[ScriptedAlchemy]

Scope

Refs #4423 — partial, DRAFT. Supersedes closed PR #4816 because its original 77-character commit header failed the 72-character CI commitlint gate. This replacement copies the complete production change and existing barrier regressions unchanged and adds a provider-state correctness regression. No force-push or rewrite of the prior contributor commit.

Source changes

• Local editor/LSP and hook feedback no longer starts GitHub review refresh or CI discovery, so independently authorized code diagnostics can proceed despite a remote read that hangs, fails, or is denied.
• Explicit advisory invocation continues to await requested GitHub/CI remote reads under its authorized deadline.
• A configured remote CI provider deliberately not read during a local cycle is Unavailable, not NotConfigured. A genuinely absent CI configuration retains NotConfigured; no local pass can imply remote evidence was fetched.
• Preserves the canonical advisory/feedback owner, operation event, selected configuration/generation, proximity and delivery path. No new scheduler or provider cache.

Regression evidence and validation

Three authored nonzero Rust tests: (1) local feedback cannot even poll a forbidden CI read and excludes GitHub refresh; (2) unconfigured local feedback cannot poll CI and stays NotConfigured; (3) an explicitly requested remote read cannot complete until its barrier releases and propagates Denied. Existing assertions are preserved.

Reviewed exact one-commit diff from master 91c72aba7750a398dd28e83d64bf0c6d6fef4172: two source/test files only, 155 insertions/19 deletions. Commit cb2fa59dc18aee0771a52bf4dd7b8030099520ba has a conforming 58-character header. Source changes were transferred without force from closed #4816, and a new typed-state regression was added.

The new-head Rust/Bazel tests have not executed. Hosted CI is mandatory: //crates/tracedecay:unit_test, owning advisory/runtime/LSP/hook integration, Clippy and repository gates. Native macOS acceptance remains unavailable here. Do not mark ready/merge from diff review alone.

Remaining acceptance

Already-retained remote evidence must attach only under exact authorization, scope, generation, configuration and freshness; remote-required policy must remain fail-closed; test full editor/hook/explicit-refresh journeys and cancellation separation; measure actual provider calls; remove obsolete provider waits/fields only when all consumers are migrated. No issue closure or performance benchmark claim.

Protected #4776 and release #4763 untouched.

CI correction — 2026-11-08

Hosted Repository gates confirmed the Bazel rustfmt_check_2024 rule failed on five formatting hunks (two source regions and two test regions; the source map change appears as two rustfmt diffs). Commit 2cc04d4 applies those exact reported changes. Its independently reviewed diff changes formatting only; all existing regression assertions and production behavior remain intact. The branch was advanced by non-force fast-forward after exact old-head verification. Exact-head CI #42493863604 is queued, not passed. Rust/Bazel behavior and native macOS acceptance remain unverified. Keep the draft unmerged and #4423 open.

Native verification

At 2cc04d4854, all 26 macOS Bazel advisory-runtime tests passed. They cover local feedback with and without CI configuration, explicit remote discovery, ownership retirement and pending replay. Hosted repository gates also passed. The PR remains draft for independent review and the outstanding acceptance work on #4423.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0e883c1

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Devin Review found 1 new potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

[devin-ai-integration]

🔴 Recovered provider verdict stays stale

When an incomplete verdict returns to an earlier state, same_incomplete_publication_evidence matches its older publication. publication_order keeps the intervening verdict newest, so readers never see the recovery.

Learn more

The publication ledger retains incomplete results even after a different verdict arrives for the same key. The duplicate check searches every stored publication, so a later return to an old verdict matches history and never becomes the latest result. Reads select publications by the publication_order timestamp, leaving the intervening verdict visible. This also applies to other evidence that changes and then returns to its earlier value.

Example: Save incomplete Unavailable at time 10, Failed at time 20, then Unavailable again at time 30 under the same key. The third save matches the time-10 entry and is dropped; latest-committed reads still return Failed from time 20.

