Creatidy/creatidy-kernel
5
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

Deliver independent work, SCM, CI and knowledge drivers with a heterogeneous project path #105

New issue
Open
opened 2026-10-27 00:29:19 +00:00 by kilo · 8 comments
kilo commented 2026-10-27 00:29:19 +00:00
Member
Copy link

Priority: P3

Owner-Deferred Delivery

Owner decision 2026-10-29: defer this heterogeneous-provider delivery until explicit future owner reactivation. This is a delivery sequencing and priority decision, not a reversal of ADR 0012 or deletion of its replaceable-provider target. Keep this issue open; no further Jira/Atlassian research or review dispatch is authorized for the present delivery.

PR #111, branch issue-105-independent-provider-drivers, exact preserved HEAD 6c7c2d0a71522714fc9434ffe0829182a260ea65, and all implementation commits, tests, evidence and review history remain historical/reusable work. The existing delivery has permanently consumed 7/10 independent whole-PR review invocations; no approval exists, no counter is reset, and the unapproved PR must not be merged. Future reactivation requires an explicit owner decision and recovery of that existing history. Do not discard provider-neutral work or infer its acceptance from deferral.

Goal

Operate independently configured Work Management/SCM/CI/Knowledge bindings while preserving the Forgejo reference and current trusted execution/effect safety.

Why

Work identity and code/check/context authority must not be inferred from one forge provider.

Scope

Executable provider adapters for the first Jira/GitHub/Jenkins/Confluence composition and existing Forgejo; split existing read/effect seams rather than add a parallel provider framework. Repository documentation remains an independently useful knowledge source. Reuse existing transports or documented provider interfaces, adding a dependency only with explicit justified maintenance/rights.

Acceptance Criteria

  1. New provider-qualified opaque identities distinguish hosts/ports/tenants/projects and nonnumeric keys; source revisions/native states/provenance remain explicit. Legacy intake/ref bytes reopen unchanged through a retained Forgejo facade; read-only configuration needs no mutation credential.
  2. Deliver real configured provider read/mutation adapters, not fake-only classes: selected Jira work and dependency reads, GitHub exact source/change/review facts and authorized PR effects, Jenkins exact-subject checks, Confluence versioned context. Explicitly refuse unsupported provider operations.
  3. Receive pagination/freshness/moving scans/permissions/native edge semantics and conditional updates; unsupported CAS or ambiguous absence cannot authorize mutation or eligibility.
  4. Every mutation reuses exact intent/dedupe/fence/receipt/reconcile; exercise lost replies, duplicate delivery, native revision drift and partial multi-driver sync without universal exactly-once claims.
  5. Run deterministic provider-shaped conformance on executable adapter transports and an installed mixed-binding path, including actual Forgejo compatibility. Synthetic service fixtures do not count as live provider acceptance; no final delivery consisting only of fixtures or interface stubs.
  6. Ship configuration/compatibility/migration/operator refusal docs and preserve existing source/AGit/authority safety. Separately authorized live receipt is a later named acceptance gate, not required to implement the offline installed adapter behavior.

Dependencies

Integrated architecture; no whole-issue native predecessor. No #52/#55/#57/Console or SR/MI feed prerequisite. Per-adapter provider interface/rights checks are required evidence, not speculative cross-project issue blockers. #106 Forgejo-first ordinary delivery must not wait on this owner-deferred issue.

Constraints

ADR 0012 and ADR 0011; inward dependencies (adapters -> ports -> core); self-contained public core. No new coding agent, tracker, catalogue, gateway or generic workflow DSL; no credential/runtime-state copying. Preserve old bytes/IDs/unknowns and #53 CLOSED/NOT IMPLEMENTED, PR #85 CLOSED/UNMERGED. Preserve accepted bounded Forgejo/Codex, source ownership, product review and cancellation evidence rather than replacing them. Synthetic offline tests plus the installed path and fresh independent exact-subject review are required; live inference/effects/releases require separate authority. No production credentials or paid/live provider execution is granted by registration. The owner-selected P3 and explicit deferral supersede the former P1 delivery priority, not the long-term functional requirements.

