From c9d12abcf60941e9925ae22c475dc9a4230b3a8d Mon Sep 17 00:00:00 2001 From: Sinity Date: Thu, 6 Aug 2026 11:50:55 +0200 Subject: [PATCH 1/5] chore(beads): add schema gate implementation authority Record the schema-currency hardening implementation as polylogue-dudtn and make it a blocking prerequisite of polylogue-9qnzy. This keeps the live deployment bead separate from the code and test slice. --- .beads/issues.jsonl | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl index 5f55c0c41..efb066c4b 100644 --- a/.beads/issues.jsonl +++ b/.beads/issues.jsonl @@ -1,3 +1,4 @@ +{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T09:50:03Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-06T05:48:17Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-pr-scope-contract","title":"PR scope carrier and executable merge contract","description":"Replace prose-only PR process assumptions with a structured carrier that tells automated review and merge gates the exact Beads scope, disposition, evidence, and residual successor state. The carrier must be bound to the PR head and canonical Beads snapshot and must be consumed by the existing CircleCI and merge-boundary machinery.","design":"Use a versioned JSON carrier embedded in the PR body. Keep Bead acceptance criteria human-readable and do not parse prose. Validate whole-Bead dispositions, assigned IDs, head SHA, Beads snapshot digest, evidence references, and successor IDs for partial work. Make render and check commands part of devtools workspace and bind the carrier digest into merge-gate receipts.","acceptance_criteria":"1. A versioned PR scope carrier schema and renderer/checker exist under devtools and are reachable through the existing workspace command surface. 2. The checker rejects missing or malformed carriers, wrong head SHA, missing assigned Beads, stale Beads digest, unknown or closed successor IDs, and partial dispositions without named successors. 3. CircleCI quick-gate and the actual merge boundary validate the carrier and record its digest in the existing merge-gate receipt. 4. The PR template and lane definitions instruct fresh lanes to emit a non-draft carrier-backed PR with Summary, Problem, Solution, Verification, and per-Bead disposition matrix. 5. Focused tests exercise production command paths and anti-vacuity mutations. 6. No machine gate parses PR prose or Bead acceptance prose.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:16Z","created_by":"Sinity","updated_at":"2026-08-06T05:35:16Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-canonical-snapshot","title":"test harness: compare canonical archive snapshots across all reindex routes","description":"Provide one comparator for rrxe4, 0x7nh, incident fixtures, and promotion, covering canonical rows, provenance, authority, links, attachments, derived views, and representative public projections.","design":"Do not create a second archive semantics engine. Normalize through an explicit allowlist and preserve semantic timestamps and provider identity.","acceptance_criteria":"Only explicit run-local fields are normalized. Mutating material origin, link status, provenance, or action-result state fails. The same comparator is used by route equivalence, crash recovery, and promotion proof tests.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:15Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:15Z","dependency_count":0,"dependent_count":2,"comment_count":0} @@ -16,7 +17,7 @@ {"_type":"issue","id":"polylogue-claude-vintage-live-proof","title":"acceptance: prove measured Claude vintage reclassification","description":"Residual live or proof scope of polylogue-0qfy. The implementation mechanism may remain closed, but the reindex cannot claim convergence until this evidence exists.","design":"Run through the real production seam against a frozen source or candidate generation. Bind the result to an immutable receipt and state explicitly what was not exercised.","acceptance_criteria":"A sanitized measured-cohort old/new pair and read-only cohort-reclassification receipt prove the actual classifier branch and canonical identity decision.","notes":"Parent implementation bead: polylogue-0qfy. This child exists because the audit found the implementation closure did not prove the live effect.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:11Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:11Z","dependencies":[{"issue_id":"polylogue-claude-vintage-live-proof","depends_on_id":"polylogue-0qfy","type":"blocks","created_at":"2026-08-06T07:39:43Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-codex-804-live-proof","title":"acceptance: prove incident-scale Codex materialization and recovery","description":"Residual live or proof scope of polylogue-5iz4. The implementation mechanism may remain closed, but the reindex cannot claim convergence until this evidence exists.","design":"Run through the real production seam against a frozen source or candidate generation. Bind the result to an immutable receipt and state explicitly what was not exercised.","acceptance_criteria":"A real or faithfully sanitized 804-revision, approximately 90 MiB wire shape exercises recovery-copy ordering, crash/restart, source-authority terminal state, and candidate materialization with resource receipts.","notes":"Parent implementation bead: polylogue-5iz4. This child exists because the audit found the implementation closure did not prove the live effect.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:11Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:11Z","dependencies":[{"issue_id":"polylogue-codex-804-live-proof","depends_on_id":"polylogue-5iz4","type":"blocks","created_at":"2026-08-06T07:39:33Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-topology-live-proof","title":"acceptance: prove live topology status and safe public composition","description":"Residual live or proof scope of polylogue-4ts.10. The implementation mechanism may remain closed, but the reindex cannot claim convergence until this evidence exists.","design":"Run through the real production seam against a frozen source or candidate generation. Bind the result to an immutable receipt and state explicitly what was not exercised.","acceptance_criteria":"Candidate and live census show zero empty link status or method values, typed unresolved or cycle-broken edges, and visibly safe reader behavior for unresolved parents.","notes":"Parent implementation bead: polylogue-4ts.10. This child exists because the audit found the implementation closure did not prove the live effect.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:11Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:11Z","dependencies":[{"issue_id":"polylogue-topology-live-proof","depends_on_id":"polylogue-4ts.10","type":"blocks","created_at":"2026-08-06T07:39:23Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0} -{"_type":"issue","id":"polylogue-live-operation-receipts","title":"acceptance: collect live operation receipts for reindex readiness","description":"Aggregate the named operational and live-proof children that convert implementation mechanisms into evidence about the actual archive. This remains open until each applicable child has an immutable receipt or an explicit typed non-applicability decision.","design":"Keep mechanism beads historically honest. Each child proves one live effect or operation and is independently rerunnable and idempotent.","acceptance_criteria":"Every required live-proof child has a receipt bound to the exact source snapshot, candidate or active generation, and semantic fingerprint. Residues are typed rather than silently omitted. The aggregate report is consumed by the terminal reindex proof.","status":"open","priority":0,"issue_type":"epic","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:10Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:10Z","dependencies":[{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-active-leaf-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-byte-supersession-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-chatgpt-content-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-claude-streaming-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-claude-vintage-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-codex-804-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-excluded-cursor-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-hook-authority-conflict-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-hook-reconciliation-apply-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-raw-dedupe-apply-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-stalled-cursor-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-topology-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":12,"dependent_count":1,"comment_count":0} +{"_type":"issue","id":"polylogue-live-operation-receipts","title":"acceptance: collect live operation receipts for reindex readiness","description":"Aggregate the named operational and live-proof children that convert implementation mechanisms into evidence about the actual archive. This remains open until each applicable child has an immutable receipt or an explicit typed non-applicability decision.","design":"Keep mechanism beads historically honest. Each child proves one live effect or operation and is independently rerunnable and idempotent.","acceptance_criteria":"Every required live-proof child has a receipt bound to the exact source snapshot, candidate or active generation, and semantic fingerprint. Residues are typed rather than silently omitted. The aggregate report is consumed by the terminal reindex proof.","status":"open","priority":0,"issue_type":"epic","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:10Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:10Z","dependencies":[{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-active-leaf-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-byte-supersession-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-chatgpt-content-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-claude-streaming-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-claude-vintage-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-codex-804-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-csx21","type":"blocks","created_at":"2026-08-06T10:55:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-excluded-cursor-live-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-hook-authority-conflict-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-hook-reconciliation-apply-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-raw-dedupe-apply-proof","type":"blocks","created_at":"2026-08-06T07:02:58Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-stalled-cursor-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-live-operation-receipts","depends_on_id":"polylogue-topology-live-proof","type":"blocks","created_at":"2026-08-06T07:02:57Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":13,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-reindex-final-proof","title":"acceptance: emit a proof-carrying production reindex receipt","description":"Terminal receipt-only aggregation gate for the production reindex. It authorizes neither code closure nor promotion by itself. It becomes satisfiable only when every incident, candidate, live-operation, fidelity, provenance, scale, and public-contract obligation has a current hash-bound receipt.","design":"Consume one self-describing invariant registry, one canonical comparator, one structured incident ledger, and immutable live receipts. Do not infer completion from a merged PR or a green synthetic test.","acceptance_criteria":"Every blocking incident-ledger row is green or has explicit operator acceptance. The candidate receipt binds the source snapshot, semantic fingerprints, registry version, canonical snapshot, and exact candidate generation. Promotion, daemon restart, convergence, public query tour, and rollback-retention receipts are present and current.","notes":"Evidence required: candidate acceptance receipt; promotion receipt; post-promotion daemon health receipt; canonical query-tour receipt; retained-generation rollback receipt.","status":"open","priority":0,"issue_type":"epic","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:10Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:10Z","dependencies":[{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-0x7nh","type":"blocks","created_at":"2026-08-06T07:01:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-3hdz2","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-aagkt","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-canonical-snapshot","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-csx21","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-embeddings-retention","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-f1vg","type":"blocks","created_at":"2026-08-06T07:01:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-incident-coverage-ledger","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-live-operation-receipts","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-pr-scope-contract","type":"blocks","created_at":"2026-08-06T07:41:29Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-r9xsj","type":"blocks","created_at":"2026-08-06T07:01:39Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-reindex-proof-edge-correction","type":"blocks","created_at":"2026-08-06T07:41:25Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-rrxe4","type":"blocks","created_at":"2026-08-06T07:01:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-rrxe4.1","type":"blocks","created_at":"2026-08-06T07:01:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-final-proof","depends_on_id":"polylogue-xselt","type":"blocks","created_at":"2026-08-06T07:01:55Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":15,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-stalled-cursor-live-proof","title":"acceptance: drain and disposition all stalled append cursors","description":"Residual live or proof scope of polylogue-2qrx. The implementation mechanism may remain closed, but the reindex cannot claim convergence until this evidence exists.","design":"Run through the real production seam against a frozen source or candidate generation. Bind the result to an immutable receipt and state explicitly what was not exercised.","acceptance_criteria":"Ordinary daemon catch-up leaves zero unexplained stalled cursors and every residue has a typed disposition bound to the source snapshot.","notes":"Parent implementation bead: polylogue-2qrx. This child exists because the audit found the implementation closure did not prove the live effect.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:10Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:10Z","dependencies":[{"issue_id":"polylogue-stalled-cursor-live-proof","depends_on_id":"polylogue-2qrx","type":"blocks","created_at":"2026-08-06T07:39:14Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-dlfcx","title":"fix: gate fast-forward promotions on candidate corpus fidelity","description":"Independent review after #3748 found devtools/index_v37_fast_forward.py promotes or recovers activating candidates without the corpus fidelity candidate gate. Absence/revision tests also pass if runners accidentally resolve the active index. Every production promotion path must gate candidate index plus durable source evidence before activation or recovery.","design":"Route fast-forward and activating-recovery through the same candidate acceptance helper used by managed rebuild, retaining durable source root plus explicit candidate index path. Strengthen absence/revision fixtures so active index passes and only candidate fails. Do not duplicate the rebuild gate or mutate production.","acceptance_criteria":"1. Fast-forward normal and restart-recovery promotion refuse an invalid candidate before activation. 2. Candidate-only absence and revision drift tests fail only with index_path_override; active verification remains clear. 3. Focused real-route tests and quick gate pass. 4. No live archive mutation.","status":"in_progress","priority":0,"issue_type":"bug","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-04T07:44:31Z","created_by":"Sinity","updated_at":"2026-08-04T07:44:47Z","started_at":"2026-08-04T07:44:47Z","lease_expires_at":"2026-08-04T07:49:47Z","heartbeat_at":"2026-08-04T07:44:47Z","dependency_count":0,"dependent_count":0,"comment_count":0} @@ -38,7 +39,7 @@ {"_type":"issue","id":"polylogue-rrxe4","title":"test harness: hermetic convergence-property loop - generate corpus, ingest, converge, assert registry green; metamorphic properties on top","description":"The master loop unifying zoo (yazae), composer (amrpx), and registry (t0m73) into ONE elegant mechanism: property test = for corpus-program P and ingestion order sigma: build hermetic archive from (P, sigma) via PRODUCTION ingest+convergence (tests/infra/convergence_harness.py already adapts production writers/daemon stages and 'deliberately owns no alternate convergence state machine' - the exact seam), then assert the t0m73 registry green on the result. Every registry predicate thereby gets exercised against synthetic pathological corpora in CI, and every composer pathology is validated end-to-end through real code. METAMORPHIC properties on top (each kills a whole bug class): (1) INGESTION-ORDER INVARIANCE - final archive state equivalent for all sigma (catches the deferred-tail/parent-arrival order-dependence class); (2) INCREMENTAL==BULK - trickle-converged archive equivalent to bulk-rebuilt archive on the same corpus (this is hjwr done RIGHT: as a cheap synthetic property, not a live-archive lane - note on hjwr); (3) IDEMPOTENCE - re-ingest is a no-op; (4) APPEND-PREFIX consistency - ingest(full) == ingest(full_prefix)+ingest(append_delta). Use hypothesis.stateful RuleBasedStateMachine for order/interruption exploration (precedent: test_write_path_state_machine.py, test_fts_identity_state_machine.py); crash-injection at stage boundaries as a later extension. Depends on amrpx (corpus source) + t0m73 (predicates).","design":"DESIGN (2026-08-03; the description carries the mechanism — this fixes the file/seam map): SEAM: tests/infra/convergence_harness.py (already adapts production writers/daemon stages, owns no alternate state machine). LOOP: for corpus-program P (from the zoo/composer, yazae; amrpx closed = corpus source available) and ingestion order sigma: build a hermetic archive via PRODUCTION ingest+convergence, then assert the t0m73 registry green (binding (a) of its four). METAMORPHIC PROPERTIES, each its own test module, priority order: (1) ingestion-order invariance (kills the deferred-tail/parent-arrival class); (2) incremental==bulk (hjwr done right, synthetic); (3) idempotence (re-ingest no-op — hash-skip already exists, this proves it end-to-end); (4) append-prefix consistency (full == prefix+delta). MECHANISM: hypothesis.stateful RuleBasedStateMachine for order/interruption exploration (precedents: test_write_path_state_machine.py, test_fts_identity_state_machine.py); crash-injection at stage boundaries is a later extension, not v1. PITFALLS: archive equivalence needs a canonical comparison (session/message/block rows modulo generation-scoped ids and timestamps — define one comparator, reuse across all four properties); keep corpora small (seconds per example) and rely on Hypothesis shrinking; register slow variants behind --lab, not the default testmon loop. Depends on t0m73 (predicates) — start with the registry subset that exists today rather than waiting for full migration.\n","acceptance_criteria":"1. The property loop exists: (corpus-program P, order sigma) -\u003e hermetic archive via production ingest+convergence (tests/infra/convergence_harness.py seam) -\u003e t0m73 registry asserted green; runs in CI on small corpora.\n2. All four metamorphic properties implemented as separate modules sharing ONE canonical archive-equivalence comparator (also used by 0x7nh): order-invariance, incremental==bulk, idempotence, append-prefix consistency.\n3. Hypothesis stateful machine explores orders/interruptions (precedent files cited in design); failures shrink to minimal corpora.\n4. At least one historical bug class is demonstrably caught: re-introducing a known fixed order-dependence bug makes property (1) fail (anti-vacuity).\n5. Slow variants gated behind --lab; default testmon loop stays fast. Verify: devtools test -k convergence_property.","notes":"Promoted P0 2026-08-03, scope extended per operator direction: this is the closest existing bead to 'the test suite generated from schemas IS the integrity checker, run against the real archive when wanted.' Extend explicitly: corpus size can exceed the real archive, generated corpus is never checked into the repo (only the seeding schemas are, as the corpus's deterministic seeds), test invocations can specify which slice/intersection of the corpus to run. Depends on already-closed polylogue-amrpx (generator) and polylogue-t0m73 (registry) -- both landed, this is unblocked.\nSCOPE CORRECTION (operator-prompted verification, 2026-08-04): this bead's premise partially does not hold yet. Read tests/infra/pathology_composer.py (amrpx's actual output): it ships 6 fixed, non-composable pathology functions and ZERO ingestion-order control. rrxe4's own first metamorphic property (ingestion-order invariance over sigma) has no input to vary sigma OVER -- nothing generates multiple orderings of a corpus today. Filed as its own gap: [new bead, see notes]. rrxe4 cannot fully execute as designed until that lands (or rrxe4 absorbs building minimal order-control itself as part of its own scope, which may be the cheaper path -- rrxe4 is the one consumer that needs it, so building it inline here rather than reopening amrpx is worth considering).","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T07:09:11Z","created_by":"Sinity","updated_at":"2026-08-03T22:31:04Z","dependencies":[{"issue_id":"polylogue-rrxe4","depends_on_id":"polylogue-4v2d3","type":"blocks","created_at":"2026-08-06T07:02:25Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-rrxe4","depends_on_id":"polylogue-amrpx","type":"blocks","created_at":"2026-08-03T09:09:12Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-rrxe4","depends_on_id":"polylogue-canonical-snapshot","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-rrxe4","depends_on_id":"polylogue-t0m73","type":"blocks","created_at":"2026-08-03T09:09:12Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-rrxe4","depends_on_id":"polylogue-un60n","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-rrxe4","depends_on_id":"polylogue-yazae","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":6,"dependent_count":3,"comment_count":0} {"_type":"issue","id":"polylogue-xselt","title":"reindex: stamp fingerprints at bootstrap - 818fy rebuild must write parser+lowering semantics fingerprints per session","description":"Split from polylogue-kea7p (its tiny prerequisite, decoupled from the big differential planner). Add two additive index-tier columns (sessions.parser_fingerprint, sessions.lowering_fingerprint) + per-origin fingerprint derivation (origin_specs home), and have the 818fy blue-green rebuild WRITE them for every session. Why P0 and why it gates 818fy: without stamps, the next semantic fix after the reindex forces another FULL rebuild (kea7p soundness analysis: hash-skip alone is unsound; the skip oracle needs fingerprint conjunction). With stamps, every future parser/lowering fix becomes an origin-scoped reparse and the whole 'we must root out ALL bugs before reindexing' pressure collapses to 'fix stamp-poisoners + durable-corrupters before; everything else cheaply after'. Blocked by the stamp-poisoner bugs (7zp4 NFC gaps, gysk3 position-derived identity) - fingerprints computed over buggy identity/hash semantics would bootstrap poisoned stamps. Scope: columns + derivation + rebuild wiring + registry check (every session row carries current-format stamps). NOT in scope: the differential planner/skip logic (stays kea7p).","design":"DESIGN (2026-08-03, grounded against current master: SOURCE=24, INDEX=57):\n\nPREMISE UPDATE: both declared blockers are now closed (7zp4 closed 2026-08-03, was already fixed at index-v46 commit 5e23e6abf; gysk3 closed via PR #3604). The stamp-poisoner gate on this bead is satisfied EXCEPT that fsgdd's K-class list also names 0qfy/uqwd (vintage-volatile comparison axes) as stamp-poisoners; coordinator should confirm whether those two must also gate this bead before stamps bootstrap. Otherwise this bead is ready to implement.