feat: add V2 foundation crates as stacked delivery base - #509
feat: add V2 foundation crates as stacked delivery base#509ScriptedAlchemy wants to merge 9 commits into
Conversation
Carve the low-layer V2 crates out of the consolidated delivery branch so they can merge to master first, with the remaining V2 work stacked on top: - new workspace members: api, application, host-integration, hooks, policy, private-fs, rusqlite-runtime, store, temporal-query, tool-catalog - tracedecay-domain: adopt the V2 contract modules; protobuf node kinds become unconditional domain vocabulary (the lang-protobuf feature is gone, so code-extraction no longer forwards it) - keep the seven master-era result structs (EditResult, MultiEditResult, InsertResult, AstGrepResult, MoveHint, MoveResult, CostTurn) in domain::code_intelligence until the stacked branch replaces their callers - include the host-event/provider fixtures and the rusqlite runtime suite sources the crate tests compile against Verified: cargo check --workspace (default and --all-features) and cargo nextest for the eleven touched crates (2118 passed).
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 06047de72e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| match fs::symlink_metadata(root) { | ||
| Ok(metadata) if metadata.file_type().is_symlink() || !metadata.is_dir() => { | ||
| return Err(HookSpoolError::UnsafePath); | ||
| } | ||
| Ok(_) => return Ok(()), |
There was a problem hiding this comment.
When the configured spool root already exists with group/world-write permissions or a permissive Windows ACL, this branch accepts it after checking only that it is a directory. Another local account can then delete or replace records.v1.bin, metadata, or lease files despite their per-file modes, allowing captured hook envelopes to be corrupted or disclosed. Validate the existing directory's ownership and private permissions—or tighten them—before returning success.
Useful? React with 👍 / 👎.
Cargo auto-discovers tests/storage_runtime_rusqlite_suite/main.rs as a root-package test target, and that harness needs the stacked V2 root crate. The rusqlite-runtime crate tests include the five module files directly, so only the harness leaves this slice; the stacked delivery reintroduces it with the V2 root.
Hawk closed-world visibility audit: this branch vs master
Every pre-existing crate reports identical counts in both runs — the slice introduces zero new findings in master's code ( The entire delta sits in the carved V2 surface, which master's binary does not consume yet by design — its production callers arrive in #421 (which adopted this same hawk audit with a clean burndown):
Integration checks on the compatibility work specifically:
|
The delivery branch lints under rustc 1.97; master CI gates with the repo toolchain, which formats three carved files differently and raises five clippy warnings the stacked branch never sees: - collapse the invalid-activity check into a match guard (domain) - simplify handoff-expiry and recovery-fence boolean forms (application, rusqlite-runtime) - drop an explicit auto-deref on the reader snapshot transaction - box the MCP tools-call future: the V2 domain contracts push it past the configured large-future threshold in master's dispatcher Verified: cargo clippy --workspace --all-targets --all-features -D warnings, cargo fmt --all --check, and nextest for domain, application, and rusqlite-runtime (1514 passed).
Preexisting hawk findings: dispositionInvestigated all 1,653 master-baseline findings against the delivery branch (#421), which gates CI with 68
1,462 Conclusion: every preexisting finding already has its fix up-stack. Re-deleting them here would duplicate #421's burndown and manufacture modify/delete merge conflicts, so this PR intentionally leaves master's preexisting surface untouched — hawk confirms it introduces zero new findings in shared code. Split-crate adoption
Also landed 43260d5: fmt + five clippy fixes the repo-toolchain CI gates caught in the carved surface (delivery branch lints under rustc 1.97, so these were invisible there). |
The workspace contract now lists the ten carved foundation crates as internal members with their real dependency edges, keeps the remaining stacked-delivery crates in the omitted set, and exempts tracedecay-rusqlite-runtime — the one sanctioned boundary around the bundled SQLite engine — from the workspace rusqlite ban. The reachability resolver also learns that a module loaded through an explicit #[path] attribute owns the directory containing the loaded file, so its children resolve as siblings (mod-rs semantics); the carved application crate registers test modules exactly that way.
