chore(beads): close landed reindex obligations - #3872
Merged
Conversation
Problem: two implementation and graph-correction Beads remained open after their merged PRs, leaving the phase graph overstating unfinished work.\n\nWhat changed: close the cursor-authority implementation obligation against merged PR #3860 and close the reindex proof-edge correction against merged PR #3869. Preserve the live cursor receipt and downstream proof nodes as open obligations.\n\nVerification: bd dep cycles --json reports no dependency cycles. devtools lab policy bead-graph --json reports cycles ok and the known 220-item missing-AC census.\n\nCo-Authored-By: Claude <noreply@anthropic.com>
Owner
Author
|
@codex review |
📝 WalkthroughWalkthroughTwo Beads issue records were updated in ChangesBeads issue closure
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 86b2c32011
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| {"_type":"issue","id":"polylogue-reindex-preflight-authorization","title":"reindex: authorize a frozen production transition","description":"Phase 1 of the production reindex. Establish one immutable authorization binding the selected code and deployed package, source snapshot, raw-authority census, schema fingerprints, explicit waivers, and the exact preflight receipt before any freeze, migration, candidate build, or live mutation. The current graph has postconditions blocking the operation that produces them; this phase carrier provides the ordered precondition.","design":"The coordinator records a structured preflight contract and receipt. It consumes the structured PR scope contract and the current incident-forcing set, and it does not perform database mutation. It must reject stale code, stale Beads scope, unresolved disconnected P0 delivery defects, untyped raw failures, or a source/index authority census without an explicit typed disposition. Runtime values are produced only by named commands and stored in the receipt consumed by the next phase.","acceptance_criteria":"1. Exact code SHA, deployed package SHA, Beads digest, source/index/ops fingerprints, schema versions, raw-authority census, and waiver set are bound in a self-hashed preflight receipt. 2. polylogue-pr-scope-contract is a direct prerequisite. 3. The receipt is immutable and names the next source-remediation and candidate-build phase inputs. 4. No production write or promotion occurs in this phase. 5. A stale binding or disconnected P0 defect fails closed.","status":"open","priority":0,"issue_type":"epic","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:50:07Z","created_by":"Sinity","updated_at":"2026-08-06T11:50:07Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-reindex-preflight-authorization","depends_on_id":"polylogue-incident-coverage-ledger","type":"blocks","created_at":"2026-08-06T15:51:23Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-preflight-authorization","depends_on_id":"polylogue-pr-scope-contract","type":"blocks","created_at":"2026-08-06T13:52:44Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-preflight-authorization","depends_on_id":"polylogue-reindex-proof-edge-correction","type":"blocks","created_at":"2026-08-06T15:51:23Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":3,"dependent_count":1,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\n\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\n\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\n\nNo production mutation is performed by this implementation Bead.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\n3. Daemon bulk entry checks before transaction bookkeeping.\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\n6. File-backed regression tests exercise every guard and the quick gate passes.\n7. Live migrations and deployment remain open under polylogue-9qnzy and polylogue-a7gmk.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.\nCarrier publication commit is now a2ec4d8fbff5b19bed843df15f269f58b6881580; the PR body carrier is regenerated against that exact head and the committed branch snapshot.\nCI publication sequencing correction 2026-08-06: prepare the next exact-head carrier before pushing its commit, because Circle validates the PR body at push-trigger time.\nFinal carrier sequencing receipt 2026-08-06: the next PR head will be pushed only after its exact carrier has been published in the PR body; this prevents a stale push-triggered validation.\nAudit correction 2026-08-06: the merged tracker commit for PR #3857 had serialized literal backslash-n sequences in this Bead description and acceptance fields. Replaced them with actual paragraph/newline structure. The PR also carried unrelated tracker mutations for polylogue-z7sv3 and polylogue-csx21; those graph states are retained only where independently justified, while the attribution/process defect is tracked under polylogue-pr-scope-contract.","status":"closed","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T19:24:35Z","closed_at":"2026-08-06T19:24:35Z","close_reason":"Closed after current-master audit: the durable schema-currency implementation and regression coverage landed in PR #3858. Live deploy and migration receipts remain under polylogue-9qnzy and polylogue-a7gmk.","dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-06T05:48:17Z","dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.\nClosure preparation 2026-08-07: required phase-ordering edges are present in the current Beads graph after merged PR #3869 at dc88ecee89d8. The phase graph remains live-proof-gated downstream.","status":"closed","priority":0,"issue_type":"task","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-07T08:19:48Z","started_at":"2026-08-07T08:19:47Z","closed_at":"2026-08-07T08:19:48Z","close_reason":"Graph edge correction satisfied by merged PR #3869 at dc88ecee89d8. The required live-proof blocking edges are present, the graph has no dependency cycles, and downstream acceptance still consumes the open live-proof nodes. No production mutation was delivered.","dependency_count":0,"dependent_count":2,"comment_count":0} |
There was a problem hiding this comment.
This closure marks all acceptance criteria satisfied even though AC4 still has no implementation: inspecting devtools/verify_bead_graph.py and tests/unit/devtools/test_verify_bead_graph.py shows only generic cycle, parent, wave, and missing-AC validation, and a repository-wide search finds no fixture or policy encoding the twelve required blocking edges. Consequently, removing one of those edges would still pass the graph policy, while closing this P0 bead releases its dependencies from polylogue-reindex-preflight-authorization and polylogue-reindex-final-proof; keep it open or defer AC4 to a named successor until the required-edge mutation is rejected.