\n\nWHAT GETS STAMPED (two additive nullable TEXT columns on index-tier `sessions`, archive_tiers/index.py):\n- sessions.parser_fingerprint: SHA-256 hex over the ORIGIN-SCOPED parser semantics — the normalized source of the parser module set that produced this session's parse. Derivation home is polylogue/sources/origin_specs.py (OriginSpec already carries the prose `semantic_reparse` field per origin; add a `parser_fingerprint()` that hashes the origin's declared parser surface). Mechanism precedent: docs/plans/classifier-fingerprints.json (polylogue-gucv gate) already computes per-function source fingerprints — reuse that function-source-hash machinery, do not invent a second normalizer.\n- sessions.lowering_fingerprint: SHA-256 over the SHARED lowering path semantics (sources/dispatch.py detect_provider/_lower_payload_specs/_parse_lowered_spec + pipeline/ids.py identity/hash functions). One global value per code vintage, same for all origins; a lowering change invalidates everything, a parser change invalidates one origin. This split is exactly what makes kea7p's T0 skip origin-scoped.\n\nNAMING HAZARD: source-tier census tables already have a `parser_fingerprint` column (revision_backfill.py:392 `_resource_blocked_parser_fingerprint`) — that fingerprints the RESOURCE ENVELOPE (max_payload_bytes), not parser semantics. Different concept, different tier. Document the distinction at both sites; do not unify them.\n\nWRITE POINT: write_parsed_session_to_archive (storage/sqlite/archive_tiers/write.py:307) — the single choke point both live incremental ingest and full raw replay/reindex go through, so ordinary ingest and the 818fy rebuild stamp identically for free. Stamps MUST be written in the same transaction as the session row, never backfilled asynchronously — an unstamped-but-indexed session makes kea7p's skip oracle unsound.\n\nSCHEMA MECHANICS: INDEX_SCHEMA_VERSION bump + IndexDeltaDeclaration in storage/sqlite/lifecycle.py. Correct class: SEMANTIC_REPARSE (the column's value is parser-semantics-dependent by definition; only reparse populates it). That routes existing archives to the full rebuild — which is precisely 818fy; land this bump so the one planned rebuild bootstraps the stamps, rather than paying a second rebuild later. `devtools lab policy schema-versioning` enforces the declaration.\n\nSKIP-PREDICATE CONTRACT (kea7p consumes, xselt guarantees): a session is reparse-candidate iff parser_fingerprint != current(origin) OR lowering_fingerprint != current() OR its raw head is unindexed; skippable otherwise. xselt's deliverable is that the conjunction inputs exist and are trustworthy on every row; the planner itself stays in kea7p.\n\nREGISTRY CHECK: add an ArchiveVerificationCheckSpec to ARCHIVE_VERIFICATION_CHECKS (polylogue/maintenance/archive_verification.py) asserting every sessions row carries non-NULL, hex-shaped fingerprints, with per-origin distinct-value counts as evidence (a healthy post-rebuild archive has exactly one parser_fingerprint per origin and one lowering_fingerprint globally). This is the \"registry check\" AC item and lives in both verification planes per 60gzo.\n","acceptance_criteria":"1. Additive nullable columns sessions.parser_fingerprint + sessions.lowering_fingerprint exist in the index-tier DDL (archive_tiers/index.py), with an INDEX_SCHEMA_VERSION bump carrying a declared IndexDeltaDeclaration (SEMANTIC_REPARSE) in storage/sqlite/lifecycle.py; `devtools lab policy schema-versioning` passes.\n2. write_parsed_session_to_archive stamps both columns in the same transaction as the session row, on both ordinary ingest and raw replay — proven by a unit test through the real write path (not a mock), verify: `devtools test -k fingerprint`.\n3. Per-origin derivation lives in origin_specs.py and reuses the classifier-fingerprints function-source-hash mechanism; a unit test proves the derived fingerprint CHANGES when a parser-semantics input changes and is STABLE across process restarts.\n4. After rebuilding a fixture archive, 100% of sessions rows carry both stamps, one distinct parser_fingerprint per origin, one lowering_fingerprint globally — enforced by a new ArchiveVerificationCheckSpec in ARCHIVE_VERIFICATION_CHECKS with a red-twin fixture test.\n5. Explicitly NOT in scope: the differential planner/skip logic (stays polylogue-kea7p); this bead only guarantees the skip oracle's inputs exist and are trustworthy.","notes":"2026-08-03 (reindex-gate-hunt, team-lead): PREMISE CORRECTION. The premise-update claiming \"both declared blockers are now closed (7zp4, gysk3) ... ready to implement\" is FALSE as stated: gysk3 closure fixed only the identity-hash call-site symptom and explicitly deferred the root cause (18 parser call sites baking positional strings into provider_message_id; the \"acks\" registry docs/plans/position-derived-identity-acks.json is a lint-suppression list whose every entry references the closed gysk3, not a tracking bead). New K-class blocker polylogue-slshy (blocks edge added) carries that root cause and MUST land before this bead writes bootstrap stamps — stamps computed over position-derived identity would poison every future differential reparse. Adjudicated K by the 2026-08-03 gate-hunt; ruling and evidence on that bead.\n2026-08-04 prerequisite update: polylogue-slshy landed as PR #3730. Current-master audit finds no position-derived provider_message_id assignments in parser routes, and docs/plans/position-derived-identity-acks.json is empty. The parser identity precondition for bootstrap stamps is satisfied; retain the remaining explicit xselt dependencies.\n2026-08-04 correction: slshy was reopened after an adversarial review found three identity defects in merged PR #3730. Do not implement or merge stamps until the reopened slshy repair is merged and re-verified.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T06:24:45Z","created_by":"Sinity","updated_at":"2026-08-04T06:30:07Z","dependencies":[{"issue_id":"polylogue-xselt","depends_on_id":"polylogue-0qfy","type":"blocks","created_at":"2026-08-03T13:19:29Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-xselt","depends_on_id":"polylogue-7zp4","type":"blocks","created_at":"2026-08-03T08:24:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-xselt","depends_on_id":"polylogue-gysk3","type":"blocks","created_at":"2026-08-03T08:24:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-xselt","depends_on_id":"polylogue-slshy","type":"blocks","created_at":"2026-08-03T14:17:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-xselt","depends_on_id":"polylogue-uqwd","type":"blocks","created_at":"2026-08-03T13:19:29Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":5,"dependent_count":3,"comment_count":0} {"_type":"issue","id":"polylogue-4v2d3","title":"verification: oracle-integrity lint - every tested symbol must be production-reachable (dead-engine test suites certify nothing)","description":"From test-class taxonomy 2026-08-03. Two instances found in one day: test_topology_cycle_rejection.py + parts of test_delegations_view.py pin queries/session_links.py (zero production imports - H4/4ts.10); test_source_laws.py pins parse_drive_payload (zero production callers - M5/194qk). Both suites stay green forever regardless of live behavior. Class design: an import-graph reachability lint - for each test module, the primary tested symbols must be reachable from a production entry point (cli/mcp/daemon/api roots); a test whose entire target set is production-unreachable fails the lint with 'certifies dead code'. Needs a small allowlist for deliberate infra (tests/infra, fixtures). Cheap to approximate: intersect grep-derived test imports with the layering/topology import graph devtools already builds. This is the mechanical form of the anti-vacuity doctrine and directly attacks the 1:1-LoC-coverage paradox.","notes":"2026-08-03: scope explicitly includes the HERMETICITY guard (kmqwm class - tests must not read real user paths like ~/.codex/sessions; enforce via fixture-env guard or lint), same family as reachability: both are 'the test exercises something other than what it claims'.\n2026-08-06 campaign graph promotion: this bead is a direct prerequisite or process guard for proof-carrying reindex acceptance. Its implementation cannot substitute for the terminal receipt, but its output is consumed by the campaign ledger and final gate.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T05:47:34Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:41Z","dependency_count":0,"dependent_count":1,"comment_count":0} -{"_type":"issue","id":"polylogue-csx21","title":"verification: complexity/cost assertions - assert O-shape of work per operation on scaled synthetic corpora (nothing today can catch an O(archive)-per-item regression)","description":"From test-class taxonomy 2026-08-03. H7 (qsagp: archive-wide derived rebuild per component) was invisible to every existing test class: fixture-scale tests cannot see complexity bugs, benchmarks measure wall-clock on fixed inputs (noise-bound), and the 5000x commit-latency finding (7mtf) + 188s holds (de2a) were both discovered live instead. Class design: instrument work units (rows scanned/written via sqlite3 stmt counters or trace hooks, bytes, passes) and assert SHAPE across 2-3 corpus scales (e.g. materializing one new session must touch O(session) derived rows, not O(archive); a bounded pass's work must not scale with backlog size beyond its batch). Runs in CI at small scales (seconds); the assertion is the exponent, not the wall-clock. Candidates: per-component materialization cost (qsagp regression net), census cost per pass, FTS repair cost per drifted session, write-path cost per message. Home: the class-tagged check registry (t0m73) or tests/benchmarks reworked to counter-based assertions.","notes":"2026-08-06 campaign graph promotion: this bead is a direct prerequisite or process guard for proof-carrying reindex acceptance. Its implementation cannot substitute for the terminal receipt, but its output is consumed by the campaign ledger and final gate.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T05:47:33Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:40Z","dependency_count":0,"dependent_count":1,"comment_count":0} +{"_type":"issue","id":"polylogue-csx21","title":"verification: complexity/cost assertions - assert O-shape of work per operation on scaled synthetic corpora (nothing today can catch an O(archive)-per-item regression)","description":"From test-class taxonomy 2026-08-03. H7 (qsagp: archive-wide derived rebuild per component) was invisible to every existing test class: fixture-scale tests cannot see complexity bugs, benchmarks measure wall-clock on fixed inputs (noise-bound), and the 5000x commit-latency finding (7mtf) + 188s holds (de2a) were both discovered live instead. Class design: instrument work units (rows scanned/written via sqlite3 stmt counters or trace hooks, bytes, passes) and assert SHAPE across 2-3 corpus scales (e.g. materializing one new session must touch O(session) derived rows, not O(archive); a bounded pass's work must not scale with backlog size beyond its batch). Runs in CI at small scales (seconds); the assertion is the exponent, not the wall-clock. Candidates: per-component materialization cost (qsagp regression net), census cost per pass, FTS repair cost per drifted session, write-path cost per message. Home: the class-tagged check registry (t0m73) or tests/benchmarks reworked to counter-based assertions.","notes":"2026-08-06 campaign graph promotion: this bead is a direct prerequisite or process guard for proof-carrying reindex acceptance. Its implementation cannot substitute for the terminal receipt, but its output is consumed by the campaign ledger and final gate.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T05:47:33Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:40Z","dependency_count":0,"dependent_count":2,"comment_count":0} {"_type":"issue","id":"polylogue-in24n","title":"verification: source-index-coverage check uses the census's own ledger as its universe - the 7,200-source gap is invisible to it by construction","description":"Found 2026-08-03 while generalizing the invariant suite. maintenance/archive_verification.py:247-312: _check_source_index_coverage computes missing_work = censused_complete - indexed, where censused_complete = raw_membership_census WHERE status='complete' AND member_count\u003e0. Raws the census never blessed (quarantined: 7,191 today; untyped: 9) never enter the universe, so the check reports OK while 25% of logical sources are unindexed. This is the wrong-oracle pattern inside the verification layer itself: the check audits the mechanism against the mechanism's own bookkeeping. Fix: universe = raw_sessions logical heads (ground truth); every unindexed head must be typed (parse_error / open blocker / declared non-session artifact) - i.e. adopt invariant I1 from .agent/scratch/archive-invariants-2026-08-03.py. Registry-wide rule to adopt in the same change (and lint if cheap): a verification check's universe must be a ground-truth table, never a derived ledger of the machinery under audit. Related: t0m73.","notes":"2026-08-06 campaign graph promotion: this bead is a direct prerequisite or process guard for proof-carrying reindex acceptance. Its implementation cannot substitute for the terminal receipt, but its output is consumed by the campaign ledger and final gate.","status":"open","priority":0,"issue_type":"bug","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T05:47:32Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:41Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-t0m73","title":"verification: productize the whole-archive invariant suite (10 checks, 7 failing live) as a lab probe + reindex acceptance gate","description":"From inline audit continuation 2026-08-03. Prototype at .agent/scratch/archive-invariants-2026-08-03.py (repo checkout, gitignored) - 10 read-only ground-truth invariants runnable against any archive root; live run: 7 FAIL / 3 PASS in ~1.5s. Failing today: I1 coverage (7,200 unindexed logical sources: 7,191 quarantined + 9 UNTYPED), I2 enum-superset-CHECK (source tier 5 tables + live index generation sessions table all missing claude-design-session), I3 blob_refs join-liveness (73,427 raw_payload + 1,336 attachment orphans), I4 embeddings refs (4,186 orphaned = feu0's exact number, undrained), I5 session_links lifecycle (status NULL on all 9,497 rows = 4ts.10), I7 FTS drift (messages_fts missing 35,331; threads_fts 10), I8 message_count projection drift (1 session). Passing: I9 revision-head pointers, I10 user-tier refs, I6 (criterion too weak - detail shows 0 daemon stage events in 24h alongside a 7,200-source gap; productized version must fail on gap\u003e0 AND no recent convergence activity, and re-check the 3 known convergence_debt rows my predicate missed). Productize as: devtools lab probe archive-invariants (against live/demo root) + pytest wrappers against corpus_seeded_db; each check documents the bug class and the incident that motivated it. These are checks against ground truth (cross-tier joins, enum-vs-DDL, liveness), NOT mechanism-vs-itself - the class the 1:1-LoC unit suite structurally lacks, which is why the suite is green while the archive is 25% unconverged. This suite green on the post-reindex archive should be part of 818fy's acceptance.","design":"DESIGN (2026-08-03 structured distillation of the rescope + classification notes — read them for evidence):\nTARGET SHAPE (per the operator rescope): do NOT build a bespoke lab probe. ONE class-tagged check registry, seeded from the two existing substrates: ARCHIVE_VERIFICATION_CHECKS (maintenance/archive_verification.py — read-only, any-root, per-check error isolation; I2/I3/I4/I5/I8 already migrated) and the daemon health tiers (daemon/health.py, ~20 checks). Class tags: state-invariant | liveness | freshness | complexity | fidelity | conservation | config.\nFOUR BINDINGS consuming the one registry: (a) pytest parametrized over registry × corpus_seeded_db/zoo fixtures (CI, Plane 1 per 60gzo); (b) promotion/readiness gate subset (818fy's rebuild-index promote step); (c) daemon health-tier scheduling for liveness/freshness classes (Plane 2); (d) operator CLI against any root incl. live.\nTWO CONTRACT RULES baked into the registry: GROUND-TRUTH-UNIVERSE (a check's universe is a ground-truth table, never the audited mechanism's own ledger — the wrong-universe coverage-check bug is filed separately) and RED-TWIN anti-vacuity (every check ships a fixture mutation that must make it fail; red twins run in binding (a)).\nWAIVERS: known-red-on-live carries a bead id and expires when that bead closes; red-without-waiver is the alarm.\nMIGRATION WORK REMAINING: lift the 5 not-yet-migrated prototype invariants (I1 coverage with the corrected third bucket byte_dup_of_indexed so the report can't overstate; I6 with the fixed criterion gap\u003e0 AND no recent convergence activity =\u003e fail, re-checking convergence_debt rows; I7 FTS drift; I9/I10 as cheap passes) from .agent/scratch/archive-invariants-2026-08-03.py into the registry, each documenting its bug class + motivating incident; graduate the second-wave detectors (V2 capability-parity, V4 active-leaf, V1b vocabulary-honesty — all red live) per the wwph1 graduation rule.\nDEV LOOP: the canary reindex loop (partial --no-promote rebuild + registry against the canary, minutes) is the iteration mechanism; the full-registry green on the post-reindex archive is 818fy acceptance. Red-check-first workflow rule is ey4ro's contract — this bead provides the instruments.\n","acceptance_criteria":"1. One class-tagged registry exists (seeded from ARCHIVE_VERIFICATION_CHECKS + health-tier checks) with the GROUND-TRUTH-UNIVERSE and RED-TWIN contract rules enforced structurally (a check without a red twin fails a meta-test).\n2. All 10 prototype invariants migrated (I1 with byte_dup_of_indexed third bucket; I6 with gap\u003e0 AND no-recent-convergence criterion), each documenting bug class + motivating incident.\n3. Four bindings live: pytest (registry x fixtures + red twins), promotion-gate subset wired into rebuild-index promote, daemon health scheduling for liveness/freshness classes, operator CLI against any root.\n4. Waiver mechanism: known-red-on-live rows carry a bead id and expire on close; red-without-waiver alarms.\n5. Registry green on the post-reindex archive is wired into 818fy acceptance (runbook step 5/6). Verify: devtools test -k archive_verification; devtools test -k registry.","notes":"2026-08-03 RESCOPE after substrate investigation (operator: 'not a bespoke probe - a probe against the archive where invariants are one kind of many'): do NOT build a new lab probe. The substrate exists twice already: (1) ARCHIVE_VERIFICATION_CHECKS (maintenance/archive_verification.py:612) - read-only, any-root, per-check error isolation, 7 checks, but run routinely by NOTHING (CLI manual, promotion gate runs only fts-parity subset, backup verify) and its coverage check has a wrong-universe bug (separate bead filed); (2) daemon health tiers (daemon/health.py, ~20 checks incl. convergence-debt/cursor-lag/insight-freshness) - the scheduled liveness/freshness home, currently dark past FAST (y0ven). Target shape: ONE class-tagged check registry (state-invariant | liveness | freshness | complexity | fidelity | conservation | config), four bindings consuming it: (a) pytest parametrized over registry x corpus_seeded_db fixtures (regular tests, CI); (b) promotion/readiness gate subset; (c) daemon health-tier scheduling (liveness classes); (d) operator CLI against any root incl. live. Two contract rules baked into the registry: GROUND-TRUTH-UNIVERSE (a check's universe is a ground-truth table, never the audited mechanism's ledger) and RED-TWIN anti-vacuity (every check ships a fixture mutation that must make it fail; the red twin runs in the pytest binding). Plus a waiver mechanism for known-red-on-live: waiver carries a bead id, expires when the bead closes; red-without-waiver is the alarm. Migrate the 10 prototype invariants into this registry; I6's criterion must become gap\u003e0 AND no recent convergence activity =\u003e fail.\n2026-08-03 BACKLOG CLASSIFICATION (operator: 'are all bugs instances of a detectable class? classify the ~50, build the tests, get them red'). All 62 open 818fy-gating beads classified by detector family: ~48 map to one of EIGHT families - D1 state-invariants (14: 052vs, 4ts.10, 2tfug, i3zo, es7b, omsw, gxig, hjpx-symptoms, lkrc-symptoms, 5tkbt...), D2 liveness/freshness (6: 2qrx, ix5r, 5xxmc, tu1f, 5iz4-aging, hjpx-debt), D3 complexity-shape (3: qsagp, 5q2u, lyv4), D4 test-integrity/hermeticity (2: kmqwm, h7y0j-adjacent), D5 fidelity-differentials (8: c831, 6lyh1, 7zp4, gysk3, hjwr, uqwd, 0qfy, b5l.1), D6 capability-parity (6: ksgg, xofj, mvcbi, tu1f, 0qfy, 8ac0-coverage), D7 vocabulary-honesty (6: 6krh, cc4k, z22ml, h57ic, iuyr, vp2ky), D8 runtime/config-coherence (5: 9kc0, e98k, 9qnzy, swqu, f47j). ~14 are NOT detector-shaped: operational tasks (a7gmk, tnqqt, k8wv, lb39z, f1vg) and design decisions (cijx.2, ds4b4, w6hql, tw4ar, aex0, sp72, foee, ih67, 2qx.3, 6bebe) - honest limit of the approach. SECOND-WAVE RESULTS (built + ran today, .agent/scratch script extended inline): V2 capability-parity RED (codex 0% parent links of 2.47M msgs; hermes, aistudio 0%), V4 active-leaf RED (103 multi-leaf sessions), V1b vocab RED (deferrals as 'failed'), V5/V1a/V6 PASS and thereby flag gxig/cc4k/9kc0 as possibly-stale beads (detectors audit the backlog itself, both directions), V7 probe: 6lyh1 latent (0 of 4,344 APPEND raws divergent - un-gated from 818fy), V3: xofj needs parse-boundary conservation (silent drops invisible index-side). Cumulative scorecard: 18 detectors built today, 10 red, 3 bead-refuting passes, 2 scope-refining probes. WORKFLOW ADOPTION: red-check-first for bug-class gating beads - a fix PR must flip a named registry check red-\u003egreen, check predates fix. ITERATION SPEED (operator concern - 'verification relies on actually reindexing'): add a CANARY REINDEX loop - partial selection rebuild into an inactive --no-promote generation (machinery exists) of a few hundred representative sessions per origin, run the registry against the canary in minutes, iterate red-\u003egreen, full reindex once at the end. The gate is the backstop; the canary is the dev loop.\n2026-08-03 ~10:15 CORRECTION to invariant I1's framing: the prototype's 7,200/quarantined/9-untyped split is missing a THIRD bucket the operator's challenge surfaced - byte-identical-duplicate-of-already-indexed (measured: 4,305 of 7,200 heads, 77% of bytes). I1 as designed would still correctly flag the true ~2,895-head novel gap as ERROR, but its evidence/summary text should report the duplicate-vs-novel split, not present the raw unindexed count as if it were all 'missing'. When productizing into the registry: add a byte_dup_of_indexed classification (same blob_hash exists on an indexed raw) alongside untyped/quarantined so the check's own report can't repeat this overstatement.\n2026-08-06 audit reopens the acceptance claim. The implementation is useful, but the registry is not yet the sole self-describing source for red twins, waivers, acceptance selection, daemon scheduling, incident provenance, candidate applicability, or live receipts. Close only after registry-v2 and the campaign ledger consume one structured contract.