feat(arch01): atomic platform install + authority kernel (Closes #822) #839

2026-07-22T22:03:39-05:00

jcwalker3 commented

2026-07-22 22:03:39 -05:00

Closes #822

ARCH-01 Foundation Slice A — the first implementation leaf of the #820/#821 program. SQLite-first. PostgreSQL parity is a separate issue (#827).

What this delivers

A new module, arch01_platform.py, holding a disabled-by-default authority kernel over a single SQLite connection. Nothing in the running MCP server imports it; instantiating PlatformKernel creates an isolated database and never touches the operational control-plane store. It becomes a security boundary only once these readiness checks pass in a target environment.

Concern	Mechanism
Connection-bound authenticated actor context	`cp_actor_principal/kind`, `cp_operation_mode`, `cp_service_session`, `cp_context_epoch` scalar functions registered from Python only
Actor protocol on every mutating trigger	read epoch, read fields, re-check epoch; abort unless present + non-null + well-formed + bound to the active transaction
Immutable authority lattice	exact seeded dominance tuple set, each tuple validated individually
Principal-equivalence root	class row inserted before its first principal; `current_class_id` NOT NULL FK
Atomic install	one `BEGIN IMMEDIATE` transaction, immutable `installed` marker written last and validated by a fail-closed `BEFORE INSERT` trigger
Last-active-grant floor	singleton invariant row with `CHECK (active_count >= 1)`
Append-only audit	`audit_records` rejects UPDATE/DELETE

Enforcement classification (per #820 vocabulary)

[TRUSTED-SERVICE] — actor-context authenticity: SQL can read the cp_* functions but has no statement that can define or set them.
[SCHEMA] — fail-closed aborts, the dominance / immutability / NOT-NULL-class / last-active-grant invariants, enforced by CHECK/FK/trigger.
[RUNTIME-ADAPTER] — none in this slice.

Acceptance criteria → tests (#822 §12/§13)

Every AC is exercised against a real SQLite database; the migration runs on a fresh DB in setUp.

AC	Test
1 clean install → INSTALLED, marker present	`test_install_clean`
2 second install → ALREADY_INSTALLED, no mutation	`test_install_twice`
3 / 5 stage failure rolls back whole transaction, no partial rows	`test_install_stage_rollback`, `test_no_partial_after_rollback`
4 missing / additional / malformed dominance tuple → DOMINANCE_SET_MISMATCH	`test_dominance_missing/extra/malformed`
6 no principal without a class (NOT NULL FK)	`test_principal_no_class`
7 temporary NULL issuer only for the installer during install	`test_noninstaller_null_issuer`, `test_installer_null_issuer_only_during_install`
8 missing / stale / epoch-shifted context → INVALID_ACTOR_CONTEXT	`test_context_missing/stale/epoch_shift`, `test_bad_actor_kind_or_mode_rejected`
9 bootstrap artifacts cannot be updated / deleted post-install	`test_bootstrap_immutable_update/delete`, `test_grant_reactivation_rejected`
10 two concurrent installs → one INSTALLED, one lost	`test_concurrent_install`
11 two concurrent revocations cannot remove the final active grant	`test_concurrent_last_grant_revoke`, `test_revoke_final_grant_denied`
12 raw INSERT/UPDATE/DELETE bypass attempts fail	`test_raw_write_bypass`
13 audit rows created for security-sensitive operations	`test_audit_created`
14 audit rows cannot be altered / deleted	`test_audit_immutable`

Scope

Two new files, nothing else touched:

arch01_platform.py (new, 892 lines)
tests/test_arch01_platform.py (new, 572 lines)

Test evidence

Run with venv/bin/python -m pytest from the allocated worktree, base master 53c2c92.

Focused: pytest tests/test_arch01_platform.py — 25 passed, 21 subtests passed.
Fresh-DB migration smoke on a file database — install → INSTALLED, second install → ALREADY_INSTALLED, all ten tables created.
Full suite — 4422 passed, 11 failed, 6 skipped, 580 subtests passed.

