[scbrown]

Slice 3a of the shared applier, stacked on #803 (S2), which is stacked on #798 (S1b). Review scope: the commits beyond #803, which are 5a2b5af and 311075d, plus the merge 82ce0a3.

This is the applier's side of the scoped replication stream (docs/design/local-sync-mode.md §5; docs/design/shared-applier-api.md rules 1-8). The producer (GET /replicate/stream and POST /replicate/challenge) is the next slice.

What it adds

• Signed session. A quipu.replicate.session frame binds a session id to the source, the scope digest and its since.
  • It must verify against a stream key and scope that the caller pinned with Applier::trust_stream. Neither is ever learned from the stream.
  • A since above the cursor answers Resume.
• Sequence.
  • frame_seq must be exactly last + 1.
  • Each tx must be newer than the last one the session sent.
  • Anything else drops the session and answers Resume. Gaps in tx ids are normal and are never read as loss.
• Coverage. Signed coverage is persisted beside the cursor (replica_coverage, share-Excluded) and never moves back. A reconnect resumes from max(applied, coverage), so a filtered no-op advances the cursor. Coverage proves completeness only.
• Freshness. staleness_bound_ms = now - t_send holds only from a coverage frame that answers an outstanding challenge of the open session, and the nonce is consumed. None of these yield a bound:
  • a heartbeat;
  • a replayed or unsolicited nonce;
  • a new session, a reopen, end_session or clock_discontinuity.
    Freshness::within(ms) gates a bounded= read.
• Control frames. revoked is persisted as Stop::Revoked and stays sticky across reopening. epoch_end answers Rebootstrap.
• src/replicate_wire.rs. The signed bytes, shared with the producer: domain tag quipu-replicate/v1, then length-prefixed fields.

Decision (quipu lead). Coverage is signed with the existing ed25519 identity (src/signing.rs), domain-separated. The S0 crate is a P3 gate, not a P2 one (local-sync §12). The bytes do not change when S0 is extracted.

Controls (local-sync §12, P2)

22 stream tests cover:

• a 60 s-delayed heartbeat: within(100) is false;
• a challenge answered in 40 ms: bound 50 ms at read, within(100) true; the same proof read 500 ms later is false;
• a quiet source passing by challenge;
• replayed and unsolicited nonces;
• restart, clock discontinuity and disconnect: UNKNOWN;
• frame-sequence gap, reorder, a wrong key, unsigned coverage, coverage regression across sessions;
• scope mismatch, revocation (including mid-chunk and across reopen), epoch end;
• a chunked tx invisible until its barrier;
• a stream-only replica equal to its source.

Mutations: 12 mutations of the checks, each failing at least one test.

Local results:

• default suite: 3221 passed, 0 failed;
• --features shacl,onnx,server --bin quipu-server: 236 passed, 0 failed;
• clippy on 3 feature sets, fmt, the size gate, the knowledge witnesses and wasm32 check: clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01BkdpDkAkbTvXvNbNacVpJb

[scbrown]

Restacked onto #803 head 4a6864a (which is on main d68a89a); new head b8193e9. The merge is conflict-free except one knowledge-witness hash, which was recomputed. Review scope is unchanged: 5a2b5af and 311075d. Local results: default suite 3247 passed, 0 failed; server 240 passed, 0 failed; clippy on 3 feature sets, fmt, the size gate and wasm32 are clean. Stays DRAFT until #803 lands.

🤖 Generated with Claude Code

[scbrown]

Ready for review. #803 has landed (bb9254c), and this PR now merges main at 43a88e6. The merge kept main's applier_bootstrap*.rs (with the #803 repair) and kept this branch's stream module. The only other change is the recomputed knowledge witness.

Review scope: 5a2b5af and 311075d (S3a: stream sessions, signed coverage, the freshness challenge).

Local results:

• default suite: 3248 passed, 0 failed;
• server: 240 passed, 0 failed;
• clippy (default and no-default) and the size gate: clean.

Earlier in this run, sparql::filter_drive::...a_filtered_count_drives_and_counts_the_same_rows failed once under full-suite load. It is outside this PR's paths, it passes in isolation (7/7, 181 s), and it passed in this full run.

🤖 Generated with Claude Code

[scbrown]

Non-author Ian — CHANGES at 43a88e645d3ec53da803de03a3c64d03a4be5fc9, base bb9254c249fccc64ca3f2168a870f00c4f8430f5. Full ten-path review. Native T2 preparation: INPUT 7aa0889fa1dd0a58c1901240d1de1cb5ce9f9e1c0e32cd0f194e064ef0d15ed5, CONTENT 824342de714b3fe8636da8bde84fdd056ce4afe579e6eafe1f562b17d081f514; current green admission preceded content inspection. No approval or merge admission issued.

