feat(candidate): bind checks to immutable snapshots #176

Merged

triform-admin merged 25 commits from agent/candidate-snapshot-manifest-final-v2-20260824 into main 2026-08-24 21:42:12 +00:00

Conversation 0 Commits 25 Files changed 23 +19016 -4724

triform-admin commented 2026-08-24 21:29:44 +00:00

Owner

Copy link

Recovery PR for the exact validated CGLS-47 head after Forgejo cached PR #175 as non-mergeable despite main being its ancestor and a clean git merge-tree. No source or tree change.

Exact head: d062053979.

Dedicated authoritative gate: ALL GREEN — build, 673 workspace tests, fmt, clippy, integration build, 440 integration-unit tests plus integration suites, integration clippy. Independent final and repair re-reviews approve with no remaining blocker.

Recovery PR for the exact validated CGLS-47 head after Forgejo cached PR #175 as non-mergeable despite main being its ancestor and a clean git merge-tree. No source or tree change. Exact head: d062053979e2318979a1bda088220a435d0a081b. Dedicated authoritative gate: ALL GREEN — build, 673 workspace tests, fmt, clippy, integration build, 440 integration-unit tests plus integration suites, integration clippy. Independent final and repair re-reviews approve with no remaining blocker.

triform-admin added 25 commits 2026-08-24 21:29:44 +00:00

feat: bind policy checks to immutable candidates ... 019e31b40b

Add the typed CandidateSnapshot wire model, exact Git and overlay validation, candidate-addressed transport, sealed execution authority, strict result-v2 evidence, durable attempt artifacts, and backward-compatible activation for explicit verdict checks.

Refs CGLS-47 and PYAML-65.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: compile candidate snapshot contracts on MSRV ... dab5076d16

Add the direct serde derive dependency required by the new closed result and evidence types, replace Rust 1.88 let-chains with MSRV-safe control flow, and import the test-only check profile type.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: declare serde for evidence validation ... 6a3a081b12

The CLI owns closed result-v2 envelopes in verdict.rs, so it must declare serde derive directly instead of relying on another workspace crate's transitive dependency.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: align candidate integration call sites ... e55c952c09

Preserve legacy base-attributed polling with the optional transport API, use current typed candidate accessors, and keep BatchProject cleanup paired through its Drop owner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: close candidate snapshot integration gate ... d1d2d4e596

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test: align candidate authority assertions ... f900f43a19

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test: assert sealed manifest values ... 1dac71eb16

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test: pin producer snapshot resource bounds ... c6432c515c

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test(transport): reject candidate scope grafting ... 4804440715

Pins candidate authority location, duplicate-container, pairing, round-trip, and pre-service-mutation contracts before the parser repair. The current global raw-key scanner cannot satisfy the location and container taxonomy cases.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test(server): pin attempt replay admission identity ... 61eed12f32

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test(transport): close candidate authority fields ... 2d6bfa55b7

Adds the RED contract that candidate-bearing option containers reject unknown authority fields while legacy non-candidate parsing remains tolerant.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(transport): bind candidate authority scope ... bcac66c762

Replaces the global candidate key graft with a raw JSON container parser for candidate-bearing requests. Push accepts exactly one flat or nested authority; batch accepts nested options only. Duplicate, unknown, split, and decoy authority fails closed while no-candidate legacy requests retain best-effort parsing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: bound candidate snapshot payload memory ... add233897d

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test(transport): pin structured push rejection codes ... 42145be6f4

Defines the RED codec/default and outcome-v3 response contract for optional branchable service rejection codes, including the legacy submission.rejected fallback.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

feat(transport): carry structured push rejection codes ... b519398e67

Adds optional reject_code to PushOverlayAck, preserves it across ack codecs, normalizes blank values to legacy absence, and emits it from POST /v3 rejections with submission.rejected as the backward-compatible fallback.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(server): bind attempt identity before dispatch ... 4c4e65dd8b

Persist a versioned admission record for full semantic identity, serialize concurrent replay, retain typed rejection precedence, and fail closed across restart or storage corruption.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(server): keep admission rollback MSRV-compatible ... 31b821c636

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(server): box large admission decision variant ... 0791a5c676

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test(server): pin lost pending dispatch behavior ... 815c0716a2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(server): fail closed when pending dispatch is lost ... 69591abc96

Keep terminal and same-process replay idempotent, but require a successor attempt after restart when accepted pending work has no durable terminal evidence.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test: pin candidate manifest metadata bound ... 449aa118e3

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix: preflight candidate manifest metadata size ... 82709a66ec

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

refactor: group manifest serialization parameters ... 86b854d8d8

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

test(server): keep pending outcomes through cache churn ... eb91fac8d0

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fix(server): never evict live pending outcomes ... d062053979

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

triform-admin merged commit 03d91a7b5b into main 2026-08-24 21:42:12 +00:00

triform-admin referenced this pull request from a commit 2026-08-24 21:42:13 +00:00

feat(candidate): bind checks to immutable snapshots (#176)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

triform/cargoless!176

No description provided.