Links

Priority: P3 ## Owner-Deferred Delivery Owner decision 2026-10-29: defer this heterogeneous-provider delivery until explicit future owner reactivation. This is a delivery sequencing and priority decision, not a reversal of ADR 0012 or deletion of its replaceable-provider target. Keep this issue open; no further Jira/Atlassian research or review dispatch is authorized for the present delivery. PR #111, branch `issue-105-independent-provider-drivers`, exact preserved HEAD `6c7c2d0a71522714fc9434ffe0829182a260ea65`, and all implementation commits, tests, evidence and review history remain historical/reusable work. The existing delivery has permanently consumed 7/10 independent whole-PR review invocations; no approval exists, no counter is reset, and the unapproved PR must not be merged. Future reactivation requires an explicit owner decision and recovery of that existing history. Do not discard provider-neutral work or infer its acceptance from deferral. ## Goal Operate independently configured Work Management/SCM/CI/Knowledge bindings while preserving the Forgejo reference and current trusted execution/effect safety. ## Why Work identity and code/check/context authority must not be inferred from one forge provider. ## Scope Executable provider adapters for the first Jira/GitHub/Jenkins/Confluence composition and existing Forgejo; split existing read/effect seams rather than add a parallel provider framework. Repository documentation remains an independently useful knowledge source. Reuse existing transports or documented provider interfaces, adding a dependency only with explicit justified maintenance/rights. ## Acceptance Criteria 1. New provider-qualified opaque identities distinguish hosts/ports/tenants/projects and nonnumeric keys; source revisions/native states/provenance remain explicit. Legacy intake/ref bytes reopen unchanged through a retained Forgejo facade; read-only configuration needs no mutation credential. 2. Deliver real configured provider read/mutation adapters, not fake-only classes: selected Jira work and dependency reads, GitHub exact source/change/review facts and authorized PR effects, Jenkins exact-subject checks, Confluence versioned context. Explicitly refuse unsupported provider operations. 3. Receive pagination/freshness/moving scans/permissions/native edge semantics and conditional updates; unsupported CAS or ambiguous absence cannot authorize mutation or eligibility. 4. Every mutation reuses exact intent/dedupe/fence/receipt/reconcile; exercise lost replies, duplicate delivery, native revision drift and partial multi-driver sync without universal exactly-once claims. 5. Run deterministic provider-shaped conformance on executable adapter transports and an installed mixed-binding path, including actual Forgejo compatibility. Synthetic service fixtures do not count as live provider acceptance; no final delivery consisting only of fixtures or interface stubs. 6. Ship configuration/compatibility/migration/operator refusal docs and preserve existing source/AGit/authority safety. Separately authorized live receipt is a later named acceptance gate, not required to implement the offline installed adapter behavior. ## Dependencies Integrated architecture; no whole-issue native predecessor. No #52/#55/#57/Console or SR/MI feed prerequisite. Per-adapter provider interface/rights checks are required evidence, not speculative cross-project issue blockers. #106 Forgejo-first ordinary delivery must not wait on this owner-deferred issue. ## Constraints ADR 0012 and ADR 0011; inward dependencies (`adapters -> ports -> core`); self-contained public core. No new coding agent, tracker, catalogue, gateway or generic workflow DSL; no credential/runtime-state copying. Preserve old bytes/IDs/unknowns and #53 CLOSED/NOT IMPLEMENTED, PR #85 CLOSED/UNMERGED. Preserve accepted bounded Forgejo/Codex, source ownership, product review and cancellation evidence rather than replacing them. Synthetic offline tests plus the installed path and fresh independent exact-subject review are required; live inference/effects/releases require separate authority. No production credentials or paid/live provider execution is granted by registration. The owner-selected P3 and explicit deferral supersede the former P1 delivery priority, not the long-term functional requirements. ## Links - Architecture/backlog mandate: #103; owner publication 2026-10-27 and Forgejo-first priority decision 2026-10-29. - Preserved implementation and review evidence: #111; issue comment https://forgejo.creatidy.com/Creatidy/creatidy-kernel/issues/105#issuecomment-19738. - Integrated architecture PR #104, merge `ace7175e087cd70e207594f5631c8f4f70fabfd4`. - ADR 0012: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/adr/0012-unified-work-coordination-and-drivers.md - Publication payload: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/backlog-alignment.md - Current target: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/target.md - Migration: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/src/commit/ace7175e087cd70e207594f5631c8f4f70fabfd4/docs/architecture/migration.md - #9 bounded Forgejo, #49 current numeric inert intake; #61 source ownership. #52 is model routing and #55 optional MI, neither owns this composition.
kilo commented 2026-10-28 11:38:26 +00:00
Author
Member
Copy link

Selected By Fresh Canonical Loop

The owner's explicit #56 recovery and autonomous /loop continuation completed #56 (PR109) and then #59 (PR110). After #59 integrated acceptance19620, all12current open issues were exhausted; exactwontfix44/37/30/15 were excluded first, and all8remaining bodies, comments, native edges and required producer evidence were refreshed.

