Bind subscription provenance to canonical renderer inputs - #10
Merged
Conversation
Constraint: Preserve stdio-json-v1 compatibility Rejected: Alias v2 to v1 | protocol negotiation must remain explicit Confidence: medium Scope-risk: narrow Tested: go test ./plugin Not-tested: v2 process pool behavior
Subscription snapshots now carry a secret-free source version and canonical manifest while schema-v1 reads migrate deterministically to schema v2. Legacy failed last-good records become explicitly stale without inventing provenance. Constraint: Durable stores must stage rewrites only after decrypting and validating every record Rejected: Infer stale state forever from fetch_error | callers need an explicit serving contract Confidence: high Scope-risk: narrow Reversibility: clean Directive: SourceManifest must remain credential-free and canonical Tested: go test ./..., go vet ./..., git diff --check Not-tested: Server durable migration; implemented in the dependent server slice
Provide a strict v2 runtime loop that validates protocol, generation, invocation kind, and invocation identity, then emits a correlated invoke_result without silently downgrading to v1. Constraint: v1 Serve remains unchanged Rejected: implicit protocol fallback | hides stale worker frames Confidence: medium Scope-risk: moderate Tested: go test ./plugin Not-tested: host-call fd3 multiplexing
The SDK now emits strict runtime readiness frames, correlates host calls by host_call_id, and invalidates invocation host facades before worker readiness. Constraint: stdio-json-v1 behavior remains unchanged Rejected: Persistent host authority on pooled workers | permits late cross-invocation calls Confidence: medium Scope-risk: moderate Directive: Expire invocation clients before invoke_ready Tested: go test ./...; go test -race ./plugin Not-tested: fuzz frame decoder
SDK now exposes a transport-agnostic generation and invocation state machine that rejects stale, duplicate, and out-of-order lifecycle frames. Constraint: Preserve v1 runtime compatibility Rejected: Implicit frame acceptance | permits late cross-invocation dispatch Confidence: medium Scope-risk: narrow Directive: Integrate V2Session before dispatch in pooled host Tested: go test ./...; go test -race ./plugin Not-tested: fuzz hostile frame decoder
Share serialized transport state across invocation facades and runtime terminal writes while retaining per-invocation lease expiry. Strictly decode correlated v2 frames, reject trailing or unknown fields, bound invocation reuse, and exercise nil-host, duplicate, and fuzz paths.\n\nConstraint: v1 host wire compatibility remains unchanged\nRejected: Per-facade output/scanner locks | allowed terminal races and duplicate IDs\nConfidence: high\nScope-risk: moderate\nDirective: Keep host_call and host_response outer v2 correlation fields synchronized with server protocol\nTested: go test ./..., go test -race ./plugin, go vet ./..., git diff --check\nNot-tested: Cross-repository server integration
Share runtime-owned transport output, preserve the v1 host envelope, and strictly validate v2 frame structure and correlation. Add duplicate-key rejection, fail-closed invocation facades, bounded invocation reuse, canonical golden fixtures, and hostile lifecycle coverage. Constraint: Preserve v1 byte-compatible host calls Rejected: Protocol fields in v1 envelopes | breaks existing hosts Confidence: high Scope-risk: moderate Directive: Keep plugin/testdata/stdio-json-v2-runtime-ready.jsonl synchronized with server fixtures Tested: go test ./..., go test -race ./plugin, go vet ./..., 5s fuzz, git diff --check Not-tested: Cross-repository integration
Keep v1 host_call JSON byte-compatible while emitting correlated outer fields only for strict v2 facades. Reject null or missing v2 requests before dispatch. Constraint: Existing v1 consumers depend on legacy envelope Confidence: high Scope-risk: narrow Tested: go test ./... Not-tested: Cross-repository integration
Hold the shared response lock across each admitted write/read exchange so concurrent calls cannot cross-consume responses. Allocate IDs under the transport lock, validate outer and inner response correlation, and advance lifecycle state before terminal frames are emitted. Constraint: Expiration must remain independent of blocking response I/O Rejected: Separate write/read critical sections | permits response ownership races Confidence: high Scope-risk: moderate Directive: Keep terminal output on the runtime-owned shared transport Tested: go test ./... Not-tested: Cross-repository integration
Add a real fuzz target over strict frame decoding; malformed, duplicate, unknown, and trailing inputs must return errors without panicking, while lifecycle validation remains in ServeV2. Constraint: Fuzzing must cover decoder behavior rather than only state transitions Confidence: high Scope-risk: narrow Tested: 5s FuzzStrictV2Decoder Not-tested: Cross-repository integration
