Observe sender ledger continuity and track supervised transition
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a18e2d-f513-7742-b8e7-12af0b744ff3
This commit is contained in:
parent
c1c14a0ea1
commit
c2ce58f10d
6 changed files with 526 additions and 0 deletions
64
docs/sender-ledger-native-2026-10-31.json
Normal file
64
docs/sender-ledger-native-2026-10-31.json
Normal file
|
|
@ -0,0 +1,64 @@
|
|||
{
|
||||
"consistent_read_transaction": true,
|
||||
"ledger_fingerprint": {
|
||||
"schema_sha256": "13148e5a9c6e01cc593bb07278a8649b13e43b26c30b0ed1a6e15995f7b00732",
|
||||
"tables": {
|
||||
"caller_buckets": {
|
||||
"rows": 1,
|
||||
"sha256": "14eac0ee940c87217439ff255f96c92c746be1bcd87a76db350647cea2aaddf0"
|
||||
},
|
||||
"deliveries": {
|
||||
"rows": 2,
|
||||
"sha256": "a0387716815b2ec191187cb34bb3252b9cf51f5fb15a2019918a9cf1737c061e"
|
||||
},
|
||||
"send_attempts": {
|
||||
"rows": 0,
|
||||
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
|
||||
},
|
||||
"suppressions": {
|
||||
"rows": 1,
|
||||
"sha256": "ae26d10dfec16f1b626292b342a5e86afd1858fcaed7c29d4e68e7cf821183d7"
|
||||
},
|
||||
"verification_attempts": {
|
||||
"rows": 121,
|
||||
"sha256": "4a20f2865438daaf9ba9192019ebf4d689778560cb7b27fd118fc9cea1ea7f39"
|
||||
},
|
||||
"verifications": {
|
||||
"rows": 121,
|
||||
"sha256": "ffaf67ac6665d3d7d9fdd50d5feb57f75c70061d773b689669421f1017454334"
|
||||
}
|
||||
},
|
||||
"user_version": 0
|
||||
},
|
||||
"mail_sent": false,
|
||||
"needs_outcome_reconciliation": false,
|
||||
"observed_at": "2026-10-31T15:16:41.014728+00:00",
|
||||
"outcomes": {
|
||||
"accepted_invitations": 2,
|
||||
"accepted_verifications": 121,
|
||||
"canceled_challenges": 0,
|
||||
"consumed_challenges": 0,
|
||||
"failed_invitations": 0,
|
||||
"failed_verifications": 0,
|
||||
"orphan_verification_attempts": 0,
|
||||
"suppressed_recipients": 1,
|
||||
"unknown_invitations": 0,
|
||||
"unknown_verifications": 0,
|
||||
"unlinked_verifications": 0,
|
||||
"unrecognized_attempt_states": 0
|
||||
},
|
||||
"private_rows_printed": false,
|
||||
"rollout_authorized": false,
|
||||
"schema": "email-connect.sender-ledger-observation.v1",
|
||||
"writers_fenced": false,
|
||||
"runtime": {
|
||||
"deployment_uid": "2e98e52a-a2d1-4c52-9ac8-6efbc0a18e72",
|
||||
"generation": 74,
|
||||
"image": "forgejo.coulomb.social/coulomb/email-connect@sha256:5d79fd1fec15d3a279383820f170d263de3a55f5308df01a0a34732ebaea6d3d",
|
||||
"sender": "forgejo@coulomb.social",
|
||||
"deployment_spec_unchanged_during_observation": true,
|
||||
"transactional_sha256": "36fdfd8cb58f10148cd491a7e34d7aea798e4289fce760af70a48776bede204d",
|
||||
"packaged_source_matches_checkout": true
|
||||
},
|
||||
"observer_sha256": "262d6d52d5c10fb8583e0828ed34945b647f1d53bf9de5286374fef85cf76a8d"
|
||||
}
|
||||
68
docs/sender-transition-boundary-2026-10-31.md
Normal file
68
docs/sender-transition-boundary-2026-10-31.md
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
# Sender transition: ledger and shutdown boundary
|
||||
|
||||
The current receiver remains generation 74/image 5d79fd1f, using
|
||||
forgejo@coulomb.social. The platform sender's credential foundation is prepared
|
||||
under RPF-WP-0068 but unadmitted. EMAIL-WP-0010 now owns the separate configuration
|
||||
executor, attended switch and native return, supporting CSOC-WP-0015-T02.