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T05:35:27Z","created_by":"Sinity","updated_at":"2026-08-06T04:58:17Z","dependencies":[{"issue_id":"polylogue-t0m73","depends_on_id":"polylogue-in24n","type":"blocks","created_at":"2026-08-06T07:02:25Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-t0m73","depends_on_id":"polylogue-reindex-registry-two-plane-subset","type":"blocks","created_at":"2026-08-06T07:02:25Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":2,"dependent_count":4,"comment_count":0} {"_type":"issue","id":"polylogue-fyyro","title":"storage: embeddings tier has no retired-generation GC - 555MB+ .retired files unowned; plus dead archive_tiers/self_verify.py","description":"Structural audit M8 (/realm/data/derived/reports/polylogue-structural-audit-2026-08-03.html). /realm/db/polylogue/embeddings.db.retired-20260627 (555MB) + embeddings.db.v2-retired-20260718-{shm,wal} referenced by zero code (repo-wide grep). Index tier has generation GC; embeddings has none. Also archive_tiers/self_verify.py:11-105 (build_archive_session_self_verify_envelope) has one caller: its own test; the real self-verify lives in devtools/self_verify.py. Reclaim files, add embeddings-generation retirement ownership, delete or fold the dead module.","notes":"2026-08-06 audit reopens the claim because the close reason says only the code half landed. Retired embeddings-generation retention and garbage collection must be automatic and receipt-backed before blue-green promotion. The embeddings-retention bead carries the residual implementation and proof scope.","status":"open","priority":0,"issue_type":"chore","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T05:08:07Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:40Z","dependency_count":0,"dependent_count":0,"comment_count":0} @@ -49,7 +50,7 @@ {"_type":"issue","id":"polylogue-a7gmk","title":"Final pre-reindex sinnix deploy sync: package + durable migrations, immediately before running rebuild-index","description":"The last step before the production reindex itself (polylogue-818fy). Resolves\npolylogue-9qnzy's schema-currency gap for the FINAL merged state (9qnzy's own\nfix addresses the gap as of when it's worked; every PR that merges afterward\n(lb39z remainder, w6hql, ds4b4, schema-commit, etc.) re-drifts the deployed\npackage from origin/master, so this bead is the final sync immediately before\ntriggering the reindex, not a duplicate of 9qnzy).\n\nAC:\n1. `git fetch --all` in sinnix; confirm the polylogue flake input / package\n pin points at the latest merged origin/master commit.\n2. Apply any durable-tier migrations to /realm/db/polylogue's source.db/user.db\n that the target package version requires, under a verified backup manifest\n (`polylogue backup --profile full_evidence --verify` first, per the durable-\n tier migration policy in CLAUDE.md).\n3. `nix develop --command switch` (or `boot` + reboot) in sinnix to deploy the\n matching package.\n4. Confirm the deployed package's declared SOURCE_SCHEMA_VERSION matches the\n live source.db `PRAGMA user_version` and `journalctl --user -u polylogued`\n shows no source/user-tier schema CRITICAL alerts. INDEX_SCHEMA_VERSION is\n EXPECTED to still exceed the live index.db version at this point: that\n residual mismatch is exactly what polylogue-818fy resolves, so neither the\n mismatch nor its health alert is a blocker for triggering the reindex\n (CodeRabbit PR #3597 review caught the original circular phrasing).\n5. Run `devtools verify --all` on the final merged master as a due-diligence\n check before triggering the reindex.\n\nRef polylogue-9qnzy. Part of the pre-reindex readiness chain (polylogue-818fy).","design":"DESIGN + SCOPE CLARIFICATION (2026-08-03):\n\nWHAT THIS BEAD ACTUALLY IS: ~1 hour of mechanical ops (the 5 AC steps in the description). It carries 44 blocker edges not because it consumes those beads' outputs but as an ORDERING constraint: it must run last so the deployed package contains every pre-reindex code change. The two kinds of edge should not be conflated when reading `bd blocked`:\n- REAL input dependencies: beads whose deliverable lands IN the shipped package or the durable schema (code fixes, migrations, committed schema packages e.g. tnqqt). These genuinely gate the deploy.\n- ORDERING-ONLY edges: pure-ops/audit/doctrine beads (e.g. f1vg audit runs, verification-instrument and design beads) that don't change what `nix build` produces. If the coordinator ever wants a truthful critical path, these can be re-pointed at 818fy itself rather than at this bead — but per the fsgdd operator correction (all known gates get fixed regardless), re-wiring is optional bookkeeping, not required work. Precedent: a7gmk was already un-gated from mkk0 on exactly this reasoning (commit 60c1c016f, \"wrong mechanism\").\n\nRUNBOOK (concrete commands; steps 2-3 have live precedent from the 9qnzy migration run this morning):\n1. Merge freeze; `git fetch --all`; record target commit sha on origin/master.\n2. `polylogue backup --profile full_evidence --verify` → fresh manifest (durable-tier policy; do NOT reuse a stale manifest across intervening writes).\n3. `polylogue ops maintenance migrate-tier source --backup-manifest \u003cmanifest\u003e` (exact surface the operator used for 15→20 on 2026-08-03); repeat for user tier only if USER_SCHEMA_VERSION moved (currently v10 = current). Confirm `PRAGMA user_version` == the target commit's SOURCE_SCHEMA_VERSION and `PRAGMA integrity_check` ok.\n4. sinnix: bump the polylogue flake input to the target sha; `cd /realm/project/sinnix \u0026\u0026 nix develop --command switch`; restart/verify polylogued.\n5. Post-deploy check (AC4): deployed package constants match live durable tiers; `polylogue status` flags only the index tier; index mismatch + its health alert are EXPECTED here (818fy resolves them — per the CodeRabbit-corrected phrasing in the description).\n6. `devtools verify --all` on the target commit (~3 min per project memory, not \u003e1h).\n7. Hand off to 818fy: trigger `polylogue ops maintenance rebuild-index` (NOT `ops reset --index`, which refuses on an active generation).\n\nRELATION TO 9qnzy: 9qnzy = get out of the current CRITICAL state now (its durable-migration half is already done; its deploy half may be executed early). This bead = the FINAL re-sync immediately before the reindex trigger; every post-9qnzy merge re-drifts the package, which is why this exists separately. If the interval between 9qnzy's deploy and the reindex is short, this bead degenerates to re-running steps 1-6 — cheap by design.\n","acceptance_criteria":"The description's AC 1-5 remain authoritative. Additions from the 2026-08-03 scoping pass:\n6. The bead's own execution is the 7-step runbook in the design (fetch/freeze, fresh verified backup, migrate-tier to the target commit's SOURCE_SCHEMA_VERSION, sinnix flake-input bump + switch, post-deploy status check, devtools verify --all, hand off to 818fy's rebuild-index trigger) — roughly one hour of mechanical ops, no code changes under this bead id.\n7. Blocker hygiene: before execution, confirm remaining blocker edges are real input dependencies (code/migrations/committed packages that must be in the shipped build) — ordering-only edges from pure-ops/audit/doctrine beads may be re-pointed at 818fy instead, each removal with a one-line evidence note (precedent: mkk0 un-gate, commit 60c1c016f). Optional per the fsgdd operator correction.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T01:22:37Z","created_by":"Sinity","updated_at":"2026-08-03T10:47:56Z","dependencies":[{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-052vs","type":"blocks","created_at":"2026-08-03T07:31:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-1xc.8","type":"blocks","created_at":"2026-08-03T05:35:48Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-2qx.3","type":"blocks","created_at":"2026-08-03T03:26:14Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-2tfug","type":"blocks","created_at":"2026-08-03T05:35:47Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-5q2u","type":"blocks","created_at":"2026-08-03T05:35:47Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-6bebe","type":"blocks","created_at":"2026-08-03T05:35:48Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-6krh","type":"blocks","created_at":"2026-08-03T04:02:34Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-8ac0","type":"blocks","created_at":"2026-08-03T03:26:17Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-9kc0","type":"blocks","created_at":"2026-08-03T04:02:33Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-9qnzy","type":"blocks","created_at":"2026-08-03T03:26:11Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-aex0","type":"blocks","created_at":"2026-08-03T04:02:33Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-b5l.1","type":"blocks","created_at":"2026-08-03T04:04:37Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-c831","type":"blocks","created_at":"2026-08-03T03:26:17Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-cc4k","type":"blocks","created_at":"2026-08-03T05:39:44Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-cijx.2","type":"blocks","created_at":"2026-08-03T04:02:33Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-ds4b4","type":"blocks","created_at":"2026-08-03T03:26:15Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-e98k","type":"blocks","created_at":"2026-08-03T03:26:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-es7b","type":"blocks","created_at":"2026-08-03T05:39:44Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-f1vg","type":"blocks","created_at":"2026-08-03T03:26:13Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-f47j","type":"blocks","created_at":"2026-08-03T05:35:44Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-gxig","type":"blocks","created_at":"2026-08-03T05:35:45Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-gysk3","type":"blocks","created_at":"2026-08-03T03:26:16Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-h57ic","type":"blocks","created_at":"2026-08-03T05:47:16Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-h7y0j","type":"blocks","created_at":"2026-08-03T03:26:17Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-hjwr","type":"blocks","created_at":"2026-08-03T05:35:46Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-i3zo","type":"blocks","created_at":"2026-08-03T05:35:46Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-iuyr","type":"blocks","created_at":"2026-08-03T05:39:43Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-k8wv","type":"blocks","created_at":"2026-08-03T03:26:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-kmqwm","type":"blocks","created_at":"2026-08-03T05:35:45Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-ksgg","type":"blocks","created_at":"2026-08-03T03:26:16Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-lb39z","type":"blocks","created_at":"2026-08-03T03:26:11Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-lkrc","type":"blocks","created_at":"2026-08-03T03:26:12Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-lyv4","type":"blocks","created_at":"2026-08-03T05:39:43Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-qhk8z","type":"blocks","created_at":"2026-08-03T03:26:16Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-swqu","type":"blocks","created_at":"2026-08-03T03:26:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-tnqqt","type":"blocks","created_at":"2026-08-03T03:26:14Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-tu1f","type":"blocks","created_at":"2026-08-03T05:35:45Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-tw4ar","type":"blocks","created_at":"2026-08-03T03:26:15Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-vp2ky","type":"blocks","created_at":"2026-08-03T05:39:44Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-w6hql","type":"blocks","created_at":"2026-08-03T03:26:15Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-yla8","type":"blocks","created_at":"2026-08-03T03:26:13Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-z22ml","type":"blocks","created_at":"2026-08-03T05:35:47Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-a7gmk","depends_on_id":"polylogue-zoek0","type":"blocks","created_at":"2026-08-03T05:47:05Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":43,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-tnqqt","title":"Run real schema-inference commit for all 9 providers on the pristine blobstore, review for sensitive content, commit","description":"Once polylogue-2qx.3 wires the real persist path, run schema inference for real\n(not the currently-broken generate --full-corpus, which silently no-ops because\ngenerate_provider_schema() never calls persist_generated_provider_bundle()).\n\nAC:\n1. Run devtools lab schema commit (or whatever surface 2qx.3 wires the persist\n path onto) for all 9 origins (claude-code-session, claude-ai-export,\n chatgpt-export, codex-session, gemini-cli-session, hermes-session,\n antigravity-session, aistudio-drive, grok-export), against the pristine\n post-raw-authority-cleanup blobstore (i.e. after lb39z/hjpx/lkrc/yla8 land),\n not the currently-stale committed schema packages.\n2. Diff the newly generated schema packages against the previously committed\n ones -- confirm the diff is non-empty and structurally sane (this session's\n own audit found every prior \"zero diff\" was a false negative caused by the\n 2qx.3 wiring gap, so a genuine non-trivial diff here is itself a sanity\n check that the fix worked).\n3. Review every one of the 9 generated schema packages for sensitive or\n embarrassing content before committing -- polylogue is a PUBLIC GitHub repo.\n One package was spot-checked this session (gzip'd JSON Schema: only\n $defs/type/title/anyOf/default fields, no embedded real content values),\n which de-risks but does not clear the other 8; check specifically for any\n example/sample/representative_paths-style fields that might carry real\n conversation excerpts.\n4. Commit the reviewed schema packages via a normal PR.\n\nRef polylogue-2qx.3, part of the pre-reindex readiness chain (polylogue-818fy).","design":"DESIGN (2026-08-03; builds on notes — pristine-blobstore ruling + 10:15 correction still stand, read them first):\n\nWHAT \"COMMIT\" CONCRETELY MEANS (the 2qx.3 gap is closed — this is now real): `devtools lab schema commit` → polylogue/schemas/operator/commit.py:commit_provider_schema(SchemaCommitRequest). It wraps generate_all_schemas (schemas/generation/workflow.py) — the ONLY path that calls persist_generated_provider_bundle — and writes polylogue/schemas/providers/\u003cprovider\u003e/versions/... through SchemaRegistry.replace_provider_packages, which enforces monotonic-merge protection. It emits a before/after report per version: new | changed | unchanged, plus lost/narrowed leaf-type detection via polylogue/schemas/type_narrowing (added_paths/narrowed_paths). Distinct from promote_schema_cluster (single-cluster promotion) — do not use that surface for this run.\n\nPER-PROVIDER EXECUTION: one commit invocation per origin, all 9 (claude-code-session, claude-ai-export, chatgpt-export, codex-session, gemini-cli-session, hermes-session, antigravity-session, aistudio-drive, grok-export). Provider packages are independent directory trees, so runs are isolated by construction.\n\nFAILURE HANDLING (one provider failing must not sink the batch):\n- A generation/commit ERROR for provider X: record it, continue with the other 8, file a follow-up bead for X. The PR ships the successful subset; the AC matrix marks X deferred, not silently absent.\n- A NARROWING report for provider X (lost/narrowed leaf types vs committed packages): STOP for that provider — narrowing means either a sampling-frame regression or genuinely retired wire shapes; needs operator review before commit, per replace_provider_packages' own monotonicity contract. Never override the monotonic-merge protection to force a commit.\n- A ZERO-DIFF result for any provider is itself suspect (description item 2: every prior zero-diff was the 2qx.3 wiring gap) — treat as a failure to investigate, not a pass.\n\nSENSITIVE-CONTENT REVIEW PROTOCOL (repo is PUBLIC; description item 3): for each of the 9 generated bundles, before `git add`: decompress and grep the JSON Schema for value-bearing keys (examples, default, const, enum, representative_paths, sample) and eyeball any hits — structural keys ($defs/type/title/anyOf) are fine. One package was spot-checked clean earlier; the other 8 are unreviewed. Privacy config: privacy_config_from_payload (schemas/operator/inference.py) is already threaded through the commit path — confirm its redaction settings are active for the run.\n\nSAMPLING FRAME: use the logical-heads-only sampling mode (registry-phase1 lane, per notes) so superseded revisions don't skew value distributions; blob_hash dedup in sampling_db.py already skips byte-identical re-acquisitions. Precondition remains r9xsj's gate (pristine blobstore) plus omsw/3m3de/8ac0 for misclassified-raw contamination — scale of contamination was corrected DOWN in the 10:15 note; the misclassification concern is unchanged.\n\nDELIVERABLE: one PR with the 9 (or N\u003c9 + deferrals) reviewed schema packages + the per-provider commit report table (new/changed/unchanged/narrowed counts) in the PR body.\n","acceptance_criteria":"Sharpens the description's AC 1-4 (which remain authoritative) with per-provider failure semantics:\n1. `devtools lab schema commit` (commit_provider_schema path — the real persisting entry point, 2qx.3 closed) run per origin for all 9, against the post-cleanup blobstore (r9xsj gate PASS receipt in hand), logical-heads-only sampling mode active.\n2. Per-provider isolation: one provider's generation/commit error defers that provider (follow-up bead filed, AC matrix marks it deferred) without blocking the other 8; a NARROWING report for any provider halts that provider's commit pending operator review — the monotonic-merge protection is never overridden.\n3. Every provider's diff vs committed packages is non-empty and structurally sane; any zero-diff is investigated as a failure, not accepted as a pass.\n4. All committed bundles pass the sensitive-content review protocol (grep decompressed schemas for examples/default/const/enum/representative-style value-bearing fields; repo is PUBLIC) with the review noted per package in the PR body.\n5. One PR ships the reviewed packages + a per-provider commit report table (new/changed/unchanged/narrowed counts).","notes":"Footprint: polylogue/schemas/operator/commit.py, polylogue/schemas/generation/workflow.py (real persist path from polylogue-2qx.3), generated provider bundles under polylogue/schemas/providers/.\n2026-08-03 OPERATOR RULING: a pristine blobstore is a HARD prerequisite for the inference run - the sampling frame reads every raw_sessions row (70+ GB) and the current corpus is contamination- and duplication-heavy, so the inferred distribution would be out-of-distribution garbage. Prerequisite set now wired as blockers: omsw + 3m3de + mvcbi (misclassified-raw admission, fix lanes dispatched 2026-08-03), 8ac0, plus the raw-authority drain program (lkrc/lb39z) for the quarantine mass and supersession/retention release. Additionally a logical-heads-only sampling mode is being added (registry-phase1 lane) so value-distribution synthesis can ignore superseded revisions even before full corpus cleanup. Note: byte-identical dupes are already skipped by the sampler's blob-hash dedup (13-38% per origin); the remaining skew is near-dup revision chains + misclassified raws.\n2026-08-03 ~10:15 CORRECTION to the earlier pristine-blobstore ruling on this bead: the '70+ GB out-of-distribution contamination' framing overstated the quarantine mass by ~4x (see corrected lkrc note - true never-indexed content is ~5.3 GiB, not ~30 GiB; 77% of the apparent gap is byte-identical re-acquisitions the sampler's own blob_hash dedup already skips, per sampling_db.py:279-305 - so THAT specific contamination risk was already smaller than stated). Genuine remaining prerequisites for real schema inference, unchanged: omsw/mvcbi/3m3de (misclassified raws still contaminate regardless of scale) + 8ac0. Do NOT frame future work here as 'ingest/reconcile 7,200 sources' - the correct target is the ~2,895-head / ~5.3 GiB genuinely-novel slice plus formal dedup-supersession of the duplicate mass (tracked on lkrc).","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T01:22:19Z","created_by":"Sinity","updated_at":"2026-08-03T10:47:56Z","dependencies":[{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-2qx.3","type":"blocks","created_at":"2026-08-03T03:26:09Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-3m3de","type":"blocks","created_at":"2026-08-03T08:57:03Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-4987i","type":"blocks","created_at":"2026-08-03T16:43:25Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-8ac0","type":"blocks","created_at":"2026-08-03T08:57:03Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-f47j","type":"blocks","created_at":"2026-08-03T05:35:50Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-iuyr","type":"blocks","created_at":"2026-08-03T05:39:54Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-kmqwm","type":"blocks","created_at":"2026-08-03T05:35:50Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-mvcbi","type":"blocks","created_at":"2026-08-03T08:57:03Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-o8c3m","type":"blocks","created_at":"2026-08-03T16:19:56Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-omsw","type":"blocks","created_at":"2026-08-03T08:57:03Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-r9xsj","type":"blocks","created_at":"2026-08-03T10:23:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tnqqt","depends_on_id":"polylogue-tu1f","type":"blocks","created_at":"2026-08-03T05:35:50Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":12,"dependent_count":2,"comment_count":0} {"_type":"issue","id":"polylogue-818fy","title":"Run the production reindex (polylogue ops reset --index / rebuild-index \u0026\u0026 polylogued run)","description":"The actual production reindex operation against the live archive (/realm/db/polylogue), the culmination of this session's whole raw-authority/schema-inference/blobstore-cleanup readiness effort.\n\nCorrect command per this session's own audits (NOT the originally-planned 'polylogue ops reset --index'): the live archive is a managed active generation (.index-active-pointer present), so `reset --index` will hard-refuse. Use `polylogue ops maintenance rebuild-index` instead, then `polylogued run`.\n\nOperator directive 2026-08-03: polylogue-f1vg (corpus acceptance gate) explicitly BLOCKS this bead -- do not run the reindex until f1vg passes clean (or every remaining absence/fidelity gap it reports is explicitly accepted by the operator as known/tracked).\n\nAlso gated on the P0 raw-authority cluster (9qnzy schema-currency gap, lb39z/hjpx/lkrc/yla8 raw-authority convergence, 2qx.3 schema-inference persist-path fix) resolving first, per this session's own pre-reindex audit wave.","design":"DESIGN — THE RUNBOOK (2026-08-03; command per the mechanism note: blue/green rebuild-index, NOT ops reset --index which hard-refuses on the active generation):\n\nGATE CLOSURE: transitive blocker closure grew 80 -\u003e 81 today (polylogue-2qx, the OriginSpec epic, confirmed a real gate). Direct-blocker forcing-class map lives on fsgdd (K/S/O/V/P/D); the ordering rule that matters here: K-class stamp-poisoners land before xselt writes stamps; S-class durable-tier fixes land before or with the run.