#105 is selected as the eligible P1 root. Older #57 still requires #106; #106 requires #105; independent #62 is P2. #105 has no whole-issue native predecessor, exclusions or new owner decision. Per-adapter API/interface/rights checks are implementation evidence, not a #52/#55/#57/SR/MI/Console readiness gate. Current Router lane facts do not authorize mutation or block this independent work.

Post-selection actual #105 scope/AC1-6 and dependency list were revalidated unchanged. Ordinary branch issue-105-independent-provider-drivers starts from freshly fetched canonical develop b1c9ffca16f06596e5c3afdca3b9893cf7422d8d in the same checkout. No prior #105 branch, delivery, comments, review counter or open PR was found. #105 whole-PR review budget starts0/10, independent of completed #59's8/10 and permanently preserved #56 original10/10 plus separate recovery3/4. No counter is reset.

Implement real independent Work/SCM/CI/Knowledge bindings for Jira/GitHub/Jenkins/Confluence and retain executable Forgejo compatibility. New opaque identities preserve host/port/tenant/project/key/native revision; existing numeric/ref bytes stay unchanged. Native pagination, permissions, exact-subject checks and server-enforced conditions must be received, not invented. Mutations reuse intent/dedupe/fence/receipt/reconcile and preserve partial-sync/unknown outcomes. Unsupported operations refuse; no fake-only or interface-only delivery.

The sole source writer is implementing against official documented provider interfaces with synthetic transport conformance and an actual installed mixed-binding journey. Full checks/package/audit precede normal publication and fresh independent exact-head review. Live provider receipts remain a later named gate; no production credentials, external repository mutations, inference, release/deployment, new architecture/ADR0012 planning or #106/#57/#52/#55 expansion is authorized. Issue remains open until separate reviewed integration and acceptance.

## Selected By Fresh Canonical Loop The owner's explicit #56 recovery and autonomous /loop continuation completed #56 (PR109) and then #59 (PR110). After #59 integrated acceptance19620, all12current open issues were exhausted; exactwontfix44/37/30/15 were excluded first, and all8remaining bodies, comments, native edges and required producer evidence were refreshed. **#105 is selected as the eligible P1 root.** Older #57 still requires #106; #106 requires #105; independent #62 is P2. #105 has no whole-issue native predecessor, exclusions or new owner decision. Per-adapter API/interface/rights checks are implementation evidence, not a #52/#55/#57/SR/MI/Console readiness gate. Current Router lane facts do not authorize mutation or block this independent work. Post-selection actual #105 scope/AC1-6 and dependency list were revalidated unchanged. Ordinary branch `issue-105-independent-provider-drivers` starts from freshly fetched canonical develop **`b1c9ffca16f06596e5c3afdca3b9893cf7422d8d`** in the same checkout. No prior #105 branch, delivery, comments, review counter or open PR was found. **#105 whole-PR review budget starts0/10**, independent of completed #59's8/10 and permanently preserved #56 original10/10 plus separate recovery3/4. No counter is reset. Implement real independent Work/SCM/CI/Knowledge bindings for Jira/GitHub/Jenkins/Confluence and retain executable Forgejo compatibility. New opaque identities preserve host/port/tenant/project/key/native revision; existing numeric/ref bytes stay unchanged. Native pagination, permissions, exact-subject checks and server-enforced conditions must be received, not invented. Mutations reuse intent/dedupe/fence/receipt/reconcile and preserve partial-sync/unknown outcomes. Unsupported operations refuse; no fake-only or interface-only delivery. The sole source writer is implementing against official documented provider interfaces with synthetic transport conformance and an actual installed mixed-binding journey. Full checks/package/audit precede normal publication and fresh independent exact-head review. Live provider receipts remain a later named gate; no production credentials, external repository mutations, inference, release/deployment, new architecture/ADR0012 planning or #106/#57/#52/#55 expansion is authorized. Issue remains open until separate reviewed integration and acceptance.
kilo commented 2026-10-28 13:26:49 +00:00
Author
Member
Copy link

Implementation Published

PR #111 is open at HEAD ff7e0d20da1661d18c5d649c6cf871d5273f7231, base/merge-base b1c9ffca16f06596e5c3afdca3b9893cf7422d8d, ordinary branch issue-105-independent-provider-drivers. The normal owner-authored commit contains15intendedfiles and no dependency, schema, old-codec or ADR change.

Executable independent Jira/GitHub/Jenkins/Confluence adapters, exact Git-document knowledge and retained Forgejo family facade now run through concrete bounded HTTPS/native-payload transports and shared read/publication handlers. Provider-qualified opaque identities separate native revisions, related commits and observation hashes. Existing WorkOwnership, budgets, immutable Operations, real outbox fences, receipts and reconciliation remain the authority path.

