969 Commits
Author SHA1 Message Date
Hare 7321d6c7c3 fix: forward scoped Workdir delegation checks
Forward provider authorization and overlap checks through ScopedWorkdirSession while preserving capability ceilings, path rebasing, write leases, and revocation. Exercise stacked wrappers, External providers, and remote HTTP sessions without weakening resolved symlink policy.
2026-10-10 02:12:29 +09:00
Hare fd759545c1 fix(workdir): preserve mutation and command safety through diagnostics 2026-10-10 00:00:43 +09:00
Hare 10c55874e3 fix: preserve tool classification and accurate Workdir failure stages 2026-10-09 22:55:53 +09:00
Hare f9d70e2ae2 fix: retain structured Workdir refusal diagnostics across provider boundaries 2026-10-09 22:23:22 +09:00
Hare 471113fbcf fix: inspect only the requested WIP entity 2026-10-09 19:17:05 +09:00
Hare e7b1aa2a6a chore: merge develop into hare/develop 2026-10-09 18:03:58 +09:00
Hare c550abb11b fix: preserve Workdir operation errors in API logs 2026-10-09 18:03:37 +09:00
Hare caac1c18e0 fix: remove legacy ticket conclusion reason limits 2026-10-09 18:03:37 +09:00
Hare 5831190012 fix: integrate safe Workdir removal recovery
Merge approved T-730 source b1dc8f9f into develop. Resolve the test-registration conflict by preserving both Drive and Workdir-removal tests. Integration root check, Runtime/Server/Worker suites, real Web Drive adapter, generated Workdir contract, Web check/unit/components/build/browser, fmt and diff checks passed.
2026-10-09 17:43:19 +09:00
Hare 4d266420fc fix: retain concrete Workdir observation failure causes 2026-10-09 17:02:38 +09:00
Hare b02eb7bee3 feat: integrate Workspace Web Drive management
Merge approved T-724 source e4daa4aa into current develop a91eec29 without conflicts. Root check, Server714+11 and explicit real SQLite/LocalFileSystem/Web HTTP adapter, API TypeScript91 and generated contracts, Web check0/0/unit569/component305/build/browser9/responsive1 all passed. Fixture-browser results are distinct from real storage/auth tests; no live deployment update.
2026-10-09 16:59:19 +09:00
Hare ed50847afe fix: fence removal while permitting safe Workdir reconnection 2026-10-09 16:51:59 +09:00
Hare e4daa4aaa7 feat(workspace): add shared Drive browsing editing and Worker grants 2026-10-09 16:40:50 +09:00
Hare a91eec295f fix: align API logging tests with worker assignment names 2026-10-09 16:28:14 +09:00
Hare 4337f415f9 fix: revalidate durable Workdir removal on ordinary retry 2026-10-09 16:26:01 +09:00
Hare 34f9e70ce8 chore: merge develop into hare/develop 2026-10-09 16:25:49 +09:00
Hare e6aa56ff6f feat: integrate authorized Worker Drive operations
Merge approved T-723 source e94af40d into develop3a2994cd. Resolve overlapping configuration WIP test migration by retaining source typed result assertions and target live Tree/Inspect publication checks. Runtime implementation merged without conflicts. Root check; full Manifest, Tools, Worker935+110, Runtime349+34, Server710+11, FS and Workdir suites; Workdir HTTP; API83/TypeScript91; WIP0.2.0 resolution and fmt/diff checks passed.
2026-10-09 16:11:07 +09:00
Hare 3a2994cdd7 feat: integrate bounded checkout discovery
Merge approved T-714 source b8faa83c into develop c79506b6. Preserve the target's already-integrated public Tree/Inspect/Invoke configuration fixture migration in the overlapping test helper; runtime implementation merged without conflicts. Root check, complete FS/Workdir/Tools/Worker/Server/API suites, HTTP Workdir suite, WIP 0.2.0 resolution, formatting and diff checks passed.
2026-10-09 15:45:41 +09:00
Hare e94af40dab fix(worker): reconcile invalid Drive completions and default pages
Accept the Backend shared default page maxima (list 200/search 128), not an unsent 100 limit. Classify semantically invalid completions before receipt reconciliation; query the original identity once and accept only validated committed results, never resend or upgrade revisions.

