toasterson/Anima
Watch
0
0
Fork
You've already forked Anima
 0
Code Issues 1 Pull requests 89 Projects Releases Packages Wiki Activity Actions 2

Persist canonical central model usage and terminal provenance #803

Open
toasterson wants to merge 37 commits from feat/s3-model-usage-provenance-20261019 into main
pull from: feat/s3-model-usage-provenance-20261019
merge into: toasterson:main
Conversation 0 Commits 37 Files changed 18 +2212 -44
toasterson commented 2026-10-19 11:42:32 +00:00
Owner
Copy link

Current exact head: c12ecb9e4e565df24f92fe46e0fa2ef8b7594946. Current main b083a89ad8224c844a3db37e38167e21184aa163 merged normally, with no history rewrite. Focused main repair #805 is a dependency, addressing only introduced Q1/Q2 fixture lifecycle calls and the Q4 denial expectation. Human order: #805 → #802 → #803 → #804.

Local final-head validation: cargo check -p anima-server --lib PASS; model_usage4 including20k-turn PostgreSQL and receipt-collision/recompute regressions PASS; production central_session_projection PostgreSQL1 PASS. Final-head local200k-row WI reads measured0.047–0.524ms;20k-turn refresh118ms. These new PostgreSQL tests have now run locally at this exact pushed head, as well as in the earlier nightly; the prior CI-only qualification is superseded for these cases.

Final result of earlier identical-production-tree nightly8f262bca: both Rust jobs FAILED,57/64 integration jobs passed each, same7 files /9 named failing tests. Job81d07baf-8a05-4593-a1c7-6cbe6b81bbda pool5213s / runner6083.530548s; job92303809-be59-454a-b045-d63b9d4bf07c pool5303s / runner6123.978662s. Both conflict-check categories passed. All new series PostgreSQL categories passed, including model_usage2. fb26e055 had zero matching Solstice jobs in the20:05Z census.

Exactly those7 files were run on pre-series b4ab5f6a and current main b083a89a. Five operator-scope fixture files and the external_merge lifecycle-guard violation already fail before the series; they remain separate baseline follow-up. Q4 changed one denial expectation; Q1/Q2 added fixture violations masked by that baseline guard. Only those introduced cases are fixed in #805. Do not claim a green full nightly while baseline failures remain. Full attribution/log hashes: analysis-anima-3w/nightly-seven-attribution.md/.json.

Validation-v2 is exactly this #803 head, with no off-PR commits. It contains final #802/#804/#805 heads and current main by ancestry. job.sh remains byte-identical to reviewed8f262bca. Its five source differences from that tree are only the intended fixture/test and CI-test diagnostic follow-ups.

Local receipt log SHA256 28c6674d8f35dea6ab7a59982216733b7606dcfabb5c6550431d3eb1d6de7788. Exact-head remote CI/review remains a distinct operator gate. No merge/deployment/live recovery by this agent.

Central sessions retain typed model/usage/terminal provenance and account immutable runtime turn summaries exactly once. Actual reported models and unknown values stay truthful. Per-call observations and provider snapshots remain non-additive; missing/invalid/uncertain receipts never become zero or executor aliases.

Per-session NUMERIC rollups refresh inside the projection transaction under its existing dispatch row lock. WI reads join their primary keys and never aggregate the journal. The lineage ledger references D1's deterministic receipt by immutable FK, without a second JSON body. Published migrations162/165 keep their checksums. Migration165 converts references and creates the cache;166 replaces only the refresh function with Fable's grouped per-turn anti-join and function-local jit=off, removing the quadratic unresolved-turn plan. Historical missing cache remains unknown until projection or explicit recompute.

Full totals require coverage for every journaled turn and known counts on every receipt. Inclusive input is used directly; exclusive input adds known cache-read/write counts; reasoning is not charged twice. NUMERIC and Q3's exact integer/decimal-string encoding preserve overflow values. Central compatibility columns mirror representable observed totals; model is cleared when none or several actual models were reported.

Accounting states are explicit in detail, D1 query, Q3 state counts and native receipt metadata: complete, incomplete_turns, unknown_usage, uncertain_receipt, session_uncertain, recompute_pending and not_observed. Bounded unresolved-turn IDs explain unknown totals. These are snapshot counts as of the last successful reconcile; journal appends can precede it. Detail exposes refreshed_at. Readers use the view, whose live dispatch flags mask raw-cache staleness. Native counts carry runtime_turn_not_session_total scope. A successful transient savepoint retry records no marker. Exhausted transient persistence becomes recompute_pending; skipped nontransient accounting persistence becomes session_uncertain. Both immediately mask old totals. Cache-refresh failure also updates persisted native labels through its fallback, preserving raw receipt counts.

