G08: Define authorized Router state and reconnectable events for Console and CLI consumers #183
Labels
No labels
accessibility
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
P1
P2
P3
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
Depends on
#227 Composed Tier-2/Tier-3 harness and installed acceptance successor of excluded #141
Creatidy/scarcity-router
Reference
Creatidy/scarcity-router#183
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Goal
Product owner: Scarcity Router (producer); Console/CLI consumers; G08/G13/G07. Source: Creatidy architecture v1.0 (2026-10-04), sections 1-5, 7-13, 14-18 via #173. Provide producer-owned state/event/diagnostic contracts supporting trustworthy cross-product views without a second selector, scheduler or database access.
2026-10-27 scope integration (D-083, owner backlog disposition): producer-owned resource-state correctness formerly assigned to excluded #140 is part of this issue's producer scope: derived/discovered resource representation, honest availability and freshness information, a stable consistent state projection for consumers, and no fabricated completeness or availability. The producer must not manufacture history from existing request-audit sequence numbers or restart-local registry revisions; cursors/revisions must rest on a durable, restart-stable basis. Administrator-facing rendering of the same truth is #226; this issue builds the projection both consume.
Why and Evidence
Develop
8d9d4b04bcb23fe19ff702b6209fbcb1537cdf1b: control_api offers state/resources/sources/diagnostics and export; server_ui already owns admin UI. Registry revision/timestamps and AuditRecord request/decision IDs exist. These do not prove a public Console producer-consumer reconnect/dedup/gap contract; worker reconnect is not a Console event feed. The 2026-10-27 reconciliation additionally verified:/control/statereturns counts with no revision/cursor;/control/resourcesiterates static_config.resourcesonly (no derived resources, no observed_at/freshness); the registry_revisioncounter resets on every application rebuild; the durable audit store is write-only (no read surface); and no read-only consumer identity class exists. Review694 corrected a missed counterpart: Console #2/#3/#12 already existed and were linked in comment14299 before the documentation freeze; the contradictory later comment14358 is now explicitly corrected. These OPEN obligations are not implemented integration evidence.Scope
Inventory actual state/diagnostic surfaces and client authorization before choosing transport. Freeze minimum snapshot/event correlation, freshness, source revision/identity, dedup/resume/gap semantics, retention and authorization; implement only missing Router producer support after decision — including the integrated producer-state correctness above (derived/discovered representation, honest availability/freshness, stable consistent projection, no fabricated completeness). Reuse/link existing admin views for privileged commands with authority retained in Router. Meaningful-change notifications deduplicate. No assumed broker/Kubernetes/common DB, prescribed endpoint/payload/version, Console implementation or generic workflow/event engine.
Acceptance Criteria
Dependencies and Integration Order
#179 identity fixes are delivered (closed). Excluded #140 is no longer a predecessor (D-083 removed the stale edge); its producer-owned state correctness is integrated above and its administrator-facing remainder is #226. #182 CLI readability shipped independently. Router owns this producer. Actual consumers: Console #2 read/auth inventory, #3 snapshot/progress/resync/reconnect/gaps, #12 installed/browser acceptance after Router #183/#186/#226 — downstream, never an upstream prerequisite. Parallel product producers are Kernel #57 and MI #16, not Console implementation. Producer contract/data -> authorized consumer -> separately authorized installed/browser receipt. Coordinate #177 exports and #185 versions (delivered); composed acceptance is received by #227. No copied cross-product state or duplicate issue.
Constraints, Reuse, Priority and Authority
Reuse control/diagnostic/registry/audit serializers and admin UI first; reuse the authoritative registry, control plane and authentication architecture. OpenTelemetry/Langfuse patterns are unverified candidates: exact revision/files/license/attribution, privacy/auth semantics, failure tests, dependency/maintenance cost and data rights before adoption. Priority is an observability foundation, not indiscriminate P0. Future service/Console access, permission changes or inference need separate authorization/security decision; registration grants none. Technical+UX review and full gates required; no credentials or live quota in fixtures. Refs #173, D-041/D-044/D-048, D-083 and comment14299/corrected14358; admin rendering #226; composed acceptance #227.