The 11 failures are the documented pre-existing master baseline at 53c2c92 — six in test_commit_payloads.py, two in test_issue_702_review_findings_f1_f6.py, and one each in test_mcp_server.py::TestPreflightVerification, test_post_merge_moot_lease.py, and test_reconciler_supersession_close.py. None touch arch01. This branch adds no new failures; the 25-test delta is the new suite.

Exclusions / deferred (#822 §5/§17)

No evidence stores, repository bindings, workspaces, PostgreSQL, or ARCH-02/04. Full grant succession → grant-succession issue; full principal merge body → principal-equivalence issue (this slice lands only the class root + NOT NULL FK). Subsystem stays disabled by default until readiness checks pass.

Canonical PR State

STATE: awaiting-review
WHO_IS_NEXT: reviewer
BLOCKED_ROLE: none
NEXT_ACTION: Review PR against issue #822 acceptance criteria 1-14 and the disabled-by-default / SQLite-first non-goals
NEXT_PROMPT: Review this PR as prgs-reviewer; verify the fail-closed actor protocol, the exact dominance validation, raw-write bypass, the last-active-grant floor under concurrency, and that the 11 full-suite failures match the 53c2c92 baseline; submit verdict; stop

Co-Authored-By: Claude Opus 4.8 (1M context) [email protected]

