feat(desktop): add proof-backed Activity Ledger - #6504
Conversation
Constraint: Preserve Buzz mission/governance/proof architecture and the active dirty live checkout. Rejected: A second mission database or agent-authored VERIFIED state | duplicates authority and breaks proof boundaries. Confidence: high Scope-risk: moderate Directive: Do not treat turn_completed or managed-agent claims as verified outcomes. Tested: 3793 desktop tests; 68 archive tests; typecheck; Biome checks; production build; cargo check/fmt; SQLite close/reopen persistence. Not-tested: installed-app deployment; OS crash before archive commit; Honey direct query; durable owner overrides. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: preserve Buzz mission, governance, proof, and running signed-app architecture. Rejected: agent-authored verification and direct SQLite Honey reads | they bypass owner authority and provenance. Confidence: high Scope-risk: moderate Directive: never promote tool completion, lifecycle completion, or agent claims to VERIFIED. Tested: desktop 3811/3811; archive 83/83; buzz-agent full suite; typecheck; lint; build; cargo workspace check; formatting; file-size gates. Not-tested: replacement of the installed Developer-ID-signed app; relay frames killed before callback entry. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: Ephemeral observer frames and owner-facing summaries must survive restart without letting an agent or same-user process mint VERIFIED truth. Rejected: Trusting static capability strings or generic signed observer rows | neither proves the active owner authorized the snapshot or that evidence belongs to the journal. Confidence: high Scope-risk: moderate Directive: Keep CLAIMED, OBSERVED, RECEIPTED, and VERIFIED boundaries fail-closed; preserve signed provenance through batching and dedupe. Tested: Honey 8/8; journal authority 12/12; snapshot 5/5; native sync 36/36; frontend ledger 79/79; typecheck, fmt, diff, and file-size gates. Not-tested: Block-signed distribution channel; hard termination before a native MatchedEvent reaches the durable queue. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: Upstream added a gated archive database and retention commands while the ledger branch was under verification. Rejected: Force-pushing the stale base or keeping direct archive opens | both would bypass the mainline initialization and maintenance lock. Confidence: high Scope-risk: moderate Directive: Route every ledger database command through ArchiveDb and keep the expected Today owner key reserved. Tested: Honey 9/9 including shared Desktop fixture; Today snapshot 6/6; journal authority 12/12; reserved owner env 1/1; native sync 36/36; fmt, diff, and file-size gates. Not-tested: Block-signed distribution channel; hard termination before native MatchedEvent delivery. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: The full pre-push gate rejects over-wide command signatures and warning-level iterator/test shapes. Rejected: Clippy allow attributes | typed request and aliases keep the contract explicit. Confidence: high Scope-risk: narrow Directive: Keep the observer range request nested under input in frontend and Tauri command calls. Tested: desktop Tauri workspace clippy with all targets and warnings denied; TypeScript typecheck; isolated visibility timing test 5/5. Not-tested: Block-signed distribution channel. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: Upstream main advanced during the verified pre-push gate. Rejected: Open a PR one commit behind main | current-main lineage is required. Confidence: high Scope-risk: narrow Directive: Preserve the ledger proof boundaries and upstream mobile behavior. Tested: Prior full pre-push gate passed at 4cfe7c3; rerun required on merged head. Not-tested: Block-signed release pipeline. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 117da0b7ef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Owner verification and Today supervision must remain fail-closed under real tool correlations and incomplete turns. Rejected: Dismissing automated P1 review findings | each reproduced against production contracts. Confidence: high Scope-risk: narrow Directive: Keep verification journal-correlated, always age Today journals, and retain durable queue heads on invariant failure. Tested: frontend 83/83; native sync 36/36; Honey Today 9 unit plus signed subprocess integration; TypeScript; Biome; rustfmt; diff checks. Not-tested: Block-signed installed-app release. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review\n\nRe-review requested at e98684c after closing all three P1 findings plus the signed Today integration-fixture gap. Full local pre-push gate passed: Desktop 5,343/5,343; Rust workspace suites; Desktop Tauri 2,771/2,771 plus integration/doc suites; clippy/typecheck/format/file-size checks. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e98684cb3a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Verification must survive split observer batches, Today snapshots must replace atomically on Windows, and owner edits must reopen from validated authority. Rejected: Treating the repaired head review as advisory | all three findings reproduced against production seams. Confidence: high Scope-risk: narrow Directive: Preserve journal and receipt source binding, Windows replace-existing atomicity, and authority-loaded edit seeding. Tested: frontend 83/83; TypeScript; Today snapshot 6/6; strict native clippy; Biome; rustfmt; diff checks; independent review APPROVE. Not-tested: Windows runtime execution and Block-signed installed-app release. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4669e7fc87
