Repository navigation
chore(release): v0.200.1 - #7
Merged
Merged
Conversation
A re-ship with no user impact: since v0.200.0 only CI and the changelog feed changed (#2-#6). It is the first release through staged npm publishing (6j6v.c7dd) and the first tag whose promote.yml opens the stable feed PR (#3). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT
cabcookie
added
the
skip-changelog
cabcookie
added a commit
that referenced
this pull request
Oct 4, 2026
…ly policy reads, named revoked-trust cause, group stop - A build reads a user-level folder only under a NAMED development instance, never the production one, and an unresolvable home or instance means no folder rather than an error (Code #2, #3; Integrity #3, #4). Guard test: a build under the production instance does not see personas planted in the production folder. - An existing but unreadable user-level folder is an error, not a silence (Integrity #5). - `threads show`, `search`, `Engine::thread` and `Engine::search` read the merged channels only (`merged_channels`), so a malformed persona file cannot make a thread unreadable (Code #1). - `nxc prime`, `Engine::prime_as` and `nxs prime --persona` resolve the catalogue once (`prime_with`) (Code #5). - The revoked-trust cancel fires only on an answer not yet served, so a question delivered before the revocation does not cancel; two negative controls, mutation-checked (Test #1, Integrity #7). - A stuck peer handover runs in its own process group, which is killed as a whole and then reaped by polling; the sidecar it started has a group of its own and survives; start-idempotence rests on the admission claim (Code #7, Integrity #6). Test drops the wall-clock assertion and gates `true` on unix (Test #3, #4). - The freeze test now edits a user-level hurdle too (Code #6); loader failing cases for channels, a missing and an unreadable folder, a dangling member (Test #2). - A user-level `external` admits only from workspaces the running repository trusts — tested through the binary and written in the guide (Integrity #2); the guide no longer calls a hiding "never silent" but says where it is shown (Integrity #1, the lock question filed as 6j6v.3mgy). - Stale prose and wraps (Code #4, #9). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT
cabcookie
added a commit
that referenced
this pull request
Oct 4, 2026
…s (nxf 6j6v.7k58, 6j6v.dcpd) (#17) * One persona definition for every repository: a user-level declaration folder, merged per name (nxf 6j6v.7k58) Beside a workspace's own `.nxs-personas/`, every workspace reads the user-level folder `<service home>/personas` — `~/.nexusflow/personas` for the installed suite and an embedding app, `~/.nexusflow-<name>/personas` for a development build. A persona or channel the repository declares hides the user-level one of the same name; everything else is added. - The merge lives in `Definitions::resolve` alone, so the CLI, every `Engine` verb, `nxs prime` and a spawned persona's own `nxc` see one team. Duplicates are judged per folder (naming it); handle form and flow cycles on the merged team. - `DeclarationSource` carries `user_path`, `from_user` and `shadowed`, all off the wire when there is no user-level declaration, so such a machine reads exactly as before (point 8). - `nxc list` / `Engine::directory` stamp `origin: user` per entry and print the account whenever the user-level folder takes part; `nxs prime` says it under "Declarations". - A user-level persona's session start says where its declaration lives: a relative path in a prompt means the repository the session runs in, never the declaration's folder. - The freeze projects the merged catalogue, so it holds for user-level hurdles and prompts; proved by an edit mid-operation. - The readers that loaded the folder directly (thread/search channel policy, list, prime) go through the merged catalogue now. Proved through the real binary: two repositories without a pm file both run the user-level pm, the commission scenario runs on it, a repository file hides it out loud; the live test with real sessions now uses one user-level pm for both repositories (22 s, green). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT * Border follow-ups from the review of PR #14: revoked trust is named, a stuck handover is stopped, the cooperative depth is written down (nxf 6j6v.dcpd) 1. When the caller's workspace stops trusting the receiver while a border thread is open, the receiver's newest message is unvouched and steers nothing. The caller's coordinator now cancels at once with "the answer arrived from <peer>, a workspace no longer trusted here" and wakes the commissioner, instead of "no sign of life" two hours later. 2. The depth across the border rests on the trusted coordinator's stamp — within the trust model (spec section 4); said where `external` and the depth guard are documented. 3. A peer handover past HANDOVER_WAIT is killed and reaped, so the long-lived service no longer accumulates stuck children. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT * Pin the in-process home through pinned_home_env, and mark the dcpd fragment's facade impact The two single-test binaries set HOME by hand, which the source gate every_pinned_home_pins_the_instance refuses: a pinned home without the instance resolves another directory under this repo's .envrc. They now apply nxs_test_support::pinned_home_env() to their own process. The dcpd fragment says `facade: changed` (a behaviour change behind unchanged signatures: an unvouched answer now cancels the border thread). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT * Mitigate the review of PR #17: hermetic user-level folder, channel-only policy reads, named revoked-trust cause, group stop - A build reads a user-level folder only under a NAMED development instance, never the production one, and an unresolvable home or instance means no folder rather than an error (Code #2, #3; Integrity #3, #4). Guard test: a build under the production instance does not see personas planted in the production folder. - An existing but unreadable user-level folder is an error, not a silence (Integrity #5). - `threads show`, `search`, `Engine::thread` and `Engine::search` read the merged channels only (`merged_channels`), so a malformed persona file cannot make a thread unreadable (Code #1). - `nxc prime`, `Engine::prime_as` and `nxs prime --persona` resolve the catalogue once (`prime_with`) (Code #5). - The revoked-trust cancel fires only on an answer not yet served, so a question delivered before the revocation does not cancel; two negative controls, mutation-checked (Test #1, Integrity #7). - A stuck peer handover runs in its own process group, which is killed as a whole and then reaped by polling; the sidecar it started has a group of its own and survives; start-idempotence rests on the admission claim (Code #7, Integrity #6). Test drops the wall-clock assertion and gates `true` on unix (Test #3, #4). - The freeze test now edits a user-level hurdle too (Code #6); loader failing cases for channels, a missing and an unreadable folder, a dangling member (Test #2). - A user-level `external` admits only from workspaces the running repository trusts — tested through the binary and written in the guide (Integrity #2); the guide no longer calls a hiding "never silent" but says where it is shown (Integrity #1, the lock question filed as 6j6v.3mgy). - Stale prose and wraps (Code #4, #9). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
cabcookie
added a commit
that referenced
this pull request
Oct 9, 2026
- Integrity #1: a retry that takes the working copy and fails again hands it on when nothing runs in its claim area (liveness-answering workers only); withdrawing a failed start asks the release question once its threads are discharged. Tests: a third round starts in both cases. - Integrity #2/#3: the retry claim pushes retry_at forward and marks the row in flight; withdraw does not discard a row in flight (reported as started_meanwhile); a crashed retry falls due again. - Code #6: the attempt count is incremented in the database (upsert ... RETURNING), never read and written back. - Integrity #4: the withdraw discharge posts a fixed sentence without the worker's error; stored errors are cut to FAILED_START_ERROR_MAX characters. - Integrity #5: a retry whose thread no longer owes the role an answer is dropped, not started. - Integrity #7: failed-start instants are stored and compared in whole UTC seconds; an instant that cannot be computed is said, not swallowed. - Code #1/#3/#5: constructor docs restored and added; the None/None StartFailed documented; a dedicated retry-spacing constant; the io mapping traced to nxs_init::spawn. - Tests: requeue on the release path and on the retry, overlapping claims, withdraw vs. in-flight retry, crash after claim, findings on reply/session-end/tick incl. LeaseUndecided, Advance-branch pin, retry spacing with the armed timer, status JSON, discharge text, error cap, attempt count, sub-second due-check, CLI line. The tick's belt forget is gone, so the funnel's forget is tested. - Guide lines reflowed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184D5PqXGRbwMKDkMkRggdZ
cabcookie
added a commit
that referenced
this pull request
Oct 9, 2026
…e on the tick (nxf 6j6v.br25) (#32) * Report, retry and withdraw a queued start that failed; ask the release on the tick (nxf 6j6v.br25) Measured in the agents workspace on 0.205.1: the lease was released, the four rounds queued behind it were taken off the queue, every start failed on a transient timeout, and the failure reached only the service's stderr. Nothing was queued, nothing ran, withdraw and resume found nothing. - release_and_fire records a failed start (failed_starts table) and puts a StartFailed consequence in Promotions.warnings. release_working_tree_if_scope_is_done returns the Promotions, and every caller goes through ask_the_release, which lifts them into the receipt's warnings (StartFailed, StartRequeued, and LeaseUndecided now on the reply path too). - An io failure is retried by the tick at a recorded instant, bounded by MAX_START_ATTEMPTS (3); any other kind is not retried. The trigger funnel forgets the record once the session starts. - nxc status marks the operation START FAILED (StatusOperation.start_failed) with the error and the next step; withdraw finds such a commission and discards it. - tick_the_thread asks the release question after it routes a channel completion. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184D5PqXGRbwMKDkMkRggdZ * br25: mitigate the review of PR #32 - Integrity #1: a retry that takes the working copy and fails again hands it on when nothing runs in its claim area (liveness-answering workers only); withdrawing a failed start asks the release question once its threads are discharged. Tests: a third round starts in both cases. - Integrity #2/#3: the retry claim pushes retry_at forward and marks the row in flight; withdraw does not discard a row in flight (reported as started_meanwhile); a crashed retry falls due again. - Code #6: the attempt count is incremented in the database (upsert ... RETURNING), never read and written back. - Integrity #4: the withdraw discharge posts a fixed sentence without the worker's error; stored errors are cut to FAILED_START_ERROR_MAX characters. - Integrity #5: a retry whose thread no longer owes the role an answer is dropped, not started. - Integrity #7: failed-start instants are stored and compared in whole UTC seconds; an instant that cannot be computed is said, not swallowed. - Code #1/#3/#5: constructor docs restored and added; the None/None StartFailed documented; a dedicated retry-spacing constant; the io mapping traced to nxs_init::spawn. - Tests: requeue on the release path and on the retry, overlapping claims, withdraw vs. in-flight retry, crash after claim, findings on reply/session-end/tick incl. LeaseUndecided, Advance-branch pin, retry spacing with the armed timer, status JSON, discharge text, error cap, attempt count, sub-second due-check, CLI line. The tick's belt forget is gone, so the funnel's forget is tested. - Guide lines reflowed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184D5PqXGRbwMKDkMkRggdZ * br25: withdraw now starts the round queued behind the copy it lets go; say so in read_surface The read-surface gate measures which handle calls reach the spawn funnel. Since the review fix, withdraw asks the release question after discharging a failed start, and a release starts what send_to queued behind the working copy. The row now says what it starts and names send_to as the commission, as session_ended's does; the criterion admits it for the same reason. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184D5PqXGRbwMKDkMkRggdZ --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
cabcookie
added a commit
that referenced
this pull request
Oct 10, 2026
- A failed start with a retry still due counts as not asked: its window no longer lapses before the retry, so the flow does not open the next step and the retry does not start the earlier step beside it. A failed start with no retry due lapses as before. (Code #1, Integrity #2) - A step whose window has passed while its start still waits is named on the declining tick's receipt and on stderr, as the new ConsequenceClass::StepStillWaiting, pointing at nxc status and nxc withdraw. (Integrity #1) - The re-arm after a queued start reports a failure as a tick_unscheduled finding through the callers' warnings instead of dropping it, and the nest is flattened. (Code #2, #3, Integrity #5) - Tests: a failed start with a retry due, one with none, the still- waiting finding, a later step put back in line by the hand-off, a failed start arms no window, and the lease runs at least to the end of the started window. (Test #1, #2, #4) - #38's hand-off tests rebuild the two-steps-in-line shape as an earlier build left it, with the coder still owing its answer. (Code #4, Test #6) - Docs: supervised_member_threads names failed starts and what ends the wait; the channels guide (EN/DE) covers retried starts, the finding, withdraw, the board's stale flag, replicas and absolute instants; channel_member_timeout's comment no longer describes the retired behaviour. (Code #5, Integrity #3, Test #7) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184D5PqXGRbwMKDkMkRggdZ
This was referenced Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cargo xtask version set 0.200.1: workspace version, lockfile,docs/generated, and an empty beta feed entry (no pending fragments).A re-ship with no user impact — since v0.200.0 only CI and the changelog feed changed (#2–#6). Its purpose:
@nexus-flow/mcp@0.200.1will wait on npm for the owner's 2FA approval;promote.ymlopens the stable feed PR (promote.yml carries the stable feed to main through a PR, and fails loudly when it cannot (nxf 6j6v.exga) #3) instead of pushing tomain.skip-changelog: a release PR folds fragments instead of adding one.🤖 Generated with Claude Code
https://claude.ai/code/session_018Sipejn8YQhKgngxeHpMhT