\n\nSEQUENCE:\n1. PRE-FLIGHT GATES (all must hold): r9xsj gate receipt PASS (zero quarantine / zero open blockers / fidelity census — its AC lists the exact queries); f1vg corpus acceptance PASS or every residual operator-accepted in writing (hard blocker per operator directive); tnqqt schema packages committed; xselt stamp columns landed so the rebuild bootstraps fingerprints (this is what makes 818fy the LAST full rebuild — kea7p takes over after); t0m73 registry productized enough to serve as the post-rebuild acceptance instrument; 0x7nh canary differ available.\n2. DEPLOY SYNC: a7gmk runbook (fresh verified backup -\u003e migrate-tier source to the target commit's SOURCE_SCHEMA_VERSION -\u003e sinnix flake bump + switch -\u003e only index-tier mismatch remains -\u003e devtools verify --all green).\n3. CANARY (0x7nh): rebuild N sessions per origin with --no-promote; run the changelog differ old-vs-new; operator reviews the diff before full run.\n4. FULL REBUILD: `polylogue ops maintenance rebuild-index` (daemon-owned writer, blue/green: builds a fresh generation beside the active one; bounded passes via raw_batch_size/pass_byte_budget_mb/pass_deadline_seconds flags in cli/commands/maintenance/_rebuild_index.py). Monitor via daemon health + pass receipts; e98k (mmap-vs-cgroup) must be resolved or explicitly waived first (OOM risk for the rebuild process itself).\n5. PROMOTION GATE: before flipping .index-active-pointer, run the archive-verification registry (ARCHIVE_VERIFICATION_CHECKS) + xselt's stamp-coverage check against the CANDIDATE generation; refuse promotion on failure.\n6. POST-RUN: `polylogued run` resumes convergence (embeddings catch-up, insights); qsagp/5xxmc post-reindex catch-up viability already closed. Re-run f1vg audit + r9xsj receipt against the new generation; expected deltas: b508 phantom sidecars gone (~4,945 claude-code rows drop), gt1z sessions.reported_cost_usd populated (v49 delta), msia purge+reingest reflected, hermes staleness (76 sessions) resolved.\n7. RECEIPTS: record before/after tier versions, session/message counts per origin, duration, and the promotion-gate registry receipt on this bead.\n\nROLLBACK: blue/green means the old generation stays until promotion; abort = do not flip the pointer. After promotion, rollback = re-point at the retained old generation before GC reclaims it (confirm retention window before starting).\n","acceptance_criteria":"1. Every pre-flight gate holds with receipts: r9xsj PASS receipt, f1vg PASS or operator-accepted residuals in writing, tnqqt packages committed, xselt stamp columns landed, a7gmk deploy-sync complete (only index-tier mismatch remains), e98k resolved or waived.\n2. Canary first: 0x7nh differ run over N-per-origin --no-promote rebuild, diff reviewed by operator before the full run.\n3. Full rebuild executes via `polylogue ops maintenance rebuild-index` (never ops reset --index); promotion happens only after the archive-verification registry + stamp-coverage check pass against the candidate generation.\n4. Post-run: live index.db PRAGMA user_version == current INDEX_SCHEMA_VERSION (57+); daemon health shows no schema CRITICAL on any tier; f1vg + r9xsj re-run PASS against the new generation.\n5. Expected-delta checks recorded on this bead: b508 phantom count -\u003e 0, gt1z reported_cost_usd populated, msia origin shape real, hermes 76-session staleness gone, 100% sessions carry fingerprint stamps (one parser_fingerprint per origin), v50 thinking/reasoning recovery verified per polylogue-m73wk (per-origin sum(thinking_count) \u003e 0 for claude-code/codex populations known to carry it), material_origin human_authored counts per origin \u003e= pre-rebuild counts (no gzgyl-class regression), the 41 s8s54 raws rebuild as chatgpt-export identity.\n6. Before/after receipts (tier versions, per-origin session/message counts, duration, promotion-gate output) recorded here; closure blocker count at run time noted (81 as of 2026-08-03 morning; +3 gate-hunt additions slshy/gzgyl/s8s54 same day).","notes":"2026-08-03 mechanism note (Fable, operator question 'why wipe the index?'): the upsert primitive already exists (ingest hash-skip, _core.py:671) and polylogue-kea7p designs the differential reindex (fingerprint/hash/backfill tiers, in-place by default, blue-green as measured escalation). For THIS reindex, blue-green remains the right call: past sessions carry no semantics fingerprints, and 9 of the 11 pending deltas (v46-56) are SEMANTIC_REPARSE without clone-safe DDL declarations, so there is no in-place DDL path. Run 818fy as planned; kea7p makes it the last full rebuild.\n2026-08-03 reindex-gate-hunt closeout (team-lead): the unknown-hunting campaign fsgdd/wwph1 anticipated ran today (4 lens-hunters + adjudicator + Fable lead; full report /realm/data/derived/reports/reindex-gate-hunt-2026-08-03.html). Net additions to this runbook: 3 new direct blockers — polylogue-slshy (K: positional provider_message_id root cause, also blocks xselt), polylogue-gzgyl (P-regression: PR #2502 material_origin, ~22.4K rows), polylogue-s8s54 (S: mvq8 AC2 retroactive origin repair, actuator exists). AC #5 amended with three new expected-delta checks (thinking-count via m73wk, human_authored non-regression, s8s54 identity). Batch-riders (no edge, land in the same semantic window): iltbx (hash-payload widening — efficiency-critical: lowering_fingerprint covers ids.py, landing later costs a dedicated full differential reparse), 22ldr (gemini outcome mapping), 58jjk (codex goals/memories wiring, targeted-reprocess shape). Sequencing question closed: attachment blob backfill (pfdf/ck5v/5gjre) is order-independent w.r.t. this run (pfdf actuator = targeted idempotent UPDATE keyed by attachment content-identity, generation-agnostic; adjudicated task #2). Named-absence evidence for the f1vg pass appended to f1vg directly (6 aistudio-drive raws).\nPRE-REINDEX BASELINE FROZEN 2026-08-03: .agent/scratch/reindex-baseline-2026-08-03.md (invariant suite 7F/3P with counts; per-origin raw census; blob accounting; provenance classes; ground-truth denominators; session_events sizing). Phase F diffs against THIS. Two blockers found during the census: mhx95 (daemon frozen since 07-31 — P0) and 0v4tn (blob_refs GC oracle broken).\nReindex-gate audit (2026-08-03, fork of ~90 open design/architecture beads read individually, not by title): the 7 blocked-by edges just added above are the ones that would force redoing this reindex if decided/landed AFTER it runs, because they change content_hash-relevant computation (session_events/title are direct hash inputs) or the session-composition/identity semantics the hash is computed over:\n\n- a7xr.25: session_events double-stores tool-call/reasoning content already in blocks (7.4M rows) -- decision direction is to stop storing redundant events or derive them; either way changes session_events, a direct content_hash component.\n- 6e7m: title derivation has 78-way prompt-echo collisions -- title is in the content_hash payload; any resolution-logic change shifts hashes.\n- 4ts: session lineage truth (shared-prefix composition across fork/resume/subagent/compaction) -- literally decides what content a materialized session contains; 26.5% of human/assistant blocks still cross-session-duplicated per its own re-measurement this session.\n- nas1: resume topology vs. context-assisted continuation -- touches the same session_links write path as 4ts, grouped as one lineage-gating cluster.\n- 2qx: OriginSpec (source admission/material_origin/authorship rules) -- own description cites live classification correctness gaps in material_origin, a message-hash input.\n- qj5x: decision to remove Origin.BEADS_ISSUE -- ~924 beads-issue-projected sessions would need reparsing if decided after; narrower blast radius than the others, could be a targeted follow-up rather than blocking, but should be decided before or shortly after 818fy, not indefinitely deferred.\n- a7xr.23: content-defined chunking vs durable cursors for append/prefix ingest -- upstream of parsing, decides what raw bytes get admitted/chunked.\n\nLower-confidence, NOT wired as blocking (flagged for a closer look, not confident enough to gate): a7xr.24 (ColumnSpec/DDL/mapper reconciliation -- one field, stop_reason/is_active_leaf, is restated in 5 places; if those currently disagree and get reconciled, stored values could shift), 83u (attachment/blob integrity -- depends on whether the fix changes attachment metadata recorded at parse time vs. only backfilling storage post-hoc).\n\nExplicitly NOT gating (operationally relevant to running the reindex smoothly, but doesn't change output): 5vft (rebuild-index --only-missing/reset --index operational bugs -- check before invoking, not before deciding scope), b5l.1 (raw-replay --only-missing resumability, efficiency not correctness), kea7p (differential reindex strategy -- its own conclusion is that 818fy's full rebuild is the necessary fingerprint bootstrap, it explains why 818fy must run as designed rather than gating it).\n\nEverything else in the audited ~90 (read/query/render surfaces, daemon/infra/perf, durable-tier process beads, user.db/overlay-only beads, security/mutation-authority, cost/analytics/embeddings/interop, vocabulary/enum hygiene, agent-UX/config/tooling) checked and confirmed no parse/hash/identity/schema surface -- not wired as blocking.\n2026-08-04: polylogue-gvzkr filed (schema field/table purge audit, all 5 tiers). NOT a hash/correctness gate — dropping unused columns from DDL doesn't change content_hash (computed over the parsed semantic payload, not DB column existence) — so this is an EFFICIENCY batch-rider like iltbx/22ldr/58jjk, not a blocker: if the derived-tier (index.db/embeddings.db) disposition table is ready before this rebuild's DDL is finalized, land the pruned schema directly and skip a second full rebuild later to drop the same columns; if not ready in time, proceed without it — nothing forces waiting. Durable-tier (source.db/user.db) purges are unrelated to this bead's timing entirely (separate consent-gated migration, doesn't block 818fy either direction).\nGENERALIZED PRINCIPLE (operator observation, 2026-08-04): the ride-the-rebuild table above (a7xr.25, iltbx, 22ldr, 58jjk, and now gvzkr's derived-tier phase) is one recurring test, not four coincidentally similar decisions: ANY derived-tier structural/computational change is FREE if its DDL/logic decision lands before this rebuild's walk starts (the walk touches every session regardless), and EXPENSIVE if decided after (either a second full rebuild, or a bespoke backfill pass reimplementing the same walk). Apply this as a one-line check to any new finding surfaced before 818fy runs: 'does this change what a derived-tier row looks like, and is it cheap to decide now?' — if yes to both, it's a batch-rider for this table, not a separate future task. Note the principle's shelf life: kea7p (differential reindex) exists specifically to make future rebuilds cheap/incremental, which retires the 'free only during the one big walk' urgency this principle depends on — post-kea7p, this stops being a load-bearing distinction.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T00:34:02Z","created_by":"Sinity","updated_at":"2026-08-03T22:33:36Z","dependencies":[{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-0qfy","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-0x7nh","type":"blocks","created_at":"2026-08-03T08:24:56Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-2hwl","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-2qrx","type":"blocks","created_at":"2026-08-03T06:40:17Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-2qx","type":"blocks","created_at":"2026-08-03T22:36:23Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-4987i","type":"blocks","created_at":"2026-08-03T16:43:25Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-4ts","type":"blocks","created_at":"2026-08-03T22:36:23Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-4ts.10","type":"blocks","created_at":"2026-08-03T07:31:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-5iz4","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-5xxmc","type":"blocks","created_at":"2026-08-03T07:31:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-6753s","type":"blocks","created_at":"2026-08-03T10:21:51Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-6e7m","type":"blocks","created_at":"2026-08-03T22:36:22Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-7zp4","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-a7gmk","type":"blocks","created_at":"2026-08-03T03:26:19Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-a7xr.23","type":"blocks","created_at":"2026-08-03T22:36:23Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-a7xr.25","type":"blocks","created_at":"2026-08-03T22:36:22Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-ey4ro","type":"blocks","created_at":"2026-08-03T08:50:29Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-f1vg","type":"blocks","created_at":"2026-08-03T02:34:02Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-foee","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-fsgdd","type":"blocks","created_at":"2026-08-03T08:24:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-gzgyl","type":"blocks","created_at":"2026-08-03T14:18:20Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-ih67","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-ix5r","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-mvcbi","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-nas1","type":"blocks","created_at":"2026-08-03T22:36:23Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-omsw","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-qj5x","type":"blocks","created_at":"2026-08-03T22:36:23Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-qsagp","type":"blocks","created_at":"2026-08-03T07:31:55Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-r9xsj","type":"blocks","created_at":"2026-08-03T10:23:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-reindex-final-proof","type":"blocks","created_at":"2026-08-06T07:02:24Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-rrxe4","type":"blocks","created_at":"2026-08-04T06:14:13Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-rrxe4.1","type":"blocks","created_at":"2026-08-04T06:21:49Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-s8s54","type":"blocks","created_at":"2026-08-03T14:18:21Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-slshy","type":"blocks","created_at":"2026-08-03T14:17:57Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-sp72","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-t0m73","type":"blocks","created_at":"2026-08-03T07:35:29Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-uqwd","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-wwph1","type":"blocks","created_at":"2026-08-03T08:24:56Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-xofj","type":"blocks","created_at":"2026-08-03T06:40:18Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-818fy","depends_on_id":"polylogue-xselt","type":"blocks","created_at":"2026-08-03T08:24:56Z","created_by":"Sinity","metadata":"{}"}],"comments":[{"id":"017c6135-491d-58af-ae25-bc99a8fbafe9","issue_id":"polylogue-818fy","author":"Sinity","text":"Gate-set expansion (2026-08-03, dependency-curation pass): added 13 blocks deps under the invalidation rule \"doing X after the reindex forces a second replay or a sketchy retrofit\".\n\nAcquisition-completeness class (replay only sees source.db; these mean raws are missing/incomplete at replay time): 2qrx (211 stalled append cursors, 414MB unacquired; its own text: rebuild recovers none of it), ix5r (1,446 excluded cursors dark until revival mechanism exists), 5iz4 (90.8MB codex whale parse-crashes on every attempt; rebuild does NOT fix).\n\nParse/identity semantics class (baked into index.db at replay; fixing later reclassifies nothing without another reparse): 0qfy + uqwd (export-vintage instability drives false conflict verdicts in revision-authority membership), 7zp4 (content hash skips NFC for tool_input/session-event payloads: hash derivation change re-keys everything), xofj (six unmodelled chatgpt content types, ~11k blocks lose semantic type), 2hwl (chunk-merge drops titles + multi-flags active leaf), foee + ih67 (codex title/topology resolution: without them all 3,101 codex sessions bake UUID titles again), mvcbi (drive detector admits empty envelopes), sp72 (drive re-acquisition bypasses revision governance, raws quarantined at replay), omsw (tool-result/workflow-journal artifacts minted as phantom sessions; admission fix must precede replay or they re-materialize).\n\nDeliberately NOT gated (proposals, operator to decide): bo9n (6.8M-row session_events aggregation decision) and ei0d (1.28GiB write-only payload_json) are schema-shape decisions that would shrink the fresh index but are design-decision-gated; 3szyi (CHECK-constraint generation) rides any index bump; 4ts (lineage epic) is too large to gate wholesale.","created_at":"2026-08-03T04:41:23Z"}],"dependency_count":40,"dependent_count":17,"comment_count":1} -{"_type":"issue","id":"polylogue-9qnzy","title":"Live archive source.db/index.db schema lags checked-out code by 3-5 migrations, daemon health CRITICAL","description":"Discovered during a pre-reindex raw-authority-backlog audit (2026-08-02), read-only against the live archive at /realm/db/polylogue.\n\nEvidence:\n- `PRAGMA user_version` on live source.db = 15. Checked-out worktree HEAD (d84834968, includes merged PRs #3574/#3577/#3586/#3588/#3589/#3590) declares SOURCE_SCHEMA_VERSION = 20 (polylogue/storage/sqlite/archive_tiers/source.py:12). That is 5 pending additive migrations (016-020), most requiring a verified backup manifest per `migrate_archive_tier` (only 017 is marked `-- migration-safety: additive-no-backup`).\n- The **currently deployed** nix package (`python3.14t-polylogue-0.3.0`, live systemd unit `polylogued.service`, PID 1919586) itself expects source.db v18 / index.db v56, i.e. already 3 source + 10 index versions ahead of the live archive. `journalctl --user -u polylogued` shows a CRITICAL `daemon.health: schema_version` alert firing every 5 minutes continuously since at least 21:27Z today: `archive tier layout is not ready: tier user_version mismatch: source.db:15!=18, index.db:46!=56`.\n- Migration 016 (`raw_capture_observations`, absent from the live source.db) is written **unconditionally** by the ordinary capture-ingest write path (`polylogue/storage/sqlite/queries/raw_writes.py:97-104`, guarded only on `capture_mode is not None`, which is the common case) — a live ingest run under current/deployed code hitting this path with schema still at v15 would raise `sqlite3.OperationalError: no such table: raw_capture_observations`. No such error has appeared in the journal yet (likely because no capture-mode-bearing write has been exercised since the last restart), but it is a live landmine, not a hypothetical.\n- Separately: the operator's stated reindex command `polylogue ops reset --index \u0026\u0026 polylogued run` will **refuse outright** right now — `_archive_index_targets()` in `polylogue/cli/commands/reset.py:110-114` raises `ClickException(\"reset --index is unsafe for a managed active generation; use \\`polylogue ops maintenance rebuild-index\\`\")` whenever `.index-active-pointer` exists, and it does exist in the live archive root. The blue/green `polylogue ops maintenance rebuild-index` path must be used instead; the plan as literally stated cannot execute.\n\nNone of this is caused by or related to the raw-authority quarantine/convergence redesign (lb39z/w6hql/ds4b4) — it is an independent deployment/migration-currency gap between the live daemon's installed package, the live archive's on-disk schema, and origin/master's checked-out HEAD. Recommend: run the durable-tier migration path (`polylogue maintenance migrate-tier` or equivalent, with a verified backup manifest) for source.db up to whatever version the intended runtime code declares, and confirm the deployed nix package version matches origin/master before doing a full reindex, or the reindex will run under a runtime code / on-disk schema mismatch of unknown severity beyond the one path already identified above.","design":"DESIGN / REMEDIATION SEQUENCE (2026-08-03, supersedes the description's numbers — much has moved since filing):\n\nCURRENT STATE (verified live this session, read-only):\n- source.db user_version=20 (operator ran `polylogue ops maintenance migrate-tier source --backup-manifest \u003c2026-08-02 full_evidence manifest\u003e` this morning, applying 016-020; see comment). Master now declares SOURCE_SCHEMA_VERSION=24 (archive_tiers/source.py:24) — migrations 021-024 (widen-origin-check, hook_payload blob refs, byte-dup supersession receipts, verdict cache) landed AFTER that migration run and are pending.\n- user.db v10 = current. No user-tier work.\n- index.db user_version=46 vs master INDEX_SCHEMA_VERSION=57 (archive_tiers/index.py, last assignment wins). This gap is NOT a migration — index is a derived tier; it closes only via the 818fy blue/green rebuild (`polylogue ops maintenance rebuild-index`, daemon-owned). The description's note stands: `ops reset --index` hard-refuses while `.index-active-pointer` exists.\n- Deployed nix package still bakes SOURCE=18/INDEX=56 — stale vs master 24/57. Daemon CRITICAL health alert now reports index-tier mismatch only (source no longer flagged after the migration).\n\nCONCLUSION — THIS BEAD NEEDS NO POLYLOGUE CODE CHANGES. It is an ops/deploy sequence:\n1. Pick the target master commit (merge-freeze checkpoint for the pre-reindex batch).\n2. Fresh verified backup: `polylogue backup --profile full_evidence --verify` (durable-tier migration policy; 021 is the only non-trivial one — it widens a CHECK, precedent says table rebuild, backup manifest mandatory).\n3. `polylogue ops maintenance migrate-tier source --backup-manifest \u003cmanifest\u003e` → source.db 20→24. Confirm `PRAGMA user_version`=24 + `PRAGMA integrity_check` ok.\n4. sinnix: update the polylogue flake input pin to the target commit; `cd /realm/project/sinnix \u0026\u0026 nix develop --command switch`; restart polylogued.\n5. Confirm: `polylogue status` schema health flags AT MOST the index tier; `journalctl --user -u polylogued` shows no source/user-tier CRITICAL.\n6. Index gap: resolved by 818fy's own `polylogue ops maintenance rebuild-index` run — explicitly NOT this bead's scope.\n\nSteps 4-5 overlap a7gmk (final deploy sync). Division of labor: this bead = get the live system OUT of the CRITICAL/landmine state now (migrations current + a non-stale daemon); a7gmk = the final re-sync immediately before triggering the reindex (every PR merged after this bead's deploy re-drifts the package).\n\nSCOPE-REDUCTION FINDING (verified against each bead's own notes): the four P0s blocked on this bead — lb39z, hjpx, lkrc, yla8 — are NOT waiting on more code for their merged halves. lb39z items 1-4 of 5 merged (PRs #3574/#3577/#3588); hjpx AC1-5 satisfied (per its 2026-08-01 reconciliation note), gated on yla8's live closure gate; what remains for all four is LIVE EXECUTION (dry-run censuses, operator-authorized actuator applies, the yla8 audit) which requires the deployed daemon/CLI to run current code against a schema-current archive — i.e. exactly this bead's deploy step. The blocked-on-9qnzy edges are deploy-dependencies, not missing-feature dependencies. Fixing this bead likely converts those four from \"blocked\" to \"ready for their live/ops halves\" without further merges (except lb39z item 5, which still needs its own dedicated code session).\n","acceptance_criteria":"1. Live source.db `PRAGMA user_version` equals the deployed package's SOURCE_SCHEMA_VERSION (currently 24 on master; verify: sqlite3 'file:/realm/db/polylogue/source.db?mode=ro' 'PRAGMA user_version'), with `PRAGMA integrity_check` ok, migrations applied via `polylogue ops maintenance migrate-tier source --backup-manifest \u003cfresh verified full_evidence manifest\u003e`.\n2. user.db remains current (v10) or is migrated the same way if USER_SCHEMA_VERSION moves.