diff --git a/docs/goal-delivery.md b/docs/goal-delivery.md index 2f0b3c8e..1d83de9e 100644 --- a/docs/goal-delivery.md +++ b/docs/goal-delivery.md @@ -77,16 +77,21 @@ verifies the original unacknowledged Location-settlement regression actually executed on Linux/macOS/Windows. This accepts its simulated lease-owner case, not native confinement or the complete producer matrix. -Continue the first workstream on `test/cwd-wal-commit-ack`: the -[Store commit correction](../openspec/changes/complete-plugin-hook-runtime/store-commit-uncertainty.md) -fences generic errors after a transaction has ended, preserves known rollback, -and verifies no CwdChanged or later shell dispatch follows the uncertain outcome. -The real WAL-error fixture and main comparison pass locally after correction; -current-head hosted acceptance remains required. The new replay case uses a fresh -runtime over the same Store rather than a process restart. Keep native activation -and Linux dependency changes behind their existing review/acceptance gates. The -complete Setup marker/migration choices and DirectoryAdded proposal also need -their recorded review before implementation. +PR #90 merged at `5ed50bff` after all 16 checks passed. Its +[source-bound receipt](../openspec/changes/complete-plugin-hook-runtime/evidence/store-commit-bb91e32d.json) +verifies both commit-boundary cases and runtime lost-ack/replay behavior on +Linux/macOS/Windows, with suite totals and the unverified Windows leaked-process +warning retained. It accepts that correction, not the full producer matrix. +The replay case uses a fresh runtime over the same Store rather than a process +restart. + +Continue review on `spec/setup-legacy-admission-review`. The +[legacy Setup owner-resolution candidate](../openspec/changes/complete-plugin-hook-runtime/setup-legacy-bootstrap-review.md) +proposes the missing migration policy and its compatibility exception. The +complete S1 decision is pending; publishing or merging the proposal does not +approve it or implement markers/init. Preserve the separate Linux support and +DirectoryAdded design-review gates. No dependent behavior or native activation +is selected by this documentation follow-up. Native confinement foundations and regressions exist, but production enforcement and the remaining plugin/hook scope are incomplete. The diff --git a/openspec/changes/complete-plugin-hook-runtime/evidence/store-commit-bb91e32d.json b/openspec/changes/complete-plugin-hook-runtime/evidence/store-commit-bb91e32d.json new file mode 100644 index 00000000..362ae161 --- /dev/null +++ b/openspec/changes/complete-plugin-hook-runtime/evidence/store-commit-bb91e32d.json @@ -0,0 +1,74 @@ +{ + "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091", + "base": "bbc233d572b44468bd906308687de33f6e7c7954", + "prospective_merge": "89d99aeea8acefff6c1d809af1f3dcb92e093beb", + "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881", + "head_tree_equal": true, + "status": "Accepted Store correction: all 16 current-head checks passed; the full goal remains incomplete.", + "checks_passed": 16, + "platforms": { + "linux": { + "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091", + "checkout": "89d99aeea8acefff6c1d809af1f3dcb92e093beb", + "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881", + "platform": "linux", + "named_cases_passed": [ + "committed_wal_error_stops_later_mutations", + "rejected_commit_rolls_back_without_stopping_the_writer", + "cwd_changed_lost_commit_ack_is_silent_and_replay_does_not_dispatch", + "full_queue_times_out_with_busy" + ], + "summaries": [ + "2026-10-31T20:54:07.9029731Z Summary [1244.447s] 5508 tests run: 5508 passed (2 slow), 21 skipped" + ], + "warnings": [], + "log_sha256": "9d971f8f9ccc76e5b997d4460f0c778c48c532c1328313f1a4706630342cd200", + "job_url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41238584041/job/124647570206" + }, + "macos": { + "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091", + "checkout": "89d99aeea8acefff6c1d809af1f3dcb92e093beb", + "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881", + "platform": "macos", + "named_cases_passed": [ + "committed_wal_error_stops_later_mutations", + "rejected_commit_rolls_back_without_stopping_the_writer", + "cwd_changed_lost_commit_ack_is_silent_and_replay_does_not_dispatch", + "full_queue_times_out_with_busy" + ], + "summaries": [ + "2026-10-31T21:13:23.6390030Z Summary [1190.236s] 5508 tests run: 5508 passed (1 slow), 23 skipped" + ], + "warnings": [], + "log_sha256": "cf704f297ef38e45ba952bbc7b81986991997b2ef6b016a9b81ee43bcac06dbc", + "job_url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41238584041/job/124647570302" + }, + "windows": { + "head": "bb91e32d35a22fcd459b488c1f24eea6cac78091", + "checkout": "89d99aeea8acefff6c1d809af1f3dcb92e093beb", + "tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881", + "platform": "windows", + "named_cases_passed": [ + "committed_wal_error_stops_later_mutations", + "rejected_commit_rolls_back_without_stopping_the_writer", + "cwd_changed_lost_commit_ack_is_silent_and_replay_does_not_dispatch", + "full_queue_times_out_with_busy" + ], + "summaries": [ + "2026-10-31T21:09:04.5968084Z Summary [1002.821s] 3785 tests run: 3785 passed (1 leaky), 647 skipped", + "2026-10-31T21:09:06.8480681Z Summary [ 0.028s] 4 tests run: 4 passed, 387 skipped", + "2026-10-31T21:09:10.8798012Z Summary [ 0.094s] 9 tests run: 9 passed, 0 skipped", + "2026-10-31T21:09:45.7707334Z Summary [ 1.791s] 18 tests run: 18 passed, 0 skipped" + ], + "warnings": [ + "2026-10-31T20:57:50.4748467Z LEAK [ 22.337s] ( 520/3785) cyber-cli::messages_cli an_exec_session_refuses_messages_unless_it_accepts_them" + ], + "log_sha256": "8bbfe6f0736c573f1df589b97704d2f6e103b44fd435ff160dacdb7e37b4436b", + "job_url": "https://github.com/CyberdyneCorp/cybercode-cli/actions/runs/41238584041/job/124647570101" + } + }, + "accepted_merge": "5ed50bffe185877d0a95392a9dafeb03384ebbec", + "accepted_tree": "e6aedfa0600fc2ea74b11108d9d6ee3fc8812881", + "accepted_tree_matches": true, + "limits": "Store correction acceptance only. Runtime replay uses the same failed Store, not a restarted process. The Windows messaging leaked-process warning has unverified cause. Native plugin enforcement, other producers and task 5.3 remain incomplete." +} diff --git a/openspec/changes/complete-plugin-hook-runtime/setup-design.md b/openspec/changes/complete-plugin-hook-runtime/setup-design.md index 50e5365a..2f30406b 100644 --- a/openspec/changes/complete-plugin-hook-runtime/setup-design.md +++ b/openspec/changes/complete-plugin-hook-runtime/setup-design.md @@ -132,6 +132,11 @@ the two epoch/key choices alone does not settle this newly identified legacy bootstrap requirement. The full original Setup contract remains required until a revised compatibility decision is reviewed. +The [owner-resolution proposal](setup-legacy-bootstrap-review.md) supplies a +concrete candidate for that review, including a deliberate legacy compatibility +exception and its CLI/API, concurrency and retry consequences. It is not accepted +by recording the proposal; S1 and the original full contract remain open. + Required adversarial cases include root/attempt deletion before restart, a previously deleted root with another parent's child surviving at that Location, an empty settled attempt, @@ -173,7 +178,7 @@ remain authoritative; init grants no additional permissions. ## Implementation and acceptance tasks -- [ ] S1 Review both epoch/key decisions and the legacy-deletion bootstrap requirement above; record the accepted complete migration/support decision before implementation. +- [ ] S1 Review both epoch/key decisions and the legacy-deletion bootstrap requirement above, including the [owner-resolution candidate](setup-legacy-bootstrap-review.md); record the accepted complete migration/support decision before implementation. - [ ] S2 Add bounded events, marker projection/migration and writer-atomic root Session admission across separate durable owners; cover concurrent creation, children, legacy/deleted history and rebuild after Session deletion with actual diff --git a/openspec/changes/complete-plugin-hook-runtime/setup-legacy-bootstrap-review.md b/openspec/changes/complete-plugin-hook-runtime/setup-legacy-bootstrap-review.md new file mode 100644 index 00000000..5d8d2328 --- /dev/null +++ b/openspec/changes/complete-plugin-hook-runtime/setup-legacy-bootstrap-review.md @@ -0,0 +1,128 @@ +# Legacy Setup bootstrap: proposed owner resolution + +Status: **proposal requiring S1 review, not approved or implemented**. This +supplies a concrete compatibility choice for the deletion gap in +[setup-design.md](setup-design.md#session-deletion-and-legacy-history-review). +It