Repository navigation
Integrate architecture boundaries and acceptance fixes - #176
Merged
Merged
Conversation
A restored database can omit a ban that the pinned log still requires. Record that ban locally, keep lift deny-only, and state why promotion stays blocked. Co-authored-by: Cursor <cursoragent@cursor.com>
The one_root index allows only one parentless resource, so a second root topic made the topic_ban.apply fixture fail with constraint_conflict on PostgreSQL. Co-authored-by: Cursor <cursoragent@cursor.com>
The published 0.x line is a different series. This source version does not claim a PyPI release or a finished production migration. Co-authored-by: Cursor <cursoragent@cursor.com>
…ement records backup_retired now needs one exact root-signed record bound to the subject and both old key IDs, imported behind require_local_console and re-verified on every read; server_key_retired additionally needs online retirement. Missing, altered, expired, misbound or pre-rotation records fail closed. Slice of #68. Co-authored-by: Cursor <cursoragent@cursor.com>
…ependently of entrypoints
… cloud branch Refs #158 #82 #83 #85. Patch SHA-256 244778f572724b991a8b14ff3334b810a3af14329de999bf148c5445950c8a02. Restrict publishing to 19 enumerated files and this feature branch; remove the one-shot publisher in the generated source commit. Record RED and explicit full-server installation compatibility.
…al format The source archive normalizes pyproject formatting; cloud run36484923358 refused that hunk before any publish. Commit the same reviewed dependency split against the live repository file and apply the unchanged verified source patch excluding only that already-committed metadata. Refs #158 #83.
… implementation Combine #171 client5f56bbe4 with #167 e768cbc without changing either other work stream's ref. Retain #167 executor, packet/schema, QuerySession/RelationalSession and all regression tests; retain merged #165 tool contract. Core codec owns the one result_wire function; packet re-exports that same object and executor keeps its packet import. Preserve all client helper, installation and signature tests. Apply the complete frozen-JSON comparison correction from #169 3db973a, whose 34 focused regressions passed in cloud. Refs #158 #156 #157 #83 #85. Final combined tree requires new full/focused cloud gates; no historical GREEN or production acceptance is claimed.
Join #167 2d1cc44 and client integration3ae9f8ef. Adopt its five exact workflow/test/note blobs, including the expanded ledger/migration/recovery selection and the same complete frozen-JSON assertion. No product source changes from the preceding integration. Record the independently verified isolated client7/wheel/four-transport GREEN without treating it as this final combined head's result. Refs #158 #156 #157 #83 #85. Only the client feature branch will advance; all final-head gates remain required.
…executor error redaction
…on fixes Preserve both regression-first and PR #180 histories. Scan at most 128 rows per query, apply current target visibility per row, enforce a 4096-row/monotonic deadline budget, and return continuation only from a visible lease. Preserve existing v1 output and v2 Resource contracts. Cloud RED 36573737687: 13 cases, exactly two explicit unbounded SQL failures, no errors/skips. Runtime source SHA256 ac4247f5629403942506a80c895e4018db4ec56d3a2e279a11a6fedbbef3b74d; no unrelated handoff changes. Refs #81 #85
4 tasks
…atest read integration Retain #180 f304bcf and #181 70d46ce histories without changing either branch. Work request/offer/checkpoint/proposal readers use bounded 128-row keyset scans, current row authorization/projection, 4096-candidate and monotonic-deadline budgets. Preserve their existing output/schema/state transitions. Cloud RED 36576545310 at dd441ea: 15 real PostgreSQL/signed cases, exactly five unbounded-SQL failures, no errors/skips. Artifact11038236899 ZIP SHA256 71adea8a6611c11fe1fd82f13900e0e48b224038b610ed66530bde3129198c12 independently checked with source/JUnit. Add pre-query and mid-scan deadline regressions for each work kind. Refs #78 #81 #82 #83 #85
Each EffectWorker serializes its own loop, but several workers could claim different pending jobs of the same tool at once, so a tool had no cross-worker concurrency bound (F162.ToolSpec.concurrency). A process-local lock cannot express that fact; only the jobs table seen under the claim's write transaction (BEGIN IMMEDIATE on SQLite, the global advisory lock on PostgreSQL) is shared by every worker. The claim now counts live running jobs per tool id in the same write transaction that expires stale leases, and skips any pending tool job whose tool is already at its limit, continuing in next_at,id order so other tools and non-tool jobs are not blocked. Expired leases still become uncertain first and are not counted. The limit comes from the job's captured tool revision. Published revisions have no concurrency field and keep their bytes, signatures and receipts; absence means 1 (tighter than before). An explicit value must be an int in 1..32; anything else is rejected (invalid_tool_concurrency) by read_tool and fails the job at claim without executing it, never becoming unbounded. Co-authored-by: Cursor <cursoragent@cursor.com>