Regressions fail on 61afdb77 and pass after the fix: real API 201-entry default Tools/native WIP pagination; mismatched completion ID/invalid entry metadata recovery and unresolved/invalid receipt matrices. Root cargo check; Worker 920 unit +110 integration; Server 709 lib +11 binary; Drive unit18/API18; fmt and diff checks passed.
2026-10-09 15:36:06 +09:00
Hare c79506b60f chore(ticket): preserve integrated authentication and WIP test fixes
# Conflicts:
#	crates/workspace-server/src/server_workspace_config_wip_tests.rs
2026-10-09 03:10:39 +09:00
Hare e90e2ab391 fix(ticket): validate configuration adapters through structured WIP 2026-10-09 03:04:47 +09:00
Hare 61afdb7773 feat: expose authorized Worker Drive tools and native WIP entries
Use T-722 identity-bound API for paged discovery, bounded text read/create/write/edit, folders, relocate/delete, revision-fixed images, Workdir artifact publication, and mutation receipts. Keep IDs as Workspace-bound decimal strings, observed CAS preconditions and Client validators hidden from model arguments, and never substitute revisions or blindly replay uncertain effects.

Activate via host-bound Feature/Profile/schema and centralized instructions. Publish only the Drive entrance as indexable; resolve selected stable IDs directly with coherent self-scoped WIP publication. Internal SubWorkers and Reviewer children deny undelegated Drive access at feature and client boundaries; no child grant or local storage authority is synthesized.

T-723 validation: root cargo check; manifest 190; tools 78 unit +39 integration +1 doctest; Worker 918 unit +110 integration; Runtime 348 unit +34 binary; Server 708 library +11 binary including 17 real DB+LocalFileSystem signed-API adapter tests. Native image capture/replay, multichunk revision bounds, Workdir import, concurrent CAS, current grants, response-loss reconciliation and dependent config WIP0.2 regressions pass. WIP crates.io 0.2.0 resolution verifier, fmt and diff checks pass.
2026-10-09 03:01:41 +09:00
Hare e67d75615d chore(ticket): incorporate integrated Drive and structured WIP contracts
# Conflicts:
#	openapi/server-api.json
#	web/workspace/src/lib/generated/companion-api.ts
#	web/workspace/src/lib/generated/repository-api.ts
#	web/workspace/src/lib/generated/runtime-api.ts
#	web/workspace/src/lib/generated/ticket-api.ts
#	web/workspace/src/lib/generated/worker-launch-api.ts
2026-10-09 02:54:09 +09:00
Hare 7bb4096373 fix: retain safe runtime proof rejection diagnostics
T-729: distinguish issued_in_future from expired with exact checked times and overflow-safe deltas; retain request-binding mismatch reasons and proof verification progress. Correlate claimed Runtime/Worker/JTI via fixed-size fingerprints and server-generated rejection IDs, bound request metadata, omit query/raw claims/error/body/header/key material. Preserve allow/deny ordering and generic 401 responses; document diagnostic limits and T-728 policy ownership. Reported same-machine incident remains unconfirmed.

Validation: worker-runtime auth filter 3 passed; worker-runtime crate 345 lib + 17 per binary passed; Server auth logging 3 passed (17 rejection cases on both routers plus bounded metadata and generic repository401); workspace_config_integration 12 passed; Server crate 692 lib + 11 bin passed; root cargo check; cargo fmt --all -- --check; rustfmt included config tests --check; git diff --check HEAD. Existing no-default Runtime feature-gate breakage remains documented and out of scope.
2026-10-09 02:53:23 +09:00
Hare 5244308c0d feat(ticket): align Web actions and instructions with intent-led work 2026-10-09 02:51:22 +09:00
Hare 717ff2555f fix: migrate server config test helpers to WIP object API
T-729 validation prerequisite approved in Ticket seq7. Preserve Backend authority, attachment, mutation, stale observation and unknown-outcome assertions using public Tree, path-centered Inspect and structured InterfaceReference Invoke. No production API expansion.

