Repository navigation
feat(kernel): complete P02b-3 durable subscriber delivery - #31
Merged
Merged
Conversation
Record PR #27's merged head and independently verified merge-run evidence so current status surfaces agree with the delivered public renderer. Keep dated delivery history intact and name P02d-7's remaining decisions, demo, Lighthouse and phase-exit obligations without starting that packet.
Record the approved lifecycle, genericity scope and serial browser/audit measurement boundaries before implementation. Register the four proof obligations without claiming passing runtime evidence or activating CI. ADR: 0056
Give local and isolated CI runs one owned lifecycle with explicit stack selection, migration readiness and seed-derived public content checks. Preserve local data and refuse foreign listeners or uncertain cleanup. The browser audit driver remains in its approved subsequent step. ADR: 0056
Keep selected database configuration consistent before stack actions and make owned teardown survive terminal hangup. Preserve split UTF-8 output within a byte bound and keep public marketing outside private-content exclusions. ADR: 0056
Close the second P02d-7 Step 1 review findings before the ADR-0056 browser and audit work.
Close the focused ADR-0056 lifecycle fix review with a live profile-boundary mutation and its accepted-hop control.
Project typed SeedData into exact backend/frontend identity controls, ban production Seeder references and preserve the schema-revision behavioral companion for the ADR-0056 exit foundations.
Keep the exact-literal guard effective across compiled C# branches, UTF-8 constants, emitted JSX values and runtime helpers behind test exclusions. The first independent review found and reproduced each escape.
Keep lexical configurations independent and resolve static module URLs so source exclusions cannot hide a demo-specific runtime helper. ADR: 0056
Preserve the bounded import census when resolver options change the location of a relative runtime helper. ADR: 0056
Measure the actual seeded product navigation with bounded, repeatable browser and audit evidence while preserving real admission and cleanup. Keep passing local feasibility distinct from pending CI enforcement. ADR: 0056
Close independently reproduced false-green paths in completion logging, Lighthouse timeout admission and visible product identity. Exercise real DOM mutations and the pinned soft-timeout behavior in the shared proof. ADR: 0056
Keep damaged or deferred API refusals out of successful demo receipts, and require the bounded seeded visibility controls to run against the actual browser document. ADR: 0056
Share the existing five-second cleanup reserve between process stopping and output drain, and record the independent causal fix verification. ADR: 0056
Record the complete round-two runtime proof and scoped source identity so the CI exit step starts from verified evidence. ADR: 0056
Run the shared seeded browser and audit lifecycle in real PR checks, keep public artifacts bounded, and pair each exit obligation with its named proof. Add third-locale and organization-branding pipeline/HTTP cases and carry remaining lifecycle work to its explicit phase owner. Live protection activation waits for the first successful real job. ADR: 0056 Module: Tenancy, Education
Pair host, locale and organization HTTP outcomes with raw translation reads on each request connection. Reserve cleanup inside the CI budget and prepare sandbox-enabled managed Chromium on hosted Linux only. Reconcile mutable exit and review guidance with delivered contracts. ADR: 0036, 0040, 0052, 0056 Module: Education, Tenancy
Record independent runtime and corpus approval, focused proof results and verified navigation fixes. Keep real Linux CI, full receipts and seventh-check activation explicitly pending before phase exit. ADR: 0056
Tie completion to the passing real PR reports and bounded required-check activation so acceptance and local feasibility cannot stand in for exit evidence. Preserve earlier delivery history and maintainer merge review. ADR: 0056
Remove two stale pending suffixes after independently confirming both named cases Passed in the downloaded real PR integration receipt. ADR: 0056
Keep the identity census aligned with the producer's nullable curriculum contract while preserving every tenant and present-curriculum assertion. The required demo inventory remains enforced separately. ADR: 0018, 0056
Keep installed tool metadata and receipt versions in one path while retaining independent pinned drift checks. Distinguish reviewed-head CI receipts from activation history and acceptance-time ADR wording. ADR: 0056
Record both fresh independent approvals and local proof results while keeping later-head seven-job CI acceptance with the PR check rollup. ADR: 0056
Keep the documented seed launcher argument-free. Attempt owned Compose teardown even when process cleanup or output observation fails, and retain private state until every cleanup stage succeeds. Preserve private error causes internally while keeping foreground diagnostics fixed. ADR: 0056
