Repository navigation
Conversation
Keep Chief proposals separate from Maintainer and Owner approval. Preserve retired role context and room history without reassigning existing Tasks or inferring worker exit.
Keep exact latest Task-role native bindings and context parts, refuse unknown exit and missing handles, and use committed role catalogs when pinning execution rights. Preserve original Workflow lifecycle and legacy DAG workspace behavior.
Keep logical identity separate from artifact responsibility and SDK read-only policy. Preserve retired active claims while blocking new work until Chief selects an active target.
Preserve structured handoff identity through native delivery and restore archived context only after committed activation. Guard the actual DSH single-resource return path and keep historical implementation evidence outside the bounded active policy.
…tted SQLite snapshots
…nd committed events
Collaborator
Author
|
Written-by: Codex 原PR已推送86e8b6e69，当前全部执行/角色治理/上下文/Task/SQLite分支完成接口组合。完整检查4706通过/0失败/0跳过，实际DSH运行时6项均通过（确定性模型，其中1项真实SQLite读取已提交快照）。138项针对性检查通过，Views/Events均100%行，分支75.65%/85.43%，未宣称全分支覆盖。 补齐native状态/激活与退出证明、当前与固定角色版本、角色治理v1别名及Owner审批回执；公共角色提案/native事实进入事件，私人提案与主机细节不泄露。新增按entityType有界读取的同版本快照。冻结人设/Skills不再塞进每条Session列表。 完整检查重现‘普通查询生成默认目录→后续命令多出Project事件’，现改为无副作用读取，实际SQL事件断言原文保留；显式配置/创建载体才保存目录。历史说明全文归档且保留当前约束，不提高384k预算。当前无未处理评审（已读取review/thread列表），只有实现者自查，不冒充独立Reviewer PASS。 继续#2186兼容/切换（已认领）与最后#2189真实持久后端部署/README，保持Draft，无合并部署或前端/control-plane修改。 |
github-actions
Bot
added
the
risk:T3
This was referenced Nov 3, 2026
Base automatically changed from
feat/2182-transactional-state
to
delivery/ai-centric-development-service
November 3, 2026 09:15
Collaborator
Author
zy95-12
marked this pull request as ready for review
November 3, 2026 09:15
zy95-12
merged commit Nov 3, 2026
ae00e71
into
delivery/ai-centric-development-service
3 of 8 checks passed
zy95-12
added a commit
that referenced
this pull request
Nov 3, 2026
) Written-by: Codex Preserve personal Chief/Bots, native groups and original Task/Workflow/Session identities while closing old Project-task admission bypasses. Capture legacy work once with committed Effects proof; unknown post-cutover rows stay held. Keep explicit legacy rework continuations and exact-current-Attempt Workflow dispatch, while canonical Tasks remain under Chief/Handoff control. Original Project-associated groups stay available through the same personal channel with both group history ACL and current Project access. Queries cannot import private history. Add a bounded scoped compatibility diagnostic and capability/entrypoint inventory. Physical JSON v4 fences new contracts across SQLite import/export/rollback and journal snapshots; same-version storage rollback cannot replay committed actions or authorize an old-code downgrade. Fixes #2186. Stacked on #2250 / feat/2185-service-contracts. No frontend/control-plane changes, new executor/store, main merge, production rollout or service restart. Validation at a966241: - Full TZ=UTC npm run verify: 4,720 passed, 0 failed/skipped; includes six actual DSH runtime cases using deterministic inference, one with SQLite. Test child drops only DAC override/read-search capabilities for existing root chmod tests. - New compatibility suite: 13 passed. The same suite at parent86e8b6e:12 failed/1 passed; the future-frame case is a retained guardrail. Covers actual original HTTP Chief/group/own-memory access, stable IDs/rework, admission side doors, JSON/SQLite rollback and a real local-file Effect that is not replayed. - 53 scoped checks passed before the final group-only refinement; compatibility measured100% lines/76.71% branches/100% functions and frame100/88.89/100. Final group+compat21 passed. Alternate branches remain uncovered. - Memory, architecture/subsystem docs, capability/migration inventory and changelog updated; source mirrors regenerated. Self-check complete, no independent Reviewer verdict. Not run: production data migration, browser/desktop acceptance, external-vendor product adapter or real-provider complete development loop. Existing separate real Codex continuation evidence is not attributed to this new head. Remains Draft; final real backend packaging and README/API refresh follow in #2189.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Written-by: Codex
Unify command recovery, bounded queries and committed Project events over the existing services. Scoped command receipts distinguish durable completion, replay, conflict and unknown outcomes; acceptance commits before ownership can be replayed. Task/Attempt lists reference exact hash-paged sources instead of copying growing history, context or frozen definitions.
Native and SDK execution views now expose scoped lifecycle/exit facts, current catalog vs pinned definition versions and custom logical role capabilities. Live activation uses existing Effects acknowledgement; Bot/PID absence is never exit proof. Host process details/raw failures/profiles stay private. Ordinary role metadata reads peek defaults/current committed catalog without materializing Project facts; explicit configuration/carrier creation keeps the existing write path.
HTTP v1 aliases
roles,role.proposalsandrole.decidereuse governance and exact-hash Owner/Maintainer checks; no HTTP Chief impersonation. Role decisions use the same scoped receipt/replay contract. Pending public governance proposals, catalog revisions and native execution facts enter the committed event projection; personal-agent proposals/conversations do not.SSE remains authenticated, Project scoped and revocation aware with bounded retention, cursor recovery and backpressure. Receiving events grants no authority.
project.snapshotdefaults to Tasks and supports boundedentityTypepages for attempts/executions/resources/inputs/role-proposals under the same Project revision/cursor. No new store, executor, framework inspection timer or frontend/control-plane implementation.Refs #2185. Base: current #2182 branch, including composed identity/governance/execution/context/Task ancestors. Remain Draft for #2186 compatibility, #2189 CLI/deployment integration and independent review; no main merge/deployment.
Validation at 86e8b6e:
TZ=UTC npm run verify: 4,706 passed, 0 failed/skipped, including six actual DSH runtime cases with deterministic inference. One case reads committed SQLite snapshots through the real canonical Chief/native return pipeline. Only test-child DAC override/read-search capabilities are dropped for existing root chmod tests.Not run: production rollout/migration/restart, independent review, real-provider complete custom-role Task closure. Earlier real Codex two-worker continuation evidence remains separately attributed. #2186/#2189 work continues on their own branches/PRs; these checks are not proof of those remaining stages.