2315 Commits
Author SHA1 Message Date
Hare bb1b05ed20 fix(ticket): preserve uncertain launch claims on local replay rejection 2026-10-08 21:53:28 +09:00
Hare 633522278b feat(drive): add durable Workspace document storage and lifecycle
Use object_store 0.13.2 immutable local blobs and FeatureStorage SQLite trees, revision CAS, same-transaction receipts, bounded reads/search, staged/orphan GC and retryable deletion. Attach Server authority to serialize cached Drive operations with deletion reservation. Document fsync compensation, Linux guarantees and offline DB-plus-blob restore.

Validation: root cargo check; workspace-drive 29 unit + 12 integration tests; feature-storage 13 tests; workspace-server 649 library + 11 binary tests with test-threads=4; cargo fmt --all -- --check; git diff --check HEAD. Default-parallel Server run hit the existing ticket_checker_burst timeout assertion (648 passed); the isolated filter and bounded-parallel full suite passed. Fault tests are not physical power-cut evidence.
2026-10-08 21:39:51 +09:00
Hare 761de69e18 feat(ticket): generalize Worker launch and durable resource claims 2026-10-08 21:36:33 +09:00
Hare e5ea7544d4 Merge branch 'develop' into hare/develop 2026-10-08 20:46:36 +09:00
Hare 1a095315ee chore: merge approved optional workspace creation into develop 2026-10-08 19:58:04 +09:00
Hare 148da0b3d9 test(workspace): preserve member-facing access without repositories
Apply T-717 item6/thread7 user decision: settings stay owner-controlled, ordinary non-owner viewing remains permitted under existing authentication. Add real HTTP assertions for non-owner workspace reads and absent management permissions; existing owner-only repository/deletion mutations and anonymous rejection remain exercised. Replace obsolete pending-policy documentation; no production authorization policy change.

Validation: targeted repository-free HTTP test, root cargo check, yoi-workspace-server 639 lib + 11 bin tests, canonical OpenAPI freshness, cargo fmt and baseline/HEAD diff checks pass. Rust tests/documentation only; rendered UI and previously reviewed browser/visual evidence are unchanged.
2026-10-08 19:41:41 +09:00
Hare df390f02e9 feat(ticket): decouple audited lifecycle decisions from MR integration
T-718: unify state, completion, close and reopen with explicit CAS and operation receipts; keep MR integration proofs independent. Queue only the explicitly selected Ticket and fence target edits against active Worker grants. Align REST, Worker/WIP, evidence projection and generated contracts.

Validation: root cargo check; full ticket, merge-request, client, worker, yoi-workspace-server and server-api tests; server-api typescript feature; OpenAPI and six generated API checkers; Svelte check and 36 narrow Web tests; fmt and diff checks.
2026-10-08 19:12:39 +09:00
Hare 7919616db5 feat(workspace): allow creation without an initial repository
Keep bootstrap, signing identity, config and resource-key allocation atomic with optional Repository intent. Preserve repository-present fingerprints for saved receipts; replay reads current authority at the initial key and never recreates missing assets.

Provide explicit repository-free CLI creation, optional TUI/Web creation inputs, nullable generated contracts, and valid empty catalog/Worker paths. Retain existing authenticated non-owner viewing policy pending the T-717 authorization decision.

Validation: root cargo check; server tests 639 lib + 11 bin; server-api 70 default / 77 typescript; client 52 lib + 2 integration; tui 337; yoi 11 lib + 120 bin. OpenAPI/TS freshness, cargo fmt and diff checks pass. Web check/build, 18 model tests, 268 component tests and Chromium 8 width/theme combinations pass; before/after visual evidence is documented in web/workspace/test/visual-review. Full Web suite has one independently reproduced baseline Ticket source-policy failure.
2026-10-08 18:34:44 +09:00
Hare e939cd4e4b fix(engine): keep tool truncation notices in tool results
Stop emitting a user-facing Engine warning for ordinary output limiting while preserving structured size diagnostics and the model-visible truncation marker. Keep the Worker warning bridge for genuine warnings.