Console counterparts registered: Creatidy/creatidy-console#2 (read/auth inventory), #3 (snapshot/progress/resync), #5 (resource/cost/freshness), #7 (revision-bound command delivery), #8 (existing admin navigation), #9 (attention), #12 (consumer/live gates). They reuse #183 and #140, not a duplicate producer issue. Console source evidence @
8d9d4b0records /v1/status fresh capacity collection, missing delegated read/history feed, strict distinct admin/client/worker identities, frame-ancestors none and historical inventory not live connection. No automatic probes, guessed new API or copied credentials; this link adds no producer authority/scope change.Corrected after independent review694: the previous negative Console-consumer conclusion was inaccurate and is superseded. The actual OPEN counterparts were already linked in comment14299: Console #2 owns read/auth inventory, #3 snapshot/progress/resync/reconnect/gap semantics, and #12 consumer/browser/installed acceptance. They consume Router #183/#140/#186; registered issues are not implemented integration evidence.
Parallel producer counterparts remain Kernel #57 and MI #16. Each owns its state/events; this issue owns Router's producer, not Console or a shared database. Producer contract/data -> authorized Console consumption -> separately authorized installed/browser receipt. CLI readability remains independent #182; admin UI remains #140. No duplicate issue, Console implementation or new API/authority is introduced.
kilo referenced this issue2026-10-12 22:57:07 +00:00
Owner-authorized /loop resumed after completed228/229 and225/230. Fresh canonical full queue2026-10-28:14 open issues; exact wontfix exclusions132/139/140/141/165/166; active177,183,186,199,214,224,226,227. Selecting183 under owner's explicit next execution preference (183 then186;225 P1 now integrated), not PR age. Actual native predecessor179 is closed; excluded140 edge is absent; Console acceptance is downstream. 199 retains explicit replacement/retirement gates;214 live Claude remains deferred;227 receives downstream183/186. Base freshly fetched develop04f40ddf59ea1abba6719208166daa94aeeddb1a, clean designated checkout. Beginning the expressly authorized staged contract/producer-foundation phase: verify actual registry/control/store boundaries first. No new identity, permission or exposed network contract is authorized by this selection; any such required security decision will remain explicit rather than inferred. No closure claim for the full issue from a staged delivery.
Staged contract research outcome @develop04f40dd (read-only source inspection; no product/HTTP/auth change):
The approved inventory/contract research step is now recorded; minimal producer design is feasible but exposed authorization/consistent publication are not implemented or accepted. All issue ACs remain open; no issue closure. No new identity, endpoint, schema migration, store/journal or unsupported security guarantee has been invented. With no source changes/implementation commits/PR for183, post-selection eligibility revalidation can return nonterminally to SELECT for independently authorized186 work while the already-explicit exposure prerequisite remains open. This is not QUEUE_EMPTY or a request to restart policy.
Owner-directed development stop — 2026-10-28. No #183 source implementation or PR was started. Contract research remains recorded in comment #19648: authoritative registry/control/storage surfaces exist, but an externally exposed state/event producer requires durable restart-stable cursors, atomic snapshot/replay boundaries, honest freshness/completeness and explicit authorization for any new read-only consumer identity/permission/network contract. No such security authorization was inferred. Console acceptance remains downstream, and the excluded #140 edge is absent. Further work is paused at owner direction; issue remains open with the exposure/authorization gate intact.
Current owner triage, 2026-11-01: P2. Router producer contract research is recorded in #19648; no producer implementation or PR was completed. Internal derived/discovered state correctness, freshness and consistent producer projection can proceed independently within existing authority; Console acceptance and #227 are downstream, not implementation prerequisites. Any new exposed consumer identity, permission or network contract requires Adrian's explicit security decision on identity, permitted data, transport, revocation and retention before exposure/integration. Full reconnectable events and consumer/installed acceptance remain open. This triage does not resume the previous development pause.