AGENTS.md reference: AGENTS.md:L480-L482
Useful? React with 👍 / 👎.
| {"_type":"issue","id":"polylogue-x97cf","title":"maintenance: install typed live-proof receipt protocol","description":"Implement one static, typed live-proof receipt protocol for the reindex campaign. It must collect read-only, candidate, and already-produced apply receipts without becoming a task scheduler or mutation surface. Every receipt binds the proof and Bead IDs, exact code SHA, archive identity, source snapshot, schema versions, candidate identity when applicable, parser and lowering fingerprints, registry version, structured result, typed residues, input receipt digests, and private-path digests. This is the shared evidence protocol required before live-proof children can contribute to the terminal reindex proof.\n","design":"Add a versioned LiveProofSpec registry and receipt collector. Register the fixed proof modes read_only, candidate, and existing_apply_receipt. Expose polylogue ops maintenance live-proof with a fixed proof ID and receipt input/output contract. Read-only and candidate producers may execute only registered callables; existing-apply mode validates an immutable receipt. The command must never apply a mutation, stop or start the daemon, migrate a tier, promote a generation, accept arbitrary commands, or infer proof from Beads status. Private paths are represented by SHA-256 digest plus basename. Wire the collector into the live-operation aggregate and the candidate/final proof consumers. Reuse the existing archive-verification registry and canonical fingerprint helpers.\n","acceptance_criteria":"1. The three fixed proof modes and typed residue vocabulary are represented by one registry.\n2. The maintenance command accepts only registered proof IDs and the mode-specific input shape.\n3. Receipts are immutable, self-hashed, and bind code, archive, source snapshot, schema, semantic fingerprints, result, residues, and input receipts.\n4. Candidate receipts bind the exact inactive candidate generation; existing-apply receipts bind the validated input receipt.\n5. Private paths never appear in durable receipt payloads except as digest plus basename.\n6. The command has no mutation, daemon lifecycle, migration, promotion, or arbitrary-command path.\n7. Missing, stale, or malformed bindings fail closed, and a controlled mutation of any required binding makes validation fail.\n8. Focused tests cover registry completeness, receipt determinism, mode isolation, binding failures, and the real CLI dispatch path.\n9. The protocol is a prerequisite of polylogue-live-operation-receipts and remains open until its implementation and focused verification merge.","notes":"Compiled packet intake 2026-08-06. Source packet tar SHA-256: cae45456e8f25c491085c2035afc8fbf36545e4ac59c55bd53c114e6d4179189. Execution-spec SHA-256: 64fa47bd7d42e0d4e81b3e77db2216a88300dd81b08141dd6e79a54319607303. The packet graph basis is 685f2ca8, so current phase names and dependencies must be checked against current Beads before dispatch.\nGraph correction from Codex review on PR #3861 (comment 5205727476): closed duplicate polylogue-q8tpq no longer claims to supersede this canonical Bead. The supersedes relationship is now x97cf -\u003e q8tpq; x97cf remains the open implementation owner consumed by live-operation and candidate proof.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T13:50:01Z","created_by":"Sinity","updated_at":"2026-08-06T15:55:02Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-x97cf","depends_on_id":"polylogue-q8tpq","type":"supersedes","created_at":"2026-08-06T17:54:48Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-live-proof","title":"acceptance: reconcile and attest production cursor authority before source freeze","description":"Execute the scoped cursor-authority reconciliation after its implementation is merged, under operator-controlled freeze and backup boundaries, and bind the live result into the reindex operation receipts. This is the residual live effect of polylogue-xeck9; it is not satisfied by the fail-closed mechanism or synthetic tests.","design":"The coordinator supplies a protected private path file for the exact known cursor-ahead row, a fresh verified full_evidence backup manifest, the selected deployed package SHA, and the immutable dry-run plan. Require the daemon stopped and writer ownership. Apply only the plan's one-use authorization through the normal full-ingest/replay route. Revalidate path digest, cursor offset, accepted frontier, accepted raw digest, source-prefix digest, database fingerprints, schema versions, package/code SHA, and plan digest after ownership. Accept only reconciled or typed_deferred, with no unrelated authority regression, quick_check on touched tiers, and a self-hashed receipt bound to before/after projections, ingest attempt, backup, and final verdict. Consume this receipt through polylogue-live-operation-receipts.","acceptance_criteria":"1. Historical diagnosis from polylogue-xeck9 and implementation polylogue-cursor-authority-reconcile-implementation are complete. 2. Dry-run plan is immutable and its exact source path is represented only by digest in durable receipts. 3. Fresh full-evidence backup is verified before apply. 4. The selected one-path route produces either reconciled or typed_deferred with no direct cursor/head/source-row repair. 5. Normal unscoped ingestion remains fail-closed throughout. 6. Before/after raw_frontier_integrity_projection, source/index/ops/blob fingerprints, plan digest, backup identity, code/package SHA, ingest attempt ID, quick_check results, and final verdict are present in polylogue.cursor-authority-reconciliation-receipt.v1. 7. The receipt is consumed by polylogue-live-operation-receipts and remains a blocker for final proof until present. 8. No Bead is closed from a synthetic receipt alone.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:49Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:49Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-live-proof","depends_on_id":"polylogue-cursor-authority-reconcile-implementation","type":"blocks","created_at":"2026-08-06T13:54:13Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:32Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.\nClosure preparation 2026-08-07: implementation scope is satisfied by merged PR #3860 at dec1eab35cfb. The live production reconciliation receipt remains polylogue-cursor-authority-live-proof and is intentionally open.","status":"closed","priority":0,"issue_type":"task","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-07T08:19:48Z","started_at":"2026-08-07T08:19:47Z","closed_at":"2026-08-07T08:19:48Z","close_reason":"Implementation scope satisfied by merged PR #3860 at dec1eab35cfb. Focused implementation and CLI/watcher/retention verification passed; no production mutation or live receipt was delivered. Remaining live operation is polylogue-cursor-authority-live-proof.","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} |
There was a problem hiding this comment.
The implementation being closed still does not satisfy AC7 for the production shape this bead documents: when the sole cursor-ahead row has already disappeared but the known 725/2 incomparable population remains, _build_plan() enters its cursor_ahead_count == 0 branch but emits not_applicable only when cursor_authority_gap_count == 0 and the whole projection is healthy; otherwise it raises cursor authority is incomparable or has no selected violation. Thus a harmless no-longer-applicable reconciliation cannot produce the required typed no-op plan in the presence of the explicitly preserved gap population, and there is no focused regression for this case; keep the implementation bead open or name a successor until that behavior is implemented.