Closes #822 ARCH-01 Foundation Slice A — the first implementation leaf of the #820/#821 program. SQLite-first. PostgreSQL parity is a separate issue (#827). ## What this delivers A new module, `arch01_platform.py`, holding a **disabled-by-default** authority kernel over a single SQLite connection. Nothing in the running MCP server imports it; instantiating `PlatformKernel` creates an isolated database and never touches the operational control-plane store. It becomes a security boundary only once these readiness checks pass in a target environment. | Concern | Mechanism | |---|---| | Connection-bound authenticated actor context | `cp_actor_principal/kind`, `cp_operation_mode`, `cp_service_session`, `cp_context_epoch` scalar functions registered from Python only | | Actor protocol on every mutating trigger | read epoch, read fields, re-check epoch; abort unless present + non-null + well-formed + bound to the active transaction | | Immutable authority lattice | exact seeded dominance tuple set, each tuple validated individually | | Principal-equivalence root | class row inserted before its first principal; `current_class_id` NOT NULL FK | | Atomic install | one `BEGIN IMMEDIATE` transaction, immutable `installed` marker written last and validated by a fail-closed `BEFORE INSERT` trigger | | Last-active-grant floor | singleton invariant row with `CHECK (active_count >= 1)` | | Append-only audit | `audit_records` rejects UPDATE/DELETE | ## Enforcement classification (per #820 vocabulary) - `[TRUSTED-SERVICE]` — actor-context authenticity: SQL can read the `cp_*` functions but has no statement that can define or set them. - `[SCHEMA]` — fail-closed aborts, the dominance / immutability / NOT-NULL-class / last-active-grant invariants, enforced by CHECK/FK/trigger. - `[RUNTIME-ADAPTER]` — none in this slice. ## Acceptance criteria → tests (#822 §12/§13) Every AC is exercised against a real SQLite database; the migration runs on a fresh DB in `setUp`. | AC | Test | |---|---| | 1 clean install → INSTALLED, marker present | `test_install_clean` | | 2 second install → ALREADY_INSTALLED, no mutation | `test_install_twice` | | 3 / 5 stage failure rolls back whole transaction, no partial rows | `test_install_stage_rollback`, `test_no_partial_after_rollback` | | 4 missing / additional / malformed dominance tuple → DOMINANCE_SET_MISMATCH | `test_dominance_missing/extra/malformed` | | 6 no principal without a class (NOT NULL FK) | `test_principal_no_class` | | 7 temporary NULL issuer only for the installer during install | `test_noninstaller_null_issuer`, `test_installer_null_issuer_only_during_install` | | 8 missing / stale / epoch-shifted context → INVALID_ACTOR_CONTEXT | `test_context_missing/stale/epoch_shift`, `test_bad_actor_kind_or_mode_rejected` | | 9 bootstrap artifacts cannot be updated / deleted post-install | `test_bootstrap_immutable_update/delete`, `test_grant_reactivation_rejected` | | 10 two concurrent installs → one INSTALLED, one lost | `test_concurrent_install` | | 11 two concurrent revocations cannot remove the final active grant | `test_concurrent_last_grant_revoke`, `test_revoke_final_grant_denied` | | 12 raw INSERT/UPDATE/DELETE bypass attempts fail | `test_raw_write_bypass` | | 13 audit rows created for security-sensitive operations | `test_audit_created` | | 14 audit rows cannot be altered / deleted | `test_audit_immutable` | ## Scope Two new files, nothing else touched: - `arch01_platform.py` (new, 892 lines) - `tests/test_arch01_platform.py` (new, 572 lines) ## Test evidence Run with `venv/bin/python -m pytest` from the allocated worktree, base master `53c2c92`. - Focused: `pytest tests/test_arch01_platform.py` — **25 passed, 21 subtests passed**. - Fresh-DB migration smoke on a file database — install → INSTALLED, second install → ALREADY_INSTALLED, all ten tables created. - Full suite — **4422 passed, 11 failed, 6 skipped, 580 subtests passed**. The 11 failures are the documented pre-existing master baseline at `53c2c92` — six in `test_commit_payloads.py`, two in `test_issue_702_review_findings_f1_f6.py`, and one each in `test_mcp_server.py::TestPreflightVerification`, `test_post_merge_moot_lease.py`, and `test_reconciler_supersession_close.py`. None touch `arch01`. This branch adds no new failures; the 25-test delta is the new suite. ## Exclusions / deferred (#822 §5/§17) No evidence stores, repository bindings, workspaces, PostgreSQL, or ARCH-02/04. Full grant succession → grant-succession issue; full principal merge body → principal-equivalence issue (this slice lands only the class root + NOT NULL FK). Subsystem stays disabled by default until readiness checks pass. ## Canonical PR State ```text STATE: awaiting-review WHO_IS_NEXT: reviewer BLOCKED_ROLE: none NEXT_ACTION: Review PR against issue #822 acceptance criteria 1-14 and the disabled-by-default / SQLite-first non-goals NEXT_PROMPT: Review this PR as prgs-reviewer; verify the fail-closed actor protocol, the exact dominance validation, raw-write bypass, the last-active-grant floor under concurrency, and that the 11 full-suite failures match the 53c2c92 baseline; submit verdict; stop ``` Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

jcwalker3 added 1 commit 2026-07-22 22:03:40 -05:00

feat(arch01): atomic platform install + authority kernel (Closes #822 ) 6449594fd7

ARCH-01 Foundation Slice A — first implementation leaf of the #820/#821
program. Adds a new, disabled-by-default SQLite kernel:

- Connection-bound trusted-service actor context (cp_actor_principal/kind,
  cp_operation_mode, cp_service_session, cp_context_epoch) that SQL may read
  but never set; every mutating trigger runs the actor protocol and fails
  closed on a missing, stale, or epoch-shifted context.
- Immutable authority-dominance lattice with the exact seeded tuple set,
  validated individually by the install-state trigger.
- Principal-equivalence root: a class exists before its first principal and
  current_class_id is NOT NULL.
- Single atomic BEGIN IMMEDIATE install seeding the installer principal, the
  distinguished operator-key issuer, dominance, the initial NULL-grantor
  bootstrap grant, the active invariant, and the immutable installed marker
  last; second install returns ALREADY_INSTALLED with no mutation.
- Immutability triggers on marker/seed/dominance/issuer/installer
  registration/initial-grant identity; append-only audit_records; last-active
  grant floored by CHECK so concurrent revokes cannot drop it to zero.

Files: arch01_platform.py (new), tests/test_arch01_platform.py (new).