Regression coverage proves bounded ASCII/UTF-8 results, per-tool limits, attachments, dispositions and commit/model agreement, plus absence of live/buffered truncation alerts and preservation of other Engine alerts.

Validation: cargo check; cargo test -p agen; cargo test -p worker; targeted callback test with codex; cargo fmt --all -- --check; git diff --check HEAD.
2026-10-08 17:33:15 +09:00
Hare 14fea520df merge(develop): retain active-work guards with immutable Ticket evidence
T-716: incorporate T-715 (b6de908e) into the existing Ticket source branch only. Resolve MR read/readiness conflicts by keeping persisted merged-result evaluation and active assignment selection for open source observation. Preserve responsibility records and terminal work releases. Update temporary API regression fixtures to distinguish retained identity from active work.

Narrow validation: merge-request store 21 tests; Workspace Server Ticket evidence API 5 tests, including done/merged remote evidence without active assignment and unavailable open source with retained released responsibility.
2026-10-08 16:20:38 +09:00
Hare 5424280348 fix(ticket): project immutable results and typed source observations
T-716: merged evidence uses recorded result approval; open source reads use Runtime provider authority and preserve unavailability. Current requirements use the shared exact snapshot evaluator. Remove primary-MR/report SQL heuristics; continue bounded query scans through nonmatching candidates. Align Worker/Web projections and explain lifecycle versus integration/attestation. Synchronize checker test on delivered inputs, not pre-delivery attempt state.

Validation: root cargo check; cargo test -p merge-request (30), -p server-api (70), -p worker (949), -p yoi-workspace-server (620 lib + 11 binary); server-api typescript feature check; 32 focused Deno tests; deno task check (0 errors/warnings); cargo fmt --all -- --check; git diff --check HEAD; canonical OpenAPI/generated Ticket artifact checks.
2026-10-08 15:44:27 +09:00
Hare 4d0f2afc1e fix(merge-request): share immutable integration and requirement evidence
T-716: validate recorded source/approval/request identity, chronology and revocation independently of mutable selectors. Reuse exact revision and complete linked-source attestation in CompleteTicket. Assignment and lifecycle mutation are unchanged.\n\nValidation: cargo test -p merge-request (9 evidence and 21 store tests).
2026-10-08 15:44:26 +09:00
Hare b6de908e9f fix(ticket): separate retained responsibility from unfinished work
T-715: end assignment work identities atomically on done/close without deleting responsibility. Reopen never reactivates old authority. Schema 82 preserves legacy closed assignments, historical removal plans and Worker attribution; active work drives admission, auth/routing, retention and cleanup while independent lifecycle/attachment fences remain.

Validation: root cargo check; cargo test -p yoi-workspace-server (630 lib + 11 bin), -p merge-request (20), -p worker (947); worker-runtime restore/removal filters (2); Deno ticket responsibility/runtime UI contracts (12); cargo fmt --all -- --check; git diff --check HEAD.
2026-10-08 15:35:16 +09:00
Hare e723afe5f5 fix: authorize restore coordination with worker input capability 2026-10-08 15:33:38 +09:00
Hare 56ab8c22ba fix: preserve generated API error details in logs 2026-10-08 15:33:38 +09:00
Hare b0d8c7b786 chore: merge develop into hare/develop 2026-10-07 18:03:33 +09:00
Hare cfacf04260 fix: prevent subject startup deadlocks and diagnose auth rejection 2026-10-07 17:56:48 +09:00
Hare f086cf3375 feat(profiles): seal builtin import provenance and expose read-only editor imports
Retain the evaluated JSON launch entrypoint, seal observed builtin source bytes and digests as verified provenance, and fail on missing/corrupt dependencies without Runtime builtin reevaluation. Cover real HTTP commits and launch resolution, including worker mode and Workspace Config feature composition.

Expose read-only builtin import completions/diagnostics in the editor and rebuild wasm32 release assets with wasm-bindgen 0.2.117. Document public paths, ordinary composition, limits, resave semantics, and the lazy-cycle incident.

