Repository navigation
feat(kernel): complete P02b-4 transactional job runtime - #32
Merged
Merged
Conversation
Make successful enqueue an immediate atomic write with trusted execution metadata and explicit identifier-only routing. Refuse stale, foreign or unowned frames before persistence and retain production receipts across absorbed failures without changing event-free execution. ADR: 0057
Distinguish the phase-entry inventory from current producer delivery and record the first independent review round without rewriting entry evidence. ADR: 0057
A persisted event with no subscriber cannot reveal accidental delivery. Observe the resolved transport with a positive control and close both independent outbox review rounds against the passing database proof. ADR: 0057
Collect facts only after their source save succeeds and retain their invocation origin until physical-owner completion. Translate completed tenant provisioning into one pending outbox row on the same commit as both business roots and MUST audit, with no subscriber delivery yet. ADR: 0057, 0040, 0042, 0044
Record two fresh independent reviews and their focused passing repeats before starting the producer enforcement step. ADR: 0057
Keep producer guarantees measurable across complete assembly censuses and transitive helper paths, with deliberate dirty and clean controls. Align the catalogue and authoring guidance with delivered producer capabilities while retaining dispatcher and consumer ownership in their named packets. ADR: 0057 Module: Tenancy, Customization, Audit
Expand the producer and domain-handler walks to derived implementations so normal class dispatch cannot bypass their capability checks. Plant dirty and clean class paths and verify the interface-only regression fails. Reconcile the lease migration's existing-row premise. ADR: 0057
Record complete producer delivery with exact local evidence, verified review fixes and preserved decision history. Keep PR approval separate and name the remaining dispatcher and consumer decision passes. ADR: 0057
Keep private browser diagnostics contained while distinguishing launch, hydration and document-fallback failures in the existing CI proof. The first PR run failed without identifying the browser operation; preserve all assertions and deadlines while making the next result actionable. ADR: 0055
Align current-state references with delivered producer completion and keep durable ordering, dispatch and inbox obligations with their owning packets. Process-local serialization is not a durable ordering proof. ADR: 0057
Remove the remaining durable-order equivalence claim found during the independent CI follow-up review. Partition serialization is process-local; P02b-2 G3 still owns ordering across commits and retries. ADR: 0057
Keep XML guidance consistent with the corrected architecture and glossary. Process-local invocation serialization does not decide durable ordering across concurrent commits or retry, which remains P02b-2 G3. ADR: 0057
Always run browser cleanup without allowing its failure to replace the original diagnostic phase. A cleanup-only failure remains classified as shutdown, and neither path exposes private exception text. ADR: 0055
Retain the first failed browser receipt and distinguish the subsequent passing integration evidence from an established cause. Record bounded diagnostics, verified review corrections and their independent reviews; the PR checks own final-head CI approval. ADR: 0057
Exercise actual outbox receipts and require positive intent and owner write observations so missing production work cannot pass these tests. ADR: 0057
Keep the review follow-up traceable to verified regressions, controlled mutations and independent reviews without claiming new runtime behavior. ADR: 0057
A live transaction means frame completion refused before COMMIT. Route that failure through guarded rollback so durable audit records the known failure and cleanup cannot replace its original exception. Prove actual business/outbox rollback and raw event-save admission in both hosts. ADR: 0033, 0040, 0057
Keep shared transaction state inside the sequential-execution census, with exact exceptions for independent singleton flights. Distinguish private browser proof failures without exposing their source. Reconcile uncached settings ownership and correct the historical clause locators without changing accepted decisions. ADR: 0033, 0040, 0041, 0057
A closed phase token alone cannot prove that an error was sanitized. Use the same private brand at the outer proof boundary, retaining sanitized first-error identity while refusing forged raw messages. ADR: 0055
Record the independently verified pre-commit audit correction, bounded proof changes and both completed review rounds against actual local regression counters. Preserve historical evidence and keep exact-head CI ownership separate from local results. ADR: 0033, 0040, 0041, 0057
An absorbed SQL failure must not leave the producer unit eligible for completion. Mark it rollback-only at the insert boundary while retaining successful-production receipts only for completed inserts. Exercise both rethrow and absorption against PostgreSQL and align the audit ownership and delivered producer documentation with the shared coordinators. ADR: 0040, 0057