\n3. The deployed sinnix polylogue package is built from a master commit whose SOURCE_SCHEMA_VERSION matches the live source.db; daemon restarted.\n4. `polylogue status` / `journalctl --user -u polylogued` show NO source/user-tier schema CRITICAL alerts; an index-tier mismatch (46 vs current) is the only permitted residual — it is 818fy's scope (`polylogue ops maintenance rebuild-index`, never `ops reset --index`), not this bead's.\n5. No polylogue code changes shipped under this bead id — it is an ops/deploy sequence; any code gap discovered during execution files its own bead.","notes":"Re-verified live 2026-08-03: source.db is now v24 (migrations 016-024 all present, tables raw_membership_writeback_receipts/raw_append_chain_backfill_receipts/raw_byte_duplicate_supersession_receipts/raw_authority_verdicts_cache all exist) -- the source-tier gap this bead originally flagged (was v15) is fully resolved, presumably via normal incremental additive-migration convergence since filing. index.db remains behind (v46 vs checked-out code's v60, now wider after this session's own semantic-reparse bumps for 4987i/omsw/taj0o) -- but per operator correction 2026-08-03: this is not a separate blocker requiring investigation, it IS the exact condition that running the reindex (polylogue-818fy) resolves by construction. Removing this bead's blocked-by edge on polylogue-lb39z (fully done, source-tier concern resolved, nothing else in lb39z's scope depends on index-tier currency). Leaving edges on hjpx/yla8/lkrc for now pending their own reconsideration (operator architectural redirect re: permanent repair machinery, 2026-08-03).","status":"open","priority":0,"issue_type":"bug","owner":"ezo.dev@gmail.com","created_at":"2026-08-02T21:48:47Z","created_by":"Sinity","updated_at":"2026-08-03T21:26:05Z","dependencies":[{"issue_id":"polylogue-9qnzy","depends_on_id":"polylogue-gbs02","type":"relates-to","created_at":"2026-08-03T18:23:53Z","created_by":"Sinity","metadata":"{}"}],"comments":[{"id":"9f82e33d-4236-5f68-bbef-168438aa51bd","issue_id":"polylogue-9qnzy","author":"Sinity","text":"2026-08-03: operator ran the durable-tier migration live (polylogue ops maintenance migrate-tier source --backup-manifest \u003c2026-08-02 full_evidence manifest\u003e). source.db migrated 15 -\u003e 20 (applied 016-020), confirmed via PRAGMA user_version=20 and integrity_check ok. user.db was already current at v10, needed no migration. Daemon restarted; polylogue status now reports the schema-mismatch health check as \"schema version mismatch on tier(s): index\" only -- source is no longer flagged. Remaining gap: (1) index.db (v46 vs deployed package's expected v56) -- this is the derived tier the reindex itself (polylogue-818fy) resolves, not a separate migration; (2) the deployed nix package itself still lags origin/master (was v18/56 at last check, master has advanced well past that) -- that's polylogue-a7gmk's scope (sinnix deploy sync), not yet done. This bead's durable-tier-migration half is done; keep open (or narrow scope) pending a7gmk.\n","created_at":"2026-08-03T03:08:22Z"}],"dependency_count":0,"dependent_count":5,"comment_count":1} +{"_type":"issue","id":"polylogue-9qnzy","title":"Live archive source.db/index.db schema lags checked-out code by 3-5 migrations, daemon health CRITICAL","description":"Discovered during a pre-reindex raw-authority-backlog audit (2026-08-02), read-only against the live archive at /realm/db/polylogue.\n\nEvidence:\n- `PRAGMA user_version` on live source.db = 15. Checked-out worktree HEAD (d84834968, includes merged PRs #3574/#3577/#3586/#3588/#3589/#3590) declares SOURCE_SCHEMA_VERSION = 20 (polylogue/storage/sqlite/archive_tiers/source.py:12). That is 5 pending additive migrations (016-020), most requiring a verified backup manifest per `migrate_archive_tier` (only 017 is marked `-- migration-safety: additive-no-backup`).\n- The **currently deployed** nix package (`python3.14t-polylogue-0.3.0`, live systemd unit `polylogued.service`, PID 1919586) itself expects source.db v18 / index.db v56, i.e. already 3 source + 10 index versions ahead of the live archive. `journalctl --user -u polylogued` shows a CRITICAL `daemon.health: schema_version` alert firing every 5 minutes continuously since at least 21:27Z today: `archive tier layout is not ready: tier user_version mismatch: source.db:15!=18, index.db:46!=56`.\n- Migration 016 (`raw_capture_observations`, absent from the live source.db) is written **unconditionally** by the ordinary capture-ingest write path (`polylogue/storage/sqlite/queries/raw_writes.py:97-104`, guarded only on `capture_mode is not None`, which is the common case) — a live ingest run under current/deployed code hitting this path with schema still at v15 would raise `sqlite3.OperationalError: no such table: raw_capture_observations`. No such error has appeared in the journal yet (likely because no capture-mode-bearing write has been exercised since the last restart), but it is a live landmine, not a hypothetical.\n- Separately: the operator's stated reindex command `polylogue ops reset --index \u0026\u0026 polylogued run` will **refuse outright** right now — `_archive_index_targets()` in `polylogue/cli/commands/reset.py:110-114` raises `ClickException(\"reset --index is unsafe for a managed active generation; use \\`polylogue ops maintenance rebuild-index\\`\")` whenever `.index-active-pointer` exists, and it does exist in the live archive root. The blue/green `polylogue ops maintenance rebuild-index` path must be used instead; the plan as literally stated cannot execute.\n\nNone of this is caused by or related to the raw-authority quarantine/convergence redesign (lb39z/w6hql/ds4b4) — it is an independent deployment/migration-currency gap between the live daemon's installed package, the live archive's on-disk schema, and origin/master's checked-out HEAD. Recommend: run the durable-tier migration path (`polylogue maintenance migrate-tier` or equivalent, with a verified backup manifest) for source.db up to whatever version the intended runtime code declares, and confirm the deployed nix package version matches origin/master before doing a full reindex, or the reindex will run under a runtime code / on-disk schema mismatch of unknown severity beyond the one path already identified above.","design":"DESIGN / REMEDIATION SEQUENCE (2026-08-03, supersedes the description's numbers — much has moved since filing):\n\nCURRENT STATE (verified live this session, read-only):\n- source.db user_version=20 (operator ran `polylogue ops maintenance migrate-tier source --backup-manifest \u003c2026-08-02 full_evidence manifest\u003e` this morning, applying 016-020; see comment). Master now declares SOURCE_SCHEMA_VERSION=24 (archive_tiers/source.py:24) — migrations 021-024 (widen-origin-check, hook_payload blob refs, byte-dup supersession receipts, verdict cache) landed AFTER that migration run and are pending.\n- user.db v10 = current. No user-tier work.\n- index.db user_version=46 vs master INDEX_SCHEMA_VERSION=57 (archive_tiers/index.py, last assignment wins). This gap is NOT a migration — index is a derived tier; it closes only via the 818fy blue/green rebuild (`polylogue ops maintenance rebuild-index`, daemon-owned). The description's note stands: `ops reset --index` hard-refuses while `.index-active-pointer` exists.\n- Deployed nix package still bakes SOURCE=18/INDEX=56 — stale vs master 24/57. Daemon CRITICAL health alert now reports index-tier mismatch only (source no longer flagged after the migration).\n\nCONCLUSION — THIS BEAD NEEDS NO POLYLOGUE CODE CHANGES. It is an ops/deploy sequence:\n1. Pick the target master commit (merge-freeze checkpoint for the pre-reindex batch).\n2. Fresh verified backup: `polylogue backup --profile full_evidence --verify` (durable-tier migration policy; 021 is the only non-trivial one — it widens a CHECK, precedent says table rebuild, backup manifest mandatory).\n3. `polylogue ops maintenance migrate-tier source --backup-manifest \u003cmanifest\u003e` → source.db 20→24. Confirm `PRAGMA user_version`=24 + `PRAGMA integrity_check` ok.\n4. sinnix: update the polylogue flake input pin to the target commit; `cd /realm/project/sinnix \u0026\u0026 nix develop --command switch`; restart polylogued.\n5. Confirm: `polylogue status` schema health flags AT MOST the index tier; `journalctl --user -u polylogued` shows no source/user-tier CRITICAL.\n6. Index gap: resolved by 818fy's own `polylogue ops maintenance rebuild-index` run — explicitly NOT this bead's scope.\n\nSteps 4-5 overlap a7gmk (final deploy sync). Division of labor: this bead = get the live system OUT of the CRITICAL/landmine state now (migrations current + a non-stale daemon); a7gmk = the final re-sync immediately before triggering the reindex (every PR merged after this bead's deploy re-drifts the package).\n\nSCOPE-REDUCTION FINDING (verified against each bead's own notes): the four P0s blocked on this bead — lb39z, hjpx, lkrc, yla8 — are NOT waiting on more code for their merged halves. lb39z items 1-4 of 5 merged (PRs #3574/#3577/#3588); hjpx AC1-5 satisfied (per its 2026-08-01 reconciliation note), gated on yla8's live closure gate; what remains for all four is LIVE EXECUTION (dry-run censuses, operator-authorized actuator applies, the yla8 audit) which requires the deployed daemon/CLI to run current code against a schema-current archive — i.e. exactly this bead's deploy step. The blocked-on-9qnzy edges are deploy-dependencies, not missing-feature dependencies. Fixing this bead likely converts those four from \"blocked\" to \"ready for their live/ops halves\" without further merges (except lb39z item 5, which still needs its own dedicated code session).\n","acceptance_criteria":"1. Live source.db `PRAGMA user_version` equals the deployed package's SOURCE_SCHEMA_VERSION (currently 24 on master; verify: sqlite3 'file:/realm/db/polylogue/source.db?mode=ro' 'PRAGMA user_version'), with `PRAGMA integrity_check` ok, migrations applied via `polylogue ops maintenance migrate-tier source --backup-manifest \u003cfresh verified full_evidence manifest\u003e`.\n2. user.db remains current (v10) or is migrated the same way if USER_SCHEMA_VERSION moves.\n3. The deployed sinnix polylogue package is built from a master commit whose SOURCE_SCHEMA_VERSION matches the live source.db; daemon restarted.\n4. `polylogue status` / `journalctl --user -u polylogued` show NO source/user-tier schema CRITICAL alerts; an index-tier mismatch (46 vs current) is the only permitted residual — it is 818fy's scope (`polylogue ops maintenance rebuild-index`, never `ops reset --index`), not this bead's.\n5. No polylogue code changes shipped under this bead id — it is an ops/deploy sequence; any code gap discovered during execution files its own bead.","notes":"Re-verified live 2026-08-03: source.db is now v24 (migrations 016-024 all present, tables raw_membership_writeback_receipts/raw_append_chain_backfill_receipts/raw_byte_duplicate_supersession_receipts/raw_authority_verdicts_cache all exist) -- the source-tier gap this bead originally flagged (was v15) is fully resolved, presumably via normal incremental additive-migration convergence since filing. index.db remains behind (v46 vs checked-out code's v60, now wider after this session's own semantic-reparse bumps for 4987i/omsw/taj0o) -- but per operator correction 2026-08-03: this is not a separate blocker requiring investigation, it IS the exact condition that running the reindex (polylogue-818fy) resolves by construction. Removing this bead's blocked-by edge on polylogue-lb39z (fully done, source-tier concern resolved, nothing else in lb39z's scope depends on index-tier currency). Leaving edges on hjpx/yla8/lkrc for now pending their own reconsideration (operator architectural redirect re: permanent repair machinery, 2026-08-03).\nLIVE RECHECK 2026-08-06: direct read-only probes found source.db user_version=28, index.db=46, user.db=10. Running service is installed polylogue-0.3.0 with source expectation 24 and index expectation 57. origin/master at 685f2ca8 expects source 29 and index 66. The daemon journal reports schema_version critical and parks convergence, plus FTS missing rows and raw failures. The live source v28 is ahead of the installed package but behind origin/master v29; the deployed package is behind both. Do not migrate, reset, rebuild, or promote until a provenance and deployment-currency gate identifies the exact target package and verifies the source v28 to v29 transition. Current status API also timed out; no production mutation was performed in this probe.\nPROVENANCE CORRECTION 2026-08-06: repository history identifies source v28 as the additive raw_hook_events_source_hash index train from c9d127d1b / PR #3811, with 028.train.json and 028_raw_hook_events_source_hash_index.sql. The live source v28 is therefore a known valid schema predecessor, not an unidentified anomaly. The remaining deployment gap is exact target selection: installed package source24/index57, origin/master source29/index66, live source28/index46. Terra/Sol must bind the migration and package target to one immutable master revision before any apply.\nINDEPENDENT REVIEW 2026-08-06: Terra gate PR #3851 is intentionally held. The shared guard currently covers source/user only and needs audit-tier coverage, a post-OwnedArchiveLocation recheck, daemon bulk entry protection, empty-source bypass removal, explicit --preflight --daemon rejection, structured daemon-visible mismatch responses, and fixtures initialized with all durable tiers. Six deterministic tests fail before intended ownership assertions with user.db None!=10. A dedicated RW hardening lane is implementing these defects. No production writes or merges have occurred for this gate.","status":"open","priority":0,"issue_type":"bug","owner":"ezo.dev@gmail.com","created_at":"2026-08-02T21:48:47Z","created_by":"Sinity","updated_at":"2026-08-06T09:13:37Z","dependencies":[{"issue_id":"polylogue-9qnzy","depends_on_id":"polylogue-dudtn","type":"blocks","created_at":"2026-08-06T11:50:02Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-9qnzy","depends_on_id":"polylogue-gbs02","type":"relates-to","created_at":"2026-08-03T18:23:53Z","created_by":"Sinity","metadata":"{}"}],"comments":[{"id":"9f82e33d-4236-5f68-bbef-168438aa51bd","issue_id":"polylogue-9qnzy","author":"Sinity","text":"2026-08-03: operator ran the durable-tier migration live (polylogue ops maintenance migrate-tier source --backup-manifest \u003c2026-08-02 full_evidence manifest\u003e). source.db migrated 15 -\u003e 20 (applied 016-020), confirmed via PRAGMA user_version=20 and integrity_check ok. user.db was already current at v10, needed no migration. Daemon restarted; polylogue status now reports the schema-mismatch health check as \"schema version mismatch on tier(s): index\" only -- source is no longer flagged. Remaining gap: (1) index.db (v46 vs deployed package's expected v56) -- this is the derived tier the reindex itself (polylogue-818fy) resolves, not a separate migration; (2) the deployed nix package itself still lags origin/master (was v18/56 at last check, master has advanced well past that) -- that's polylogue-a7gmk's scope (sinnix deploy sync), not yet done. This bead's durable-tier-migration half is done; keep open (or narrow scope) pending a7gmk.\n","created_at":"2026-08-03T03:08:22Z"}],"dependency_count":1,"dependent_count":5,"comment_count":1} {"_type":"issue","id":"polylogue-lb39z","title":"Raw-authority redesign Phase 1: drain the fake quarantine (no schema change)","description":"Raw-authority redesign Phase 1: drain the fake quarantine without schema changes. Five items: (1) classifier duplicate/fork-localization rules, (2) membership write-back actuator, (3) append-chain backfill actuator, (4) frontier-executability gate, (5) ambiguous-set reclassification + guarded _maximal_evidence_fallback wiring. Items 1-4 merged (PRs #3574/#3577/#3588); item 5(a) verified already-fixed; remaining scope = item 5(b)(c) guarded wiring + the operator-supervised live drain of the three landed actuators. Full evidence trail in notes.","design":"DESIGN (2026-08-03 distillation — full evidence trail lives in this bead's notes, do not re-derive):\n\nCURRENT STATE: items 1-4 of 5 are MERGED (item 1 classifier dedup/fork-localization PR #3574; item 2 membership write-back actuator + migration 019 PR #3577; item 3 append-chain backfill + migration 020 PR #3588; item 4 frontier-executability lab policy PR #3588). Item 5(a) verified already-closed (attachment normalizer fixed via aggz/d8al). REMAINING SCOPE = two things only:\n\nA. ITEM 5(b)+(c): guarded _maximal_evidence_fallback wiring. The complete implementation plan — param threading (existing_accepted_raw_id), the three-case guard (headless cohort gets first head / re-affirmation applies / anything else refuses by construction), both call sites (sources/live/batch.py ~2572, sources/revision_backfill.py ~1323 incl. the unconditional head pass-through fix), and the anti-vacuity test shape against apply_raw_membership_classification — is written out in the 2026-08-02 continuation note. Execute that plan in a dedicated session; it touches the never-retire-an-accepted-head invariant, so no bundling with other work.\n\nB. LIVE DRAIN EXECUTION (operator-supervised, after 9qnzy/a7gmk deploy): run the three landed actuators against the live archive in dependency order, each dry-run first, verified backup manifest required for --apply, receipts recorded: (1) devtools workspace raw-membership-writeback-apply (item-2 population); (2) devtools workspace raw-append-chain-backfill-apply (item-3 population, 2,712 membershipless rows); (3) devtools workspace raw-byte-duplicate-supersession-apply (6753s population, 4,305 rows — landed separately via migration 023). Then let daemon convergence re-run classification (item-1 classifier improvements + _promote_contiguous_append_evidence cascade) and measure the remaining quarantine mass. Whatever survives feeds r9xsj's zero-quarantine gate accounting.\n\nPITFALLS: actuators require the deployed package to carry migrations 019/020/023 — live source.db is at v20, so 023's receipts table does not exist live yet; the deploy/migration step is a hard prerequisite for actuator (3). Do not raise batch limits or bypass the reconciler to make the drain look faster (hjpx fixed-point discipline).\n","acceptance_criteria":"1. Item 5(b)(c): classify_membership_revisions carries existing_accepted_raw_id; the three-case guard is structurally incapable of retiring an accepted head; both call sites wired (batch.py + revision_backfill.py with unconditional head pass-through); anti-vacuity test against apply_raw_membership_classification proves the retire-refusal case, the re-affirmation case, and the first-head-for-headless-cohort case. Verify: devtools test -k membership.\n2. Live drain executed in order (membership-writeback, append-chain-backfill, byte-dup-supersession), each dry-run first, verified backup manifest for --apply, receipts recorded on this bead; requires deployed package \u003e= migration 023 (live source.db must be v23+ first).\n3. Post-drain: daemon convergence re-classification runs; remaining revision_authority='quarantined' count measured and every survivor accounted for in r9xsj's census vocabulary; no batch-limit raises or reconciler bypasses used.\n4. Closure hand-off: residual quarantine feeds r9xsj gate; this bead closes when items 1-5 are landed AND the live drain receipts exist.","notes":"2026-08-02 partial-implementation session (worktree agent-ae4e2dec04012e4ed): landed items 1 and 2 of 5, both well-tested and PR'd; items 3-5 remain open.\n\nITEM 1 (fix classifier duplicate rule, I4/I5): DONE. PR #3574 (branch\nfeature/fix/raw-revision-dedup-fork-localization). classify_historical_full_revisions\nand classify_historical_full_revision_streams (polylogue/archive/revision_authority.py)\nnow collapse byte-identical revisions onto one representative before any\nchain-order proof runs (I4), and localize residual ambiguity to only the\ndivergent suffix instead of the whole cohort (I5) via a proper byte-prefix\nDAG + clean-path propagation, replacing the old \"any size tie or unique-chain\nfailure quarantines everyone\" logic. classify_untyped_full_revision_groups\n(revision_governance.py) updated to require ALL decisions BYTE_PROVEN\n(preserving its existing whole-cohort-must-be-provable contract) since\npartial-cohort verdicts are now possible. classify_raw_revision_cohort\nrequired zero changes (duplicate/ambiguous decisions both leave\npredecessor_raw_id=None, so the existing generation-numbering walk never\ncollides). New anti-vacuity tests prove the pre-fix classifier quarantined a\nbyte-equal duplicate pair and a shared-root fork wholesale; the post-fix\nclassifier does not. 24 new/updated unit tests pass; mypy --strict clean;\n6 unrelated pre-existing failures in test_raw_authority_scale_proof.py /\ntest_raw_authority_daemon_health_proof.py confirmed to reproduce identically\nwith this change reverted (via git stash), so classified pre-existing/unrelated.\n\nITEM 2 (write-back actuator): DONE (built + tested, NOT run live). PR #3577\n(branch feature/feat/raw-membership-writeback-actuator). New actuator\npolylogue/maintenance/raw_membership_writeback_apply.py, read-only classifier\npolylogue/storage/raw_membership_writeback.py, migration 019 (source schema\nv18-\u003ev19, new raw_membership_writeback_receipts table), devtools workspace\nraw-membership-writeback-apply command. Follows the identical dry-run-default\n/ verified-backup-required-to-apply / immutable-receipt pattern as the\nmerged u19l live-source-reconciliation actuator. Only promotes rows whose\nmembership decision is in {applied, superseded_equivalent, superseded_prefix}\nAND whose membership revision_authority is itself already byte_proven (a\nfixture explicitly proves a decided-but-membership-still-quarantined row is\ncorrectly left untouched). Never touches predecessor_raw_id/baseline_raw_id/\nacquisition_generation or revision_authority_evidence. 4 new tests +\n40 durable-migration tests (7 pre-existing hardcoded version-chain assertions\nupdated for the new v19 migration) pass; devtools render all --check clean;\nmypy --strict clean. NOT run against the live archive -- that is the\nseparate, later, operator-supervised step this PR explicitly leaves open,\nsame as u19l's own live application.\n\nITEM 3 (append-chain backfill, 2,712 membershipless rows): NOT STARTED.\nNeeds a new actuator running raw_append_revision_parent's existing byte-proof\nagainst still-present live source files for quarantined rows with no\nraw_session_memberships row at all. Same dry-run/backup-manifest/receipt\nsafety pattern as items 1-2 should carry over directly.\n\nITEM 4 (fix the gate, sibling polylogue-w32w): PARTIALLY ALREADY SATISFIED,\nnot touched this session. polylogue-w32w itself closed 2026-07-31 via PR\n#3466: RawAuthorityFrontierItem.__post_init__ now raises ValueError if an\nactuator is in _APPLY_DISPATCHED_ACTUATORS but its state isn't executable\n(constructor-level invariant), with a drift-guard test\n(test_apply_dispatched_actuators_match_apply_branches). What remains per this\nbead's explicit ask and w32w's own close note: a devtools lab policy check\n(not just a constructor guard) that fails CI if a FUTURE frontier state\nbecomes unreachable again -- w32w's close reason calls the constructor guard\n\"a legitimate alternate implementation\" but the bead text here explicitly\nalso asks for the lab-policy form. Not attempted this session.\n\nITEM 5 (re-classify ambiguous set + wire _maximal_evidence_fallback): NOT\nSTARTED. Needs: (a) find and fix the attachment-id-stability normalizer issue\nthe report names (synthetic id derived from position, not provider data --\nlikely the same class as the already-closed hith/qkuq beads, needs\nverification this is still live or whether it's actually fully closed and\nonly historical rows need re-classification); (b) re-run classification for\nthe ambiguous cohort under the fixed normalizer; (c) wire\n_maximal_evidence_fallback (session_revision_membership.py:299) behind the\naccepted-head-safety condition its own docstring documents; (d) a real\nregression test constructing a case where naively wiring it in WOULD retire\nan accepted head, proving the implementation correctly refuses. This is the\nhighest-risk remaining item (directly touches the never-retire-an-accepted-\nhead invariant) and deserves a dedicated, unhurried session per this bead's\nown \"no live apply / no silent wrong-guesses\" discipline.