Track in-flight invocation calls and wait for admitted exchanges after revocation so invoke_ready cannot overtake an older host call. Remove generated fuzz crash artifacts from the shared fixture tree. Constraint: Expiration must close admission before waiting Rejected: Emit ready immediately after handler return | permits late host output Confidence: high Scope-risk: moderate Tested: go test ./..., go test -race ./plugin, go vet ./..., git diff --check Not-tested: Cross-repository integration
Hold the invocation lease until the full host request/response exchange is terminal, so expiration cannot release ready while an admitted call is still reading. Extract semantic invoke decoding with required-field validation and fuzz its invariants. Constraint: Late calls must fail closed without post-ready output Rejected: Unlock lease before response read | allows lifecycle overlap Confidence: high Scope-risk: moderate Tested: go test ./..., go test -race ./plugin, go vet ./..., 5s semantic fuzz Not-tested: Cross-repository integration
Keep nested strict host payloads limited to legacy domain fields while outer frames carry generation, invocation, and host-call correlation. Remove obsolete facade counters and add an exact regression for nested correlation duplication. Constraint: v1 payload compatibility remains unchanged Rejected: Duplicate nested authority | creates conflicting correlation sources Confidence: high Scope-risk: narrow Tested: go test ./..., go test -race ./plugin, go vet ./..., git diff --check Not-tested: Cross-repository integration
Decode strict host responses with legacy payload fields only and validate all correlation exclusively at the outer frame. Bind ServeV2 terminal and invocation writes to a runtime-owned transport using rt.Out without mutating the supplied host transport. Constraint: v1 response decoding remains compatible Rejected: Nested strict correlation fields | duplicate authority and ambiguous validation Confidence: high Scope-risk: moderate Tested: go test ./..., go test -race ./plugin, go vet ./..., git diff --check Not-tested: Cross-repository integration
Update the shared v2 golden sequence to outer-only correlation and add tests consuming it. Add table coverage for unknown, missing, null, trailing, wrong-generation, and duplicate invoke frames alongside the strict semantic fuzz target. Constraint: Golden bytes are shared with server contract tests Rejected: Untested fixture-only changes | permits drift Confidence: high Scope-risk: moderate Tested: go test ./..., race plugin, vet, 5s fuzz, diff-check Not-tested: Cross-repository integration
Remove obsolete nested correlation checks from strict response validation so canonical outer-only host_response frames are accepted. Add positive canonical response coverage and wrong-outer-generation rejection. Constraint: Outer frame is the sole v2 correlation authority Rejected: Require nested generation/invocation/host_call fields | rejects canonical frames Confidence: high Scope-risk: narrow Tested: go test ./..., race plugin, vet, diff-check Not-tested: Cross-repository integration
Bound semantic v2 invoke decoding by the runtime request limit and add an oversized hostile matrix case alongside exact correlation tests. Constraint: Oversized frames must fail before allocation and dispatch Confidence: high Scope-risk: narrow Tested: go test ./..., race plugin, vet, 5s fuzz, diff-check Not-tested: Cross-repository integration
Close response readers when an invocation expires so stalled fd3 scans terminate, and represent strict ok/result fields as pointers to reject missing or null payloads. Constraint: Expire must revoke admission and unblock pending response reads Rejected: Boolean/raw zero values | cannot distinguish missing and null fields Confidence: medium Scope-risk: moderate Tested: go test ./..., go test -race ./plugin, go vet ./... Not-tested: Platform-specific closer behavior and cross-repository integration
Keep normal Expire limited to admission revocation and pending completion so persistent fd3 survives subsequent invocations. Add explicit Abort for terminal stalled-call cancellation that closes the response source. Constraint: Normal lifecycle must permit the next invocation Rejected: Close shared response source from every Expire | poisons healthy sessions Confidence: high Scope-risk: moderate Tested: go test ./..., race plugin, vet Not-tested: Deterministic stalled Abort integration
Read host responses in a serialized reader goroutine and select against context cancellation. Cancellation poisons and closes the shared response source, waits for reader exit, and returns the context error while normal Expire preserves reusable transports. Constraint: Cancellation is terminal for the runtime transport Rejected: Blocking Scan without cancellation | Expire and callers can hang forever Confidence: medium Scope-risk: moderate Tested: go test ./..., race plugin, vet Not-tested: Deterministic stalled fd3 integration