Supported effects are GitHub explicit-commit COMMENT review append and native-version-conditional Confluence replacement; unsupported expected-head PR create/PATCH/merge and Jira conditional edits refuse without write credentials. Permission-limited links require trusted owner exact-edge/freshness evidence; native Closed and check results are not Kernel acceptance. Unknown/lost/eventually invisible results do not authorize automatic retry. Independent partial outcomes remain visible.

Final closed/offline checks: 2,344 passed,106 subtests,85 existing native opt-ins skipped; all tooling/import/types/secrets/diff gates passed. Package checks passed reproducible builds and actual isolated installed mixed-provider HTTP/native-payload journey, partial-sync lost-reply/reopen recovery and retained Forgejo/AGit plus migration/ownership proofs. Audit found no known vulnerabilities. Source was frozen during final gates; parent inspected the full intended delta and verified owner identity/clean exact refs.

Official provider API/version/rights/terms and exact public Jenkins pins are documented. No SDK/code copied or live credentials/accounts used. The named live provider/profile reception gate remains separate; synthetic receipts and native skips are not live reception.

Review budget0/10 before first fresh complete independent review. No approval, merge or closure claimed. All #56/#59 histories remain unchanged.

## Implementation Published [PR #111](https://forgejo.creatidy.com/Creatidy/creatidy-kernel/pulls/111) is open at HEAD **`ff7e0d20da1661d18c5d649c6cf871d5273f7231`**, base/merge-base **`b1c9ffca16f06596e5c3afdca3b9893cf7422d8d`**, ordinary branch `issue-105-independent-provider-drivers`. The normal owner-authored commit contains15intendedfiles and no dependency, schema, old-codec or ADR change. Executable independent Jira/GitHub/Jenkins/Confluence adapters, exact Git-document knowledge and retained Forgejo family facade now run through concrete bounded HTTPS/native-payload transports and shared read/publication handlers. Provider-qualified opaque identities separate native revisions, related commits and observation hashes. Existing WorkOwnership, budgets, immutable Operations, real outbox fences, receipts and reconciliation remain the authority path. Supported effects are GitHub explicit-commit COMMENT review append and native-version-conditional Confluence replacement; unsupported expected-head PR create/PATCH/merge and Jira conditional edits refuse without write credentials. Permission-limited links require trusted owner exact-edge/freshness evidence; native Closed and check results are not Kernel acceptance. Unknown/lost/eventually invisible results do not authorize automatic retry. Independent partial outcomes remain visible. Final closed/offline checks: **2,344 passed,106 subtests,85 existing native opt-ins skipped**; all tooling/import/types/secrets/diff gates passed. Package checks passed reproducible builds and actual isolated installed mixed-provider HTTP/native-payload journey, partial-sync lost-reply/reopen recovery and retained Forgejo/AGit plus migration/ownership proofs. Audit found no known vulnerabilities. Source was frozen during final gates; parent inspected the full intended delta and verified owner identity/clean exact refs. Official provider API/version/rights/terms and exact public Jenkins pins are documented. No SDK/code copied or live credentials/accounts used. The named live provider/profile reception gate remains separate; synthetic receipts and native skips are not live reception. **Review budget0/10 before first fresh complete independent review.** No approval, merge or closure claimed. All #56/#59 histories remain unchanged.
kilo commented 2026-10-28 18:00:23 +00:00
Author
Member
Copy link

Independent Review 3/10

Fresh native Sol 6.1 High reviewer task ses_e7c6ecd7affenOslJcM2zHGInX reviewed the complete PR at exact HEAD ff7e0d20da1661d18c5d649c6cf871d5273f7231, base b1c9ffca16f06596e5c3afdca3b9893cf7422d8d. Canonical/local refs and clean checkout matched; independent make check passed2,344/85nativeopt-inskips/106subtests and package-check passed. The reviewer returned COMMENT with two code findings plus an independent public-source access limitation; no approval.

  1. Final authorization race: effect-specific authorization is checked before workspace capture and the final store delivery/clock cut. The grant can expire or be revoked during that blocking preflight while the wider Kernel claim remains active, and the native POST/PUT can still proceed. The final effect-specific check must occur after owned-workspace observation and current exact store fence/lease/clock validation, with no later blocking local preflight.
  2. Settlement recovery gap: a committed accepted/rejected provider receipt and Operation outcome can precede resource settlement. On replay, the terminal Operation short-circuits the cached receipt path, leaving the hold unsettled indefinitely. Recovery must validate the exact cached receipt/current Operation fence and idempotently record its missing settlement after reopen without another provider send; unknown or unrelated effects remain held.

