Skip to content

Repair file, output, and native execution limits - #113

Merged
dollspace-gay merged 40 commits into
developfrom
fix/minimum-repair
Oct 10, 2026
Merged

dollspace-gay merged 40 commits into
developfrom
fix/minimum-repair

Conversation

@dollspace-gay

@dollspace-gay dollspace-gay commented Oct 8, 2026 •

Copy link
Copy Markdown
Member

This PR contains the existing minimum-repair history and the remaining 23 implementation items, targeting develop. Large inputs, files, terminal output, and evidence retain exact identities and complete recoverable content; interfaces page or scroll that content without independent action quotas.

The final work adds atomic referenced-message and attachment admission, exact continuation and retry binding, incremental queue reordering, retained brief pages, and artifact-backed initialization with authenticated instruction scope. TUI editing preserves whitespace and large drafts, and terminal views can navigate beyond the previous row limits.

Browser consoles and Git operations retain native process ownership and durable outcomes across disconnects and gateway restarts. File previews read version-bound UTF-8 ranges, directory pagination binds canonical project roots, and nested repositories retain their exact registered Git identities. Evidence publication and verification preserve complete streamed bytes and reject conflicting or changed content.

Windows preparation validates native path identities before granting authority, retains original objects through live-owner ACL restoration, and gives ConPTY sessions owned cancellation and descendant cleanup. Native qualification repairs cover terminal Enter semantics, updater Job ownership, PowerShell replacement, symbolic ACL serialization, and retryable ACL cleanup. Live ACL transactions reserve their affected volumes before capturing permissions; a competing transaction receives a typed busy result, and failed final-owner cleanup quarantines the volume for the lifetime of that process. macOS updater cleanup retains the unreaped root identity and accepts Darwin's zombie-only group signal result only after a native singleton-group snapshot proves that no other member remains.

Reviewed source: 6889f8c5dcca335b71c572865d5483c8e68c0890. Current PR head: 9666d0902afe9f52e6b063d9ebfa9aea7b2aaf5c. All 132 ordinary/Verus package commands passed on the frozen reviewed source, with every raw log, command, hash, timestamp, and candidate binding independently audited. Its hosted qualification completed with 580 successful PR checks and four explicit skips: Gate A passed all 215 jobs, Foundation passed all 194, and Native product passed all 162. Windows native qualification passed all 16 cases plus conformance; all 36 Windows x64/ARM product scenarios passed raw-observation and cleanup audits. Discovery passed all 12 real-container lifecycle scenarios and four replay targets.

The initial browser attempt had one unexplained session-selection timeout after 19 passing cases. The unchanged rerun passed all 25 browser cases, and traced local repeats passed another 90 cases. That initial failure remains documented as an open, nonblocking reliability finding.

PCR-0011 is included through separate signed authorization (6674998803736ae1820f599206e65a91a1723e9b) and implementation (5bbd2555921d1feee5c6e5747d421b34f089d341) commits. The final application source is byte-identical to the reviewed source; the added records contain the independent verdict, all 132 raw gate logs, and 28 finding detail/evidence pairs. All blocking findings are fixed; three inherited native cleanup limitations and the browser reliability finding remain explicitly open and nonblocking. All seven historical and new phase transitions passed the previous-tip checker's policy and trust checks, with 14 successful offline evaluations after explicit dependency-cache preparation. The first cache-incomplete attempt is retained as diagnostic evidence.

The fresh 5bbd25559 campaign exposed a Windows preview test assumption: after the prompt first appeared, it treated a later observation as unchanged. That run recorded revisions 3 and 4 without full state diagnostics. The correction uses a real split-output handshake, requiring actual retained-state changes to advance the revision and unchanged observations to preserve it. A subsequent policy rejection of an unsupported print! macro was corrected with an explicit byte write. Candidate 0d87a2388 passed all 132 fresh local ordinary/Verus gates, including 335 daemon tests, and its native Windows Foundation preview shard passed. Those results remain source-bound evidence; that candidate did not complete hosted qualification.

