tegwick
b63131e863
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf
126 lines
5.1 KiB
Markdown
126 lines
5.1 KiB
Markdown
---
|
|
id: ACTIVITY-WP-0037
|
|
type: workplan
|
|
title: "Carry repository grants and reconcile terminal queue closes"
|
|
domain: infotech
|
|
repo: activity-core
|
|
status: active
|
|
owner: codex
|
|
topic_slug: activity-core
|
|
priority: high
|
|
created: "2026-09-04"
|
|
updated: "2026-09-04"
|
|
related:
|
|
- ACT-ADR-005
|
|
- ACT-ADR-006
|
|
- ACTIVITY-WP-0032
|
|
- ACTIVITY-WP-0036
|
|
- REINAH-WP-0003
|
|
---
|
|
|
|
# Carry Repository Grants and Reconcile Terminal Queue Closes
|
|
|
|
## Origin
|
|
|
|
Rein-aharness enabled its versioned local repository-grant validator and durable
|
|
close outbox on 2026-09-04, then reported two Activity Core contract gaps:
|
|
|
|
1. queued/profiled work has no separately typed authoritative repository grant;
|
|
2. a response-lost terminal close retry receives the same undifferentiated 409
|
|
as a wrong-owner, expired-lease, or conflicting-result mutation, while the
|
|
result allowlist drops repository transaction and acceptance identity.
|
|
|
|
These are Activity Core responsibilities at the definition/emission and durable
|
|
queue boundaries. The grant must not be inferred from task prose, labels,
|
|
`execution_refs`, a profile, or repository defaults.
|
|
|
|
## Review and specify the cross-repository contract
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Review rein-aharness repository-grant v1, its close-outbox identity, and exact
|
|
ADR-002 revision `36e1096`. Define compatibility, rejection, evidence, and
|
|
repeat-close semantics before changing the queue.
|
|
|
|
Decision: preserve the four-field v1 grant unchanged in a dedicated JSON
|
|
column after strict structural and path-safety validation. A first accepted
|
|
terminal close returns `applied`; an identical repeat by the same claim owner
|
|
returns `reconciled`. Missing rows, wrong owners, expired leases, non-terminal
|
|
states, and different terminal intents receive distinct refusal codes. Legacy
|
|
grant-absent rows remain valid during migration.
|
|
|
|
## Carry the authoritative repository grant
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Add a typed repository-grant v1 model to rule actions and instructions, reject
|
|
unsupported or unsafe grants during definition parsing and emission preflight,
|
|
and carry the exact field through `ops_runs` and claim/read projections. Add an
|
|
additive migration; do not place the grant in attribution-only
|
|
`execution_refs` or synthesize it from another field.
|
|
|
|
Completed 2026-09-04. `RepositoryGrant` and `CommitCount` enforce the exact v1
|
|
shape, strict scalar types, local-only publication, bounded commit counts, and
|
|
safe repository-relative patterns. Definition sync and complete-batch emission
|
|
preflight both reject invalid grants. Rule actions copy static grant data
|
|
without rendering it; instructions carry the typed payload. Migration `0010`
|
|
adds nullable `ops_runs.repository_grant`, and claim/read/run projections keep
|
|
it separate from `execution_refs`. Cross-implementation identity tests match
|
|
rein-aharness grant id `af2e7c8275c9ba8c8f78485067f9608e` and acceptance
|
|
policy id `2ed31282d721f4466bc9ea722067d9d0` for the shared fixture.
|
|
|
|
## Preserve evidence and reconcile terminal closes
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T03
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Allowlist bounded repository transaction, grant, acceptance, and external
|
|
metrics identities in queue results. Persist a digest of the accepted terminal
|
|
close intent. Under the row lock, accept an identical repeat by the original
|
|
claim owner as reconciled without requiring a now-cleared lease, while refusing
|
|
different outcomes/actions/flags, wrong owners, expired active claims, and
|
|
unknown rows with distinct API codes. Reopened failures are not terminal and
|
|
must not be mistaken for reconciled delivery.
|
|
|
|
Completed 2026-09-04. The result allowlist now retains bounded
|
|
`repository_transaction` baseline, grant, acceptance, and external-metrics
|
|
evidence while dropping raw grant patterns and unknown blobs. Migration `0010`
|
|
adds `close_intent_digest`. The row-locked close decision returns `applied` for
|
|
the first accepted mutation and `reconciled` for an exact normalized terminal
|
|
repeat by the same owner. It reports distinct `not_found`, `wrong_owner`,
|
|
`expired_lease`, `state_conflict`, `evidence_conflict`, and
|
|
`terminal_conflict` refusals. Granted completion additionally proves that the
|
|
reported grant and acceptance-policy identities match the queued authority and
|
|
that acceptance is positive. Reopened failures clear close identity and remain
|
|
non-terminal.
|
|
|
|
## Verify and hand off
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T04
|
|
status: progress
|
|
priority: high
|
|
```
|
|
|
|
Run focused and full tests, migration/static checks, update the queue contract,
|
|
sync State Hub, and return the exact revision/schema/repeat semantics to
|
|
rein-aharness. Production rollout and live outbox activation remain separate
|
|
until both repositories consume and deploy the reviewed contract.
|
|
|
|
Source verification 2026-09-04: 493 tests passed with one live integration test
|
|
skipped; critical Python lint, compilation, and whitespace checks passed.
|
|
Alembic reports one head (`0010`). A throwaway PostgreSQL 16 database passed
|
|
full upgrade, `0010` downgrade to `0009`, column-removal inspection, re-upgrade,
|
|
and type/nullability inspection; it was then removed. Remaining work is the
|
|
exact-revision State Hub handoff and consistency sync.
|