Resolve supported local aliases and workspace exports transitively, refuse unclassified roots/formats and missing imports, and distinguish actual dependency/output roots from nested authored source. Cross-check backend sources against evaluated Compile inputs and refuse unmodeled build shapes. ADR: 0018, 0035
Include competing alias and JS/TS targets conservatively, and select workspace exports only from owned manifests. Refuse implicit build hooks and project references outside the evaluated production project set. ADR: 0018, 0056
Refuse inherited alias maps even when a same-basename source file would previously shadow the actual JSON configuration. ADR: 0018, 0056
Exercise independent network overlap and per-route timing aggregation in fast dirty/clean controls. Count completed navigations and restrict uploads to named public artifacts. Record verified review dispositions and align current P7 guidance without rewriting historical ADRs. ADR: 0018, 0056
Record all three steps, verified fixes, both independent review rounds and completed local validation. Require final seven-job PR CI without attributing historical evidence to the new source head. ADR: 0018, 0056
Persist validated immutable envelope copies atomically without constructing business handlers. Claim shared inbox identities only on the announced application transaction, before the later delivery owner executes work. Prove duplicate waits, conflicting subsets, tenant scope and uncertain acceptance COMMIT using PostgreSQL. Preserve producer worker cancellation and cleanup proofs with a disclosed acceptance wrapper and direct control. ADR: 0046, 0057, 0040, 0003
Keep retained-envelope execution on one prepared application transaction, so inbox, business state, produced events, audit and delivery completion commit together. Fence ownership after saved work and arbitrate cancellation against physical commit without losing acknowledged durability to cleanup. ADR: 0046, 0040, 0057, 0044
Record the independent first-round reviews and completed broader regression, and attribute the two new owner-census proofs to their delivery step. ADR: 0046
Record fresh second-round runtime and evidence verification before advancing to independent subscriber scheduling under the accepted package. ADR: 0046
Keep subscriber retries, terminal audit and targeted replay independent from producer and sibling outcomes. Retain cancellation callbacks and scope cleanup through actual completion, and observe bounded progress without adding payload access to the confined scheduler. ADR: 0040, 0044, 0046
A retained handler or cleanup must not consume the producer's timeout and capacity through a shared partition queue. Keep consumer ordering local while allowing durable acceptance to finish independently; prove both held-handler and acknowledged-cleanup scenarios with a killed mutant. ADR: 0046
Record the verified acceptance-lane correction and independent second round reruns before advancing to useful consumers and Seeder handoff. ADR: 0046
Make both durable tenant-created subscriptions useful without replacing any touched customization concept. Share transaction-owned semantic locks with ordinary registration, and let Seeder retain verified warm built-in identities while authored identities remain exact. ADR: 0046, 0057 Module: Customization, Tenancy, Audit
Keep mutable audit ownership and review guidance consistent with the Active production subscriptions, while preserving dated prior receipts. Record the first independent Step 5 review and verified corrections. ADR: 0046, 0057
Record both completed independent Step 5 reviews and distinguish the Pending policy fixtures from the Active production bindings they protect. ADR: 0046, 0057
Keep both real default subscribers inside the shared inbox and common completion owner, and require concrete handler audit coverage in the actual roots. Exercise missing and bypassed typed capabilities with planted controls and prove persisted tracing from HTTP and delivery. Reconcile current guidance while preserving accepted decision history. ADR: 0046, 0057, 0044, 0038 Module: Customization, Tenancy
Bind provisioning to its exact type, follow inherited implementations and generic DI forwarding, and enumerate EF transaction completion so future typed bypasses cannot appear covered by the common-owner guards. Keep independent dirty and clean controls and align current guidance. ADR: 0046, 0042, 0057 Module: Customization, Tenancy
Record fresh second-round evidence and the verified current-carrier corrections so the completed six-step implementation has one truthful handoff. Preserve historical receipts and leave PR-head CI and merge with their actual owners; background jobs remain the next packet. ADR: 0046, 0057
|
Sorry @cemililik, your pull request is larger than the review limit of 150,000 diff characters |
Contributor
|
