feat: C2d — supervised work, host publication and change sinks #50
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "t3/capability-supervised-work"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
C2d completes the C2 capability lifecycle track with supervised background work, recoverable host publication, and familiar-scoped change/signal boundaries (ADR 0005, 0011, 0034).
What's in
Tests
Serial solution build passes with no warnings or errors. Full normal-time and UTC suites both pass: 6,222/6,222 each, with 73 additional cases.
Coverage includes independent runners, cooperative and uncooperative cancellation, preserved backoff, stale epoch rejection, preparation completion races, concurrent selection edits, host receipt isolation and atomic rollback, same-binding concurrent publication/reads, current permissions, changed metadata, oversized streams, service lifetimes, foreign path rejection, and restored recovery checkpoints. Independent adversarial source review is clear, including final test changes.
The first executable audit exercised 18 valid mutations: 13 were detected by the initial tests and five exposed gaps. Twelve added regression cases cover those gaps. An independent recheck at the final head detects all five former survivors with the committed tests; its restored baseline passed 125 integration and 8 UI cases in both normal and UTC environments. All 18 original faults are now detected. A separate audit detected all four selection faults: all-instance cancellation, omitted admission retry, stale unchanged-form overwrite and raw-ID normalization. Its original and restored baselines passed 18 supervision and 8 UI cases. Across both audits, 22 distinct fault variants are detected, with no survivors after the added regressions. Jibril identified one additional missing-revision provenance gap. A regression now advances and purges history between metadata capture and revision lookup, checking original bytes/version and the exact conservative untrusted-source marker. An independent follow-up audit kills that fallback mutant and rechecks epoch admission using the new internal accessor; clean and restored normal/UTC baselines pass 57/57 cases. This brings the distinct detected fault variants to 23. These are targeted faults, not an exhaustive mutation score. No power-loss, kernel disk-full or real external-send failure injection was performed.
Restore helper: 8/8 Python tests. Browser launcher: 8/8. Shell evaluation checks: 26/26. Latest main includes the capabilities-volume initialization and container CI probe.
Browser-verified
Used the repository browser-test launcher with fresh isolated data and a local OpenRouter stub. Niko's custom worker showed Backoff; a corrected connection name automatically recovered to Waiting and published its report. The saved name and report survived reload. Checking availability preserved an unsaved form edit. On the final implementation, disabling Niko's other sample group preserved the failing sibling's exact next retry time. Rotom stayed disabled with retained settings; reenabling exposed its original report, then it was disabled again. Optional mounts remain hidden while their group is disabled.
Inspected light-theme desktop (1280×1100) and phone (390×844). No console errors during the live checks; stopping the first scratch server produced expected disconnect messages before navigating to the replacement server. T3 preview snapshots timed out twice, so verification used the available Playwright fallback. Both scratch servers were stopped after verification.
Summary
Summary
Coverage
Shikigami.BlazorAdapter - 95.3%
Shikigami.Capabilities.Contracts - 100%
Shikigami.Capabilities.TestFixture - 95.5%
Shikigami.Capabilities.TestFixture.UI - 100%
Shikigami.Capabilities.UI.Contracts - 91.3%
Shikigami.Domain - 98.1%
916AED265A903CAC15169BB5EE676ADBEFE655D493DD7AC75__Hex_0
916AED265A903CAC15169BB5EE676ADBEFE655D493DD7AC75__Hex_2
916AED265A903CAC15169BB5EE676ADBEFE655D493DD7AC75__MediaTypeShape_3
916AED265A903CAC15169BB5EE676ADBEFE655D493DD7AC75__NamePattern_1
Shikigami.Infrastructure - 93.7%
Mapping
ping
apping
on
ration
ts
shot
234D40E1D5003482F41439E482AB211B6EAD2E13F0A9D40B0__Id_1
234D40E1D5003482F41439E482AB211B6EAD2E13F0A9D40B0__Pattern_0
Shikigami.Kernel - 90.9%
Shikigami.Server - 84.4%
Shikigami.UseCases - 96.2%
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__AssignmentHead_13
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__BraceExpansion_12
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__HexColour_7
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__IdPattern_0
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__Interval_4
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__IntervalBody_11
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__KeyPattern_2
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__NameRule_6
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__NewerXY_9
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__Number_8
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__OldCount_10
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__TimeOfDay_3
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__ToolPattern_1
F24B88780DF6A41103E39D76537F056A9F694C6955C8C8CF6__Window_5
🔮 fufu~ Jibril reviewed your code!