Validation: cargo test -p yoi-workspace-server --lib workspace_config_integration (12 passed); git diff --check HEAD.
2026-10-09 02:47:56 +09:00
Hare ea1badc0be chore: merge develop into hare/develop
# Conflicts:
#	crates/api-macros/src/axum.rs
2026-10-09 02:28:08 +09:00
Hare af655ae632 feat: limit checkout indexing to entrances and expose bounded typed discovery
Content directories always have no indexable children; direct authorized paths remain resolvable. Add List using provider Read/enumeration authority and separate List permission, dirs-first lexical live continuation, bounded retention/path bytes, scoped result coordinates and External DTO validation. List/Glob/Grep return Descriptor-typed entries without eager acquisition. Bind content Interfaces coherently to the live entrance scope.

Validation: root cargo check; FS 58 unit+6 pagination, Workdir 125+5 (default and http-client), Tools 84 unit+39 integration+1 doctest, Worker 901 unit+110 integration, Server 691 unit+11 CLI, Server API 83 tests; exact crates.io WIP 0.2.0 resolution; format/diff checks. Focused model/local/remote/provider/race/scope checks passed. Commands and semantics in docs/development/wip-integration-validation.md.

Publication/review paused: continuation ShowTicket returned HTTP 401. No Backend bypass, source push, MR approval, target integration or live environment update is claimed.
2026-10-09 02:22:52 +09:00
Hare 6445999120 fix: migrate dependent server WIP tests to public object tools
Dependent test compilation exposed removed discover, opaque Interface strings and private call usage. Select structured references from actual path Inspect and invoke through the public WIP 0.2.0 API.

Validation: complete Workspace Server suite (691 unit + 11 CLI), Server API 83 tests including generated artifact freshness, root cargo check and SDK resolution verification passed.
2026-10-09 02:22:18 +09:00
Hare b5ea162f83 feat(drive): expose authorized typed Workspace Drive API
T-722: reuse T-721 storage/CAS/receipts with clone-bound transaction authorization against attached Server authority. Add migration 84 audited Worker read_only/read_write grants and removal/deletion fencing, member-facing ordinary access, owner-controlled grant settings, Workspace-bound decimal entry references, bounded text/binary chunks, streamed HTTP receive/download with integrity and safe headers, typed errors and generated Rust/OpenAPI/TypeScript contracts.

Validation: root cargo check; server-api 83 default / 91 typescript tests; FeatureStorage 16; Drive 31 unit + 12 integration; Workspace Server 691 library + 11 binary tests (--test-threads=4), including 9 real DB/LocalFileSystem HTTP tests for two Workers/non-owner usage, revoke during reception, concurrent CAS, response-loss receipts, chunk expiry and safe binary media. cargo fmt --all -- --check and git diff --check HEAD passed. Existing OpenAPI schemas/routes semantically unchanged; dependent TS digest projections regenerated.
2026-10-09 00:02:09 +09:00
Hare 60ec815237 chore: merge approved Ticket Worker launch into develop 2026-10-08 23:06:49 +09:00
Hare bb1b05ed20 fix(ticket): preserve uncertain launch claims on local replay rejection 2026-10-08 21:53:28 +09:00
Hare 633522278b feat(drive): add durable Workspace document storage and lifecycle
Use object_store 0.13.2 immutable local blobs and FeatureStorage SQLite trees, revision CAS, same-transaction receipts, bounded reads/search, staged/orphan GC and retryable deletion. Attach Server authority to serialize cached Drive operations with deletion reservation. Document fsync compensation, Linux guarantees and offline DB-plus-blob restore.

Validation: root cargo check; workspace-drive 29 unit + 12 integration tests; feature-storage 13 tests; workspace-server 649 library + 11 binary tests with test-threads=4; cargo fmt --all -- --check; git diff --check HEAD. Default-parallel Server run hit the existing ticket_checker_burst timeout assertion (648 passed); the isolated filter and bounded-parallel full suite passed. Fault tests are not physical power-cut evidence.
2026-10-08 21:39:51 +09:00
Hare 761de69e18 feat(ticket): generalize Worker launch and durable resource claims 2026-10-08 21:36:33 +09:00
Hare e5ea7544d4 Merge branch 'develop' into hare/develop 2026-10-08 20:46:36 +09:00
Hare 1a095315ee chore: merge approved optional workspace creation into develop 2026-10-08 19:58:04 +09:00
Hare 148da0b3d9 test(workspace): preserve member-facing access without repositories
Apply T-717 item6/thread7 user decision: settings stay owner-controlled, ordinary non-owner viewing remains permitted under existing authentication. Add real HTTP assertions for non-owner workspace reads and absent management permissions; existing owner-only repository/deletion mutations and anonymous rejection remain exercised. Replace obsolete pending-policy documentation; no production authorization policy change.

