3075c63e01
Some checks failed
tamq-ci / test (push) Failing after 5s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a03397-4d51-7fd1-8ff2-946eb22ea2bc
80 lines
2.9 KiB
Markdown
80 lines
2.9 KiB
Markdown
---
|
|
id: TAMQ-WP-0012
|
|
type: workplan
|
|
title: "Pushy feedback circuit breaker and upgrade gate"
|
|
domain: communication
|
|
repo: tmux-amq
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: coulomb-social
|
|
planning_priority: P0
|
|
planning_order: 17
|
|
created: "2026-08-25"
|
|
updated: "2026-08-25"
|
|
state_hub_workstream_id: "43d9c66a-0851-55b3-ad40-e9334a393fcd"
|
|
---
|
|
|
|
# Pushy feedback circuit breaker and upgrade gate
|
|
|
|
Stop a live pushy feedback incident, make stale delivery framing detectable,
|
|
and reject any legacy injected envelope that re-enters a tapped pane.
|
|
|
|
## Halt and characterize the live incident
|
|
|
|
```task
|
|
id: TAMQ-WP-0012-T01
|
|
status: done
|
|
priority: critical
|
|
state_hub_task_id: "e886f7ce-2d13-53e2-ba6e-be7bf34c47e1"
|
|
```
|
|
|
|
Stop the broker without changing panes or history and preserve evidence of the
|
|
alternating sender/target chain and recursively appended message identifiers.
|
|
|
|
## Enforce compatible pushy framing
|
|
|
|
```task
|
|
id: TAMQ-WP-0012-T02
|
|
status: done
|
|
priority: critical
|
|
state_hub_task_id: "373311a1-7ef6-5eef-af38-b79c6543786c"
|
|
```
|
|
|
|
Advertise and require a capability specific to non-routable pushy envelopes so
|
|
startup restarts a broker that still emits the legacy routable `#sender:` form.
|
|
|
|
## Add a tap-side circuit breaker and prove containment
|
|
|
|
```task
|
|
id: TAMQ-WP-0012-T03
|
|
status: done
|
|
priority: critical
|
|
state_hub_task_id: "f297c45d-1c0b-5c83-b67e-c32bcffb3bc8"
|
|
```
|
|
|
|
Recognize legacy injected envelopes by their durable message identity and
|
|
direction, refuse to enqueue them, and cover stale-service restart, false
|
|
positive boundaries, one-pass delivery, and isolated real-tmux containment.
|
|
Install the corrected build but leave the operator broker stopped and preserve
|
|
incident history unless cleanup is separately authorized.
|
|
|
|
## Completion evidence
|
|
|
|
- Stopped live broker PID 2656594 before diagnosis; panes and durable history
|
|
were preserved. Message count stabilized at 105 with 14 pre-existing pending
|
|
records and no active endpoint.
|
|
- The incident records alternate `flex-auth` and `audit-core`, append the prior
|
|
message identifier on every hop, and prove an older `#sender:` pushy envelope
|
|
was being routed by newer taps.
|
|
- Pushy startup now requires `pushy_input_non_routable_v1`, forcing a one-time
|
|
restart of brokers that predate the `# from sender:` framing.
|
|
- The broker independently rejects a legacy hash envelope only when its final
|
|
message identifier resolves to a durable delivery whose sender and target
|
|
are the reverse of the observing tap. Unknown receipt-like user text remains
|
|
routable.
|
|
- `make check`: 126 tests passed, including real tmux injection of a legacy
|
|
envelope followed by proof that no second durable record appears.
|
|
- `make install`: refreshed `tmux-amq==0.1.0`. The operator broker remains
|
|
stopped; the 82 incident-generated records were not deleted or acknowledged.
|
|
- Retry and acknowledgement residuals remain owned by `TAMQ-WP-0003`; this
|
|
incident adds no untracked residual.
|