test(reindex): harden Claude vintage drift proofs (#3895) - #3895
Conversation
Problem: The Claude vintage red twin deleted a raw row, so it did not prove that membership decisions and canonical hashes remain authoritative under semantic drift. What changed: Replace the destructive mutation with a superseded-prefix membership decision, cover hash/applied/superseded-equivalent drift against the registered verifier, and derive manifest uniqueness from the production accessor. Verification: The managed Claude vintage route passed 3 tests, the archive-verifier registry subset passed 3 tests, and devtools verify --quick passed all 24 steps. No production or schema files changed. The broader pathology-zoo selection remains blocked by the pre-existing unsupported Antigravity synthetic wire route, before Claude assertions execute.
|
Warning Review limit reached
Next review available in: 57 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Sinity
changed the title
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2ebca90b4f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| FROM raw_sessions AS r | ||
| JOIN raw_session_memberships AS m ON m.raw_id = r.raw_id | ||
| WHERE r.native_id = ? AND r.source_path LIKE ? AND m.decision = 'applied' |
There was a problem hiding this comment.
If a valid authority tie-break ever makes the old vintage row applied and the new row superseded_equivalent, this subquery returns no row and the mutation becomes a no-op, causing test_pathology_zoo_invariants_red_twin to fail even though the production invariant intentionally permits either row to be canonical. Select the cohort's applied membership independently of source_path so this helper always introduces the promised decision drift.
Useful? React with 👍 / 👎.
| registered_manifest = pathology_zoo_manifest() | ||
| assert registered_manifest is PATHOLOGY_ZOO_MANIFEST | ||
| assert len({member.member_id for member in registered_manifest}) == len(registered_manifest) |
There was a problem hiding this comment.
This replacement no longer detects manifest shrinkage: deleting a member still leaves the accessor identical to the constant and all remaining IDs unique, while the red-twin test also derives its cases from that same shortened manifest. The separate dimension test cannot catch every such deletion because append-self-describing and append-opaque share the append-revision-chain dimension, so either can disappear without failing its set assertion; pin the expected member IDs or retain an inventory floor while allowing additions.
Useful? React with 👍 / 👎.
| zoo = build_pathology_zoo(tmp_path / "zoo") | ||
|
|
||
| for drift in ("hash", "applied", "superseded_equivalent"): |
There was a problem hiding this comment.
If production ingestion already regresses so that this cohort has unequal hashes or incorrect membership decisions, every mutated copy is still red and this test passes without proving that any of the three mutations caused the failure. The neighboring generic test is independently selectable and may not run in focused verification, so establish that claude-vintage-live-proof is green on zoo.archive_root before entering the mutation loop.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in e62d240. Before the mutation loop, the test runs the production pathology verifier on zoo.archive_root and asserts the report is active, explicitly checks claude-vintage-live-proof, and reports that member as not failed. The mutation loop continues to use the same verifier and native-ID cohort. The focused route remains blocked before these assertions by the known #3899 Antigravity synthetic-route dependency.
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Problem: The Claude vintage red-twin only asserted the aggregate pathology report before applying mutations. A pre-regressed source invariant could therefore make the mutation loop red for the wrong reason. What changed: Require the production pathology verifier to be active, to check the Claude vintage member, and to report that member as green before the existing hash and membership mutations run. Compatibility/migration: Test-only change. The broader live proof and current-corpus dependency remain outside this commit.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e62d2407a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| UPDATE raw_session_memberships | ||
| SET decision = 'superseded_prefix' |
There was a problem hiding this comment.
If the production invariant's COUNT(*) = 2 clause is accidentally removed or weakened, every test here still passes: the new dedicated loop only corrupts hashes or decisions, and this generic mutation now duplicates the applied-decision case. The prior row deletion was the only proof that losing one vintage revision makes this member red, so retain that mutation or add a separate missing-revision case.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in signed commit 630e385. The registered Claude mutation now deletes the scoped new revision using canonical origin plus the exact membership logical source key, so the invariant’s COUNT(*) = 2 clause has a distinct missing-revision red twin. The focused mutation loop includes this deletion case, while the candidate and reindex acceptance assertions remain behind the real zoo route and retain the explicit Antigravity residual.
Problem: current-head review found duplicate wire receipt identities, an origin-blind live archive lookup, duplicated schema refusal precedence, repeated persisted-entry scans, an unmarked real-clock proof, and an element-blind receipt assertion. What changed: bind wire receipt identity to unique sorted provider and element keys, keep unsupported-route decisions named and fail-closed, scope live identity to the provider origin, centralize schema classification, index persisted support once, and mark the fresh-process proof's clock dependency. The regression pins exercise the production parser, archive tiers, append planner, and convergence harness. Verification: 16 exact focused tests passed; devtools verify --quick passed all 24 steps. Ref #3895.
