[rockyshi1993]

Stage 1 — P0-A S07 P1 capacity/liveness fix (strict scope)

This is a new scoped fix PR, separate from existing M6 draft PR #7. Base is reviewed M5 main @ c873e3edf0f1a78b13178966cdeb408391755170.

Implementation

• Preserve the 2 MiB hard Checkpoint integrity bound, but reserve 256 KiB of error space on every new nonterminal Store write. Reject initial Run creation before it can become unrecoverable. No unbounded waiting accepted by the default SQLite Store.
• Remove arbitrary per-result size thresholds: Agent JSON remains under the existing 2 MiB hard bound, but the full nonterminal Checkpoint must stay below 1.75 MiB. Larger business data is Host-owned, returned via small user-selected references. On an otherwise matching Agent receipt that cannot fit, the Coordinator uses a durable errored(FK_I_CHECKPOINT_CAPACITY) checkpoint/Journaling CAS, preserving original business State and without falsely acknowledging an unaccepted receipt.
• Add fk_i_receipt_index for FlowKit execution idempotency only: immutable namespaced requestId/digest/attempt/original acceptedRevision correlated with the original Journal revision. Insert index and Checkpoint+Journal in one SQLite transaction.
• Retain only 16 recent summaries in the Checkpoint; all accepted receipts remain durably discoverable from SQLite across restarts and M5 signed historical replays. Pre-index inline histories are migrated under a receipt CAS, validated against the original Journal, with no loss of accepted-receipt history.
• Keep Standard root SDK, Program ABI V1, Context and business artifact/storage/GC responsibilities unchanged.

Mandatory verification

• tests/interactive/s07-capacity.test.mjs proves original near-2MiB malicious seed is rejected before writing, and a valid 64KiB receipt can finish from the safe state. A legitimate soft-budget-full waiting Run deterministically reaches errored, not an indefinite waiting.
• Genuine Checkpoint-capacity overflows (including large Host-owned inline results) become durable error states with State unchanged and no false acceptedRevision; a valid 256 KiB result still completes if sufficient total Checkpoint space exists; initial State > active budget rejected before creation.
• Twenty-one sequential Agent receipts demonstrate historic Ack persistence after bounded CP cache eviction, signed M5 replay after proof expiry, tenant-safe Store lookups, and transactional migration of legacy inline history.
• All existing M1–M5 tests, Node22/24 × Ubuntu/Windows CI, website, package, types, docs, security isolation.

Gate and non-goals

Review actual source and negative tests. Fix any failures and rerun CI against exact final HEAD before merge. This PR does not implement Context, user file storage, generic artifact providers, TTL, GC, P0-B/P1/P2, or genuine S13 model integration. M6 PR #7 remains Draft / blocked on S13 after S07 fix.

---

Note

Medium Risk
Touches core Coordinator CAS, receipt idempotency, and SQLite schema/migration paths where mistakes could strand runs or mis-ack receipts; mitigated by explicit capacity guards and broad new S07 tests.

Overview
Introduces the S07 interactive storage contract: the 2 MiB hard Checkpoint limit stays, but nonterminal writes are capped at 1.75 MiB (MAX_ACTIVE_CHECKPOINT_BYTES) so a 256 KiB reserve remains for a durable errored(FK_I_CHECKPOINT_CAPACITY) exit. Oversized initial state, transitions, and inline Agent receipts (including envelope size) are rejected or converted to that terminal path without a false acceptedRevision; large payloads stay Host-owned references.

The SQLite Store gains fk_i_receipt_index and optional getReceipt, written atomically with receipt CAS and journal proof. The Coordinator keeps only 16 recent receipt summaries in the Checkpoint while duplicate/idempotent completion and M5 signed replay resolve older acks from the index (with legacy inline backfill). Documentation, TypeScript types, and tests/interactive/s07-capacity.test.mjs encode the contract.

^{Reviewed by Cursor Bugbot for commit 94bad70. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rockyshi1993]

Stage 1 / S07 P1 fix — final source review and test evidence (2026-11-11)

Reviewed EXACT PR head: 94bad708efc8413b7a6bad6caa5e0a0c78722484. Main baseline: c873e3edf0f1a78b13178966cdeb408391755170. This review concerns only the execution-capacity fix, not M6 S13 or P0-B.

