🤖 feat: record durable history acceptance for compaction replacement - #4182
🤖 feat: record durable history acceptance for compaction replacement#4182ThomasK33 wants to merge 7 commits into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5b87bd3f21
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
5b87bd3 to
4031141
Compare
|
Addressed all three findings in
The repair passed independent review, 243 focused tests and full static checks. After a clean rebase onto main, 379 affected history/storage/context-budget tests and both TypeScript targets passed. The original acceptance commit and repair are unchanged by the rebase. Runtime integration remains a dependent layer. Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4031141a98
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the three current findings in
Validation: 652 affected tests passed, full static checks passed, and independent review approved the repair. Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2297c64073
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
The post-fence window is real and deliberately has conservative invalidation semantics. Commit The test loses ownership while chat publication is staged, after the owned generation rename. It verifies byte-identical chat and archive, no acceptance callback or replacement witness, retention of the same Stop, rejection of the old journal, and successful fresh capture, replacement publication, and witnessed Stop retirement. The journal fixture proves storage eligibility and generation rejection; it does not claim a full live-compactor recovery test. The focused tests passed (60 cases), with TypeScript, ESLint, formatting, and independent review passing. The side effect is that already prepared compaction work may need recomputation. Treating the generation rename as accepted input would be unsafe: no durable user trigger or nonce witness exists at that point, yet acceptance permits closing rollback, retiring Stop, and delivery bookkeeping. A recoverable transaction spanning generation and history would impose a stronger contract than this layer provides. The inspected path preserves original history and allows a fresh attempt, so we are keeping the conservative fence and exact-history acceptance boundary rather than adding a new transaction mechanism. Please reassess Generated with |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a057374906
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed acceptance before the append durability barrier in Replacement lookup and witnessed retirement share verification that flushes only the matched chat/archive artifacts, revalidates provenance, and preserves final ownership checks. Persistent flush failure therefore retains Stop across restart. Later successful verification can retire it without appending or rewriting the row. Tests also cover evidence changes and lease reclamation during the flush. The lower commit passes 182 real-file tests with 997 assertions and full Generated with |
|
@codex review Please review current head Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
81101dd to
8732215
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 87322156a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review Please review current head Generated with |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
8732215 to
9e5206e
Compare
|
Addressed PRRT_kwDOPxxmWM6hJfdX (finding) in the published lower layer Real-file controls cover failed directory flushes, later recovery without duplicate rows, evidence changes and reclaimed leases. The unchanged complete implementation has prior static, backend and focused IPC/UI evidence. The new V1 intermediate tree separately passed 257 tests and canonical static checks. The final top exactly restores the complete implementation plus main’s documentation-only update; no fresh wholesale run of that final tree is claimed. The PR body records the qualified evidence. Generated with |
|
@codex review Please review current head Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e5206e6fb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed two findings in
The append operation also has a preserve-cancellation mode for #4209’s final publication fence: it compares the original nonce/generation and returns a durable append receipt without stamping a witness or retiring the scoped Stop. The oversized-row scan finding remains valid and open. A separately reviewed raw scanner prerequisite is being prepared; history-specific validation and integration must follow before this phase can merge. No oversized-row fix is claimed by this update. Validation: 78 lower replacement tests passed. Both integrated runtime candidates passed targeted tests and canonical static checks; the PR descriptions identify exact scope and trees. Generated with |
|
@codex review Please review current head Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 00b747a344
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed findings 3988953093 and 3988953101. Persisted dates are normalized on a copied row before exact wire projection; the original disk row remains the stamped source. Operation serialization stays synchronous before any await, with a local Result guard returning Err for invalid unknown payloads. New real-history tests cover a dated signed Resume plus BigInt/circular append and Resume inputs, proving no receipt or disk mutation on failure. Lower tests83/438 and canonical static pass; combined stack145/870 passes. The oversized-row scanner finding remains open. Generated with |
|
@codex review Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review Generated with |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b6a99dfe93
