Repository navigation
feat: add native Server discovery and fix owner recovery migration - #2212
Conversation
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
| DiscoveryStatus::Missing, | ||
| CompatibilityReason::DiscoveryMissing, | ||
| ), | ||
| SafeError::Unauthorized | SafeError::Forbidden => ( |
There was a problem hiding this comment.
[P2] 一次瞬时的 get_server_info 失败会把已资格化的连接判定为未验证，并关闭全部操作
Err 分支把 Network / Timeout / Busy / Server / RuntimeNotReady 归为 Unavailable，把 Unauthorized / Forbidden 归为 Denied；这两类状态在下面的逐操作判定中都拿不到 Qualified。同一个 PR 把 connections/session.rs 的 compatibility_verified 从 compatible.is_some() 改成 !supported_operations.is_empty()，于是只要这一个请求失败，supported_operations 就是空 ⇒ compatibilityVerified=false ⇒ MemoryWorkspace / Overview 的 enabled 和 Scopes 的 fieldset 全部关闭，用户已保存并已资格化的连接在重新检查成功前完全不可用。
两点不一致：
- 本文件顶部的模块说明写的是「Discovery observations and operation qualification are independent of health and authorization」，而
Unavailable/Denied恰恰让资格化依赖健康与授权状态。 - 同一批观测里，
/v1/capabilities的 403 只降级capabilities一个字段，不影响资格化；这里把同类拒绝提升为「全部操作不可用」。
only_a_missing_handshake_allows_explicit_qualified_legacy_operations 显式断言了 supported_operations().is_empty()，说明这是有意行为；但触发条件包括与产品无关的瞬时网络错误和 503，而 UI 没有渲染 CheckReport.discovery，用户只能看到「未验证」，无法区分「Server 不兼容」与「刚才那次请求超时」。
建议：Unavailable（以及视取舍的 Denied）时保留已匹配记录的 operations 作为 Qualified，把 discovery.status / reason 作为独立诊断暴露；或至少在前端渲染 report.discovery 的状态与原因。若坚持当前语义，请修正顶部模块说明，并补一条「瞬时 503 恢复后连接重新可用」的用例。
|
Please resolve the merge conflicts with the latest |
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
hidb4ai
left a comment
hidb4ai
left a comment
There was a problem hiding this comment.
One P2 issue remains in operation-specific UI gating; details inline.
| capabilities: capabilities.into(), | ||
| compatibility_verified: compatible.is_some(), | ||
| supported_operations: compatible.map(|c| c.operations.clone()).unwrap_or_default(), | ||
| compatibility_verified: !supported_operations.is_empty(), |
There was a problem hiding this comment.
[P2] Apply per-operation compatibility to the existing UI controls
compatibility_verified now stays true when only part of the operation set is qualified, but NoteForm, MemoryWorkspace, and Scopes still use it as a blanket enable flag. For example, return supported discovery with memory.explicit.operations: ["search_memory"], explicitly select a qualified profile, and select a Scope: remember_memory is correctly marked unsupported/operation_missing, yet the note editor and Save button remain enabled. I reproduced this by feeding the native manager's checked/selected state into NoteForm; saving is then rejected by the native manager with CompatibilityUnverified, and the UI asks the user to select a profile they already selected. Please gate each action on its corresponding supportedOperations entry and expose its restriction reason, while keeping independently supported actions available.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
hireview001
left a comment
hireview001
left a comment
There was a problem hiding this comment.
- Resolve merge conflicts with the target branch.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
jackie-cqz
changed the title
There was a problem hiding this comment.
Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.
An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.
* feat(memory): enforce subject-bound atomic extraction * fix(evaluation): add complete license headers * fix(e2e): configure Kimi scope script guidance * fix(evaluation): pin atomic fixture line endings * fix(evaluation): harden atomic extraction reports * fix(evaluation): detect Chinese imperative verbs * fix(evaluation): scan Chinese imperative clauses * fix(evaluation): normalize imperative prefixes * test(evaluation): cover Unicode imperative prefixes * fix(evaluation): allow attributed preferences * fix(desktop): qualify the current Server contract * revert(desktop): defer contract qualification to #2212 * fix(eval): distinguish attributed preferences from directives
Which issue or RFC does this PR close?
Related to #2101 (PR 01-A), under #2099 and RFC #1455. Delivers native discovery and source-specific protocol qualification. #2101 remains open for deployment identity isolation and the remaining PR 01-B requirements.
Rationale for this change
Desktop checks health, identity and capabilities without consuming the public Server discovery contract. Read discovery through the existing bounded native transport and combine its requirements with explicitly selected qualification evidence.
External relationship-writer deployments create durable ownership intents in
pc_access_owner_recovery, but that table was absent from the registered Server schema, so strict schema validation rejected restart recovery. Register the table in the shared migration chain and bind the compatibility review to the resulting storage contract.What changes are included in this PR?
Generate
get_server_info, wire models and per-operation feature requirements from OpenAPI. Accept compatible discovery minor additions. Invoke the pinned generator JAR with argument arrays to support Windows checkout paths containing spaces.Expose supported/missing/denied/unavailable/invalid/incompatible discovery and qualified/unsupported/unverified per-operation results with reasons through generated IPC types.
