Creatidy/creatidy-console
5
0
Fork 0
Code Issues 11 Pull requests Projects Releases Packages Wiki Activity Actions

Deliver revision-bound owner responses with uncertain-effect reconciliation #7

New issue
Open
opened 2026-10-04 23:02:40 +00:00 by kilo · 0 comments
kilo commented 2026-10-04 23:02:40 +00:00
Member
Copy link

Goal

Owner: Console command delivery, not business authority. Deliver only real producer-supported actions and distinguish receipt from effect.

Why / Current Evidence

A stale tab must not approve changed work; a timeout can mean accepted mutation. Console seed d6468f3 has no command path. Kernel eb4f4a2956712bfaf39a3271e1523e7f77a91e26 has internal revision/idempotency seams, no Console auth API; identical command-key replay returns historical receipt. Router 8d9d4b04bcb23fe19ff702b6209fbcb1537cdf1b admin/client/worker identities differ; MI fb7299810fdc4612d4e0559465faef571662c6ef has no operational commands. Source sections 4,6,8,12; G02/G03/G08/G09/G11.

Scope / Non-Goals

Per-command inventory: owner API, principal/scope, subject/revision, consequences, idempotency/input/reconciliation/audit and failure taxonomy. Safe owner requests/responses only; unsupported pause/resume/cancel/approve unavailable. No shell fallback, acceptance/retry engine, producer permission bypass or UI-only authorization.

Acceptance Criteria

  • Exact reviewed revision/scope shown before consequential authority change; routine navigation needs no ritual confirmations.
  • Changed revision conflicts; denied/revoked/expired permission and unsupported command fail safely.
  • Accepted interrupt is not cancelled; cancel not pause; receipt not effect. Timeout-after-acceptance remains unknown until supported reconciliation; no blind retry/exactly-once claim.
  • Multiple clients cannot seize control; repeated same-key input, changed-key input and historical receipt cases conform to owner semantics.
  • Notification dismissal cannot approve work; XSS/CSRF/origin attack tests and non-secret audit evidence bind action to subject.

Constraints

Credentials stay in owning supported trust boundary, never browser caches/URLs/logs. Command/version and idempotency migrations preserve immutable subject; unknown authority fails closed. Reuse producer command/reconciliation and established session primitives, not custom identity platform. Priority P1 design before any writes, implementation after producer contract. Live mutation and any authority/security decision require separately approved bounded scope; registration authorizes no action.

Links / Dependencies

Parent #1; Console read/auth and testing issues. Kernel Creatidy/creatidy-kernel#57; Router BioMedical-IT/scarcity-router#183; MI Creatidy/model-intelligence#16. If contract study finds an uncovered concrete command, recheck duplicates before a narrowly scoped producer request.

## Goal Owner: Console command delivery, not business authority. Deliver only real producer-supported actions and distinguish receipt from effect. ## Why / Current Evidence A stale tab must not approve changed work; a timeout can mean accepted mutation. Console seed d6468f3 has no command path. Kernel eb4f4a2956712bfaf39a3271e1523e7f77a91e26 has internal revision/idempotency seams, no Console auth API; identical command-key replay returns historical receipt. Router 8d9d4b04bcb23fe19ff702b6209fbcb1537cdf1b admin/client/worker identities differ; MI fb7299810fdc4612d4e0559465faef571662c6ef has no operational commands. Source sections 4,6,8,12; G02/G03/G08/G09/G11. ## Scope / Non-Goals Per-command inventory: owner API, principal/scope, subject/revision, consequences, idempotency/input/reconciliation/audit and failure taxonomy. Safe owner requests/responses only; unsupported pause/resume/cancel/approve unavailable. No shell fallback, acceptance/retry engine, producer permission bypass or UI-only authorization. ## Acceptance Criteria - Exact reviewed revision/scope shown before consequential authority change; routine navigation needs no ritual confirmations. - Changed revision conflicts; denied/revoked/expired permission and unsupported command fail safely. - Accepted interrupt is not cancelled; cancel not pause; receipt not effect. Timeout-after-acceptance remains unknown until supported reconciliation; no blind retry/exactly-once claim. - Multiple clients cannot seize control; repeated same-key input, changed-key input and historical receipt cases conform to owner semantics. - Notification dismissal cannot approve work; XSS/CSRF/origin attack tests and non-secret audit evidence bind action to subject. ## Constraints Credentials stay in owning supported trust boundary, never browser caches/URLs/logs. Command/version and idempotency migrations preserve immutable subject; unknown authority fails closed. Reuse producer command/reconciliation and established session primitives, not custom identity platform. Priority P1 design before any writes, implementation after producer contract. Live mutation and any authority/security decision require separately approved bounded scope; registration authorizes no action. ## Links / Dependencies Parent #1; Console read/auth and testing issues. Kernel https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/57; Router https://forgejo.creatidy.com/BioMedical-IT/scarcity-router/issues/183; MI https://forgejo.creatidy.com/Creatidy/model-intelligence/issues/16. If contract study finds an uncovered concrete command, recheck duplicates before a narrowly scoped producer request.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
docs-review-conversational-independence
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Depends on
#2 Define supported producer reads and the browser authentication boundary
Creatidy/creatidy-console
Reference
Creatidy/creatidy-console#7
No description provided.