Repository navigation
Repair file, output, and native execution limits - #113
Merged
Merged
Conversation
Implement the selected minimum repairs for patch/checkpoint capacity, inspection continuation, contract-driven artifact validation, and paged checkpoint coverage with full confirmation binding and durable recovery. Migrate journal state-history storage through the existing schema owner. Retain path authority, preimage checks, atomicity, and the 500-line lint. Selected repairs: L003 L006 L010 L012 L013 L016 L020 L035 L036 L041 L045 L076 L078 L124 L168 L172 L173 L174 L175 L712. L036 already had the required retry lookup and needed no extra code. Validated the 12 affected/consuming package test selection, corrected runner assertions and finalization synchronization, and reran affected daemon fixtures against a stable executable. Runner unit suite: 471 pass. All-target Clippy with warnings denied, formatting, architecture-check, and ordinary-api-check pass. Crosslink continuation: 826. Issue results and automatic changelog updates are being recorded separately from this source commit.
Complete the second 20-item minimum-repair batch: streamed filesystem paging, artifact and context retention, discard recovery, exact native command receipts, unbounded Git status, and durable cancellable patch handoff. Preserve native owner identity and terminal evidence before allowing recovery or acknowledgement. Fix repeated literal-match columns and search subpage/fragment cursors found during review. Align source policy and fixtures to one 500-line limit. Crosslink: #103
Preserve exact attachment, process, request, reviewer, and Git evidence through bounded continuation and durable recovery. Bind previews to active conversation models and review navigation to exact source pages. Synchronize cancellation tests at actual reviewer start, repair documentation structure, and enroll the independent reviewer for candidate-bound proof-impact reconciliation. This commit is source review material, not a new PCR approval. Validation: 3,912 workspace tests passed; final daemon suite 271 passed; strict workspace Clippy, Rustdoc, Windows cross-compilation, format and structural checks passed. Native CI and exact proof-impact authorization follow this frozen source. Refs: Crosslink #103
Keep directory diagnostics unique and bounded, bind Git observations to immutable object data, and preserve long history subjects. Account only successfully written spool bytes and select live preview streams from the actual I/O mode. Correct canonical environment projection and Windows/macOS codec and test assumptions.
Persist exact preview output matches and their goal revision so accepted checks replay after restart without rescanning or retargeting changed goals. Carry zero-deadline execution authority through process admission. Negotiate bounded review summaries, preserve contiguous byte-bound diff pages and exact raw-byte rendering, and align native filesystem diagnostic fixtures with platform behavior.
Read retained preview evidence at its recorded byte offset. Exercise both Unix filesystem fixture variants and account for binary-file omissions in continuation checks.
Use a host-safe Unix path and verify continuation of that exact entry. Exercise the base fixture separately from Linux-native invalid filename coverage while preserving complete path and patch reconstruction.
Accumulate terminal bytes across bounded polls and split output chunks before checking the preview prompt. Use monotonic deadlines for prompt and exit waits, retain bounded diagnostics, and cover empty pages with a split-marker regression.
Register the independent ACTOR-0010 review of candidate 2353e5d and its 1,025 source transitions, 132 passing package gates, and resolved finding ledger. Keep protected source and inventory bytes at baseline 9092579, retain the permitted checker/design changes, and preserve all prior review artifacts. Source application follows in a separate commit. All 157 formal obligations remain in progress. Crosslink issue 103.
Apply the exact source tree reviewed as candidate 2353e5d after its separate authorization commit. Update the complete source inventory while preserving every detached reviewer artifact unchanged. The reviewed candidate passed all 132 ordinary/Verus package gates, all 194 Foundation jobs, native H0 on all three platforms, and the native graphical restart/goal-revision regression pair. Crosslink issue 103.