Add deterministic cancellation coverage for stalled fd3 calls, late-call silence after abort, and two consecutive runtime invocations sharing transport. Constraint: Cancellation is terminal while normal expiration preserves reuse Confidence: high Scope-risk: moderate Tested: full normal/race/vet, 5s fuzz, diff-check Not-tested: Cross-repository integration
Run repeated ServeV2 invocations with a real response-backed HostClient so transport reuse is exercised rather than nil-host output. Constraint: Runtime transport must remain reusable across normal expiration Confidence: medium Scope-risk: narrow Tested: go test ./plugin Not-tested: Full integration matrix
Add a real ServeV2 test whose handler performs KVGet, waits on a controlled canonical fd3 response, and proves result precedes ready. Replace timing-based call-start assumptions with channel synchronization. Constraint: Lifecycle proof must exercise HostClient rather than nil-host output Confidence: medium Scope-risk: moderate Tested: focused ServeV2 and cancellation tests Not-tested: Full matrix rerun
Use a mutex-protected test writer that signals only after a complete host_call line. Snapshot output safely before response, then verify terminal ordering under the race detector. Constraint: Tests must observe actual host_call emission, not handler entry Confidence: high Scope-risk: narrow Tested: go test -race ./plugin -run TestServeV2HostCallResponsePrecedesReady Not-tested: Full suite rerun
Track terminal transport poisoning so Abort prevents every subsequent facade from writing and ServeV2 suppresses result/ready emission after cancellation. Constraint: Cancellation is terminal and must not permit worker reuse Confidence: high Scope-risk: moderate Tested: go test ./..., race plugin, vet Not-tested: Non-closable response-source boundary integration
Treat even null or empty error presence as invalid on successful strict host responses while preserving failure error semantics.
Table actual HostClient.Call cases for missing outer fields, wrong correlations, missing nested id, null ok, and success/failure union conflicts; assert every case fails without panic.
Reject empty, null, and non-string failure error payloads through strict HostClient.Call semantics.
Serialize complete host exchanges through a context-selectable gate so canceled queued calls exit without blocking expiration.
A queued strict call now returns context cancellation without poisoning an active exchange; remove obsolete read lock after channel gate migration.
Queued strict calls now return context cancellation without aborting an admitted exchange, while invalid invocation correlation fails closed before emitting bytes. Constraint: Active exchanges must survive queued cancellation Rejected: Abort shared transport on queued cancellation | would kill active call Confidence: high Scope-risk: narrow Tested: Focused queued cancellation and zero-correlation tests Not-tested: Full suite
ServeV2 now validates that an injected host writer is the runtime writer before emitting runtime_ready, preventing split lifecycle streams. Constraint: v2 lifecycle frames must share rt.Out Rejected: Silently replace host output | hides integration misconfiguration Confidence: high Scope-risk: narrow Tested: Focused mismatch and queued cancellation tests Not-tested: Full suite
The nonclosable response test now shares rt.Out so it reaches the intended fail-closed facade path rather than the independent writer mismatch guard. Constraint: writer mismatch must be tested independently Rejected: Keep separate output in nonclosable test | conflates two validation failures Confidence: high Scope-risk: narrow Tested: plugin tests, race plugin tests, go vet Not-tested: fuzz
Subscription source manifests now use one fixed-order typed schema with canonical construction, strict hostile decoding, stable sv1 hashing, graph and byte bounds, renderer-input coverage, and defensive deep cloning. Snapshot decoding separately records the persisted schema version and rewrite requirement so encrypted v1 data cannot masquerade as durable v2 before storage migration completes. Constraint: Server and Sub-Store must share one secret-free provenance authority before composer integration can proceed. Rejected: Continue carrying arbitrary json.RawMessage manifests | unchecked duplicate, unknown, trailing, and sensitive fields would make source versions non-authoritative. Confidence: high Scope-risk: moderate Reversibility: clean Directive: Construct and decode source manifests only through the SDK helpers; storage must honor NeedsRewrite before publishing migrated v1 records. Tested: Focused canonical/hostile/bounds/aliasing/v1 rewrite tests; go test ./...; go test -race ./model; go vet ./...; gofmt; git diff check. Not-tested: Server SDK pin and durable store integration are the next Task43 slice.