Both fixes are in progress with revocation-during-capture and accepted/rejected crash-cut regressions. The reviewer could not independently retrieve two cited public references through its reader, so those claims remain subject to independent verification in the next fresh review using alternative bounded source URLs; that is not a third code finding.

Three review invocations consumed (ordinal1 infrastructure error, ordinal2 COMMENT/incomplete source access, ordinal3 COMMENT with two findings); seven remain. PR #111 remains open/unmerged. All #56/#59 histories unchanged.

## Independent Review 3/10 Fresh native Sol 6.1 High reviewer task `ses_e7c6ecd7affenOslJcM2zHGInX` reviewed the complete PR at exact HEAD `ff7e0d20da1661d18c5d649c6cf871d5273f7231`, base `b1c9ffca16f06596e5c3afdca3b9893cf7422d8d`. Canonical/local refs and clean checkout matched; independent `make check` passed2,344/85nativeopt-inskips/106subtests and package-check passed. The reviewer returned **COMMENT with two code findings** plus an independent public-source access limitation; no approval. 1. **Final authorization race:** effect-specific authorization is checked before workspace capture and the final store delivery/clock cut. The grant can expire or be revoked during that blocking preflight while the wider Kernel claim remains active, and the native POST/PUT can still proceed. The final effect-specific check must occur after owned-workspace observation and current exact store fence/lease/clock validation, with no later blocking local preflight. 2. **Settlement recovery gap:** a committed accepted/rejected provider receipt and Operation outcome can precede resource settlement. On replay, the terminal Operation short-circuits the cached receipt path, leaving the hold unsettled indefinitely. Recovery must validate the exact cached receipt/current Operation fence and idempotently record its missing settlement after reopen without another provider send; unknown or unrelated effects remain held. Both fixes are in progress with revocation-during-capture and accepted/rejected crash-cut regressions. The reviewer could not independently retrieve two cited public references through its reader, so those claims remain subject to independent verification in the next fresh review using alternative bounded source URLs; that is not a third code finding. Three review invocations consumed (ordinal1 infrastructure error, ordinal2 COMMENT/incomplete source access, ordinal3 COMMENT with two findings); seven remain. PR #111 remains open/unmerged. All #56/#59 histories unchanged.
kilo commented 2026-10-28 19:00:01 +00:00
Author
Member
Copy link

PR #111 Remediation Commit

Review3 fixes are committed and pushed normally to the same branch/PR as 62203c2ce09bebf3378c171117d1dec2a3f4babe (base/merge-base b1c9ffca16f06596e5c3afdca3b9893cf7422d8d). No history rewrite or new delivery.

  • Effect-specific authorization now runs last, after blocking workspace capture and exact current claim/clock/fence/lease validation. Tests revoke the host grant during the third ownership capture and store cut, proving GitHub POST and Confluence PUT are never sent.
  • Cached terminal accepted/rejected receipts repair a missing exact-fence work settlement after reopen from their already-committed content address. Receipt, OperationKey, status and native reference are checked. No provider resend, attempt increment, new grant or settlement of other operations. Accepted GitHub and rejected Confluence409 installed journeys simulate process failure at the commit gap. Prior cancelled-operation receipt history stays read-only and cannot settle.

Full final closed/offline make check package-check audit passed after all edits: 2,359 passed,85 existing native opt-ins skipped,106 subtests,1093.53s; all locked/tool/type/import/secrets/diff gates passed. Package checks include both installed settlement crash/reopen recoveries plus all previous mixed provider/Forgejo/migration journeys. Audit reports no known vulnerabilities. Focused provider suite84PASS. No code changes followed the gates.

#105 cumulative review remains 3/10 consumed: ordinal1 transport failure/no verdict, ordinal2 COMMENT/no findings/incomplete source retrieval, ordinal3 COMMENT/two code findings. Independent approval is not yet established. Next is fresh complete Sol6.1High review4/10 on current exact PR head; exact-head CI and currentness remain required before any merge. PR111/#105 stay open/unmerged.

