Harden dirty-session rebind inventory and journal identity #868

New Issue

2026-07-24T00:06:57-05:00

jcwalker3 commented

2026-07-24 00:06:57 -05:00

Summary

Follow-up correction for two medium-severity defects in the dirty same-claimant author-session rebind capability landed by PR #865 (closes #864, merge ef14622ba0badd0cd7d654c05af13aca7d81bc05, head a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23).

PR #865 was approved and merged before these two independently identified medium findings could be submitted as a blocking review on the closed PR. Do not reopen, re-review, amend, or attempt REQUEST_CHANGES on closed PR #865. Land remediation only through this new issue + one PR.

Blocked downstream recovery (Issue #860 / PR #861) must not invoke the rebind capability against the real #860 worktree until this correction is reviewed, merged, and loaded into the runtime.

Context

Item	Value
Original issue	#864
Landed PR	#865 (closed/merged)
Merge commit	`ef14622ba0badd0cd7d654c05af13aca7d81bc05`
Review reference	#533
Downstream blocked	#860 / PR #861
Preserve untouched	#850, PR #853, #855, #860 worktree, PR #861

Duplicate search

Searched open and closed issues/PRs for:

full dirty-inventory revalidation around session rebinding;
complete recovery-journal identity and replay validation;
any existing post-merge remediation for PR #865.

Result: no open or closed issue owns the complete remediation (both findings together with required tests). Adjacent items (#864 closed via #865, #860/#861 distinct orphan-recovery path, #753/#772 clean-worktree recovery) do not cover these gaps.

Finding 1 — Complete dirty-inventory revalidation

Defect

The apply path verifies fingerprints for expected paths but does not recollect and compare the complete tracked and untracked dirty inventory immediately before and after bind_session_lock.

Required behavior

collect the authoritative complete dirty inventory immediately before mutation;
require exact equality with the pinned expected path set;
repeat the complete inventory collection after mutation;
require the post-mutation path set to remain exactly equal;
fail closed for added, removed, renamed, or otherwise changed paths;
verify fingerprints and byte preservation for every expected path;
ensure failures cannot leave a newly authoritative live session.

Finding 2 — Complete recovery-journal identity

Defect

The JOURNAL_PHASE_ASSESSED record omits:

remote;
organization;
repository;
claimant identity;
claimant profile.

Required behavior

persist all five fields as part of the durable operation identity;
validate them during initial execution, resume, retry, and already_rebound;
reject missing, mismatched, stale, cross-repository, cross-claimant, or replayed journal state;
preserve validation of issue, branch, worktree, old PID, generation, local and remote heads, dirty paths, fingerprints, and source pins.

Non-weakening invariants

Do not weaken:

ordinary dirty-worktree refusal;
same-claimant verification;
dead-PID proof;
worktree registration and canonical-root checks;
competing ownership detection;
journal/CAS crash safety;
author and reconciler role boundaries;
reviewer and merger refusal;
local- and remote-head pins.

Required tests

Focused regression coverage for at least:

extra tracked dirty path immediately before binding;
extra untracked path immediately before binding;
path added during the mutation window;
path removed or renamed during the mutation window;
fingerprint movement with an unchanged path set;
remote / organization / repository mismatch in a stored journal;
claimant-identity / claimant-profile mismatch;
incomplete legacy or malformed journal identity;
replay of a journal against another repository or claimant;
successful exact retry;
already_rebound with complete matching identity;
preservation of ordinary dirty-worktree refusal.

Also add the previously optional reconciler success-path integration test when live implementation supports reconciler execution:

authorize_reconciler_execute=True;
complete expected-value pin set;
successful tightly pinned rebinding;
reconciler grants no commit, push, publication, review, or merge capability.

Use actual lock/session writers and real temporary repositories or worktrees for central integration paths.

Acceptance criteria

Both findings remediated on a branch from current live master.
Single PR closes this issue only; PR #865 remains closed/unchanged.
Focused suite + new tests green; exact commands and pass counts recorded.
#850 / PR #853 / #855 / #860 / PR #861 and the preserved seven-file #860 worktree remain unmodified.
Author handoff requests independent gitea-reviewer review at the authoritative head.