AGENTS.md reference: AGENTS.md:L480-L482
Useful? React with 👍 / 👎.
| {"_type":"issue","id":"polylogue-x97cf","title":"maintenance: install typed live-proof receipt protocol","description":"Implement one static, typed live-proof receipt protocol for the reindex campaign. It must collect read-only, candidate, and already-produced apply receipts without becoming a task scheduler or mutation surface. Every receipt binds the proof and Bead IDs, exact code SHA, archive identity, source snapshot, schema versions, candidate identity when applicable, parser and lowering fingerprints, registry version, structured result, typed residues, input receipt digests, and private-path digests. This is the shared evidence protocol required before live-proof children can contribute to the terminal reindex proof.\n","design":"Add a versioned LiveProofSpec registry and receipt collector. Register the fixed proof modes read_only, candidate, and existing_apply_receipt. Expose polylogue ops maintenance live-proof with a fixed proof ID and receipt input/output contract. Read-only and candidate producers may execute only registered callables; existing-apply mode validates an immutable receipt. The command must never apply a mutation, stop or start the daemon, migrate a tier, promote a generation, accept arbitrary commands, or infer proof from Beads status. Private paths are represented by SHA-256 digest plus basename. Wire the collector into the live-operation aggregate and the candidate/final proof consumers. Reuse the existing archive-verification registry and canonical fingerprint helpers.\n","acceptance_criteria":"1. The three fixed proof modes and typed residue vocabulary are represented by one registry.\n2. The maintenance command accepts only registered proof IDs and the mode-specific input shape.\n3. Receipts are immutable, self-hashed, and bind code, archive, source snapshot, schema, semantic fingerprints, result, residues, and input receipts.\n4. Candidate receipts bind the exact inactive candidate generation; existing-apply receipts bind the validated input receipt.\n5. Private paths never appear in durable receipt payloads except as digest plus basename.\n6. The command has no mutation, daemon lifecycle, migration, promotion, or arbitrary-command path.\n7. Missing, stale, or malformed bindings fail closed, and a controlled mutation of any required binding makes validation fail.\n8. Focused tests cover registry completeness, receipt determinism, mode isolation, binding failures, and the real CLI dispatch path.\n9. The protocol is a prerequisite of polylogue-live-operation-receipts and remains open until its implementation and focused verification merge.","notes":"Compiled packet intake 2026-08-06. Source packet tar SHA-256: cae45456e8f25c491085c2035afc8fbf36545e4ac59c55bd53c114e6d4179189. Execution-spec SHA-256: 64fa47bd7d42e0d4e81b3e77db2216a88300dd81b08141dd6e79a54319607303. The packet graph basis is 685f2ca8, so current phase names and dependencies must be checked against current Beads before dispatch.\nGraph correction from Codex review on PR #3861 (comment 5205727476): closed duplicate polylogue-q8tpq no longer claims to supersede this canonical Bead. The supersedes relationship is now x97cf -\u003e q8tpq; x97cf remains the open implementation owner consumed by live-operation and candidate proof.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T13:50:01Z","created_by":"Sinity","updated_at":"2026-08-06T15:55:02Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-x97cf","depends_on_id":"polylogue-q8tpq","type":"supersedes","created_at":"2026-08-06T17:54:48Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-live-proof","title":"acceptance: reconcile and attest production cursor authority before source freeze","description":"Execute the scoped cursor-authority reconciliation after its implementation is merged, under operator-controlled freeze and backup boundaries, and bind the live result into the reindex operation receipts. This is the residual live effect of polylogue-xeck9; it is not satisfied by the fail-closed mechanism or synthetic tests.","design":"The coordinator supplies a protected private path file for the exact known cursor-ahead row, a fresh verified full_evidence backup manifest, the selected deployed package SHA, and the immutable dry-run plan. Require the daemon stopped and writer ownership. Apply only the plan's one-use authorization through the normal full-ingest/replay route. Revalidate path digest, cursor offset, accepted frontier, accepted raw digest, source-prefix digest, database fingerprints, schema versions, package/code SHA, and plan digest after ownership. Accept only reconciled or typed_deferred, with no unrelated authority regression, quick_check on touched tiers, and a self-hashed receipt bound to before/after projections, ingest attempt, backup, and final verdict. Consume this receipt through polylogue-live-operation-receipts.","acceptance_criteria":"1. Historical diagnosis from polylogue-xeck9 and implementation polylogue-cursor-authority-reconcile-implementation are complete. 2. Dry-run plan is immutable and its exact source path is represented only by digest in durable receipts. 3. Fresh full-evidence backup is verified before apply. 4. The selected one-path route produces either reconciled or typed_deferred with no direct cursor/head/source-row repair. 5. Normal unscoped ingestion remains fail-closed throughout. 6. Before/after raw_frontier_integrity_projection, source/index/ops/blob fingerprints, plan digest, backup identity, code/package SHA, ingest attempt ID, quick_check results, and final verdict are present in polylogue.cursor-authority-reconciliation-receipt.v1. 7. The receipt is consumed by polylogue-live-operation-receipts and remains a blocker for final proof until present. 8. No Bead is closed from a synthetic receipt alone.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:49Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:49Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-live-proof","depends_on_id":"polylogue-cursor-authority-reconcile-implementation","type":"blocks","created_at":"2026-08-06T13:54:13Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:32Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.\nClosure preparation 2026-08-07: implementation scope is satisfied by merged PR #3860 at dec1eab35cfb. The live production reconciliation receipt remains polylogue-cursor-authority-live-proof and is intentionally open.","status":"closed","priority":0,"issue_type":"task","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-07T08:19:48Z","started_at":"2026-08-07T08:19:47Z","closed_at":"2026-08-07T08:19:48Z","close_reason":"Implementation scope satisfied by merged PR #3860 at dec1eab35cfb. Focused implementation and CLI/watcher/retention verification passed; no production mutation or live receipt was delivered. Remaining live operation is polylogue-cursor-authority-live-proof.","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} |
There was a problem hiding this comment.