\n\nSafety notes: no live archive mutation was performed or attempted at any\npoint this session. Both merged-eligible PRs are proven only against\nsynthetic fixtures. Read polylogue-yla8/hjpx/lkrc/w32w in full before\nresuming -- none of their landed protections were touched or duplicated.\n2026-08-02: items 1-2 of 5 merged. PR #3574 (classifier duplicate-collapse + fork-localization, I4/I5) merged at 31614661f -- includes a coordinator-applied fix for a real quadratic-\u003ecubic streamed-blob-read amplification CodeRabbit found in the maximal-parent filter (transitivity makes the filter's extra is_prefix calls redundant), plus a strengthened test assertion. Coordinator declined CodeRabbit's second suggestion (mirror predecessor_raw_id onto duplicates) after finding it would introduce a dict-key collision in the generation walk -- filed as separate follow-up polylogue-5unky instead of rushing a fix. PR #3577 (raw_session_memberships write-back actuator, source schema v18-\u003ev19) merged at f1897473d -- dry-run default, verified-backup-required --apply, not run live. Items 3 (append-chain backfill), 4 (gate completeness -- partially covered by closed w32w), and 5 (ambiguous-set reclassification + _maximal_evidence_fallback wiring, explicitly flagged as highest-risk, deserves its own dedicated session) remain open.\n2026-08-02 fidelity-gate cross-check: ran .agent/scripts/corpus-fidelity-audit.py (polylogue-f1vg) against the live archive -- VERDICT FAIL, 1267 absent documents + 100 unexplained revision-shortfall sessions + 9767 unacquired attachment refs. Investigated the 100-session shortfall cluster inline (operator request): fully explained by two already-in-flight causes, not a new bug. (a) 76 Hermes sessions: raw_sessions.parsed_at_ms is 68-72 days LATER than the index session's updated_at_ms for the same provider_session_id -- the raw was re-censused with a newer parser (message_count=3007 vs indexed 135) but the index materialization was never refreshed. Pure staleness, fixed by the reindex itself. (b) claude-code-session cases (verified 3 examples: 997aa5cf-..., f23b4181-..., 063a6885-...): every contributing raw is decision='ambiguous'/revision_authority='quarantined' -- the exact class this bead's Phase 1 (classifier dedup/fork-localization, merged PR #3574) and Phase 2 (w6hql) target. No separate fix needed; both classes resolve via reindex + the already-queued redesign phases.\n2026-08-02 continuation session (worktree agent-a3e268d6692d1b756, PR #3588): landed items 3 and 4 of 5. Item 5 investigated in depth but NOT implemented -- left explicitly open per this bead's own \"no time pressure, no silent wrong-guesses\" guidance.\n\nITEM 3 (append-chain backfill, 2,712 membershipless rows): DONE, PR #3588 (branch feature/feat/raw-authority-append-chain-backfill-and-frontier-lint, commit 84ceeccc8). New read-only classifier polylogue/storage/raw_append_chain_backfill.py scopes to raw_sessions rows that are revision_kind='append', revision_authority='quarantined', AND have zero raw_session_memberships rows (LEFT JOIN ... IS NULL) -- distinct from u19l's broader population (all quarantined rows regardless of membership). Reuses live_source_reconciliation.compare_raw_against_live_source directly (no duplicated logic) to prove each row's own [append_start_offset:append_end_offset) byte range against its live source file. New actuator polylogue/maintenance/raw_append_chain_backfill_apply.py follows the identical dry-run/backup-manifest/receipt pattern as u19l and item-2's actuator, reusing revision_authority_evidence='live_source_verification_v1' (same mechanism, different population -- own dedicated raw_append_chain_backfill_receipts table records the distinction). Migration 020, source schema v19-\u003ev20. devtools workspace raw-append-chain-backfill-apply. Deliberately never touches predecessor_raw_id/baseline_raw_id/acquisition_generation -- once a row is proven, the EXISTING _promote_contiguous_append_evidence cascade (revision_governance.py) picks it up for free on the next convergence pass, either as its true predecessor's resolved child or as a newly-eligible parent for whatever fragment sits downstream, unblocking a stuck chain one link at a time. 5 new tests (classifier + actuator) pass, including a test proving a row that already HAS a membership row is correctly excluded even when its bytes match exactly (proves the NOT EXISTS scope boundary vs u19l). test_durable_migrations.py's 7 hardcoded v19 assertions updated to v20. devtools test -k raw_authority: 90 passed, 6 failed -- confirmed identical to the prior session's pre-existing/unrelated failures (test_raw_authority_scale_proof.py / test_raw_authority_daemon_health_proof.py). devtools test -k raw_materialization: 118 passed. mypy --strict clean. NOT run live.\n\nITEM 4 (gate completeness): DONE, PR #3588 (commit 83e3fb009). New devtools/verify_raw_authority_frontier_executability.py statically parses polylogue/storage/raw_reconciler.py via AST and enumerates every literal (state, actuator) pair constructible via _item(...) and _StrategyOverride(...) call sites -- 17 pairs on current source, 1 dynamic-forwarding site (state=strategy_override.state) correctly reported as informational-only since its literal source (the _StrategyOverride construction site) is separately checked. Cross-checks each pair against the REAL _EXECUTABLE_STATES/_APPLY_DISPATCHED_ACTUATORS imported directly from raw_reconciler.py (never re-declared), so it can't drift out of sync. This is the static form w32w's own close note acknowledged was still missing beyond its constructor-level guard: the constructor guard (__post_init__) only fires when something actually CONSTRUCTS a bad pairing, so an unexercised branch (no test hits it) stays silent until it accumulates against live data -- exactly how the original defect went undetected for weeks. Wired as `devtools lab policy raw-authority-frontier-executability`. 6 new tests pass, including a genuine anti-vacuity test that reproduces the exact pre-#3466 UNRESOLVED_PROVENANCE+REFINE_QUARANTINE shape in a synthetic fixture MODULE (not the real file) and proves the lint flags it, plus controls for a safe pairing, a RawAuthorityActuator.NONE pairing, a dynamic-site pairing, and an unknown-enum-member typo (fails closed with ValueError rather than silently passing).\n\nITEM 5(a) attachment-id-stability normalizer: VERIFIED ALREADY FULLY CLOSED, no new work needed. hith and qkuq are both status=closed, close_reason references supersession by the aggz comparison-identity change (same as d8al). Confirmed directly in source: polylogue/pipeline/ids.py:254 attachment_identity_hash's docstring states explicitly \"Fixed to (anchoring message, name, media type) -- content-derived and never the provider's own attachment id (polylogue-d8al, polylogue-hith)\". The function signature only accepts message_id/name/mime_type -- passing provider_attachment_id would be a TypeError, not a value it has to remember to strip. No re-classification of the ambiguous cohort under a \"fixed normalizer\" is needed because there is no unfixed normalizer issue left to fix; any still-ambiguous historical rows from before this fix resolve via ordinary reindex, not a new code change.\n\nITEM 5(b)+(c) _maximal_evidence_fallback wiring + anti-vacuity test: INVESTIGATED IN DEPTH, NOT IMPLEMENTED this session -- deliberately left open per this bead's own explicit permission to do so rather than rush the highest-risk item. Findings, to make the follow-up genuinely actionable:\n\n- _maximal_evidence_fallback (session_revision_membership.py:299-330) is fully implemented, unit-tested (test_presence_guarantee_fallback_is_order_independent per its docstring), and NOT called by classify_membership_revisions. Its own docstring already names the exact safety condition needed: \"Landing this safely needs either the classifier or its caller to carry the existing head's raw_id into this decision, or the write-back guard to accept a re-affirmed-quarantined outcome explicitly.\"\n- classify_membership_revisions's irreducible-conflict branch (lines ~287-296) currently unconditionally returns MembershipClassification((), equivalents, ambiguous=all-representatives) -- nothing accepted, whole cohort quarantined.\n- BOTH call sites already have the currently-accepted head's raw_id available BEFORE calling classify_membership_revisions: sources/live/batch.py:2572 computes accepted_head_raw_id = archive.raw_revision_head_raw_id(logical_source_key) and unconditionally injects it into the comparison cohort (member_raw_ids) at line 2573-2574, well before the classify_membership_revisions(revisions) call at line 2616. sources/revision_backfill.py:1323 computes the equivalent head_raw_id = archive.raw_revision_head_raw_id(logical_key) (only absorbed into the cohort when its OWN authority is already 'quarantined', line 1324-1325) before its own classify_membership_revisions(revisions) call at line 1361.\n- Proposed safe wiring (NOT implemented): add `existing_accepted_raw_id: str | None = None` keyword param to classify_membership_revisions. In the conflict branch, compute `fallback = _maximal_evidence_fallback(representatives)`. Apply it (accepted_raw_ids=(fallback.raw_id,), other representatives moved to ambiguous as recorded conflict debt per the function's own docstring) ONLY when existing_accepted_raw_id is None (no head exists yet -- a genuinely new cohort that was previously permanently headless now gets a deterministic head) OR fallback.raw_id == existing_accepted_raw_id (the fallback's pick already IS the existing head -- a pure re-affirmation, zero retirement risk). In every other case (an existing head is present AND the fallback would pick something else), refuse the fallback and preserve the CURRENT behavior byte-for-byte (empty accepted, everyone ambiguous) -- this makes it structurally impossible for this change to ever retire an accepted head, by construction, not by a runtime check that could be bypassed.\n- This is NOT a trivial patch despite the design being clear: apply_raw_membership_classification (storage/sqlite/archive_tiers/revision_governance.py:2237+) has extensive, incident-hardened logic around what happens when accepted_raw_ids becomes non-empty for a cohort that previously had NO accepted head vs one that already did (yield_to_head_raw_id branches, dangling-append-descendant checks referencing polylogue-miwv/#3211/#2718 by name) -- verifying the newly-non-empty case (previously-headless cohort, now getting a fallback head for the first time) interacts correctly with ALL of that write-back logic needs careful tracing, not just the classifier function in isolation. The anti-vacuity test this bead requires (a case where naively wiring it in WOULD retire an accepted head) needs to exercise the REAL caller plumbing (batch.py or revision_backfill.py) end-to-end, or at minimum apply_raw_membership_classification directly, not just classify_membership_revisions alone, to be a genuine regression test rather than a toy that only proves the classifier's own internal logic.\n- Recommendation for the next session: implement the guarded wiring above, wire BOTH call sites (batch.py already computes accepted_head_raw_id; revision_backfill.py's head_raw_id needs the SAME unconditional pass-through regardless of the existing 'quarantined'-only absorption condition at line 1324, since the safety guard needs to know about a non-quarantined existing head too, to correctly refuse retiring it), then build the anti-vacuity test against apply_raw_membership_classification directly: construct a cohort with an existing accepted head H, an irreducible conflict among OTHER representatives that don't include H, where _maximal_evidence_fallback's own max() would pick a representative other than H -- prove the guarded classify_membership_revisions leaves accepted_raw_ids empty (refusing to retire H), then prove a second case where the fallback's pick DOES equal H and gets safely applied, and a third case with existing_accepted_raw_id=None where a previously-headless cohort gets its first head.\n\nSafety notes: no live archive mutation performed or attempted this session. PR #3588 is proven only against synthetic fixtures. Read polylogue-yla8/hjpx/lkrc/w32w in full before resuming (done this session) -- none of their landed protections were touched, duplicated, or bypassed.\n\nItem 5(b)(c) is already implemented and merged via PR #3630 (15c2e546c, merged 2026-08-03T10:08:43Z, earlier this session) -- the 2026-08-02 continuation note calling it open was stale. Guard is STRICTER than originally planned: refuses the fallback whenever ANY existing head is present (not just mismatched), because dev turned up a real regression where even same-raw_id re-affirmation silently downgraded accepted_frontier_kind/generation metadata (test_live_multi_session_divergence_reopens_raw_authority). Both call sites wired (sources/live/batch.py, sources/revision_backfill.py incl. unconditional head pass-through fix). Anti-vacuity tests against real production entry points confirmed: devtools test -k membership -\u003e 104 passed. Remaining scope for this bead = ONLY the live-drain-execution half (operator-supervised, still untouched, blocked on polylogue-9qnzy per its own AC2).\nLive drain dry-run executed 2026-08-03 (all 3 actuators, --json, no --apply): raw-membership-writeback-apply, raw-append-chain-backfill-apply, raw-byte-duplicate-supersession-apply all report scanned_count=0/promoted_count=0. Zero receipts exist in any of the 3 receipt tables (never run before), so this is not 'already applied' -- the narrow preconditions each actuator targets (already-decided-verdict-not-written-back / membershipless-provably-correct-append / byte-identical-duplicate-with-null-logical-key) simply no longer match any current row. The bead's 2026-08-02 measured backlogs (15,737 / 2,712 / 4,305 rows respectively) have evidently resolved or shifted since then, most likely via item 1's classifier improvements (PR #3574) plus ordinary daemon convergence over the following day -- not investigated further, would need a diff against the 2026-08-02 census to confirm exactly which mechanism closed each. Live archive currently shows 22,470 quarantined / 20,654 byte_proven raw_sessions rows -- the remaining quarantine mass is NOT covered by these 3 narrow actuators and needs the broader lkrc/hjpx reconciler (or its replacement per the operator's 2026-08-03 architectural redirect -- see polylogue-lkrc notes). Item 5's live-drain-execution half is now verified empty/non-actionable for these 3 specific actuators; nothing left to --apply.","status":"closed","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-02T16:00:43Z","created_by":"Sinity","updated_at":"2026-08-03T21:26:16Z","closed_at":"2026-08-03T21:26:16Z","close_reason":"All 5 items complete. Items 1-4 merged earlier (PRs #3574/#3577/#3588). Item 5(b)(c) merged via PR #3630 (guarded _maximal_evidence_fallback wiring, stricter than originally planned per a real regression it caught). Item 5's live-drain-execution half: all 3 actuators dry-run 2026-08-03, zero actionable rows for any (bead's 2026-08-02 backlogs of 15,737/2,712/4,305 rows have since resolved via item 1's classifier improvements + ordinary daemon convergence). Nothing left to --apply. Remaining live quarantine mass (22,470 rows) is out of this bead's narrow scope, tracked under lkrc/hjpx (currently being reconsidered per operator architectural redirect, 2026-08-03).","dependency_count":0,"dependent_count":5,"comment_count":0} {"_type":"issue","id":"polylogue-k45pq","title":"devtools lab schema generate --full-corpus never writes committed packages -- generate_all_schemas is unwired","description":"polylogue/schemas/generation/workflow.py:generate_provider_schema() (what \"devtools lab schema generate --provider X --full-corpus\" calls) only returns bundle.result and never calls persist_generated_provider_bundle(), the function that actually writes polylogue/schemas/providers/\u003cp\u003e/versions/... via SchemaRegistry.replace_provider_packages(). That write only happens inside generate_all_schemas(output_dir, ...), which has ZERO CLI/devtools wiring (grep confirms: only called from polylogue.demo.workspace for demo seeding and from tests/unit/core/test_schema_generation.py). Result: the documented \"correct entry point\" for regenerating committed schema packages from the live archive does not actually update them -- it silently no-ops on the committed files while printing plausible-looking generation output (sample_count, versions, suggested corpus specs), making a stale package invisible. Discovered 2026-08-02 when the operator was rightly suspicious that a 138-day-old package showed zero diff after a 30M-sample full-corpus regenerate.","design":"Fix: add a real CLI/devtools command (e.g. devtools lab schema promote-full-corpus --provider X, or extend generate with a --commit/--promote flag) that calls generate_all_schemas(output_dir=repo_root/\"polylogue/schemas/providers\", providers=[X]) for real, then verify via git diff + the existing diff_schema.py-style safety check before committing. Cross-check devtools lab schema promote (the --cluster-based path) is not secretly equivalent -- it operates on evidence clusters from --cluster mode, a different, single-version promotion shape, not a full-corpus multi-version replace.","status":"closed","priority":0,"issue_type":"bug","owner":"ezo.dev@gmail.com","created_at":"2026-08-02T10:22:32Z","created_by":"Sinity","updated_at":"2026-08-02T13:03:27Z","closed_at":"2026-08-02T13:03:27Z","close_reason":"Merged PR #3538: devtools lab schema commit (backed by polylogue.schemas.operator.commit.commit_provider_schema) actually calls generate_all_schemas for real and writes polylogue/schemas/providers/\u003cprovider\u003e/versions/... -- the missing persist path this bead described. Reports new/changed/unchanged per version, dry-run mode against a scratch copy, and defends against lost/narrowed leaf types via the shared type_narrowing.py extraction. Not yet RUN for real against any provider (deliberately held pending the u19l blobstore prune landing first, per operator sequencing decision) -- that's operational follow-up, not remaining code work.","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"polylogue-kadx3","title":"Daemon UDS socket path is machine-wide, not archive-scoped — CLI silently talks to the wrong archive","description":"Discovered live during PR #3517 perf work (g3jk lane, 2026-08-01): the daemon Unix domain socket path is derived from $XDG_RUNTIME_DIR/polylogue/daemon.sock with no archive-root component. A test/dev daemon pointed at a different archive is never actually reached by the CLI — any polylogue invocation on the same machine finds and talks to the live production daemon regardless of POLYLOGUE_ARCHIVE_ROOT or --archive-root. Worse: even explicit --no-daemon local execution through the real polylogue binary was observed ignoring POLYLOGUE_ARCHIVE_ROOT and serving results from the live personal archive during the lane agent's measurement work — real archive content leaked into agent shell output twice before the agent caught it and switched to an in-process/mocked-daemon harness. This extends the already-tracked polylogue-z9gh/polylogue-tas4 finding (same family: archive-root resolution not respected in some code path) but is a distinct, more severe manifestation: it means ANY agent or test running local devtools/CLI commands on this machine, believing it is isolated to POLYLOGUE_ARCHIVE_ROOT, may in fact be silently reading (and via other commands, potentially writing) the live production archive. No fix attempted by the discovering lane (out of its scope); needs dedicated investigation into (1) socket path derivation — should key off resolved archive root, not just XDG_RUNTIME_DIR, (2) the --no-daemon local path specifically, tracing why POLYLOGUE_ARCHIVE_ROOT was not honored there. Ref polylogue-z9gh, polylogue-tas4.","notes":"Addressed the bot's P2 finding on PR #3526: the archive-scoped path could exceed AF_UNIX's 107-byte sun_path limit for long XDG_RUNTIME_DIR values. daemon_socket_path now falls back to /tmp/polylogue-\u003cuid\u003e/\u003ckey\u003e.sock (still archive-scoped, always short) whenever the ordinary path would exceed the limit. New regression test reproduces the bot's exact 73-char case. Commit 7e43be76a, pushed to the same PR branch.","status":"closed","priority":0,"issue_type":"bug","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-01T13:01:00Z","created_by":"Sinity","updated_at":"2026-08-01T18:04:39Z","started_at":"2026-08-01T17:28:42Z","closed_at":"2026-08-01T18:04:39Z","close_reason":"Fixed via PR #3526 (merged): daemon_socket_path archive-scopes the UDS path, with a length-bounded fallback for the AF_UNIX limit.","comments":[{"id":"63d2c93e-8f9e-5884-af9c-1697bd14ff56","issue_id":"polylogue-kadx3","author":"Sinity","text":"PR #3526 (feature/fix/daemon-socket-archive-scope, not yet merged) closes the socket-scoping half of this bead.\n\nScope understood: (1) archive-scope the daemon UDS socket path so two daemons for different archives never collide, (2) investigate whether --no-daemon genuinely ignores POLYLOGUE_ARCHIVE_ROOT.\n\nWhat changed: new polylogue/daemon/socket_path.py derives $XDG_RUNTIME_DIR/polylogue/\u003csha256-key-of-resolved-archive-root\u003e/daemon.sock instead of the old unscoped $XDG_RUNTIME_DIR/polylogue/daemon.sock. Updated daemon/cli.py (startup), cli/archive_query.py, cli/click_app.py, cli/commands/facets.py (all 3 CLI daemon-probe call sites) to pass config.archive_root / archive_root_path -- the same value already used for /api/health probe matching, so probe and bind now use identical scoping.\n\n--no-daemon finding: could NOT reproduce as a separate defect. Live-reproduced against the actual CLI entry point (python3 with the worktree's own source on PYTHONPATH, avoiding the shared-venv editable-hijack hazard) with POLYLOGUE_ARCHIVE_ROOT pointed at a scratch dir, both with and without --no-daemon: in every case the CLI correctly looked for the scratch archive's own index.db and failed cleanly, never fell through to a real archive. This is consistent with polylogue/paths/_roots.py's existing archive-root scoping (polylogue-4ma3, polylogue-o7hx) and the hundreds of existing --no-daemon tests already isolated per-archive-root. My assessment: the observed leak in the discovering lane's harness is fully explained by the socket collision alone -- the harness must have reached the daemon-fallback path (not --no-daemon), and pre-fix that path could reach whichever daemon last stole the shared socket, i.e. the real production polylogued. No separate --no-daemon regression test was added since I could not confirm a real defect there (per the bead's own conditional instruction).\n\nVerification: new tests/unit/daemon/test_uds_socket_scoping.py (5 tests, including a live two-daemon-two-archive-roots-one-runtime-dir integration test proving no cross-talk/socket theft); devtools test across golden-parity + facets/click_app/archive_query/daemon_cli suites, 326 passed; devtools verify --quick exit 0 (had to register the new hashlib.sha256 call site in docs/plans/hash-boundary-registry.yaml as `identifier` classification, and regenerate docs/plans/topology-target.yaml for the new module).\n\nAcceptance criteria: (1) socket-path archive-scoping -- satisfied, PR #3526. (2) --no-daemon POLYLOGUE_ARCHIVE_ROOT-honoring gap -- investigated, not reproduced as a real defect; treating as explained by (1) rather than a distinct bug requiring its own fix.