30 lines
4.5 KiB
Markdown
30 lines
4.5 KiB
Markdown
# Impl operation architecture
|
|
|
|
## Authority and compatibility
|
|
|
|
The main agent owns approval, interpretation, credential use, Git/Gitea mutation, integration and delivery. A helper does not grant authority, sandbox a trusted adapter, prove a custom provider build equivalent to upstream, or guarantee atomicity across REST/Git. Product repositories, historical failed baselines and receipts are not rewritten by this redesign.
|
|
|
|
Retain input-gate review semantics, canonical comment rendering/correlation, cache-mode restrictions, complete pagination, source binding, fresh delegation adoption, broker leases, runtime/worktree admission and exact-source evidence execution. Existing narrow functions remain stage helpers, not end-to-end completion certificates.
|
|
|
|
## Operation boundaries
|
|
|
|
An operation is one external mutation, not an entire distributed transaction. Initial delivery has separate push and PR operations. Rework has separate push, PR-body and canonical-comment operations. Correction is its own explicitly approved same-comment operation; it never promotes an earlier failed handoff.
|
|
|
|
Use a shared, versioned operation coordinator: validated intent and approval -> fresh preflight (identity, target, lease, source/evidence and provider capability) -> one mutation attempt -> fresh readback -> operation-specific verification -> bounded receipt. Record intent/snapshot digests before mutation. Preflight and verification are trusted adapter contracts, not boolean claims loaded from an untrusted worker artifact. Revalidate delegation adoption at existing consumer boundaries.
|
|
|
|
A failed or uncertain acknowledgement enters read-only reconciliation. Do not call mutate again automatically. Any incomplete verification yields partial, preserving attempt and observed state. A coordinator instance consumes its attempt authority before invoking mutate, including exceptions; reuse cannot authorize another mutation. Durable recovery requires an authoritative journal/approval and reconciliation, not recreating an in-memory object and assuming at-most-once durability.
|
|
|
|
## Capability and transitions
|
|
|
|
Fail closed for unsupported semantics before writing. Default correction is blocked in this revision: no implemented client-snapshot CAS correction executor/verifier is available. A future client-CAS path remains unsupported until both execution and matching verification are implemented and proven; a capability=True callback alone cannot enable it. Explicit ordinary-PATCH approval may permit a single attempt with fresh preflight/readback, but must report `atomic_client_precondition=false` and residual read/write race. Lease is not a provider CAS.
|
|
|
|
Correction verification is pure and input-bound: reconstruct the bounded three-label migration through the existing canonical planner, validate target/head/actor, old/new expected bodies, exact same comment identity and correlation cardinality, complete before/after collections, provider/version binding, and preserved source metadata/reviews/inline/cache. Reject duplicate IDs, missing fields, malformed timestamps, unsupported profile and arbitrary change masks.
|
|
|
|
A separately approved observed reference-neutralization profile may permit only a pre-existing source timeline `comment_ref` that points to this exact comment/PR to transition `none` to `neutered`; its ID, actor, created_at and target remain immutable. Only its updated_at and exact embedded corrected comment body/updated_at projection may additionally change. Unchanged events remain byte/structurally equal. New/deleted events or source metadata changes fail. This is observed behavior, not proof of every deployed build. Unknown deltas remain partial. Strict no-timeline-change remains the default.
|
|
|
|
## Evidence and rollout
|
|
|
|
Inventory baseline contracts/tests before editing. Each proven defect/review finding gets a named RED-to-GREEN regression; adapter tests are not live provider acceptance. Replay preserved native before/after readbacks without credentials or product writes. Exercise coordinator failures, stale preflight, single attempt, uncertain acknowledgement, reconciliation, wrong identity/head, pagination, missing approval, schema/profile mismatch and unrelated mutations.
|
|
|
|
Run canonical collection and full suite, inspect final diff, obtain independent specification/code-security review, and preserve source hashes, commands, environment, exit codes and outputs in reviewer-accessible evidence. No remote rollout, push or Gitea mutation is authorized by this harness redesign request. Preserve archive compatibility and report limitations explicitly.
|