Recommended fix: Coalesce an incomplete publication only when the newest stored publication for its dedupe key has equivalent evidence. Retain older history, but append a fresh publication when evidence returns after an intervening change; cover the A→B→A sequence in the store test.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[ScriptedAlchemy]

Exact-head correctness repair — Refs #4423

Published 6bdfb29696326d0c633e2facc3e7792026054c08 via expected-old-head e7a204c, non-force fast-forward. Branch, PR, and commit comparison independently match this head; the PR is DRAFT / HOLD MERGE.

Fixed source defect: the previous incomplete-publication coalescer compared every historical record. After an Unavailable → Failed → Unavailable recovery, an old Unavailable suppressed the new result, leaving readers on stale Failed evidence. Dedupe now compares only the latest committed result for the same key; it still does not consume the completed-result key. Coalescing also distinguishes grants, policy, trigger, budget, runtime and admitted scope, without rewriting existing durable result identities.

Extended the actual SQLite store test to check the A→B→A transition and doctor_latest_publication read, subsequent unchanged repetition and changed runtime, while retaining the 64 repeated-save assertion and existing identity-refusal test. Moved the three fixture imports to module scope per AGENTS. One source/test file changed, no generated output touched. These are authored regressions, not passed tests.

Current CI: run 42754863027 queued at handoff. Superseded run 42754817367 was cancelled; neither is pass evidence. Local Rust/Bazel and native macOS checks were not available.

Still blocking: identical incomplete cycles currently return Duplicate at the service port, leaving publication=None and preventing compose_canonical_result from minting read handles. Do not solve by deleting historical publication identities that can be referenced by durable host notices or evidence authorities. A coherent port/service/canonical consumer cutover with real read-handle and restart regressions is required. Broader retained remote evidence, LSP/hook/explicit refresh, cancellation, and full caller/API deletion acceptance remain outstanding. No issue closure or merge approval.

[ScriptedAlchemy]

Exact-head handoff — Refs #4423 — DRAFT / HOLD MERGE

Published non-force fast-forward fixes: e2f7e444 followed by current verified head 69355fcd. Both commits descend from 6bdfb296; branch, commit and PR readbacks agree on 69355fcd21058d655f9d89a89a041237d013fd1f.

Concrete fix and API cutover: The former bool publication insert and bare Duplicate incomplete path discarded a fresh result while returning no committed publication reference, preventing canonical read-handle minting. The store port now atomically returns Reused(existing) with the original committed FeedbackPublicationV1 identity. The service verifies full matching incomplete evidence, returns the actual durable result instead of an uncommitted identity, and refuses invalid incomplete duplicates. All identified application, contract-fixture, SQLite-test, and LSP integration callers have been migrated; the duplicate app-local comparison helper was deleted in favor of the canonical contract comparison. Distinct provider verdicts, generation/runtime, grant/policy, and finding projections remain differentiable; historical result IDs are not deleted or rebound.

Authored (not yet executed) behavioral regressions: 64 identical SQLite-backed saves retain one ledger entry and return its exact committed record; A→B→A remote verdict recovery, runtime watermark transitions, and conflicting durable identity are preserved. The contract service test executes two cycles with distinct identities and requires reuse without false complete coverage. The real LSP-advisory/response-handle integration now executes the feedback service again, checks committed incomplete result reuse and reads its diagnostics through the mounted response-handle authority. The earlier Bazel rustfmt diagnostic was corrected.

Validation: Latest-head hosted CI run #42761963446 is QUEUED at this handoff; not a pass. Earlier run #42754863027 FAILED the repository rustfmt check; superseded #42761527046 was cancelled. Local Bazel/native macOS and browser/SDK tests were not run. Do not approve or merge.

Still required before acceptance: Rust compiler/Bazel and nonzero behavioral test results at the exact head, independent review, all production/local editor/hook/explicit refresh callers and obsolete orchestration/API deletion, retained remote validity and authorization, cancellation/restart/read-handle durability, and explicit provider operation attribution. #4423 remains OPEN. PR maintenance owns eventual merge eligibility; no protected model or release authority is granted.

[ScriptedAlchemy]

#4423 current-head handoff — DRAFT / HOLD MERGE

Verified non-force fast-forward commits (Refs #4423):

• e0f67e9: fixes all six rustfmt hunks reported in failed repository-gates job 129649519282 on old CI run #42761963446. Three owned source/test paths, formatting only.
• 9d8c2df (current exact PR/ref head): fixes same-microsecond publication-order tie collisions. A lexically larger older result ID no longer masks the last committed provider verdict in doctor/diagnostic/latest-finding reads, incomplete feedback coalescing, or per-finding listing. New real SQLite-backed regression deliberately commits the larger result identity first, then checks newest verdict, reused committed result, and two-record ledger cardinality. No generated files, release, model, or peer branches changed.

