diff --git a/devlog/_plan/260919_contract_resolution/000_plan.md b/devlog/_plan/260919_contract_resolution/000_plan.md index 7f8ac58ac9..f0d238bf18 100644 --- a/devlog/_plan/260919_contract_resolution/000_plan.md +++ b/devlog/_plan/260919_contract_resolution/000_plan.md @@ -18,8 +18,8 @@ Evidence lives in this unit; previous implementation specifications remain in `d | Lane | Sole issue ownership | File domains and sequence | | --- | --- | --- | -| Runtime | #5109 #5110 #5111 #5113 #5115 #5122 #5123 #5124 | Raw transport contract, custom input consistency, send accounting, journal ownership and continuation policy. Stack null-body/coding only if a real shared helper dependency exists; upload can stay independent. Keep stream and state changes separate. | -| Policy and operator | #5112 #5114 #5116 #5117 #5118 #5119 #5120 #5121 | Schema reports before reject-lossy policy, static merge parity before consolidation, identity hints separate from availability, authority-map/tooling, optional metrics and pure preview, documentation alignment. Stack by these dependencies; independent docs can land separately. | +| Runtime | #5109 #5110 #5111 #5113 #5115 #5118 #5122 #5123 #5124 | Raw transport contract, custom input consistency, send accounting, journal ownership and continuation policy. Stack null-body/coding only if a real shared helper dependency exists; upload can stay independent. Keep stream and state changes separate. | +| Policy and operator | #5112 #5114 #5116 #5117 #5119 #5120 #5121 | Schema reports before reject-lossy policy, static merge parity before consolidation, identity hints separate from availability, authority-map/tooling, optional metrics and pure preview, documentation alignment. Stack by these dependencies; independent docs can land separately. | | Coordinator | Review, CI, base/merge judgment and issue closure | Workers never merge or close issues. Cross-lane shared test-layout/structure changes are serialized at integration, with no cap increases or dropped regressions. | The user chose two different main-task models and a specific subagent model. Runtime/model selection provenance stays in task records rather than public repository artifacts. Workers may use unlimited useful subagent rounds; concurrent workers have disjoint writes and never perform branch-level git operations in parallel on one checkout. @@ -49,3 +49,5 @@ The roadmap is locked, the two isolated implementation owners are active, and th Ownership amendment: #5115 moved to the runtime owner after the policy owner confirmed no implementation writer or commit existed. Independent preparation can proceed on current dev because its known-model hint region is unchanged by #5174; final landing remains after #5171 and #5174, with a fresh integration base, reviewed delta and exact-head hosted CI. The two-owner limit, acceptance criteria and execution restrictions are unchanged. Independent preparation audit accepted the #5115 ownership amendment: `knownModelIdsForProvider` is byte-identical across #5174, the registry entry type is unchanged by that layer, and the new helper has no static-policy dependency. Expected later overlap is import ordering and line movement; integration must retain both independent changes and obtain new-head hosted proof. + +Second ownership amendment: #5118 transferred to the existing runtime owner after confirmation that no implementation writer, branch or commit existed. Server and dashboard delivery remain required, with the prior private pre-build audit incorporated before implementation. Metrics-to-preview shared-route integration is serialized; preparation can proceed in disjoint files. Dashboard evidence must satisfy the actual file-based screenshot gate using hosted artifacts under the no-local-build restriction. No third implementation owner was created. diff --git a/devlog/_plan/260919_contract_resolution/001_status.md b/devlog/_plan/260919_contract_resolution/001_status.md index 3b18bd361f..0b92cf7613 100644 --- a/devlog/_plan/260919_contract_resolution/001_status.md +++ b/devlog/_plan/260919_contract_resolution/001_status.md @@ -1,13 +1,13 @@ # Campaign status -Status: ACTIVE. Ten of the sixteen original issues are resolved and closed. Remaining: #5112, #5114, #5115, #5117, #5118, #5123. Supplementary sideband recovery #5161 and send-assertion follow-up #5170 are merged. Runtime ownership #5157, strict-policy child #5167 (report parent #5162 merged), and static-policy resolver/consumer stack #5171/#5174 are under exact-head hosted verification and static review. Latest integration recorded here: #5162 at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`. +Status: ACTIVE. Thirteen of the sixteen original issues are resolved and closed. Remaining: #5114, #5117, #5118. Supplementary sideband recovery #5161 and send-assertion follow-up #5170 are merged. Runtime ownership #5157 is merged. Strict-policy child #5167 is merged. Static-policy resolver/consumer stack #5171/#5174 and metrics #5183 remain under review and hosted verification; preview #5185 is a draft. Integration snapshot at 2026-09-19T15:27:51Z: #5167 at `96a6de86b71cf8a8f78959e0bf626dac642510a7`. ## Owners | Lane | State | Issues | | --- | --- | --- | -| Runtime | Active in an isolated worktree | #5109 #5110 #5111 #5113 #5115 #5122 #5123 #5124 | -| Policy and operator | Active in an isolated worktree | #5112 #5114 #5116 #5117 #5118 #5119 #5120 #5121 | +| Runtime | Active in an isolated worktree | #5109 #5110 #5111 #5113 #5115 #5118 #5122 #5123 #5124 | +| Policy and operator | Active in an isolated worktree | #5112 #5114 #5116 #5117 #5119 #5120 #5121 | Private orchestration records retain the actual task handles, model-selection evidence and wake cursors. The current coordinator heartbeat is ACTIVE at a 20-minute interval. It follows the two existing implementation owners; it must not duplicate them. The coordinator owns integration and issue closure. @@ -20,8 +20,8 @@ Private orchestration records retain the actual task handles, model-selection ev ## Issue outcomes -Closed: #5109, #5110, #5111, #5113, #5116, #5119, #5120, #5121, #5122, #5124. -Open: #5112, #5114, #5115, #5117, #5118, #5123. +Closed: #5109, #5110, #5111, #5112, #5113, #5115, #5116, #5119, #5120, #5121, #5122, #5123, #5124. +Open: #5114, #5117, #5118. The entries below are chronological historical checkpoints. Their earlier open/closed states do not override the current summary or acceptance ledger. @@ -126,3 +126,11 @@ Report parent #5162 merged at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1` after c Runtime owner pushed `9e789c1613b22109dd0398e9619be8902bff9662` for #5157: management ACL failure injection is restricted to the token file, the stream retry fixture uses its narrow relay-platform seam, and the direct combo fixture holds a writer lease and drains its response. Assertions and production ownership rules are unchanged in this delta. Independent review and fresh hosted CI are required. Policy owner is implementing #5117 in its isolated checkout while repairing #5174; #5115 and #5118 remain required scope. Ownership amendment: #5115 moved to the runtime owner after the policy owner confirmed no implementation writer or commit existed. Independent preparation can proceed on current dev because its known-model hint region is unchanged by #5174; final landing remains after #5171 and #5174, with a fresh integration base, reviewed delta and exact-head hosted CI. The two-owner limit, acceptance criteria and execution restrictions are unchanged. + +#5157 integrated and #5123 closed after final acceptance verification. Current progress is11/16, with five remaining original issues. See031_pr_5157.md for exact-head CI and merge evidence. + +Second ownership amendment: #5118 transferred to the existing runtime owner after confirmation that no implementation writer, branch or commit existed. Server and dashboard delivery remain required, with the prior private pre-build audit incorporated before implementation. Metrics-to-preview shared-route integration is serialized; preparation can proceed in disjoint files. Dashboard evidence must satisfy the actual file-based screenshot gate using hosted artifacts under the no-local-build restriction. No third implementation owner was created. + +#5177 is integrated and #5115 closed after complete acceptance verification. Current progress is12/16; remaining issues are #5112/#5114/#5117/#5118. The independent decode-hint change landed before policy migration after a recorded source-based sequencing amendment. + +The current-task heartbeat was updated and read back ACTIVE with the existing twenty-minute cadence. It now reflects twelve closed issues, runtime ownership of #5118, policy ownership of #5112/#5114/#5117, and the remaining publication/visual verification duties. Other task monitors were not modified. diff --git a/devlog/_plan/260919_contract_resolution/020_integration.md b/devlog/_plan/260919_contract_resolution/020_integration.md index 2909611e5b..d005e4e438 100644 --- a/devlog/_plan/260919_contract_resolution/020_integration.md +++ b/devlog/_plan/260919_contract_resolution/020_integration.md @@ -74,3 +74,5 @@ Background receipt update: #5009 advanced from a relocated-test conflict to clea Background receipts now record clean replay for #3901 at `d0da0264e8092f65575b6eb69aa9bc2ee067e9d8` and #3983 at `c25e79ea0d076859aa43f09fd97802e3e7cd79ee` after the whitespace correction. #4989 publication matched remote head `7a8cb1ad286355c5aaefcdd84b16752daad8e849`. The separate consolidation command reports #3389 closed as superseded by #4989, not merged. #3025 still reports a Logs.tsx conflict at a later replay step. These are external lane receipts rather than campaign completion evidence. Final background batch in this notification: #4056 reports clean replay at `5eb0d1e311a1c2d5986bcd701711cd007f2090b8`; #4225 still has a compatibility-facade conflict. An older pinned-base check detected concurrent remote changes for #5157 and #5136, and verified an externally updated #5016. The historical pinned-base mismatch is not current mergeability evidence and triggers no automatic overwrite/rebase by this coordinator. Both campaign implementation owners remain active, repairing the separately observed exact-head CI failures. + +Cumulative integration verification: push run [35446842226](https://github.com/lidge-jun/opencodex/actions/runs/35446842226) completed successfully at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`, including aggregate ci and all applicable jobs. This independently verifies the earlier runtime union through #5170/#5162. The later docs-only #5175 is separate; future runtime integrations still require fresh cumulative proof. Superseded earlier runs are not retried merely because their canceled legs made an aggregate red. diff --git a/devlog/_plan/260919_contract_resolution/031_pr_5157.md b/devlog/_plan/260919_contract_resolution/031_pr_5157.md index 64884c8a1c..660153430b 100644 --- a/devlog/_plan/260919_contract_resolution/031_pr_5157.md +++ b/devlog/_plan/260919_contract_resolution/031_pr_5157.md @@ -1,6 +1,6 @@ # PR 5157: spend-ledger writer ownership -Issue #5123 is open. [PR #5157](https://github.com/lidge-jun/opencodex/pull/5157) targets `dev`; its current head is `647dc675019a995b97c73c7b7ce02fe4cebaf5f4`. It has not been integrated and is not approved for merge until exact-head hosted verification and remaining public reviews pass. +Issue #5123 is closed after verified integration. [PR #5157](https://github.com/lidge-jun/opencodex/pull/5157) targets `dev`; its current head is `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3`. It merged into dev as `40670044146adc714f06d8b2e29f9114f8393df5`; the entries below preserve pre-integration checkpoints. The proposed control requires a single writer for each state directory. Implementation and regression changes have received independent static reviews, including storage, startup/shutdown, fixture lifetime, and current integration compatibility. Detailed security review and historical repair reasoning are retained in ignored task