does not authorize schema, marker or init implementation. The full original +Setup contract remains required until a complete revised decision is accepted. + +## Proposed decision + +Retain the proposed Store-lifetime installation epoch and exact stored directory +key. Do not infer that Setup never ran from missing Session rows or receipts. +For an unproven legacy Location, require a fresh owner decision before dispatching +another potentially mutating automatic attempt. Permit an explicit new attempt +or an explicit decision to consume automatic eligibility without dispatch. + +This is a compatibility revision for ambiguous legacy history. It is not the +claim that universal refusal satisfies automatic Setup. New Stores retain normal +automatic first-root behavior, and all other Setup requirements remain required. +The changed behavior for legacy root creation needs explicit review together +with the epoch/key choices; accepting those two choices alone is insufficient. + +## Classification owned by the Store + +| Authoritative state | Proposed result | +| --- | --- | +| Store proven newly initialized with its epoch, with no legacy history to migrate | Normal atomic first-root Session/automatic-attempt admission. | +| Existing marker or admitted attempt | Retain its identity and actual status; normal creation cannot dispatch it again. | +| Retained root-creation evidence at the exact stored directory | Consume legacy automatic eligibility without another effect; record the evidence, not fabricated successful handlers. | +| Valid retained, non-synthetic Setup receipt facts at that key | Retain positive use and known per-handler outcomes; consume automatic eligibility without replay. An individual receipt does not prove a whole attempt completed. | +| Existing legacy Store with no complete applicable proof, including deleted roots, child-only surviving history or an exhausted bounded search | Classify history as unproven. Missing facts cannot make the Location fresh. Apply the owner-resolution flow below. | + +Freshness needs Store initialization provenance captured under its ownership +lock before a legacy migration can erase that distinction. An empty Session/event +table, absence of receipt projections, filesystem timestamps, reinstall, process +restart or an alias spelling is not a freshness witness. Restoring/copying an +existing Store retains its epoch and provenance. Normal Session deletion cannot +create a new installation. The exact initialization/migration implementation is +an S2 prerequisite and must preserve the existing atomic schema initialization. + +Read positive legacy evidence in bounded pages and with a finite search budget. +Budget exhaustion can yield only unproven history, never a proof of absence. +Do not inspect deleted prompt contents or use provider usage as a history oracle. +Bind retained evidence to its actual schema, source ID and directory key; do not +silently canonicalize aliases or import synthetic test receipts as authority. + +## Proposed owner flow + +Ordinary root creation for an unproven legacy Location returns a structured +`SetupHistoryUnprovenError` before creating the Session, admitting input, running +a model Turn or dispatching Setup. It reports the epoch, validated directory key +and a bounded resolution revision. It must not silently create the root while +pretending automatic Setup completed or while hiding that Setup was suppressed. +Child creation still cannot consume automatic eligibility or claim root authority. + +The owner has three explicit choices: + +1. **Run a new Setup attempt.** Use the proposed `cyber --init` owner operation, + with a new request ID. This authorizes a new attempt, not replay or settlement + of an old unknown invocation. Preserve all earlier uncertainty. Display that + prior execution cannot be ruled out; do not claim the Location was never used. +2. **Continue without Setup.** Proposed CLI spelling: + `cyber --init --skip-legacy-setup --cwd `. This resolves only an + unproven legacy claim, creates the requested root and consumes automatic + eligibility with an explicit skipped outcome. It dispatches no Setup handler + and emits no successful Setup observation. It is not a general bypass for + fresh-Store automatic Setup. A later deliberate init needs a new request ID. +3. **Cancel.