• [P1] Preserve the source anchor and cursor for coverage-only scopes — src/applier_stream.rs:100-110, with src/applier.rs:208. A valid scoped stream can receive signed coverage before its first matching transaction. Coverage is accepted and written to replica_coverage, but progress remains None. Reopen consequently passes no source to Stream::load, which discards the persisted watermark. My valid-traffic control accepted watermark 4, then observed coverage() == None after reopening the same store; the nonempty-store persistence control passes. This loses the advertised reconnect cursor for empty/filter-only scopes. Source checks also depend solely on the missing progress anchor. Retain and validate the covered source/cursor independently of applied facts, without inventing an applied transaction; add empty/filter-only reopen and source/epoch-change controls.

• [P2] End the stream on chunk recovery outcomes — src/applier_stream.rs:243-250. The chunk helpers can return Resume for an incomplete or rejected chunk, but these branches return that outcome directly instead of going through fault(). The chunk is cleared while the stream session and an earlier freshness proof remain present. Sequence-gap recovery correctly clears both. Route chunk recovery outcomes through the stream-fault cleanup and cover the post-Resume session/freshness state. This is a source-path finding; the private runtime failure above exercises coverage persistence, not this path.

Validation: 22 supplied stream tests plus the independent nonempty persistence control pass; the independent coverage-only reopen control fails (None versus Some(4)). All three wire tests pass. The HOME guard was clean for both runs; stream inner exit 101 is retained as a failing test, wire inner exit 0, both outer exits 0. Product source was unchanged; the temporary test inclusion was restored byte-for-byte and the review checkout is clean. No runtime or activation action.

[scbrown]

Repair for the review CHANGES (comment 6391197995). The new head is 0718837, one commit on top of 43a88e6. The head is frozen for the same reviewer.

• P1, coverage-only anchor. Stream::load reads the coverage row together with the source it was verified from. With applied progress, that row must be the same source's. With no progress yet, the row is the replica's anchor and cursor. check_source anchors on progress, or failing that on the covered source, so another source or epoch still answers Rebootstrap. No applied transaction is invented.
• P2, chunk recovery. Every in-session Resume now goes through fault(), so the session and its proofs end. A broken part or commit is handled the same way as a sequence gap.

New controls, each failing with its repair reverted (3/3):

• coverage_before_any_transaction_anchors_the_replica_across_reopening: W is kept after reopen; a session at W opens; a session at W+1 answers Resume { from: W }.
• coverage_from_one_source_refuses_another_source_before_and_after_reopening
• a_broken_chunk_ends_the_session_and_its_proofs: the session is None and freshness is unbounded after Resume.

Local results:

• default suite 3251/0 and server suite 240/0;
• clippy clean for no-default, shacl and server;
• wasm and fmt clean;
• knowledge witness OK.

[scbrown]

Same-branch refresh onto current main after the strict classification refused 0718837 because 045f1fa was missing.

• New head: 58b9da7. It is a merge of origin/main 045f1fa into 0718837, conflict-free. It is not a rebase, and the repair commit is unchanged.
• Whole-proposal parity: git diff bb9254c2 0718837c and git diff 045f1fa5 58b9da77 are byte-identical (sha256 58831b2c6d0d12d7… both ways; cmp equal). The proposal is the same 10 paths with the same content.
• What main added: one commit, .github/workflows/ci.yml plus docs/demos/terminal/*. None of it overlaps the proposal.
• Witness qualification: scripts/test-repository-knowledge.py OK (2 skipped). No pinned file is in the proposal delta.
• Fresh hosted CI is running. The local default and server suites are running too; results will be posted when they finish.

Head frozen for the same reviewer (ian). The original CHANGES review stands until that review.

[scbrown]

Second same-branch refresh: main moved to 7c9a80d (#819, attested writes) while 58b9da7's CI ran.

• New head: 6869231, a merge of origin/main 7c9a80d, with no conflict markers.
• Proposal parity: git diff 045f1fa5 58b9da77 and git diff 7c9a80d5 6869231b differ in exactly ONE line, the index line of src/share_completeness.rs. That file's base blob changed because feat(store): attested writes, a generic default-off signed-write primitive (aegis-25k) #819 added its own declarations. With index lines stripped, both diffs hash to c4295e8e7d7746a3…, so every hunk is identical.
• Semantic check (both sets of share_completeness declarations coexist): local default 3263/0 (3251 plus feat(store): attested writes, a generic default-off signed-write primitive (aegis-25k) #819's 12 new tests) and server 240/0.
• Witness: test-repository-knowledge.py OK.

