feat: replace revision counters with domain state contracts
Use content digests, key fingerprints, binding and trust identities, immutable mutation receipts, and observation tokens instead of state-update ordinals across API, storage, Runtime, and Web contracts. Preserve historical replay and secret material through frozen migrations; preflight uncertain removals before cutover, resume provisioning receipts, validate encrypted migration candidates, and align fresh/upgraded schemas. Include reviewed regression fixes, generated artifacts, and validation evidence.
This commit is contained in:
@@ -0,0 +1,109 @@
|
||||
# State-contract cleanup completion and recovery record
|
||||
|
||||
The interrupted cleanup has been restored, integrated with `develop` at
|
||||
`72ce817de4592e8c9703e0725dd705f46cba63aa`, completed, and validated. This record
|
||||
supersedes the earlier incomplete restart checkpoint. No live Server, Runtime,
|
||||
or user database was stopped or migrated as part of this work.
|
||||
|
||||
## Recovery and integration
|
||||
|
||||
- Workdir attachment: `yoi-origin`; branch: `hare/develop`.
|
||||
- Preserved the Workdir delegation fix (`7321d6c7`), asynchronous cleanup fix
|
||||
(`dc8e586a`), and the T-731/T-732 changes integrated by `72ce817d`.
|
||||
- Applied stash `dd31c0ecd41d2aca1ef29889a5194fb4499cb149` once after merging
|
||||
develop. It remains as recovery evidence; do not apply it again over this work.
|
||||
- Older stash `a386a9e2943d53f331a555a8c255741bc004c419` also remains untouched.
|
||||
- Direct implementation/review SubWorkers were collected after their committed
|
||||
sessions and concrete changes/test evidence were inspected.
|
||||
|
||||
## Completed contracts
|
||||
|
||||
State/update ordinals have been replaced by content digests, key fingerprints,
|
||||
binding/trust/connection IDs, immutable mutation IDs, and observation tokens.
|
||||
Schema/protocol versions, ordered events, command IDs, and local asynchronous
|
||||
invalidation fences remain distinct contracts and were not indiscriminately removed.
|
||||
|
||||
- Config source/history preserves separate source/toolchain/projection evaluations.
|
||||
Cache identities occupy a namespace forbidden to real virtual paths, including
|
||||
JSON-deserialized paths. Native and generated WASM regressions cover the boundary.
|
||||
- Job/content migration retains completed results and cleanup/replay evidence.
|
||||
Proven reserved-only work can fail definitively; uncertain execution is not
|
||||
silently admitted again. Historical Flow definitions are validated, not recompiled.
|
||||
- Drive preserves old receipt fingerprints and validates old Update/Relocate/Delete
|
||||
replays against frozen evidence rather than granting authority from old ordinals.
|
||||
- SSH migration reseals envelopes under actual mutation receipts. Terminal Workdir
|
||||
history whose credentials were deleted remains non-authorizing archival evidence.
|
||||
INSERT/UPDATE guards prevent that archive from acquiring candidate/lease authority.
|
||||
- Runtime binding verification ties together binding/trust identities and actual
|
||||
public-key fingerprints. Worker command-ID replay is separate from admission-time
|
||||
state. Ticket checker intent IDs include the complete immutable request.
|
||||
|
||||
## Migration safety and review corrections
|
||||
|
||||
- Uncertain Worker removals (`executing`/`failed`) block **before any retained
|
||||
migration runs**, including ordinary Server open and migration CLI entrypoints.
|
||||
Tests start at schema84, verify unchanged schema/receipt after rejection, then
|
||||
reconcile with the old contract and upgrade successfully.
|
||||
- SSH dry-run uses the original database's secret context while validating an
|
||||
in-memory backup. Actual encrypted-envelope tests prove dry-run non-mutation,
|
||||
formal migration, new-AAD decryption, and unchanged master-key material.
|
||||
- Interrupted signing identity provisioning resumes the same reserved key/material.
|
||||
Frozen old receipt validation precedes operation-key/fingerprint conversion;
|
||||
activation and migration failures roll back. Completed and create receipts are
|
||||
also covered.
|
||||
- The old reservation CHECK constraint is removed through a transactional rebuild
|
||||
retaining other columns, constraints, indexes, triggers, and incoming/outgoing
|
||||
foreign keys. Unknown dependencies are not broadly rewritten.
|
||||
- Fresh/upgraded metadata comparison covers 36 state-contract tables: columns,
|
||||
defaults, PK/FK structure, index columns, and triggers. It caught and repaired a
|
||||
missing history DEFAULT and retained-chain reservation lookup index. This is not
|
||||
a general SQL-equivalence proof of all CHECK expressions or index predicates;
|
||||
separate behavior/rollback tests cover the relevant authority constraints.
|
||||
- Independent data and Server reviews found the above defects; follow-up reviews
|
||||
confirmed their resolution without additional blockers in the reviewed scope.