…ults Design 154 requires a /@user/receipts/ view. The signed OperationResult rows the executor already persists in `results` (subject, request_id) are the real receipt facts, so this adds communication.receipt_list / receipt_get as pure reads over them instead of a new receipt table, state machine or writable resource. Stored result bytes and signatures are never rewritten. Only the path subject can read: other subjects get permission_denied (even for their own or unknown request IDs), anonymous callers get authentication_required. The projection is request_id, operation, status, committed_at, currently readable resources, a signed flag and error_code; data/output/cli_url are omitted because they can carry delivered credentials. Listing uses the inbox-style limit (1..200) and an HMAC cursor bound to the subject, ordered by request_id. Reads write nothing. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
Author
|
本轮按用户 2026-09-29 的新要求推进 Python 3.15 / 更严格 Ruff / uv-build 更新和可部署整合。已读取当前设计及有效归档，源码检查基线 ff57e66，main 22b5e86（用户刚将发行名改为 msgctl/0.1.0a1），#182 bf1a166、#183 bf07d48、#184 4d3f3c0；原分支未覆盖。 云端诊断 run 36591180628，artifact 11043807668，SHA256 9470dae83d3e6e6d1db2cca9db466477851d9b83bebfa9a07bea6fad97b2c315，下载后已验证。当前工具版本 Ruff 0.16.9、uv/uv-build 0.12.20。严格候选规则扫描 2357 项（含可选异步诊断），现有 formatter 470 文件待规范；py315 在 Ruff 需显式 preview 才不产生未稳定支持警告。不会用全局 ignore 或关闭已有测试制造绿色。 已逐份下载并核验完整 run 36578368674 的四份 artifact。shard0 实际597例、1失败（descending read_query@1 首页空结果）；shard3 实际585例、0失败；shard1/2 只有收集清单，没有 JUnit，jobs 显示 cancelled，不能计作通过。#182 保留的 keyset 修复覆盖前者。正在保留所有来源历史整合并处理包名/构建脚本/客户端 extra 冲突，随后在最终源树重跑 lint、warnings、完整实际 node-ID 分片、conformance/tokenizer、打包和专项检查。辅助 scout 不进入产品树。 尚未合并、部署或关闭广义/生产证据 issue；未操作真实 Root/PIN、资金、外发通知、生产迁移或备份退役。 |
Contributor
Author
|
Python 3.15 / Ruff 本轮进度交接（未完成合并，不能作为可部署结论）：
最后复查 #176 仍为 draft/open、head ff57e66，未合并、未部署。没有关闭广义验收/生产证据issue，也未触发真实Root/PIN、资金、外发、生产迁移、恢复提升或备份退役。后续须经正常授权写入路径审查导入候选，完成最终头所有门禁后才能合并。 |
fix(workers): admit same-tool jobs against a shared running limit
feat: read-only /@user/receipts projection of stored OperationResults
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This was referenced Sep 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Integrates the market, standalone client, read-only hosting, Git transport and recovery branches while retaining their histories. Follow-up commits add explicit signed market acceptance; Registry source retirement and feature/template/tool contracts; plugin lifecycle guards; search v5 filters and visible-name spelling hints; shared file operations and content validation; collaboration resources, pinned proposals and target watches; restrictive recovery checkpoints; and offline legacy SQLite preservation.
Published operation versions and signed representations are preserved. Market convergence now includes signed Listing Resources, explicit legacy offer adoption and native entitlement orders; new default Order lifecycle transitions now use controlled Resource/Revision records with checked SQL projections, while old contracts remain explicitly compatible. Protected legacy SQLite content and fixed-ref Git import have passed private isolated rehearsals. Historical identities remain inert, and the user selected a new Root with permissions re-enrolled. These are not claims that the broad acceptance issues are complete.
Verification
Focused tests have passed for individual changes in isolated Python 3.15/PostgreSQL environments. The previous full run exposed a database-collation-dependent webhook deduplication failure and a public-read effect-check ordering failure. Both now have reproduced regressions and fixes. Complete recovery proof integration also exposed a stale pinned schema inventory; its exact reviewed market-table/type delta and PostgreSQL 16/18 catalogue compatibility are now integrated and under combined verification. The complete four-shard node-ID coverage gate, conformance, package build and specialized workflows must pass on the final head before merging. This PR remains draft while source work and integration verification continue.
The actual legacy SQLite snapshot has been preserved privately and independently round-trip checked: 33 tables, 512 rows and 7,166 typed cell values match. This establishes scoped database preservation only; it does not establish active v4 migration, filesystem backup completeness or current revocation authority. Content import preserved 17 boards and 198 posts privately, and Git import preserved one fixed ref and 739 reachable objects with exact OIDs. These are rehearsals with test-only ownership, not production identity authorization. No private database contents or credentials are included in this PR.
Incorporates PRs #145, #155, #168, #170, #171, #177, #178 and the now-merged #173. The two new transfer/client PRs passed 33 focused combined tests locally. Completion evidence will identify the final commit rather than reuse results from older heads.
Closes #158, closes #159, closes #163.
Refs #64, #65, #68, #69, #70, #71, #72, #76, #77, #78, #79, #80, #81, #82, #83, #84, #85.
The user has authorized deployment after the new version is ready. No deployment, restart, production migration, real financial operation or external message delivery has been performed. Remaining source gaps, independent current-authority evidence, backup retirement, console governance and deployment acceptance remain open.