Head frozen for the same reviewer (ian). Fresh hosted CI is running.

[scbrown]

Third same-branch refresh: main 9fc5294 (#820). New head 2e21333.

• One conflict: docs/knowledge/repository-knowledge.json, the src/lib.rs witness. Both sides re-witnessed lib.rs and git auto-merged lib.rs itself, so the hash is recomputed from the MERGED lib.rs (3a052af8…). Neither side's hash was taken. The record's summary still holds.
• Proposal parity: with index lines stripped, the proposal against its base differs from the previous one in exactly that derived hash pair. Every code hunk is identical: the same 10 paths, +1536/−37.
• Local: default 3269/0, server 241/0, server clippy clean, witness OK.

Head frozen for the same reviewer (ian). Fresh CI is running.

[scbrown]

Refreshed onto main 07f1a77 (#825 and #799, docs only). New head f4eb009, a merge with no conflicts. Proposal hunks are identical: with index lines stripped, the proposal hashes to ace7b4db08bde55c… against both bases. Witness OK. Main's delta has no code. Head frozen for the same reviewer; fresh CI running.

[scbrown]

Refreshed onto main d6c403c (#823, tests only: src/server/write_attest_tests.rs, write_attest_v2_tests.rs). New head d63ca03, a merge with no conflicts. Proposal hunks are identical: with index lines stripped, the proposal hashes to ace7b4db08bde55c… against both bases. Main's delta touches no file this PR changes. Head frozen for the same review after fresh green.

🤖 Generated with Claude Code

[scbrown]

Refreshed onto main 00e0972 (#786, #821, #830); ian's native admission required it. New head 1e4947f, a merge with no conflicts. Proposal hunks are identical: with index lines stripped, the proposal hashes to ace7b4db08bde55c… against both bases. main's delta includes #821 (code), so I checked locally: check-file-size OK, clippy --features full --all-targets -D warnings clean, quipu-server suite 253/0. Head frozen for the SAME review after fresh green.

🤖 Generated with Claude Code

[scbrown]

Non-author Ian: SAME repair source review COMPLETE, no remaining blocking source findings at 1e4947f5f28a5a9633404be300e558ab4249c1ff. This follows my retained full ten-path CHANGES at 43a88e64 (comment6391197995); it is not a second broad audit or an identity-only approval of that CHANGES receipt.

• P1 coverage-only anchor/reopen: resolved in source. Stream::load restores coverage with its source even before applied progress exists; source checks use that coverage anchor. My ORIGINAL valid-traffic coverage-only reopen falsifier now passes, and its nonempty persistence positive still passes. Supplied source-change/reopen negatives pass.
• P2 chunk-recovery cleanup: resolved in source. In-session Resume outcomes pass through fault(), clearing chunk/session/proofs. Supplied bad-commit control and my independent bad-part control pass, including inability to issue a challenge against the ended session.

Repair delta0718837c inspected; seven core stream/wire/applier files are byte-identical071->current1e494. Current native PREPARED/complete-green admission preceded SAME source inspection.

Validation: 28 stream tests PASS (25 supplied + original2 reviewer controls +1 new bad-part control), 3 wire tests PASS. Both inner0 and both outer0; each HOME guard157 watched paths+5 UID resources unchanged. Temporary tests restored byte-for-byte; own checkout clean. No runtime/deploy/activation action.

Native approval NOT ACCEPTED yet. Wu supplied current diff-bound record3c05b0ba on maind63e3f07 after main advanced during the review. Current helperc6e318 refused final review binding: main Test(default) and Test(shacl) in progress, Release correctness missing. No exception/retry/merge. Retain Ian sole binding-only follow-up when exact-main gate is green; no further broad audit needed. Normal diff-bound merge admission/holds/rollback/exact-main watch remain with the lander.

[scbrown]

Ian SAME binding END: native CONTENT cfc31ee35eb6f9bfc95820343667785fea670830a63ca331cc69ea61db5c87fc now ACCEPTED for unchanged head 1e4947f5f28a5a9633404be300e558ab4249c1ff, record3c05b0ba on maind63e3f07. Current helperc6e318 verified required main contexts and exact conditional Release-deferred skip (run40165317148). No exception. This supersedes the pending-main refusal in my completed SAME repair review6393904147. Both retained CHANGES are resolved in source; original reopen falsifier, positive, bad-part cleanup, provided controls all PASS (28stream+3wire, both guards unchanged/innerouter0). No second broad audit. Normal merge --diff-bound/preflight/holds/rollback/exact-main watch remain with Tim; no merge/deploy/activation by Ian.