The closed implementation does not actually enforce AC2's verified full-evidence backup at apply time: _validate_backup() rehashes the four SQLite images, but for blob rollback evidence it only checks that blob/ and blob-inventory.json exist and trusts three booleans in the previously signed receipt. verify_verification_receipt() authenticates that stale receipt but does not inspect current backup artifacts, and this path never invokes the existing blob-inventory validation that compares every file and hash. If a backup blob is deleted or corrupted after verification, reconciliation still proceeds to mutate the live archive without usable rollback evidence; retain this implementation obligation until apply revalidates the closed blob inventory.
AGENTS.md reference: AGENTS.md:L480-L482
Useful? React with 👍 / 👎.
Problem: late Codex review found that the cursor implementation still lacks two acceptance behaviors and the proof-edge correction lacks an executable required-edge guard.\n\nWhat changed: reopen both Beads, record the review findings, create hardening successors polylogue-s8gcr and polylogue-eqq02, and make the new edge guard block preflight and terminal proof readiness.\n\nCompatibility: no production mutation, candidate generation, or live receipt is claimed.\n\nVerification: bd dep cycles --json reports no cycles.\n\nCo-Authored-By: Claude <noreply@anthropic.com>
Owner
Author
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b6438e090d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| {"_type":"issue","id":"polylogue-x97cf","title":"maintenance: install typed live-proof receipt protocol","description":"Implement one static, typed live-proof receipt protocol for the reindex campaign. It must collect read-only, candidate, and already-produced apply receipts without becoming a task scheduler or mutation surface. Every receipt binds the proof and Bead IDs, exact code SHA, archive identity, source snapshot, schema versions, candidate identity when applicable, parser and lowering fingerprints, registry version, structured result, typed residues, input receipt digests, and private-path digests. This is the shared evidence protocol required before live-proof children can contribute to the terminal reindex proof.\n","design":"Add a versioned LiveProofSpec registry and receipt collector. Register the fixed proof modes read_only, candidate, and existing_apply_receipt. Expose polylogue ops maintenance live-proof with a fixed proof ID and receipt input/output contract. Read-only and candidate producers may execute only registered callables; existing-apply mode validates an immutable receipt. The command must never apply a mutation, stop or start the daemon, migrate a tier, promote a generation, accept arbitrary commands, or infer proof from Beads status. Private paths are represented by SHA-256 digest plus basename. Wire the collector into the live-operation aggregate and the candidate/final proof consumers. Reuse the existing archive-verification registry and canonical fingerprint helpers.\n","acceptance_criteria":"1. The three fixed proof modes and typed residue vocabulary are represented by one registry.\n2. The maintenance command accepts only registered proof IDs and the mode-specific input shape.\n3. Receipts are immutable, self-hashed, and bind code, archive, source snapshot, schema, semantic fingerprints, result, residues, and input receipts.\n4. Candidate receipts bind the exact inactive candidate generation; existing-apply receipts bind the validated input receipt.\n5. Private paths never appear in durable receipt payloads except as digest plus basename.\n6. The command has no mutation, daemon lifecycle, migration, promotion, or arbitrary-command path.\n7. Missing, stale, or malformed bindings fail closed, and a controlled mutation of any required binding makes validation fail.\n8. Focused tests cover registry completeness, receipt determinism, mode isolation, binding failures, and the real CLI dispatch path.\n9. The protocol is a prerequisite of polylogue-live-operation-receipts and remains open until its implementation and focused verification merge.","notes":"Compiled packet intake 2026-08-06. Source packet tar SHA-256: cae45456e8f25c491085c2035afc8fbf36545e4ac59c55bd53c114e6d4179189. Execution-spec SHA-256: 64fa47bd7d42e0d4e81b3e77db2216a88300dd81b08141dd6e79a54319607303. The packet graph basis is 685f2ca8, so current phase names and dependencies must be checked against current Beads before dispatch.\nGraph correction from Codex review on PR #3861 (comment 5205727476): closed duplicate polylogue-q8tpq no longer claims to supersede this canonical Bead. The supersedes relationship is now x97cf -\u003e q8tpq; x97cf remains the open implementation owner consumed by live-operation and candidate proof.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T13:50:01Z","created_by":"Sinity","updated_at":"2026-08-06T15:55:02Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-x97cf","depends_on_id":"polylogue-q8tpq","type":"supersedes","created_at":"2026-08-06T17:54:48Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-live-proof","title":"acceptance: reconcile and attest production cursor authority before source freeze","description":"Execute the scoped cursor-authority reconciliation after its implementation is merged, under operator-controlled freeze and backup boundaries, and bind the live result into the reindex operation receipts. This is the residual live effect of polylogue-xeck9; it is not satisfied by the fail-closed mechanism or synthetic tests.","design":"The coordinator supplies a protected private path file for the exact known cursor-ahead row, a fresh verified full_evidence backup manifest, the selected deployed package SHA, and the immutable dry-run plan. Require the daemon stopped and writer ownership. Apply only the plan's one-use authorization through the normal full-ingest/replay route. Revalidate path digest, cursor offset, accepted frontier, accepted raw digest, source-prefix digest, database fingerprints, schema versions, package/code SHA, and plan digest after ownership. Accept only reconciled or typed_deferred, with no unrelated authority regression, quick_check on touched tiers, and a self-hashed receipt bound to before/after projections, ingest attempt, backup, and final verdict. Consume this receipt through polylogue-live-operation-receipts.","acceptance_criteria":"1. Historical diagnosis from polylogue-xeck9 and implementation polylogue-cursor-authority-reconcile-implementation are complete. 2. Dry-run plan is immutable and its exact source path is represented only by digest in durable receipts. 3. Fresh full-evidence backup is verified before apply. 4. The selected one-path route produces either reconciled or typed_deferred with no direct cursor/head/source-row repair. 5. Normal unscoped ingestion remains fail-closed throughout. 6. Before/after raw_frontier_integrity_projection, source/index/ops/blob fingerprints, plan digest, backup identity, code/package SHA, ingest attempt ID, quick_check results, and final verdict are present in polylogue.cursor-authority-reconciliation-receipt.v1. 7. The receipt is consumed by polylogue-live-operation-receipts and remains a blocker for final proof until present. 8. No Bead is closed from a synthetic receipt alone.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:49Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:49Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-live-proof","depends_on_id":"polylogue-cursor-authority-reconcile-implementation","type":"blocks","created_at":"2026-08-06T13:54:13Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:32Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.\nClosure preparation 2026-08-07: implementation scope is satisfied by merged PR #3860 at dec1eab35cfb. The live production reconciliation receipt remains polylogue-cursor-authority-live-proof and is intentionally open.\nPost-closure review correction 2026-08-07: Codex P1 findings 3734483480 and 3734483485 show that the implementation AC is not fully satisfied. Keep this Bead open while polylogue-cursor-authority-reconcile-hardening adds the typed no-op regression and revalidates current blob inventory contents at apply time. The live production receipt remains open.","status":"open","priority":0,"issue_type":"task","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-07T08:44:34Z","started_at":"2026-08-07T08:19:47Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} |
There was a problem hiding this comment.