Validation: new exact-head hosted CI #42767834564 was QUEUED at handoff. Rust/Bazel, named nonzero tests, native macOS, and cross-host behavioral acceptance not verified; authored tests must not be treated as passes. Local checkout/Bazel unavailable in this run.

Outstanding acceptance: full local editor/hook/agent-stop/explicit-refresh caller and transport inventory; delete remaining remote-refresh orchestration fields/legacy branches rather than leave dual API paths; retained GitHub/CI evidence scope, generation, freshness, grant and policy checks; cancellation isolation, read-handle/replay after restart, actual provider-call attribution, and compiler/Bazel/native regression proof. #4423 remains OPEN. No merge approval; PR maintenance owns eligibility.

[ScriptedAlchemy]

Exact-head correction — Refs #4423 — DRAFT / HOLD MERGE

Published 3f701f4 as a non-force, expected-old-head fast-forward from 9d8c2df. Independent PR, branch-ref, and GitHub compare readbacks agree: exactly one commit ahead, one owned source/test file, no peer or generated changes.

Correctness fix: CI #42767834564 failed the rustfmt_check_2024 repository gate at two positions in feedback/concrete.rs; both exact reported formatting hunks are corrected. More importantly, the prior fix still sorted equal-timestamp publications by lexicographic result ID, so later committed provider verdicts with smaller IDs were promoted incorrectly despite the comparator fix. The durable ledger now uses stable timestamp sorting, preserving actual insertion order on equal revalidation timestamps; there is no legacy identity tie-breaker. The real SQLite regression now verifies stored ledger order, newest doctor verdict, exact incomplete replay, and a subsequent same-timestamp A→B→A recovery (3 distinct retained records).

Validation: exact-head CI #42774480226 was QUEUED at handoff, not passed. No local Bazel/rustfmt binary exists in this environment, so Rust compilation and named nonzero behavioral-test results are not yet verified. Existing historical ledger order is preserved; older ties whose original insertion order was already lost cannot be reconstructed from result IDs. No data is dropped or rewritten.

Still open: full LSP/hook/explicit refresh API deletion and caller inventory, retained remote evidence authorization/freshness/generation, isolated cancellation and restart/replay, hosted and native Bazel integration. No merge approval, issue closure, or weakening of checks. Coordinate with dedicated PR maintenance on this exact head.

[ScriptedAlchemy]

Exact-head correctness handoff — Refs #4423 — DRAFT / HOLD MERGE

Published 0e883c1 from 3f701f4 by expected-old-head, force=false fast-forward. Independent branch ref, PR metadata, and commit readbacks agree on 0e883c1dbda0218700f3db8a261133588aae0bd0. Exactly one owned source/test file changed; no generated, peer, model, or release files.

Durable integrity fix: a result-ID replay previously compared only selected publication fields. An otherwise identical incomplete publication with a different authority.revalidated_at was accepted and returned the old committed result/handle despite the changed receipt. The store now compares the entire FeedbackPublicationV1 record for same-ID replay, deletes the redundant partial comparison, and refuses any rebind as FeedbackRuntimeError::Corrupt. Distinct-ID incomplete evidence coalescing and original committed handles remain unchanged. Extended the real SQLite-backed conflicting-identity regression to assert receipt rebinding refusal and unmodified retained publication bytes.

Validation: exact-head CI #42781164494 was QUEUED, not passed, at handoff. No local Bazel/native macOS compiler or nonzero test result is claimed.

Still blocking #4423 acceptance: production editor/hook/agent-stop and explicit-refresh API/caller cutover, obsolete remote orchestration deletion, retained provider evidence scope/freshness/generation/policy checks, independent cancellation, restarts/replay and multi-host nonzero Bazel tests. Keep this PR DRAFT / HOLD MERGE; no issue closure or merge authorization. PR-maintenance owns eligible merges.