fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier (reconciled:true, render-tier not class=digest) #922

2026-07-26T08:13:53Z

jason.woltje commented

2026-07-26 08:13:53 +00:00

Closes #920. Part of #892.

FIX 1 (availability): digest.sh cmd_render per-entry QUARANTINE — a render-refused (hard-locator-missing) entry is dead-lettered to $STATE_DIR/dead-letter.jsonl + a loud per-entry alarm, then continue so the rest of the drain delivers (no head-of-line block). Fail-loud preserved (accounted-for, never silent-dropped).

FIX 2 (semantic, AMENDED): reconcile.sh store class UNCHANGED (non-coalescing — literal class=digest was rejected as it coalesces distinct enumerations, breaking R6/§2.3/G3). Instead, RENDER-TIER: digest.sh classifier treats an entry whose locators carry reconciled:true (set only by reconcile.sh, source-unforgeable — the detector locator whitelist cannot express it) as ORIENTATION-tier → skips the §2.1 hard-locator/exit-4 gate.

Red-first (test-wake-digest-quarantine.sh, openssl-independent): malformed-quarantines-and-rest-delivers; enumeration-renders-orientation; two distinct enumerations both survive (anti-collapse). reconcile R1-R9 + store T2 green. Manifest wake 0.6.3->0.6.4 (union with #912). Rebased onto post-#912 main (merge 4de1fa3b).

Closes #920. Part of #892. **FIX 1 (availability):** digest.sh cmd_render per-entry QUARANTINE — a render-refused (hard-locator-missing) entry is dead-lettered to $STATE_DIR/dead-letter.jsonl + a loud per-entry alarm, then `continue` so the rest of the drain delivers (no head-of-line block). Fail-loud preserved (accounted-for, never silent-dropped). **FIX 2 (semantic, AMENDED):** reconcile.sh store class UNCHANGED (non-coalescing — literal class=digest was rejected as it coalesces distinct enumerations, breaking R6/§2.3/G3). Instead, RENDER-TIER: digest.sh classifier treats an entry whose locators carry `reconciled:true` (set only by reconcile.sh, source-unforgeable — the detector locator whitelist cannot express it) as ORIENTATION-tier → skips the §2.1 hard-locator/exit-4 gate. Red-first (test-wake-digest-quarantine.sh, openssl-independent): malformed-quarantines-and-rest-delivers; enumeration-renders-orientation; two distinct enumerations both survive (anti-collapse). reconcile R1-R9 + store T2 green. Manifest wake 0.6.3->0.6.4 (union with #912). Rebased onto post-#912 main (merge 4de1fa3b).

jason.woltje added 1 commit 2026-07-26 08:13:54 +00:00

fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier

ci/woodpecker/pr/ci Pipeline was canceled

Details

6905f84881

Live pilot finding #6 (BLOCKING): a reconciler enumeration enqueued
class=actionable with soft locators {kind,id,path,observed_hash} failed
§2.1's ACTIONABLE hard-locator taxonomy, so digest render exit-4'd the
ENTIRE cumulative-state drain — 4 consecutive timer failures, NOTHING
delivered, including clean unrelated entries (head-of-line blocking).

FIX 1 (quarantine, don't wedge): digest.sh cmd_render's fail-loud pass is
now PER-ENTRY. A render-refused ACTIONABLE entry (no hard locator) is
DEAD-LETTERED to $STATE_DIR/dead-letter.jsonl + a loud per-entry alarm and
EXCLUDED, while the REST of the cumulative set still renders (exit 0). The
bad entry is accounted-for, never silently dropped; one malformed entry can
no longer wedge the whole drain.

FIX 2 (AMENDED — render-tier, NOT class=digest): reconcile.sh's store class
is UNCHANGED (non-coalescing) — the naive class=digest was rejected because
store §2.3/T2 coalescing would silently collapse distinct enumerations
(proven: reconcile R6 goes RED). Instead digest.sh's actionable-classifier
now treats locators.reconciled==true (set only by reconcile.sh; not
source-forgeable) as ORIENTATION-tier: gate-exempt, rendered as an
orientation pointer via _locator_line's digest-class vocabulary. No exit-4,
no wedge, no coalescing loss; §2.3/T2/G3-R6 intact.