The same 0d87a2388 Gate A campaign found two additional Windows test defects: an outcome-file read returned NotFound during the updater test, and a terminal-spool startup assertion incorrectly required empty output even after ConPTY control bytes arrived between reads. The updater correction (39c47dee6) bounds live receipt polling, retries only NotFound while the helper remains active, reuses the matched snapshot, and keeps completed receipts and exact ownership/version assertions strict. The spool correction (9666d0902) retains immediate reads, checks bounded lengths and append-consistent prefixes, and preserves pipe emptiness plus cancellation/cleanup assertions. Both changes are test-only and independently source-reviewed. Strict Windows-target Clippy, 53 Linux launcher tests, focused pipe/PTY startup tests, all 72 process tests, and policy/layout/format checks passed on their final bytes. Native Windows execution is still required for the new head.

Current candidate 9666d0902afe9f52e6b063d9ebfa9aea7b2aaf5c has a fresh clean checkout, an independently audited reconciliation with five formal-input transitions, and a new 132-command campaign underway alongside exact-head hosted checks. The launcher test is class C and is separately included in source review and hosted qualification. PCR-0012 approval and signed authorization/application records remain pending. No failed or superseded campaign is represented as qualification of this head.

The Windows repair covers the requested L605–L607 items. L608 remains an inherited limitation outside this subset: owner loss can leave ACL changes that cannot yet be reconstructed and reversed after restart. Live-owner exclusion must not be presented as crash-safe ACL recovery.

The actual PR base remains 90925794845121dd9278d06c5eec92a5bbfd85e9. PCR-0009 and PCR-0010 records and evidence are preserved unchanged, and PCR-0011 is now recorded on this PR. These records have not been landed on the protected base. Passing source checks does not establish trusted protected-checker authority: the authorization/application sequence and separately controlled checker bootstrap remain required. No merge has been performed. All 157 formal obligations retain their existing in-progress status.

Refs #103.

Implement the selected minimum repairs for patch/checkpoint capacity,
inspection continuation, contract-driven artifact validation, and paged
checkpoint coverage with full confirmation binding and durable recovery.
Migrate journal state-history storage through the existing schema owner.
Retain path authority, preimage checks, atomicity, and the 500-line lint.

Selected repairs: L003 L006 L010 L012 L013 L016 L020 L035 L036 L041
L045 L076 L078 L124 L168 L172 L173 L174 L175 L712.
L036 already had the required retry lookup and needed no extra code.

Validated the 12 affected/consuming package test selection, corrected
runner assertions and finalization synchronization, and reran affected
daemon fixtures against a stable executable. Runner unit suite: 471 pass.
All-target Clippy with warnings denied, formatting, architecture-check,
and ordinary-api-check pass.

Crosslink continuation: 826. Issue results and automatic changelog
updates are being recorded separately from this source commit.
@dollspace-gay dollspace-gay self-assigned this Oct 8, 2026
Complete the second 20-item minimum-repair batch: streamed filesystem
paging, artifact and context retention, discard recovery, exact native
command receipts, unbounded Git status, and durable cancellable patch
handoff. Preserve native owner identity and terminal evidence before
allowing recovery or acknowledgement.

Fix repeated literal-match columns and search subpage/fragment cursors
found during review. Align source policy and fixtures to one 500-line
limit.

Crosslink: #103
@dollspace-gay dollspace-gay changed the title fix: remove selected daily-driving capacity blockers fix: remove 40 selected capacity and recovery blockers Oct 8, 2026
Preserve exact attachment, process, request, reviewer, and Git evidence through
bounded continuation and durable recovery. Bind previews to active conversation
models and review navigation to exact source pages.

Synchronize cancellation tests at actual reviewer start, repair documentation
structure, and enroll the independent reviewer for candidate-bound proof-impact
reconciliation. This commit is source review material, not a new PCR approval.

Validation: 3,912 workspace tests passed; final daemon suite 271 passed; strict
workspace Clippy, Rustdoc, Windows cross-compilation, format and structural checks
passed. Native CI and exact proof-impact authorization follow this frozen source.

Refs: Crosslink #103
@dollspace-gay dollspace-gay changed the title fix: remove 40 selected capacity and recovery blockers Remove 70 minimum-repair blockers and preserve exact evidence Oct 8, 2026
Keep directory diagnostics unique and bounded, bind Git observations to immutable object data, and preserve long history subjects. Account only successfully written spool bytes and select live preview streams from the actual I/O mode. Correct canonical environment projection and Windows/macOS codec and test assumptions.
Persist exact preview output matches and their goal revision so accepted checks replay after restart without rescanning or retargeting changed goals. Carry zero-deadline execution authority through process admission.