Acquire the SQLite writer transaction before installing the ordinal schema, so first-open setup and durable allocation commit together. Preserve the five-second contention budget and EXTRA synchronization, add operation-specific errors, and regress failed initial reservations publishing schema separately. Enroll the actual independent ACTOR-0011 reviewer for supplemental PCR-0010. PCR-0009 and all historical proof artifacts remain unchanged. This candidate is not formal approval: native Windows and fresh proof qualification follow. Validation: old implementation fails the new regression; repaired ordinal suite passes 8 tests. Full product-runner tests pass 527 with 6 ignored. Strict Linux and Windows GNU all-target Clippy, formatting, source layout, and whitespace checks pass. Native Windows behavior remains unverified. Crosslink: #103
Replace the shared 400-poll observation window with a two-minute monotonic watchdog for real Cargo gate completion. Preserve the latest snapshot in timeout diagnostics and retain explicit five-second cancellation checks. The fresh Windows review shard failed before the oversized-diff assertions; its generic timeout did not retain the blocking phase. A stalled-provider regression now checks the short-bound error snapshot and prompt cancellation. Verified: focused timeout regression, all three review tests, strict Linux and Windows GNU Clippy, formatting, source layout, and whitespace. Full candidate-bound formal and native qualification will be rerun for PCR-0010.
Retain ACTOR-0011's independent approval of candidate e5c4ec4 and all 132 exact-candidate ordinary and Verus gate logs. Restore the I9 application and actor inputs for the separate authorization-only phase. Preserve PCR-0001 through PCR-0009 and all 752 historical review artifacts. This registers review evidence without applying the reviewed source changes or discharging any in-progress obligation.
Apply the exact independently reviewed candidate source and actor inputs: reserve command ordinals and initialize their schema in one transaction, and use an elapsed-time integration watchdog with snapshot diagnostics. Advance the proof inventory to the reviewed source hashes while preserving the already registered PCR-0010 verdict and all historical review evidence.
dollspace-gay
changed the base branch from
authorization/pcr-0009
to
authorization/pcr-0010
October 9, 2026 13:19
Retain the exact signed PCR-0010 implementation tree and complete reviewed history while restoring the original repair branch as the delivery branch. The authorization base is now 2d8ad67. This source-unchanged publication commit triggers fresh checks against that settled base; superseded PRs #114 and #115 are retired without merging.
Repair retained execution ownership, scalable workbench inputs and artifacts, evidence and Git custody, Windows sandbox/console behavior, and updater lifecycle. Include a fresh independent reviewer identity for the candidate-bound formal verification campaign; formal approval and hosted qualification remain separate pending work.
Extract artifact storage, preview tests, nested Git inventory, evidence decoding and queries, and Windows sandbox helpers into coherent private modules. Preserve public paths and behavior; independently reviewed module moves. Local architecture, API, source layout, documentation, reproducibility, toolchain, formatting, focused tests, and strict Clippy pass. Fresh candidate formal and hosted verification follows.
Restore ConPTY console handles under redirected runners, explicitly terminate updater jobs, preserve atomic PowerShell receipts, and flush existing evidence with Windows write access. Copy retained output in contiguous slices to avoid excessive PTY capture overhead. Refs #103.
Reject aliased protected roots before ACL projection, keep directory inventories scoped to canonical project roots, and submit terminal Enter correctly from preview controls. Strengthen native deny/rollback and terminal regressions without changing raw input semantics. Refs #103.
Retain exact object descriptors and handles, exclude competing native ACL transactions by volume, and preserve cleanup ownership for retry. Restore original DACLs after inheritance cleanup and detect residual temporary authority on new descendants. Align the daemon review-start fixture with its existing observation watchdog while preserving the five-second cancellation deadline. Refs #103.
Prepare the Windows replay descriptor with the required auto-inheritance request while retaining the immutable saved descriptor. Verify all original objects again after every replay write, preserve concrete cleanup failures, and cover reverse nested restoration and inherited control on native Windows.
Use independent fixture principals for cross-process ACL exclusion and report read-only creator and ACE inventories when protected-child cleanup fails. This diagnostic commit does not alter production inheritance comparison.
