tegwick
52f2ac9a5c
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06bfe-2a55-7ed3-bacd-879977b099bf
145 lines
6.2 KiB
Markdown
145 lines
6.2 KiB
Markdown
---
|
|
id: ACTIVITY-WP-0037
|
|
type: workplan
|
|
title: "Carry repository grants and reconcile terminal queue closes"
|
|
domain: infotech
|
|
repo: activity-core
|
|
status: active
|
|
owner: codex
|
|
topic_slug: activity-core
|
|
priority: high
|
|
created: "2026-09-04"
|
|
updated: "2026-09-04"
|
|
related:
|
|
- ACT-ADR-005
|
|
- ACT-ADR-006
|
|
- ACTIVITY-WP-0032
|
|
- ACTIVITY-WP-0036
|
|
- REINAH-WP-0003
|
|
---
|
|
|
|
# Carry Repository Grants and Reconcile Terminal Queue Closes
|
|
|
|
## Origin
|
|
|
|
Rein-aharness enabled its versioned local repository-grant validator and durable
|
|
close outbox on 2026-09-04, then reported two Activity Core contract gaps:
|
|
|
|
1. queued/profiled work has no separately typed authoritative repository grant;
|
|
2. a response-lost terminal close retry receives the same undifferentiated 409
|
|
as a wrong-owner, expired-lease, or conflicting-result mutation, while the
|
|
result allowlist drops repository transaction and acceptance identity.
|
|
|
|
These are Activity Core responsibilities at the definition/emission and durable
|
|
queue boundaries. The grant must not be inferred from task prose, labels,
|
|
`execution_refs`, a profile, or repository defaults.
|
|
|
|
## Review and specify the cross-repository contract
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Review rein-aharness repository-grant v1, its close-outbox identity, and exact
|
|
ADR-002 revision `36e1096`. Define compatibility, rejection, evidence, and
|
|
repeat-close semantics before changing the queue.
|
|
|
|
Decision: preserve the four-field v1 grant unchanged in a dedicated JSON
|
|
column after strict structural and path-safety validation. A first accepted
|
|
terminal close returns `applied`; an identical repeat by the same claim owner
|
|
returns `reconciled`. Missing rows, wrong owners, expired leases, non-terminal
|
|
states, and different terminal intents receive distinct refusal codes. Legacy
|
|
grant-absent rows remain valid during migration.
|
|
|
|
## Carry the authoritative repository grant
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Add a typed repository-grant v1 model to rule actions and instructions, reject
|
|
unsupported or unsafe grants during definition parsing and emission preflight,
|
|
and carry the exact field through `ops_runs` and claim/read projections. Add an
|
|
additive migration; do not place the grant in attribution-only
|
|
`execution_refs` or synthesize it from another field.
|
|
|
|
Completed 2026-09-04. `RepositoryGrant` and `CommitCount` enforce the exact v1
|
|
shape, strict scalar types, local-only publication, bounded commit counts, and
|
|
safe repository-relative patterns. Definition sync and complete-batch emission
|
|
preflight both reject invalid grants. Rule actions copy static grant data
|
|
without rendering it; instructions carry the typed payload. Migration `0010`
|
|
adds nullable `ops_runs.repository_grant`, and claim/read/run projections keep
|
|
it separate from `execution_refs`. Cross-implementation identity tests match
|
|
rein-aharness grant id `af2e7c8275c9ba8c8f78485067f9608e` and acceptance
|
|
policy id `2ed31282d721f4466bc9ea722067d9d0` for the shared fixture.
|
|
|
|
## Preserve evidence and reconcile terminal closes
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T03
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Allowlist bounded repository transaction, grant, acceptance, and external
|
|
metrics identities in queue results. Persist a digest of the accepted terminal
|
|
close intent. Under the row lock, accept an identical repeat by the original
|
|
claim owner as reconciled without requiring a now-cleared lease, while refusing
|
|
different outcomes/actions/flags, wrong owners, expired active claims, and
|
|
unknown rows with distinct API codes. Reopened failures are not terminal and
|
|
must not be mistaken for reconciled delivery.
|
|
|
|
Completed 2026-09-04. The result allowlist now retains bounded
|
|
`repository_transaction` baseline, grant, acceptance, and external-metrics
|
|
evidence while dropping raw grant patterns and unknown blobs. Migration `0010`
|
|
adds `close_intent_digest`. The row-locked close decision returns `applied` for
|
|
the first accepted mutation and `reconciled` for an exact normalized terminal
|
|
repeat by the same owner. It reports distinct `not_found`, `wrong_owner`,
|
|
`expired_lease`, `state_conflict`, `evidence_conflict`, and
|
|
`terminal_conflict` refusals. Granted completion additionally proves that the
|
|
reported grant and acceptance-policy identities match the queued authority and
|
|
that acceptance is positive. Reopened failures clear close identity and remain
|
|
non-terminal.
|
|
|
|
## Verify and hand off
|
|
|
|
```task
|
|
id: ACTIVITY-WP-0037-T04
|
|
status: wait
|
|
priority: high
|
|
```
|
|
|
|
Run focused and full tests, migration/static checks, update the queue contract,
|
|
sync State Hub, and return the exact revision/schema/repeat semantics to
|
|
rein-aharness. Production rollout and live outbox activation remain separate
|
|
until both repositories consume and deploy the reviewed contract.
|
|
|
|
Source verification 2026-09-04: 493 tests passed with one live integration test
|
|
skipped; critical Python lint, compilation, and whitespace checks passed.
|
|
Alembic reports one head (`0010`). A throwaway PostgreSQL 16 database passed
|
|
full upgrade, `0010` downgrade to `0009`, column-removal inspection, re-upgrade,
|
|
and type/nullability inspection; it was then removed. Remaining work is the
|
|
exact-revision State Hub handoff and consistency sync.
|
|
|
|
Handoff completed at source revision `b63131e`. Activity Core acknowledged
|
|
rein-aharness ADR-002 revision `36e1096` / SHA-256
|
|
`84b47d2e669949ab6d178a8e452712df197b852341682b175d831cf2c8bb206f`
|
|
in State Hub message `84748a7e-a0fd-4423-80e8-94d6e885f3fa`, and returned the
|
|
schema and repeat-close contract in message
|
|
`cc105786-7936-4a4d-836a-03b110566e98`. Decision
|
|
`5ca55e62-6747-48eb-9055-eb7d18ab1b4d` and progress event
|
|
`254d7df7-c046-44fd-95e3-cbf8681dc98e` retain the bounded closeout record.
|
|
The first two required `statehub fix-consistency` attempts timed out querying
|
|
the local API; retry after this final file update remains the only close gate.
|
|
|
|
The third attempt reached inbox-hygiene collection but remained blocked waiting
|
|
for the local State Hub messages endpoint for more than two minutes and was
|
|
interrupted. Direct message, decision, progress, and mark-read API writes all
|
|
succeeded. State Hub was asked to reconcile the file in message
|
|
`a96837e6-1c33-4d65-b07a-71dfa7f1b328`. T04 remains `wait` only for State Hub
|
|
registration/consistency; the implementation and rein-aharness handoff are
|
|
complete.
|