## PR #111 Remediation Commit Review3 fixes are committed and pushed normally to the same branch/PR as `62203c2ce09bebf3378c171117d1dec2a3f4babe` (base/merge-base `b1c9ffca16f06596e5c3afdca3b9893cf7422d8d`). No history rewrite or new delivery. - Effect-specific authorization now runs last, after blocking workspace capture and exact current claim/clock/fence/lease validation. Tests revoke the host grant during the third ownership capture and store cut, proving GitHub POST and Confluence PUT are never sent. - Cached terminal accepted/rejected receipts repair a missing exact-fence work settlement after reopen from their already-committed content address. Receipt, OperationKey, status and native reference are checked. No provider resend, attempt increment, new grant or settlement of other operations. Accepted GitHub and rejected Confluence409 installed journeys simulate process failure at the commit gap. Prior cancelled-operation receipt history stays read-only and cannot settle. Full final closed/offline `make check package-check audit` passed after all edits: **2,359 passed,85 existing native opt-ins skipped,106 subtests**,1093.53s; all locked/tool/type/import/secrets/diff gates passed. Package checks include both installed settlement crash/reopen recoveries plus all previous mixed provider/Forgejo/migration journeys. Audit reports no known vulnerabilities. Focused provider suite84PASS. No code changes followed the gates. #105 cumulative review remains **3/10 consumed**: ordinal1 transport failure/no verdict, ordinal2 COMMENT/no findings/incomplete source retrieval, ordinal3 COMMENT/two code findings. Independent approval is not yet established. Next is fresh complete Sol6.1High review4/10 on current exact PR head; exact-head CI and currentness remain required before any merge. PR111/#105 stay open/unmerged.
kilo commented 2026-10-28 19:38:57 +00:00
Author
Member
Copy link

Independent Review 4/10

Fresh native GPT-6.1 Sol High whole-PR review task ses_e7c1a57ddffeXNQBalbY0wSjlG checked PR #111 exact HEAD 62203c2ce09bebf3378c171117d1dec2a3f4babe / base b1c9ffca16f06596e5c3afdca3b9893cf7422d8d: COMMENT, one P1. PR/local currentness and full accumulated diff were verified. Reviewer package-check and diff-check passed; its make-check hit one /proc/<pid>/stat ProcessLookupError race in an unchanged base test (git show confirmed the test is byte-identical at base). Its public provider source audit remains incomplete; this is not approval.

The P1 is that moving the unrestricted host policy authorizer to the last callback is not sufficient: that callback itself can block or re-enter and commit cancellation/expiry after the durable work deadline/lease/fence check, then return true. The required correction is two-phase: resolve a grant and its revision/expiry before the final cut, then after all blocking workspace/credential/provider work perform a fresh store clock/authority/fence cut and only a bounded, side-effect-free final grant revision/expiry validation against that cut. No blocking work may follow. Tests must cover grant expiry/revoke during capture and slow/reentrant authorizer cancellation/deadline/lease, with zero native POST/PUT and preserved existing capture-revocation behavior.

This is an implementation finding, not an owner decision. Six review invocations remain out of ten. PR #111 and #105 remain open/unmerged; no approval is established. Earlier failure/COMMENT ordinals and all #56/#59 histories remain preserved.

## Independent Review 4/10 Fresh native GPT-6.1 Sol High whole-PR review task `ses_e7c1a57ddffeXNQBalbY0wSjlG` checked PR #111 exact HEAD `62203c2ce09bebf3378c171117d1dec2a3f4babe` / base `b1c9ffca16f06596e5c3afdca3b9893cf7422d8d`: **COMMENT, one P1**. PR/local currentness and full accumulated diff were verified. Reviewer package-check and diff-check passed; its make-check hit one `/proc/<pid>/stat` ProcessLookupError race in an unchanged base test (`git show` confirmed the test is byte-identical at base). Its public provider source audit remains incomplete; this is not approval. The P1 is that moving the unrestricted host policy authorizer to the last callback is not sufficient: that callback itself can block or re-enter and commit cancellation/expiry after the durable work deadline/lease/fence check, then return true. The required correction is two-phase: resolve a grant and its revision/expiry before the final cut, then after all blocking workspace/credential/provider work perform a fresh store clock/authority/fence cut and only a bounded, side-effect-free final grant revision/expiry validation against that cut. No blocking work may follow. Tests must cover grant expiry/revoke during capture and slow/reentrant authorizer cancellation/deadline/lease, with zero native POST/PUT and preserved existing capture-revocation behavior. This is an implementation finding, not an owner decision. Six review invocations remain out of ten. PR #111 and #105 remain open/unmerged; no approval is established. Earlier failure/COMMENT ordinals and all #56/#59 histories remain preserved.
kilo commented 2026-10-28 20:23:21 +00:00
Author
Member
Copy link

Review 4 Remediation Commit

The P1 effect-grant timing finding is fixed and pushed normally to PR #111 as a98954179a573a2c9b08e30f8eb86951617ae159, base b1c9ffca16f06596e5c3afdca3b9893cf7422d8d.

