2026-09-05 01:53:24 +02:00
|
|
|
|
# Repository review — 2026-09-05
|
|
|
|
|
|
|
|
|
|
|
|
Reviewed the working tree, fetched origin, scanned all local workplan statuses,
|
|
|
|
|
|
and read/acknowledged the State Hub inbox. Existing WORK-RECORDS.md changes
|
|
|
|
|
|
correct renumbered plans 0025–0027 and are retained.
|
|
|
|
|
|
|
|
|
|
|
|
Open plans 0015, 0025 and 0027 retain their attended gates: approved exercise
|
|
|
|
|
|
windows/abort operators, operator listener cutover, and exact recovery/custody
|
|
|
|
|
|
receipts. No new qualifying receipts were in the unread inbox.
|
|
|
|
|
|
|
|
|
|
|
|
New actionable source work is tracked by RPF-WP-0028 (durable image inventory)
|
|
|
|
|
|
and RPF-WP-0029 (backup credential fallback). Their live completion gates remain
|
|
|
|
|
|
explicit. No prune, reboot, lease revocation, or provider rotation was run.
|
|
|
|
|
|
|
|
|
|
|
|
Other inbox demands requiring scoped design or owner inputs remain pending:
|
|
|
|
|
|
|
|
|
|
|
|
- ops-mason fluid-telegram: tenant prefix and actual OIDC group claim remain
|
|
|
|
|
|
unconfirmed. Read/write policy requires reviewed CCR schema/validator support;
|
|
|
|
|
|
current read-only request shape must not be bypassed.
|
|
|
|
|
|
- secrets-engine: native AppRole apply still requires serving canonical action
|
|
|
|
|
|
authorization, exact targets, attended authority and consumer health proof.
|
|
|
|
|
|
Its separate service JWT mount/role contract is not yet established here.
|
|
|
|
|
|
- State Hub rename preflight: dedicated signing-secret lane remains to be
|
|
|
|
|
|
designed and approved; the rename is outside this session's scope.
|
|
|
|
|
|
- Policy Nexus CCR-2026-0014 request is superseded by the repository's existing
|
|
|
|
|
|
activation commit 62423fd; no duplicate provisioning performed.
|
|
|
|
|
|
- Activity-core OpenRouter recovery was reported complete and its intentional
|
|
|
|
|
|
reuse decision retained in RPF-WP-0004.
|
|
|
|
|
|
|
|
|
|
|
|
No coordination messages were sent. Incoming requests are recorded here for
|
|
|
|
|
|
follow-up rather than treated as permission to invent identities or credentials.
|
|
|
|
|
|
|
|
|
|
|
|
Validation: unittest discovery passed 158 tests; full pytest discovery passed
|
|
|
|
|
|
164 tests, including the function-based tests omitted by unittest. Bash syntax
|
|
|
|
|
|
and git diff whitespace checks passed. The inventory and credential tests use synthetic
|
|
|
|
|
|
inputs and mocked custody only.
|
|
|
|
|
|
|
|
|
|
|
|
State Hub synchronization remains pending: `statehub fix-consistency` was
|
|
|
|
|
|
attempted in the sandbox and once outside it. Both were interrupted after
|
|
|
|
|
|
prolonged HTTP reads during the check phase, before a repair report was
|
|
|
|
|
|
returned. No registrar skip was reported, so registrar authority was not
|
|
|
|
|
|
assumed. Re-run `statehub fix-consistency` when these reads complete reliably
|
|
|
|
|
|
to index the new workplans and refresh the generated records/brief. Progress
|
|
|
|
|
|
was logged successfully as `7e317a96-eb7e-4b36-9d81-4efe49efa22c`.
|
2026-09-05 02:04:22 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Follow-up: prune guard and consistency latency
|
|
|
|
|
|
|
|
|
|
|
|
The CLI now refuses apply before authentication if any explicitly requested
|
|
|
|
|
|
image export is missing, unreadable, empty, or comment-only. Focused tests:
|
|
|
|
|
|
14 passed. Full suite: 166 passed. No production prune was run.
|
|
|
|
|
|
Implementation commit: `f637989`.
|
|
|
|
|
|
|
|
|
|
|
|
Read-only HTTP timing reproduced the consistency problem:
|
|
|
|
|
|
|
|
|
|
|
|
- `/repos/railiance-platform`: HTTP 200 in 13.58 seconds.
|
|
|
|
|
|
- `/repos/railiance-platform/work-record-projection/snapshot`: HTTP 200 in
|
|
|
|
|
|
16.02 seconds; schema and repository ID match the checker contract.
|
|
|
|
|
|
- The installed consistency checker defaults to a 10-second HTTP timeout;
|
|
|
|
|
|
snapshot failure causes fallback to individual workplan/task reads.
|
|
|
|
|
|
|
|
|
|
|
|
A further ordinary sync was interrupted during slow reads. The installed
|
|
|
|
|
|
checker was then invoked in-process with only its HTTP client timeout increased
|
|
|
|
|
|
to 60 seconds (same `--here . --fix` arguments and repair/identity rules).
|
|
|
|
|
|
It also failed to return a repair report within several minutes and was stopped;
|
|
|
|
|
|
no generated repository changes were observed. This confirms a latency issue,
|
|
|
|
|
|
but does not establish that timeout tuning alone is sufficient. State Hub sync
|
|
|
|
|
|
remains pending. A focused State Hub endpoint/query latency investigation is
|
|
|
|
|
|
needed before another full consistency run. No registrar authority was changed.
|
2026-09-05 10:17:42 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Operational migration and precise sync blocker
|
|
|
|
|
|
|
|
|
|
|
|
RPF-WP-0028 is now finished: durable directory and versioned capture hook
|
|
|
|
|
|
installed on railiance01; actcore-worker rolled out; definition synchronized
|
|
|
|
|
|
and read back from the API. All 51 restored entries survive in the 86-entry
|
|
|
|
|
|
union. The worker mount is read-only, and missing input is rejected before
|
|
|
|
|
|
subprocess invocation. No prune was executed. See the dedicated JSON receipt.
|
|
|
|
|
|
Platform code `da42f76`; activity-core integration `4083f31`.
|
|
|
|
|
|
|
|
|
|
|
|
The current State Hub AGENTS.md documents `rmgr sync --path . --push` for fast
|
|
|
|
|
|
projection sync, reserving fix-consistency for deep audits. That command
|
|
|
|
|
|
assigned missing identifiers and pushed `05f315b`, verified primary/railiance01
|
|
|
|
|
|
and the exact Forge commit, then returned a refusal in 5.8 seconds. The blocker
|
|
|
|
|
|
is six duplicated identities shared by the archived May apps-pg plan and the
|
|
|
|
|
|
August Core Hub onboarding plan, both RPF-WP-0021. No projection mutations were
|
|
|
|
|
|
performed. RPF-WP-0031 tracks the exact repair proposal and the required exception
|
|
|
|
|
|
to this repository's managed-UUID editing prohibition. This supersedes the
|
|
|
|
|
|
previous undifferentiated "sync latency" blocker; deep audit latency is separate.
|
|
|
|
|
|
|
|
|
|
|
|
Read-only State Hub source inspection also found eager relationship loading
|
|
|
|
|
|
on RepositorySlug, ManagedRepo, Workplan and Task. Avoiding unrelated relationship
|
|
|
|
|
|
loads is a candidate optimization for the snapshot/identity endpoints, not a
|
|
|
|
|
|
measured root-cause finding. No State Hub service code or deployment was changed.
|
