Repository navigation
Ticket 0008: fan anchor emission out to the remaining seal points - #319
Conversation
Replicate 0007b's proven emission pattern at the three remaining production seal points: observation bundle completion (observe fixture), codelet validate/run completion, and desktop-transaction dry-run completion. Same opt-in --anchor-key/--anchor-log args, same config-first ordering (unconfigured flows never verify and stay byte-identical plus a notice), same verify->anchor gate, same pending-anchor.json fail-open marker. The marker/notice helpers and AnchorEmissionOutcome move from kernel.rs into commands/anchor.rs and kernel.rs now consumes them -- one implementation, four call sites, no copy-paste. Domain crates learn nothing about anchoring; witness_algorithm and canonicalization_profile are read from each bundle's own witness manifest, never hardcoded. cog-anchor unchanged. Nine new tests (3 per seal point: anchored-and-verifies, fails-to-marker-but-seal-succeeds, absent-args byte-identical against a direct-library baseline). After this ticket, every sealed bundle in the estate either has an anchor in the log or a pending-anchor.json beside it -- the precondition for 0009's reconciler to be total. Implemented by Codex (gpt-5.5) via delegation; Claude-reviewed. Validation run by reviewer (Codex sandbox spawn failed at final rerun): 15 anchor tests green, workspace 536 passed / 7 failed -- the 7 are the pre-existing style_plan snapshot failures on native Windows, unchanged; clippy -D warnings clean; magpie-log still one direct dependent. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ded6d92297
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| .and_then(|mut anchorer| anchorer.anchor("cog observe fixture", request.clone())); | ||
| match result { | ||
| Ok(()) => Ok(AnchorEmissionOutcome::Anchored), | ||
| Err(err) => Ok(write_pending_anchor_warning( |
There was a problem hiding this comment.
When observation anchoring fails after the pre-anchor verification step (for example, --anchor-log points at a directory or cannot be appended), this writes pending-anchor.json into the observation run and still returns success. I checked cog_observation::verify_observation_bundle: it enumerates files in the run directory and reports uncommitted_artifact_present for anything not in its required/allowed verifier-output lists, and pending-anchor.json is not allowed, so the bundle that just “sealed” will fail a later cog verify observation --run <dir> solely because of the pending marker. The observation marker needs to be whitelisted/committed or written outside the strict bundle directory.
Useful? React with 👍 / 👎.
1 participant
What
Ticket 0008 — replicates 0007b's proven emission pattern at the three remaining production seal points, completing the ADR-0001 rollout:
bundle_kindrun_idsourceobserve fixtureobservation_request.request_idcodelet validate/codelet runcodelet_run)codelet_id:version:backend(synthesized — see note)transaction dry-rundesktop_transaction)transaction_idSame opt-in
--anchor-key/--anchor-log, same config-first ordering (unconfigured flows never verify, stay byte-identical + notice), same verify→anchor gate, same fail-openpending-anchor.json.Dedup done right: the marker/notice helpers and
AnchorEmissionOutcomemoved fromkernel.rsintocommands/anchor.rs; kernel now consumes them — one implementation, four call sites. Domain crates learn nothing about anchoring;witness_algorithm/canonicalization_profileare read from each bundle's own witness manifest, never hardcoded.cog-anchorunchanged, as the ticket required.After this PR: every sealed bundle in the estate either has an anchor in the log or a
pending-anchor.jsonbeside it — the precondition for 0009's reconciler to be total.Review (validation run by reviewer — Codex's sandbox spawn failed at its final rerun, honestly reported)
style_plan::snapshot_*native-Windows failures (identical on clean main; pass on ubuntu CI)-D warnings(cog-cli)magpie_logdirect in cog-cliAnchorercargo tree -i magpie-logNine new tests — the 0007 trio per seal point. The absent-args tests are strong: they byte-compare the entire output tree against a baseline produced by calling the domain library directly.
Reviewer notes (non-blocking)
run_idis synthesized (codelet_id:version:backend) because codelet witness manifests carry no per-run id. Two identical validations share arun_idand awitness_root, so 0009's root-keyed dedupe treats them as the same segment — arguably correct (identical content), but worth knowing.observation.rs—cog-observationkeeps those names private, and exporting them would touch a domain crate (out of scope). Right call.Provenance
Implemented by Codex (gpt-5.5) via the delegation wrapper; ticket authored and diff reviewed by Claude. Human is the merge authority.
🤖 Generated with Claude Code