The HostClient.Call hostile table now exercises nested duplicate and unknown fields, null and missing payloads, union violations, wrong protocol or kind, trailing data, and oversized responses through the real exchange path. Constraint: Strict wire validation must be proven at the public call boundary Rejected: Decoder-only assertions | do not prove transport behavior Confidence: high Scope-risk: narrow Tested: HostClient hostile table and plugin package Not-tested: Full suite
Hostile exchange cases now have named subtests for missing and null envelopes, wrong invocation and nested IDs, and zero-correlation calls fail before output. Strict host response fuzzing exercises the actual Call boundary. Writer identity comparison now fails closed for non-comparable writers. Constraint: Shared runtime output requires exact writer identity Rejected: Deep equality for non-comparable writers | distinct writers can compare equal by contents Confidence: high Scope-risk: narrow Tested: Full tests, race, vet, both five-second fuzz targets, diff check Not-tested: Independent review
Canonical provenance now preserves required empty arrays, rejects cyclic or oversized graph inputs, and enforces the one supported renderer. Snapshot decoding rejects ambiguous JSON and binds every v2 record to a validated canonical manifest while retaining explicit v1 rewrite authority. Constraint: E5 provenance must be map-free, bounded, secret-free, and deterministic across storage and renderer boundaries Rejected: Permissive JSON decoding | duplicate, unknown, or version-incompatible fields can change durable interpretation Confidence: high Scope-risk: narrow Directive: Keep v1 migration strict and require paired canonical provenance for all v2 snapshots Tested: go test ./... -count=1; go test -race ./model -count=1; go vet ./...; gofmt; git diff --check
Version-two snapshots now accept the legacy-compatible state where both provenance fields are absent, while still rejecting partial, empty, or hash-mismatched provenance. A v1 decode, v2 rewrite, and second decode regression protects restart durability. Constraint: Existing v1 snapshots have no source manifest but must be rewritten before provenance-aware refresh occurs Rejected: Requiring provenance on every v2 record | it makes a correctly migrated v1 record unreadable on its next restart Confidence: high Scope-risk: narrow Directive: Treat provenance as an atomic optional pair; validate and hash-bind it whenever present Tested: go test ./... -count=1; go test -race ./model -count=1; go vet ./...; gofmt; git diff --check
Zero-correlation calls now prove zero output with a buffer, hostile exchange cases use semantic names, and strict response fuzz checks successful raw results plus emitted host calls. Constraint: Regression tests must observe wire effects Rejected: Discarding output in fail-closed tests | cannot prove no emission Confidence: high Scope-risk: narrow Tested: Full tests, race, vet, diff check Not-tested: Independent review
The actual exchange matrix now covers null outer and nested correlation fields plus missing failure errors. Explicit fuzz seed regressions assert hostile frames fail, while fuzzing continues to exercise arbitrary strict responses. Constraint: Independent review requires named hostile seed evidence Rejected: Rely on random fuzz discovery | does not prove required classes Confidence: high Scope-risk: narrow Tested: Full normal, race, vet, strict seed test, five-second strict response fuzz, diff check Not-tested: Independent review
All hostile response cases now receive semantic labels, including null outer and nested fields. Strict response fuzzing no longer carries an ignored expectation flag and retains canonical positive-result invariants. Constraint: Fuzz inputs must not include unenforced expectation metadata Rejected: Ignored wantOK parameter | gives false evidence Confidence: high Scope-risk: narrow Tested: Full tests, race, vet, five-second strict response fuzz Not-tested: Independent review
Fuzzing now wraps arbitrary JSON payloads in duplicate, unknown, null, and wrong-correlation envelopes and rejects each through HostClient.Call, while canonical success wrappers must return the exact payload bytes. Constraint: Fuzz must not infer validity from arbitrary input Rejected: Raw-input validity guesses | misses wrapper contract violations Confidence: high Scope-risk: narrow Tested: Full tests, race, vet, diff check Not-tested: Independent review