\n\nNot merging this PR myself per repo convention (agent-opened PRs still go through the merge-gate check before squash-merge).","created_at":"2026-08-01T17:29:04Z"}],"dependency_count":0,"dependent_count":0,"comment_count":1} @@ -144,7 +145,7 @@ {"_type":"issue","id":"polylogue-tf2.1","title":"Rerun forensics on current archive; price origin_reported providers","description":"Rerun scripts/agent_forensics.py against the current archive (v23+); price origin_reported providers via the vendored LiteLLM catalog (match last path segment); all-provider headline or explicitly-labeled per-provenance figures that cannot be misread; record deltas vs 06-27; verify chart SVGs render. Cache-inclusion must be disambiguated (Codex input INCLUDES cached ~96%; see bd memories). Also blocked on logical-session token attribution — the headline must not be double-counted.","notes":"Correction to close_reason monetary values: stored/provider-priced subset was $239,453.14; catalog API-equivalent was $318,650.88; origin_reported catalog estimate was $79,197.74. The original close_reason text lost dollar-prefixed digits due shell expansion, not measurement drift.","status":"closed","priority":0,"issue_type":"task","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-07-03T04:31:33Z","created_by":"Sinity","updated_at":"2026-07-31T22:35:43Z","started_at":"2026-07-03T09:28:10Z","closed_at":"2026-07-03T09:59:02Z","close_reason":"Completed with blocker caveat preserved: scripts/agent_forensics.py now prices origin_reported rows through the shared vendored LiteLLM pricing catalog while preserving stored provenance; report separates stored/provider-priced cost from catalog API-equivalent estimates and carries logical-session/cache caveats instead of claiming final billing reconciliation. Regenerated current artifact at .agent/demos/agent-forensics against /home/sinity/.local/share/polylogue schema v23: 16,498 physical sessions, 4,142,175 messages, 356.5B tokens, ,453.14 stored/provider-priced subset, ,650.88 catalog API-equivalent, and ,197.74 origin_reported catalog estimate. SVG parse check passed for 9 charts; devtools test tests/unit/scripts/test_agent_forensics.py passed; devtools verify --quick passed run 20260703T095718Z-quick-753466-96559776; devloop-review clean. Remaining final-reconciliation blocker stays open as polylogue-4ts.2.","labels":["area:usage","campaign"],"dependencies":[{"issue_id":"polylogue-tf2.1","depends_on_id":"polylogue-4ts.2","type":"blocks","created_at":"2026-07-03T06:32:45Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tf2.1","depends_on_id":"polylogue-sru.7","type":"blocks","created_at":"2026-07-03T06:31:33Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-tf2.1","depends_on_id":"polylogue-tf2","type":"parent-child","created_at":"2026-07-03T06:31:33Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":2,"dependent_count":2,"comment_count":0} {"_type":"issue","id":"polylogue-tf2","title":"Campaign: agent-forensics regeneration + all-provider repricing","description":"Regenerate the agent-forensics packet on the current archive with an honest all-provider headline. The 2026-06-27 report (546.6B tokens, $89,368 API-list equivalent, 216x cache amplification) is the most stranger-legible artifact on any shelf, but its numbers are pre-dedup stale and the headline prices only the priced-provenance subset (Claude Code cost_usd rows); Codex/ChatGPT/Gemini are origin_reported token counts with no dollar value (operator estimate ~$150K all-provider). Sequenced after claim-vs-evidence per operator direction 2026-07-02.","design":"Current slice design: turn the existing agent-forensics/cost headline into a product-backed all-provider repricing artifact. First inspect devtools/scripts and polylogue analyze surfaces for agent_forensics/cost code. Use active archive usage headline (detail=headline) for authoritative physical_session and logical_session_model_high_water token totals. Keep priced-provenance dollars and origin-reported token estimates separate: do not multiply every token by one blended price without a labeled lane. Add or reuse a shared pricing/projection helper so the demo artifact is regenerated from Polylogue product code, not ad hoc SQL. Acceptance for this slice: the generated agent-forensics artifact names archive root/schema, includes physical vs logical token grain, separates priced subset from origin-reported estimate lanes, gives reproduction commands, and has focused tests for any new repricing helper/surface.","acceptance_criteria":"Terminal state: regenerated forensics packet on the current archive with an honest all-provider headline (priced subset AND origin-reported estimate lanes separated), agent_forensics.py folded into polylogue analyze (tf2.2), artifact on the demo shelf with reproduction commands, cold-reader gate passed. Epic closes only when that artifact is recorded.","status":"closed","priority":0,"issue_type":"epic","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-07-03T04:31:32Z","created_by":"Sinity","updated_at":"2026-07-31T22:35:43Z","started_at":"2026-07-03T18:47:23Z","closed_at":"2026-07-03T19:06:44Z","close_reason":"Completed: provider usage headline now exposes product-backed pricing lanes in polylogue analyze usage --detail headline, separating stored/provider-priced cost from catalog API-equivalent estimates for origin_reported rows. Regenerated the current .agent/demos/agent-forensics artifact against /home/sinity/.local/share/polylogue schema v23: physical-session tokens 395,320,980,423; logical high-water tokens 288,741,229,728; stored/provider-priced USD 243,392.189328; catalog API-equivalent USD 337,565.031618; priced lane 13,889 rows / 12,331 sessions / 12,650 matched rows; origin_reported lane 2,308 rows / 2,270 sessions / 2,302 matched rows. Verification: live polylogue --plain analyze usage --detail headline --format json --limit 0 wrote /realm/tmp/polylogue-usage-headline-pricing-current.json; devtools test tests/unit/storage/test_provider_usage_report.py tests/unit/cli/test_diagnostics.py passed 23 tests; devtools verify --quick passed run 20260703T190553Z-quick-2226137-d91d4e8f; devtools workspace demo-shelf --json reported ok. Non-claim preserved: this is not final billing reconciliation and physical/logical token grains stay explicitly separated.","labels":["area:usage","campaign","size:M","spine"],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"polylogue-sru","title":"Campaign: claim-vs-evidence report to finding-grade","description":"Terminal state: an externally publishable finding ('how often do coding agents proceed past failed tool calls, by model/tool') with stated sample frame, calibrated markers, benign/consequential split, seeded stranger-runnable reproduction, and a passed cold-reader gate. Slice closure is NOT campaign closure; this epic stays top-of-frame until its terminal state is recorded.\\n\\nState as of 2026-07-03 after calibrated active-archive regeneration: archive root /home/sinity/.local/share/polylogue, index schema v23, 41,886 structured failures total, 5,000 origin-stratified failures inspected (3,746 claude-code-session, 1,247 codex-session, 7 claude-ai-export), 100 unpaired structured failures. Marker vocabulary was tightened to avoid broad issue/fix/block/gitignored false positives. Immediate next-turn totals: acknowledged=420, silent_proceed=1,205, ambiguous=3,375 (2,624 wordless tool continuations; 751 prose without marker). Lower-bound silent rate is 24.1%; among classified immediate next turns, silent rate is 74.2%. Next-3 sensitivity window, stopping before the next user message, finds 302 acknowledgments that appear only after the next turn; window3 silent lower bound is 37.0%. Calibration: 50 hand-labeled immediate-next-turn rows, acknowledged-marker precision=1.0, recall=0.8421052631578947, invalid rows=0. Artifact: .agent/demos/claim-vs-evidence/claim-vs-evidence.report.json.","notes":"2026-07-03 update: methodology package is now cold-read gated. .agent/demos/claim-vs-evidence contains aggregate live evidence, public-summary.json, PUBLIC_REPRODUCTION.md, COLD_READER_GATE.md, and COLD_READ_RESULT.md. Seeded reproduction is meaningful, not empty: 4 structured failures, 2 acknowledged follow-ups, 2 silent-proceed follow-ups, 0 unpaired. Cold-reader subagent PASS recovered claim/non-claim, sample frame, rates, calibration, caveats, and reproduction commands from the artifact directory only. Remaining campaign child: polylogue-sru.1 productizes action-unit outcome/followup_class capability.","status":"closed","priority":0,"issue_type":"epic","owner":"ezo.dev@gmail.com","created_at":"2026-07-03T04:31:26Z","created_by":"Sinity","updated_at":"2026-07-31T22:35:43Z","closed_at":"2026-07-03T09:28:09Z","close_reason":"Completed: all seven campaign children are closed. The claim-vs-evidence finding now has bounded sample-frame reporting, calibrated marker precision/recall, handler-class and next-3 sensitivity splits, meaningful seeded reproduction, cold-reader PASS, and productized action-unit followup_class/followup_message_ref query capability. Current artifact lives under .agent/demos/claim-vs-evidence and was regenerated against /home/sinity/.local/share/polylogue schema v23.","labels":["area:substrate","campaign"],"dependency_count":0,"dependent_count":0,"comment_count":0} -{"_type":"issue","id":"polylogue-z7sv3","title":"Make PR scope CI authority immutable at the base revision","description":"The first structured PR-scope carrier landed a green CI gate, but the validator still executes from the PR checkout and CircleCI can lack CIRCLE_PULL_REQUEST. Harden the process boundary so a pull request cannot weaken the validator it is being judged by.","design":"Modify devtools/pr_scope.py to resolve repository and PR metadata through GitHub REST, validate exact checkout/head identity, fetch the base revision validator, and run it in an isolated subprocess. Extend CircleCI quick-gate to call check-ci with CIRCLE_SHA1 and repo metadata. Make merge receipts bind scope_digest, beads_digest, and assigned IDs, and pass --match-head-commit to gh pr merge. Add unit coverage for no-PR-URL resolution, base-validator authority, schema rejection, receipt drift, and stale-head refusal. Remove the natural-language PR state guard and update lane/CI documentation.","acceptance_criteria":"1. CircleCI validates the exact checkout head and resolves the unique open PR when CIRCLE_PULL_REQUEST is absent. 2. When the base revision already contains pr_scope.py, CI executes that base validator rather than the PR-modified validator. 3. The carrier schema rejects unknown fields and merge receipts bind scope digest, Bead digest, and assigned Bead IDs. 4. The prose-parsing PR state guard is removed or replaced by structured validation. 5. Focused tests and devtools verify --quick pass.","status":"open","priority":1,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T06:44:24Z","created_by":"Sinity","updated_at":"2026-08-06T06:44:34Z","dependency_count":0,"dependent_count":1,"comment_count":0} +{"_type":"issue","id":"polylogue-z7sv3","title":"Make PR scope CI authority immutable at the base revision","description":"The first structured PR-scope carrier landed a green CI gate, but the validator still executes from the PR checkout and CircleCI can lack CIRCLE_PULL_REQUEST. Harden the process boundary so a pull request cannot weaken the validator it is being judged by.","design":"Modify devtools/pr_scope.py to resolve repository and PR metadata through GitHub REST, validate exact checkout/head identity, fetch the base revision validator, and run it in an isolated subprocess. Extend CircleCI quick-gate to call check-ci with CIRCLE_SHA1 and repo metadata. Make merge receipts bind scope_digest, beads_digest, and assigned IDs, and pass --match-head-commit to gh pr merge. Add unit coverage for no-PR-URL resolution, base-validator authority, schema rejection, receipt drift, and stale-head refusal. Remove the natural-language PR state guard and update lane/CI documentation.","acceptance_criteria":"1. CircleCI validates the exact checkout head and resolves the unique open PR when CIRCLE_PULL_REQUEST is absent. 2. When the base revision already contains pr_scope.py, CI executes that base validator rather than the PR-modified validator. 3. The carrier schema rejects unknown fields and merge receipts bind scope digest, Bead digest, and assigned Bead IDs. 4. The prose-parsing PR state guard is removed or replaced by structured validation. 5. Focused tests and devtools verify --quick pass.","status":"closed","priority":1,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T06:44:24Z","created_by":"Sinity","updated_at":"2026-08-06T08:02:57Z","closed_at":"2026-08-06T08:02:57Z","close_reason":"Merged in PR #3848 as 685f2ca8. The base-revision validator, exact-head and repository binding, draft/no-open-PR handling, structured carrier schema, graph-linked residual validation, merge receipt binding, CircleCI check-ci integration, CI diagnostics, focused tests, quick verification, and coordinator publication-order rule are present. The merge-train full-suite ledger remains open separately; this Bead does not claim archive or campaign convergence.","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-taj0o","title":"Unify Claude Code eager and streaming parsers into one incremental multi-way merge","design":"Root architectural cause behind polylogue-4987i (session_events ordering\ninstability), which was fixed tactically in PR #3669 via a reconciliation\npass, not fixed structurally.\n\nCurrent design (path dependence, not principled):\n- Eager (parse_payload -\u003e dispatch.py grouping -\u003e _parse_code_records):\n materializes the ENTIRE raw JSONL payload into memory, groups ALL records\n by sessionId across the whole file (a complete partition, independent of\n file order), THEN feeds each session's full record list to\n _parse_code_records as one coherent single pass. Correct by construction\n because the parser never sees interleaving -- an earlier full-materialize\n step already removed it.\n- Streaming (parse_stream_payload -\u003e _claude_code_stream_sessions,\n dispatch.py:824): exists because raw JSONL ingest can be multi-GiB and\n can't be buffered wholesale. Instead of a true incremental multi-way\n merge, it takes a shortcut: detect CONTIGUOUS runs of the same sessionId\n and treat each run as an independent mini-file, reusing the exact same\n per-session \"I see the whole session at once\" parser\n (_parse_code_records via parse_code_stream) UNMODIFIED on each run. Chunks\n are then concatenated (merge_parsed_session_chunks) and reconciled after\n the fact (reconcile_code_session_chunks) to approximate what eager would\n have produced.\n\nWhy this is the wrong shape: reconcile_code_session_chunks has to\nre-implement, after the fact, every piece of session-wide accumulation\n_parse_code_records already does in its main loop (background-completion\ndedup, delegation-progress tick summation, coverage count summation,\nsession-wide event ordering) -- and every time a NEW session-wide summary\nevent type is added to the eager parser's main loop (which has happened\nseveral times, per its own comments: polylogue-pbuh AC5's coverage event,\ndelegation-progress events, session_kind), reconcile_code_session_chunks has\nto be remembered and updated to fold it too, or the same class of\neager-vs-streaming divergence bug recurs for the new event type. #3669 fixed\nthe THREE known cases; nothing prevents a fourth from being added without\nanyone updating reconcile. This is a structural bug-factory, not a one-off.\n\nProposed fix: replace both _claude_code_stream_sessions' contiguous-run\nchunking AND the eager grouping-then-parse call in dispatch.py's non-stream\npath with ONE incremental multi-way merge:\n- Walk the record stream exactly once, in file order (regardless of size).\n- Maintain a dict of open per-session accumulator state, keyed by session\n id -- the SAME state _parse_code_records currently builds up locally\n during its single-session main loop (messages, session_events-in-progress,\n delegation_progress dict, coverage counters, etc.), but keyed per session\n instead of assumed-singular.\n- Fold each record into its session's accumulator as it streams past\n (exactly the same per-record logic _parse_code_records already has, just\n addressed by session id instead of implicit \"the one session\").\n- Finalize (emit ParsedSession, apply order_session_events, run the\n post-loop coverage/background/delegation appends) a session's accumulator\n only when the stream ends (or, for true bounded-memory operation on\n extremely long-lived files, on an explicit flush signal -- out of scope\n for a first cut, current per-run memory is already \"proportional to\n unique record identifiers\" per _claude_code_stream_sessions' own\n docstring, i.e. already bounded well below full-file materialization).\n- Eager's dispatch.py grouping call and streaming's chunk-and-glue\n machinery both become this ONE function. reconcile_code_session_chunks,\n merge_parsed_session_chunks' claude-code-specific glue, and the\n eager/streaming duality in general are deleted, not deprecated\n (automagic-invariants doctrine: no break-glass tier once one path proven\n to correctly subsume the other).\n\nKnown hazards to preserve (read before touching):\n- Identity/carryover resolution (bd polylogue-jc4q, dispatch.py:848-863):\n contiguous-run-based primary/carryover detection for resume/fork/quirk\n boundaries. A multi-way merge needs the equivalent notion (which record\n run is THIS file's own primary content vs an ancestor's carryover\n prefix) re-derived under session-keyed accumulation, not run-keyed.\n Get this wrong and the fix reintroduces the exact bug this session's\n polylogue-slshy/polylogue-2hwl active-leaf-by-position lineage fixed.\n- Tool-result sidecar streaming join (polylogue-wjgf): currently teed\n through ToolResultIndexAccumulator per contiguous run, joined once a\n run's iterator is exhausted. Needs to become per-session-accumulator\n scoped instead of per-run scoped.\n- is_agent / agent-* fallback id special-casing (dispatch.py:878-882).\n- Sidecar join for the eager path (join_tool_result_sidecars, needs the\n full tool_use_id index) currently assumes full materialization; the\n merged design should reuse the SAME per-session-scoped join the\n streaming path already does, not the eager whole-file index -- one\n fewer thing that can diverge.\n\nScope note: this is a genuine parser-core rewrite of the hottest path in\nthe codebase (every Claude Code session, live and reindexed, goes through\nit). Do NOT attempt as a quick patch; needs its own dedicated session with\nfull regression coverage of tests/unit/sources/test_claude_code_normalization_laws.py,\ntest_claude_code_sidecar_evidence.py, test_parsers_claude_code_artifacts.py,\ntest_delegation_provider_fixtures.py, and a live-archive parity spot-check\n(parse every real multi-chunk/subagent-interleaved session in the archive\nboth ways, old vs new, before/after, diff zero).\n","notes":"ADDITIONAL FINDING (2026-08-03): this is a THREE-way duplication, not two. dispatch.py's eager grouping (_claude_code_grouped_record_specs, line 671) defines \"primary group\" as the group with the MOST records: `primary_group_id = max(groups, key=lambda group_id: len(groups[group_id]))`. Streaming's chunking (_claude_code_stream_sessions, line 948) defines primary as the group whose session_id equals the caller-supplied fallback_id: `is_primary_group = group_session_id == fallback_id`. These are NOT provably equivalent -- a file where the fallback_id-matching session has fewer records than another interleaved session in the same file would resolve differently under eager vs streaming.\n\nLive-archive check (read-only, source.db mode=ro): sampled 400 claude-code-session raw_sessions rows sized 200KB-5MB, zero contained \u003e1 distinct sessionId (i.e. zero genuinely session-interleaved files in that sample). Separately checked all 12 blob_hash values shared across \u003e1 distinct native_id in the whole archive -- these turned out to be a DIFFERENT, already-known phenomenon (polylogue-omsw's file-history-snapshot/artifact classification duplication, not sessionId-based session interleaving; the shared blobs contain zero \"sessionId\" fields at all). So: no live confirmed case of the eager/streaming primary-definition mismatch actually diverging on this archive today, but the code-level divergence is real and provable by inspection, not hypothetical -- it just hasn't been hit yet, or the two algorithms happen to agree in every case seen so far (files where the fallback_id-matching session also happens to have the most records, which is the common/expected shape).\n\nThis changes the design target for the unification: it's not just \"collapse eager-loop-state vs streaming-chunk-state into one accumulator\" (the code_parser.py duality already scoped), it ALSO needs ONE canonical \"which interleaved session is this file's own primary content\" algorithm shared by both paths, replacing both dispatch.py:671's max-by-count and dispatch.py:948's fallback_id-match (need to decide which definition, or a new one, is actually correct -- likely fallback_id-match, since that's grounded in the caller's own knowledge of which file this is, whereas max-by-count is a heuristic that could pick the WRONG group for a small main session with a huge subagent transcript in the same file).\n\nDecision: scoped as a dedicated lane dispatch (agent-executed, worktree-isolated, execution-grade design already documented above + this note) rather than attempted serially inline, per this repo's own orchestration doctrine and operator's earlier explicit correction this session (\"why are you not orchestrating anymore\"). Not a deferral -- dispatching now, in parallel with continued campaign work.\nStage 1 merged 2026-08-03 (PR #3680): _SessionAccumulator dataclass extraction from _parse_code_records, mechanical, zero behavior change (verified: rebased onto post-4987i master, full named regression suite 373/373 passed, mypy --strict clean). Stage 2 (the actual multi-way merge: key by session id, resolve the eager-vs-streaming primary-definition conflict, delete reconcile_code_session_chunks/merge_parsed_session_chunks's Claude-Code branch/_claude_code_stream_sessions/_claude_code_grouped_record_specs) remains open -- Stage 1 sets up the exact accumulator shape Stage 2 needs but does not itself unify eager/streaming. Bead stays open.","status":"closed","priority":1,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T18:41:03Z","created_by":"Sinity","updated_at":"2026-08-05T07:26:34Z","closed_at":"2026-08-05T07:26:34Z","close_reason":"Stage 2 already merged as 25434d0f0 (#3691): one incremental multi-way Claude Code accumulator with canonical fallback-id primary selection replaces eager/streaming duality. The named parity suites passed (480) and quick verification is recorded.","dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"polylogue-gbs02","title":"Acquire-only degraded mode: index-tier mismatch must not park raw acquisition","description":"Found closing mhx95 (2026-08-03). After deploy+source-migration, the daemon (current master) parks ALL 16 loops INCLUDING the live watcher on 'index.db:46!