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Capture exact append, batch and Resume acceptance under history ownership and durability checks, preserving Stop until replacement is durably witnessed. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
Compare normalized Resume targets without replacing their persisted metadata, recover identical interrupted archive replay, and allow guarded appends to preserve their captured cancellation record. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
Normalize copied persisted dates before exact wire projection, preserving the original stamped row. Return Result errors for invalid synchronous operation snapshots without moving capture past an await. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
Allow only preserve-mode appends to persist canonical budget-rejection capsules or legacy user rows without replacement authority. Keep captured nonce/generation ownership and reject default replacement or Resume with rejected input. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
Retry may reuse its exact existing durable witness after unchanged target, identity, provenance and generation checks. Revalidate and flush the witness without rewriting signed history; cancellation cleanup debt remains independently retryable. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable -->
…omes Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable --> Change-Id: Id4605b002a93118695cb79f1dbcd772189b9fb81
Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with `xum` • Model: `unavailable` • Thinking: `unavailable` • Cost: `$unavailable`_ <!-- mux-attribution: model=unavailable thinking=unavailable costs=unavailable --> Change-Id: I494bd5fde8ac20fb1da09d9c85b3602ba7f78630
b6a99df to
9d9b990
Compare
|
Addressed all three remaining findings:
Lower repairs pass 172 tests / 1,012 assertions; reader integration passes 341 tests / 10,629 assertions. Both pass canonical static and independent review. Final phase integration on main Generated with |
|
@codex review Please review the current head after the complete phase was composed on current main. All known findings have fixes and replies in their owning layers; the eight-member phase stays held until all members are approved and green. Generated with |
1 participant
Retained Stop needs durable evidence of replacement acceptance before recovery can release it. This layer provides guarded append/Resume publication, captures receipts at the history commit point, and verifies witnesses across chat and archive. #4187 exposes preparation publication; #4191/#4209 activate runtime policy.
Captured cancellation nonce, journal generation and physical/logical ownership are rechecked at publication. Single-row input stays append-only; batches and Resume publish atomically. Visible rows and durable receipts remain distinct across file/directory flush failures. Preserve-mode appends grant no replacement authority, including canonical budget-rejection capsules and legacy rejected user rows.
Resume verifies the exact typed target or the exact wire-schema projection of a copied, date-normalized persisted row. It stamps the original row so signatures and metadata survive. Invalid synchronous JSON snapshots return Result errors. A later Retry can reuse its existing stamped witness after cleanup failure: exact target, lifetime identity, flush, provenance and generation checks still apply, with no history rewrite. Ordinary Resume without a cancellation nonce also avoids rewriting.
Witness lookup accepts optional final LF and identical archive replay copies. Multiple active-chat copies, changed identity bytes and protected reset rows cannot grant authority. Witness evidence now uses #4221’s bounded row adapter. Readable protected or invalid-UTF-8 rows still occupy identities; ID fingerprints can conservatively reject a collision, while replay authority always requires exact captured byte ranges. Both reset probes, complete lifetime traversal, provenance revalidation and file/directory durability remain in the owning service.
Validation: the lower real-file suite passed 105 tests / 553 assertions, followed by all eight new controls after a test-only lint correction. Canonical static checks pass. The integrated A candidate passed 556 tests / 3,208 assertions. Risks are flush latency and conservative refusal when exact ownership or history evidence cannot be proved.
New chat-file creation now flushes the parent directory before issuing its synchronous acceptance receipt. A superseded generation publication returns the normal superseded outcome instead of a storage error. Three deterministic regressions passed after failing on the prior implementation; the lower repair passed 172 tests / 1,012 assertions and canonical static checks. The reader integration passed 341 tests / 10,629 assertions and canonical checks. Its allocation tests cover lookup and retirement throughout, and acceptance evidence before the write lock. Ordinary append sequence allocation retains its existing giant archive-tail read; this change does not claim the entire append path has bounded memory.
Final phase integration on main
ad8a01b: independent composition review and full canonical static checks pass on tree3ed04896. Across 35 affected files, 2,549 tests / 28,590 assertions pass: 34 files passed before a test-only lifecycle repair, then all 28 pinned-budget tests passed after it. Two final-flush fixtures now complete their fake stream on Stop instead of waiting for later disposal; their original assertions and production behavior are unchanged.The complete cancellation phase is ordered #4214 → #4215 → #4219 → #4221 → #4182 → #4187 → #4191 → #4209. The reader prerequisites and runtime changes merge together only after every member has current-head approval and green CI.
Generated with
xum• Model:unavailable• Thinking:unavailable• Cost:$unavailable