Validation: worker-runtime 344 library + 34 integration tests; workspace-server 609 library + 11 binary tests plus final builtin HTTP/launch tests (2); archive tests (16); native WASM tests (2); real-WASM/web tests (37), editor component tests (10); root cargo check, cargo fmt --all -- --check and git diff --check HEAD pass.
2026-10-07 03:38:49 +09:00
Hare 4343be86c1 feat(config-source): add confined read-only builtin Decodal imports
Share the explicit embedded Profile catalog with native and WASM evaluators. Preserve ordinary Decodal values, isolate builtin relative imports, reject reserved Workspace mutations, and capture the exact loaded builtin closure. Guard lazy import cycles and dependency depth before evaluation recurses.

Validation: config-source 48 tests, builtin-source 2 tests, manifest 185 tests; root cargo check, formatting and diff checks pass. Existing contract version/fingerprint stay unchanged; archive provenance binds builtin content instead of invalidating stored Workspace metadata.
2026-10-07 03:35:59 +09:00
Hare a64707ee69 feat: integrate value-based Workspace Profiles 2026-10-07 03:04:07 +09:00
Hare e24fbabe54 fix: align Profile authoring with compaction and reasoning contracts (T-710)
Resolve MR seq9 supported-compaction-fields and numeric-extraction-reasoning findings. Cover all canonical CompactionConfigPartial settings, token aliases and ratio helpers; accept string effort and signed integer extraction budgets without materializing editor defaults. Audit the remaining Profile field groups against their real serde contracts.

Share an actual-provider value corpus across native, generated WASM, and shared save/projection/verified Runtime archive consumption. Prove inline/import/patch exact values and effective Manifest settings; gate canonical compaction field coverage against serialization of the actual partial type. Keep prior scope union and worker/feature diagnostics fixes intact.

Validation: root cargo check; config-source40; unfiltered server644+11; Runtime340+17+17; API typescript77; Deno39; deno task check0/0; wasm32 release regeneration byte-identical with wasm-bindgen0.2.117/Binaryen132; cargo fmt/diff checks. Logs target/t710-contract-{check,config-source,server,api,runtime}.log. Reviewer seq9 independently confirmed seq3/5/7 resolution and correct main/relative-cwd routing. No target integration/ref mutations.
2026-10-07 02:51:29 +09:00
Hare 61f0469986 fix: preserve string and table Profile scope authoring (T-710)
Resolve MR sequence 5 profile_authoring_rejects_valid_string_scope_intents. Decodal 0.4 has no union constraint: retain an opaque scope range with non-materialized table completion hints so string intents remain valid. Keep shared Backend semantic validation authoritative for scope forms/types/unknown keys without changing persisted values or weakening worker/feature editor diagnostics.

Prove actual-provider native/WASM scalar/table, inline/import/patch, nested intent/deny_write/symlink_policy completion and evaluation invariance. Add real save/projection/Runtime scope equivalence and invalid-scope save non-loss coverage. Regenerated WASM artifact is byte-identical; the changed shape is transported via the fingerprint-bound Backend schema metadata.

Validation: root cargo check; config-source39; value_profiles4; unfiltered server643+11; worker-runtime340+17+17; server-api --features typescript77; wasm32 release/wasm-bindgen0.2.117/Binaryen132 -Oz; Deno39; deno task check0/0; fmt/diff checks. Logs target/t710-scope-{check,server,server-api,runtime}.log. No target/ref integration changes.
2026-10-07 02:25:16 +09:00
Hare 728ea3d915 feat: integrate standalone subjektiv support 2026-10-07 02:04:30 +09:00
Hare 24ae6288a5 feat(subjektiv): share domain and add explicit standalone Subject hosts 2026-10-07 01:52:06 +09:00
Hare 3558e4aae1 fix: diagnose nested partial Profile values in the editor (T-710)
Resolve MR sequence 3 profile_nested_editor_diagnostics_missing with a separate, non-materializing authoring constraint pass. Preserve omission and the persisted evaluation schema, and map nested/imported failures to supplied virtual-source spans. Exercise actual Backend schema in native and regenerated WASM tests for empty/partial values, worker and feature types, unknown fields, imports and composition.