scratch pending a final published outcome. @@ -9,3 +9,11 @@ The preceding head `271139883a552f1aac9ce3f847eb94e3327e5efc` failed Linux shard Local suites, individual tests, typecheck, builds, installation and runtime execution were NOT RUN. Static syntax screens performed during earlier review are not compiler or runtime proof. No issue closure or completion claim is made. A subsequent three-file fixture correction addresses platform-specific hosted failures. Independent delta review and current-head hosted CI are running; previous-head successes do not establish the new head. Public status remains open and unmerged. + +Acceptance mapping exposed a mode-activation gap in the process tests. The new test-only delta adds all four holder/contender combinations with actual contender policy configuration, and a transition from observation to enforcement. Independent review and new-head hosted CI are pending; no production behavior change or completion is claimed. + +Independent review of the mode-activation correction at `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3` passed. The real-process matrix and configuration transition now exercise the stated modes; existing failure, restart, cleanup and privacy checks remain. Hosted CI at this head is still required. + +Verified integration at 2026-09-19T14:35:24Z: reviewed head `a67cd9b3be6965f3b7435aa0702b6b9b5bf68fc3` passed all applicable hosted checks and aggregate [35448104919](https://github.com/lidge-jun/opencodex/actions/runs/35448104919). Logs show actual four-mode process contention, observation-to-enforcement transition, independent directories, crash recovery and startup rollback. Independent technical/security and nine-file integration-union reviews passed; no unresolved public reviews or maintainer objections remained. Merge `40670044146adc714f06d8b2e29f9114f8393df5` was verified in origin/dev before #5123 closed at 2026-09-19T14:36:03Z. The resulting cumulative dev run remains separately monitored. + +Cumulative dev verification completed successfully at merge head `40670044146adc714f06d8b2e29f9114f8393df5` in [push run35449204833](https://github.com/lidge-jun/opencodex/actions/runs/35449204833). All applicable jobs and aggregate passed, confirming the integrated ownership change with the current runtime union. diff --git a/devlog/_plan/260919_contract_resolution/034_strict_schema_policy.md b/devlog/_plan/260919_contract_resolution/034_strict_schema_policy.md index f3eeccfed1..a2561f82ae 100644 --- a/devlog/_plan/260919_contract_resolution/034_strict_schema_policy.md +++ b/devlog/_plan/260919_contract_resolution/034_strict_schema_policy.md @@ -23,3 +23,27 @@ Secondchildhostedfailure: test2job105898238282 layoutseed resolvesgoogle-tool-sc Child745f6b6 test-onlycorrectionindependentPASS: originalVertex400literalexpected, newdiagnosticprivacyretained, renamedmanagement-configtestbody100%unchangedandseed/explicit/expectedagree. Parsedregistrydiffhasnoothermappingchanges. Latestchild60516397 requiresinterdiffconfirmation beforeusingearlierevidence. Latestchild60516397 onlyrestoresregistryformatting over745f6b6; parsedfullJSONsemanticsequalforbothlayoutfiles. Previousscopedtest/code reviewsremainvalid; currentheadCIrequired. + +Prepared post-parent cascade at `16ed5bee42eb53110983e2788f607c390bf43ac0` has clean merge-tree against current dev. Range-diff matches the first four strict-policy commits exactly; test rename/repair history is consolidated. Final inventory/union re-review was assigned before treating the cascade as equivalent. The previous head CI is not new-head proof; fresh hosted CI remains required. + +Independent cascade review PASS at `16ed5bee42eb53110983e2788f607c390bf43ac0`: base ancestry verified, first four stable patch IDs preserved, complete child patch equivalent excluding the two test-layout inventories, renamed test byte-identical, and inventories changed only the intended test name. Production strict-uncertainty behavior, docs and regression assertions remain intact. The new head is published and hosted CI is in progress. + +Current public review additionally requests consistent documentation of both strict refusal conditions (proven loss or indeterminate comparison), and exact repair-diagnostic shape. Source/documentation validation was assigned before accepting the requested edits. The request for local verification commands does not override the task restriction: applicable hosted suite, type and privacy proof must be recorded instead. The current PR remains unmerged. + +Independent documentation validation confirmed a bounded seventeen-file correction: all eight guide/configuration pairs must describe rejection on proven loss or indeterminate comparison; the eight guides must include the bounded uncertainty count in their report shape; the Google structure repair-shape list must include the same field already emitted by source. No runtime change was requested. + +Documentation correction `fc12e8f7b009cc31b6bebf7b6633c91de35d972b` is prepared; seventeen-file locale/shape interdiff review assigned. Earlier runtime reviews remain relevant only where source is unchanged; new-head hosted proof is still required. + +The seventeen-file uncertainty documentation correction passed independent review. New head `50af16087ca08751af7c1b1e49fd85337a1b99f2` additionally clarifies that compatibility repair replay remains enabled by default and adds exact original-400-body assertions in two existing regression cases. This narrow delta is under re-review; production source is unchanged. + +Final nine-file delta at `50af16087ca08751af7c1b1e49fd85337a1b99f2` passed independent review: each translated guide distinguishes strict repair withholding from unchanged default replay, and both additional response assertions retain the original 400 payload and one-send behavior while diagnostic canaries stay excluded. Production source is unchanged. No known static blocker remains; current-head hosted jobs are still running. + +Final integration-union review passed for candidate tree `07141dc1ab9e6dbe313208a1bf5a00f3e0979968` with dev `4067004414`: five shared structure/layout files preserve both ownership and strict-policy contracts; source/tests on each side remain intact. New public wording feedback identified one separate diagnostic-boundary clarification: strict initial compilation throws before initial loss-record emission, while strict repair has its own record. Main verified the source order and requested a precise eight-guide correction, without changing runtime behavior. + +The latest guide-only review accepted the strict initial diagnostic boundary but rejected a newly added statement that the policy error carries the full same facts as the report. The error and report have different bounded shapes. The owner was asked only to remove that added clause across eight translations, retaining all already-correct behavior descriptions and avoiding a runtime expansion. + +Commit `eb5d51b7c0` removes only the newly introduced overclaim about policy-error/report equivalence from all eight guides. Main inspected the bounded deletion; independent language consistency re-review is pending. No runtime or regression behavior changes in this delta. + +Independent review accepted final eight-guide clause removal at `eb5d51b7c022637ac086639a695864bcf1f7a136`. No other claim or behavior changed. Current-head hosted verification remains required before integration. + +Verified integration: #5167 merged as `96a6de86b71cf8a8f78959e0bf626dac642510a7` at2026-09-19T15:26:53Z. Exact headeb5d51b7 passed every applicable job and aggregate [35450471540](https://github.com/lidge-jun/opencodex/actions/runs/35450471540), including type/privacy checks. Logs explicitly show endpoint loss/uncertainty refusals, lossless/native-output acceptance, indexed/unindexed withholding, direct no-repair and CLI/management persistence. All known reviews resolved; current union retains ownership and decode hints. Both parent8a030721 and child merge ancestries were verified before #5112 was closed. No local execution. diff --git a/devlog/_plan/260919_contract_resolution/035_static_policy_resolver.md b/devlog/_plan/260919_contract_resolution/035_static_policy_resolver.md index 3a08cfb1b1..6d6a5c0487 100644 --- a/devlog/_plan/260919_contract_resolution/035_static_policy_resolver.md +++ b/devlog/_plan/260919_contract_resolution/035_static_policy_resolver.md @@ -21,3 +21,27 @@ Second independent review passed router/server source tracing at `7b25d449d98280 Final parent preflight at `2fdd21004eb256890ae9d7a54baab6c00653c65d`: applicable hosted CI and aggregate35446324533 passed, but thirteen public review threads remain unresolved. Merge is held. Findings concern legacy policy parity, limit projection and provenance/documentation; independent source adjudication is split between legacy compatibility and the other projection findings. Owner must reconcile any valid findings in the parent and cascade its child, with fresh exact-head evidence. A green run and earlier subset reviews do not override concrete unresolved findings. Independent source adjudication of thirteen parent threads accepted eleven and rejected two. Accepted work includes raw-input legacy parity, shared family-limit resolution, cross-field input bounds, selected-destination validation/provenance, captured-auth capability overlays, output-default fallback and two documentation scope corrections. Existing callers already repair three legacy cases, so these must not be misreported as observed runtime failures. The explicit captured-auth boundary and existing supported custom-header policy support rejecting two proposed changes. Owner received precise source evidence and minimum regression cases; no blanket header-name heuristic or weakened shared-policy objective was accepted. Corrections must be reviewed at the new parent head and cascaded to the child. + +Parent correction `b21937d152fba9b7eccb8d4c8ff454a0595fa5e6` is published. It addresses the accepted parity, limit and provenance findings with focused oracle cases and extracts pure merge helpers. Two independent re-reviews cover the same adjudicated split; rejected changes remain excluded. New-head CI and child cascade are required before integration. + +The repaired parent still has two concrete review blockers: the legacy reasoning-ladder repair must require a matched registry entry so intentional custom destinations are preserved; service-tier provenance must follow the captured-auth overlay and provider fallback, including unlisted models. Other accepted fixes passed their assigned reviews. Owner received minimal regressions and was asked to batch both corrections before cascading the consumer layer. + +Follow-up parent `df578b6719500344091fcf60a94c3879af72b908` adds the matched-entry legacy guard and corrects service-tier provenance fallback, with focused parity cases and documentation clarification. Independent re-review is limited to the two remaining findings; earlier accepted changes are unchanged. New-head hosted verification is running. + +Both narrow re-reviews at `df578b6719500344091fcf60a94c3879af72b908` passed. Custom unmatched destinations retain their explicit reasoning ladder/provenance; canonical legacy repair remains. Service-tier provenance now follows merged model defaults and captured-auth provider fallback, retaining operator false and covering an unlisted key-auth model. No known static parent blocker remains; current-head hosted proof and consumer cascade remain required. + +Consumer child `20ea64ff9475204443391ffa16980be2f914a579` incorporates the corrected parent but still fails the four observed consumer classes in hosted run35450781362: a narrowed route type omits staticPolicy, resolved URL refusal parity, virtual-model identity behavior, and clearing explicit modality back to inference. Range-diff shows the consumer production patch was unchanged; parent repairs cannot substitute for consumer-specific fixes. Completed job logs and exact anchors were delivered to its owner for a coherent repair while preserving existing