Important Review skippedToo many files! This PR contains 163 files, which is 13 over the limit of 150. To get a review, reduce the PR to 150 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to Team to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configuration
📒 Files selected for processing: 163
You can disable this status message by setting the
Comment |
Give the completed packet one live PR and exact-head CI owner while preserving scoped local receipts and the next background-job decision gate. Maintainer review and merge remain pending. ADR: 0046, 0057
Keep failed queue observations recoverable and distinguish uncertain completion from lease expiry. Pin actual tenant-announcement callers, status parsing and production index candidates without relaxing the accepted overrun or causal-metadata contracts. Reconcile live delivery status and record verified review dispositions and scoped validation. ADR: 0040, 0046, 0044
Preserve the classified direct one-root consumer path while banning module writes to inbox and delivery machinery. Remove a stale setter count and record independent first-round verification and corrections. ADR: 0040, 0044, 0046, 0057
Normalize qualified implementation statuses so two shipped integration rules participate in catalogue checks. Pin qualified discovery in the existing parser control and record independent second-round verification. ADR: 0003, 0046
Rotate acquisition classes so terminal audit outages cannot starve unrelated deliveries. Compare retained type identities through the explicit registry family while preserving every immutable envelope. Close constructor/project census gaps and align diagnostics and receipts. ADR: 0046, 0057
Record three independent reviews and their executed checks without substituting earlier CI evidence for the correction head. ADR: 0046, 0057
The subscriber review exposed the same priority starvation in producer dispatch. Rotate claim classes while retaining one claim, lease fencing, terminal audit atomicity and the existing publication ownership boundary. Prove real durable acceptance and recovery under sustained audit denial. ADR: 0046
Record both independent review rounds for the adjacent producer fix and keep final-head CI ownership explicit without reusing old receipts. ADR: 0046, 0057
Collaborator
Author
|
@coderabbitai review all |
Contributor
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Complete P02b-3 durable subscription acceptance and independent delivery: retained envelopes, immutable shared inbox, six-attempt retries/recovery, fenced completion and atomic terminal MUST audit.
Activate two independent Customization defaults (
card@1content type,plain@1taxonomy), preserve existing concept history, and hand Seeder to the same initializer commands with strict semantic verification.Enforce actual handler/manifest/DI and typed lifecycle boundaries, extend audit/aggregate censuses, and reconcile documentation without rewriting Accepted ADR history.
Address the first verified external review: restore immediate failed-snapshot recovery, distinguish uncertain COMMIT from lease expiry, close tenant-announcement/status-parser test gaps, and correct current delivery status.
Close the second external review: prevent terminal-audit starvation in both workers with bounded class rotation, accept explicitly compatible alias duplicates without rewriting retained envelopes, and strengthen completion/project censuses, diagnostics and regression proofs.
Approach
Publication commits every required subscription envelope without constructing business handlers. A separate app-role executor claims the shared inbox before construction and owns business state, produced outbox, MUST audit and fenced ledger completion in one transaction. An attempt-local gate arbitrates cancellation against commit admission; actual tasks and cleanup retain scope/capacity until finished. Acceptance and execution use separate local partition lanes.
This implements the approved six-step package on
development; each step has an implementation commit and two fresh independent review rounds. Publication remains at-least-once. There is no cross-process ordering or exactly-once transport claim.Tests
0fa7dc869d5b0f704a2d05313226d3d1b0f98510. Strict protection and the required context set are unchanged; PR is OPEN/CLEAN.a131ca6b59f750c69d4465b46a0bd1a5717dcd0a).Risk
Migration / Rollback
Apply
20261013083903_add_event_delivery_and_inboxthrough the normal platform migration chain before starting the new workers. It creates the two shared tables, isolation/immutability controls, matching indexes and column grants; existing producer rows remain available for durable acceptance. No new database role or secret is required.Down drops the new ledger/inbox and their retained delivery evidence. Use it only on disposable schemas; keep durable tables and data when rolling an application deployment back. Completed inbox rows are never reset by internal replay.
Related
dd243a0on its existing branch; no Hub runtime/HTTPS change or Hub push is included.Prepared with Codex.