The audited recompute_session_usage MCP tool requires an operator.write PAT and exact-project work-item update authorization. It rebuilds D1/S3 metadata from the complete immutable journal under the dispatch lock. Only successful full replay clears persistence markers; changed/invalid source remains uncertain. Repair has a120s request budget,10s per-statement timeout and2s lock wait. Failure before commit rolls back; an unconfirmed commit response requires reading canonical state. Lifecycle, ownership, replies and projection cursors never change. Production S3 and D1 ingest use typed errors rather than unwraps. A D1 observation ID reused under another job/turn/generation points to the original immutable row with uncertain=true; it remains a source fault (uncertain_receipt), not a storage gap, and full recompute succeeds.

Native metadata includes observations, usage, transforms and safe terminal provenance in stable sequence slots. Fault.message, prompt contents and arbitrary provider fields are excluded. Context/output refusal, deadline, rate/usage rejection, cancellation, transport and unknown_outcome stay distinct. No usage endpoint polling or content metric labels.

Performance: reran Fable's same200017-event fixture (2006 sessions,100007 receipts,206 WIs). EXPLAIN(ANALYZE,BUFFERS) provenance862.984ms→0.696ms, Q3 WI cost887.044ms→0.185ms; both below10ms. Raw before/after plans and receipt: analysis-anima-3w/s3-perf-before.out, s3-perf-after.out, s3-perf-probe-receipt.json. Before SHA256170755340418b4e55939feb5273b1056d214be57fa91473a69947dec776d6b2e; after73606118f0de61905076056f3d52c19016ff6f9e2ded755a04fdd18cc0b15774. Fable round2 independently measured cost0.159ms/provenance0.199ms and zero rollup drift across2015sessions. Its grouped rewrite preserved all2005comparison rows and reduced a20k-turn mixed-fixture refresh from17.646s to0.673s. The current migration166 SQL-only smoke on a single20k-turn fixture measured131.740ms with exact20M/2M totals; function-local JIT restored the caller setting afterward (s3-r2-sql-smoke-receipt.json, SQLlogSHA256f3ff5b8420840e3ca2d13c1365ab9646daaaaf1194697498508c117cd6d5e9b8). That smoke also verifies collision-pointer source state with both storage flagsfalse. This is SQL-level local evidence, not Rust test execution. New PG regression loads200k unrelated journal rows and rejects read plans touching journal/receipt/diagnostic storage.

Validation: prior clean remote-equal bbd6bf4358 receipt passes3model_usage tests (2PG),1production projection PG,2migration lint; logSHA25613f76a61424c7149c60eafc40a52aa520abca0537a7e201895582037fc068c8c. All-target server Clippy and562lib/9ignored passed before that push. Tests cover replay/reorder/restart, cache conventions, overflow, known-zero-only, mixed legacy, generations, unknown cancelled turns, real23514 persistence failure, failed operator repair rollback, session-token denial, successful audited107/23 repair and real55P03 successful retry. The new cache-failure regression adds a fresh durable third receipt, forces a rollup write failure, asserts masked totals/native uncertainty, then full recompute restores115/27. The final Rust regressions are designated CI-only execution because of the disk floor: 20k-turn mixed-distribution refresh with both5s PostgreSQL timeout and elapsed-time bound, cross-turn/cross-generation immutable-ID collision followed by successful recompute, native cache-write failure/recovery, and bounded recompute lock wait. They have NOT run yet at the final head; exact-head CI remains pending. Rustfmt/parse, shell syntax and diff checks pass. No local Cargo target/build.

Current headfb26e0556b281ddf828acbfbd9fc70fadc0c3d1c includes ordinary preceding-PR dependency merges. Constructor ownership is committed on PRs: #802 fixes the three D1/S1 sites; #803 fixes its own model_usage fixture. Validation/anima-qseries-nightly-v2-20261019 points at this exact PR head; every validation commit is reachable from a PR head, with no validation-only source fix. Last verified mainb4ab5f6a is unchanged.

Merge S3 last after #797→#800→#799→#795→#796→#798→#801→#802, including #804 CI policy. Independent concerns remain separate main-targeted PRs; this diff collapses as dependencies land. The nightly model_usage:: job runs both ignored PG tests. #804 activates the existing pool for full PR diffs touching schema/tests. A commit-mode green alone is not a PG receipt. The exact-head remote nightly job/category/pool evidence will be recorded in patches-anima.md before final series handoff; it is still pending.

Akh #674/#677/#678 provide optional contracts; #801's paired #675 pin is80464684ecc2b9afb7c9978aab8841d14dc55971. No new wire shape. Operator rollout requires compatibility readers first, drained jobs, AKH_DEPLOYMENT=deployed, AKH_RUNTIME_MODEL_EVENT_CONSUMER=model-events-v1 and AKH_RUNTIME_LEGACY_EVENTS=false. Contract: docs/ai/contracts/central-model-usage-v1.md. No main merge, deployment, live recovery, WI acceptance or retry-budget change.