Canonical next step

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Allocate a clean registered worktree from live master, implement both corrections + tests, publish one PR, hand off to gitea-reviewer

## Summary Follow-up correction for **two medium-severity defects** in the dirty same-claimant author-session rebind capability landed by **PR #865** (closes #864, merge `ef14622ba0badd0cd7d654c05af13aca7d81bc05`, head `a3f8f67c9323ec7e78b5c7cc8ce8b051ab061e23`). PR #865 was **approved and merged before these two independently identified medium findings could be submitted as a blocking review** on the closed PR. Do **not** reopen, re-review, amend, or attempt `REQUEST_CHANGES` on closed PR #865. Land remediation only through this new issue + one PR. Blocked downstream recovery (**Issue #860 / PR #861**) must **not** invoke the rebind capability against the real #860 worktree until this correction is reviewed, merged, and loaded into the runtime. ## Context | Item | Value | |---|---| | Original issue | #864 | | Landed PR | #865 (closed/merged) | | Merge commit | `ef14622ba0badd0cd7d654c05af13aca7d81bc05` | | Review reference | #533 | | Downstream blocked | #860 / PR #861 | | Preserve untouched | #850, PR #853, #855, #860 worktree, PR #861 | ## Duplicate search Searched open and closed issues/PRs for: * full dirty-inventory revalidation around session rebinding; * complete recovery-journal identity and replay validation; * any existing post-merge remediation for PR #865. **Result:** no open or closed issue owns the complete remediation (both findings together with required tests). Adjacent items (#864 closed via #865, #860/#861 distinct orphan-recovery path, #753/#772 clean-worktree recovery) do not cover these gaps. ## Finding 1 — Complete dirty-inventory revalidation ### Defect The apply path verifies fingerprints for **expected paths** but does **not** recollect and compare the **complete** tracked and untracked dirty inventory immediately before and after `bind_session_lock`. ### Required behavior * collect the authoritative complete dirty inventory immediately before mutation; * require exact equality with the pinned expected path set; * repeat the complete inventory collection after mutation; * require the post-mutation path set to remain exactly equal; * fail closed for added, removed, renamed, or otherwise changed paths; * verify fingerprints and byte preservation for every expected path; * ensure failures cannot leave a newly authoritative live session. ## Finding 2 — Complete recovery-journal identity ### Defect The `JOURNAL_PHASE_ASSESSED` record omits: * remote; * organization; * repository; * claimant identity; * claimant profile. ### Required behavior * persist all five fields as part of the durable operation identity; * validate them during initial execution, resume, retry, and `already_rebound`; * reject missing, mismatched, stale, cross-repository, cross-claimant, or replayed journal state; * preserve validation of issue, branch, worktree, old PID, generation, local and remote heads, dirty paths, fingerprints, and source pins. ## Non-weakening invariants Do **not** weaken: * ordinary dirty-worktree refusal; * same-claimant verification; * dead-PID proof; * worktree registration and canonical-root checks; * competing ownership detection; * journal/CAS crash safety; * author and reconciler role boundaries; * reviewer and merger refusal; * local- and remote-head pins. ## Required tests Focused regression coverage for at least: * extra tracked dirty path immediately before binding; * extra untracked path immediately before binding; * path added during the mutation window; * path removed or renamed during the mutation window; * fingerprint movement with an unchanged path set; * remote / organization / repository mismatch in a stored journal; * claimant-identity / claimant-profile mismatch; * incomplete legacy or malformed journal identity; * replay of a journal against another repository or claimant; * successful exact retry; * `already_rebound` with complete matching identity; * preservation of ordinary dirty-worktree refusal. Also add the previously optional **reconciler success-path** integration test when live implementation supports reconciler execution: * `authorize_reconciler_execute=True`; * complete expected-value pin set; * successful tightly pinned rebinding; * reconciler grants no commit, push, publication, review, or merge capability. Use actual lock/session writers and real temporary repositories or worktrees for central integration paths. ## Acceptance criteria 1. Both findings remediated on a branch from current live master. 2. Single PR closes **this** issue only; PR #865 remains closed/unchanged. 3. Focused suite + new tests green; exact commands and pass counts recorded. 4. #850 / PR #853 / #855 / #860 / PR #861 and the preserved seven-file #860 worktree remain unmodified. 5. Author handoff requests independent `gitea-reviewer` review at the authoritative head. ## Canonical next step ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Allocate a clean registered worktree from live master, implement both corrections + tests, publish one PR, hand off to gitea-reviewer ```