Negotiate bounded review summaries, preserve contiguous byte-bound diff pages and exact raw-byte rendering, and align native filesystem diagnostic fixtures with platform behavior.
Read retained preview evidence at its recorded byte offset. Exercise both Unix filesystem fixture variants and account for binary-file omissions in continuation checks.
Use a host-safe Unix path and verify continuation of that exact entry. Exercise the base fixture separately from Linux-native invalid filename coverage while preserving complete path and patch reconstruction.
Accumulate terminal bytes across bounded polls and split output chunks before checking the preview prompt. Use monotonic deadlines for prompt and exit waits, retain bounded diagnostics, and cover empty pages with a split-marker regression.
Register the independent ACTOR-0010 review of candidate
2353e5d and its 1,025 source
transitions, 132 passing package gates, and resolved finding ledger.

Keep protected source and inventory bytes at baseline 9092579,
retain the permitted checker/design changes, and preserve all prior
review artifacts. Source application follows in a separate commit.
All 157 formal obligations remain in progress.

Crosslink issue 103.
Apply the exact source tree reviewed as candidate
2353e5d after its separate
authorization commit. Update the complete source inventory while
preserving every detached reviewer artifact unchanged.

The reviewed candidate passed all 132 ordinary/Verus package gates,
all 194 Foundation jobs, native H0 on all three platforms, and the
native graphical restart/goal-revision regression pair.

Crosslink issue 103.
@dollspace-gay
dollspace-gay changed the base branch from develop to authorization/pcr-0009 October 9, 2026 05:46
@dollspace-gay dollspace-gay reopened this Oct 9, 2026
Acquire the SQLite writer transaction before installing the ordinal schema,
so first-open setup and durable allocation commit together. Preserve the
five-second contention budget and EXTRA synchronization, add operation-specific
errors, and regress failed initial reservations publishing schema separately.

Enroll the actual independent ACTOR-0011 reviewer for supplemental PCR-0010.
PCR-0009 and all historical proof artifacts remain unchanged. This candidate
is not formal approval: native Windows and fresh proof qualification follow.

Validation: old implementation fails the new regression; repaired ordinal
suite passes 8 tests. Full product-runner tests pass 527 with 6 ignored.
Strict Linux and Windows GNU all-target Clippy, formatting, source layout,
and whitespace checks pass. Native Windows behavior remains unverified.

Crosslink: #103
Replace the shared 400-poll observation window with a two-minute monotonic
watchdog for real Cargo gate completion. Preserve the latest snapshot in
timeout diagnostics and retain explicit five-second cancellation checks.

The fresh Windows review shard failed before the oversized-diff assertions;
its generic timeout did not retain the blocking phase. A stalled-provider
regression now checks the short-bound error snapshot and prompt cancellation.

Verified: focused timeout regression, all three review tests, strict Linux
and Windows GNU Clippy, formatting, source layout, and whitespace. Full
candidate-bound formal and native qualification will be rerun for PCR-0010.
Retain ACTOR-0011's independent approval of candidate e5c4ec4 and
all 132 exact-candidate ordinary and Verus gate logs. Restore the I9
application and actor inputs for the separate authorization-only phase.

Preserve PCR-0001 through PCR-0009 and all 752 historical review artifacts.
This registers review evidence without applying the reviewed source changes
or discharging any in-progress obligation.
Apply the exact independently reviewed candidate source and actor inputs:
reserve command ordinals and initialize their schema in one transaction,
and use an elapsed-time integration watchdog with snapshot diagnostics.