Inspect raw ACE inventories independently of the explicit-entry decoder and compare complete parent and owner/group creator variants. Use recognized non-host principals and distinct backup roots for each child invocation. Production ACL logic is unchanged pending native diagnosis.
dollspace-gay
marked this pull request as ready for review
October 9, 2026 23:20
Register ACTOR-0012's independent exact-candidate review, the complete 132-gate ordinary and Verus campaign, and the resolved finding ledger. Retain the PCR-0010 source inventory and protected actor registry while binding the reviewed actor from the exact detached candidate and establishing the checker input. Preserve PCR-0001 through PCR-0010 and every historical review artifact. Source application follows in a separate commit. Crosslink issue 103.
Apply the exact source tree reviewed at 6889f8c after its separate authorization commit. Advance the complete proof inventory while preserving the PCR-0011 verdict and every detached review artifact. The reviewed candidate passed all 132 ordinary and Verus package gates and the required exact-candidate hosted and native qualification. Crosslink issue 103.
Exercise a deliberately split prompt through the owned subprocess and require revision changes only when the complete retained observation changes. Verify settled public snapshots and restore the candidate digest after fixture synchronization. Enroll the fresh independent PCR-0012 reviewer without changing prior principals or proof history. Refs #103.
Use the supported Write API to emit the exact partial prompt while preserving the real subprocess handshake and revision assertions. Both workflow API-policy commands, focused repetitions, workbench tests, and strict Linux and Windows-target lint checks pass. Refs #103.
Retry only a missing live receipt while the updater helper remains active, within the existing bounded observation window. Keep malformed receipt and other I/O failures strict, reuse the matched waiting snapshot, and retain all final outcome, version, and installation ownership assertions. Add phase and path context to completed receipt failures. Windows GNU strict Clippy, 53 Linux launcher tests, policy/layout and format checks passed; fresh native Windows qualification remains required. Crosslink issue 103.
Keep immediate control, full-spool and exact-owner reads while allowing ConPTY setup bytes to arrive between observations. Require bounded range lengths, nondecreasing totals and unchanged retained prefixes. Pipe output remains exactly empty, and cancellation plus cleanup checks stay strict. Use the existing native PTY test output budget for this readability test to avoid an unrelated output-limit termination during terminal setup. Focused pipe/PTY regressions, all 72 process tests, Windows GNU strict Clippy, policy/layout and formatting passed. Native ConPTY qualification remains required on the new commit. Crosslink issue 103.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the existing minimum-repair history and the remaining 23 implementation items, targeting
develop. Large inputs, files, terminal output, and evidence retain exact identities and complete recoverable content; interfaces page or scroll that content without independent action quotas.The final work adds atomic referenced-message and attachment admission, exact continuation and retry binding, incremental queue reordering, retained brief pages, and artifact-backed initialization with authenticated instruction scope. TUI editing preserves whitespace and large drafts, and terminal views can navigate beyond the previous row limits.
Browser consoles and Git operations retain native process ownership and durable outcomes across disconnects and gateway restarts. File previews read version-bound UTF-8 ranges, directory pagination binds canonical project roots, and nested repositories retain their exact registered Git identities. Evidence publication and verification preserve complete streamed bytes and reject conflicting or changed content.
Windows preparation validates native path identities before granting authority, retains original objects through live-owner ACL restoration, and gives ConPTY sessions owned cancellation and descendant cleanup. Native qualification repairs cover terminal Enter semantics, updater Job ownership, PowerShell replacement, symbolic ACL serialization, and retryable ACL cleanup. Live ACL transactions reserve their affected volumes before capturing permissions; a competing transaction receives a typed busy result, and failed final-owner cleanup quarantines the volume for the lifetime of that process. macOS updater cleanup retains the unreaped root identity and accepts Darwin's zombie-only group signal result only after a native singleton-group snapshot proves that no other member remains.