Validation: targeted repository-free HTTP test, root cargo check, yoi-workspace-server 639 lib + 11 bin tests, canonical OpenAPI freshness, cargo fmt and baseline/HEAD diff checks pass. Rust tests/documentation only; rendered UI and previously reviewed browser/visual evidence are unchanged.
2026-10-08 19:41:41 +09:00
Hare df390f02e9 feat(ticket): decouple audited lifecycle decisions from MR integration
T-718: unify state, completion, close and reopen with explicit CAS and operation receipts; keep MR integration proofs independent. Queue only the explicitly selected Ticket and fence target edits against active Worker grants. Align REST, Worker/WIP, evidence projection and generated contracts.

Validation: root cargo check; full ticket, merge-request, client, worker, yoi-workspace-server and server-api tests; server-api typescript feature; OpenAPI and six generated API checkers; Svelte check and 36 narrow Web tests; fmt and diff checks.
2026-10-08 19:12:39 +09:00
Hare 7919616db5 feat(workspace): allow creation without an initial repository
Keep bootstrap, signing identity, config and resource-key allocation atomic with optional Repository intent. Preserve repository-present fingerprints for saved receipts; replay reads current authority at the initial key and never recreates missing assets.

Provide explicit repository-free CLI creation, optional TUI/Web creation inputs, nullable generated contracts, and valid empty catalog/Worker paths. Retain existing authenticated non-owner viewing policy pending the T-717 authorization decision.

Validation: root cargo check; server tests 639 lib + 11 bin; server-api 70 default / 77 typescript; client 52 lib + 2 integration; tui 337; yoi 11 lib + 120 bin. OpenAPI/TS freshness, cargo fmt and diff checks pass. Web check/build, 18 model tests, 268 component tests and Chromium 8 width/theme combinations pass; before/after visual evidence is documented in web/workspace/test/visual-review. Full Web suite has one independently reproduced baseline Ticket source-policy failure.
2026-10-08 18:34:44 +09:00
Hare 14fea520df merge(develop): retain active-work guards with immutable Ticket evidence
T-716: incorporate T-715 (b6de908e) into the existing Ticket source branch only. Resolve MR read/readiness conflicts by keeping persisted merged-result evaluation and active assignment selection for open source observation. Preserve responsibility records and terminal work releases. Update temporary API regression fixtures to distinguish retained identity from active work.

Narrow validation: merge-request store 21 tests; Workspace Server Ticket evidence API 5 tests, including done/merged remote evidence without active assignment and unavailable open source with retained released responsibility.
2026-10-08 16:20:38 +09:00
Hare 5424280348 fix(ticket): project immutable results and typed source observations
T-716: merged evidence uses recorded result approval; open source reads use Runtime provider authority and preserve unavailability. Current requirements use the shared exact snapshot evaluator. Remove primary-MR/report SQL heuristics; continue bounded query scans through nonmatching candidates. Align Worker/Web projections and explain lifecycle versus integration/attestation. Synchronize checker test on delivered inputs, not pre-delivery attempt state.

Validation: root cargo check; cargo test -p merge-request (30), -p server-api (70), -p worker (949), -p yoi-workspace-server (620 lib + 11 binary); server-api typescript feature check; 32 focused Deno tests; deno task check (0 errors/warnings); cargo fmt --all -- --check; git diff --check HEAD; canonical OpenAPI/generated Ticket artifact checks.
2026-10-08 15:44:27 +09:00
Hare b6de908e9f fix(ticket): separate retained responsibility from unfinished work
T-715: end assignment work identities atomically on done/close without deleting responsibility. Reopen never reactivates old authority. Schema 82 preserves legacy closed assignments, historical removal plans and Worker attribution; active work drives admission, auth/routing, retention and cleanup while independent lifecycle/attachment fences remain.