assertions. + +Owner confirmed the earlier consumer repair had not actually been executed after its delegated attempt did not proceed. Coordinator requested verified worker acceptance and an actual immutable diff before any renewed repair claim; the parent-only cascade does not count as consumer correction. Existing implementation and regression scope remain unchanged. + +Independent execution-driven source diagnosis split the child failures into two consumer fixes (route type propagation and final wire-model identity selection) and two parent parity fixes exposed by consumption (absent base-URL error semantics and legacy colon-family map lookup). Exact capability lookup remains exact-only. Original test expectations were confirmed meaningful and must remain. Parent integration is held again until these cross-layer findings are corrected; prior isolated static PASS did not establish complete consumer equivalence. + +Prepared consumer correction `1a2ed3eb896d4ee54d7e8b0eefa3d104c28ec684` requires further review: it fixes the retry type and a missing-URL guard, but temporarily restores the old catalog modality authority and does not visibly change the reported final-wire identity selection. Coordinator explicitly retained the shared-authority objective and requested completing those contracts after the parent fallback fix, not treating a compatible bypass as the requested consolidation. Original transport identity assertions remain required. + +Independent consumer review confirmed the type correction, but the virtual-model identity repair was still absent at1a2ed. Owner was explicitly directed to resolve from the final routed model rather than namespaced logging identity, and to consume the shared modality result once the parent lookup parity is fixed. Parent correction6892fd25 adds absent-URL and colon-family cases and is under narrow re-review. + +Parent6892 narrow review found one cross-source provenance mismatch: a registry exact model key wins the merged value over an operator family key, while separate source lookups can incorrectly report operator provenance. Owner was asked to derive value and provenance from the same winning merged lookup and add a cross-source regression. Absent-URL behavior and exact-only capability precedence otherwise passed. Parent remains held until the source/value agreement is proved. + +Parent `844cea4e0f11b5fa78fb5b1352a6949f4ab19035` adds merged winning-key provenance; the consumer stack is published on it at `304648706a360a737cad4d6473b9d164869e4c45`. Narrow parent re-review and exact-head hosted checks are pending. Running checks are not recorded as passing execution evidence. + +Independent review accepted winning-key provenance at `844cea4e0f11b5fa78fb5b1352a6949f4ab19035`, including cross-source exact/family precedence and explicit false. Source and provenance now share the same key-selection order. Current parent/child hosted proof remains in progress. diff --git a/devlog/_plan/260919_contract_resolution/037_acceptance_ledger.md b/devlog/_plan/260919_contract_resolution/037_acceptance_ledger.md index 61fde8b196..733804705f 100644 --- a/devlog/_plan/260919_contract_resolution/037_acceptance_ledger.md +++ b/devlog/_plan/260919_contract_resolution/037_acceptance_ledger.md @@ -1,16 +1,16 @@ # Sixteen-issue acceptance ledger -This checkpoint does not declare the campaign complete. On 2026-09-19, a fresh GitHub query confirmed ten closed issues and six open issues. Every recorded closed-issue merge below was checked as an ancestor of `origin/dev` at `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`. Acceptance/review and exact-head hosted receipts are in the linked per-PR records; this checkpoint does not re-run or replace those checks. +This checkpoint does not declare the campaign complete. Current disposition: thirteen closed issues and three open issues. The initial 2026-09-19 checkpoint confirmed ten closed issues and six open issues; the later verified #5123 closure is recorded below. The initial ten-issue checkpoint checked its recorded merges against `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`. The three later merges for #5123, #5115 and #5112 were separately verified after landing; all thirteen closed-issue merges have now been checked against `96a6de86b71cf8a8f78959e0bf626dac642510a7`. Acceptance/review and exact-head hosted receipts are in the linked per-PR records; this checkpoint does not re-run or replace those checks. | Issue | Current disposition | Evidence / remaining requirement | | --- | --- | --- | | #5109 | Closed; landed through #5125 | [`4e7d7132d8`](021_pr_5125.md); closure at 2026-09-19T08:08:28Z. | | #5110 | Closed; landed through #5127 | [`9824aa55bb`](023_pr_5127.md); closure at 2026-09-19T09:23:33Z. | | #5111 | Closed; landed through #5126 | [`af4f744c75`](022_pr_5126.md); closure at 2026-09-19T10:01:05Z. | -| #5112 | Open; incomplete | Report parent #5162 landed; strict-policy child #5167 requires new-base review, hosted verification and landing. [Record](033_schema_report_review.md). | +| #5112 | Closed; parent #5162 and child #5167 landed | [`96a6de86b7`](034_strict_schema_policy.md); current closure verified after both ancestries. | | #5113 | Closed; landed through #5129 | [`bb2fa5ab25`](024_pr_5129.md); closure at 2026-09-19T10:04:15Z. | | #5114 | Open; incomplete | Resolver #5171 passed hosted CI but has unresolved review findings; consumer #5174 has hosted failures under repair. Both layers must land. [Record](035_static_policy_resolver.md). | -| #5115 | Open; incomplete | Runtime owner now owns registry identity-map classification and selector/availability regressions; final landing follows #5174. [Record](000_plan.md). | +| #5115 | Closed; landed through #5177 | [`838af40f1b`](039_decode_hint_review.md); closure at 2026-09-19T15:01:16Z. | | #5116 | Closed; landed through #5155 | [`6d42723387`](030_pr_5155.md); closure at 2026-09-19T11:07:05Z. | | #5117 | Open; incomplete | Opt-in metadata-only exporter is being implemented; full privacy/auth/counting/lifecycle