Independent Fable round3 APPROVE at exact8cb4fd053488a983861df4f33c31e0a3e8c92c79, pending exact-head CI. Its670k-journal/285k-ledger/307k-D1 fixture confirms all20k-turn shapes, generic/custom/no-statistics plans, function-local JIT, ID-collision replay and native fallback. Migration165vs166 produces0differing rows across2007sessions; new plans have no correlated loops>1. Known20k first call237ms, mixed20k130ms,100kreceipt case711ms. The Rust delta is read/reviewed only, still NOT executed. Review/evidence: analysis-anima-3w/review-anima-803.md Round3 and review-803-r3-*.out. Exact-head nightly is still outstanding. The subsequent b35a1d20 tree added the ordinary #804 follow-up merge: policy-promoted commit runs alone get configurable reduced concurrency, scheduled/explicit nightlies retain six/default threads, and shallow PR history gets two bounded fetch attempts with visible fallback reasons. At b35a1d20 all S3 Rust/SQL files were byte-identical to approved8cb4fd05. The later8f262bca source fix and its validation are described below. Eight policy tests, shell syntax and merged-tree dry-run pass atb35a1d20; no new Rust test execution is claimed. Nightly job/pool wall time will be recorded once this exact tree executes.

First merged nightly atb35a1d20 failed before Rust tests: both authoritative rust jobs657373a9-770b-4c62-a521-4a43231571f8 andfcd58bb1-a34d-4016-bb01-39d965fad347 hit identical E0277 at MCP post(handle_mcp). Class(a), owned by this PR: R2 multi-statement RawSql::execute makes the recompute future fail Send. Isolated SQLx0.8.6 require_send repro fails before and compiles with two individual SET LOCAL queries; fix8f262bca retains10s statement/2s lock/120s request bounds. Added a no-I/O recompute-future Send regression. No observed pre-existing Docker failure or infrastructure failure: no Rust/PG/Docker test ran. Eight policy+21helper(1skip)+10cache Python tests passed; shallow recovery/promotion worked. All24categories across4jobs downloaded and hashed in analysis-anima-3w/merged-first-nightly-failure-analysis.json.

Failed-run timing from complete Solstice default log: runner14:33:24.820160→workflowfailed14:36:27.564419=182.744259s. Build/test category log spans176.862857s (6573) and156.263510s (fcd5); fcd5 default has no terminal timestamp. The success-only job-wall-time line and pool timer were not reached, so these are compile-failure timings, not completed nightly/pool durations. New exact-head full Rust/PG execution remains required; source unit Send regression is not yet run.

Fix validation at exact8f262bca7df7da86ee188f21d5925b5f6cda078c: guarded cargo check --locked --offline -p anima-server --lib PASSES, including the actual Axum MCP Handler/Send bound (1m56s; source clean; logSHA256a93f7bcd612b2f84410d86a88a7882d9316e811f6cc29fb8aae6aabde66cc6c5). This is production-library compile validation, not unit/PG execution. Isolated before/after compiler repro is preserved in ci-send-repro-receipt.json. Finished own target verified0open files/exclusive Cargo lock and deleted, free32.133GiB. Validation-v2 fast-forwards to this exact PRhead; no validation-only commits, no blind CI rerun. Fresh exact-head nightly execution remains the gate.

Integration refresh (2026-10-19): normal main/dependency merge commits, no force push. Main is 8d3eb5855f. This head also includes refreshed #802 so the agreed merge order cannot repeat the same insertion conflict; its diff narrows as predecessors land. Shell/Rust syntax, diff and predecessor-ancestry checks pass. No fresh local cargo check: available disk headroom above the 31.25 GiB floor was smaller than the last measured owned compile target. Exact new-head CI is the gate; prior receipts remain prior-head evidence. The entire source tree is byte-identical to 8f262bca7d, including the Send fix; tree SHA c0591a40ce. Validation-v2 equals this PR head with no off-PR commits. This is source identity, not a new-head nightly receipt.