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Honey must retain newest supervision data, oversized tool output cannot expire the signed feed, and Windows production code cannot add unsafe. Rejected: unbounded signed surfaces and direct MoveFileExW FFI | both violate fail-closed owner visibility or repository policy. Confidence: high Scope-risk: narrow Directive: Preserve newest-first limit semantics and the disclosed six-megabyte snapshot projection budget. Tested: 85 frontend ledger tests, 10 Honey Today tests, 6 native snapshot tests, TypeScript, rustfmt, strict clippy, file-size and diff checks. Not-tested: Windows runtime execution; same-directory replace semantics were verified against tempfile implementation and Microsoft MoveFileEx documentation. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review\n\nFinal blocker audit requested against exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 170aa87fa7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Later terminal evidence must outrank verification, archive entry and byte caps must backpressure without losing the received event, and built-in results must obey the model history budget. Rejected: masking failure with an older receipt, stopping the listener or dropping an event at durable capacity, or returning the six-megabyte owner projection directly into model history. Confidence: high Scope-risk: narrow Directive: Preserve terminal failure and incomplete proof precedence, exact-candidate retention across queue-cap drain, and the configured Today text-result budget. Tested: focused frontend 86/86; native sync 38/38; Honey Today 11/11 plus signed subprocess integration; TypeScript, Biome, rustfmt, strict clippy, file-size and diff checks. Not-tested: Windows runtime execution and Block-signed installed-app release. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Final blocker audit requested against exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4a58983a28
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: A relay frame received at the serialized-byte boundary must survive cancellation and restart, and production archive recovery must not panic. Rejected: retaining accepted overflow only in memory or asserting rollback invariants with expect(). Confidence: high Scope-risk: narrow Directive: Preserve main-queue-first ordering, durable inbox replay, and tombstone-before-inbox-removal crash safety. Tested: archive sync 38/38 including failed-teardown/restart replay; strict native clippy; rustfmt; file-size and diff checks; independent P0-P2 review PASS. Not-tested: Windows runtime execution and Block-signed installed-app release. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3358d476ba
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: A consumed relay frame must survive transient durable-storage failure, owner verification must cover current journal evidence, and large journals must remain renderable. Rejected: stopping sync after one inbox write failure, accepting stale verification subsets, or spreading unbounded event arrays into Math.max. Confidence: high Scope-risk: narrow Directive: Keep one-event live backpressure until durable acceptance and require verification to bind the current non-owner evidence source. Tested: frontend ledger and Today 38/38; native archive sync 39/39; TypeScript; Biome; strict native clippy; rustfmt; file-size and diff checks; independent P0-P2 review PASS. Not-tested: Windows runtime execution and Block-signed installed-app release. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review — final blocker audit against exact head 818c9c9. All 17 prior threads are repaired, receipted, and resolved. Focus on P0-P2 correctness, live-retained storage retry and cancellation, current-evidence verification binding, large-journal behavior, proof authority, durability, and false-completion paths. Full gate: desktop 5350/0; native 2774/0 plus integrations; strict clippy, typecheck, static, size, skew, and format checks passed. |
There was a problem hiding this comment.
💡 Codex Review
buzz/desktop/src-tauri/src/archive/sync.rs
Lines 703 to 709 in 818c9c9
Do not reuse a sync task that is already stopping
When cancellation occurs while a live-retained candidate still cannot be persisted, end() times out and reinserts the cancelled RunningSync; a same-scope remount then takes this branch and reports a successful no-op. The old task no longer receives events and eventually clear_completed() removes it, but the new caller has already returned and never starts a replacement, leaving archive sync permanently stopped. Treat a cancelled/stopping same-scope task as unavailable and wait for or replace it rather than applying healthy-task idempotence.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Activity truth must survive remounts and stay owner-plus-relay scoped without unbounded ingestion or unverifiable source sets. Rejected: Treat stopping sync as healthy; owner-only snapshot; full-day fanout; proof-source truncation | each weakens truth or availability. Confidence: high Scope-risk: moderate Directive: Preserve canonical relay binding, page-wise bounded decrypt, the exact 256-source gate, and terminal secret fencing. Tested: desktop check/typecheck plus 5,352 tests; all 9 workspace unit suites; desktop-native clippy plus 2,794 tests and integration suites; formatting, file-size, and diff checks. Not-tested: Block-signed installed-live release. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Final blocker audit requested against exact head |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f391efc40b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Today reconstruction must remain memory-bounded across an unbounded archive day while preserving signed sources needed for owner verification and restart recovery. Rejected: Retain all decoded events or retry every start error | both create unbounded failure modes. Confidence: high Scope-risk: narrow Directive: Preserve owner-verification, correlation, terminal, failure, and receipted sources before ordinary timeline detail when changing projection limits. Tested: targeted Activity Ledger and archive-sync tests 21/21; Desktop typecheck; Biome; file-size gate; diff check; independent P0-P2 review PASS. Not-tested: full repository pre-push gate runs on push. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: Today must use authoritative observer time, preserve archived proof after collection is disabled, and never expose embedded credentials. Rejected: fixed envelope overlap and current-subscription revalidation | both create silent evidence gaps. Confidence: high Scope-risk: moderate Directive: Keep observer-time indexes rebuildable from signed archive rows and VERIFIED authority independent of current collection preferences. Tested: 56 frontend ledger tests; observer-time 4/4; journal authority 16/16; Today 10/10 plus structured Authorization regression; strict native clippy; typecheck; formatting; file-size and diff gates. Not-tested: installed Block-signed application release path. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Fresh final exact-head blocker audit for Exact-head evidence: full pre-push gate PASS; Desktop 5,421/5,421; native 2,789 passed + 18 intentional keychain ignores; integrations/docs PASS; strict workspace clippy, typecheck, static, file-size, branch-skew, format and DCO gates PASS. Independent current-diff review: APPROVE, zero P0-P2 findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b8fbba1eb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Historical observer indexing must remain bounded and snapshots must never export authorization material. Rejected: Treating a short page as EOF or enumerating auth schemes | both permit silent omission or credential leakage. Confidence: high Scope-risk: narrow Directive: Keep backfill completion explicit across the Tauri boundary and redact complete Authorization values regardless of scheme. Tested: observer-time 4/4; Today snapshot 7/7; Desktop typecheck; selected Biome; file-size; rustfmt; strict native Clippy. Not-tested: Installed Block-signed application release path. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Please perform a fresh full P0-P2 review of exact head d77597f. Recheck scheme-independent Authorization and Proxy-Authorization redaction, explicit bounded historical backfill completion before range EOF, relay/agent/owner proof isolation, inner-time indexing, snapshot signing, pagination, failure states, and silent truncation. Report every material blocker. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d77597f307
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Today must stay fail-closed without silently omitting observer evidence or corrupting large Honey responses. Rejected: Truncate serialized JSON and skip excluded frames | corrupts the query contract and hides incomplete evidence. Confidence: high Scope-risk: narrow Directive: Preserve scheme-independent authorization redaction, signed exclusion counts, and stable three-key pagination cursors. Tested: 5422 Desktop tests; 2789 native tests plus integrations/docs; root and Desktop strict clippy; production build; typecheck; file-size and format gates. Not-tested: Block-signed/notarized installed-live distribution. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Final fresh exact-head blocker audit for |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 260df0c599
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Prevent signed Today from understating observer evidence that cannot be assigned to a day. Constraint: Observer envelopes with NULL inner-time bounds cannot enter a day range. Rejected: Ignore rows omitted by the time index | lets bounded=false hide possible terminal or failure evidence. Confidence: high Scope-risk: narrow Directive: Keep unindexed-frame counts owner-scoped and disclose them exactly once during paginated reconstruction. Tested: Today reconstruction 15/15; exact native NULL-marker regression; TypeScript typecheck; selected Biome; strict Desktop clippy; file-size and diff gates. Not-tested: Block-signed/notarized installed-live distribution. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Final fresh exact-head blocker audit for |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 515ede4f2c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Keep signed Today omission claims current through pagination, malformed batches, and the native write boundary. Constraint: Archive ingest and batch decoding continue while Today is reconstructed. Rejected: Trust only the first range-page count | races concurrent hidden evidence and silently drops malformed siblings. Confidence: high Scope-risk: moderate Directive: Preserve separate signed unindexed-frame accounting and hold the archive actor across its final publication check. Tested: focused Today/API 17/17; native publication-fence regression; TypeScript typecheck; selected Biome; strict Desktop clippy; file-size, formatting, and diff gates. Not-tested: Block-signed/notarized installed-live distribution. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Please perform a fresh whole-diff P0-P2 blocker audit at exact head 95a4d66. Re-check all prior fixes and specifically challenge: (1) page-delta accumulation plus the final native unindexed-frame fence, (2) atomicity of the archive-actor-held snapshot publication fence under concurrent ingest, and (3) malformed members in otherwise valid observer batches being counted rather than silently dropped. Report any remaining correctness, security, durability, provenance, proof-state, pagination, restart, multi-agent, or owner-authority blockers. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 95a4d66927
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Today must never publish a false-complete projection while observer evidence changes during paging or signing. Rejected: Best-effort final page/count checks | they neither retract already-consumed pages nor exclude concurrent SQLite writers. Confidence: high Scope-risk: moderate Directive: Preserve the monotonic observer revision, reset-on-drift paging, and exclusive immediate publication transaction as one invariant. Tested: focused frontend 28/28, TypeScript typecheck, native revision/exclusive-lock/snapshot-fence regressions, strict Desktop clippy, formatting, Biome, file-size, and diff checks. Not-tested: full pre-push matrix runs on push. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Final exact-head whole-diff P0-P2 blocker audit at 3e1dc85. Re-check every prior finding and specifically attack the new durable observer revision triggers, transactional per-page revision comparison/reset, invalid timestamp accounting, bounded retry behavior, ArchiveDb exclusive guard, and SQLite IMMEDIATE transaction held through signed atomic snapshot replacement. Also inspect proof-state boundaries, owner/relay/agent scoping, restart durability, pagination, historical backfill, and multi-agent Today behavior. Please open concrete threads for any remaining P0-P2 issue; if none, leave the no-findings completion signal on this exact request. |