RED-FIRST: new test-wake-digest-quarantine.sh (openssl-independent) proves
(a) malformed {kind,id,path,observed_hash} quarantines while a clean sibling
still delivers, (b) a reconciled enumeration renders orientation-tier (no
exit-4), (c) TWO distinct enumerations both survive as separate orientation
renders (anti-collapse — the class=digest silent-drop we rejected), and the
preserved per-entry actionable fail-loud. D2/D6 in test-wake-digest-hmac.sh
updated from whole-digest exit-4 to per-entry quarantine. Wake manifest
bumped 0.6.2 -> 0.6.3 + inventory.

Closes #920
Part of #892

Co-Authored-By: Claude Opus 4.8 <[email protected]>
Claude-Session: https://claude.ai/code/session_0158NZqN2n2ymKFeJAZ4GUCb

jason.woltje added 1 commit 2026-07-26 08:28:30 +00:00

Merge remote-tracking branch 'origin/main' into fix/wake-920-drain-quarantine

ci/woodpecker/pr/ci Pipeline was successful

Details

4de1fa3b9b

# Conflicts:
#	packages/mosaic/framework/tools/wake/manifest.txt

jason.woltje changed title from ~~fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations class=digest~~ to fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier (reconciled:true, render-tier not class=digest)

2026-07-26 08:40:21 +00:00

jason.woltje referenced this pull request

2026-07-26 08:41:03 +00:00

wake/store T10 concurrency flake (pre-existing): intermittent fail on parallel-enqueue race — de-flake the synchronization #923

jason.woltje commented

2026-07-26 08:45:11 +00:00

Record of Review — PR #922 (issue #920): drain quarantine + reconciler-enumeration render-tier — FINAL, CI-GREEN

VERDICT: APPROVE — GO. REVIEWED-HEAD (full-40): 4de1fa3b9b435b14fd5fb21684339e9b195d88fe. CI: TERMINAL-GREEN (Woodpecker 2070, first-try; the pre-existing store-ack T10 flake did not fire).

Review basis

Independent reviewer a303348a (opus, ≠ builder mosaic-coder) at the rebased head — APPROVE, all 6 criteria PASS, criteria 2/3/4 independently REPRODUCED (a prior review agent no-opd; this is a fresh full review):

Scope/provenance — head==4de1fa3b…; mergeable; id2 ≠ commit-author mosaic-coder; body Closes #920 + Part of #892; net delta vs main = only #920s 5 files; reconcile.sh BYTE-UNCHANGED vs main (store class stays non-coalescing); manifest 0.6.4 (union of #912 0.6.3 + #920).
FIX1 quarantine (reproduced) — a malformed actionable {kind,id,path,observed_hash} alongside a clean 40-hex-sha sibling → the malformed one DEAD-LETTERED ($STATE_DIR/dead-letter.jsonl) + LOUD alarm (observed_seq) + excluded; the clean sibling STILL delivered same drain (exit 0). Fail-loud preserved per-entry; no head-of-line block. RED baseline = old whole-digest exit-4.
★ FIX2 security — reconciled:true UNFORGEABLE (reproduced the forge) — set ONLY by reconcile.sh:468; the detector locator whitelist {kind,id,observed_hash}+{repo,path,anchor,remote,branches} structurally cannot express reconciled. Adversarial forge: ran the detector jq filter with reconciled:true in the source def → dropped. A source (raw stdout) cant reach enqueues --locators. So a feeder cannot smuggle an actionable claim past the §2.1 hard-locator gate.
FIX2 render + anti-collapse (reproduced) — two distinct enumerations (reconciled:true) both render as SEPARATE ORIENTATION pointers (count=2, neither coalesced); ACTIONABLE (none); reconcile R1-R9 green; store T2 coalescing untouched (store.sh byte-identical).
Contract preserved — genuine malformed actionable still loudly surfaced (dead-letter + alarm), never delivered as valid; claim-precedence still gated; _has_hard_locator unchanged; #912s _scrub_ctrl intact (D1-D6+H1-H2 pass); D2/D6 assert per-entry quarantine, no unlocated claim delivered.
Gates — shellcheck 0.11 clean; verify-sanitized PASS; test:framework-shell rc=0 normal AND openssl-masked (quarantine harness openssl-independent); prettier clean; firewall jason|woltje|jarvis|dragon-lin=0.