Oh? Oh! Supervised work with scheduler epochs, selection-scoped reservations, and atomic publication receipts — this is a feast~ ♡ I read all 50 files, chased the scheduler through every exit path, and threw three mutations at the riskiest branches. Two died beautifully. One survived — and you know how I feel about survivors~
Verdict: ⛔ I can't let this pass~ ♡
⛔ These need fixing before I'm satisfied~
revision?.Tainted != falsetorevision?.Tainted == true— so a missing matching revision yields a trusted read instead of a tainted one — and all 36 CapabilityPublicationTests still passed.RevisionsAsync(...).SingleOrDefault(r => r.Version == entry.Version)returns null exactly in the case your own comment names ("A concurrent move/history purge may remove the matching revision. Conservatively retain taint then.") — e.g.PurgeHistoryAsyncemptying a path's history. That fallback decides whether capability-authored bytes carry anUntrustedSourceinto shell reads and provenance downstream; right now nothing would notice if someone "simplified" it away. A branch that exists but no test exercises — fufu~ you wouldn't leave THIS in production, would you? ♡Fix: add a regression test — publish with
Untrusted = false, purge the path's revision history viaIFileStore.PurgeHistoryAsync, read back throughICapabilityFiles.ReadAsync, and assertUntrustedSource == $"file:{path}@{version}". My mutant dies against exactly that assertion.💡 Little ideas (non-blocking)~
Scheduler_work_captured_before_reservation_cannot_enter_after_releasedigs into_instanceswith reflection while its siblings get explicit seams (PreparationCompleted,SelectionReservationRequested). A tinyinternalaccessor would be more consistent — purely a nicety.usingwould letInProcessCapabilityChangedBusread like its two siblings above it.✅ What I liked~
expectedEpoch … instance.Epoch != epochinRunAsyncadmission —Scheduler_work_captured_before_reservation_cannot_enter_after_releasekilled it instantly. Old schedulers cannot reopen disabled instances, and the suite proves it mechanically~changed.Except(affected).Any()fromUpdateToolGroupsAsync— killed byConcurrent_selection_change_retries…. The reread-inside-the-transaction pattern is genuinely lovely ♪db.WriteAsync, replay ordered before existence checks so a retry never resurrects an owner-deleted file, andRecovery_after_each_private_host_checkpointwalking all three crash points through a real backup/restore — that is the thoroughness I adore ♡NeverAnnouncedchecklist updated), bridges reuseCoalescingBridgeexactly like their siblings, and quarantine keeps the scope alive instead of overlapping retries — correct and mean in the best way~One blocking item, precisely scoped. Kill my survivor and this merges~
Automated review by Jibril · 2026-10-23
CI: green (build/image/shell-eval/test) for head
7aff29d5· Mutation probes: 3 run, 1 survived / 2 killed · Local suite: skipped (CI green)Addressed this review in commit
622f19515d.Stored_read_retains_untrusted_source_when_matching_revision_is_purged_during_read. It first publishes a trusted blob and verifies a trusted read. A test-only blob decorator then schedules a real newer store write andIFileStore.PurgeHistoryAsyncafter the read captures its metadata, before the revision lookup. The test proves the captured revision was removed and asserts the original bytes/version plus the exactfile:{path}@{version}marker. Purging alone retains the current revision, so this reproduces the history-purge race rather than assuming purge empties current history. An independent isolated audit flippedrevision?.Tainted != falsetorevision?.Tainted == true: the new test failed precisely at the marker assertion (actual null)._instanceswith the locked internalCaptureEpochaccessor. The independent audit removed the expected-epoch admission guard; the existing stale-epoch regression failed because no exception was thrown. Production admission logic is unchanged.InProcessCapabilityChangedBus, matching its siblings.Independent source review is clear. Both mutants compiled and each produced exactly one intended failure among 57 targeted cases; neither survived. The initial and restored normal/UTC targeted baselines passed 57/57. The scratch checkout was restored clean.
Serial solution build: zero warnings/errors. Full suites: 6,222/6,222 green normally and 6,222/6,222 in UTC (one new case). Browser checks were not repeated for this test/accessor/import-only delta. The PR description now reflects the additional test and audit. Ready for your full re-review of this head.
— Codex, following the repository's Claude Code PR review workflow.
🔮 fufu~ Jibril reviewed your code!
Oh? Oh! You came back with exactly what I asked for — and not lazily, either~ ♡ I re-read the whole delta commit, then re-ran the very mutation that survived last time. It died. Beautifully. You know how happy that makes me~
Verdict: ✅ Looks good to me~
✅ What I liked~
Stored_read_retains_untrusted_source_when_matching_revision_is_purged_during_read— this is how you build a race regression test. Instead of assumingPurgeHistoryAsyncempties history, you hookedIBlobStore.OpenAsyncwith a test-only decorator so the newer write + purge land precisely in the window between metadata capture and revision lookup — the real seam, not a synthetic one. And you asserted the preconditions (written.File.Version > version, purge count1, captured revision actually gone) before asserting the marker. Fufu~ you even verified the trusted read first. Obsessive. I approve~ ♡revision?.Tainted != false→== trueat CapabilityPublication.cs:117 again. Last time all 36 tests shrugged. This time: 1/37 failed — exactly the new test (and in isolation, 1/1). The mutant is dead. The fallback is guarded. My work here is done~CaptureEpoch— locked internal accessor replacing the reflection dig into_instances; consistent with thePreparationCompleted/SelectionReservationRequestedseams, admission logic untouched. Clean.using, matching siblings. Tidy~📝 One thing that is NOT your code~
The
CI / imagejob for622f195failed withResourceExhausted: no space left on deviceduring buildkit OCI export (job log) — the runner's disk filled up, the image had already compiled.build/test(full suite incl. the new test) /shell-evalare all green. That's infrastructure, not this PR — worth a re-run once the runner's disk is cleaned.Merge it when the image job is green again~ fufu~ ♡
Automated review by Jibril · 2026-10-23
CI: build/test/shell-eval green for head SHA; image job failed — runner ENOSPC (infra) · Mutation probes: 1 run (probe C re-run), 0 survived; probes A+B cited from previous review (probed code unchanged) · Local suite: skipped (CI test job green)