Reviewed source:
6889f8c5dcca335b71c572865d5483c8e68c0890. Current PR head:9666d0902afe9f52e6b063d9ebfa9aea7b2aaf5c. All 132 ordinary/Verus package commands passed on the frozen reviewed source, with every raw log, command, hash, timestamp, and candidate binding independently audited. Its hosted qualification completed with 580 successful PR checks and four explicit skips: Gate A passed all 215 jobs, Foundation passed all 194, and Native product passed all 162. Windows native qualification passed all 16 cases plus conformance; all 36 Windows x64/ARM product scenarios passed raw-observation and cleanup audits. Discovery passed all 12 real-container lifecycle scenarios and four replay targets.The initial browser attempt had one unexplained session-selection timeout after 19 passing cases. The unchanged rerun passed all 25 browser cases, and traced local repeats passed another 90 cases. That initial failure remains documented as an open, nonblocking reliability finding.
PCR-0011 is included through separate signed authorization (
6674998803736ae1820f599206e65a91a1723e9b) and implementation (5bbd2555921d1feee5c6e5747d421b34f089d341) commits. The final application source is byte-identical to the reviewed source; the added records contain the independent verdict, all 132 raw gate logs, and 28 finding detail/evidence pairs. All blocking findings are fixed; three inherited native cleanup limitations and the browser reliability finding remain explicitly open and nonblocking. All seven historical and new phase transitions passed the previous-tip checker's policy and trust checks, with 14 successful offline evaluations after explicit dependency-cache preparation. The first cache-incomplete attempt is retained as diagnostic evidence.The fresh
5bbd25559campaign exposed a Windows preview test assumption: after the prompt first appeared, it treated a later observation as unchanged. That run recorded revisions 3 and 4 without full state diagnostics. The correction uses a real split-output handshake, requiring actual retained-state changes to advance the revision and unchanged observations to preserve it. A subsequent policy rejection of an unsupportedprint!macro was corrected with an explicit byte write. Candidate0d87a2388passed all 132 fresh local ordinary/Verus gates, including 335 daemon tests, and its native Windows Foundation preview shard passed. Those results remain source-bound evidence; that candidate did not complete hosted qualification.The same
0d87a2388Gate A campaign found two additional Windows test defects: an outcome-file read returned NotFound during the updater test, and a terminal-spool startup assertion incorrectly required empty output even after ConPTY control bytes arrived between reads. The updater correction (39c47dee6) bounds live receipt polling, retries only NotFound while the helper remains active, reuses the matched snapshot, and keeps completed receipts and exact ownership/version assertions strict. The spool correction (9666d0902) retains immediate reads, checks bounded lengths and append-consistent prefixes, and preserves pipe emptiness plus cancellation/cleanup assertions. Both changes are test-only and independently source-reviewed. Strict Windows-target Clippy, 53 Linux launcher tests, focused pipe/PTY startup tests, all 72 process tests, and policy/layout/format checks passed on their final bytes. Native Windows execution is still required for the new head.Current candidate
9666d0902afe9f52e6b063d9ebfa9aea7b2aaf5chas a fresh clean checkout, an independently audited reconciliation with five formal-input transitions, and a new 132-command campaign underway alongside exact-head hosted checks. The launcher test is class C and is separately included in source review and hosted qualification. PCR-0012 approval and signed authorization/application records remain pending. No failed or superseded campaign is represented as qualification of this head.The Windows repair covers the requested L605–L607 items. L608 remains an inherited limitation outside this subset: owner loss can leave ACL changes that cannot yet be reconstructed and reversed after restart. Live-owner exclusion must not be presented as crash-safe ACL recovery.
The actual PR base remains
90925794845121dd9278d06c5eec92a5bbfd85e9. PCR-0009 and PCR-0010 records and evidence are preserved unchanged, and PCR-0011 is now recorded on this PR. These records have not been landed on the protected base. Passing source checks does not establish trusted protected-checker authority: the authorization/application sequence and separately controlled checker bootstrap remain required. No merge has been performed. All 157 formal obligations retain their existing in-progress status.Refs #103.