed internal creation boundaries preserved and enumerated).
gabrik commentedon Oct 9, 2026
Publication update: #533 opened — V13 typed identity-authority 503 (independent, base main; review-clean with recorded pre-existing follow-ups). #531 now carries its review-clean native-endpoint fixture migration (head
09bded69); #532 is rebased on top (db93fea1). Signing recovered; all stack heads are signed and verified. V11 create-only writer is in progress; its PG-adapter create branch is documented as a separate follow-up gap (ON CONFLICT DO NOTHING returns Ok regardless of insertion).gabrik commentedon Oct 9, 2026
Full delivery map after the latest round:
6255ac3b)cc7a7bf2, awaiting current-head human approval09bded69, stacked on #5235d40bfb6(trigger-fixture fix just pushed; CI rerunning), stacked on #5316abde492(rebased; CI rerunning), stacked on #532Both #532 CI failures were test fixtures forging effect-owned state (a boolean mirror; a counter param without its assignment effect) — the protection catching real forgeries. New follow-ups recorded from the audits:
ProposalComplete(records_created_count, issues_created_count — real kernel caller, no runtime test), temper_agentConfigure(agent_depth) andCompactionComplete(context_tokens — would retain stale increments rather than accept its replacement param), tool_hookRegister(priority).Merge order: #523 → #531 → #532 → #534; #530 independent. Remaining #519 umbrella items not yet started: V1/V3/V4 projection/read slices (C1/C2/D1/D2 in the lane map), V14/V5-residual request budgets, V7 retention, V8 reauthorization, #414 durable reactions.
gabrik commentedon Oct 9, 2026
All published follow-up PRs are now CI-green with zero unresolved review threads:
6255ac3b)cc7a7bf2b63ee54509bded695d40bfb66abde492Merge order for the stack: #523 → #531 → #532 → #534 (each reduces to its own commits as predecessors merge); #530 is independent. Every slice carried discriminating pre-fix REDs, fresh independent review (all OK/OK-with-notes), and recorded local validation; maintainer review/merge decisions are human-owned.
In progress: C1 fresh point reads (stale-catalog GET serving). Remaining mapped slices: C2 list completeness, D1/D2 projection outcomes/append reconciliation, V14/V5-residual request budgets, V7 retention, V8 reauthorization, #414 durable reactions, plus the recorded app-spec counter contracts and PG-adapter create gap.
gabrik commentedon Oct 9, 2026
PR #535 published — C1 fresh point reads (stack level 5: #523→#531→#532→#534→#535).
Single-entity GETs now validate the catalog row against the authoritative journal tail (
read_eventsstrictly afterrow.sequence_nr; no new trait methods). Stale rows fall through to the existing catalog-miss recovery (authoritative tombstone 404); probe failures are typed 503JournalUnavailable; fresh rows keep the exact fast path; no-journal deployments unchanged; C2 list path untouched. 3 pre-fix REDs + 8 controls, compat suites at exact counts, all gates clean, 11/11 re-run on the final tree. Independent review: OK-with-notes.New follow-up recorded from review (P2, pre-existing semantics newly reachable): on the hydration fallback,
ensure_entity_loaded(state/entity_ops.rs:1973-1976) collapses a journal read error into "absent" → fabricated 404 for an existing entity when the probe succeeds but hydration read fails within one request. Smallest fix: distinguishPersistenceErrorfrom genuinely-empty history and surface a dependency error — separate slice (pairs naturally with D1/D2).Accepted residual (supervisor-approved): no synchronous catalog repair — a stale row pays tail probe + actor hydration per GET until an independent write refreshes the catalog.
gabrik commentedon Oct 9, 2026
C2 (filtered-list candidate completeness) — design settled, contract decisions recorded.
Design scout output (read-only, at
028de747) compared three architectures: (A) source-backed bounded enumeration vialist_entity_ids_by_type, (B1) co-committed per-(tenant,type) watermark / (B2) per-row tail proof, (C) generalizing the shipped ARN-89/ARN-68 gap-reconcile from "empty page + pure-equality filter" to every filter shape and non-empty pages, plus a scoped per-row value revalidation for returned rows (closing the stale-inclusion half that coverage probes alone cannot).Human-owner decisions (recorded):
scan_candidate_budget; correct 200 at degraded latency; budget exhaustion keeps the existing413 QueryTooLarge. No new status codes or budget knobs.503 JournalUnavailableverbatim (same typed error as C1 point reads); all-or-nothing, no partial pages.Deferred (explicitly not in the C2 writer's scope):
QueryPlaneReadTelemetrydata; would also raise the "declared filterable fields" spec-surface question for IOA authors.QueryProjectionWriteQueuesilent-drop-on-exhausted-retries (query_projection_queue.rs:275-305) — divergence is currently unrecorded; read-side correctness backstop ships first, durable staleness fact is a separate availability investment.C2 writer slice (launching next): remove the zero-coverage native-page bypass (query_plane_read/mod.rs:195-213,
list_entity_ids_lazynot rawlist_entity_ids), generalize the gap-union to all pushdown filter shapes and non-empty pages, add bounded per-row value revalidation for returned rows, keepscan_candidate_budget/413 as-is, DST REDs per the lane map (omission, reverse transition, range/OR, page boundary, budget control, row-denied hidden).gabrik commentedon Oct 9, 2026
PR #536 published — hydration dependency errors (stack level 6: #523→#531→#532→#534→#535→#536).
ensure_entity_loadedno longer collapses a journal read error into confirmed absence: newensure_entity_loaded_or_errordiscriminatesErr(typed 503JournalUnavailableon the point-read probe) fromOk(false)(confirmed absence keeps 404). All other callers keep byte-identical behavior via the legacy wrapper, pinned by a control test. Review: OK-with-notes (no P1/P2); the three reviewer P3 one-liners are folded into the commit (09e59196), focused suites re-run green on the committed tree.Verified negative finding from the same review (recorded): bound-action dispatch under journal read failure was already fail-closed at base via
ReplayPolicy::ExistingSnapshot— the original premise that it 404'd does not hold; no change made there.#535 note: its first CI Tests run failed on infrastructure (testcontainers could not pull
postgres:11-alpine— registry stream error — intemper-actor-runtime, untouched by the PR). Lacking rerun permission, the author close/reopened to retrigger at the same signed head028de747; re-run nearly complete.C2 writer launched on the new stack tip per the settled Option C design + recorded contract decisions: coverage-skip removal, gap-union generalization to all pushdown filter shapes and non-empty pages, bounded per-row value revalidation, existing 413/503 contracts unchanged.