acceptance remains unverified. [Record](000_plan.md). | | #5118 | Open; incomplete | Server-owned read-only preview, fingerprint validation and dialog integration still required. [Record](000_plan.md). | @@ -18,9 +18,13 @@ This checkpoint does not declare the campaign complete. On 2026-09-19, a fresh G | #5120 | Closed; landed through #5134 | [`1b54f2940b`](026_pr_5134.md); closure at 2026-09-19T09:02:10Z. | | #5121 | Closed; landed through #5138 | [`5ce51cb554`](027_pr_5138.md); closure at 2026-09-19T10:08:29Z. | | #5122 | Closed; landed through #5152 | [`26d3a862d6`](028_pr_5152.md); closure at 2026-09-19T11:06:36Z. | -| #5123 | Open; incomplete | Writer ownership #5157 at 9e789c1613 passed latest fixture-delta review; fresh hosted proof and landing remain required. [Record](031_pr_5157.md). | +| #5123 | Closed; landed through #5157 | [`4067004414`](031_pr_5157.md); closure at 2026-09-19T14:36:03Z. | | #5124 | Closed; landed through #5130 | [`acd43bf442`](025_pr_5130.md); closure at 2026-09-19T10:06:43Z. | -Supplementary requirements: sideband diagnostic/cleanup #5161 and send-assertion follow-up #5170 landed and their goalplan tasks are complete. The broader sideband root-cause issue is not claimed resolved. Public devlog publication, final cumulative dev verification, all remaining acceptance checks, final PABCD closure and heartbeat shutdown remain outstanding. No local test, typecheck, build, installation or proxy execution has been performed. +Supplementary requirements: sideband diagnostic/cleanup #5161 and send-assertion follow-up #5170 landed and their goalplan tasks are complete. The broader sideband root-cause issue is not claimed resolved. The initial public devlog checkpoint is merged; later evidence publication, final cumulative dev verification, all remaining acceptance checks, final PABCD closure and heartbeat shutdown remain outstanding. No local test, typecheck, build, installation or proxy execution has been performed. Publication review checkpoint: independent re-review accepted the corrected English owner/status summary, neutral pre-integration ownership record, and this ledger. The complete historical working records were preserved in ignored scratch; no implementation evidence was discarded. This is documentation readiness for the reviewed files, not permission to declare or publish the campaign as complete. + +Public checkpoint #5175 landed as `57b1df792ef7e66e17b0110727eefdd5387e164d` at 2026-09-19T14:13:30Z after reviewed head `128a47ea9db9b93ffc80fc2d42a2f4cddcc8f8c0` passed all applicable hosted checks and public review. Runtime checks were change-inapplicable, not executed. The original coordinator checkout staging was retained. Future implementation outcomes still require ledger updates and independent completion proof. + +At the #5123 checkpoint, the total was eleven closed and five open; this earlier checkpoint remains historical evidence. diff --git a/devlog/_plan/260919_contract_resolution/038_metrics_review.md b/devlog/_plan/260919_contract_resolution/038_metrics_review.md new file mode 100644 index 0000000000..358b76358f --- /dev/null +++ b/devlog/_plan/260919_contract_resolution/038_metrics_review.md @@ -0,0 +1,35 @@ +# Metrics export acceptance review + +Issue #5117 remains open. Prepared implementation `7578198be2289966fa637e36c996faf9368c1cec` adds an opt-in bounded exporter, configuration, management routing, documentation and focused tests. Runtime aggregation and configuration/privacy/documentation reviews were assigned independently. No local execution was performed. + +Runtime review found two required corrections. Buffered HTTP 200 responses with a failed or incomplete terminal body lose terminal status at the non-stream finalizer and can be classified as completed; parsed terminal metadata must reach the metrics recorder without overriding cancellation or read errors. The new focused cases call recorder/logging helpers or inspect source strings, so they do not prove real HTTP or WebSocket finalization. Add transport-level flows and authenticated scrape assertions for exact logical/physical counts, terminal outcomes and missing timing/cancellation cases. + +Static review accepted bounded labels, the WebSocket duplicate-finalization guard, attempt send-count inputs, terminal-stream EOF handling, disabled-mode inactivity and fresh-owner reset semantics. These accepted parts do not offset the missing acceptance evidence. The implementation owner received the source anchors and must return a corrected immutable head for review and hosted CI. + +The separate config/auth/privacy/docs review passed at the prepared head. It covered default-off strict validation and malformed-load behavior, restart activation, shared transport injection, management authentication before disabled404, fixed labels/finite values, English and seven translated documentation sets, and lifecycle/units documentation. Runtime aggregation and transport-level proof gaps above remain blocking; the scoped PASS is not full implementation acceptance. + +Correction `fbbe437614` passed independent runtime re-review: bounded terminal metadata is propagated only at clean EOF; cancellation and read-error precedence remain. New real-server HTTP and WebSocket scrape regressions cover exact logical/send counts, failed/incomplete buffered responses, retry/recovery, EOF/cancellation, missing versus zero TTFT and disabled behavior. Combined with the earlier config/auth/privacy/docs review, no known static blocker remains. Hosted verification and integration with the current writer-ownership layer still need proof. + +Published as [PR #5183](https://github.com/lidge-jun/opencodex/pull/5183), dev base, head `298ec5f1ce45fdd412eee3d14b6665a199e6eaeb`, after rebasing onto the landed ownership change. The terminal-metadata correction has an identical patch ID; only base-dependent union handling in the initial feature layer changed. Independent rebase/fixture compatibility review and new-head hosted CI are required. The PR is attached to the coordinator