Constraint: Today must count every malformed observer member instead of letting permissive JavaScript date parsing move it to another day. Rejected: Date.parse-only validation | it normalizes impossible dates such as February 30. Confidence: high Scope-risk: narrow Directive: Keep observer admission aligned with strict RFC3339 calendar validity. Tested: focused Today 18/18, TypeScript typecheck, Biome, and diff checks. Not-tested: full pre-push matrix runs on push. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e1dc859ab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Today must remain available during continuous observer ingestion without presenting an incomplete reconstruction as complete. Rejected: unbounded reconstruction retries or silently dropping malformed archive rows | either can hide failure evidence or make the owner surface disappear. Confidence: high Scope-risk: moderate Directive: Preserve backend-native cursors and explicit excluded-frame accounting whenever archive paging changes. Tested: focused frontend 31/31; observer-time 5/5; snapshot fence 1/1; range paging 1/1; TypeScript; Biome; rustfmt; strict clippy; file-size and diff gates. Not-tested: installed signed production application; requires Block merge and release authority. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review Final fresh exact-head whole-diff P0-P2 blocker audit for |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e75848abbb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Today must fail closed when observer events are lost before archival or the archive changes during snapshot publication. Rejected: process-local warnings or preserving stale VERIFIED journals | neither gives the owner durable evidence that the reconstruction is incomplete. Confidence: high Scope-risk: moderate Directive: Preserve signed in-band gap accounting, strict archived-row validation, and archive-drift truth invalidation across future observer pipeline changes. Tested: focused Activity Ledger 50/50; ACP observer 37/37; replay overflow; relay overflow; signed gap round-trip; snapshot fence; strict clippy; typecheck; Biome; rustfmt; file-size and diff gates. Not-tested: full pre-push suite and installed Block-signed application at commit time. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review exact head bf94d16. Perform a fresh P0-P2 blocker audit of the complete PR diff, including the newly repaired signed telemetry-gap accounting, archive-revision truth invalidation, schema-invalid archive-row handling, proof-state boundaries, owner authority, Today/Honey publication, persistence, restart, and concurrency paths. Do not rely on prior resolved threads. Report every actionable P0-P2 finding, or explicitly report that none remain. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bf94d165c9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Constraint: Source telemetry, relay acknowledgments, and archive revision fences must remain truthful across managed restarts and unrelated agent metrics. Rejected: process-local warnings, aborting the observer publisher, or advancing Today for every owner scope | each can hide missing terminal evidence or invalidate unrelated journals. Confidence: high Scope-risk: moderate Directive: Preserve FIFO relay-accepted flush barriers, recursive signed-gap totals, and kind-24200-only observer revision scope triggers. Tested: buzz-acp 815/815 unit plus 9/9 lifecycle; observer revision 2/2; strict all-target clippy; rustfmt; file-size and diff gates. Not-tested: full pre-push suite and installed Block-signed application at commit time. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: The exact-head native gate must terminate and report setup failures instead of waiting forever at a race barrier. Rejected: Leave connection setup inside worker threads | A setup panic can strand the sibling before the test harness can surface the error. Confidence: high Scope-risk: narrow Directive: Establish fallible preconditions before synchronization barriers in concurrent regression tests. Tested: Focused two-connection WAL regression; cargo fmt; file-size gate; git diff check. Not-tested: Full workspace gate runs in the pre-push hook. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
Constraint: Observer revision trigger repair must remain atomic without turning every archive connection into a schema writer. Rejected: Recreate triggers on every open | Concurrent readers contend on DDL and can fail first-open fanout. Confidence: high Scope-risk: narrow Directive: Probe revision schema first; take an immediate migration lock and recheck only when stale. Tested: Observer revision 2/2; first-open barrier regression; strict native clippy; cargo fmt; file-size gate; git diff check. Not-tested: Full workspace gate runs in the pre-push hook. Signed-off-by: Garfield Lawrence <3stepwin@gmail.com>
|
@codex review exact head 8201c27. Fresh P0-P2 blocker audit only; please re-review the complete current diff and do not rely on earlier review state. Verify proof semantics, authority binding, observer loss accounting and relay acknowledgement, shutdown durability, archive migration concurrency, Today/Honey snapshot trust, dedupe, restart persistence, and failure paths. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8201c2735a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| for seq in frame.represented_flush_seqs { | ||
| self.observer_unsettled_flush_seqs.remove(&seq); | ||
| } | ||
| self.maybe_complete_observer_flushes(); |
There was a problem hiding this comment.