Positive strict response fuzz cases now fail immediately on any Call error and compare returned bytes exactly to the normalized payload while requiring emitted host output. Constraint: Success semantics require exact payload preservation Rejected: Checking only non-empty result | permits corruption Confidence: high Scope-risk: narrow Tested: Focused hostile and fuzz tests x20 Not-tested: Full gates
SDK decoding now permits bounded lat$ persistence expansion while retaining the 1 MiB limit for plaintext provider content. The server remains responsible for rejecting malformed envelopes and reapplying the plaintext limit after authenticated decryption. Constraint: AES-GCM and base64 expansion make a valid encrypted 1 MiB payload larger than the plaintext SDK limit Rejected: Raise the plaintext limit to the envelope size | callers could then persist oversized provider responses Confidence: high Scope-risk: narrow Directive: Keep malformed-envelope and post-decrypt size enforcement at the server persistence boundary Tested: go test ./... -count=1; go test -race ./model -count=1; go vet ./...; gopls check; gofmt; git diff --check
The SDK-owned manifest validator now rejects ambiguous or sensitive text across identity, endpoint, and ALPN fields; enforces canonical DNS/IP hosts; and fixes v1 to chrome, valid REALITY public material, lowercase short IDs, vision flow, and a duplicate-free supported ALPN set. Constraint: Source versions are authoritative only when semantically equivalent renderer inputs have exactly one byte representation Rejected: Generic nonempty string checks | whitespace, alternate encodings, and unsupported renderer values can hash differently or leak secret-shaped input Confidence: high Scope-risk: moderate Directive: Extend this single validator whenever the supported renderer input surface changes Tested: go test ./... -count=1; go test -race ./model -count=1; go vet ./...; gopls check; gofmt; git diff --check
The strict host-call regression now declares its complete hostile matrix directly, eliminating a duplicated positional fallback that could silently mislabel or omit cases. Fuzz success payloads are compacted and limited to values the production JSON semantic decoder can represent, preserving byte-exact result assertions. Constraint: The matrix must exercise the real HostClient.Call path with stable case identity Rejected: Parallel frames and names slices | positional drift hid duplicated semantics and weakened reviewability Confidence: high Scope-risk: narrow Directive: Add new hostile frames as named entries in the single composite literal Tested: focused race count=20; go test ./...; go test -race ./plugin; go vet ./...; FuzzStrictV2Decoder 5s; FuzzStrictHostResponseValidation 5s; gofmt; git diff --check
Fuzz-generated JSON is now decoded to a semantic value and remarshaled before it enters the positive response path, so duplicate object keys and alternate lexical forms cannot masquerade as canonical frames. Oversized payloads fall back to a bounded fixture, while an explicit duplicate-empty-key seed permanently exercises the discovered regression. Constraint: Positive fuzz frames must satisfy the same unique-key and size contract enforced by the production decoder Rejected: json.Valid plus whitespace compaction | it preserves duplicate keys and values outside the accepted semantic representation Confidence: high Scope-risk: narrow Directive: Keep hostile arbitrary bytes separate from canonical positive payload construction Tested: focused race count=20; go test ./...; go test -race ./plugin; go vet ./...; FuzzStrictV2Decoder 5s; FuzzStrictHostResponseValidation 5s; gofmt; git diff --check
The strict response fuzz test now directly enforces non-empty result and emitted host output after the explicit success error check. Constraint: Successful canonical calls must satisfy wire assertions Rejected: Nested tautological err guard | allowed assertion bypass Confidence: high Scope-risk: narrow Tested: Focused fuzz validation and diff check Not-tested: Full suite
Extend the unreleased stdio-json-v2 contract with a correlated stderr marker and stdout completion frame so the host can bound invocation diagnostics across independent pipes before releasing a reusable worker. Constraint: The v2 host must observe both the exact FD2 marker and stdout stderr_complete before invoke_ready Rejected: Helper-only sentinel | production SDK and SubStore runtimes would retire every successful worker Confidence: high Scope-risk: moderate Reversibility: clean Directive: Keep marker, stderr_complete, and invoke_ready ordering atomic across SDK, server, and plugin runtimes Tested: go test ./plugin/... -count=1; go test -race ./plugin/... -count=3; go vet ./plugin/... Not-tested: real SubStore binary integration pending downstream pin