<!-- cos-final-train:start --> Current exact head: `c12ecb9e4e565df24f92fe46e0fa2ef8b7594946`. Current main `b083a89ad8224c844a3db37e38167e21184aa163` merged normally, with no history rewrite. Focused main repair #805 is a dependency, addressing only introduced Q1/Q2 fixture lifecycle calls and the Q4 denial expectation. Human order: #805 → #802 → #803 → #804. Local final-head validation: cargo check -p anima-server --lib PASS; model_usage4 including20k-turn PostgreSQL and receipt-collision/recompute regressions PASS; production central_session_projection PostgreSQL1 PASS. Final-head local200k-row WI reads measured0.047–0.524ms;20k-turn refresh118ms. These new PostgreSQL tests have now run locally at this exact pushed head, as well as in the earlier nightly; the prior CI-only qualification is superseded for these cases. Final result of earlier identical-production-tree nightly8f262bca: both Rust jobs FAILED,57/64 integration jobs passed each, same7 files /9 named failing tests. Job81d07baf-8a05-4593-a1c7-6cbe6b81bbda pool5213s / runner6083.530548s; job92303809-be59-454a-b045-d63b9d4bf07c pool5303s / runner6123.978662s. Both conflict-check categories passed. All new series PostgreSQL categories passed, including model_usage2. fb26e055 had zero matching Solstice jobs in the20:05Z census. Exactly those7 files were run on pre-series b4ab5f6a and current main b083a89a. Five operator-scope fixture files and the external_merge lifecycle-guard violation already fail before the series; they remain separate baseline follow-up. Q4 changed one denial expectation; Q1/Q2 added fixture violations masked by that baseline guard. Only those introduced cases are fixed in #805. Do not claim a green full nightly while baseline failures remain. Full attribution/log hashes: analysis-anima-3w/nightly-seven-attribution.md/.json. Validation-v2 is exactly this #803 head, with no off-PR commits. It contains final #802/#804/#805 heads and current main by ancestry. job.sh remains byte-identical to reviewed8f262bca. Its five source differences from that tree are only the intended fixture/test and CI-test diagnostic follow-ups. Local receipt log SHA256 `28c6674d8f35dea6ab7a59982216733b7606dcfabb5c6550431d3eb1d6de7788`. Exact-head remote CI/review remains a distinct operator gate. No merge/deployment/live recovery by this agent. <!-- cos-final-train:end --> Central sessions retain typed model/usage/terminal provenance and account immutable runtime turn summaries exactly once. Actual reported models and unknown values stay truthful. Per-call observations and provider snapshots remain non-additive; missing/invalid/uncertain receipts never become zero or executor aliases. Per-session NUMERIC rollups refresh inside the projection transaction under its existing dispatch row lock. WI reads join their primary keys and never aggregate the journal. The lineage ledger references D1's deterministic receipt by immutable FK, without a second JSON body. Published migrations162/165 keep their checksums. Migration165 converts references and creates the cache;166 replaces only the refresh function with Fable's grouped per-turn anti-join and function-local jit=off, removing the quadratic unresolved-turn plan. Historical missing cache remains unknown until projection or explicit recompute. Full totals require coverage for every journaled turn and known counts on every receipt. Inclusive input is used directly; exclusive input adds known cache-read/write counts; reasoning is not charged twice. NUMERIC and Q3's exact integer/decimal-string encoding preserve overflow values. Central compatibility columns mirror representable observed totals; model is cleared when none or several actual models were reported. Accounting states are explicit in detail, D1 query, Q3 state counts and native receipt metadata: complete, incomplete_turns, unknown_usage, uncertain_receipt, session_uncertain, recompute_pending and not_observed. Bounded unresolved-turn IDs explain unknown totals. These are snapshot counts as of the last successful reconcile; journal appends can precede it. Detail exposes refreshed_at. Readers use the view, whose live dispatch flags mask raw-cache staleness. Native counts carry runtime_turn_not_session_total scope. A successful transient savepoint retry records no marker. Exhausted transient persistence becomes recompute_pending; skipped nontransient accounting persistence becomes session_uncertain. Both immediately mask old totals. Cache-refresh failure also updates persisted native labels through its fallback, preserving raw receipt counts. The audited recompute_session_usage MCP tool requires an operator.write PAT and exact-project work-item update authorization. It rebuilds D1/S3 metadata from the complete immutable journal under the dispatch lock. Only successful full replay clears persistence markers; changed/invalid source remains uncertain. Repair has a120s request budget,10s per-statement timeout and2s lock wait. Failure before commit rolls back; an unconfirmed commit response requires reading canonical state. Lifecycle, ownership, replies and projection cursors never change. Production S3 and D1 ingest use typed errors rather than unwraps. A D1 observation ID reused under another job/turn/generation points to the original immutable row with uncertain=true; it remains a source fault (uncertain_receipt), not a storage gap, and full recompute succeeds. Native metadata includes observations, usage, transforms and safe terminal provenance in stable sequence slots. Fault.message, prompt contents and arbitrary provider fields are excluded. Context/output refusal, deadline, rate/usage rejection, cancellation, transport and unknown_outcome stay distinct. No usage endpoint polling or content metric labels. Performance: reran Fable's same200017-event fixture (2006 sessions,100007 receipts,206 WIs). EXPLAIN(ANALYZE,BUFFERS) provenance862.984ms→0.696ms, Q3 WI cost887.044ms→0.185ms; both below10ms. Raw before/after plans and receipt: analysis-anima-3w/s3-perf-before.out, s3-perf-after.out, s3-perf-probe-receipt.json. Before SHA256170755340418b4e55939feb5273b1056d214be57fa91473a69947dec776d6b2e; after73606118f0de61905076056f3d52c19016ff6f9e2ded755a04fdd18cc0b15774. Fable round2 independently measured cost0.159ms/provenance0.199ms and zero rollup drift across2015sessions. Its grouped rewrite preserved all2005comparison rows and reduced a20k-turn mixed-fixture refresh from17.646s to0.673s. The current migration166 SQL-only smoke on a single20k-turn fixture measured131.740ms with exact20M/2M totals; function-local JIT restored the caller setting afterward (s3-r2-sql-smoke-receipt.json, SQLlogSHA256f3ff5b8420840e3ca2d13c1365ab9646daaaaf1194697498508c117cd6d5e9b8). That smoke also verifies collision-pointer source state with both storage flagsfalse. This is SQL-level local evidence, not Rust test execution. New PG regression loads200k unrelated journal rows and rejects read plans touching journal/receipt/diagnostic storage. Validation: prior clean remote-equal bbd6bf4358fc75494bb9c24e99dab4aedb5fd5b4 receipt passes3model_usage tests (2PG),1production projection PG,2migration lint; logSHA25613f76a61424c7149c60eafc40a52aa520abca0537a7e201895582037fc068c8c. All-target server Clippy and562lib/9ignored passed before that push. Tests cover replay/reorder/restart, cache conventions, overflow, known-zero-only, mixed legacy, generations, unknown cancelled turns, real23514 persistence failure, failed operator repair rollback, session-token denial, successful audited107/23 repair and real55P03 successful retry. The new cache-failure regression adds a fresh durable third receipt, forces a rollup write failure, asserts masked totals/native uncertainty, then full recompute restores115/27. The final Rust regressions are designated CI-only execution because of the disk floor: 20k-turn mixed-distribution refresh with both5s PostgreSQL timeout and elapsed-time bound, cross-turn/cross-generation immutable-ID collision followed by successful recompute, native cache-write failure/recovery, and bounded recompute lock wait. They have NOT run yet at the final head; exact-head CI remains pending. Rustfmt/parse, shell syntax and diff checks pass. No local Cargo target/build. Current headfb26e0556b281ddf828acbfbd9fc70fadc0c3d1c includes ordinary preceding-PR dependency merges. Constructor ownership is committed on PRs: #802 fixes the three D1/S1 sites; #803 fixes its own model_usage fixture. Validation/anima-qseries-nightly-v2-20261019 points at this exact PR head; every validation commit is reachable from a PR head, with no validation-only source fix. Last verified mainb4ab5f6a is unchanged. Merge S3 last after #797→#800→#799→#795→#796→#798→#801→#802, including #804 CI policy. Independent concerns remain separate main-targeted PRs; this diff collapses as dependencies land. The nightly model_usage:: job runs both ignored PG tests. #804 activates the existing pool for full PR diffs touching schema/tests. A commit-mode green alone is not a PG receipt. The exact-head remote nightly job/category/pool evidence will be recorded in patches-anima.md before final series handoff; it is still pending. Akh #674/#677/#678 provide optional contracts; #801's paired #675 pin is80464684ecc2b9afb7c9978aab8841d14dc55971. No new wire shape. Operator rollout requires compatibility readers first, drained jobs, AKH_DEPLOYMENT=deployed, AKH_RUNTIME_MODEL_EVENT_CONSUMER=model-events-v1 and AKH_RUNTIME_LEGACY_EVENTS=false. Contract: docs/ai/contracts/central-model-usage-v1.md. No main merge, deployment, live recovery, WI acceptance or retry-budget change. Independent Fable round3 APPROVE at exact8cb4fd053488a983861df4f33c31e0a3e8c92c79, pending exact-head CI. Its670k-journal/285k-ledger/307k-D1 fixture confirms all20k-turn shapes, generic/custom/no-statistics plans, function-local JIT, ID-collision replay and native fallback. Migration165vs166 produces0differing rows across2007sessions; new plans have no correlated loops>1. Known20k first call237ms, mixed20k130ms,100kreceipt case711ms. The Rust delta is read/reviewed only, still NOT executed. Review/evidence: analysis-anima-3w/review-anima-803.md Round3 and review-803-r3-*.out. Exact-head nightly is still outstanding. The subsequent b35a1d20 tree added the ordinary #804 follow-up merge: policy-promoted commit runs alone get configurable reduced concurrency, scheduled/explicit nightlies retain six/default threads, and shallow PR history gets two bounded fetch attempts with visible fallback reasons. At b35a1d20 all S3 Rust/SQL files were byte-identical to approved8cb4fd05. The later8f262bca source fix and its validation are described below. Eight policy tests, shell