kilo referenced this issue2026-11-01 16:35:18 +00:00
Owner-resumed internal producer slice is proposed in PR #244 at
dcea94f037736e5ae62e27716deae32ebb1f990c, basea1c9e78c335e1b6286e17c1455a3665fc83889ee. Localmake checkpassed (3208 tests, 18 skipped), as did basedpyright and focused producer tests. The PR does not expose a consumer contract or implement durable event/replay support; #183 remains open. Independent review and Forgejo CI are pending.Partial producer slice integrated by PR #244, merge
f96d58e6d7d0fffdbe70476850d824efa5de2fb5; approved HEAD4ca972e2d28fdb9c36598727f63f8512948cd83fand basea1c9e78c335e1b6286e17c1455a3665fc83889ee. The merged tree exactly matches the approved HEAD. Local full gate passed (3213 tests, 18 skipped; package checks and basedpyright); Forgejo workflow #3439 passed; independent review #4 APPROVE with empty findings. Forgejo automatically closed this issue during merge, apparently interpreting negated closing-keyword prose; it was immediately reopened because acceptance is incomplete.Delivered: internal resource/discovery projection, conservative availability, source lifecycle/worker-connectivity distinction, serialized publication, and observation provenance invalidation. Not delivered: durable restart-stable event journal/cursors, deduplication, gap detection/replay/resynchronization, complete atomic worker reports, retained observations/discovery across restart, versioned consumer fixtures and authorized external access. This issue remains open; no downstream acceptance is claimed.
Minimal proposed future access decision, NOT implemented or approved: a separately issued, read-only Console/CLI consumer identity, scoped only to redacted resource/source state and eventual event metadata, never credentials/prompts or administrative commands; individually revocable credentials and enforcement on new and existing streams; loopback by default, verified TLS for authorized remote transport; bounded event retention/backpressure with explicit expiry/gap and snapshot resync. Exact credential mechanism, retention bounds and remote exposure require owner security decision. Existing inference-client and worker identities lack this read scope; granting the administrator identity to unattended consumers would expose broader privileged command authority. Internal event producer work remains independently authorized.
The owner-authorized continuation of internal event production is proposed in PR #247 at
2372e2c86314dfca4e0cc40e78454e8abfc6d3ed, based onf96d58e6d7d0fffdbe70476850d824efa5de2fb5. Local full gate passed (3230 tests, 18 skips, package checks, basedpyright); independent review and Forgejo CI are pending. Review ordinals #1-4 remain consumed by PR #244; the next is #5. External access remains outside this implementation.Internal event producer integrated via PR #247 as
ebeee2abe7d2b44a3383053754a07d8d220d017e(approved HEAD824343ee633de4720ecba17ac8c657e65a7efd47, basef96d58e6d7d0fffdbe70476850d824efa5de2fb5); the merged tree matches the reviewed HEAD. Review #8 APPROVE with no findings; Forgejo workflow #3453 SUCCESS; localmake checkpassed (3237 tests, 18 skipped). Post-merge reassessment found independently actionable internal acceptance-test gaps for actual reordered-consumer recovery and a combined partial-provider/usage reconstruction fixture, so the bounded #183 invocation continues rather than treating external authorization as a stop.Internal producer continuation is integrated. PR #247 merged as
ebeee2abe7d2b44a3383053754a07d8d220d017e(review #8 APPROVE, HEAD824343ee633de4720ecba17ac8c657e65a7efd47, basef96d58e6d7d0fffdbe70476850d824efa5de2fb5, Forgejo CI #3453 SUCCESS). Test-only internal acceptance follow-up PR #248 merged as14580f629f123bd079e1aa80651a454e9b3e9ce7(review #10 APPROVE, HEADf3c911391303342586869d76ca31d735e10faa9c, baseebeee2abe7d2b44a3383053754a07d8d220d017e, Forgejo CI #3458 SUCCESS). Each merge tree matches its approved HEAD. Final local gate: 3238 tests, 18 skipped, package checks and basedpyright passed. Review ordinals #1-10 are consumed.The internal contract provides bounded durable event identities/history, semantic deduplication, snapshot/high-water cuts, replay or explicit reasoned resynchronization, restart epoch fencing, atomic worker report publication, and deterministic concurrency/crash/restart/retention/consumer-fixture tests. Equivalent timestamp-only refreshes do not produce journal events or notifications; replay marks whether its timestamp provenance is current. Restart does not reconstruct ephemeral discovery, observation or connection state from history. No independently actionable internal implementation gap was identified in this bounded reassessment.
