[verified] Handle delivery acknowledgements and read-only recovery

2026-10-13 06:26:49 +00:00
parent 3759fcbde3
commit dbd381a41b
5 changed files with 439 additions and 0 deletions
@@ -88,3 +88,42 @@ def deliver_implementation(adapter: Any, *, head: str, declaration: Any) -> dict
    readback = adapter.read_pr(pr_number)
    bounded_pr = _validate_readback(readback, pr_number, head)
    return {"remote_head": remote_head, "pr": bounded_pr}
+
+
+def reconcile_implementation(adapter: Any, *, head: str, number: int,
+                             declaration: Any) -> dict[str, Any]:
+    """Explicit read-only recovery after uncertain write acknowledgement.
+
+    The trusted main-owned adapter must freshly verify identity/scope, exact
+    intended body, protected Issue snapshot, and complete files/commits via
+    verify_reconciliation(head, number). Only literal True accepts that proof.
+    These callbacks MUST be read-only. This is not a transport sandbox, an
+    automatic exception handler, or permission to retry a write.
+    """
+    _validate_head(head)
+    _validate_pr_number(number)
+    for name in ("read_remote_head", "read_pr", "verify_reconciliation"):
+        callback = None
+        try:
+            callback = getattr(adapter, name)
+        except Exception:
+            _reject("trusted reconciliation adapter required")
+        if not callable(callback):
+            _reject("trusted reconciliation adapter required")
+
+    remote_head = _delivery_adoption.deliver(
+        adapter.read_remote_head, head=head, declaration=declaration
+    )
+    if type(remote_head) is not str or remote_head != head:
+        _reject("remote head mismatch")
+    readback = _delivery_adoption.deliver(
+        lambda: adapter.read_pr(number), head=head, declaration=declaration
+    )
+    bounded_pr = _validate_readback(readback, number, head)
+    verified = _delivery_adoption.deliver(
+        lambda: adapter.verify_reconciliation(head, number),
+        head=head, declaration=declaration
+    )
+    if verified is not True:
+        _reject("reconciliation intent or protected state mismatch")
+    return {"remote_head": remote_head, "pr": bounded_pr}