Non-blocking follow-ups

Stale PR title/body prose (corrected in-place to render-tier/0.6.4). Pre-existing store-ack T10 concurrency flake (store.sh byte-identical to main; did NOT fire this run) → filed as #923 (own de-flake, T7/#918 class).

6-check — GO

open/mergeable base main ✓ · 2. CI TERMINAL-GREEN @ full-40 4de1fa3b9b435b14fd5fb21684339e9b195d88fe ✓ · 3. reviewer(a303348a)≠builder + MS-LEAD git-verified rebase, durable RoR ✓ · 4. reviewed==CI==merge-head all 4de1fa3b ✓ · 5. body Closes #920 + Part of #892 ✓ · 6. queue-guard at merge.
GO for id-11 + squash-merge at FULL-40 4de1fa3b9b435b14fd5fb21684339e9b195d88fe. Closes #920 (drain head-of-line-block quarantine + reconciler-enumeration render-tier). This is the 2nd/LAST pre-vector item — on merge the complete pre-vector set (#912 + #920) is landed. Non-executor.

# Record of Review — PR #922 (issue #920): drain quarantine + reconciler-enumeration render-tier — FINAL, CI-GREEN **VERDICT: APPROVE — GO.** **REVIEWED-HEAD (full-40):** `4de1fa3b9b435b14fd5fb21684339e9b195d88fe`. **CI: TERMINAL-GREEN** (Woodpecker 2070, first-try; the pre-existing store-ack T10 flake did not fire). ## Review basis Independent reviewer `a303348a` (opus, ≠ builder `mosaic-coder`) at the rebased head — **APPROVE, all 6 criteria PASS**, criteria 2/3/4 independently REPRODUCED (a prior review agent no-opd; this is a fresh full review): 1. **Scope/provenance** — head==`4de1fa3b…`; mergeable; id2 ≠ commit-author `mosaic-coder`; body `Closes #920` + `Part of #892`; net delta vs main = only #920s 5 files; **reconcile.sh BYTE-UNCHANGED vs main** (store class stays non-coalescing); manifest 0.6.4 (union of #912 0.6.3 + #920). 2. **FIX1 quarantine (reproduced)** — a malformed `actionable {kind,id,path,observed_hash}` alongside a clean 40-hex-sha sibling → the malformed one DEAD-LETTERED (`$STATE_DIR/dead-letter.jsonl`) + LOUD alarm (observed_seq) + excluded; the clean sibling STILL delivered same drain (exit 0). Fail-loud preserved per-entry; no head-of-line block. RED baseline = old whole-digest exit-4. 3. **★ FIX2 security — `reconciled:true` UNFORGEABLE (reproduced the forge)** — set ONLY by reconcile.sh:468; the detector locator whitelist `{kind,id,observed_hash}+{repo,path,anchor,remote,branches}` structurally cannot express `reconciled`. Adversarial forge: ran the detector jq filter with `reconciled:true` in the source def → **dropped**. A source (raw stdout) cant reach enqueues `--locators`. So a feeder cannot smuggle an actionable claim past the §2.1 hard-locator gate. 4. **FIX2 render + anti-collapse (reproduced)** — two distinct enumerations (reconciled:true) both render as SEPARATE ORIENTATION pointers (count=2, neither coalesced); ACTIONABLE `(none)`; reconcile R1-R9 green; store T2 coalescing untouched (store.sh byte-identical). 5. **Contract preserved** — genuine malformed actionable still loudly surfaced (dead-letter + alarm), never delivered as valid; claim-precedence still gated; `_has_hard_locator` unchanged; #912s `_scrub_ctrl` intact (D1-D6+H1-H2 pass); D2/D6 assert per-entry quarantine, no unlocated claim delivered. 6. **Gates** — shellcheck 0.11 clean; verify-sanitized PASS; test:framework-shell rc=0 normal AND openssl-masked (quarantine harness openssl-independent); prettier clean; firewall `jason|woltje|jarvis|dragon-lin`=0. ## Non-blocking follow-ups Stale PR title/body prose (corrected in-place to render-tier/0.6.4). Pre-existing store-ack **T10 concurrency flake** (store.sh byte-identical to main; did NOT fire this run) → filed as **#923** (own de-flake, T7/#918 class). ## 6-check — GO 1. open/mergeable base main ✓ · 2. **CI TERMINAL-GREEN @ full-40 `4de1fa3b9b435b14fd5fb21684339e9b195d88fe`** ✓ · 3. reviewer(`a303348a`)≠builder + MS-LEAD git-verified rebase, durable RoR ✓ · 4. reviewed==CI==merge-head all `4de1fa3b` ✓ · 5. body `Closes #920` + `Part of #892` ✓ · 6. queue-guard at merge. **GO for id-11 + squash-merge at FULL-40 `4de1fa3b9b435b14fd5fb21684339e9b195d88fe`. Closes #920 (drain head-of-line-block quarantine + reconciler-enumeration render-tier). This is the 2nd/LAST pre-vector item — on merge the complete pre-vector set (#912 + #920) is landed. Non-executor.**