task and covers the complete #5117 endpoint scope. + +Initial #5183 hosted run35450374594 failed four new real-flow cases. The first buffered-read-error fixture reports an uncaught injected error; following cases encounter a state-home ownership conflict. Owner received completed-job logs for diagnosis of the first failure and cleanup consequences, without weakening ownership or removing transport assertions. This observed execution failure takes precedence over the earlier source-only PASS. + +A second completed hosted job (Linux shard3, job105916394852) identified one source-oracle mismatch: the WebSocket idle-timeout test expected the previous one-argument handler construction. Owner received the exact anchor to update alongside real-flow repairs while retaining explicit timeout and activation assertions. No test removal or policy relaxation was requested. + +Independent rebase review found no additional integration loss: source/test blobs match the reviewed feature, overlap docs/inventories preserve both metrics and ownership, and production shutdown still releases ownership in final cleanup. The observed read-error fixture and subsequent home-conflict cascade remain owner-assigned repairs; their existence is not evidence to relax production ownership. The separate source-oracle mismatch also remains tracked until corrected. + +Fixture/source-oracle corrections committed at `6158748a4cd2cf5ed70420e2aef56069994910e7`; independent review is scoped to error activation, real transport assertions, complete teardown and retained WebSocket idle-policy coverage. No passing execution claim until new-head hosted CI. + +Independent review accepted `6158748a4cd2cf5ed70420e2aef56069994910e7`: real read-error activation occurs after the first delivered chunk, error precedence remains observable, server teardown is awaited with a failure-visible cleanup safety net, and WebSocket source assertions preserve idle policy and terminal/fallback checks. Current-head hosted jobs are running without observed failures at this checkpoint; no runtime success is claimed yet. + +New-head hosted execution at6158748 removed the subsequent state-home conflicts but still failed two actual transport cases: the buffered error rejects the fetch before body consumption, and cancellation is scraped before the expected aborted count is visible. Owner and independent source reviewer are investigating deterministic transport/error handling and finalization observation, preserving exact counts and avoiding fixed sleeps or skipped assertions. Static fixture approval did not establish execution success. + +Further source tracing corrected the fixture-only assumption: a pre-response handler rejection bypasses final request logging, so the metric is absent. Owner was asked to use the existing once-only finalization guard before rethrowing, preserving client-visible transport behavior and missing timing semantics. The separate cancellation count failure is a propagation race; a bounded upstream-cancel signal can establish the actual completion boundary without sleeps or relaxed counts. Both require new source/test review and hosted proof. + +Production/error-boundary correction `bf462d6070977746a2c5eb377220ca0d80494aaa` is published on #5183. Independent re-review is focused on once-only pre-response failure finalization, unchanged client transport errors, timing/send facts and deterministic cancellation observation. Fresh hosted verification is required. + +Review of the new exception finalizer found a concrete pre-response cancellation case: a client abort during a buffered read reaches the same catch but must classify as aborted, not a non-abort read failure. Owner was asked to choose the existing cancellation status/reason from the actual request signal, preserve once-only finalization and rethrow, and add a live pending-body abort regression while retaining the non-abort failure test. + +Hosted run35451702720 atbf462 again falsified assumptions in the error/cancellation fixtures: the client fetch resolved rather than rejecting in the observed handler-error case, and the expected upstream cancel callback was not observed before the bounded deadline. Owner and reviewer were told to derive a deterministic real-server harness boundary from source and existing conventions, preserve the actual metrics assertions, and avoid changing assertions speculatively or raising timeouts. + +Head `8b589b3114b82027e164f38e08dc580803c89c43` adds cancellation-aware status/reason to the pre-response finalizer and a real pending-body abort case. That correction is under narrow review. The earlier read-error and cancellation fixture execution failures are separate and remain unresolved until a deterministic harness and new hosted proof establish them. diff --git a/devlog/_plan/260919_contract_resolution/039_decode_hint_review.md b/devlog/_plan/260919_contract_resolution/039_decode_hint_review.md new file mode 100644 index 0000000000..f458fd530a --- /dev/null +++ b/devlog/_plan/260919_contract_resolution/039_decode_hint_review.md @@ -0,0 +1,29 @@ +# Registry decode-hint review + +Issue #5115 is owned by the runtime lane following the explicit ownership handoff. Prepared head `b56511bc6d21a20928d8cfe66e97fbbe8a860ba9` is based on `8a030721b3ffc909ca7d8b05ca0b7c873c1493a1`. It adds a registry-owned exhaustive field classification and replaces only the router's manual identity-map list, with existing-file regression additions and structure documentation. + +Independent source review passed: direct and nested model-key maps contribute only their intended identity keys; non-model records and virtual wire-target values remain excluded; existing configured, cached and custom identity sources remain; the transport guard precedes registry hints; no catalog availability or entitlement is inferred. Separate test/documentation review and exact-head hosted execution remain required. + +The layer can be prepared independently because #5174 leaves the known-model hint function unchanged. Final integration remains after #5171 