syntax and merged-tree dry-run pass atb35a1d20; no new Rust test execution is claimed. Nightly job/pool wall time will be recorded once this exact tree executes. First merged nightly atb35a1d20 failed before Rust tests: both authoritative rust jobs657373a9-770b-4c62-a521-4a43231571f8 andfcd58bb1-a34d-4016-bb01-39d965fad347 hit identical E0277 at MCP post(handle_mcp). Class(a), owned by this PR: R2 multi-statement RawSql::execute makes the recompute future fail Send. Isolated SQLx0.8.6 require_send repro fails before and compiles with two individual SET LOCAL queries; fix8f262bca retains10s statement/2s lock/120s request bounds. Added a no-I/O recompute-future Send regression. No observed pre-existing Docker failure or infrastructure failure: no Rust/PG/Docker test ran. Eight policy+21helper(1skip)+10cache Python tests passed; shallow recovery/promotion worked. All24categories across4jobs downloaded and hashed in analysis-anima-3w/merged-first-nightly-failure-analysis.json. Failed-run timing from complete Solstice default log: runner14:33:24.820160→workflowfailed14:36:27.564419=182.744259s. Build/test category log spans176.862857s (6573) and156.263510s (fcd5); fcd5 default has no terminal timestamp. The success-only job-wall-time line and pool timer were not reached, so these are compile-failure timings, not completed nightly/pool durations. New exact-head full Rust/PG execution remains required; source unit Send regression is not yet run. Fix validation at exact8f262bca7df7da86ee188f21d5925b5f6cda078c: guarded `cargo check --locked --offline -p anima-server --lib` PASSES, including the actual Axum MCP Handler/Send bound (1m56s; source clean; logSHA256a93f7bcd612b2f84410d86a88a7882d9316e811f6cc29fb8aae6aabde66cc6c5). This is production-library compile validation, not unit/PG execution. Isolated before/after compiler repro is preserved in ci-send-repro-receipt.json. Finished own target verified0open files/exclusive Cargo lock and deleted, free32.133GiB. Validation-v2 fast-forwards to this exact PRhead; no validation-only commits, no blind CI rerun. Fresh exact-head nightly execution remains the gate. <!-- anima-main-refresh-20261019:begin --> Integration refresh (2026-10-19): normal main/dependency merge commits, no force push. Main is 8d3eb5855f74c616d176b788e2ca881d2f933e3f. This head also includes refreshed #802 so the agreed merge order cannot repeat the same insertion conflict; its diff narrows as predecessors land. Shell/Rust syntax, diff and predecessor-ancestry checks pass. No fresh local cargo check: available disk headroom above the 31.25 GiB floor was smaller than the last measured owned compile target. Exact new-head CI is the gate; prior receipts remain prior-head evidence. The entire source tree is byte-identical to 8f262bca7df7da86ee188f21d5925b5f6cda078c, including the Send fix; tree SHA c0591a40cea98ec90b568a1a25741032a3d13aea. Validation-v2 equals this PR head with no off-PR commits. This is source identity, not a new-head nightly receipt. <!-- anima-main-refresh-20261019:end -->
Preserve unknown usage and report session cost read failures honestly
All checks were successful
CI / conflict-check (push) Successful in 9m40s
Details
CI / test (push) Successful in 10m39s
Details
7cb654d6f6
Persist typed turn context diagnostics and expose bounded scoped reads
All checks were successful
CI / conflict-check (push) Successful in 46s
Details
CI / test (push) Successful in 8m33s
Details
72c8d0ef49
fix: isolate invalid telemetry from journal and legacy dispatch progress
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
bd369174b4
fix: accept bounded provider display labels without weakening identifiers
All checks were successful
CI / conflict-check (push) Successful in 5m37s
Details
CI / test (push) Successful in 20m37s
Details
17030d469b
Persist canonical central model usage and terminal provenance
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
236b0da8b5
Cache per-session usage and support audited accounting repair
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
bbd6bf4358
Label transcript sources and enforce explicit byte-tail and native cursor semantics
Some checks failed
CI / conflict-check (push) Successful in 8m35s
Details
CI / test (push) Failing after 8m4s
Details
85e43729fe
test: cover all seven artifact tools sharing exact work-item ACL
Some checks failed
CI / test (push) Failing after 6m35s
Details
CI / conflict-check (push) Successful in 8m11s
Details
98f1cac6ff
fix: bind final manager receipt and reject nested false cleanup proofs
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
f93b015b2f
test: retain undelivered retirement Changes before workspace archive
Some checks failed
CI / conflict-check (push) Successful in 1m5s
Details
CI / test (push) Failing after 4m57s
Details
c28019b637
Bound final MCP responses with private lossless artifact receipts
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
f13ccc3164
Fix transcript boundary Clippy findings from exact-head CI
All checks were successful
CI / conflict-check (push) Successful in 37s
Details
CI / test (push) Successful in 6m24s
Details
76cbc9c555
Recover attested cancelled workspaces and keep cleanup retries actionable
All checks were successful
CI / conflict-check (push) Successful in 1m30s
Details
CI / test (push) Successful in 8m28s
Details
7b777d8659
 