Ghost approved these changes 2026-07-26 08:45:51 +00:00

Ghost left a comment

GO — Gate-16 id-11 stamp, pinned to exact FULL head 4de1fa3b9b.
Basis: verbatim FINAL RoR (comment 19126) — independent review APPROVE 6/6 with the load-bearing security REPRODUCED: a forged reconciled:true in a source definition is structurally DROPPED (the locator whitelist cannot express the trust marker; only reconcile.sh:468 mints it), so the orientation-tier reclass opens no smuggling path past the actionable hard-locator gate. Quarantine (dead-letter + per-entry alarm + rest-delivers) and anti-collapse (two distinct enumerations both survive; store class non-coalescing, reconcile.sh byte-unchanged) reproduced; #912's portable scrub intact through the union. CI green first-try. Closes #920 — and with it the COMPLETE PRE-VECTOR SET lands: the §4 vector now adjudicates on a trust layer that genuinely runs in real CI (G6) and a delivery path with no head-of-line wedge class (§1.2). This ruling carries the amended-FIX2 lineage: the store-class/render-tier axis separation, escalated by the builder with empirical proof and amended with ownership. Part of #892. Named executor: Mos (id-11), squash pinned.

GO — Gate-16 id-11 stamp, pinned to exact FULL head 4de1fa3b9b435b14fd5fb21684339e9b195d88fe. Basis: verbatim FINAL RoR (comment 19126) — independent review APPROVE 6/6 with the load-bearing security REPRODUCED: a forged reconciled:true in a source definition is structurally DROPPED (the locator whitelist cannot express the trust marker; only reconcile.sh:468 mints it), so the orientation-tier reclass opens no smuggling path past the actionable hard-locator gate. Quarantine (dead-letter + per-entry alarm + rest-delivers) and anti-collapse (two distinct enumerations both survive; store class non-coalescing, reconcile.sh byte-unchanged) reproduced; #912's portable scrub intact through the union. CI green first-try. Closes #920 — and with it the COMPLETE PRE-VECTOR SET lands: the §4 vector now adjudicates on a trust layer that genuinely runs in real CI (G6) and a delivery path with no head-of-line wedge class (§1.2). This ruling carries the amended-FIX2 lineage: the store-class/render-tier axis separation, escalated by the builder with empirical proof and amended with ownership. Part of #892. Named executor: Mos (id-11), squash pinned.

Ghost merged commit 937a276208 into main

2026-07-26 08:45:52 +00:00

Ghost deleted branch fix/wake-920-drain-quarantine

2026-07-26 08:45:53 +00:00

Ghost referenced this issue from a commit

2026-07-26 08:45:53 +00:00

fix(wake): #920 quarantine render-refused drain entry (no head-of-line block) + reconciler enumerations render orientation-tier (reconciled:true, render-tier not class=digest) (#922)

jason.woltje referenced this pull request

2026-07-26 08:49:19 +00:00

wake/digest quarantine dead-letter alarm: route via WAKE_ALARM_SINK_CMD with per-wake_id dedup (not journal-local — G2a silent-miss) #924

Sign in to join this conversation.