#941 - feat(wake): #940 snapshot-datable digests — adapter fd-3 snapshot-metadata channel - stack

Conversation 1 Commits 2 Files Changed 5

+301 -4

2 Commits

Author	SHA1	Message	Date
Jason WoltjeandClaude Fable 5	a54d539eb3	fix(wake): #941 review §2 — snapshot_ts hardening: sha precondition, epoch sanity, future-skew rejection ci/woodpecker/pr/ci Pipeline was successful Details A ts without a valid sha is unverifiable dating — dropped loudly. A future ts yields a negative age (stale reads fresher-than-fresh, the failure class this PR exists to fix) — rejected beyond WAKE_SNAPSHOT_TS_FUTURE_SLACK (default 300s). Epoch sanity (^[0-9]{1,12}$) is validated BEFORE the shell integer comparison so an absurd value cannot error past the guard. All three paths covered by new D12. Manifest now records that snapshot_* absence is deliberately not diagnostic (reviewer observation, PR #941 comment 19475). Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB	2026-07-30 05:42:01 -05:00
Jason WoltjeandClaude Fable 5	bb54e09aec	feat(wake): #940 snapshot-datable digests — adapter fd-3 snapshot-metadata channel ci/woodpecker/pr/ci Pipeline was successful Details A digest locator carried observed_hash + emit_ts but nothing DATING the snapshot, so a consumer could not tell a fresh snapshot from one already superseded at delivery without a tool call (wake-pilot finding fw-wake-digest-snapshot-lag: seq 56 rendered "(none)" from a board revision superseded ~5s before delivery by one adding a FLEET STOP block). Additive + backward-compatible: - detector.sh: invoke the W4 source adapter with fd 3 -> temp file; the adapter MAY write {"snapshot_sha": "<git commit sha>", "snapshot_ts": <epoch>}. Out-of-band is load-bearing: stdout is hashed by the delta gate, so an in-band tip-commit sha would advance observed_hash on every unrelated push. Metadata is ADVISORY and validated (sha ^[0-9a-f]{7,64}$, ts number); malformed metadata drops LOUDLY but never fails the poll or suppresses the wake. Valid fields join the enqueue locators. An adapter that never writes fd 3 is byte-identical legacy behavior. - digest.sh: _locator_line renders snapshot_sha=/snapshot_ts= (scrubbed) beside observed_hash=; snapshot_sha+path upgrades the actionable-tier re-verify hint to one-call `git show <snapshot_sha>:<path>`. With emit_ts already in the header, snapshot age is local arithmetic. - tests: detector D10 (fields land in locators; metadata-only change is NOT a delta) + D11 (malformed metadata: loud drop, wake still fires, no fields); digest Q10 (orientation dating render, no-vestige sibling, actionable re-verify upgrade). manifest 0.6.12; watch-list schema untouched ([1,1]); store/reconcile/beacon unchanged. Closes #940 Co-Authored-By: Claude Fable 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB	2026-07-30 05:13:47 -05:00

Author

SHA1

Message

Date

Jason WoltjeandClaude Fable 5

a54d539eb3

fix(wake): #941 review §2 — snapshot_ts hardening: sha precondition, epoch sanity, future-skew rejection

ci/woodpecker/pr/ci Pipeline was successful

Details

A ts without a valid sha is unverifiable dating — dropped loudly. A future
ts yields a negative age (stale reads fresher-than-fresh, the failure class
this PR exists to fix) — rejected beyond WAKE_SNAPSHOT_TS_FUTURE_SLACK
(default 300s). Epoch sanity (^[0-9]{1,12}$) is validated BEFORE the shell
integer comparison so an absurd value cannot error past the guard. All three
paths covered by new D12. Manifest now records that snapshot_* absence is
deliberately not diagnostic (reviewer observation, PR #941 comment 19475).

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

2026-07-30 05:42:01 -05:00

Jason WoltjeandClaude Fable 5

bb54e09aec

feat(wake): #940 snapshot-datable digests — adapter fd-3 snapshot-metadata channel

ci/woodpecker/pr/ci Pipeline was successful

Details

A digest locator carried observed_hash + emit_ts but nothing DATING the
snapshot, so a consumer could not tell a fresh snapshot from one already
superseded at delivery without a tool call (wake-pilot finding
fw-wake-digest-snapshot-lag: seq 56 rendered "(none)" from a board revision
superseded ~5s before delivery by one adding a FLEET STOP block).

Additive + backward-compatible:
- detector.sh: invoke the W4 source adapter with fd 3 -> temp file; the
  adapter MAY write {"snapshot_sha": "<git commit sha>", "snapshot_ts":
  <epoch>}. Out-of-band is load-bearing: stdout is hashed by the delta
  gate, so an in-band tip-commit sha would advance observed_hash on every
  unrelated push. Metadata is ADVISORY and validated (sha ^[0-9a-f]{7,64}$,
  ts number); malformed metadata drops LOUDLY but never fails the poll or
  suppresses the wake. Valid fields join the enqueue locators. An adapter
  that never writes fd 3 is byte-identical legacy behavior.
- digest.sh: _locator_line renders snapshot_sha=/snapshot_ts= (scrubbed)
  beside observed_hash=; snapshot_sha+path upgrades the actionable-tier
  re-verify hint to one-call `git show <snapshot_sha>:<path>`. With
  emit_ts already in the header, snapshot age is local arithmetic.
- tests: detector D10 (fields land in locators; metadata-only change is
  NOT a delta) + D11 (malformed metadata: loud drop, wake still fires, no
  fields); digest Q10 (orientation dating render, no-vestige sibling,
  actionable re-verify upgrade). manifest 0.6.12; watch-list schema
  untouched ([1,1]); store/reconcile/beacon unchanged.

Closes #940

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB

2026-07-30 05:13:47 -05:00

feat(wake): #940 snapshot-datable digests — adapter fd-3 snapshot-metadata channel #941