|
||||
|
||||
## Final validation
|
||||
|
||||
- Root `cargo check`: PASS.
|
||||
- All 21 changed Rust crates tested together: **3,795 passed**, **3 ignored**,
|
||||
zero failures, including doctests. The Server contributes 809 library tests and
|
||||
11 CLI tests (one library test ignored).
|
||||
- `server-api --features typescript`: **96 passed**.
|
||||
- Additional T-731/T-732 integration coverage: yoi, workdir, tools, fs-operation
|
||||
tests passed separately.
|
||||
- Web standard suite: **589 passed**; component suite: **315 passed / 33 files**.
|
||||
- Web type check: zero errors/warnings; production build passed (chunk-size warning).
|
||||
- Config WASM parity includes 18 passing cases, including literal-cache-key collision
|
||||
and JSON URI-path refusal. Generated JS/types/WASM were compared with the pinned
|
||||
wasm-bindgen 0.2.117 toolchain. OpenAPI/API/protocol generated checks passed.
|
||||
- `cargo fmt --all -- --check` and `git diff --check HEAD`: PASS. Included frozen
|
||||
Rust migration/test files were formatted explicitly as well.
|
||||
|
||||
Local evidence logs (ignored build artifacts, not part of stash/history):
|
||||
`target/revision-final-combined-rust-tests.log`,
|
||||
`target/revision-final-typescript-tests.log`,
|
||||
`target/revision-final-root-check.log`,
|
||||
`target/revision-final-web-{tests,component,check,build}.log`,
|
||||
`target/revision-virtual-path-web-{config-tests,final-check}.log`,
|
||||
`target/revision-web-final-{artifacts,normalized-artifacts}.log`, and
|
||||
`target/revision-schema-equivalence.log`.
|
||||
|
||||
## Deployment and separate findings
|
||||
|
||||
Deployment/restart remains user-operated. Take the normal database/key-material
|
||||
backup before migration. Resolve uncertain old Worker removals with the old Server
|
||||
before attempting cutover. Existing migrated Runtime bindings become configured;
|
||||
re-enrollment/verification requires the actual Runtime-issued trust ID from
|
||||
`trust-workspace add/show`, not an invented value or public-key fingerprint.
|
||||
|
||||
Previously identified Server-only capability revocation and missing enrollment
|
||||
identity in Runtime-to-Server source proofs predate this cleanup. They are not
|
||||
claimed fixed here. The separately recorded Runtime HTTP-only feature dependency
|
||||
issue also remains outside this cleanup.
|
||||
|
||||
Workdir operations intermittently returned HTTP 401 during the work. Failed calls
|
||||
were not treated as successful edits/tests; subsequent reads and final combined
|
||||
validation established the recorded result. No authorization or live-process
|
||||
workaround was used. The default wasm-bindgen CLI had a schema-version mismatch;
|
||||
a matching CLI was installed only under ignored `target/revision-wasm-tools`, with
|
||||
no global CLI change or additional change to the restored Cargo.lock.
|
||||
@@ -0,0 +1,29 @@
|
||||
# Recovery session: SubWorker scope delegation is rejected
|
||||
|
||||
## Observed boundary
|
||||
|
||||
During state-contract cleanup after restoring the worktree, `WorkerList` returned no children. The attached External Workdir `yoi-origin` advertised READ/WRITE/COMMAND, and the parent could read files, write files, and execute build commands through that attachment.
|
||||
|
||||
A new `SubWorkerSpawn` requesting only recursive READ of `.` on `yoi-origin` was rejected before the child started:
|
||||
|
||||
```text
|
||||
Invalid argument: scope parent-owned Workdir tools: Workdir operation denied: Workdir operation was denied
|
||||
```
|
||||
|
||||
An empty scope is not supported (`scope must not be empty`), so a context-only child was also unavailable. No child was created, and no delegated work is running.
|
||||
|
||||
The response does not identify which delegation condition failed. Successful direct parent access does not establish delegation authority, so these observations alone do not establish whether the refusal is a policy restriction or a Provider implementation defect. No running process was stopped or reloaded to investigate this.
|
||||
|
||||
## Additional observed tool failure
|
||||
|
||||
`Edit` of `crates/workspace-server/src/store.rs`, after reading it through the same attachment, returned:
|
||||
|
||||
```text
|
||||
Invalid argument: invalid argument: Workdir operation request is invalid
|
||||
```
|
||||
|
||||
The parent could still modify that file using its granted command capability. This is an input-request failure observation, not evidence that `Edit` has the same root cause as the SubWorker denial.
|
||||
|
||||
## Diagnostic need
|
||||
|
||||
Return bounded, non-sensitive reason categories that distinguish direct access from delegation denial, and distinguish invalid tool requests from scope checks. Avoid reporting generic denial as proof that a child is running or that the parent lost its direct attachment authority.
|
||||
Reference in New Issue
Block a user