Repository navigation
feat: add experimental enrolled append and inspector recovery - #865
Draft
kevinswiber wants to merge 19 commits into
Draft
kevinswiber wants to merge 19 commits into
kevinswiber wants to merge 19 commits into
Conversation
Compose the private enrollment, append and clone-guard foundations with the real Change-create workflow. Preserve stable signed operation plans and attempt identity across retries and interruption, retain strict reader refusal, and admit resume through the existing bounded operational state read. This is a local development checkpoint. Focused macOS controls and the two-profile roundtrip passed; full qualification and public enablement remain outstanding.
Add explicit enrolled projection rebuild and read paths with retained native witnesses and completed-progress checks. Move Inspector data work behind a disposable owned child while retaining a detached HTTP control shell. This is an in-progress backup checkpoint. Focused headless currentness controls and pure transport checks passed, but enrolled Inspector adapters, browser integration, composed review, and broader verification remain incomplete.
Read and rebuild enrolled projections through the owned data process, retain currentness fences, and expose truthful Inspector recovery state. Add focused ownership and counter coverage without enabling public enrollment.
Distinguish physical profile-probe reads from decoded event work in owner and CLI diagnostics while preserving semantic and bounded-work checks. Retain failed bootstrap diagnostic roots and keep the bootstrap owner fixture through caller assertions. Add focused controls for accounting bounds and completion cleanup.
Count the absent profile guard probe in the two outer EventStore owner tests. Preserve the independent byte, decode, capability and physical-lock assertions.
Wait for same-child observations and explicit rebuild completion before asserting asynchronous recovery state. Preserve cancellation, cold-reader and history behavior, with full HTTP diagnostics on bounded waits.
Move healthy-child synchronization into current-unready startup and add explicit waits for diagnostic and invalid-projection callers. Keep unready-reader semantics, raw auth and fault paths, and all semantic assertions intact.
Mark the native enrollment roundtrip as requiring explicit caller and fixture readiness, matching its existing operator-owned roots. Document the boundary while preserving the native body and ordinary refusal coverage.
Use the private data request schema with an invalid version so the ordinary negative control reaches the pre-I/O guard on macOS. Preserve enrollment refusal and distinguish Windows unsupported entry while checking empty output and absent root and key paths.
Apply commit.gpgsign=false only to the fixture base commit so host signing configuration cannot block the eight delegation consumers before their assertions. Preserve fixture contents, capture paths and production signing behavior.
Validate detached supervisor health and fresh retry completion in the browser harness. Retain bounded failure diagnostics and expose pre-hydration counter values without changing the frozen counting invariant.
Refresh the fixed D73 shell fingerprint after the reviewed detached-status and bounded diagnostic changes. Preserve the canonical byte scope and every existing assertion.
Attribute completed enrollment safety probes to their captured request scope and bind successor Timeline protocol, producer and evaluator evidence without changing legacy accounting. Retain bounded browser reload failure facts in the actual error transport and add focused controls.
Use the existing common borrowed view to read the versioned failure counter receipt while preserving duplicate run-identity validation.
Box both owned Timeline evidence variants and preserve their versioned wire shapes and consuming conversions. Remove redundant borrows and extend the existing owner checks for reconstruction and version refusal.
Use single-element borrowed slices in the two derived-access evidence owners so all-feature Clippy can validate the accepted contract without redundant fixture clones.
Merge current main into the enrolled append-progress candidate. Preserve detached-child polling and completion refresh while retaining timeout, credential, and single-flight protections. Add integration coverage and regenerate the served bundle.
Require explicit opt-in for private enrolled commands while preserving ordinary Inspector transport. Refuse enrolled bootstraps before native or repository access when the feature is disabled. Align native helper and import guards with their callers to repair Linux compilation and platform lint failures. Preserve the experimental qualification limits in development documentation.
Borrow the accepted socket while parsing request headers so a concurrently spawned Windows child cannot retain a cloned response handle. Add a synchronized negative and positive ownership regression. Classify history carrier opens separately from enrollment safety probes, preserving the exact selected-read bound while allowing the additional NTFS maintenance probe.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Experimental draft — not ready to merge
Current head:
cae1b51d7767ace784a61f8f1c772c68d5114184. This is experimental private/enrolled-only concurrency and Inspector recovery work, not public feature enablement.Scope
b01917799c4c26d51b61bc83b115b46f7ace2408.71939d9aadded non-defaultexperimental-enrolled-progressgating for six private owned commands, preserved ordinary Inspector transport, refused enrolled bootstraps without that feature before acquisition, and corrected platform helpers/imports.--all-featuresexplicitly opts in.cae1b51dchanges three files: request parsing borrows the accepted socket rather than cloning an inheritable handle; a Windows child-inheritance negative/positive regression checks response EOF; history tests separately bound selected carrier reads and enrollment safety probes, including unrelated NTFS churn.Review status
The same independent Claude reviewer reviewed the cumulative PR source and successive exact repair states. The latest three-file repair is accepted with follow-up for limited experimental-draft source scope, with no blocking findings or open review requests. A proof-first content check verified that the signed published commit exactly materializes that accepted repair, with no additions. Commit-convention and signature checks passed.
The latest pass inspected source and preserved receipts; it ran no new tests or builds. One optional advisory—retaining an exact safety-open bound off Windows—was recorded and deferred without changing the accepted bytes. Earlier reviews remain historical; their assessments were not transferred to the new repair.
This is not merge, release, production qualification, or public-enablement approval.
Validation on the latest repair bytes
just check: passed, including build, formatting, workspace/all-target/all-feature Clippy, and 4,161 default tests (50 skipped).CARGO_BUILD_JOBS=1 just test-full --locked --offline: passed, 4,658 tests (51 skipped). Source hashes were unchanged through review and commit.Hosted CI for the latest head
CI run 38977424226 passed on its first attempt: 17 jobs passed, with only the path-filtered extension check skipped. The separate Commit Check also passed.
cae1b51d, baseb0191779, synthetic merge988ac02492b72d36c08e52cea008c8dff6a82a89; its tree equals the published head's tree. Run completed 2026-10-16 at 22:58:47 UTC, approximately 15 minutes 25 seconds after creation.Historical failing run: CI for
71939d9ahad 14 passing jobs, three failing Windows default-test shards, and the path-filtered extension check skipped. Windows reported 4,063 passed / six failed: five Inspector status-route timeouts and one history carrier-open mismatch (5 versus 4). Linux/macOS defaults, Windows type checks, and all three hosted store-foundation smoke jobs passed. That run was not rerun.The latest repair addresses the diagnosed socket-duplication lifetime and separates selected reads from the legitimate extra NTFS safety probe. The old failures remain preserved; only new-head hosted results can establish hosted recovery.
Historical context, not fresh whole-head validation
02b9283bpassed 1,655 front-end tests plus typecheck/lint, 94 offline diagnostic and seven offline contract tests, and bundle byte comparison. Those checks did not launch a browser; Biome/Node/Happy DOM warnings remain disclosed.Remaining qualification gaps
The PR stays draft and unmerged. No browser/two-host qualification campaign or public enablement was performed for this publication. Stash and retained evidence remain preserved.