Record the reproduced INSERT failure, both independent review rounds and full backend regression without changing accepted decisions or claiming dispatcher or consumer delivery is implemented. ADR: 0057
Record the verified squash merge and final PR evidence so current status carriers agree on the completed producer packet and P02b-2 decision pass. Preserve dated records and published development history while bringing in the merged main base. ADR: 0057
Define the producer dispatcher and coupled subscriber recovery contract before enabling durable delivery. Preserve unready provisioning events and require fenced terminal transitions with atomic MUST audit. Record four implementation steps and two completed proposal review rounds. Keep ADR-0046 Proposed until maintainer approval; runtime and Accepted ADR bodies are unchanged. ADR: 0003, 0006, 0010, 0033, 0038, 0044, 0046, 0057
Bind terminal audit identity to the actual fenced transition and name negative controls for the bypass-role write boundary. Clarify Pending holds, publication eligibility, inbox completion and retry ownership. Record verified external-review dispositions and exact acceptance carrier replacements without changing Accepted ADRs or runtime code. Keep the revised decision package Proposed pending maintainer approval. ADR: 0046, 0044, 0057
Record maintainer approval before runtime implementation, preserving prior accepted decisions and dated producer delivery evidence. Register the recovery and row-bound audit obligations without claiming delivery. ADR: 0046, 0003, 0006, 0010, 0033, 0038, 0044 Module: Tenancy, Audit
Establish the accepted lease state and explicit event readiness before activating dispatch. Constrain the worker credential at configuration and physical-connection boundaries while preserving legacy event facts. ADR: 0046, 0003, 0033, 0044 Module: Tenancy, Audit
Keep mandatory reviewer instructions aligned with the accepted transport ownership while preserving the earlier dated architecture note. ADR: 0046
Fail invalid delivery composition before a stored event can be claimed. Exercise the existing discovery gap and a closed generic accepting control, with a mutation check proving the refusal is load-bearing. ADR: 0046
Record independent verification of the composition fix and synchronize current delivery status before starting fenced transitions. ADR: 0046
Use the real compiled record output rather than an internal property that generated ToString omits. Keep unexpected record members unknown and preserve closed failure-only observation. ADR: 0062, 0063
Record the actual-record correction and fresh second approval alongside complete predecessor results. Keep both failing cases and final-source A/B qualification open rather than treating diagnostics as a fix. ADR: 0062, 0063
The hosted pause proof cannot distinguish an unentered heartbeat from a provider call or cleanup that has not returned. Retain bounded in-memory phase and count observations without granting them lifecycle authority, and export only closed failure facts through the existing CI diagnostic. Include the verified capacity-control source in the same finite map. ADR: 0047, 0059, 0063
Keep both independent approvals and their actual control evidence distinct from the still-unresolved hosted failures and final-source qualification. ADR: 0063
Keep execution-focused fixtures independent of the bridge repair grace when a native hint skips the ACK row lock. Preserve body failures during explicit cleanup and observe physical opening separately so hosted failures retain their original bounded diagnostics. ADR: 0047, 0059, 0063
Apply the verified handoff prerequisite to execution-only capacity and cleanup scenarios so their waits cannot accidentally test the separate repair grace. Preserve the original assertions, bounds and bridge tests. ADR: 0047, 0063
Record both independent rounds for the native diagnostic and adjacent execution qualification corrections without attributing historical hosted failures or closing the final-source A/B gate. ADR: 0063
Use the guarded driver's asynchronous DNS and socket path behind the stock synchronous factory. This avoids its verified positive-fraction socket timeout truncation without abandoning actual acquisition or weakening the physical role guard. Keep initializer awaits context-free and prove path selection, actual completion and role refusal in Postgres. ADR: 0047, 0058, 0059, 0063
Cover bootstrap's remaining synchronous acquisition at the same guarded source entry as the vendor factory. Preserve authority before lazy source resolution and join the real asynchronous acquisition without duplicating adapter logic. Exercise both callers with the held initializer and prove the old common driver call fails both planted controls. ADR: 0047, 0058, 0059, 0063
Record both independent correction reviews and keep source-specific failed receipts distinct from live final-source qualification. Point the primary status carriers at the open PR for subsequent immutable A/B evidence so a historical failed run does not become the current source's status. ADR: 0063
