Q4: Label transcript sources and correct zero byte-tail behavior

toasterson commented

2026-10-19 09:11:16 +00:00

Owner

Q4 makes transcript provenance explicit. Stored JSONL archives return source/transport, actual fetched bytes, exact omissions, record-boundary/partial-record and malformed JSON metadata. Omitted tail_bytes defaults64KiB; zero requests whole content up to1MiB; negative/noninteger values are invalid. Completeness stays unknown.

Only an absent archive row permits a canonical native activity projection. It verifies the exact session/WI, bounds SQL payload excerpts and final serialized JSONL, returns stable sequence cursor/has_more/elision metadata, and identifies central/runner transport with archive_state=missing. It is explicitly non-lossless, with unknown total/omitted bytes and event/terminal completeness. Existing archive/storage/UTF8 errors remain errors.

The shared artifact authorization boundary now enforces exact WI for WI-bound tokens and project WorkItemRead RBAC for PATs. Plan/companion project bindings retain their existing scope. No lifecycle or token-scope expansion. Contract: docs/ai/contracts/transcript-read-v1.md.

Validation: 558 server lib tests passed/6 environment-dependent ignored. Full-schema disposable PostgreSQL plus a signed fake S3 HTTP peer passed source selection,12 huge native events through byte-bounded cursors without duplicates, same-project foreign WI/session denial, archive-row error preservation, actual default/zero/>1MiB tail boundaries and invalid negative input. Unit fixtures cover UTF8/malformed JSONL/giant partial records. Nightly runs the new database fixture; scoped formatting, diff/shell checks and CI dry-run pass.

Solstice exact-head CI/review pending under the round16-owned shared dispatch incident. Local tests are distinct from CI/deployment/runtime acceptance. Do not merge: operator human gate. No live recovery or deployment performed.

ACL scope note: shared resolve_wi_for_artifact is used by seven tools: list_sessions, get_session_transcript, get_dispatch_prompt, list_changes, get_change, get_wi_loop_state and get_work_item_forensics. Exact-WI session binding therefore tightens all seven; plan/companion project binding remains supported, PATs require project WorkItemRead. Follow-up adds direct same-project foreign-WI denial tests through the other six handlers. Independent Fable review approved; CI remains pending.

Follow-up validation: full PostgreSQL archive/native/S3/tail fixture passed again, including direct foreign-WI denial through all seven handlers. Source behavior is unchanged; follow-up adds tests and ACL documentation only.

Exact-head CI follow-up: Solstice rust job830f40e2-64e7-48d7-a3a3-201bdad15773 at98f1cac6 failed on three Clippy lints after tests passed. Normal follow-up76cbc9c55528c864a9542d9abeb60a2d3ccafd2a fixes only those expressions. Matching local cargo clippy -p anima-server --all-targets -- -D warnings passes; post-push clean/remote-bound PostgreSQL rerun passes (q4-ci-fix-exact-pg.log.receipt.json). New exact-head Solstice jobs remain required; no blind rerun.

Integration refresh (2026-10-19): normal main/dependency merge commits, no force push. Main is 8d3eb5855f. The job.sh resolution retains transcript_read_contract, session_cost_summary and merge_conflict_diagnostics, matching the validated definitions. Shell/Rust syntax, diff and predecessor-ancestry checks pass. No fresh local cargo check: available disk headroom above the 31.25 GiB floor was smaller than the last measured owned compile target. Exact new-head CI is the gate; prior receipts remain prior-head evidence.

Q4 makes transcript provenance explicit. Stored JSONL archives return source/transport, actual fetched bytes, exact omissions, record-boundary/partial-record and malformed JSON metadata. Omitted tail_bytes defaults64KiB; zero requests whole content up to1MiB; negative/noninteger values are invalid. Completeness stays unknown. Only an absent archive row permits a canonical native activity projection. It verifies the exact session/WI, bounds SQL payload excerpts and final serialized JSONL, returns stable sequence cursor/has_more/elision metadata, and identifies central/runner transport with archive_state=missing. It is explicitly non-lossless, with unknown total/omitted bytes and event/terminal completeness. Existing archive/storage/UTF8 errors remain errors. The shared artifact authorization boundary now enforces exact WI for WI-bound tokens and project WorkItemRead RBAC for PATs. Plan/companion project bindings retain their existing scope. No lifecycle or token-scope expansion. Contract: docs/ai/contracts/transcript-read-v1.md. Validation: 558 server lib tests passed/6 environment-dependent ignored. Full-schema disposable PostgreSQL plus a signed fake S3 HTTP peer passed source selection,12 huge native events through byte-bounded cursors without duplicates, same-project foreign WI/session denial, archive-row error preservation, actual default/zero/>1MiB tail boundaries and invalid negative input. Unit fixtures cover UTF8/malformed JSONL/giant partial records. Nightly runs the new database fixture; scoped formatting, diff/shell checks and CI dry-run pass. Solstice exact-head CI/review pending under the round16-owned shared dispatch incident. Local tests are distinct from CI/deployment/runtime acceptance. **Do not merge: operator human gate.** No live recovery or deployment performed. ACL scope note: shared resolve_wi_for_artifact is used by seven tools: list_sessions, get_session_transcript, get_dispatch_prompt, list_changes, get_change, get_wi_loop_state and get_work_item_forensics. Exact-WI session binding therefore tightens all seven; plan/companion project binding remains supported, PATs require project WorkItemRead. Follow-up adds direct same-project foreign-WI denial tests through the other six handlers. Independent Fable review approved; CI remains pending. Follow-up validation: full PostgreSQL archive/native/S3/tail fixture passed again, including direct foreign-WI denial through all seven handlers. Source behavior is unchanged; follow-up adds tests and ACL documentation only. Exact-head CI follow-up: Solstice rust job830f40e2-64e7-48d7-a3a3-201bdad15773 at98f1cac6 failed on three Clippy lints after tests passed. Normal follow-up76cbc9c55528c864a9542d9abeb60a2d3ccafd2a fixes only those expressions. Matching local `cargo clippy -p anima-server --all-targets -- -D warnings` passes; post-push clean/remote-bound PostgreSQL rerun passes (`q4-ci-fix-exact-pg.log.receipt.json`). New exact-head Solstice jobs remain required; no blind rerun.  Integration refresh (2026-10-19): normal main/dependency merge commits, no force push. Main is 8d3eb5855f74c616d176b788e2ca881d2f933e3f. The job.sh resolution retains transcript_read_contract, session_cost_summary and merge_conflict_diagnostics, matching the validated definitions. Shell/Rust syntax, diff and predecessor-ancestry checks pass. No fresh local cargo check: available disk headroom above the 31.25 GiB floor was smaller than the last measured owned compile target. Exact new-head CI is the gate; prior receipts remain prior-head evidence.

toasterson added 1 commit

2026-10-19 09:11:17 +00:00