Host policy resolves once before dispatch to an ephemeral exact-scope DriverEffectGrant (WorkClaim+DriverMutation, revision, absolute expiry and host-owned stdlib Event). Potentially blocking or re-entrant authorization is therefore before the fresh work authority check. After all provider reads, credentials and workspace captures, the existing SQLite delivery check validates current work/claim/fence/lease and returns its durable decision wall-time. The only subsequent checks are grant expiry against that same decision time and the built-in Event invalidation flag; no callback, extra clock read or local preflight follows. Revocation/replacement must permanently invalidate the old Event. Grants are not persisted or worker supplied.

Red-first cases reproduced14 unsafe authorization paths; final full gates on committed content passed 2,384 tests,106 subtests,85 existing native opt-ins skipped, package-check and audit. Installed tests cover revocation/expiry at capture/cut, reentrant cancellation/deadline, exact claim/mutation scope and denied grants before credentials. Exact-head CI is not yet visible, and independent public-source verification is still incomplete; neither is represented as passed/approved. Review invocations4/10 consumed, six remain. PR111/#105 stay open/unmerged.

## Review 4 Remediation Commit The P1 effect-grant timing finding is fixed and pushed normally to PR #111 as `a98954179a573a2c9b08e30f8eb86951617ae159`, base `b1c9ffca16f06596e5c3afdca3b9893cf7422d8d`. Host policy resolves once before dispatch to an ephemeral exact-scope `DriverEffectGrant` (WorkClaim+DriverMutation, revision, absolute expiry and host-owned stdlib Event). Potentially blocking or re-entrant authorization is therefore before the fresh work authority check. After all provider reads, credentials and workspace captures, the existing SQLite delivery check validates current work/claim/fence/lease and returns its durable decision wall-time. The only subsequent checks are grant expiry against that same decision time and the built-in Event invalidation flag; no callback, extra clock read or local preflight follows. Revocation/replacement must permanently invalidate the old Event. Grants are not persisted or worker supplied. Red-first cases reproduced14 unsafe authorization paths; final full gates on committed content passed **2,384 tests,106 subtests,85 existing native opt-ins skipped**, package-check and audit. Installed tests cover revocation/expiry at capture/cut, reentrant cancellation/deadline, exact claim/mutation scope and denied grants before credentials. Exact-head CI is not yet visible, and independent public-source verification is still incomplete; neither is represented as passed/approved. Review invocations4/10 consumed, six remain. PR111/#105 stay open/unmerged.
kilo commented 2026-10-28 23:46:11 +00:00
Author
Member
Copy link

Review 7 Remediation And Source-Evidence Blocker

Fresh independent review 7/10 (ses_e7b8442c4ffeixdUZYLfOIBIdX) found that the opaque identity parser's 150,000-character limit could reject its own valid maximum-length supplementary-Unicode output. It independently passed full check/package and verified exact Jenkins and GitHub public sources. It also reported that the official Jira GET-issue contract could not be independently inspected: public reader output exceeded its bounded extraction limits and access to a prepared official snapshot was denied.

The P2 codec defect was reproduced before correction and fixed without changing canonical bytes in normal commit 6c7c2d0a71522714fc9434ffe0829182a260ea65. The parser bound now derives from all valid field lengths, worst-case JSON Unicode escaping, the envelope and hex expansion. Maximum combined-field Unicode round-trip and excessive-input refusal are tested. Final closed/offline make check package-check audit: 2,385 passed,85 existing native opt-ins skipped,106 subtests, all static/type/import/secrets/diff gates and installed/reproducibility checks passed; audit no known vulnerabilities. Exact-head CI #3350/UI257 SUCCESS.

No current independent approval exists. Seven of ten reviews were consumed; three remain. Bounded recovery tried official reader, anchored/text/Markdown/alternate proxy, exact public-source clone for Jenkins and official GitHub OpenAPI, plus an official downloaded Jira snapshot. The latter could not be read by the reviewer under its actual external-directory rule; no independently verifiable official Jira Git pin was found. Parent-fetched source is not substituted for independent verification. A supported bounded reviewer-readable path with independently verifiable official Jira provenance remains necessary before a fresh whole-PR review can establish approval. No permissions or criteria were weakened. PR #111 remains open/unmerged; issue #105 remains open.