and #5174, with a current integration base, reviewed union and fresh hosted proof. No local execution and no completed-issue claim. + +Test review found missing public-boundary coverage: all maps are enumerated through the helper, but the actual route-decoding table covers only the seven newly omitted direct maps. Owner was asked to extend that same bounded table to all classified direct maps, add the shipped map-only provider decode case and verify the declared frozen-result contract. Existing transport, ambiguity, unknown pass-through and no-availability negatives were accepted. No implementation defect or cap violation was claimed. + +Correction `3918a95040` extends public routing coverage to all fifteen direct maps and checks frozen output. A new shipped-entry example used a transport-mismatched custom configuration and slash-free IDs, so its route equality could pass without activating registry hints. Main review requested a canonical configuration and an explicit map-only known-ID assertion, with accurate naming; the synthetic slash-ID matrix remains the proof of decoding. No production source change was requested. + +The independent test review passed the overall corrected coverage. It also corrected the preceding transport inference: this provider uses the non-key registry-owned matching path, so the custom fixture does not demonstrate transport exclusion. The actual issue is the slash-free selector assertion not proving decode activation. Existing synthetic public cases and shipped helper provenance are sufficient; the shipped example needs accurate wording, not a new production transport change or expanded acceptance contract. + +Final narrow test correction `8502bf99aa` removes only the newly added vacuous slash-free route example and its unused import. All fifteen synthetic public decode cases, the nested case, negatives and frozen-result checks remain; shipped-entry collection parity remains in the separate provider test. Source and test reviews are accepted for publication with exact-head hosted verification; final integration order is unchanged. + +Published as [PR #5177](https://github.com/lidge-jun/opencodex/pull/5177), base dev, exact head `8502bf99aaae6785eac4fe86d818fc454f79872d`. Template and reviewed test scope checked; attached to the coordinator task. Exact-head hosted CI and future integration with the earlier policy layers remain required before #5115 closure. + +Initial #5177 hosted run35448915385 failed the gates job on TS2352 at model-ids.ts:152 (registry entry cast to an indexed record), and a production-graph type-contract test exited nonzero. Completed job logs were retrieved directly before the overall run finished. Owner received the exact diagnostic and is correcting typed iteration/casting without changing classification semantics or removing the contract test. New-head hosted proof is required. + +The prepared type correction iterates keys of the exhaustive classification with the registry key type, reads direct maps through that key and reads the sole nested owner explicitly. Main source review found the current classification semantics preserved without the invalid index-signature cast. A syntax search returning no error-node matches is not a compiler pass; the corrected head still needs hosted type and suite proof. + +Type correction published at `a654ee8e4469f2c431b378a4ec42c68765e74a90` on #5177. Main reviewed the one-file typed-iteration delta; an independent narrow check and fresh hosted compiler/suite proof are pending. Existing public decoding and immutable-output regression coverage is unchanged. + +Independent one-file review of `a654ee8e4469f2c431b378a4ec42c68765e74a90` passed: role iteration order, selected-field access, sole nested owner, exclusion, deduplication and frozen output remain unchanged. Hosted compiler and suite verification is still pending; no local execution occurred. + +At corrected head `a654ee8e4469f2c431b378a4ec42c68765e74a90`, hosted run35449601489 gates and Linux shard4 passed. The shard log explicitly shows the previously failing production-graph translator-budget type contract passing. The original two failures are cleared; remaining applicable jobs and final integration still require completion. + +Verified integration: #5177 merged as `838af40f1b2fe32596b207ff85afcda40636f4d9` at 2026-09-19T15:00:41Z. Exact-head run35449601489 passed all applicable checks and aggregate; public decode cases were observed in macOS logs. Independent source/test/type correction and integration review passed, no public threads or maintainer objections remained, and all six files were preserved in the clean union with no overlapping dev changes. The former policy-first order was explicitly revised after both independent source review and the policy owner confirmed no semantic dependency. Later policy integration must preserve the helper/import and obtain fresh union proof. Issue #5115 closed at 2026-09-19T15:01:16Z after actual dev ancestry verification. diff --git a/devlog/_plan/260919_contract_resolution/040_preview_review.md b/devlog/_plan/260919_contract_resolution/040_preview_review.md new file mode 100644 index 0000000000..c65794e4e0 --- /dev/null +++ b/devlog/_plan/260919_contract_resolution/040_preview_review.md @@ -0,0 +1,7 @@ +# Integration preview delivery status + +Issue #5118 remains open. [PR #5185](https://github.com/lidge-jun/opencodex/pull/5185) is a draft server-layer implementation. The preview API, confirmation-bound mutation, regression coverage, documentation and dashboard delivery must all be completed and verified before issue closure. + +The owner is continuing implementation under independent review. Detailed working review records are retained in ignored scratch. Draft publication and an individual review result are not completion evidence. + +No local tests, typecheck, build, installation or proxy runtime execution were performed. Applicable exact-head hosted CI and actual dashboard visual evidence remain required; a built preview artifact alone is not a screenshot.