Fresh evidence beyond the rejected-OK repair is that an accepted relay OK still does not prove that the owner archived the frame. Kind 24200 is not stored by the relay, and crates/buzz-relay/src/handlers/event.rs:1078-1100 sends OK true after best-effort pubsub/local fan-out—even when Redis publication fails or no Desktop archive subscriber is online. Removing the flush sequence here therefore lets shutdown complete while the only terminal or failure evidence was never archived, and the later Today snapshot can report no source loss. Require an archival acknowledgement or durable relay storage before settling the frame.
Useful? React with 👍 / 👎.
| if closed && queue.is_empty() { | ||
| publisher.flush_observer().await.map_err(|error| { | ||
| format!("flush observer publisher: {error}") | ||
| })?; |
There was a problem hiding this comment.
Fresh evidence after the earlier shutdown thread is that the new drain is not actually bounded: once the local queue empties, this awaits flush_observer() without any timeout, and that waiter completes only after every frame receives an accepted relay OK. If the relay is unreachable, keeps rejecting replacement gaps, or never acknowledges an in-flight frame, task.shutdown().await in the main teardown never returns, so the managed agent cannot stop or restart. Use a bounded acknowledged drain with durable pending state for anything left unsettled.
Useful? React with 👍 / 👎.
| let current_revision = observer_revision::current(&tx, &identity_pk, &relay_url)?; | ||
| let current_unindexed = | ||
| store::count_unindexed_observer_frames(&tx, &identity_pk, &relay_url)?; | ||
| let snapshot_json = | ||
| seal_snapshot_archive_fence(&snapshot_json, current_revision, current_unindexed)?; |
There was a problem hiding this comment.
If an owner updates a journal override or verification after the frontend loads authority but before this exclusive publication begins, this fence observes only observer_archive_revisions; mutations to journal_authority_artifacts do not advance that value. The native write can therefore sign and publish the superseded summary or verification even though the database already contains a higher authority revision, defeating the artifact revision's replay protection until a later refresh. Include authority state in the publication generation/fence or reload it inside the exclusive snapshot transaction.
Useful? React with 👍 / 👎.
1 participant
Summary
Adds the smallest coherent Activity Ledger / Mission Journal slice to Buzz without replacing missions, conversations, governance, receipts, HIVE memory, or the existing runtime.
Meridian concepts are mapped into Buzz's existing signed observer and local archive architecture:
CLAIMED,OBSERVED,RECEIPTED,VERIFIED,FAILED, andUNKNOWNproof statesProof boundaries
turn_completedmeans execution ended; it never proves the mission objective succeeded.CLAIMED.RECEIPTED, not automaticallyVERIFIED.VERIFIEDrequires an owner-signed authority artifact bound to an authorized, signed, archived observer event and the same journal/correlation identity.Owner experience
get_activity_ledger_todaywhile validating owner, hash, event ID, signature, path, permissions, schema, and expiry.Verification
Failure coverage includes tool failure/retry, false completion without evidence, stale/incomplete turns, duplicate signed-frame dedupe, restart persistence/replay, multi-agent handoff, owner modification, hostile same-user snapshot rewrite, timeout/late completion/restart, tampered signatures, and cross-owner isolation.
Lineage
This branch was rebuilt and reconciled onto current upstream
main(aeb741fd3); it is not the stale historical custom-branch lineage.Release boundary
This PR changes source only. It does not replace the installed Block-signed Buzz app. Production distribution still requires Block maintainer merge plus the upstream signing, notarization, and updater release workflow.