Validation: root cargo check; config-source 38; config-source-wasm native/doc; unfiltered yoi-workspace-server 642 lib + 11 bin; worker-runtime 340 lib + 17 per binary; server-api --features typescript 77; focused Deno 39; deno task check; wasm32 release build, wasm-bindgen 0.2.117 + Binaryen 132 -Oz regeneration; cargo fmt/diff checks. Earlier checker failure did not recur: Reviewer independently passed full source suite and exact original baseline checker filter, recorded in MR sequence 3.
2026-10-07 00:36:16 +09:00
Hare ed3bcf35bd fix(worker): remove Wip prefix from gateway tool names (T-712)
Expose Discover, Inspect, and Call in WIP mode and update schema descriptions and current documentation. Preserve execution, argument schemas, internal types, and ordinary Tools mode. Add a registered-tool discovery/inspection/call regression.

Validation: cargo test -p worker --lib wip::tests:: (43 passed); cargo test -p worker (827 unit + 110 integration passed); root cargo check; cargo fmt --all -- --check; git diff --check HEAD.
2026-10-07 00:31:33 +09:00
Hare 58462d5844 feat: register Workspace Profiles as Decodal values (T-710)
Project the evaluated Workspace Profile value into a revision-bound JSON archive without source-path registration or Decodal re-evaluation. Preserve partial-value omissions and explicit overrides, validate before save, and reject legacy registrations with a documented explicit migration.

Fix array-element schema completion and provide fingerprint-bound authoring shapes independently of materialization defaults. Carry metadata through REST, regenerate TypeScript/OpenAPI/WASM artifacts, and exercise save/projection/Runtime consumption and persisted Manifest restore boundaries.

Validation: root cargo check; cargo test -p config-source; cargo test -p worker-runtime; cargo test -p server-api --features typescript; focused profile_settings/value_profiles/archive tests; 39 web config-source/profile API tests; deno task check; cargo fmt --all -- --check; git diff --check HEAD.

Full workspace-server test: 641 passed, one pre-existing ticket_checker_suppresses_stale_and_clean_results_and_diagnoses_invalid_output assertion failure. The same filter fails at base 3c424fd17d in a separately archived source tree and isolated target directory. Remaining server crate tests pass with only that filter skipped (641 lib + 11 bin); unrelated checker code is unchanged.
2026-10-07 00:14:51 +09:00
Hare 13055d7ee1 feat: execute durable standalone Jobs through Host-owned Internal Workers (T-708) 2026-10-07 00:08:01 +09:00
Hare 5c95859d39 chore: merge develop into hare/develop 2026-10-06 20:45:19 +09:00
Hare 3c424fd17d fix: budget subjektiv batches for compact verified Job results (T-704) 2026-10-06 19:58:11 +09:00
Hare d12cdc9106 feat: caller-selected Backend Jobs and bounded subjektiv consolidation (T-704) 2026-10-06 19:45:37 +09:00
Hare 6f9621ca2e fix: retain Restore recovery intent and retire stale caller conflicts (T-701) 2026-10-06 18:15:31 +09:00
Hare fdce12a47b feat: guarded Worker Restore from shared Web actions (T-701) 2026-10-06 17:45:54 +09:00
Hare 1a6d391f83 refactor: integrate registry-bound worker operations 2026-10-06 14:58:49 +09:00
Hare 849a6b4c1c fix(server): route embedded WorkerRemove through registry-bound reception 2026-10-06 14:50:31 +09:00
Hare 4892a82a28 refactor(server): unify registry-bound workspace worker operations 2026-10-06 14:24:23 +09:00
Hare 4f38f7d5b0 refactor(worker): share file contracts across Tools and WIP providers
Flatten shared typed Tool arguments and derive WIP parameters and checkout allowlists from core schemas. Workspace settings uses shared read/write/edit processing within its captured-read and canonical tree-CAS commit path. Identical settings edits now reject before read or commit; provider response contracts and unknown-outcome handling stay intact.