The work, placement, multi-root, and store-locator contracts require Path::is_absolute, which bare /... literals fail on Windows, so every carved-crate fixture that feeds those validators now builds its root through a platform-absolute helper. This clears the InvalidExecutionEnvelope, InvalidTargetRoot, and registered-root rejection cascades across the Windows CI shards.
…cking work_manifest and the executable-binding builder return CatalogValidationError but built operation, codec, binding, capability, and use-case identities from caller-supplied operation names with expect. A non-canonical name now surfaces as a typed InvalidValue instead of a panic inside a Result-returning path.
generate_node_id hand-rolled a nibble table for the digest-to-text encoding that canonical_text::encode_lowercase_hex already owns; the output is byte-identical.
The store canonical-projection test includes exactly one provider-normalization fixture; the other 36 arrive with their consumers on the stacked delivery branch. Also note why the tools-call dispatch arm alone is boxed.
12-agent review battery: consolidated resultsQuality (4), performance (2), reuse (2), and thermo-nuclear audits (4) over the authored surface. Verdicts: ship across the board once the fix-first items landed (they have). Verified clean, no action:
Merge simulation ( Fix-first findings, now landed:
Deferred to the delivery lane (byte-identical inherited code):
|
1 participant
Summary
First slice of the stacked delivery for #421. This PR carves the fully implemented low-layer V2 crates out of the consolidated branch so they can merge to master independently; #421 is restacked on top of this branch and shrinks accordingly.
tracedecay-api,-application,-host-integration,-hooks,-policy,-private-fs,-rusqlite-runtime,-store,-temporal-query,-tool-catalog.tracedecay-domaincontract modules. Protobuf node kinds become unconditional domain vocabulary, sotracedecay-code-extractionstops forwarding the removedlang-protobufdomain feature.EditResult,MultiEditResult,InsertResult,AstGrepResult,MoveHint,MoveResult,CostTurn) indomain::code_intelligencebecause master'sruntime-core/root crate still consume them; the stacked branch deletes them together with their callers.main.rs) stays on the stacked branch: it needs the V2 root crate, and Cargo would otherwise auto-discover it as a root test target here.#[path]sibling-resolution semantics.Parity with the delivery branch
The carve started byte-identical; the following deliberate, disclosed divergences now exist (each is a fix #421 should adopt verbatim on restack — see the review comment for the conflict inventory):
43260d5— repo-toolchain fmt/clippy gate fixes (the delivery branch lints under rustc 1.97 and never sees these).b57b35b— platform-absolute fixture roots so the work/placement/multi-root/store-locator tests pass on Windows.b728605/ea0fa23/fd1f2e3— typed catalog-identity errors instead ofexpectinResultpaths, canonical hex reuse ingenerate_node_id, and only the consumed provider fixture carried (the other 36 arrive with their consumers in feat: consolidate TraceDecay V2 PR8-PR13 delivery #421).Behavior notes
NodeKind::ProtoMessage/ProtoService/ProtoRpcare now always part of the domain vocabulary: graph payloads containing protobuf node kinds deserialize on every build, not only underlang-protobuf. Protobuf extraction remains feature-gated intracedecay-code-extraction; only the contract vocabulary broadened.[workspace.package] edition = "2024"; new crates inherit it while existing crates keep their expliciteditionkeys until the stacked branch unifies them.Verification
cargo check --workspace(default and--all-features) — passcargo nextest runover the carved crates — pass (latest: 1,261 across domain/application/store; 1,677 across the four crates incl. rusqlite-runtime with one known load-sensitive failure, below)cargo fmt --check,cargo clippy --all-targets --all-features -D warnings— passKnown remaining issue
tracedecay-rusqlite-runtime repository::graph_publication::tests::relational::retired_cleanup_materializes_only_the_near_limit_record_admitted_to_each_pagefails under CI load: thecfg(test)exact-SQL budgets (250ms/statement, 500ms/transaction) cannot absorb three ~4MiB near-limit appends on slow runners. This is delivery-branch code needing a design decision (theAuthorizedLongLeaseescape hatch is deliberately reserved); tracked as the one red test expected on CI.Stack
masterfeat/v2-foundation-crates