=57' — but acquisition writes only source.db, which is current (v24). Consequence: zero ingestion until 818fy runs, for no durable-tier reason; browser-capture/hook spools accumulate unprocessed and time-sensitive captures wait on a derived-tier rebuild. Fix shape: schema preflight distinguishes durable-tier mismatch (park everything — correct) from derived-only mismatch (run acquisition + spool drains + source-tier loops; park parse/materialize/index-writing loops). The parked-loop log line already enumerates loops, so the split is a classification over the existing registry. AC: with index.db deliberately at an old version and source.db current, the daemon acquires new raws (source.db row appears; spool drains) while materialization stays parked and health still reports the index mismatch. Falsification: revert the classification and the acquire test freezes again. Ref mhx95 evidence trail.","notes":"\n2026-08-03 design investigation (no code change -- this needs careful per-loop classification before touching live daemon startup sequencing, not a quick patch):\n\nCurrent structure (polylogue/daemon/cli.py ~2148-2191, health.py:341 _check_schema_version_fast):\n- _check_schema_version_fast() computes ONE aggregate severity across ALL tiers (source/index/embeddings/user/ops) with no per-tier durability distinction in its return value (HealthAlert has no detail/tier-breakdown field) -- it correctly reports CRITICAL whenever ANY tier's user_version mismatches, and the AC explicitly wants this UNCHANGED (\"health still reports the index mismatch\").\n- watcher_blocked = enable_watch and schema_alert.severity == CRITICAL currently gates BOTH the live watcher AND all 14 named loops in _SCHEMA_BLOCKED_MAINTENANCE_LOOP_NAMES via one shared `if not watcher_blocked:` block (cli.py ~2253+) -- they start together or not at all.\n\nThe fix needs TWO independent gates, not a narrowed version of the existing one:\n1. A new, SEPARATE durable-tier-only check (source.db + user.db, durability in {\"irreplaceable\",\"human\"} per ARCHIVE_TIER_SPECS) -- call it durable_mismatch. Only THIS should gate the live watcher + acquisition/spool-drain loops (the AC's \"source-tier loops\"). Add as a new function alongside _check_schema_version_fast, not a modification to it (that function's HealthAlert-typed return is consumed elsewhere for periodic health reporting and must keep reporting the FULL aggregate severity, per the AC).\n2. The EXISTING aggregate check (any tier, i.e. current behavior) must keep gating every loop that writes a derived tier (index.db/embeddings.db) -- raw materialization convergence, session insight convergence, convergence debt retry, embedding backlog catch-up, embedding orphan reconcile, fts merge, fts identity drift recompute, fts orphan audit, db optimize (likely index-tier VACUUM/ANALYZE) -- these must NOT start on a stale index.db even once gate 1 is relaxed.\n\nPer-loop classification still needed (NOT done this session -- each of the 14 names in _SCHEMA_BLOCKED_MAINTENANCE_LOOP_NAMES needs its actual write-tier confirmed by reading its implementation, not guessed from its name):\n- Likely index/embeddings-tier (must stay gated on ANY mismatch): raw materialization convergence, session insight convergence, convergence debt retry, embedding backlog catch-up, embedding orphan reconcile, fts merge, fts identity drift recompute, fts orphan audit, db optimize, judgment automation sweep (uses embeddings for judgment scoring, verify).\n- Likely source-tier-only or tier-agnostic (candidates to move to gate 1, i.e. safe to run on derived-only mismatch): wal checkpoint (verify which db(s) it checkpoints), heartbeat, status snapshot refresh (verify what it snapshots), blob gc check (blob store is source-tier), secret scan sweep (likely scans raw content = source-tier).\n- drive source catch-up (_SCHEMA_BLOCKED_OPTIONAL_DRIVE_CATCHUP_LOOP_NAME): acquisition-adjacent, likely gate-1 candidate.\n\nRisk if this is done wrong: a loop incorrectly reclassified as \"safe\" that actually writes index.db against a stale schema could silently corrupt the live production index during exactly the highest-stakes window (mid-reindex-campaign). This needs the per-loop write-tier confirmed by reading each loop's actual body, then a real test proving the split (per this bead's own AC: index.db old + source.db current -\u003e watcher runs + source.db row appears, materialization loops provably don't start), not inferred from loop names. Left for a dedicated implementation pass with that verification, not attempted blind in this session.","status":"closed","priority":1,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T16:09:27Z","created_by":"Sinity","updated_at":"2026-08-03T17:00:10Z","closed_at":"2026-08-03T17:00:10Z","close_reason":"Implemented acquire-only degraded mode: DegradedReason.derived_only flag + is_fully_degraded() (core/degraded.py), durable_tier_schema_mismatch() narrow check (daemon/health.py), two-gate split in daemon/cli.py (watcher_blocked for maintenance loops, watcher_creation_blocked for the watcher itself), acquire-then-skip-parse in both batch.py and append_ingest.py (the primary tailed-file path, which had no degraded check at all before). Regression test proves the exact AC (raw acquired, parsed_at_ms NULL, no parse_error). Commit cb60c02a3, devtools test 2211 passed (2 pre-existing load-flaky failures unrelated).","dependencies":[{"issue_id":"polylogue-gbs02","depends_on_id":"polylogue-9qnzy","type":"relates-to","created_at":"2026-08-03T18:23:53Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0} {"_type":"issue","id":"polylogue-0v4tn","title":"blob_refs GC oracle broken: 73,427 raw_payload + 1,336 attachment refs orphaned (hook-deinflation residue)","description":"Baseline census 2026-08-03 (invariant I3): 73,427 of 116,149 raw_payload blob_refs and ALL 1,336 attachment blob_refs have ref_ids that no longer resolve in their referent tables — overwhelmingly the hook-deinflation residue (64,896 raw_sessions rows deleted 2026-07-22 without pruning their blob_refs; same class as closed i3zo for raw_authority_plans). Consequences: (a) blob GC's snapshot-reference safety check treats ~73K blobs as referenced forever — GC can never collect them; (b) any 'blobstore pristine / no weirdness' claim (r9xsj) is false while the reference substrate lies. Blob FILES are fine (300/300 + 100/100 presence samples pass); this is bookkeeping-tier. Fix shape: set-based orphan identification (LEFT JOIN refs to referents) + prune in one guarded pass with a receipt, mirroring i3zo/PR #3530's pattern; then re-run I3 to 0. Attachment refs need their own referent-table check first — determine what ref_id should point at (attachment_refs moved tiers historically) before deleting anything. Baseline artifact: .agent/scratch/reindex-baseline-2026-08-03.md.","status":"in_progress","priority":1,"issue_type":"bug","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-03T15:39:48Z","created_by":"Sinity","updated_at":"2026-08-05T05:25:03Z","started_at":"2026-08-05T05:25:03Z","lease_expires_at":"2026-08-05T05:30:03Z","heartbeat_at":"2026-08-05T05:25:03Z","dependency_count":0,"dependent_count":1,"comment_count":0} From a2ec4d8fbff5b19bed843df15f269f58b6881580 Mon Sep 17 00:00:00 2001 From: Sinity Date: Thu, 6 Aug 2026 12:03:48 +0200 Subject: [PATCH 2/5] chore(beads): record schema gate carrier evidence Problem: the schema-gate tracker publication needs a durable record of the corrected full-head carrier and implementation handoff.\n\nWhat changed: append the PR and implementation evidence to polylogue-dudtn while keeping live migration under polylogue-9qnzy and polylogue-a7gmk.\n\nRef polylogue-dudtn. --- .beads/issues.jsonl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl index efb066c4b..9313feaa9 100644 --- a/.beads/issues.jsonl +++ b/.beads/issues.jsonl @@ -1,4 +1,4 @@ -{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T09:50:03Z","dependency_count":0,"dependent_count":1,"comment_count":0} +{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T10:03:39Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-06T05:48:17Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-pr-scope-contract","title":"PR scope carrier and executable merge contract","description":"Replace prose-only PR process assumptions with a structured carrier that tells automated review and merge gates the exact Beads scope, disposition, evidence, and residual successor state. The carrier must be bound to the PR head and canonical Beads snapshot and must be consumed by the existing CircleCI and merge-boundary machinery.","design":"Use a versioned JSON carrier embedded in the PR body. Keep Bead acceptance criteria human-readable and do not parse prose. Validate whole-Bead dispositions, assigned IDs, head SHA, Beads snapshot digest, evidence references, and successor IDs for partial work. Make render and check commands part of devtools workspace and bind the carrier digest into merge-gate receipts.","acceptance_criteria":"1. A versioned PR scope carrier schema and renderer/checker exist under devtools and are reachable through the existing workspace command surface. 2. The checker rejects missing or malformed carriers, wrong head SHA, missing assigned Beads, stale Beads digest, unknown or closed successor IDs, and partial dispositions without named successors. 3. CircleCI quick-gate and the actual merge boundary validate the carrier and record its digest in the existing merge-gate receipt. 4. The PR template and lane definitions instruct fresh lanes to emit a non-draft carrier-backed PR with Summary, Problem, Solution, Verification, and per-Bead disposition matrix. 5. Focused tests exercise production command paths and anti-vacuity mutations. 6. No machine gate parses PR prose or Bead acceptance prose.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:16Z","created_by":"Sinity","updated_at":"2026-08-06T05:35:16Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-canonical-snapshot","title":"test harness: compare canonical archive snapshots across all reindex routes","description":"Provide one comparator for rrxe4, 0x7nh, incident fixtures, and promotion, covering canonical rows, provenance, authority, links, attachments, derived views, and representative public projections.","design":"Do not create a second archive semantics engine. Normalize through an explicit allowlist and preserve semantic timestamps and provider identity.","acceptance_criteria":"Only explicit run-local fields are normalized. Mutating material origin, link status, provenance, or action-result state fails. The same comparator is used by route equivalence, crash recovery, and promotion proof tests.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:15Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:15Z","dependency_count":0,"dependent_count":2,"comment_count":0} From 3276f24be22f03b806be37743207f440e974f417 Mon Sep 17 00:00:00 2001 From: Sinity Date: Thu, 6 Aug 2026 12:11:57 +0200 Subject: [PATCH 3/5] chore(beads): bind schema gate carrier commit Problem: the CI run for the tracker publication started before the corrected carrier body was visible.\n\nWhat changed: record the publication commit and exact carrier synchronization in polylogue-dudtn so the next run has one durable evidence chain.\n\nRef polylogue-dudtn. --- .beads/issues.jsonl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl index 9313feaa9..d644f9e63 100644 --- a/.beads/issues.jsonl +++ b/.beads/issues.jsonl @@ -1,4 +1,4 @@ -{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T10:03:39Z","dependency_count":0,"dependent_count":1,"comment_count":0} +{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.\nCarrier publication commit is now a2ec4d8fbff5b19bed843df15f269f58b6881580; the PR body carrier is regenerated against that exact head and the committed branch snapshot.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T10:11:56Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-06T05:48:17Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-pr-scope-contract","title":"PR scope carrier and executable merge contract","description":"Replace prose-only PR process assumptions with a structured carrier that tells automated review and merge gates the exact Beads scope, disposition, evidence, and residual successor state. The carrier must be bound to the PR head and canonical Beads snapshot and must be consumed by the existing CircleCI and merge-boundary machinery.","design":"Use a versioned JSON carrier embedded in the PR body. Keep Bead acceptance criteria human-readable and do not parse prose. Validate whole-Bead dispositions, assigned IDs, head SHA, Beads snapshot digest, evidence references, and successor IDs for partial work. Make render and check commands part of devtools workspace and bind the carrier digest into merge-gate receipts.","acceptance_criteria":"1. A versioned PR scope carrier schema and renderer/checker exist under devtools and are reachable through the existing workspace command surface. 2. The checker rejects missing or malformed carriers, wrong head SHA, missing assigned Beads, stale Beads digest, unknown or closed successor IDs, and partial dispositions without named successors. 3. CircleCI quick-gate and the actual merge boundary validate the carrier and record its digest in the existing merge-gate receipt. 4. The PR template and lane definitions instruct fresh lanes to emit a non-draft carrier-backed PR with Summary, Problem, Solution, Verification, and per-Bead disposition matrix. 5. Focused tests exercise production command paths and anti-vacuity mutations. 6. No machine gate parses PR prose or Bead acceptance prose.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:16Z","created_by":"Sinity","updated_at":"2026-08-06T05:35:16Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-canonical-snapshot","title":"test harness: compare canonical archive snapshots across all reindex routes","description":"Provide one comparator for rrxe4, 0x7nh, incident fixtures, and promotion, covering canonical rows, provenance, authority, links, attachments, derived views, and representative public projections.","design":"Do not create a second archive semantics engine. Normalize through an explicit allowlist and preserve semantic timestamps and provider identity.","acceptance_criteria":"Only explicit run-local fields are normalized. Mutating material origin, link status, provenance, or action-result state fails. The same comparator is used by route equivalence, crash recovery, and promotion proof tests.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:15Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:15Z","dependency_count":0,"dependent_count":2,"comment_count":0} From 7e0d57cd050f8ed3b6ba9b638e39ba2bbcf5aa63 Mon Sep 17 00:00:00 2001 From: Sinity Date: Thu, 6 Aug 2026 12:13:23 +0200 Subject: [PATCH 4/5] chore(beads): document carrier publication ordering Problem: Circle validates the PR body at push time, so post-push carrier edits leave one stale run.\n\nWhat changed: record the sequencing correction in the durable implementation Bead before the next publication push.\n\nRef polylogue-dudtn. --- .beads/issues.jsonl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl index d644f9e63..a89c414c7 100644 --- a/.beads/issues.jsonl +++ b/.beads/issues.jsonl @@ -1,4 +1,4 @@ -{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.\nCarrier publication commit is now a2ec4d8fbff5b19bed843df15f269f58b6881580; the PR body carrier is regenerated against that exact head and the committed branch snapshot.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T10:11:56Z","dependency_count":0,"dependent_count":1,"comment_count":0} +{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.\nCarrier publication commit is now a2ec4d8fbff5b19bed843df15f269f58b6881580; the PR body carrier is regenerated against that exact head and the committed branch snapshot.\nCI publication sequencing correction 2026-08-06: prepare the next exact-head carrier before pushing its commit, because Circle validates the PR body at push-trigger time.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T10:13:23Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-06T05:48:17Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-pr-scope-contract","title":"PR scope carrier and executable merge contract","description":"Replace prose-only PR process assumptions with a structured carrier that tells automated review and merge gates the exact Beads scope, disposition, evidence, and residual successor state. The carrier must be bound to the PR head and canonical Beads snapshot and must be consumed by the existing CircleCI and merge-boundary machinery.","design":"Use a versioned JSON carrier embedded in the PR body. Keep Bead acceptance criteria human-readable and do not parse prose. Validate whole-Bead dispositions, assigned IDs, head SHA, Beads snapshot digest, evidence references, and successor IDs for partial work. Make render and check commands part of devtools workspace and bind the carrier digest into merge-gate receipts.","acceptance_criteria":"1. A versioned PR scope carrier schema and renderer/checker exist under devtools and are reachable through the existing workspace command surface. 2. The checker rejects missing or malformed carriers, wrong head SHA, missing assigned Beads, stale Beads digest, unknown or closed successor IDs, and partial dispositions without named successors. 3. CircleCI quick-gate and the actual merge boundary validate the carrier and record its digest in the existing merge-gate receipt. 4. The PR template and lane definitions instruct fresh lanes to emit a non-draft carrier-backed PR with Summary, Problem, Solution, Verification, and per-Bead disposition matrix. 5. Focused tests exercise production command paths and anti-vacuity mutations. 6. No machine gate parses PR prose or Bead acceptance prose.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:16Z","created_by":"Sinity","updated_at":"2026-08-06T05:35:16Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-canonical-snapshot","title":"test harness: compare canonical archive snapshots across all reindex routes","description":"Provide one comparator for rrxe4, 0x7nh, incident fixtures, and promotion, covering canonical rows, provenance, authority, links, attachments, derived views, and representative public projections.","design":"Do not create a second archive semantics engine. Normalize through an explicit allowlist and preserve semantic timestamps and provider identity.","acceptance_criteria":"Only explicit run-local fields are normalized. Mutating material origin, link status, provenance, or action-result state fails. The same comparator is used by route equivalence, crash recovery, and promotion proof tests.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:15Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:15Z","dependency_count":0,"dependent_count":2,"comment_count":0} From 66b1bf3d7cecbbf04b5b886a41a3d82d8c7c436c Mon Sep 17 00:00:00 2001 From: Sinity Date: Thu, 6 Aug 2026 12:16:07 +0200 Subject: [PATCH 5/5] chore(beads): record final carrier sequencing receipt Problem: push-triggered validation must observe the exact published carrier.\n\nWhat changed: preserve the final sequencing receipt with the schema gate implementation authority.\n\nRef polylogue-dudtn. --- .beads/issues.jsonl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.beads/issues.jsonl b/.beads/issues.jsonl index a89c414c7..1dad29624 100644 --- a/.beads/issues.jsonl +++ b/.beads/issues.jsonl @@ -1,4 +1,4 @@ -{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.\nCarrier publication commit is now a2ec4d8fbff5b19bed843df15f269f58b6881580; the PR body carrier is regenerated against that exact head and the committed branch snapshot.\nCI publication sequencing correction 2026-08-06: prepare the next exact-head carrier before pushing its commit, because Circle validates the PR body at push-trigger time.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T10:13:23Z","dependency_count":0,"dependent_count":1,"comment_count":0} +{"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\\n\\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\\n\\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\\n\\nAcceptance criteria:\\n1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\\n3. Daemon bulk entry checks before transaction bookkeeping.\\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\\n6. File-backed regression tests exercise every guard and the quick gate passes.\\n7. No production database mutation is performed by this implementation Bead; live migration and deployment remain polylogue-9qnzy/a7gmk scope.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. All canonical durable migration tiers are checked.\\n2. Early and post-ownership local guards are tested.\\n3. Daemon bulk is guarded before bookkeeping.\\n4. Empty-source and daemon preflight CLI paths are guarded.\\n5. HTTP returns the structured conflict diagnostic.\\n6. Focused regressions and devtools verify --quick pass.\\n7. Live migrations are explicitly out of scope and remain open under polylogue-9qnzy.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.\nCarrier publication commit is now a2ec4d8fbff5b19bed843df15f269f58b6881580; the PR body carrier is regenerated against that exact head and the committed branch snapshot.\nCI publication sequencing correction 2026-08-06: prepare the next exact-head carrier before pushing its commit, because Circle validates the PR body at push-trigger time.\nFinal carrier sequencing receipt 2026-08-06: the next PR head will be pushed only after its exact carrier has been published in the PR body; this prevents a stale push-triggered validation.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T10:16:07Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-06T05:48:17Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-pr-scope-contract","title":"PR scope carrier and executable merge contract","description":"Replace prose-only PR process assumptions with a structured carrier that tells automated review and merge gates the exact Beads scope, disposition, evidence, and residual successor state. The carrier must be bound to the PR head and canonical Beads snapshot and must be consumed by the existing CircleCI and merge-boundary machinery.","design":"Use a versioned JSON carrier embedded in the PR body. Keep Bead acceptance criteria human-readable and do not parse prose. Validate whole-Bead dispositions, assigned IDs, head SHA, Beads snapshot digest, evidence references, and successor IDs for partial work. Make render and check commands part of devtools workspace and bind the carrier digest into merge-gate receipts.","acceptance_criteria":"1. A versioned PR scope carrier schema and renderer/checker exist under devtools and are reachable through the existing workspace command surface. 2. The checker rejects missing or malformed carriers, wrong head SHA, missing assigned Beads, stale Beads digest, unknown or closed successor IDs, and partial dispositions without named successors. 3. CircleCI quick-gate and the actual merge boundary validate the carrier and record its digest in the existing merge-gate receipt. 4. The PR template and lane definitions instruct fresh lanes to emit a non-draft carrier-backed PR with Summary, Problem, Solution, Verification, and per-Bead disposition matrix. 5. Focused tests exercise production command paths and anti-vacuity mutations. 6. No machine gate parses PR prose or Bead acceptance prose.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:16Z","created_by":"Sinity","updated_at":"2026-08-06T05:35:16Z","dependency_count":0,"dependent_count":1,"comment_count":0} {"_type":"issue","id":"polylogue-canonical-snapshot","title":"test harness: compare canonical archive snapshots across all reindex routes","description":"Provide one comparator for rrxe4, 0x7nh, incident fixtures, and promotion, covering canonical rows, provenance, authority, links, attachments, derived views, and representative public projections.","design":"Do not create a second archive semantics engine. Normalize through an explicit allowlist and preserve semantic timestamps and provider identity.","acceptance_criteria":"Only explicit run-local fields are normalized. Mutating material origin, link status, provenance, or action-result state fails. The same comparator is used by route equivalence, crash recovery, and promotion proof tests.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:00:15Z","created_by":"Sinity","updated_at":"2026-08-06T05:00:15Z","dependency_count":0,"dependent_count":2,"comment_count":0}