Problem: Claude vintage red twins selected raw revisions by native ID alone and did not kill loss of one required revision. The focused mutation proof also stopped at the active archive verifier.\n\nWhat changed: Scope the production invariant, baseline reads, and source mutations by canonical Claude origin and logical source key. Restore a deletion red twin, prove a foreign same-native row is excluded and untouched, and route every Claude mutation through inactive candidate acceptance plus the real reindex acceptance invocation.\n\nCompatibility/migration: Test-only proof changes. The Antigravity synthetic route and live-export recovery remain explicitly blocked.
|
The exact-head review gaps are addressed in signed commit 630e385. The Claude manifest, baseline, and mutations now bind canonical claude-ai-export origin plus the exact claude-ai: logical source key, with a same-native chatgpt-export row proven excluded and untouched. The registered deletion red twin kills loss of one required revision. Every Claude mutation checks inactive candidate acceptance with index_path_override, and the missing-revision case invokes the real reindex acceptance route. The zoo remains explicitly blocked only by the unsupported Antigravity synthetic wire route at polylogue/schemas/synthetic/selection.py:100. No live-export recovery claim is added. |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 630e385798
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| foreign_scoped_green = verify_archive(mutated_root, checks=("pathology-zoo-invariants",)) | ||
| foreign_scoped_check = _check(foreign_scoped_green, "pathology-zoo-invariants") | ||
| assert foreign_scoped_check.status is OutcomeStatus.OK |
There was a problem hiding this comment.
For the hash, applied, and superseded_equivalent iterations, the preceding block has already corrupted one of the two scoped Claude rows, so verify_archive returns ERROR here rather than OK. The known Antigravity fixture blocker currently prevents execution from reaching this assertion, but once that blocker is removed this test will fail before exercising its candidate and reindex checks; move this scoped-green verification to immediately after inserting the foreign row and before applying each drift.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in signed commit de70b68ddbc95e2c707f5dd542645f8c38beca55. The scoped-green production verification now runs immediately after the two orthogonal collision rows are inserted and before each hash, decision, missing-revision, or overpopulation mutation. The full zoo route remains blocked only by the explicit Antigravity synthetic-route residual.
| foreign_raw_id = "foreign-origin-same-native-id" | ||
| foreign_origin = "chatgpt-export" | ||
| foreign_logical_source_key = f"chatgpt:{CLAUDE_VINTAGE_LIVE_PROOF_SESSION_ID}" |
There was a problem hiding this comment.
The only decoy changes both the origin and the logical source key, so either new WHERE predicate by itself is sufficient to exclude it. If a later change drops either the origin constraint or the logical-key constraint, this regression proof still stays green and therefore does not enforce the exact identity pair it claims to protect; add separate decoys with a matching key but foreign origin and with the Claude origin but a foreign key.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in signed commit de70b68ddbc95e2c707f5dd542645f8c38beca55. The fixture now inserts separate same-origin/different-logical-key and different-origin/same-logical-key rows, and asserts both remain unchanged after every mutation. Each baseline and source mutation uses canonical claude-ai-export plus the exact claude-ai:<native-id> membership key.
| assert "claude-vintage-live-proof" not in green_check.evidence["failed_member_ids"] | ||
| foreign_logical_source_key = f"chatgpt:{CLAUDE_VINTAGE_LIVE_PROOF_SESSION_ID}" | ||
|
|
||
| for drift in ("hash", "applied", "superseded_equivalent", "missing"): |
There was a problem hiding this comment.
The new missing case exercises only the lower bound of the cohort size. If the production predicate regresses from COUNT(*) = 2 to COUNT(*) >= 2, every case in this loop still behaves as asserted: the missing case has one row, while the other mutations are caught by hash or decision clauses. Add an extra case containing a third in-scope row with the same hash and a neutral decision so the exact two-revision requirement is independently protected.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Addressed in signed commit de70b68ddbc95e2c707f5dd542645f8c38beca55. The new overpopulation twin adds a third canonical row with the same hash and superseded_prefix; the aggregate is explicitly asserted as (3, 1, 1, 1, 1) before the production invariant is required to report red, so weakening COUNT(*) = 2 to a lower bound is exposed.
Problem: wire support identity and live append authorization could accept ambiguous or mixed-origin evidence. What changed: reject duplicate support keys at construction and persisted boundaries, canonicalize catalog order, bind parser witnesses to raw content, and require index/source origin agreement for archive and fallback lookups. Ref #3895
Problem: the repaired boundaries lacked complete red-twin coverage for parser content, duplicate identities, catalog order, mixed origins, and clock-exemption intent. What changed: add conflicting duplicate boundary tests, reordered-catalog canonicalization, ID-preserving invented-content proof, reverse mixed-origin coverage, and the required real-clock explanation. Ref #3895
|
@codex review Please review exact head |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Problem: current-head review found duplicate wire receipt identities, an origin-blind live archive lookup, duplicated schema refusal precedence, repeated persisted-entry scans, an unmarked real-clock proof, and an element-blind receipt assertion. What changed: bind wire receipt identity to unique sorted provider and element keys, keep unsupported-route decisions named and fail-closed, scope live identity to the provider origin, centralize schema classification, index persisted support once, and mark the fresh-process proof's clock dependency. The regression pins exercise the production parser, archive tiers, append planner, and convergence harness. Verification: 16 exact focused tests passed; devtools verify --quick passed all 24 steps. Ref #3895.