Gate native operation availability on discovery and explicit qualification. Only discovery 404 permits qualified legacy fallback; authorization errors, unavailable discovery and incompatible required contracts do not. Missing optional features restrict affected operations.
Add the historical
sqlite-atomic-c535d816-v1qualification, independently verified against an actual built-wheel SQLite Server in all four modes for eleven operations, including discovery. Preserve all source, wheel, contract and operation identities. The current bundled contract uses the upstream source-specificsqlite-atomic-dd62723d-v1andsqlite-atomic-4ffdf4e9-v1records; their ten qualified operations do not add discovery qualification.Show distinct discovery diagnostics and recovery guidance in Connections, including incompatible product/major reasons and safe request errors. Preserve the discovery failure policy: only 404 permits qualified legacy fallback; a successful explicit recheck restores qualified operation availability. Add a native 503 recovery regression and bilingual UI diagnostic/recheck tests.
Gate save, search, exact revision reads (including records returned by a save), Scope lookup and Scope selection on their own
supportedOperationsentries. Show per-operation restriction reasons and independent feature availability in Overview; partial compatibility keeps unrelated actions usable. Add bilingual partial-compatibility regressions and explicit operation sets to existing workflow fixtures.Preserve verbose macOS packaging output and the generated DMG script on build failure, without masking the build exit status.
Add synthetic HTTP regressions, real-Server discovery assertions and bilingual documentation.
Isolate upgrade-gate test fixtures from the inherited
PC_UPGRADE_SOURCE_SHAworkflow variable, so simulated checkout changes exercise the intended fallback identity check while explicit pinned-release checks retain their behavior.Register durable owner-recovery storage through revision
v1_4_1_004for both installed-release sources and the registered vector/Code profiles. Preserve historical revision resources/checksums, update the compatibility review, and protect managed upgrades, repeated application and Server restart recovery.Are there any user-facing changes?
For current-contract Server sources, explicitly select
sqlite-atomic-dd62723d-v1orsqlite-atomic-4ffdf4e9-v1whose recorded source/wheel identity matches the deployment, check the connection and select a Scope. Historical records, includingsqlite-atomic-c535d816-v1, retain their original contracts and remain unavailable for this build. Discovery does not attest arbitrary remote binaries or grant authorization.This provides the native/IPC foundation for #2103. Deployment-aware context fencing and explicit readiness separation remain PR 01-B work; existing checks still perform readiness probes. No HTTP API, credential format or persisted profile format changes. Protocol evidence does not establish installed-package, UI or release acceptance.
Server storage adds the registered
pc_access_owner_recoverytable. Existing registered Server databases require explicitpowercontext server db-migrate plan/apply/verifymaintenance before startup; fresh databases initialize it through the registered chain. Unknown layouts remain rejected. The policy staysupgrade-required; this does not add a supported-upgrade claim.How was this change tested?
Windows 10 x64, Rust 1.95.0, Python 3.11.15:
Full
cargo +1.95.0 test --locked --manifest-path desktop/src-tauri/Cargo.toml: all 61 passed, including the unmodified bundled-product qualification test.Frontend: 116 tests passed; lint/build passed, including generated drift, formatting and TypeScript checks.
Rust formatting, Clippy
--all-targets -- -D warnings, IPC export drift: passed.Focused Python contract/fixture tests: 7 passed.
Upgrade-gate regressions with the CI pinned-source variable set: 124 passed and 6 platform-related skips on Windows (
python -X utf8 -m pytestover the three upgrade-gate/publication/schema files). The checkout-change failure was reproduced before the fixture isolation change.Historical Server c535d81 qualification on 2026-10-23 used an actual built-wheel SQLite Server: anonymous loopback, Bearer, HTTPS with explicit CA/base path, and enforced Provider all passed. Covers discovery, Scope selection, save/search/exact revision reads, Principal changes/revocation, uncertain writes without replay, pagination and independent Server survival.
Repeated all four modes through normal
ConnectionManager::new, selecting the bundled product record without injected qualification. Temporary probe reused existing assertions, changing only manager construction and profile selection; product implementations were unchanged.All 540 wheel runtime files match recorded Git sources after CRLF normalization. Wheel/contract hashes checked; historical catalog records unchanged. See
desktop/VALIDATION.mdfor identities and acceptance limits.Repository hooks passed except default Windows
ty check, which reports POSIX-only attributes in unchanged Python modules.ty check --python-platform linuxpassed.Managed-storage and owner-recovery validation: 192 passed, 63 environment-related skips in the focused migration/upgrade-gate suite on Windows; another 44 maintenance and historical-checksum regressions passed from an isolated working directory without a local
.env. Both previously failing HTTP restart recovery cases passed after registration. Native seekDB/OceanBase execution remains a CI acceptance requirement.Candidate schema replay: 3 passed, 6 native-backend skips on Windows.
Owner recovery migration tests: 5 passed, covering preserved historical checksums and SQLite vector/non-vector upgrades, plus simulated MySQL payload character/index normalization. Simulated SHOW output is not native backend acceptance.
Upgrade policy, action pins, lock consistency, integration manifest/guidance checks and Linux-target type checking passed. Repository hooks retain the existing Windows POSIX type-check limitation.
AI usage statement
Developed and reviewed with OpenAI Codex (GPT-6). Verification commands and real-Server harnesses were executed locally; remaining acceptance limits are recorded above.