[schickling-assistant]

Problem

Identity preparation can retain failed or abandoned scratch secrets and replace a valid pending key after an operational read failure.

Goal

Land the self-contained identity-store portion of #345 in an independent change.

Decisions

Copy only src/identity.rs from #345 plus its preparation changelog entry: 168 additions and 7 deletions (175 changed lines). No CLI glue or dead-code allowances needed.

Verification

Exact head: 310bfb1.

• Hosted test workflow SUCCESS: https://github.com/compoundingtech/fabric/actions/runs/41677901172 (workspace library/binary tests and integration matrix; deterministic 18m11s, macOS 14m10s, public-text 7s).
• Hosted Nix build SUCCESS: https://github.com/compoundingtech/fabric/actions/runs/41677901113 (11m51s).
• Local pinned-shell cargo clippy --locked --all-targets: exit 0, 34.88s, via gate-slot check lane.
• The optional stricter Clippy run with -D warnings exits 101 on existing untouched dependency-package lints (child_spawn.rs unnecessary_sort_by; sync/config.rs needless_borrows_for_generic_args). Plain Clippy also reports existing repository warnings plus enum_variant_names and collapsible_if in the copied test-only fault injector. No warnings were suppressed.

New regressions cover failed sync/rename cleanup, locked abandoned-key sweeping, read-error preservation, and malformed-key replacement. Hosted test evidence replaces redundant local tests; no local test-success claim is made.

Complexity

No new production abstraction; test-only thread-local I/O fault injection copied unchanged from #345.

Concerns

Activation recovery and signal handling remain in #345. No strict warning-clean claim: the optional -D warnings proof is red. Independent review remains for the integration owner.

Friction & bottlenecks

Heavy admission waits were 3,598s (outer deadline), 5,289s (ambient Cargo unavailable), and approximately 6,460s for the pinned Clippy build, including a maintenance fence. The warm check-lane run admitted immediately. Dedicated Cargo output was removed: 434,878,650 apparent bytes, 222,914,560 allocated bytes reclaimed.

Follow-ups

After merge, merge main into #345 without rewriting its branch; preserve both changelog bullets if the insertion conflicts. Expected remainder: 237 changed lines (236 additions, 1 deletion). Release preparation #347 depends on both.

References

See #345 and #347.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	fabric/2026-11-03-identity-store-split

[schickling-assistant]

Local proof admission update: the first heavy gate waited 3,598 seconds without admitting Cargo, moving from 17 queued jobs ahead to 1. The outer 3,600-second process deadline stopped that wait; no test compiled or ran in that attempt. Retrying test and Clippy sequentially in one heavy hold without an outer deadline. This is resource admission evidence, not a source/test failure.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	fabric/2026-11-03-identity-store-split

[schickling-assistant]

Exact-head hosted evidence at 310bfb1:

• test: SUCCESS — https://github.com/compoundingtech/fabric/actions/runs/41677901172 (deterministic 18m11s, macOS 14m10s, public-text 7s). This executes workspace library/binary tests and the workflow’s integration matrix.
• Nix build: SUCCESS — https://github.com/compoundingtech/fabric/actions/runs/41677901113 (11m51s).

Neither workflow invokes Clippy. Only the missing proof, cargo clippy --locked --all-targets -- -D warnings, is now queued locally in the pinned nix develop shell under the heavy admission gate. The unadmitted redundant local test run was cancelled. The earlier ambient-shell commands exited 127 because the real Cargo binary was absent; that was not a source compilation failure.

Dependent release preparation: #347. After this PR lands, merge main into #345 without force-push; preserve both changelog bullets if the insertion conflicts. The expected remainder is 237 changed lines.

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	fabric/2026-11-03-identity-store-split

[schickling-assistant]

GO at 310bfb1 (Review346, an independent reviewer subagent). src/identity.rs is identical to #345 at bd45ec9. identity.toml bytes, NodeID derivation and crypto domains are unchanged. The PR stands alone without the main.rs changes from #345. The new clippy warnings are test-only and do not block the merge. Hosted test run 41677901172 and Nix run 41677901113 passed. Fabric-mesh merges it under Johannes's self-merge authorization (#345 issuecomment-6609960025).

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/fabric-mesh
session	01a1ecd5
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	smalltalk/main