Replace polylogue-cursor-authority-reconcile-hardening with polylogue-s8gcr, the successor created by this change. A repository-wide search finds no Bead with the name currently recorded in these notes, so an operator following this durable handoff cannot resolve the stated successor and may leave the residual implementation work disconnected from the original acceptance criteria.
AGENTS.md reference: AGENTS.md:L480-L488
Useful? React with 👍 / 👎.
| {"_type":"issue","id":"polylogue-reindex-preflight-authorization","title":"reindex: authorize a frozen production transition","description":"Phase 1 of the production reindex. Establish one immutable authorization binding the selected code and deployed package, source snapshot, raw-authority census, schema fingerprints, explicit waivers, and the exact preflight receipt before any freeze, migration, candidate build, or live mutation. The current graph has postconditions blocking the operation that produces them; this phase carrier provides the ordered precondition.","design":"The coordinator records a structured preflight contract and receipt. It consumes the structured PR scope contract and the current incident-forcing set, and it does not perform database mutation. It must reject stale code, stale Beads scope, unresolved disconnected P0 delivery defects, untyped raw failures, or a source/index authority census without an explicit typed disposition. Runtime values are produced only by named commands and stored in the receipt consumed by the next phase.","acceptance_criteria":"1. Exact code SHA, deployed package SHA, Beads digest, source/index/ops fingerprints, schema versions, raw-authority census, and waiver set are bound in a self-hashed preflight receipt. 2. polylogue-pr-scope-contract is a direct prerequisite. 3. The receipt is immutable and names the next source-remediation and candidate-build phase inputs. 4. No production write or promotion occurs in this phase. 5. A stale binding or disconnected P0 defect fails closed.","status":"open","priority":0,"issue_type":"epic","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:50:07Z","created_by":"Sinity","updated_at":"2026-08-06T11:50:07Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-reindex-preflight-authorization","depends_on_id":"polylogue-eqq02","type":"blocks","created_at":"2026-08-07T10:44:34Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-preflight-authorization","depends_on_id":"polylogue-incident-coverage-ledger","type":"blocks","created_at":"2026-08-06T15:51:23Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-preflight-authorization","depends_on_id":"polylogue-pr-scope-contract","type":"blocks","created_at":"2026-08-06T13:52:44Z","created_by":"Sinity","metadata":"{}"},{"issue_id":"polylogue-reindex-preflight-authorization","depends_on_id":"polylogue-reindex-proof-edge-correction","type":"blocks","created_at":"2026-08-06T15:51:23Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":4,"dependent_count":1,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-dudtn","title":"Implement durable schema-currency gate hardening","description":"Implementation slice extracted from polylogue-9qnzy after review found the original gate incomplete. This Bead owns the code and regression tests; polylogue-9qnzy remains the live deployment and migration operation.\n\nProblem: rebuild-index could bypass durable schema currency through audit drift, ownership races, daemon bulk setup, the empty-source CLI path, and an unstructured daemon error.\n\nScope: guard every canonical durable migration tier, recheck after ownership acquisition, guard daemon bulk bookkeeping, remove empty-source bypass, reject daemon preflight, preserve a structured conflict diagnostic, and document migration of audit.db.\n\nNo production mutation is performed by this implementation Bead.","design":"Use one canonical durable-tier set from the migration runner. Keep derived index mismatch outside this gate because rebuild-index owns replacement of the derived tier. Bind the implementation to a PR scope carrier and leave live operation as a separate receipt.","acceptance_criteria":"1. The predicate derives from DURABLE_MIGRATION_TIERS and covers source, user, and audit.\n2. Local rebuild checks before receipt/ownership/candidate creation and again after ownership acquisition.\n3. Daemon bulk entry checks before transaction bookkeeping.\n4. CLI empty-source execution and --preflight --daemon cannot bypass the guard.\n5. Daemon HTTP returns a structured 409 rebuild-schema-currency diagnostic.\n6. File-backed regression tests exercise every guard and the quick gate passes.\n7. Live migrations and deployment remain open under polylogue-9qnzy and polylogue-a7gmk.","notes":"Created 2026-08-06 to provide truthful implementation authority for PR #3856 after Terra/Sol review of polylogue-9qnzy noted that its AC5 explicitly excluded code changes.\nPublication carrier corrected 2026-08-06: PR #3857 now binds the full head c9d12abcf60941e9925ae22c475dc9a4230b3a8d. Implementation evidence remains PR #3856 at 1ac4749772bb9207c356ab9a32e6fa14c9db194a; live migration remains polylogue-9qnzy/a7gmk.\nCarrier publication commit is now a2ec4d8fbff5b19bed843df15f269f58b6881580; the PR body carrier is regenerated against that exact head and the committed branch snapshot.\nCI publication sequencing correction 2026-08-06: prepare the next exact-head carrier before pushing its commit, because Circle validates the PR body at push-trigger time.\nFinal carrier sequencing receipt 2026-08-06: the next PR head will be pushed only after its exact carrier has been published in the PR body; this prevents a stale push-triggered validation.