# Conflicts:
#	.solstice/job.sh
Scope model result bounds and provide direct read pages
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
839423cee5
Restrict nested model bounds to authenticated Akh dispatches
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
ee277438f4
 
# Conflicts:
#	crates/anima-server/src/mcp/handlers.rs
Keep preceding cleanup fixtures compatible with model auth context
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
ccfb5b52e8
 
# Conflicts:
#	.solstice/job.sh
#	crates/anima-server/src/mcp/handlers.rs
Use model auth context in the accounting repair fixture
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
19485e6b2e
Persist central provider cooldowns and gate fresh admission
Some checks failed
CI / conflict-check (push) Successful in 50s
Details
CI / test (push) Has been cancelled
Details
eeaa095cf3
Refuse oversized final dispatch briefs without losing mandatory input
All checks were successful
CI / conflict-check (push) Successful in 1m5s
Details
CI / test (push) Successful in 9m13s
Details
fd0c99bb8f
Queue usage-limited providers behind durable reset windows and one probe
Some checks failed
CI / conflict-check (push) Successful in 37s
Details
CI / test (push) Has been cancelled
Details
256b2df4a5
Deduplicate unchanged merge conflict notes with durable diagnostic episodes
Some checks failed
CI / conflict-check (push) Successful in 39s
Details
CI / test (push) Has been cancelled
Details
267867c0b7
fix: recover ended limit probes and audit bounded operator clearing
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
465f8fe9f8
Merge Q1 dependency to validate provider and allocation lock scope
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
03ad2d0929
 
# Conflicts:
#	.solstice/job.sh
fix: retain deduped unknown merge refusals when Forgejo wording changes
All checks were successful
CI / conflict-check (push) Successful in 39s
Details
CI / test (push) Successful in 31m32s
Details
d7d009245a
fix: settle cancelled provider probes through completion observation
All checks were successful
CI / conflict-check (push) Successful in 2m7s
Details
CI / test (push) Successful in 7m23s
Details
68a739f929
Merge Q1 cancelled-probe followup into brief-budget dependency
All checks were successful
CI / conflict-check (push) Successful in 3m0s
Details
CI / test (push) Successful in 9m42s
Details
ae9218991c
Select integration CI from complete migration and test PR diffs
All checks were successful
CI / conflict-check (push) Successful in 5m35s
Details
CI / test (push) Successful in 6m55s
Details
3f7c647aab
 
