refactor: unify impl operation gates and correction verification

2026-10-13 16:35:52 +00:00
parent 4e9c46bba2
commit bd73c97a97
24 changed files with 1992 additions and 682 deletions
@@ -230,26 +230,13 @@ different-body cases remain fail-closed under ordinary create/reuse; this
 correction exception is not permission to create another comment or broaden
 reuse.

-Only the main impl workflow, with separate explicit correction approval and the
-active Issue lease, may execute the single PATCH. Immediately before that PATCH,
-perform fresh unchanged checks against the correction snapshot: exact target,
-comment ID, unique correlation/no duplicates, author identity, current body,
-Source Issue, PR, underlying PR-Issue, reviews, inline evidence, complete
-collections and provider contract must still match, with the expected API status
-and version token derived from the matching source response. If any material
-state drifted, the API lacks a trustworthy status/version precondition, or
-one-time conditional PATCH semantics cannot be established, stop as partial;
-do not substitute POST, retry, delete, or restore source state.
+Default correction is blocked in this revision because there is no supported client-snapshot CAS execution/verification pair; a lease or capability flag is not provider CAS. Fail closed unless the user separately and explicitly approves the supported ordinary single PATCH exception with its residual read/write race disclosed. Future CAS support requires both execution and matching verifier proof before admission. For that approved path, the main impl workflow under the active Issue lease performs fresh preflight immediately before the one PATCH: exact target, comment ID, unique correlation/no duplicates, author identity, current body, Source Issue, PR, underlying PR-Issue, reviews, inline evidence, complete collections and provider contract must match. No POST, retry, delete, or source-state restoration is allowed. Report `atomic_client_precondition=false` and the residual race for ordinary PATCH.

 After PATCH, read back the exact same comment ID and verify actor stable account
 ID, immutable `created_at`, URL, full scoped collection count, exact corrected
 body, recomputed result digest and unchanged marker identity/correlation. Prove
 all old rows, reviews, inline evidence, Source Issue fields and entire metadata
-(including `updated_at`), timeline, and cached counter are unchanged. Only this
-comment's body/result hash/marker and a provider-verified comment `updated_at` or
-revision may change, and only with the version/precondition proof. A PR or
-underlying PR-Issue `updated_at` may change only when the exact timestamp is
-explained by the provider's verified correction semantics. Any unexplained delta,
+(including `updated_at`), timeline, and cached counter are unchanged by default. Strict no-timeline-change is the default. A separately approved observed reference-neutralization profile may admit only a pre-existing `comment_ref` pointing to this exact comment/PR transitioning `none` to `neutered`; ID, actor, `created_at`, and target remain immutable, and only `updated_at` plus the exact embedded corrected-comment body/updated_at projection may change. This is observed behavior, not proof of every deployed build; unchanged events remain structurally equal and any other timeline delta fails. Only this comment's body/result hash/marker and provider-verified comment `updated_at` or revision may change. A PR or underlying PR-Issue `updated_at` may change only when exact timestamp is explained by verified correction semantics. Any unexplained delta,
 missing field, incomplete pagination or unsupported semantic is partial and
 stops further action. Never delete comments, duplicate-POST, restore or rewrite
 the Source Issue, perform a native review, or clean up source timeline history.