\nAudit correction 2026-08-06: the merged tracker commit for PR #3857 had serialized literal backslash-n sequences in this Bead description and acceptance fields. Replaced them with actual paragraph/newline structure. The PR also carried unrelated tracker mutations for polylogue-z7sv3 and polylogue-csx21; those graph states are retained only where independently justified, while the attribution/process defect is tracked under polylogue-pr-scope-contract.","status":"closed","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T09:50:03Z","created_by":"Sinity","updated_at":"2026-08-06T19:24:35Z","closed_at":"2026-08-06T19:24:35Z","close_reason":"Closed after current-master audit: the durable schema-currency implementation and regression coverage landed in PR #3858. Live deploy and migration receipts remain under polylogue-9qnzy and polylogue-a7gmk.","dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-06T05:48:17Z","dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-reindex-proof-edge-correction","title":"Correct blocking edges for reindex live proof graph","description":"The proof graph merged in PR 3836 attached live-proof children to historical implementation Beads only with parent-child membership edges. The twelve live-proof children must also have explicit blocking dependencies on their implementation mechanism or acceptance owner, and the terminal reindex proof must consume the corrected graph.","design":"Beads rejects a blocks edge from a child to its ancestor, so the twelve live-proof records are standalone acceptance nodes rather than children of the historical implementation records. Each has an explicit blocks edge to the implementation owner. The edge-correction item itself blocks polylogue-reindex-final-proof. This preserves hard ordering without introducing an impossible ancestor dependency.","acceptance_criteria":"1. All twelve live-operation proof children have explicit blocks edges to their implementation or acceptance owner where the audit identified one. 2. The terminal reindex proof depends on the edge-correction item and therefore cannot be ready while those proof obligations are unbound. 3. Beads graph validation reports no cycles or dangling dependencies. 4. A graph fixture test or executable policy check fails when one required blocking edge is removed. 5. The change is delivered as one batched Beads export commit with the exact edge matrix in the PR body.","notes":"Graph constraint correction 2026-08-06: Beads rejects a blocks edge from a child to its ancestor. The twelve live-proof records were therefore detached from historical implementation parents and retain explicit blocks edges to those implementation records. This preserves hard ordering without creating an impossible ancestor dependency; the exact matrix is in the PR.\nClosure preparation 2026-08-07: required phase-ordering edges are present in the current Beads graph after merged PR #3869 at dc88ecee89d8. The phase graph remains live-proof-gated downstream.\nPost-closure review correction 2026-08-07: Codex P1 finding 3734483475 shows the required-edge mutation guard is absent. Keep this Bead open while polylogue-reindex-proof-edge-guard adds the executable edge matrix and negative mutation check. Existing phase ordering remains present; no production mutation occurred.","status":"open","priority":0,"issue_type":"task","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T05:35:24Z","created_by":"Sinity","updated_at":"2026-08-07T08:44:35Z","started_at":"2026-08-07T08:19:47Z","dependency_count":0,"dependent_count":2,"comment_count":0} |
There was a problem hiding this comment.
Replace polylogue-reindex-proof-edge-guard with polylogue-eqq02, the successor added by this commit. No Bead with the recorded name exists anywhere in the repository, so the correction note sends future work to an unresolvable ID even though the actual guard task has a generated identifier.
AGENTS.md reference: AGENTS.md:L480-L488
Useful? React with 👍 / 👎.
| {"_type":"issue","id":"polylogue-x97cf","title":"maintenance: install typed live-proof receipt protocol","description":"Implement one static, typed live-proof receipt protocol for the reindex campaign. It must collect read-only, candidate, and already-produced apply receipts without becoming a task scheduler or mutation surface. Every receipt binds the proof and Bead IDs, exact code SHA, archive identity, source snapshot, schema versions, candidate identity when applicable, parser and lowering fingerprints, registry version, structured result, typed residues, input receipt digests, and private-path digests. This is the shared evidence protocol required before live-proof children can contribute to the terminal reindex proof.\n","design":"Add a versioned LiveProofSpec registry and receipt collector. Register the fixed proof modes read_only, candidate, and existing_apply_receipt. Expose polylogue ops maintenance live-proof with a fixed proof ID and receipt input/output contract. Read-only and candidate producers may execute only registered callables; existing-apply mode validates an immutable receipt. The command must never apply a mutation, stop or start the daemon, migrate a tier, promote a generation, accept arbitrary commands, or infer proof from Beads status. Private paths are represented by SHA-256 digest plus basename. Wire the collector into the live-operation aggregate and the candidate/final proof consumers. Reuse the existing archive-verification registry and canonical fingerprint helpers.\n","acceptance_criteria":"1. The three fixed proof modes and typed residue vocabulary are represented by one registry.\n2. The maintenance command accepts only registered proof IDs and the mode-specific input shape.\n3. Receipts are immutable, self-hashed, and bind code, archive, source snapshot, schema, semantic fingerprints, result, residues, and input receipts.\n4. Candidate receipts bind the exact inactive candidate generation; existing-apply receipts bind the validated input receipt.\n5. Private paths never appear in durable receipt payloads except as digest plus basename.\n6. The command has no mutation, daemon lifecycle, migration, promotion, or arbitrary-command path.\n7. Missing, stale, or malformed bindings fail closed, and a controlled mutation of any required binding makes validation fail.\n8. Focused tests cover registry completeness, receipt determinism, mode isolation, binding failures, and the real CLI dispatch path.\n9. The protocol is a prerequisite of polylogue-live-operation-receipts and remains open until its implementation and focused verification merge.","notes":"Compiled packet intake 2026-08-06. Source packet tar SHA-256: cae45456e8f25c491085c2035afc8fbf36545e4ac59c55bd53c114e6d4179189. Execution-spec SHA-256: 64fa47bd7d42e0d4e81b3e77db2216a88300dd81b08141dd6e79a54319607303. The packet graph basis is 685f2ca8, so current phase names and dependencies must be checked against current Beads before dispatch.\nGraph correction from Codex review on PR #3861 (comment 5205727476): closed duplicate polylogue-q8tpq no longer claims to supersede this canonical Bead. The supersedes relationship is now x97cf -\u003e q8tpq; x97cf remains the open implementation owner consumed by live-operation and candidate proof.