## Review 7 Remediation And Source-Evidence Blocker Fresh independent review 7/10 (`ses_e7b8442c4ffeixdUZYLfOIBIdX`) found that the opaque identity parser's 150,000-character limit could reject its own valid maximum-length supplementary-Unicode output. It independently passed full check/package and verified exact Jenkins and GitHub public sources. It also reported that the official Jira GET-issue contract could not be independently inspected: public reader output exceeded its bounded extraction limits and access to a prepared official snapshot was denied. The P2 codec defect was reproduced before correction and fixed without changing canonical bytes in normal commit **`6c7c2d0a71522714fc9434ffe0829182a260ea65`**. The parser bound now derives from all valid field lengths, worst-case JSON Unicode escaping, the envelope and hex expansion. Maximum combined-field Unicode round-trip and excessive-input refusal are tested. Final closed/offline `make check package-check audit`: **2,385 passed,85 existing native opt-ins skipped,106 subtests**, all static/type/import/secrets/diff gates and installed/reproducibility checks passed; audit no known vulnerabilities. Exact-head CI **#3350/UI257 SUCCESS**. **No current independent approval exists.** Seven of ten reviews were consumed; three remain. Bounded recovery tried official reader, anchored/text/Markdown/alternate proxy, exact public-source clone for Jenkins and official GitHub OpenAPI, plus an official downloaded Jira snapshot. The latter could not be read by the reviewer under its actual external-directory rule; no independently verifiable official Jira Git pin was found. Parent-fetched source is not substituted for independent verification. A supported bounded reviewer-readable path with independently verifiable official Jira provenance remains necessary before a fresh whole-PR review can establish approval. No permissions or criteria were weakened. PR #111 remains open/unmerged; issue #105 remains open.
kilo commented 2026-10-29 21:16:06 +00:00
Author
Member
Copy link

Owner Decision: Forgejo First, Heterogeneous Delivery Deferred

Direct owner decision 2026-10-29: #105 remains OPEN, priority P3 and explicitly ineligible until future owner reactivation. ADR 0012 and all heterogeneous Jira/GitHub/Jenkins/Confluence acceptance remain the long-term target. This is sequencing, not closure or an architecture reversal.

Preserve PR #111 OPEN/UNMERGED and branch issue-105-independent-provider-drivers at exact 6c7c2d0a71522714fc9434ffe0829182a260ea65; all commits and review evidence retained. Original delivery has 7/10 independent review invocations permanently consumed, no approval; never reset, spend further reviews on Jira in this deferred delivery, merge unapproved head, delete branch or discard reusable provider-neutral work. #106 is separately refocused to the complete Forgejo-first ordinary path; owner authorized removal of the whole-issue #105 prerequisite. No acceptance or live-provider readiness is claimed.

## Owner Decision: Forgejo First, Heterogeneous Delivery Deferred Direct owner decision 2026-10-29: #105 remains OPEN, priority P3 and explicitly ineligible until future owner reactivation. ADR 0012 and all heterogeneous Jira/GitHub/Jenkins/Confluence acceptance remain the long-term target. This is sequencing, not closure or an architecture reversal. Preserve PR #111 OPEN/UNMERGED and branch `issue-105-independent-provider-drivers` at exact `6c7c2d0a71522714fc9434ffe0829182a260ea65`; all commits and review evidence retained. Original delivery has 7/10 independent review invocations permanently consumed, no approval; never reset, spend further reviews on Jira in this deferred delivery, merge unapproved head, delete branch or discard reusable provider-neutral work. #106 is separately refocused to the complete Forgejo-first ordinary path; owner authorized removal of the whole-issue #105 prerequisite. No acceptance or live-provider readiness is claimed.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
develop
issue-62-installed-compatibility
issue-58-private-outcome-export
issue-57-recovery-preparation-alerts
issue-57-owner-served-state
issue-106-final-authority-dag
issue-106-forgejo-ordinary-execution
issue-105-independent-provider-drivers
issue-59-work-resource-ownership
issue-56-atomic-approval-recovery
issue-56-work-budget-enforcement
issue-103-publish-architecture-backlog
issue-62-platform-reception
issue-55-mi-utilized-reference
issue-52-kilo-offline-proof
docs/conversational-review-policy
issue-60-reception-fixture-plan
issue-62-compatibility-matrix-spec
issue-58-export-rights-spec
issue-57-owner-state-spec
issue-56-task-cost-shapes
issue-90-owned-cancellation
issue-54-product-review
issue-53-runtime-integration
No results found.
Labels
Clear labels   
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#55 [Kernel][G06] Retain admitted knowledge snapshot and harness-evidence provenance
Creatidy/creatidy-kernel
#60 [Kernel][G01-G13] Accept the installed controlled-task path end to end
Creatidy/creatidy-kernel
Reference
Creatidy/creatidy-kernel#105
No description provided.