Tests: 25 tests + 21 subtests cover ACs 1-14 including negative, rollback,
raw-write-bypass, and concurrency. Focused suite green; full suite 4422
passed / 11 pre-existing baseline failures at 53c2c92, zero new.

Subsystem disabled by default until readiness checks pass. SQLite-first;
PostgreSQL parity is #827.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

sysadmin commented

2026-07-22 22:46:48 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #839
issue: #822
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 23985-cfd59524152e
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-839
phase: claimed
candidate_head: 6449594fd7
target_branch: master
target_branch_sha: 689c60fc7c
last_activity: 2026-07-23T03:46:48Z
expires_at: 2026-07-23T03:56:48Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #839 issue: #822 reviewer_identity: sysadmin profile: prgs-reviewer session_id: 23985-cfd59524152e worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-839 phase: claimed candidate_head: 6449594fd7fe57d55e333ace6dfa1ab45bb57463 target_branch: master target_branch_sha: 689c60fc7c386dd25926f9161d93cfc25524c5d3 last_activity: 2026-07-23T03:46:48Z expires_at: 2026-07-23T03:56:48Z blocker: none

sysadmin approved these changes 2026-07-22 22:49:51 -05:00

sysadmin left a comment

Canonical PR State

STATE: reviewed-approved
WHO_IS_NEXT: merger
NEXT_ACTION: Merge PR #839 into master on explicit operator approval
NEXT_PROMPT:

Merge PR #839 as prgs-merger only after explicit operator approval. Re-verify head is still 6449594fd7fe57d55e333ace6dfa1ab45bb57463, master parity (mutation_safe), and mergeable before merging. Do not auto-merge.

WHAT_HAPPENED: prgs-reviewer (sysadmin) reviewed PR #839 at head 6449594fd7 against issue #822 acceptance criteria 1-14 and approved via native MCP review mutation.
WHY: Scope is exactly two new files (arch01_platform.py +892, tests/test_arch01_platform.py +572), disabled-by-default with no reference from the running server and no operational control-plane store touched. The focused suite re-ran green at the candidate head (25 passed, 21 subtests passed); AC 1-14 each map to a named test (fail-closed actor protocol, exact dominance-set validation, raw-write bypass, append-only audit immutability, last-active-grant floor under concurrency). No new full-suite failures beyond the documented 53c2c92 baseline of 11.
ISSUE: 822
HEAD_SHA: 6449594fd7
REVIEW_STATUS: APPROVED
MERGE_READY: true
BLOCKERS: none
VALIDATION: pytest tests/test_arch01_platform.py at head 6449594 -> 25 passed, 21 subtests passed. git diff --stat vs base 53c2c92 = 2 files, +1464, no other files touched. merge-base with current master 689c60fc = 53c2c92 (new-files-only diff does not overlap the #811 advance); Gitea reports the PR mergeable. Parity at submit: mutation_safe=true, restart_required=false, daemon_start=local=live_remote=689c60fc.
NATIVE_REVIEW_PROOF: native MCP review mutation by prgs-reviewer (sysadmin) over the production stdio mcp_server transport, pid 23985, token_fingerprint 1425e1ee6e08fdc2; gitea_submit_pr_review action=APPROVE bound to head 6449594fd7 under reviewer lease session 23985-cfd59524152e.
LAST_UPDATED_BY: prgs-reviewer (sysadmin)

