[shivros]

Summary

• Add a standalone Rust Herdr v0.8.0 / protocol-19 bridge daemon with newline-delimited Unix-socket handling, bounded durable spool, immutable batch retries, reconnect/backoff, periodic heartbeat, and a hardened user-unit template.
• Reuse Iris's normalized Herdr mapping and authenticated source-agnostic POST /ingest contract; add fixtures/tests and operational documentation for upstream retention and spool-eviction limits.
• Correct the nested AppendMessage wire representation so an IngestBatch can serialize a typed message without colliding with Message::kind; preserve route authentication and Iris-owned canonical hashing.

Validation

• cargo fmt --all -- --check
• cargo build --locked --all-targets
• cargo test --locked --all-targets
• cargo clippy --locked --all-targets -- -D warnings
• cargo run --locked -p iris-codegen --bin iris-codegen -- check
• creed diff, git diff --check
• cargo audit: 0 vulnerable packages; existing baseline warnings remain for unsound lexical-core 0.7.6 and yanked chacha20 0.10.1 (both unchanged from the base lockfile). Gitleaks 8.21.2: no leaks found.
• Independent review panel: Reviewer A and Reviewer B APPROVE; no confirmed actionable findings.

Acceptance boundary

Tests use pinned source-derived/synthetic fixtures and local deterministic transport/ingest paths only. No endver connection, credential installation, live service restart, deployment, or real message delivery was performed. Local systemctl --user installation/restart, Herdr restart survival, journal flush observation, and real Iris delivery remain outstanding and must be exercised before COD-439 is marked Done. No merge is requested or authorized.

Event-context note

The pinned emitted status frame carries source-time workspace and optional agent/display/state-label fields. The bridge preserves those fields, strips title/raw fields, and enriches only synthetic current-status observations from a fresh pane snapshot; it does not rewrite historical event context from a later snapshot.

[shivros]

🤖 Automated Review Panel

Reviewer A — Codex (inherited model)

APPROVE — no confirmed actionable findings. Independently verified the pinned Herdr emitted status payload versus the separate subscription filter, source-time context preservation, private-field stripping, cross-workspace move/close behavior, durable replay, and the authorized /ingest mutation representation. The final six assertion edits preserve their empty/non-empty guarantees. Reviewer could not run Clippy 1.99 locally (available toolchain is 1.98); current-head GitHub Clippy and all other checks are green.

Reviewer B — Gemini 3 Flash Preview (OpenRouter)

APPROVE — no blocking findings. Informational notes: the nested AppendMessage form is covered by core/server round-trip/idempotency tests; allowlist projections keep raw titles, paths, tokens, and terminal data out of persisted metadata; authoritative workspace snapshots protect replace-on-upsert semantics; and explicit test comparisons address the Rust 1.99 assert_is_empty lint.

Both reviewers received the same COD-439 goal, authority, project context, pinned-protocol references, and complete final diff at 056e1338358d4411c293f98dd374d5d5e5974252. The full local locked build/test/strict-Clippy/fmt/codegen/Creed/diff gates passed, as did all seven current-head GitHub checks. Live endver/systemd/restart/journal/real-delivery acceptance remains outstanding.

[shivros]

Local acceptance on endver (2026-10-13, Alice at Shiv's direction) — one defect to fix before merge:\n\ndocs/providers/herdr-bridge.md installs the binary as iris-herdr-bridge, but contrib/systemd/herdr-iris-bridge.service ExecStart is %h/.local/bin/herdr-iris-bridge. Following the doc verbatim yields a crash-looping unit (status 203/EXEC). Recommend either renaming the installed artifact in the doc or aligning the unit.\n\nEverything else in the local acceptance passed: built at head 056e133 on-host, unit enabled/active, survives bridge restart and herdr server restart (subscription reconnect, no crash), spool retains all events across restarts (42 pending, zero loss), secret file 0600, no secret material in logs. Real delivery is currently blocked by sequencing, not by this PR: prod iris on platform-01 still runs main's pre-PR AppendMessage serde shape, so batches are rejected 400 until this PR merges and prod redeploys — the bridge's retry loop will drain the spool automatically at that point.

[shivros]

🤖 Automated Review Panel — COD-439 follow-up delta

Scope: commits 9fb7bd8 and deb74f6, from the previously reviewed SHA 056e133 to current head deb74f632d9392dc656d0d8c58fb25ad5bc4e658. The original panel comment covers the earlier bridge implementation.

Reviewer A — Codex (inherited model)

APPROVE — no confirmed actionable findings. The service ExecStart now matches the binary name installed by the documented procedure and the bridge crate. The Cargo.lock-only quinn-proto update and transitive getrandom resolution are internally plausible; no source/API or secret changes are introduced.

Reviewer B — Gemini 3 Flash Preview (OpenRouter)

APPROVE — no blocking findings. The corrected executable path aligns with the install documentation and package binary. The lockfile update is consistent with the stated dependency bump; the existing restrictive UMask and restart behavior remain intact, with no credentials added.

Both reviewers received the same COD-439 goal, Iris project context/conventions, current PR-head status, and exact two-commit delta. Current head is open, non-draft, mergeable, with all seven GitHub checks successful.