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T13:50:01Z","created_by":"Sinity","updated_at":"2026-08-06T15:55:02Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-x97cf","depends_on_id":"polylogue-q8tpq","type":"supersedes","created_at":"2026-08-06T17:54:48Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-live-proof","title":"acceptance: reconcile and attest production cursor authority before source freeze","description":"Execute the scoped cursor-authority reconciliation after its implementation is merged, under operator-controlled freeze and backup boundaries, and bind the live result into the reindex operation receipts. This is the residual live effect of polylogue-xeck9; it is not satisfied by the fail-closed mechanism or synthetic tests.","design":"The coordinator supplies a protected private path file for the exact known cursor-ahead row, a fresh verified full_evidence backup manifest, the selected deployed package SHA, and the immutable dry-run plan. Require the daemon stopped and writer ownership. Apply only the plan's one-use authorization through the normal full-ingest/replay route. Revalidate path digest, cursor offset, accepted frontier, accepted raw digest, source-prefix digest, database fingerprints, schema versions, package/code SHA, and plan digest after ownership. Accept only reconciled or typed_deferred, with no unrelated authority regression, quick_check on touched tiers, and a self-hashed receipt bound to before/after projections, ingest attempt, backup, and final verdict. Consume this receipt through polylogue-live-operation-receipts.","acceptance_criteria":"1. Historical diagnosis from polylogue-xeck9 and implementation polylogue-cursor-authority-reconcile-implementation are complete. 2. Dry-run plan is immutable and its exact source path is represented only by digest in durable receipts. 3. Fresh full-evidence backup is verified before apply. 4. The selected one-path route produces either reconciled or typed_deferred with no direct cursor/head/source-row repair. 5. Normal unscoped ingestion remains fail-closed throughout. 6. Before/after raw_frontier_integrity_projection, source/index/ops/blob fingerprints, plan digest, backup identity, code/package SHA, ingest attempt ID, quick_check results, and final verdict are present in polylogue.cursor-authority-reconciliation-receipt.v1. 7. The receipt is consumed by polylogue-live-operation-receipts and remains a blocker for final proof until present. 8. No Bead is closed from a synthetic receipt alone.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:49Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:49Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-live-proof","depends_on_id":"polylogue-cursor-authority-reconcile-implementation","type":"blocks","created_at":"2026-08-06T13:54:13Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-06T11:51:32Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} | ||
| {"_type":"issue","id":"polylogue-cursor-authority-reconcile-implementation","title":"maintenance: add scoped cursor-authority reconciliation through normal ingest","description":"Implement the one missing maintenance surface needed to repair the known cursor-authority violation without disabling the global fail-closed gate. The existing fail-closed mechanism and census are recorded by polylogue-xeck9 and PR #3823; the remaining implementation is a scoped, backup-gated, single-path reconciliation command.","design":"Add `polylogue ops maintenance cursor-authority-reconcile` with dry-run default and explicit `--apply`. Dry-run takes `--source-path-file` (0600 file containing one private absolute path) and `--output-plan`; resolve `/realm/db/polylogue` explicitly, require the daemon stopped, inspect source/index/ops/audit schemas and versions, run raw_frontier_integrity_projection, require exactly one true cursor-ahead relation for the selected path, verify byte-authoritative accepted head, hash current source bytes through accepted_frontier with two stat observations, and emit self-hashed polylogue.cursor-authority-reconciliation-plan.v1. Apply takes `--plan`, `--backup-manifest`, `--receipt`, and `--apply`; require stopped daemon and verified full-evidence backup, acquire writer lease, revalidate every binding, create a one-use authorization carrying path digest, cursor offset, accepted frontier, and plan digest, invoke only the existing full-ingest/replay route, allow the gate bypass only for the exact planned violation, never directly update ingest_cursor or accepted heads, enforce reconciled or typed_deferred postconditions, reject worsening unrelated rows, quick_check touched tiers, and emit polylogue.cursor-authority-reconciliation-receipt.v1. Add the exact named tests in the acceptance criteria. Do not change frontier comparison semantics or typed reason codes.","acceptance_criteria":"1. Dry-run is deterministic and changes no SQLite pages, cursor rows, source rows, or files except the requested plan. 2. Apply refuses without a verified full-evidence backup or while daemon ownership is active. 3. The exact planned ahead path uses the existing full-ingest/replay route. 4. Normal unscoped ingestion remains blocked. 5. One-use authorization cannot be reused for another path or after cursor, head, source-prefix, schema, database, or code SHA changes. 6. Source mutation during hashing refuses. 7. Zero ahead rows produces typed not_applicable with no mutation. 8. More than one true ahead row refuses without guessing. 9. Existing 725/2 incomparable classes stay explicitly typed and do not become falsely healthy. 10. No direct cursor reset, accepted-head rewrite, or global force switch exists. 11. Crash before commit leaves pre-state unchanged; crash after ingest commit before receipt is recoverable and cannot run twice. 12. Removing path restriction or replacing scoped authorization with global bypass fails a controlled mutation test. 13. Exact-frontier ordinary ingestion remains allowed. 14. Tests exist in tests/unit/maintenance/test_cursor_authority_reconcile.py, tests/unit/sources/test_live_watcher.py, tests/unit/storage/test_raw_retention.py, and tests/unit/cli/test_archive_maintenance_cli.py. 15. devtools verify --quick passes. 