## Canonical PR State STATE: reviewed-approved WHO_IS_NEXT: merger NEXT_ACTION: Merge PR #839 into master on explicit operator approval NEXT_PROMPT: ```text Merge PR #839 as prgs-merger only after explicit operator approval. Re-verify head is still 6449594fd7fe57d55e333ace6dfa1ab45bb57463, master parity (mutation_safe), and mergeable before merging. Do not auto-merge. ``` WHAT_HAPPENED: prgs-reviewer (sysadmin) reviewed PR #839 at head 6449594fd7fe57d55e333ace6dfa1ab45bb57463 against issue #822 acceptance criteria 1-14 and approved via native MCP review mutation. WHY: Scope is exactly two new files (arch01_platform.py +892, tests/test_arch01_platform.py +572), disabled-by-default with no reference from the running server and no operational control-plane store touched. The focused suite re-ran green at the candidate head (25 passed, 21 subtests passed); AC 1-14 each map to a named test (fail-closed actor protocol, exact dominance-set validation, raw-write bypass, append-only audit immutability, last-active-grant floor under concurrency). No new full-suite failures beyond the documented 53c2c92 baseline of 11. ISSUE: 822 HEAD_SHA: 6449594fd7fe57d55e333ace6dfa1ab45bb57463 REVIEW_STATUS: APPROVED MERGE_READY: true BLOCKERS: none VALIDATION: pytest tests/test_arch01_platform.py at head 6449594 -> 25 passed, 21 subtests passed. git diff --stat vs base 53c2c92 = 2 files, +1464, no other files touched. merge-base with current master 689c60fc = 53c2c92 (new-files-only diff does not overlap the #811 advance); Gitea reports the PR mergeable. Parity at submit: mutation_safe=true, restart_required=false, daemon_start=local=live_remote=689c60fc. NATIVE_REVIEW_PROOF: native MCP review mutation by prgs-reviewer (sysadmin) over the production stdio mcp_server transport, pid 23985, token_fingerprint 1425e1ee6e08fdc2; gitea_submit_pr_review action=APPROVE bound to head 6449594fd7fe57d55e333ace6dfa1ab45bb57463 under reviewer lease session 23985-cfd59524152e. LAST_UPDATED_BY: prgs-reviewer (sysadmin)

sysadmin commented

2026-07-22 22:59:28 -05:00

repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #839
issue: #822
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 49016-122421d26c7b
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-822-atomic-install-authority-kernel
phase: claimed
candidate_head: 6449594fd7
target_branch: master
target_branch_sha: none
last_activity: 2026-07-23T03:59:28Z
expires_at: 2026-07-23T04:09:28Z
blocker: none

repo: Scaled-Tech-Consulting/Gitea-Tools pr: #839 issue: #822 reviewer_identity: sysadmin profile: prgs-merger session_id: 49016-122421d26c7b worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-822-atomic-install-authority-kernel phase: claimed candidate_head: 6449594fd7fe57d55e333ace6dfa1ab45bb57463 target_branch: master target_branch_sha: none last_activity: 2026-07-23T03:59:28Z expires_at: 2026-07-23T04:09:28Z blocker: none

sysadmin merged commit caaae9b6ee into master

2026-07-22 23:00:25 -05:00

sysadmin commented

2026-07-22 23:00:29 -05:00

Stale #332 review-decision lock cleanup (#594)

Status: APPLIED

actor: sysadmin
profile: prgs-merger
timestamp: 2026-07-23T04:00:28.406939+00:00
last terminal: approve on PR feat(arch01): atomic platform install + authority kernel (Closes #822) (#839)
PR state: closed (merged=True)
merge_commit_sha: caaae9b6eef496c8f8ed451ac216250c62d495c6
prior live_mutations_count: 1
prior profile_identity: prgs-reviewer

Manual deletion of session-state files is not the workflow.
This path only clears a lock when the referenced PR is merged/closed.

## Stale #332 review-decision lock cleanup (#594) Status: **APPLIED** - actor: `sysadmin` - profile: `prgs-merger` - timestamp: `2026-07-23T04:00:28.406939+00:00` - last terminal: `approve` on PR #839 - PR state: `closed` (merged=True) - merge_commit_sha: `caaae9b6eef496c8f8ed451ac216250c62d495c6` - prior live_mutations_count: `1` - prior profile_identity: `prgs-reviewer` Manual deletion of session-state files is **not** the workflow. This path only clears a lock when the referenced PR is merged/closed.

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Scaled-Tech-Consulting/Gitea-Tools#839