Code and scope review

• Inspected eight changed files: existing canonical/coordinator/sqlite-store/trusted-host, one narrow optional Store type, a focused S07 test suite and two internal docs. No Standard root API, Program routing ABI, business artifact store, Context module, TTL, GC or generic storage provider added.
• No arbitrary 128-KiB result limit. Keep original 2 MiB hard canonicalization bound, while the default SQLite Store admits nonterminal Checkpoints only within 1.75 MiB, holding 256 KiB for durable terminal failure/recovery. A valid 256 KiB Agent result passes when the entire CP has room.
• No perpetual waiting on capacity exhaustion. A matching Host Agent receipt that cannot fit, or a prepare/publish/commit/resume-stage CP that breaches the active bound, commits errored(FK_I_CHECKPOINT_CAPACITY) through SQLite CAS + Journal. Original State and immutable identity remain intact; Pending and Candidate are cleared. An unaccepted result gets no false acceptedRevision. Initial soft/hard overflow rejects before creating the Run.
• Execution-only immutable receipt index: fk_i_receipt_index is namespace-scoped, keyed by runId + requestId, and verifies accepted digest, original acceptedRevision, node/attempt against its Journal. Receipt index insert + CP + Journal occur in one SQLite transaction; a failure rolls back all. CP keeps only 16 recent receipt summaries, while all historical exact Ack lookups remain durable in SQLite.
• Backward-compatible lookup for pre-index inline receipts; at the next accepted receipt transition historical inline entries are verified against Journal and backfilled atomically before compacting the CP cache. M5 signed historical Ack lookup now uses the immutable Store index, including after original proof expiry.
• This is FlowKit execution protocol data only; business payload references and file retention remain Host/Context responsibilities. No automatic SQLite receipt index deletion while an accepted Run remains queryable.
• Scope caveat: new admitted nonterminal CPs must meet the smaller 1.75 MiB budget; existing already-durable older near-2-MiB waiting CPs are read without normalization and a real regression proves their error exit. Live mixed-version Host writers should be coordinated during rollout rather than silently using two different ledger conventions.

Negative and positive proofs

1. Original S07 reproducer is fixed: a near-2-MiB waiting CP seed is rejected before Store mutation, while the prior real 64-KiB Agent result completes successfully.
2. A Store-admitted CP close to the 1.75-MiB active budget plus valid 64-KiB result commits errored, rather than indefinite waiting; State and Journal integrity are preserved.
3. A raw result near the 2-MiB boundary, including one whose receipt envelope exceeds the hard limit, exits durably without raw RangeError stranding a Run.
4. Authenticated signed M5 oversized result is rejected without an Ack and without leaking state; valid 256-KiB inline result remains supported when space permits.
5. 21 consecutive Agent receipts: CP cache stops at 16, while first request's digest/acceptedRevision survives from SQLite even after restart; signed M5 replay after expiry receives the original Ack.
6. Pre-existing full inline receipt history is safely backfilled; tampered SQLite index rows fail closed.
7. A pre-upgrade near-hard-limit already waiting CP can reach durable terminal error without dropping business State. Injected capacity failure at Pending publication and post-acceptance State commit keeps CAS and idempotency coherent.

Verified exact-HEAD matrix

GitHub Actions 42942778808: 7/7 COMPLETED/SUCCESS. Four npm run verify matrices (Ubuntu 24.04 and Windows 2025 × Node 22.13.0/24.22.1): 346/346 tests PASS, 0 FAIL, 0 SKIP in each. Real installed-package and docs examples succeeded in all 4, website succeeded, and both Linux cross-UID Host/SQLite security checks passed.

Review decision: S07 scoped fix PASSES. No known open P0/P1 in this stage's default SQLite/Coordinator capacity behavior. PR #8 can be squash merged only against exact validated head. M6 PR #7 remains Draft until updated to assert the fixed S07 invariant and until S13's genuine model Host/tool-call evidence is obtained. No npm publish, deploy, repository visibility change or P0-B/P1/P2 work authorized.