T-707 validation: root cargo check; fs-operation (58); tools (74 lib, 39 integration, 1 doctest); worker (802 lib, 109 integration); workdir --features http-client (125); yoi-workspace-server --lib workspace_config (19); cargo fmt --all -- --check; git diff --check HEAD.
2026-10-06 14:18:34 +09:00
Hare 4511d4f8ac refactor(fs-operation): extract provider-neutral text operations
Share typed read/edit/write arguments, Operation schemas, decoding, pure outcomes, byte bounds, replacement policy and numbered rendering. Keep filesystem CAS and descriptor-protected mutation within the provider.

T-707: cargo test -p fs-operation passes (58 tests); overflow, Unicode, limits and local checked-save regressions are covered.
2026-10-06 14:18:34 +09:00
Hare 3029e77c7a fix: remove tests that pin mutable profile defaults 2026-10-06 13:31:37 +09:00
Hare b96bd110c6 refactor(worker-runtime): route by WorkerRef and reconcile owned execution cleanup 2026-10-06 09:13:46 +09:00
Hare 0e2a6f2860 fix(worker): bind protocol lifetime to controller endpoints and join startup observers
T-700 prerequisite: expose real method-channel closure and endpoint identity without introducing WorkerRef routing tokens or catalog liveness mirrors. Delay command observer creation until fallible head/recovery/runtime writes finish; abort and join it on socket startup failure.

Validation: cargo test -p worker (909 tests including integration targets); focused controller startup ordering regression; git diff --check HEAD. Full Runtime/Server validation and MR publication follow after the dependent T-700 implementation is clean.
2026-10-06 08:26:09 +09:00
Hare 2c023ac2be fix(workspace-config): fence user editors from runtime source proofs
Resolve MR finding WC-AUTH-001: reject authored source-tree and Profile editor requests from Runtime/Worker proofs in both scoped and single-Workspace middleware. Keep legitimate UI editing and independent Prompt/Skill/config-bundle consumption contracts. Add signed-router authority-state matrix and authenticated UI/WIP positive regressions.
2026-10-06 07:14:31 +09:00
Hare 0a471242cb feat(workspace-config): project grant-bound logical settings through WIP 2026-10-06 06:56:51 +09:00
Hare 7a96c42130 fix(checkouts): preserve scoped descriptor ignore rules
T-699 rev20, MR 01a10d66-db02-70c2-b152-197aca92d6b7 seq3 native_glob_ignore_regression. Load authorized root/nested ignore sources through FsAccessPolicy descriptor opens, retain only bounded ancestor matchers, preserve source precedence/negation/anchors and prune ignored directories before enumeration. Expanded parity also exposed Grep source-class precedence and ignored-directory rescue errors; use the shared matcher without relaxing Grep's existing ignore-open/Git-marker provider contract. No ambient global/linked-worktree administration pointer traversal or unsafe WalkBuilder ignore loading.

Add 7 fs boundary tests, 4 actual Local/scoped provider parity tests and 1 native WIP search/link regression. Current corrected source passes cargo check --workspace --all-targets; cargo test -p fs-operation -p workdir -p tools -p worker (fs37 Workdir125 Tools72+10+29+1doc Worker780+109integration); cargo test -p worker-runtime -p yoi-workspace-server (Runtime279+17+17 Backend576+11); fmt/diff. Logs target/validation/T-699/rereview-{check,core,hosts}.log. Earlier intermediate parity/WIP assertion failures retained, not passing evidence. No target/ref integration, RO source changes, environment update or completion.
2026-10-06 04:24:35 +09:00
Hare b952e56bc2 test: use required Bash cwd in compatibility regressions 2026-10-06 03:44:03 +09:00
Hare ae19426298 fix: preserve sanitized dangling-symlink read diagnostics 2026-10-06 03:42:06 +09:00
Hare 603a814b80 Merge commit '5670c20a6a50077985168269dfc15a6776c66ba6' into work/T-699-checkout-projection 2026-10-06 03:37:07 +09:00
Hare 149853bb0e feat: project attached checkouts with scoped native AI operations 2026-10-06 03:37:07 +09:00
Hare 5670c20a6a fix: integrate develop and preserve invocation notification recovery 2026-10-05 22:25:32 +09:00
Hare 9146331450 fix: echo REST completion nonce and argument context 2026-10-05 20:14:19 +09:00