coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Build durable close evidence outbox

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d
This commit is contained in:
tegwick 2026-08-23 14:05:50 +02:00
parent 9866f35b30
commit c97e5ea92d
5 changed files with 978 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

25
workplans/HARNESS-WP-0003-governed-runtime-integrity.md
View file

@ -274,6 +274,31 @@ authoritative-carriage review from Activity Core
Glas (`e149c359-36bf-4867-ac10-f58a8f248666`). No execution enablement was
requested.
### Close-evidence outbox preparation — 2026-08-23
Added a production-inert `CloseOutbox` core for Activity Core completion and
failure intents. It stores private mode-`0600` JSON outside target checkouts,
keys entries by bounded run/transaction identity, uses a process-safe lock and
file/directory `fsync` around atomic replacement, suppresses identical pending
or delivered entries, and rejects conflicting identity reuse. Result evidence
is normalized and bounded by type, depth, collection/string/integer limits, and
a 64-KiB encoded ceiling.
Replay durably increments the attempt before calling a close-only callback,
moves success to delivered state, retains ordinary API failure with a bounded
error, and leaves process interrupts pending. Corrupt, oversized, or
directory/state-mismatched material is preserved with a reason in quarantine
and never delivered. Twenty-five focused cases cover private/atomic storage,
duplicate/conflict behavior, successful and failed replay, callback mutation,
interrupt persistence, corruption, atomic-write failure, two-process enqueue,
replay limits, and payload bounds.
`docs/close-evidence-outbox.md` records the storage/replay contract and the
network-ambiguity residual: a close request may be repeated after a timeout,
but replay never calls workload code and therefore cannot duplicate the
repository commit. The live claim loop remains unchanged pending transaction
wiring, Activity Core repeat-close review, and operator status/replay controls.
## Remove tenant logic from the shared runtime
```task