Execution and cleanup subjects must not depend on an initial stock hint acquiring an ACK-locked row before the accepted repair grace expires. Qualify actual entry or committed handoff with one route-correct stock hint, while preserving natural bridge, fairness and no-admission proofs. ADR: 0047, 0059, 0063
Retain both independent approvals and source-specific validation before final hosted qualification resumes on the reviewed execution fixtures. ADR: 0063
Observe the owned application pool rather than immediate database-wide session counts, and join every qualification hint before exact native work snapshots. Preserve held callbacks and reject omitted factory cleanup. ADR: 0047, 0059, 0063
Retain both independent reviews and actual restoration controls before resuming final-source hosted qualification. ADR: 0063
Expose unresolved capacity recovery without releasing its reservations, exercise the production admission owner in checkpoint proofs, and anchor published distribution checks to the reviewed checkout. Preserve fork CI identity and closed refusal diagnostics; reconcile live job documentation. ADR: 0047, 0058, 0063
Remove remaining live payload and activator authority descriptions found by the first independent correction review. Record both reviews and their verification without changing accepted decisions or historical evidence. ADR: 0047, 0063
Pin CI dependencies and refuse incomplete lifecycle comparisons while preserving exact artifact identity. Add independent worker/event boundary proofs, preserve explicit retry hints and reconcile source-specific evidence and current documentation. Keep quota accounting a proposal until its commercial meaning is selected. ADR: 0047, 0057, 0063
Align the live error-handling contract with explicit retry hint preservation and record the independent correction review.
Record both independent rounds, their verified correction and validation limits. Keep dependency update automation outside this minimal fix; exact CI dependency pins remain enforced. Quota accounting still requires the maintainer's commercial choice.
Record the maintainer's explicit choice before implementing the shared registration guard. Count distinct nondeleted custom keys, share revision slots, exclude the built-in card and serialize tenant-wide admission. ADR: 0021
Serialize tenant-wide count and registration before the existing concept lock. Apply the approved distinct-key accounting without changing default unlimited entitlements or lifecycle authority. Keep hard-limit refusals consistent across HTTP, audit and job classification. Register both CI Python tools in the exact source inventory; unknown formats still fail closed. Retain the failed CI and planted-lock evidence. ADR: 0021, 0040, 0045 Module: Customization I18n: lockey_limit_exceeded
Record independent contract and PostgreSQL inspection and distinguish current Debug review runs from rebuilt full Release evidence. Link the hard-limit error mapping to its existing entitlement decisions.
Record both fresh quota reviews, current Release and PostgreSQL proofs, and the complete frontend source inventory correction. Freeze the source for renewed exact-head CI; historical results remain source-specific.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Approach
The existing transaction owner commits business state, produced work, audit and job completion together. External effects run outside business transactions. Positive outcome/quiescence receipts, immutable failure policy and stored-row witnesses govern capacity release, retry and finalization; unknown effects keep their reservations.
All nine runtime steps and all three ADR-0063 implementation steps completed two independent review rounds and verified corrections. Subsequent verified corrections also completed two fresh independent reviews. The delivery record owns source-specific evidence and the accepted availability limits.
CI uses one base, six Architecture, twelve ordinary Docker and one native execution VM. Each execution retains its twenty-minute ceiling; both fail-closed aggregates retain five minutes. The seven required names and branch protection are unchanged. Only aggregates receive Actions read permission; they independently verify current-attempt jobs, immutable artifacts, complete case/result unions and the common base witness.
Tests
Final development head
1261c38268ff194a047f987c4ee8ffdb68ab1382passes both complete assignments of run 39253376497. Each attempt succeeds in all 27 jobs and all 5,505 backend cases, with zero skips. Both were independently reconstructed from all twenty execution archives and both aggregate ZIPs while each complete set was available.Each exact union contains 3,062 non-Docker cases (2,471 Unit, 410 Architecture, 177 HTTP and four Contract) and 2,443 Docker cases (2,412 ordinary and 31 native). Actual completed protocol, TRX identities/outcomes, API artifact digests, source/merge binding and current-attempt job ownership agree. No skipped, censored or forced-cleanup result qualifies. Frontend, meta, secret scan, OpenAPI and public demo/Lighthouse succeed in both attempts.