Version-two runtimes now negotiate stderr_frames_v1 and expose an invocation-scoped diagnostic writer that serializes correlated base64 chunks on the same ordered stdout protocol as host calls and terminal frames. Raw FD2 is no longer used as an invocation delimiter, eliminating the cross-pipe ordering claim that background writes could violate. Constraint: Independent stdout and stderr pipes cannot establish a reliable per-invocation byte boundary Rejected: Correlated raw FD2 marker | writes after the marker could contaminate the next leased invocation Confidence: high Scope-risk: moderate Reversibility: clean Directive: Expire and join diagnostic writers before invoke_result and reject any v2 peer without stderr_frames_v1 Tested: go test ./...; plugin race count=5; go vet; gopls check; git diff --check Not-tested: server and SubStore adoption are verified in their separate cross-repo commits
The SDK now serializes no-host diagnostic frames through the runtime writer, treats empty writes as no-ops, and models stderr_chunk as a correlated pre-result lifecycle self-loop. The obsolete raw-stderr option is removed and the public contract states that raw FD2 is process-scoped bounded discard telemetry rather than invocation output. Constraint: Every v2 frame shares one ordered stdout serialization domain Rejected: Release the diagnostic lock before an unguarded encoder | concurrent writes could interleave invalid JSON Confidence: high Scope-risk: narrow Reversibility: clean Directive: Accept stderr_chunk only before invoke_result and keep InvocationStderr as the sole attributed diagnostic writer Tested: go test ./...; focused race count=10; go vet; gopls check; git diff --check Not-tested: server adoption is verified in the following server protocol commit
The E5 graph contract needs the reviewed stdio runtime implementation and the canonical subscription models on one SDK history. Preserve both reviewed subtrees exactly so downstream pins can consume one auditable commit without rebasing either line of work. Constraint: Merge topology must retain c151b2e as first parent and fd39090 as second parent Rejected: Rebase or squash the reviewed branches | that would destroy the accepted review ancestry and per-branch evidence Confidence: high Scope-risk: moderate Directive: Keep plugin subtree byte-identical to fd39090 and model subtree byte-identical to c151b2e at this merge boundary Tested: Index plugin subtree equals fd39090; index model subtree equals c151b2e Not-tested: Combined SDK normal, race, vet, transport boundary extensions, downstream pins, release, or deployment
The graph composition contract needs a four MiB rpc.call result without allowing an unbounded JSONL correlation envelope. Separate those limits, validate canonical numeric correlation identities, and keep the legacy option name as an explicit payload alias. Constraint: host_response.result is capped at 4 MiB while the full JSON frame, excluding its delimiter, has only 4 KiB of independent overhead Rejected: Raise the scanner limit alone | escaped envelopes would redefine the payload contract and retain ambiguous off-by-one behavior Rejected: Accept opaque correlation strings | pooled v2 sessions require bounded canonical identities for exact matching Confidence: high Scope-risk: moderate Directive: Keep MaxResponseBytes payload-only and enforce frame limits separately before decoding future envelope fields Tested: go test ./... -count=1 -timeout=10m; go test -race ./... -count=1 -timeout=10m; go vet ./...; gopls check touched files; exact v1/v2 N, N+1, F, F+1, no-desync, and correlation hostile matrices Not-tested: Cross-repository server runner integration awaits the dependent Task68 consumer slice
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome
sv1+sha256bindingVerification
go test ./... -count=1go test -race ./model -count=1go vet ./...gopls check model/subscription_source_manifest.go model/subscription_snapshot.gogofmtcleangit diff --checkIndependent review: PASS with zero findings at exact head
c151b2e11168bfcc138800f9f996844fd5e74d06.No tag or release is part of this draft PR.