16. PR scope is implementation-complete and live-proof-pending; no production receipt or Beads mutation is delivered by the worker.","notes":"Compiled Luna execution packet 2026-08-06 from the settled #3823 authority design. Required base commit: 5ed7a50a12b5ae6fe7dad00213b4a1ac160860b3. Allowed files: polylogue/maintenance/cursor_authority_reconcile.py; polylogue/cli/commands/maintenance/_cursor_authority.py; polylogue/cli/commands/maintenance/__init__.py; polylogue/sources/live/batch.py; tests/unit/maintenance/test_cursor_authority_reconcile.py; tests/unit/sources/test_live_watcher.py; tests/unit/storage/test_raw_retention.py; tests/unit/cli/test_archive_maintenance_cli.py; docs/devtools.md. Forbidden: production access, direct SQL cursor/head/source-row writes, global bypass, generic force flag, raw-frontier semantic changes, typed reason-code changes, Beads writes, subagents. Stop if base commit or an existing one-path normal-ingest API is absent, a required change leaves allowed files, or any ambiguity remains. Verification commands are the four named focused devtools tests plus devtools verify --quick.\nClosure preparation 2026-08-07: implementation scope is satisfied by merged PR #3860 at dec1eab35cfb. The live production reconciliation receipt remains polylogue-cursor-authority-live-proof and is intentionally open.\nPost-closure review correction 2026-08-07: Codex P1 findings 3734483480 and 3734483485 show that the implementation AC is not fully satisfied. Keep this Bead open while polylogue-cursor-authority-reconcile-hardening adds the typed no-op regression and revalidates current blob inventory contents at apply time. The live production receipt remains open.","status":"open","priority":0,"issue_type":"task","assignee":"Sinity","owner":"ezo.dev@gmail.com","created_at":"2026-08-06T11:51:32Z","created_by":"Sinity","updated_at":"2026-08-07T08:44:34Z","started_at":"2026-08-07T08:19:47Z","labels":["area:maintenance","lane:reindex"],"dependencies":[{"issue_id":"polylogue-cursor-authority-reconcile-implementation","depends_on_id":"polylogue-xeck9","type":"blocks","created_at":"2026-08-06T13:54:26Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":1,"dependent_count":2,"comment_count":0} |
There was a problem hiding this comment.
This record now has an assignee and started_at but remains status:"open"; the same inconsistent state is introduced for polylogue-reindex-proof-edge-correction. The repository's frontier and backlog tooling treats only in_progress as claim-backed and treats open, unblocked P0 items as ready, so both retained claims can be offered for duplicate dispatch while also escaping the stale-claim check. Set these owned records back to in_progress, or clear the claim fields if they are intentionally unclaimed.
AGENTS.md reference: AGENTS.md:L288-L298
Useful? React with 👍 / 👎.
| @@ -1,3 +1,5 @@ | |||
| {"_type":"issue","id":"polylogue-eqq02","title":"devtools: guard required reindex proof edges","description":"Add an executable graph guard for the reindex proof-edge matrix. The policy must reject removal of any required live-proof blocking edge and must bind the edge matrix to the phase graph used by preflight and terminal proof.","design":"Define the required edge matrix as structured policy data or a typed fixture consumed by devtools lab policy bead-graph. Add a negative mutation test that removes one edge and fails, plus a positive check for the current graph. Keep this guard separate from the live production proof receipts.","acceptance_criteria":"1. The twelve required live-proof blocking edges are represented by structured policy data. 2. The positive graph check passes on the current Beads snapshot. 3. Removing any required edge fails the policy or fixture check. 4. The guard is consumed by reindex preflight and terminal proof readiness. 5. Focused tests and devtools verify --quick pass.","notes":"Created from Codex P1 review finding 3734483475 on PR #3872. Existing phase edges remain present, but their required-edge guard was not executable.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-07T08:44:35Z","created_by":"Sinity","updated_at":"2026-08-07T08:44:35Z","labels":["area:devtools","lane:reindex"],"dependencies":[{"issue_id":"polylogue-eqq02","depends_on_id":"polylogue-reindex-proof-edge-correction","type":"discovered-from","created_at":"2026-08-07T10:44:34Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":2,"comment_count":0} | |||
There was a problem hiding this comment.
Enumerate the required source-to-blocker pairs in this Bead rather than referring only to “the twelve” edges. The current graph cannot reconstruct that set unambiguously: the twelve proof records changed by the original correction now expose thirteen blocks edges because polylogue-codex-804-live-proof has two blockers. A worker deriving policy data from the then-current graph could therefore guard the wrong subset and still satisfy the proposed positive and mutation tests, leaving an intended edge removable.
AGENTS.md reference: AGENTS.md:L487-L488
Useful? React with 👍 / 👎.
This was referenced Aug 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Record the post-review state of two reindex Beads and preserve their remaining implementation obligations as named successors.
Problem
Late Codex review found that the cursor reconciliation implementation still lacks a typed no-op path for the preserved incomparable population and current blob-inventory revalidation at apply time. It also found that the proof-edge correction has no executable negative guard for removal of a required edge. Closing either Bead would release downstream readiness prematurely.
Solution
Reopen
polylogue-cursor-authority-reconcile-implementationand link hardening successorpolylogue-s8gcr. Reopenpolylogue-reindex-proof-edge-correctionand link guard successorpolylogue-eqq02; the guard also blocks preflight and terminal proof readiness. Preserve the merged implementation and phase-edge evidence as historical evidence. No production mutation, candidate generation, acceptance, promotion, restart, or live receipt is claimed.Verification
bd dep cycles --jsonreports no dependency cycles. The pre-push Beads validation scanned 1,749 issues with zero unhandled findings. The PR carrier validates against the exact branch head and Beads snapshot.Bead disposition
polylogue-cursor-authority-reconcile-implementationpolylogue-s8gcrpolylogue-reindex-proof-edge-correctionpolylogue-eqq02