# Conflicts:
#	.solstice/job.sh
# Conflicts:
#	.solstice/job.sh
#	crates/anima-server/src/mcp/handlers.rs
# Conflicts:
#	.solstice/job.sh
# Conflicts:
#	.solstice/job.sh
#	crates/anima-server/src/central_sessions/reviews.rs
#	crates/anima-server/src/central_sessions/staging.rs
#	crates/anima-server/src/mcp/handlers.rs
# Conflicts:
#	.solstice/job.sh
# Conflicts:
#	.solstice/job.sh
#	crates/anima-server/src/mcp/handlers.rs
Merge commit '5e475b6c' into feat/s3-model-usage-provenance-20261019
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
2d42502597
Record paired proof contract provenance at the consumer
All checks were successful
CI / conflict-check (push) Successful in 39s
Details
CI / test (push) Successful in 3m3s
Details
a0b2f2fa40
Merge commit 'a0b2f2fa40' into fix/s2-bounded-tool-artifacts-20261019
All checks were successful
CI / test (push) Successful in 7m29s
Details
CI / conflict-check (push) Successful in 10m26s
Details
3ec13eca07
Merge commit '3ec13eca07' into feat/s3-model-usage-provenance-20261019
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
f8f860c696
Keep native accounting state masked when rollup refresh fails
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
576179c163
Exercise cache failure after a fresh durable usage receipt
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
f51f6a4779
Bound rollup refresh and retain colliding receipt provenance
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
8cb4fd0534
Scope integration limits to promoted commits and deepen shallow PR history
All checks were successful
CI / conflict-check (push) Successful in 1m23s
Details
CI / test (push) Successful in 6m47s
Details
3938abb3f3
Merge reviewed integration-policy follow-up into validation series
Some checks failed
CI / test (push) Failing after 6m41s
Details
CI / conflict-check (push) Successful in 1m32s
Details
b35a1d208c
Keep accounting recompute Send for the MCP handler
Some checks failed
CI / test (push) Failing after 1h42m27s
Details
CI / conflict-check (push) Successful in 45s
Details
8f262bca7d
Merge current main into Q4, preserving transcript and conflict CI jobs
All checks were successful
CI / conflict-check (push) Successful in 41s
Details
CI / test (push) Successful in 15m51s
Details
bce6f02766
Merge current main into Q1, retaining usage and conflict diagnostics
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
42a8e9498b
Merge current main into Q2 with validated diagnostic and CI resolutions
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
c424888e2b
Merge current main into D1, preserving context and conflict detail fields
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
3e48011285
Merge current main into S2, preserving all paged reads and CI jobs
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
25b36af54c
Integrate refreshed Q4 dependency so Q1 merges cleanly in order
All checks were successful
CI / test (push) Successful in 7m33s
Details
CI / conflict-check (push) Successful in 33m34s
Details
7bd713fa2b
Integrate refreshed Q1 and Q4 dependencies before Q2
All checks were successful
CI / test (push) Successful in 7m48s
Details
CI / conflict-check (push) Successful in 21m21s
Details
ebf87a5ceb
Integrate refreshed Q2 dependencies into D1 with validated prompt assembly
All checks were successful
CI / conflict-check (push) Successful in 43s
Details
CI / test (push) Successful in 8m5s
Details
36d3cb084f
Integrate refreshed D1 and Q-series dependencies before S1
All checks were successful
CI / conflict-check (push) Successful in 46s
Details
CI / test (push) Successful in 8m35s
Details
bcfb7ae2ae
Integrate refreshed S1 prefix into S2 and retain all CI targets
Some checks failed
CI / test (push) Failing after 8m40s
Details
CI / conflict-check (push) Successful in 14m4s
Details
55edd630b9
Fix Q1 and Q4 integration fixtures after the merge train
Some checks failed
CI / test (push) Has been cancelled
Details
CI / conflict-check (push) Has been cancelled
Details
7e39db1076
Merge branch 'fix/qseries-merged-integration-fixtures-20261019' into fix/s2-bounded-tool-artifacts-20261019
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
d9adb6d305
Merge remote-tracking branch 'origin/main' into ci/db-integration-policy-20261019
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
be73ff37e6
Merge branch 'ci/db-integration-policy-20261019' into feat/s3-model-usage-provenance-20261019
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
005ace7afa
Bind the limit fixture to the canonical graph phase instance
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
a022fdeb1d
Use canonical lifecycle setup for the Q2 dispatch fixture too
All checks were successful
CI / conflict-check (push) Successful in 39s
Details
CI / test (push) Successful in 10m12s
Details
378d9e154a
Merge branch 'fix/qseries-merged-integration-fixtures-20261019' into fix/s2-bounded-tool-artifacts-20261019
All checks were successful
CI / conflict-check (push) Successful in 47s
Details
CI / test (push) Successful in 21m40s
Details
c37f3cf4a5
Merge branch 'fix/qseries-merged-integration-fixtures-20261019' into ci/db-integration-policy-20261019
Some checks failed
CI / conflict-check (push) Has been cancelled
Details
CI / test (push) Has been cancelled
Details
5cf998de9d
Merge branch 'ci/db-integration-policy-20261019' into feat/s3-model-usage-provenance-20261019
Some checks failed
CI / conflict-check (push) Successful in 38s
Details
CI / test (push) Has been cancelled
Details
20efa68e88
Keep policy fixtures clean and report shallow fallback diagnostics
All checks were successful
CI / conflict-check (push) Successful in 3m47s
Details
CI / test (push) Successful in 27m0s
Details
f088e66c0b
Merge branch 'ci/db-integration-policy-20261019' into feat/s3-model-usage-provenance-20261019
Some checks are pending
CI / test (push) Has started running
Details
CI / conflict-check (push) Successful in 15m40s
Details
c12ecb9e4e
Some checks are pending
CI / test (push) Has started running
Details
CI / conflict-check (push) Successful in 15m40s
Details
This pull request can be merged automatically.
This branch is out-of-date with the base branch
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/s3-model-usage-provenance-20261019:feat/s3-model-usage-provenance-20261019
git switch feat/s3-model-usage-provenance-20261019

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff feat/s3-model-usage-provenance-20261019
git switch feat/s3-model-usage-provenance-20261019
git rebase main
git switch main
git merge --ff-only feat/s3-model-usage-provenance-20261019
git switch feat/s3-model-usage-provenance-20261019
git rebase main
git switch main
git merge --no-ff feat/s3-model-usage-provenance-20261019
git switch main
git merge --squash feat/s3-model-usage-provenance-20261019
git switch main
git merge --ff-only feat/s3-model-usage-provenance-20261019
git switch main
git merge feat/s3-model-usage-provenance-20261019
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Priority
Critical
 The priority is critical

  
Priority
High
 The priority is high

  
Priority
Low
 The priority is low

  
Priority
Medium
 The priority is medium

  
Reviewed
Confirmed
 Issue has been confirmed

  
Reviewed
Duplicate
 This issue or pull request already exists

  
Reviewed
Invalid
 Invalid issue

  
Reviewed
Won't Fix
 This issue won't be fixed

  
Status
Abandoned
 Somebody has started to work on this but abandoned work

  
Status
Blocked
 Something is blocking this issue or pull request

  
Status
Need More Info
 Feedback is required to reproduce issue or to continue work

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
toasterson/Anima!803
No description provided.