Problem: wire support identity and live append authorization could accept ambiguous or mixed-origin evidence. What changed: reject duplicate support keys at construction and persisted boundaries, canonicalize catalog order, bind parser witnesses to raw content, and require index/source origin agreement for archive and fallback lookups. Ref #3895
Problem: the repaired boundaries lacked complete red-twin coverage for parser content, duplicate identities, catalog order, mixed origins, and clock-exemption intent. What changed: add conflicting duplicate boundary tests, reordered-catalog canonicalization, ID-preserving invented-content proof, reverse mixed-origin coverage, and the required real-clock explanation. Ref #3895
1 participant
Summary
Complete the Claude vintage pathology-proof continuation at the exact published head by closing three anti-vacuity gaps in source identity, candidate selection, and revision cardinality. The production invariant remains unchanged and still requires exactly two equivalent Claude revisions with one applied and one superseded-equivalent decision.
Problem
The cold exact-head review found that the collision fixture changed both identity predicates at once, the Claude candidate assertion copied an unchanged index, and the missing-revision twin covered only loss of a required row. Those shapes could leave one identity predicate, candidate-index binding, or the exact upper count bound unproven.
Solution
claude-ai-exportorigin plus the exactclaude-ai:<native-id>logical source key, and both decoys are asserted unchanged.verify_archive(..., index_path_override=..., checks=REINDEX_CROSS_TIER_ACCEPTANCE_CHECKS)route to report the Claude candidate failure.superseded_prefixdecision. Its aggregate retains one hash, one applied row, one superseded-equivalent row, and one extra typed state whileCOUNT(*)becomes three, independently protecting the exact upper bound. The registered missing-revision deletion and real rebuild acceptance invocation remain present.Acceptance and review matrix
3742221322: missing Claude revision red twin630e3857986692e70949ead19c22da1f9f10e5f6; registered deletion remains in the semantic drift loop and the real rebuild acceptance invocation.3742409019: baseline must be green before each mutationde70b68ddbc95e2c707f5dd542645f8c38beca55; each copied archive is verified immediately after collision insertion and before its drift mutation.3742409022: isolate origin and logical-source predicatesde70b68ddbc95e2c707f5dd542645f8c38beca55; orthogonal collision rows independently match one predicate and are asserted untouched.3742409023: protect the exact upper revision boundde70b68ddbc95e2c707f5dd542645f8c38beca55; the third canonical row preserves all other aggregate state and makes the production invariant red at count three.UnsupportedSyntheticWireRouteErroratpolylogue/schemas/synthetic/selection.py:100: Antigravity requires the language-server.pbadapter and source-path semantics, which generic JSON generation does not exercise. Ref #3899 remains the enabling scope.live_export_recovered=false; this PR makes no live-prevalence or live-current-corpus claim.Bead disposition
polylogue-kmt1cpolylogue-yazaepathology-zoo fixture and manifest dependency remains open. No broader live Claude proof or live current-corpus support is claimed.Verification
POLYLOGUE_PYTEST_WORKERS=1 env PATH="$PWD/.venv/bin:$PATH" devtools test tests/unit/infra/test_claude_vintage_live_proof.pyResult: 3 passed in 14.96 seconds through the real Claude parse, ingest, historical revision backfill, convergence, and receipt route. The receipt retained
live_export_recovered=false.POLYLOGUE_PYTEST_WORKERS=1 env PATH="$PWD/.venv/bin:$PATH" devtools test tests/unit/maintenance/test_archive_verification.py -k 'pathology_zoo_claude_vintage_registered_invariant_rejects_each_semantic_drift or pathology_zoo_claude_candidate_acceptance_uses_selected_index'Result: both selected tests reached the known Antigravity fixture boundary and were blocked before their assertions by
UnsupportedSyntheticWireRouteErroratpolylogue/schemas/synthetic/selection.py:100. No Antigravity support was fabricated.direnv exec . devtools verify --quickResult: all 24 steps passed at
de70b68ddbc95e2c707f5dd542645f8c38beca55, including format, lint, mypy, rendering, layering, policy, and schema promotion checks. Run id:20260809T052439Z-quick-2665560-d64042d3.git diff --checkResult: clean.
git verify-commit de70b68ddbc95e2c707f5dd542645f8c38beca55Result: good GitHub signer binding for
ezo.dev@gmail.com.Review disposition
The three current exact-head findings are addressed in signed commit
de70b68ddbc95e2c707f5dd542645f8c38beca55. The prior missing-revision finding remains addressed in signed commit630e3857986692e70949ead19c22da1f9f10e5f6. A fresh exact-head Codex review is requested after this publication.