Validation: root cargo check; cargo test -p yoi-workspace-server (630 lib + 11 bin), -p merge-request (20), -p worker (947); worker-runtime restore/removal filters (2); Deno ticket responsibility/runtime UI contracts (12); cargo fmt --all -- --check; git diff --check HEAD.
2026-10-08 15:35:16 +09:00
Hare e723afe5f5 fix: authorize restore coordination with worker input capability 2026-10-08 15:33:38 +09:00
Hare 56ab8c22ba fix: preserve generated API error details in logs 2026-10-08 15:33:38 +09:00
Hare b0d8c7b786 chore: merge develop into hare/develop 2026-10-07 18:03:33 +09:00
Hare cfacf04260 fix: prevent subject startup deadlocks and diagnose auth rejection 2026-10-07 17:56:48 +09:00
Hare f086cf3375 feat(profiles): seal builtin import provenance and expose read-only editor imports
Retain the evaluated JSON launch entrypoint, seal observed builtin source bytes and digests as verified provenance, and fail on missing/corrupt dependencies without Runtime builtin reevaluation. Cover real HTTP commits and launch resolution, including worker mode and Workspace Config feature composition.

Expose read-only builtin import completions/diagnostics in the editor and rebuild wasm32 release assets with wasm-bindgen 0.2.117. Document public paths, ordinary composition, limits, resave semantics, and the lazy-cycle incident.

Validation: worker-runtime 344 library + 34 integration tests; workspace-server 609 library + 11 binary tests plus final builtin HTTP/launch tests (2); archive tests (16); native WASM tests (2); real-WASM/web tests (37), editor component tests (10); root cargo check, cargo fmt --all -- --check and git diff --check HEAD pass.
2026-10-07 03:38:49 +09:00
Hare a64707ee69 feat: integrate value-based Workspace Profiles 2026-10-07 03:04:07 +09:00
Hare e24fbabe54 fix: align Profile authoring with compaction and reasoning contracts (T-710)
Resolve MR seq9 supported-compaction-fields and numeric-extraction-reasoning findings. Cover all canonical CompactionConfigPartial settings, token aliases and ratio helpers; accept string effort and signed integer extraction budgets without materializing editor defaults. Audit the remaining Profile field groups against their real serde contracts.

Share an actual-provider value corpus across native, generated WASM, and shared save/projection/verified Runtime archive consumption. Prove inline/import/patch exact values and effective Manifest settings; gate canonical compaction field coverage against serialization of the actual partial type. Keep prior scope union and worker/feature diagnostics fixes intact.

Validation: root cargo check; config-source40; unfiltered server644+11; Runtime340+17+17; API typescript77; Deno39; deno task check0/0; wasm32 release regeneration byte-identical with wasm-bindgen0.2.117/Binaryen132; cargo fmt/diff checks. Logs target/t710-contract-{check,config-source,server,api,runtime}.log. Reviewer seq9 independently confirmed seq3/5/7 resolution and correct main/relative-cwd routing. No target integration/ref mutations.
2026-10-07 02:51:29 +09:00
Hare 61f0469986 fix: preserve string and table Profile scope authoring (T-710)
Resolve MR sequence 5 profile_authoring_rejects_valid_string_scope_intents. Decodal 0.4 has no union constraint: retain an opaque scope range with non-materialized table completion hints so string intents remain valid. Keep shared Backend semantic validation authoritative for scope forms/types/unknown keys without changing persisted values or weakening worker/feature editor diagnostics.

Prove actual-provider native/WASM scalar/table, inline/import/patch, nested intent/deny_write/symlink_policy completion and evaluation invariance. Add real save/projection/Runtime scope equivalence and invalid-scope save non-loss coverage. Regenerated WASM artifact is byte-identical; the changed shape is transported via the fingerprint-bound Backend schema metadata.

Validation: root cargo check; config-source39; value_profiles4; unfiltered server643+11; worker-runtime340+17+17; server-api --features typescript77; wasm32 release/wasm-bindgen0.2.117/Binaryen132 -Oz; Deno39; deno task check0/0; fmt/diff checks. Logs target/t710-scope-{check,server,server-api,runtime}.log. No target/ref integration changes.
2026-10-07 02:25:16 +09:00