mosaicstack/stack
1
0
Fork 0
Code Issues 88 Pull Requests Actions Packages Projects Releases 15 Wiki Activity

fix(wake): #924 route dead-letter quarantine alarm via WAKE_ALARM_SINK_CMD with per-observed_seq dedup (G2a) (#929)
All checks were successful
ci/woodpecker/push/publish Pipeline was successful
Details
ci/woodpecker/push/ci Pipeline was successful
Details

Browse Source 
Co-authored-by: jason.woltje <jason@diversecanvas.com>
Co-committed-by: jason.woltje <jason@diversecanvas.com>
This commit was merged in pull request #929.
This commit is contained in:
jason.woltje
2026-07-26 11:45:09 +00:00
committed by Mos
parent 13e6ce5e5c
commit 347c1d57c1
3 changed files with 317 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
packages/mosaic/framework/tools/wake/manifest.txt
View File

@@ -98,8 +98,32 @@
# seen-ledger nor observed_seq, so the source is re-enumerated next
# cycle — no obligation loss). Files changed: _wake-common.sh,
# store.sh, detector.sh (+ tests).
# 0.6.6 #924 digest.sh dead-letter QUARANTINE alarm — G2a fix (dragon-lin
# cure-verification follow-up on #920/PR #922). The #920 per-entry
# quarantine alarm was stderr/journal-LOCAL only; a dead-lettered
# entry is STORE-ACCOUNTED (§2.3) so the reconciler never re-flags
# it, so journal-local-only visibility meant an unattended operator
# could PERMANENTLY MISS a real obligation (G2a silent-degradation).
# FIX: the SAME per-entry quarantine alarm now ALSO routes through
# WAKE_ALARM_SINK_CMD — REUSING beacon.sh's (W6/#910) exact
# pluggable off-host alarm-sink adapter contract (operator target
# resolved by-name inside the adapter, fail-closed) — IN ADDITION
# to (never instead of) the existing stderr diagnostic. Per-
# observed_seq DEDUP (entries carry no per-entry wake_id; the
# entry's durable identity is its store-allocated observed_seq,
# #908) via a durable alarmed-set file under STATE_DIR
# (dead-letter-alarmed.set, atomic-written) ensures a still-dead-
# lettered entry is alarmed off-host EXACTLY ONCE per drain/restart,
# never once per re-render; a NEW distinct dead-lettered entry
# still routes its own one alarm. An unconfigured/unreachable
# WAKE_ALARM_SINK_CMD is a LOUD per-entry stderr diagnostic
# (mirrors beacon.sh's fail-closed wording) but does NOT itself
# fail the whole render (per-entry fail-loud, never a whole-drain
# wedge — #920's core property is preserved). digest.sh is the
# ONLY file changed; store.sh/beacon.sh/reconcile.sh are
# UNCHANGED (beacon.sh's adapter contract is reused, not modified).
component=wake
version=0.6.5
version=0.6.6
# Watch-list schema this component consumes, and the INCLUSIVE range of
# schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -117,9 +141,11 @@ schema_max=1
# digest.sh A3 — cumulative-state digest renderer (hard locators,
# two-tier trust, injection/secret scrub). PER-ENTRY
# quarantine: a render-refused entry is dead-lettered +
# alarmed + excluded, the rest still renders (no head-of-line
# block); reconciler enumerations (reconciled==true) render
# ORIENTATION-tier, gate-exempt. (W3, #920)
# alarmed (stderr AND off-host via WAKE_ALARM_SINK_CMD,
# deduped by observed_seq, #924) + excluded, the rest still
# renders (no head-of-line block); reconciler enumerations
# (reconciled==true) render ORIENTATION-tier, gate-exempt.
# (W3, #920, #924)
# sign.sh A5 — non-circular HMAC signer (independent wake_id,
# load_credentials by-name; fills the hmac placeholder). (W3)
# detector.sh A1 — per-host single-instance delta-gated detector daemon