Both attempts use GitHub-generated PR #32 merge-ref commit
d062b67ed79f9c85d46d8faab44189e20b959729, whose verified second parent is the development head above. Source, plan, manifest and actual toolchain agree. Actual co-membership differs in Architecture, ordinary Docker and SharedSchema: 218/254 Architecture and 992/1085 ordinary selector groups change owner. Maximum execution-job walls are 846 s (A) and 812 s (B), below 1,200 s. All four aggregate jobs remain below 300 s; pre-upload processing takes 16.441/31.655 s (A backend/integration) and 11.347/17.068 s (B). Queue time is separate. Whole-configuration API readback confirms branch protection is unchanged, including all seven strict app-bound contexts.121879975379b34b0a92d55ecd74555224987e3bf11dbcc9680d0e5fb7e694f3823ecac7a41121873543694eac0bacedd3f30e99472db97eb8cd20a44c7855bdd085a8d0b4927d57063e5f1219135524618b1f18c57cabe19ad07e9aa7b7890f1e33364bd3cc9697e906fa381b8488400121915204220482a80e92d608f06f305ff9b2bd749df36f0ee44fc0366c90104f1fbd8565eeArtifact availability is narrower than verification performed at the time. All 22 A ZIPs and their API metadata/hashes were downloaded and independently verified before starting B. Final readback returns HTTP 404 for all 22 A artifact IDs; the API lists none of them. B's 22 archives remain available and independently verified. No deletion cause is inferred; the current API cannot independently reconstruct A.
The complete retained review bundle contains 44 ZIPs, both independent receipts, captured API metadata, the A/B comparison, source-hash manifests, availability observations and protection readbacks:
learnstack-pr32-evidence-39253376497.tar.gz(40,974,306 bytes), SHA-256028de8d8d2bc6584a90e84f16755187cd2c32d600c2e80d98ad3ea19e18ce98d. It is available in the shared local review workspace, rather than through a GitHub download link. Theverify-retained.pyentry point is inside that archive, not in repository scripts. From the extracted bundle directory, runpython3 verify-retained.py /path/to/qualified-checkout, with the checkout at1261c382. Offline reconstruction of both attempts passes with the frozen source validators and captured responses. This checks retained integrity and results; it does not reauthenticate unavailable API responses or rerun tests.Verified review corrections:
403 limit_exceeded, Denied audit and permanent job classification. Existing unlimited default entitlements and deletion/restoration authority are preserved. Two fresh independent review rounds pass. A real lock-removal mutant fails; exact restoration and the positive PostgreSQL controls pass.jobshealth unhealthy while preserving reservations. Real PostgreSQL proves peer parking and original-owner late positive cleanup. Checkpoint controls invoke production admission; tenant observation, zero budgets and held acknowledgements have independent controls.Supplementary local checks pass: full Release solution build with zero warnings/errors, format verification, 2,471 Unit, 177 HTTP, four Contract, 41 affected PostgreSQL and the full guarded frontend's 1,625 tests, with zero skips/todos. All 51 plan/aggregate, seven supply-chain and seven ADR-lifecycle controls pass. Independent reviewers confirm current Release discovery/results and 607 document links. Earlier focused PostgreSQL, recurrence, distribution and native-owner receipts remain in the delivery record; the complete final-source A/B results above close hosted qualification.
Risk
Migration / Rollback
Apply the complete migration chain before API startup. The migration role installs the pinned vendor schema and exact grants; runtime DDL is disabled. Validate guarded dispatcher/application connection configuration and topology bounds before activation.
Stop workers before a reviewed rollback. Real-PostgreSQL proofs cover exact inventory restoration; incompatible retained history refuses migration rather than inventing failure policy. Do not manually reset unresolved external-effect/capacity state.
Related
Prepared with Codex.