** Create no Session, attempt or consumed marker. A later request + still needs resolution if history remains unproven. + +Extend the already proposed `POST /api/v1/setup` request with an optional +`legacy_resolution` object containing the observed resolution revision and action +`new_attempt` or `skip_automatic`. Its creation-input validation and 128-byte +request-ID bound remain unchanged. The CLI performs the owner preflight needed +to obtain the revision; a stale resolution is refused without effects. Explicit +init for an otherwise ordinary Location retains its existing new-attempt meaning. + +An interactive client may present these choices after the structured refusal. +An unattended ordinary creation cannot choose on the user's behalf. Explicit +init/skip requests still obey existing non-interactive, trust, Mode, pure/managed +policy and permission rules; they do not manufacture permission approvals. +Use ordinary owner API authority. Prompt text, hook rewrites, plugin callbacks and +`session/prompt` cannot supply a migration decision or assert that history is fresh. + +## Atomicity, ownership and retries + +Resolve the installation/directory claim, create the root, admit the new attempt +or explicit skip, and bind request deduplication in the bounded multi-aggregate +writer transaction required by S2. Recheck the epoch, exact key, resolution +revision, existing marker and current owned context in that transaction. +Competing legacy resolutions cannot both claim the same unresolved revision. +A stale loser must not silently turn into another fresh attempt or retry with +a new request ID. Normal concurrent creators resume the ordinary creation rules +only after the legacy claim has been resolved. + +Dispatch after acknowledged commit and outside ownership locks. Existing live +attempts, native owners and uncertain cleanup still need their normal settlement +or reconciliation; a migration choice cannot bypass them. A fresh explicit +intent never rewrites an older unknown outcome to completed. A lost commit +acknowledgement follows the Store uncertainty fence and cannot trigger retry. + +Keep marker, resolution, attempt and request records independent of Session +deletion. An exact retry returns the original result and deletion status; it +cannot recreate a deleted Session or dispatch again. Changed-input reuse is +refused. Reprojection uses self-contained owner facts and preserves consumed, +skipped and unknown states without requiring a surviving Session projection. +The request digest includes the epoch, exact key, resolution action/revision and +validated root-creation inputs. Check exact deduplication before rejecting a +consumed revision, so an operation's own successful resolution cannot make its +transport retry look stale. A different action or revision under the same request +ID is changed-input reuse, not another chance to dispatch. + +## Review and implementation consequences + +S1 must accept or replace this compatibility policy, the Store-lifetime epoch +and the exact directory key together. No S1 checkbox is closed by this proposal. +If accepted, revise the unconditional concurrent-root-creation description and +the Setup delta scenarios to make the unproven-legacy exception explicit before +S2 code. No policy is selected merely by recording or mechanically merging this +review document. If declined, retain the original full requirement and return a +different complete migration decision rather than silently choosing a fallback. + +Required acceptance cases include all classification rows; deleted roots with +another parent's surviving child; partial and synthetic receipts; budget +exhaustion; concurrent init/skip/root creation; stale revisions and changed inputs; +policy refusal; empty versus unresolved catalogs; lost commit/handler outcomes; +process restart and projection rebuild; deletion before an exact retry; and no +model Turn, extra permission, duplicate effect or false successful observation. diff --git a/openspec/changes/complete-plugin-hook-runtime/store-commit-uncertainty.md b/openspec/changes/complete-plugin-hook-runtime/store-commit-uncertainty.md index 18131ad8..658cc34b 100644 --- a/openspec/changes/complete-plugin-hook-runtime/store-commit-uncertainty.md +++ b/openspec/changes/complete-plugin-hook-runtime/store-commit-uncertainty.md @@ -1,6 +1,7 @@ # Unacknowledged Store commits and CwdChanged -This fixes an observed durability-boundary gap while implementing task 5.3. It +This fixes an observed durability-boundary gap while implementing task 5.3. +PR #90 is accepted at `5ed50bff` after all 16 current-head checks passed. This does not close the full producer matrix or the plugin/native workstream. ## Failure and main comparison @@ -68,6 +69,31 @@ and all 13 Location activity tests pass after the fix. Scoped Clippy for all Sto targets and the actual Location test target passes with warnings denied. Formatting, strict OpenSpec (114/0) and spec lint (0 errors/25 warnings) pass. Those results do not claim the new uncertain-commit case was tested through a process restart, on Windows -or Linux, or across the full local workspace. Local code/security review found no blocking issue. Hosted acceptance and final -PR review remain required before merging this follow-up. Native support/design +or Linux, or across the full local workspace. Local code/security review found no blocking issue. The platform acceptance and +final merge review recorded below complete this Store correction only. Native support/design review gates, DirectoryAdded/Setup and task 5.3 remain open. + + +## Accepted platform execution + +The [source-bound receipt](evidence/store-commit-bb91e32d.json) records actual +Linux/macOS/Windows execution at head +`bb91e32d35a22fcd459b488c1f24eea6cac78091`. All three checkout logs identify merge +`89d99aeea8acefff6c1d809af1f3dcb92e093beb`, tree +`e6aedfa0600fc2ea74b11108d9d6ee3fc8812881`, equal to the reviewed head and +accepted main merge `5ed50bffe185877d0a95392a9dafeb03384ebbec`. + +Both new Store regressions, the bounded writer-queue case and the runtime +lost-ack/replay case execute and pass on every platform. Linux/macOS each pass +5,508 workspace tests (21/23 skipped, 2/1 slow). Windows passes 3,785 selected +tests (647 skipped), plus four metadata, nine migration and 18 AppContainer +checks. Its corrected profile executes the writer unit tests instead of +silently omitting them. The receipt retains actual suite totals and log hashes. + +Windows reports one leaked-process warning in +`messages_cli::an_exec_session_refuses_messages_unless_it_accepts_them`; its cause +is unverified. No flaky or timeout result is reported in the three inspected +jobs. This record does not turn source listing or cross-compilation into native +execution evidence. It preserves the runtime replay/process-restart distinction +above and leaves the complete task 5.3, native admission and other goal features +open. diff --git a/openspec/changes/complete-plugin-hook-runtime/tasks.md b/openspec/changes/complete-plugin-hook-runtime/tasks.md index 54226995..81b23d56 100644 --- a/openspec/changes/complete-plugin-hook-runtime/tasks.md +++ b/openspec/changes/complete-plugin-hook-runtime/tasks.md @@ -112,6 +112,10 @@ Setup ownership is expanded in [setup-design.md](setup-design.md). Its Store epoch and exact-directory marker choices are proposed for review; marker/schema and init behavior are not implemented by this specification. Tasks S1–S6 there expand task 5.1 without closing it or the other producer obligations. +The [legacy owner-resolution candidate](setup-legacy-bootstrap-review.md) makes +the remaining compatibility policy concrete, including the changed behavior for +unproven legacy root creation. It is proposed only; the complete S1 decision and +the original full contract remain open until review. ## 6. Acceptance and delivery @@ -162,5 +166,8 @@ SQLite WAL callback can report an error after the exit has persisted. The failing regression on main, distinguish unknown completed COMMIT from a known rollback, and verify that CwdChanged stays silent while reducer replay recovers its committed identity. All 49 Store and 13 Location activity tests pass locally -on macOS. Hosted platform acceptance and final review remain required; task 5.3 -and the other native/producer/workstream obligations stay open. +on macOS. Merged PR #90 passes all 16 checks; the +[receipt](evidence/store-commit-bb91e32d.json) verifies the named cases actually +execute on Linux/macOS/Windows at the accepted tree. The Windows leaked-process +warning has unverified cause. This accepts the Store correction; task 5.3 and the +other native/producer/workstream obligations stay open.