|
||||
|
||||
At 15:16:41Z, `inspect-sender-ledger.py` read the native ledger in one read-only
|
||||
SQLite transaction. All six tables pass integrity/fingerprint checks, including
|
||||
committed WAL. Aggregate results: 2 accepted invitations, 121 accepted verification
|
||||
attempts, 1 suppression, no unknown outcomes, orphan attempts, unrecognized states
|
||||
or unlinked verification rows. No private row values were printed. Evidence:
|
||||
`sender-ledger-native-2026-10-31.json`. The receipt binds the exact observer source
|
||||
and native transactional source, which matches the checkout. The deployment spec
|
||||
was unchanged across observation; no resource or sender change was made.
|
||||
|
||||
## What the observation means
|
||||
|
||||
The successful invitation path writes its provider receipt into deliveries but
|
||||
leaves the corresponding send_attempts row in_flight. That row by itself is not
|
||||
evidence of uncertainty: `delivery_status` and `reserve_send` check deliveries
|
||||
first. Verification sends instead explicitly update their attempt to accepted.
|
||||
The observer follows both conventions and reports only counts and hashes.
|
||||
|
||||
The source uses `wsgiref.simple_server` without an explicit SIGTERM handler. The
|
||||
Deployment has 15 seconds termination grace, but that setting does not establish
|
||||
application-level draining. Termination between SMTP acceptance and ledger commit
|
||||
can retain an unknown outcome. Existing source refuses blind resubmission; a
|
||||
configuration change must preserve this behavior and the whole ledger. The new
|
||||
observer neither alters reservations nor decides whether a provider accepted mail.
|
||||
|
||||
No uncertain outcomes were present at this observation. Writers were active;
|
||||
new requests can arrive afterward. Therefore this does not establish a drained
|
||||
receiver or a valid execution-time baseline. Unlinked historical challenges are
|
||||
reported separately; they may include superseded retries and are not automatically
|
||||
classified as uncertain sends or relabeled as accepted.
|
||||
|
||||
## Remaining executor work
|
||||
|
||||
The executor must combine a verified foundation return with current identity/spec
|
||||
guards, writer quiescence and a fresh recoverable ledger point. It must retain
|
||||
phase evidence across lost replies and distinguish source configuration rollback
|
||||
from data restoration. A failed rollout must not overwrite accepted/unknown sends,
|
||||
consumed or canceled handles, suppression or quotas, including later legitimate
|
||||
writes. The old reader/projection remains retained for guarded rollback; no
|
||||
mailbox credential is copied into source, chat or a public receipt.
|
||||
|
||||
The existing consumer dry-run candidate changes only the sender and credential
|
||||
references, but is not an execution procedure. Exact supervised controller and
|
||||
interruption tests are EMAIL-WP-0010-T02; live switch and independent postflight
|
||||
are T03/T04. Productive mail authentication and inbox/return handling remain
|
||||
CSOC-WP-0015-T02/T05. No new execution approval is requested by this observation.
|
||||
|
||||
## Validation
|
||||
|
||||
Twelve new synthetic cases pass. They compare the exact fingerprint format with
|
||||
the existing archive implementation, preserve all rows, distinguish accepted
|
||||
in_flight invitation rows from unknowns, retain unknown retry refusal after reopen,
|
||||
classify verification/history cases, and prove that a concurrent committed WAL
|
||||
write cannot split the fingerprint and outcome counts across snapshots. Missing,
|
||||
symlinked, oversized and unexpected-schema input refuses; CLI failures redact
|
||||
paths. Tests use no production URLs/accounts or provider sends.
|
||||
|
||||
Owner default suite: 192 passed, 21 skipped in 13.21s. Those 21 existing tests require the
|
||||
opt-in container mail harness; no new test is skipped. This is sufficient evidence
|
||||
for the read-only observer and is not a delivered-message or rollout acceptance
|
||||
claim. Ruff passes for both changed Python files. Log:
|
||||
`/tmp/email-sender-ledger-check-20261031.log`.
|
||||
Loading…
Add table
Add a link
Reference in a new issue