ADR 0003 B2: Operation views and undo, plain and final discard, including checkpoint and compaction #30

Activity

1. drakestapleton commented on Oct 18, 2026

   

   drakestapleton

   on Oct 18, 2026

   Contributor

   More actions

   This was generated by AI.

   claimed by claude-opus-5.5 session syn-adr0003 (branch synapse/30-operation-views, base main 2f06c45).

   Plan:

   1. Operation log = the revision records already in the WAL (kinds 7, 8, 9, 11) plus a new kind 12 view operation: undo (whole or filtered to one actor chain), plain discard, final discard, capability revocation. Each operation records its actor chain.
   2. View = the per-change visible heads plus the discarded set, with a two-level Merkle digest; computed by folding the operations still in effect. An undo to operation T disables every later operation (or every later operation of one actor); an undo of an undo re-enables what it disabled, so undo is undoable and an undo to T restores the exact view digest at T.
   3. Refusals: undo without the Undo capability; undo of operations whose actor chain the undoer does not dominate; undo across a revocation or a final discard; undo to a point outside the window (typed).
   4. Checkpoints and compaction keep every operation (no sweep before K1), so undo works after them.
   5. Revocations become durable WAL operations and are re-applied to the auth state at open.

   Not in B2: GC, quota release on final discard, per-owner retention window (K1); receipts and promotions (E1, E2); workspace pointers in the view (C2).
2. drakestapleton commented on Oct 18, 2026

   

   drakestapleton

   on Oct 18, 2026

   Contributor

   More actions

   This was generated by AI.

   B2 is ready on branch synapse/30-operation-views (head 8c68955), based on main 2f06c45. No PR was opened; the orchestrator opens it.

   • WAL kind 12 ViewOperationRecorded: undo (whole or per actor), plain and final discard, revocation.
   • A view is the fold of the log, with a two-level Merkle digest.
   • API: undo (needs Undo), discard (needs Propose), and an operator revoke_link that writes the fact and revokes the link in the policy enforcer at the same sequence.

   Tests:

   • cargo test --workspace --locked --no-fail-fast: 410 passed, 0 failed. Clippy -D warnings and fmt are clean.
   • The acceptance property (undo to T restores the digest of T, also after reopen and checkpoint_and_compact), undo of an undo, per-actor isolation and conflict data, refusal of undoing a fact, and the dominance rules are covered in crates/synapse-store/src/operation_tests.rs and crates/synapse-api/tests/b2_operation_views.rs.
   • Red before green: 14 mutations, all red. See evidence/b2-operation-views/.

   Limits, also in docs/B2_OPERATION_VIEWS.md:

   • No undo window and no GC yet (K1).
   • The policy enforcer's grants and revocations are not rebuilt at open.
   • Kind 12 carries the actor chain but no agent signature; the Re-verify admission records (kinds 7, 8) and their chain at replay, or seal the log with a key #101 seal is what protects it.
   • Kind 10 is left to H1 cut 2 (feat(git,store): H1 cut 2: persistent GitOid map, native import, export from the store (#48) #96). B2 uses 12.