jcwalker3 added the mcp status:ready workflow-hardening recovery safety type:bug labels 2026-07-24 00:06:57 -05:00

jcwalker3 referenced this issue from a commit

2026-07-24 00:14:09 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868)

jcwalker3 referenced a pull request that will close this issue

2026-07-24 00:14:31 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868) #869

jcwalker3 added status:pr-open and removed status:ready labels 2026-07-24 00:14:33 -05:00

jcwalker3 referenced a pull request that will close this issue

2026-07-24 00:16:09 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868) #869

jcwalker3 commented

2026-07-24 00:16:27 -05:00

Author delivery

Implementation and PR published for this follow-up remediation.

Item	Value
PR	#869 (only PR for this issue)
Head	`ba3ea3012c36db888d6189fee577c9f3a9805c1b`
Branch	`fix/issue-868-dirty-rebind-inventory-journal`
Focused tests	142 passed

Both medium findings (complete dirty-inventory revalidation; complete recovery-journal identity) are addressed. Full author handoff posted on PR #869.

Canonical Issue State

STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Independent review of PR #869 at head ba3ea3012c36db888d6189fee577c9f3a9805c1b; submit verdict; stop
NEXT_PROMPT:

Act as gitea-reviewer / prgs-reviewer. Independently review PR #869 (Closes #868) at head ba3ea3012c36db888d6189fee577c9f3a9805c1b on prgs Scaled-Tech-Consulting/Gitea-Tools. Verify both medium findings and that PR #865 / #860 / #861 were not mutated. Submit formal review verdict; stop.

WHAT_HAPPENED: Author published PR #869 closing #868 for post-merge #865 defects.
WHY: Two medium findings could not block already-merged PR #865; follow-up issue/PR required.
RELATED_PRS: #869 (Closes #868); #865 closed/merged unchanged; #861 not mutated
BLOCKERS: none
VALIDATION: 142 passed focused suite; remote head equals ba3ea3012c
LAST_UPDATED_BY: jcwalker3 / prgs-author

## Author delivery Implementation and PR published for this follow-up remediation. | Item | Value | |---|---| | PR | **#869** (only PR for this issue) | | Head | `ba3ea3012c36db888d6189fee577c9f3a9805c1b` | | Branch | `fix/issue-868-dirty-rebind-inventory-journal` | | Focused tests | **142 passed** | Both medium findings (complete dirty-inventory revalidation; complete recovery-journal identity) are addressed. Full author handoff posted on PR #869. ## Canonical Issue State STATE: awaiting-review WHO_IS_NEXT: reviewer NEXT_ACTION: Independent review of PR #869 at head ba3ea3012c36db888d6189fee577c9f3a9805c1b; submit verdict; stop NEXT_PROMPT: ```text Act as gitea-reviewer / prgs-reviewer. Independently review PR #869 (Closes #868) at head ba3ea3012c36db888d6189fee577c9f3a9805c1b on prgs Scaled-Tech-Consulting/Gitea-Tools. Verify both medium findings and that PR #865 / #860 / #861 were not mutated. Submit formal review verdict; stop. ``` WHAT_HAPPENED: Author published PR #869 closing #868 for post-merge #865 defects. WHY: Two medium findings could not block already-merged PR #865; follow-up issue/PR required. RELATED_PRS: #869 (Closes #868); #865 closed/merged unchanged; #861 not mutated BLOCKERS: none VALIDATION: 142 passed focused suite; remote head equals ba3ea3012c36db888d6189fee577c9f3a9805c1b LAST_UPDATED_BY: jcwalker3 / prgs-author

sysadmin referenced this issue

2026-07-24 00:23:21 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868) #869

sysadmin referenced this issue

2026-07-24 00:24:28 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868) #869

sysadmin referenced this issue

2026-07-24 01:00:25 -05:00

fix(author): harden dirty-session rebind inventory and journal identity (#868) #869

sysadmin closed this issue

2026-07-24 01:00:59 -05:00

sysadmin referenced this issue from a commit