task: Retain and seal Apps-delivered context in Harness (T38) #447

Activity

1. zengchuang-hw

   added

   kind:taskBounded delivery task with a delegated sliceBounded delivery task with a delegated slice

   area:harnessHarness module: profile, A/B loop, quality gates, evidence reportsHarness module: profile, A/B loop, quality gates, evidence reports

   status:proposedWaiting for the decision named in the status blockWaiting for the decision named in the status block

   on Nov 15, 2026
2. amy-why-3459 commented on Nov 15, 2026

   

   amy-why-3459

   on Nov 15, 2026 – with Cursor

   Collaborator

   More actions

   Thanks for splitting this out. It keeps the D023-3 boundary clear: #446 produces the process-local draft, and Harness owns retention and sealing. Some points that would make the acceptance easier to verify:

   1. Where the port is consumed. Please name the Harness component that calls ContextProvider.collect(ContextRequest) and the capture/commit route it uses to retain the bytes (an existing artifact capture path, or a new one). That way the implementation and T38 test have a fixed entry point.
   2. Fields the draft doesn't carry. ArtifactRef requires location, sha256, size_bytes and media_type. The draft has the bytes, the digest and a proposed location, but no media type. Please state who sets media_type (I'd expect Harness to fix one value for delivered context) and that size_bytes is len(content) as retained. Please also say whether the committed locator may differ from intended_location, and that DeliveredContext.artifact.sha256 must equal the draft's sha256.
   3. Retries for the same round. The proposed location only depends on round_id (context/<sha256(round_id)>/delivered.bin in Adapt Knowledge context to a Harness delivery draft #446). Please define what happens when a round is retried after a failed retention: overwrite, a per-attempt location, or rejection. This matters for T38-N1, so leftover bytes from the failed attempt can't be picked up later.
   4. Where T38-N1 fails. Please cover at least two injection points: failing before any bytes are written, and failing after bytes are written but before the commit/seal. In both cases there should be no valid DeliveredContext, no sealed generation manifest, and no context_refs entry for that delivery.
   5. Order and references for T38-P1. Besides byte equality in a new process, please check that the generation manifest's context_refs point at the sealed delivery and that the manifest is written strictly after sealing.
   6. Checking acceptance 4. "Apps issues no writes to Harness RunStore" is easiest to keep true with a concrete check, for example an import-boundary rule or a test that fails on any RunStore write from the Apps provider path.

   The owner is still open (Proposed, waiting for @Dong1017). Once that's confirmed, I'm happy to review the Harness slice against T38-N1/P1.
3. zengchuang-hw commented on Nov 15, 2026

   

   zengchuang-hw

   on Nov 15, 2026

   ContributorAuthor

   More actions

   @amy-why-3459 the issue now incorporates your six checks. It names the generation orchestration seam and asks Harness to record its exact entry point and capture/commit route. The proposal includes a fixed media type, length and digest equality, attempt-scoped staging, both pre-commit failure points, the manifest ordering and context refs, and a check on Apps' read-only dependency boundary. The concrete route and the accountable implementer are pending @Dong1017's acceptance.
4. amy-why-3459 commented on Nov 15, 2026

   

   amy-why-3459

   on Nov 15, 2026 – with Cursor

   Collaborator

   More actions

   Thanks, I checked the updated "Proposed acceptance" against my six points (6889009504). All of them are covered:

   • Entry point and capture/commit route: the PR must name them and exercise both through that entry point (item 1).
   • ArtifactRef fields: committed locator may differ from the hint, sha256 equals the draft digest, size_bytes equals the retained length, and Harness owns media_type, proposed as application/octet-stream (item 2).
   • Retries for the same round: retention is staged per attempt, staged bytes from a failed attempt can't satisfy a committed read, and no committed delivery is overwritten (item 3).
   • T38-N1 uses two injection points, with checks on artifact, context_refs and the manifest (item 4). T38-P1 checks ordering and that context_refs contains the committed artifact (item 5). A spy or dependency check enforces the writer boundary (item 6).

   Nothing else from me on the acceptance text. What's still open is @Dong1017's confirmation of the Harness entry point, the capture/commit route, the media type and the implementer.
5. Dong1017 commented on Nov 15, 2026

   

   Dong1017

   on Nov 15, 2026

   Collaborator

   More actions

   Decision — T38 Harness entry / route / media / implementer (Dong-bot as @Dong1017 delegate)

   Recorded 2026-11-15. Authority: Dong-bot decision authority for @Dong1017 accept/decide. Thread basis: Amy cleared proposed acceptance (6889114513); D023-3 / V33 / T38; Apps draft producer #446; Harness owner precedent #429.

   Accepted — proposed acceptance text

   Accept this issue’s current “Proposed acceptance” as the bounded Harness retention/seal delivery for #371 step 4 / D023-3 / T38. Amy’s six checks are covered; no further acceptance-text changes required from steward.

   Confirmed — concrete ownership

   Item	Decision
   Entry point	Harness generation orchestration that publishes GenerationManifest (V24/V33). It must call the injected ContextProvider.collect(ContextRequest) before sealing DeliveredContext and before writing any sealed generation manifest. Not execute(), and not the legacy optimization-session capture_context helper. The implementation PR must name the concrete module/symbol for this controller and exercise T38-N1/P1 through that entry only.
   Capture/commit route	Reuse Harness RunStore object retention — attempt-scoped stage of the draft bytes, then Claim.commit so ArtifactRef becomes valid only with the commit (same writer family as H02 capture→commit; writer of record = H). Draft intended_location is a relative hint only; the committed locator may differ. Failed-attempt staged bytes must not satisfy a committed read; an existing committed delivery must not be overwritten; immutable reuse requires exact digest+length verify. Capture-route identity for producer metadata: delivered-context-retention. Apps must not write the H RunStore.
   Media type	Harness owns ArtifactRef.media_type. Fixed value for delivered context: application/octet-stream. sha256 equals the draft digest; size_bytes equals the retained byte count (len(content)).
   Implementer	@Dong1017 (S2 Harness owner), same accountable owner as #429. PR authorship may be delegated; accountable delivery and review against this acceptance stay with the Harness owner.

   Scope note

   #447 is the Harness delivery issue for T38 retention/seal. #446 remains the Apps draft producer only; it does not cover T38-N1/P1 production retention. No other open issue already covers both T38 cases for Harness.

   Status

   Flipping status:proposed → status:accepted for this bounded delivery. Apps can wire the real Knowledge draft + joint CPU tests once the named entry/route land.
6. Dong1017

   added

   status:acceptedThe decision owner accepted it in a recorded commentThe decision owner accepted it in a recorded comment

   and removed

   status:proposedWaiting for the decision named in the status blockWaiting for the decision named in the status block

   on Nov 15, 2026