fix: atomically accept work approval and immutable budgets (#56) #109
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "issue-56-atomic-approval-recovery"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Scope And Provenance
Refs #56, full active AC1-6. Owner's explicit2026-10-27T15:34:28Z mandate authorizes ONE materially revised atomic persistence-boundary recovery
kernel56-atomic-approval-recovery-20261027T153428Z(receipt56comment19377), maximumFOUR fresh whole-PR reviews.Supersedes PR108 CLOSED/UNMERGED/STOP_REVISE, permanently10/10 (PR94specificationordinal1, PR108functionalordinals2-10). Original
issue-56-work-budget-enforcementatd1d55d406923674c847b98a30756a05e87b52d2c, all nine commits/native reviews/negative evidence preserved. Replacement retains full ancestry, not a counter reset/rename/history rewrite. No original review11 or original unapproved-head merge.Exact Subject
Branch
issue-56-atomic-approval-recovery, HEADecfee7d04fae5149ba4538d706ebb303662a6458, base/merge-basee2348656238a2ff9a3244868e2beb543d86f15a5. Four normal recovery commits76083c7a,201c8f5f,81631a27,ecfee7d0. No amend/squash/force/branch deletion.Persistence And Safety
SQLite owner commits configured decision+consumption+Program create/amend+project/work binding+artifact references atomically, or none. Preflight compatibility and transactional invariants reject incompatible/removed envelopes. Final validation callbacks run before fresh independently durable boot-clock capture checked against UNCHANGED original anchors; reentrant mutations refuse while preserving committed cancellation/draft state. Spec-bound inert clock-origin evidence retains first anchors across rejection/COMMITfailure/reopening but grants NO Program/budget/dispatch authority. Pending/high-water clock observations survive business rollback. All task/offline/live-reference initializations share bounded acceptance; legacy unconfigured behavior cannot strip configured authority.
Unknown TOOL ownership blocks workspace reuse/restoration/collection/reexecution/acceptance/publication, not supported STOP/expiry cleanup of independently identifiable original runtime. Existing exactreceipt/fence/originalowned cleanup is reused; no numericPID/replacement adoption or invented TOOL settlement.
Resource headroom keeps provenance/unit/currency separate. Supported measurement/provider/owner records count; effective numeric estimates/unknowns remain unknown even for currentoperation after correction. Settlement does not release hidden-client resource uncertainty. Retains full finite project/task reservations across attempts/review/remediation/tool/retries/output/auxiliary work, boot expiry, dispatch/acceptance fencing, durable STOP/recovery and schema4 backup/downgrade refusal. Reservation != usage; unknown != zero/billing/headroom. Unsupported strict inference refuses. Dispatcher106/claims59/drivers105 remain separate.
Reviews And Validation
Recovery2/4 consumed, two remain before next dispatch. Fresh Sol6.1High wholePR1(task
ses_e81d3addaffeuriOHGR0VP3Lqb,76083c7a) REQUEST_CHANGES; wholePR2(taskses_e819ee560ffe0Cfn6upCvQoFth,81631a27) REQUEST_CHANGES. Normal scoped remediation commits preserve history; current full independent approval NOT claimed. Original10810/10 remains permanent/separate.Regressions:24 atomic acceptance cases,8 composed real-synthetic-processgroup STOP cases,34 finalclock/provenance cases+2taskretry variants. Includes successful/rejected new/amend/replay/reopen, priorapproval applicability, business COMMIT rollback, separately durable clock failures/rollback/reboot/latecallbackexpiry/stale projection, originalanchor preservation, compatible retry/replacementrefusal, unknownTOOL bytes/no publication, provenance corrections/dedupe/currentoperation+project/program/resourcehold. Red-first counterexamples17 before finalclock/provenance fix,4 beforeSTOPfix,1 budget-removal bypass.
Finalclosed/offline
make check: 1738passed,85existingopt-innative skips,106subtests,585.17s; locked tooling/format/lint/basedpyright/inwardimports/secrets/diffPASS.make package-checkPASS reproduciblewheel/sdist, isolatedinstalledordinary/source/budget/replay, actualpinnedschema2e2348656/schema323a28e31 readersrefuse4, originalbytes/backups/artifactsretained.make auditNO KNOWN VULNERABILITIES; targeted existing devmsgpack1.2.2->1.2.3 patch(CVE-2026-114613), no productdependency. Focused101PASS/compatibility288PASS on finaltree.Previous81631a27CI3270/UI242SUCCESS. CurrentHEADCI and freshfullreview/currentness/issueacceptance remain required before owner-authorized/loopmerge/verified56closure/freshcanonicalSELECT. Historical76083c7aCIfailure preserved; causalstep not inferred from inaccessiblelogs.
85skips do not prove native/live/realCodex/billing/hostileisolation. No ADR0012/architecture replan, SR/MI/CC mutation, production profiles/credentials/live inference, main/releases/deployments or gatewaivers.
Final Recovery Review And Integrated Merge Receipt
Fresh GPT-6.1 Sol High whole-PR recovery review 3/4, native task
ses_e816f34d1ffe0krOQLsBWMg7bs, returned APPROVE / findings[] for exact HEADecfee7d04fae5149ba4538d706ebb303662a6458, basee2348656238a2ff9a3244868e2beb543d86f15a5. Entire accumulated implementation/active #56 AC1-6 independently inspected; initial/final canonical/local refs and clean tree matched. Independent makecheck1738PASS/85unchangedoptionalnative skips/106subtests562.62s; packagecheckPASS. Parent complete gates+auditPASS; exact-head CI3281/UI243SUCCESS4m3s. No production/native/live/billing claim.Premerge fresh issue authority/labels/gates, exact base/head/currentness, clean checkout and no findings verified. Supported owner-authorized /loop merge-style MCP merge succeeded at2026-10-27T18:41:35Z, merge
b11aae420517b14bbb4d85c84f9a0d82c14446c6. Actual canonical PR readback merged/closed; normal fetch proves exact parents[e2348656,ecfee7d0], approved head ancestor of develop and integrated tree IDENTICAL to independently tested/reviewed tree (git diff --exit-codeclean).Cumulative immutable history: predecessor PR108 remains CLOSED/UNMERGED/STOP_REVISE at 10/10, original branch/9commits/allnative results preserved. Separate explicitly authorized recovery used 3/4: REQUEST_CHANGES, REQUEST_CHANGES, APPROVE; one authorized slot unused, no review4 or original11 dispatched. Four normal recovery commits76083c7a,201c8f5f,81631a27,ecfee7d0; no rewrite/deletion/force/squash. Current completion/acceptance evidence supersedes description's pre-review2/4 snapshot without erasing it.
Issue56 closure is separately conditioned on integrated active-criteria verification, not approval alone. Then fresh canonical SELECT automatically; no main/release/deploy/external mutation.