Issue remains OPEN: external consumer authorization, actual Console/CLI conformance, and separate installed/browser acceptance are not complete. External exposure requires an owner decision on a distinct read-only identity, allowed redacted resource/source/event fields, issuance and revocation including active streams, transport (loopback by default and verified TLS if remote), and bounded retention/backpressure/resync policy. Inference-client/worker roles lack the read scope; using administrator credentials for unattended consumers would grant excessive authority. None of those external permissions or endpoints were added.
Observer-access invocation, 2026-11-02: direct owner request authorizes the bounded observer implementation and proposes maximum 13, but expressly does not establish a D-069A exception before exact PR-specific authorization. Fresh
developis14580f629f123bd079e1aa80651a454e9b3e9ce7; D-069A integration is an ancestor. Reviews #1-10 are consumed, including #10 on PR #248; no current observer PR exists. The repository's no-patch-without-fresh-review-capacity rule prevents an agent implementation commit at the effective maximum 10, while D-069A requires the actual linked issue/PR identity for an exception. No source, branch, PR, review or permission was changed.Owner-controlled decision/action: provide an existing canonical, linked observer-scope PR and direct exact-PR authorization with finite maximum 13, or provide another explicit owner-authorized way to resolve this policy deadlock. A pre-PR inferred maximum, reuse of PR #248, review-counter reset, unreviewed patch, policy change or an invented PR identity cannot satisfy the stated constraints. The requested implementation and exposure scope are otherwise authorized; downstream consumer acceptance is not an implementation prerequisite.
2026-11-02 owner directly authorized a one-time preparatory exception to the no-unreviewable-patch restriction solely to implement and publish one new issue-linked observer-access PR, so its canonical identity can be used for a later PR-specific D-069A decision. This does not increase the effective maximum of 10, authorize or reserve review #11, allow merge/closure, change general policy, or reset consumed #1-10. Preparation uses one branch from current develop and will stop at
AWAITING_PR_SPECIFIC_REVIEW_AUTHORIZATIONafter local validation and PR verification. This agent comment records the direct instruction; it is not itself authority for a future review.Preparatory observer implementation is published in PR #249: #249. Canonical repository ID 15; issue #183; base
14580f629f123bd079e1aa80651a454e9b3e9ce7; HEAD189279b505fc01a5125bd9b22eaa4292574225c4. Localmake checkpassed (3253 tests, 18 skipped, basedpyright clean), as did package-check and installed-wheel observer HTTP coverage. Status:AWAITING_PR_SPECIFIC_REVIEW_AUTHORIZATION. Existing review ordinals #1-10 remain consumed; no review #11 was reserved or dispatched, and no merge/closure is authorized by this preparation. A future review exception requires direct owner authorization naming this exact PR, issue, scope and finite maximum under D-069A; this comment is not that authority.Read-only observer access integrated via PR #249: merge
10c3ea639280777847605c8f7132fff5a49ef09a, independently approved HEADe0be39facb542a23700ed959e6431605e43bfd00, base14580f629f123bd079e1aa80651a454e9b3e9ce7. The merged tree equals the approved HEAD, and merge parents match the approved refs. Review #11 requested changes; review #12 returned APPROVE with empty findings using nativepr-reviewer/openai/gpt-6.1-solhigh. Localmake checkpassed (3254 tests, 18 skipped; basedpyright clean);make package-checkand Forgejo workflow #3474 passed. The exact owner exception remains scoped to PR #249, maximum 13; #1-12 consumed, #13 not used and is not transferable. No live providers or production deployment.Issue remains open: actual Console/CLI consumer conformance and downstream installed/browser acceptance have not been established. The SR implementation adds separately scoped, individually revocable observer keys and versioned allowlisted snapshot/replay reads on the existing listener; it does not create a new listener, broaden inference/admin/worker access or implement a downstream consumer.