Advance the proof inventory to the reviewed source hashes while preserving
the already registered PCR-0010 verdict and all historical review evidence.
@dollspace-gay
dollspace-gay changed the base branch from authorization/pcr-0009 to authorization/pcr-0010 October 9, 2026 13:19
Retain the exact signed PCR-0010 implementation tree and complete reviewed
history while restoring the original repair branch as the delivery branch.
The authorization base is now 2d8ad67.
This source-unchanged publication commit triggers fresh checks against that
settled base; superseded PRs #114 and #115 are retired without merging.
@dollspace-gay
dollspace-gay changed the base branch from authorization/pcr-0010 to develop October 9, 2026 15:29
Repair retained execution ownership, scalable workbench inputs and artifacts, evidence and Git custody, Windows sandbox/console behavior, and updater lifecycle. Include a fresh independent reviewer identity for the candidate-bound formal verification campaign; formal approval and hosted qualification remain separate pending work.
Extract artifact storage, preview tests, nested Git inventory, evidence decoding and queries, and Windows sandbox helpers into coherent private modules. Preserve public paths and behavior; independently reviewed module moves. Local architecture, API, source layout, documentation, reproducibility, toolchain, formatting, focused tests, and strict Clippy pass. Fresh candidate formal and hosted verification follows.
Restore ConPTY console handles under redirected runners, explicitly terminate updater jobs, preserve atomic PowerShell receipts, and flush existing evidence with Windows write access. Copy retained output in contiguous slices to avoid excessive PTY capture overhead. Refs #103.
Reject aliased protected roots before ACL projection, keep directory inventories scoped to canonical project roots, and submit terminal Enter correctly from preview controls. Strengthen native deny/rollback and terminal regressions without changing raw input semantics. Refs #103.
Retain exact object descriptors and handles, exclude competing native ACL transactions by volume, and preserve cleanup ownership for retry. Restore original DACLs after inheritance cleanup and detect residual temporary authority on new descendants.

Align the daemon review-start fixture with its existing observation watchdog while preserving the five-second cancellation deadline. Refs #103.
@dollspace-gay dollspace-gay changed the title Remove 70 minimum-repair blockers and preserve exact evidence Repair file, output, and native execution limits Oct 9, 2026
Prepare the Windows replay descriptor with the required auto-inheritance request while retaining the immutable saved descriptor. Verify all original objects again after every replay write, preserve concrete cleanup failures, and cover reverse nested restoration and inherited control on native Windows.
Use independent fixture principals for cross-process ACL exclusion and report read-only creator and ACE inventories when protected-child cleanup fails. This diagnostic commit does not alter production inheritance comparison.
Inspect raw ACE inventories independently of the explicit-entry decoder and compare complete parent and owner/group creator variants. Use recognized non-host principals and distinct backup roots for each child invocation. Production ACL logic is unchanged pending native diagnosis.
@dollspace-gay
dollspace-gay marked this pull request as ready for review October 9, 2026 23:20
Register ACTOR-0012's independent exact-candidate review, the complete
132-gate ordinary and Verus campaign, and the resolved finding ledger.

Retain the PCR-0010 source inventory and protected actor registry while
binding the reviewed actor from the exact detached candidate and establishing
the checker input. Preserve PCR-0001 through PCR-0010 and every historical
review artifact. Source application follows in a separate commit.

Crosslink issue 103.
Apply the exact source tree reviewed at 6889f8c
after its separate authorization commit. Advance the complete proof inventory
while preserving the PCR-0011 verdict and every detached review artifact.

The reviewed candidate passed all 132 ordinary and Verus package gates and
the required exact-candidate hosted and native qualification.

Crosslink issue 103.
Exercise a deliberately split prompt through the owned subprocess and require revision changes only when the complete retained observation changes. Verify settled public snapshots and restore the candidate digest after fixture synchronization.

Enroll the fresh independent PCR-0012 reviewer without changing prior principals or proof history. Refs #103.
Use the supported Write API to emit the exact partial prompt while preserving the real subprocess handshake and revision assertions. Both workflow API-policy commands, focused repetitions, workbench tests, and strict Linux and Windows-target lint checks pass. Refs #103.
Retry only a missing live receipt while the updater helper remains active,
within the existing bounded observation window. Keep malformed receipt and
other I/O failures strict, reuse the matched waiting snapshot, and retain
all final outcome, version, and installation ownership assertions.

Add phase and path context to completed receipt failures. Windows GNU
strict Clippy, 53 Linux launcher tests, policy/layout and format checks
passed; fresh native Windows qualification remains required.

Crosslink issue 103.
Keep immediate control, full-spool and exact-owner reads while allowing
ConPTY setup bytes to arrive between observations. Require bounded range
lengths, nondecreasing totals and unchanged retained prefixes. Pipe output
remains exactly empty, and cancellation plus cleanup checks stay strict.

Use the existing native PTY test output budget for this readability test
to avoid an unrelated output-limit termination during terminal setup.

Focused pipe/PTY regressions, all 72 process tests, Windows GNU strict
Clippy, policy/layout and formatting passed. Native ConPTY qualification
remains required on the new commit.

Crosslink issue 103.
@dollspace-gay
dollspace-gay merged commit b3437fa into develop Oct 10, 2026
586 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant