Repository navigation
016 harden session integrity - #37
Merged
Merged
Conversation
Freeze the v0.16 Composer identity compatibility contract for unchanged incremental consumers and define one-time v0.17 Store/merged convergence without preserving unstable transitional IDs. Specify workspace-scoped logical addressing and payload I/O isolation, safe bound migration, replica reconciliation, deterministic timestamp provenance, private SQLite staging, capability-aware driver selection, bounded read contexts, and fail-closed publication. Add the complete 016 specification, research decisions, implementation plan, data model, public/CLI/internal contracts, JSON schema, validation quickstart, quality checklist, and 115 dependency-ordered implementation tasks with release-blocking regressions. Amend the project constitution and agent context so stable returned values, native source fidelity, deterministic synthetic identities, and prior-version compatibility tests remain mandatory review gates. Refs: #33
Freeze the cursor-history v0.16 Composer identity projection and pin the unchanged vibe-history consumer oracle, including real synthetic SQLite rollback and idempotency coverage. Define workspace-scoped addressing and I/O boundaries, merged-session fidelity and provenance, duplicate occurrence reconciliation, migration safety, timestamp provenance, private backup handling, SQLite capability probing, and bounded read contexts. Align public and CLI contracts, the structured-output schema, Compatibility Matrix v1, defensive Source Read Limits, and the fail-closed pack-once release workflow. Finalize traceability for FR-001 through FR-080, SC-001 through SC-017, and T001 through T115 with no unresolved product decisions.
Add the feature-016 source, resolution, identity, timestamp, workspace membership, diagnostic, and Source Read Limits v1 type vocabulary while preserving existing public fields. Introduce stable typed errors with safe machine-readable details, exact inclusive source-limit validation, lexical exact-first/unique-suffix workspace matching, and operation-bound low-level I/O observation that fails unknown resources closed. Export the additive contracts through core and library surfaces, map typed failures to existing CLI exit categories, and lock the behavior with focused error, scope, limit, and observer regressions.
Add synthetic Composer, Store DB, transcript, backup, duplicate-UUID, and conflicting workspace fixtures together with exact-byte built-CLI capture, low-level I/O poison probes, and canonical contract assertions. Copy the pinned vibe-history v0.16 Cursor projection, digest, replacement policy, and real SQLite transaction behavior into a self-contained compatibility harness, lock the upstream revision and source-blob inventory, and preserve downstream persistence ownership. Record completed setup and foundational tasks so later identity, scope, security, and release slices can reuse one deterministic test foundation without reading live user data or an adjacent checkout.
Add a source-independent identity layer that reproduces the v0.16 Composer projection before Store alignment, preserves native IDs byte-for-byte, and allocates positional compatibility IDs for missing Composer identities. Define canonical JSON and SHA-256 inputs, Store DB/transcript occurrence namespaces, collision suffixing that never rewrites Composer IDs, fixed Composer-to-Store tool matching, synthetic tool identities, and deterministic relationship rewriting. Lock the v0.16.0 projector commit and source blobs with an independent rowid, placeholder, filtering, branch, and fallback oracle so current production parsing cannot silently redefine the compatibility baseline.
Probe the concrete read, read-write, and online-backup APIs exposed by each provider instead of treating a successful import as sufficient capability. Select a driver independently for each operation with strict library, process, and environment preferences; permit fallback only during automatic selection and expose stable typed errors when no capable provider exists. Preserve synchronous setDriver semantics, verify old-node backup boundaries with real adapters, and record completion of the capability-profile and selection tasks.
Require better-sqlite3 versions from 12.10 through the end of major 12 and lock 12.11.1, whose published runtime matrix includes Node 26 while retaining the advertised Node 20 floor. Keep the declared range and root lockfile dependency identical and record completion of the researched provider-baseline task.
Run the required suite through Vitest JSON reporting and reject zero tests, unexpected platform skips, failures, timeouts, and cancellations with a documented machine-verifiable policy. Replace the test-swallowing publication job with an explicit Node capability-boundary matrix, a pack-once checksum-addressed candidate, exact-byte smoke stage, protected maintainer approval, and publication of the preserved tarball without rebuilding. Add release-workflow mutation tests covering the historical bypass, tag/version identity, dependency ordering, runtime coverage, clean installation, and exact-artifact publication.
Build a metadata-only logical catalog keyed by native Cursor UUID while keeping private locators separate from deterministic workspace memberships and canonical-path selection. Fingerprint only unchanged-consumer payload fields, collapse equivalent same-role and same-tier replicas with complete occurrence provenance, and surface divergent replicas as one locator-free ambiguity with operation-scoped opaque references. Keep Composer global/workspace and Store DB/transcript arbitration in fixed tiers so complementary sources remain distinct and unselected payloads stay lazy.
Compile the library and core into a dedicated CommonJS tree, mark that tree with a local package type, and generate dist/lib/index.cjs as the package-root require wrapper. Keep the existing ESM/declaration build while making npm run build produce both module formats without introducing a bundler or changing the CLI output.
Freeze the exact v0.16 Composer projection before alignment, pair messages once in a permanent Composer-to-Store orientation, and keep matched Composer IDs stable regardless of the preferred rendering backbone. Preserve Composer tool-call slots while enriching matched calls and appending Store-only calls in native order; allocate nonempty versioned identities and rewrite parent and active-branch relationships through resolved IDs. Keep legacy source as the replacement-safety signal, expose merged provenance additively, route merged summaries by resolvedSource, and serialize the new identity and relationship metadata. Add deliberate pairing and tool-order mutation switches plus regressions for backbone ties, Store gaps, standalone files, partial fidelity, active branches, and JSON/Markdown output.
Create exclusive per-operation workspaces with private POSIX directory and file modes, versioned owner/process markers, tracked direct artifacts, idempotent exhaustive disposal, and typed paths-only residue reporting. Coordinate catchable-signal and AbortSignal cleanup while preserving signal termination, and conservatively recover only current-owner stale workspaces whose PID/start token proves death or reuse. Refuse recursive traversal through unexpected directories, never follow candidate or marker symlinks, and validate umask, parent modes, concurrent creation, SIGKILL containment, recovery traps, and platform-qualified Windows behavior in real child processes.
Extract backup databases into per-operation private workspaces instead of world-readable files in the shared temporary directory. Create the workspace with the hardened lifecycle manager, preserve 0600 snapshot permissions, and dispose it when opening fails or when the database wrapper closes. Cleanup errors now take precedence while retaining close/open failures as their cause, so plaintext residue can no longer be silently ignored. Add integration coverage for POSIX directory and file modes plus cleanup after open and close failures.
Add a deterministic, executable generator for Composer-only v0.16 raw SQLite, workspace fallback, tagged projection, pinned vibe-history archive, and Store enrichment fixtures. Record exact cursor-history and consumer provenance, logical inventory, and artifact hashes so compatibility tests do not depend on a live Cursor installation or adjacent repository. Add recurring byte-for-byte regeneration, POSIX permission, logical inventory, sensitive-content scanning, and poison-mutation checks. Also lock v0.17 complete/degraded merge, transcript-to-Store transition, and fatal CLI stream baselines for corrective convergence tests. Mark implementation tasks T012 and T013 complete after the compatibility suite passes 19 of 19 tests.
Replace the stale 0.9.2 manifest literal with a generated package-version constant and fail typecheck/build when that generated source drifts from package.json. This keeps packed ESM and CommonJS artifacts self-identifying without relying on the consumer process working directory. Emit the additive producer field while retaining cursorHistoryVersion for compatibility, keep producer optional so legacy manifests remain readable, and add tests for both new and legacy manifest shapes. Mark task T070 complete after ESM/CJS builds, typecheck, and backup security/unit tests pass.
Add the canonical shipped contract for logical and physical identity, interface-specific index bases, workspace payload isolation, fidelity versus provenance, deterministic timestamps, Source Read Limits v1, backup permissions, and v0.16/v0.17 migration behavior. Surface the v0.17 incremental-library warning and corrective upgrade path in the main and localized READMEs, reconstruct v0.12-v0.17 release history, and require per-value compatibility fixtures, regression tests, migration notes, and source-fidelity evidence in the pull request template. Keep the packaged Compatibility Matrix v1 and source-limit table synchronized with the normative specification and mark documentation tasks T105 through T109 complete.
Clean stale build output before producing ESM, CommonJS, declarations, and the CLI, and explicitly ship the changelog plus canonical compatibility contract alongside the existing README and license. Add a fail-closed candidate smoke runner that clean-installs the preserved tarball, verifies every required package file, compares ESM and CommonJS root exports, checks declarations and Matrix v1 documentation, and executes the packed CLI version path. The release-gate suite passes 12 of 12 tests, npm's dry-run manifest contains all required artifacts, and a locally packed candidate completes the clean-install smoke.
Register one global repeatable --source-limit field=value option and centralize parsing for every command. Accept exact decimal values plus IEC suffixes on byte fields, reject policyVersion, unknown and duplicate fields, unsafe ranges, malformed syntax, and suffixes on count/row/ratio fields with the typed usage error. Keep accumulation immutable and defer cross-field validation until the complete override map is available, then resolve it through the frozen Source Read Limits v1 policy. Add focused coverage for valid inheritance and every invalid assignment category.
Freeze defensive source-read limits and deterministic UTF-8 handling across transcript and SQLite representations. Resolve Store expectation states without unsafe fallbacks, propagate infrastructure failures, and promote dual partial-prefix failures to fatal outcomes. Preserve Composer compatibility identities, relationship rewrites, legacy fidelity signals, and deterministic Store provenance across either merge backbone. Add v0.16 unchanged-consumer upgrade, v0.17 convergence, source-limit boundary, expectation-matrix, and infrastructure-failure regressions.
Measure authorized Composer SQLite and cursor-history backup ZIP carriers using metadata-only row, byte, entry, and compression aggregates without retaining keys or conversation content. Reject downstream-shaped databases, unrelated archives, symlinked inputs, repository evidence paths, and non-private evidence directories while creating aggregate results exclusively as owner-only files. Lock the exact Source Read Limits v1 policy fingerprint across normative, design, task, and shipped documentation and mutation-test both implementation and artifact drift. Document the external maintainer attestation, legitimate-limit escalation procedure, and strict prohibition on scanning or retaining vibe-history archives.
Project supported Store attachment blocks into a canonical cursor_attachment_v1 content fence without dereferencing locator-only evidence. Keep raw content evidence immutable for merge decisions, mark unsupported or incomplete evidence as partial, and align asymmetric Composer/Store messages without changing frozen Composer identities or order. Add integration and identity regressions for inline attachments, degraded locator evidence, and Composer-first enrichment behavior.
Replace whole-buffer JSZip backup paths with a narrow ZIP32/ZIP64 STORE/DEFLATE reader and writer that enforces frozen Source Read Limits, canonical central/local metadata, data descriptors, CRCs, sizes, normalized names, and cancellation. Stage plaintext snapshots in owner-private workspaces, publish completed archives atomically with safe default and overwrite permissions, preserve explicit shared mode, and roll back cancelled restores without residue. Thread source-limit and AbortSignal options through core, CLI, and library backup APIs, retain legacy manifests and actual producer identity, and add POSIX, ZIP mutation, callback-mutation, concurrency, cleanup, and CLI regression coverage.
Preserve locked v0.17 command-specific error fields while adding stable machine-readable codes and typed safe details. Emit JSON-mode fatal failures as exactly one stderr object, leave stdout untouched, and keep established exit categories and human-readable behavior unchanged. Add focused regressions for legacy field preservation, typed source-limit diagnostics, and stream isolation.
Resolve session timestamps from Composer metadata, Store metadata inputs, direct message extrema, or the fixed epoch without consulting the wall clock or filesystem time. Preserve legacy non-null timestamps as unknown, infer missing message times in linear constant-space passes using next-direct then previous-direct then session fallback order, and prevent inferred values from becoming anchors. Emit complete timestamp/provenance pairs, mark approximate human output, retain structured tools on true error/thinking categories, and cover the contract with 166 focused regressions.
Bind one immutable source-limit map, driver preference, and AbortSignal to each read context and propagate them through backup, Composer, and Store database operations. Treat malformed manifests, CRC/encoding failures, missing manifest-referenced entries, SQLite query failures, and provider/snapshot failures as owning-read errors instead of false empty or partial results. Preserve only the explicitly optional missing global backup fallback. Validate manifest inventories eagerly, bound metadata reads, retain typed Store metadata diagnostics when a safe contributor exists, promote them otherwise, and preserve primary failures through database close and private-workspace cleanup. Add real-driver, cancellation, mutable-option, archive-corruption, cleanup-precedence, and Store representation regression coverage.
Resolve Composer-backed session clocks from stored Composer metadata, then direct message extrema, and use epoch-unknown only as the final deterministic fallback. Retain Store DB and meta timestamp evidence until projection, remove filesystem mtime from Store and transcript selection, and keep merged timestamp selection fixed in Composer-to-Store order regardless of the preferred rendering backbone. Project missing message times in linear time with explicit next, previous, session, or unknown provenance; preserve direct source values; and cover list/show, Store mapping, duplicate transcripts, merging, and legacy compatibility with focused regressions.
Replace index re-resolution with a prepare/apply state machine that binds one native UUID, physical Composer occurrence, source fingerprint, destination identity, driver, cancellation signal, and frozen source-read policy before mutation. Reject Store-only, merged, shared, duplicate, divergent, and changed targets before writes; preserve UUIDs for moves and allocate collision-checked UUIDs only for copies. Protect source, destination, and global databases with deterministic BEGIN IMMEDIATE ordering and raw-value CAS updates. Revalidate under lock, conservatively compensate indeterminate commits, keep Store membership checks best-effort across the filesystem boundary, and preserve ordinary v0.17 failure-result semantics while typed integrity failures remain fatal. Replace mock-heavy migration coverage with real SQLite state-machine, rollback, compensation, copy/move, scope, capability, source-limit, and race regressions.
Resolve workspace-filtered numeric addresses through the exact summary ID and index hint instead of replaying a local index against the global corpus. Forward workspace scope and source-read policy into session migration, and lock dry-run/apply target parity with unit and built-CLI regression coverage.
Create migration read contexts with the selected workspace already bound, dispose them on every binding and workspace-listing path, and avoid reusing a disposed corpus during destructive preparation. Add real-SQLite coverage for index binding, replica ambiguity, Store/merged refusals, dry-run parity, transactional apply and rollback, capability failures, aborts, and unchanged logical UUIDs.
Project every Composer message and tool call through the v0.16 identity contract before merging, retain Composer identities for matched content, and expose versioned provenance independently from output order. Reconcile equivalent Store metadata, transcript, and database replicas deterministically; surface divergent copies as locator-free ambiguity; and preserve complete contributor, workspace, attachment, and resolution evidence across either merge backbone.
Make the maintainer disposition authoritative in the feature specification and compatibility matrix: the frozen tree, package, and recurring CI retain no third-party implementation. Accept only the already-audited deleted compact harness revisions, while continuing to fail release on full upstream source, private Cursor inputs, generated downstream artifacts, retained implementations, or any new unapproved historical exception.
Run the frozen structured-output schema oracle against the CLI installed from the preserved tarball and verify its JSON report with the fail-closed test-result policy. Exercise current, legacy-v1, and producer-only backup manifests through the installed library; lock the outer and inventory schema versions, owner-private variant modes, public summary/session/search invariance, stable identities, and zero incremental writes for producer-only changes. Add package-smoke assertions and mutation checks so schema, manifest, privacy, projection, or incremental gates cannot be silently removed before publication.
Replace stale NPM_TOKEN setup instructions across every shipped README with the actual npm OIDC trusted-publisher configuration and protected GitHub environment requirements. Document the pack-once checksum-addressed candidate flow, maintainer verification before approve-candidate, provenance publication of unchanged bytes, and fail-closed tag remediation rules in English, Spanish, French, and Chinese.
Attach the protected npm-release-verification environment to the actual OIDC publishing job and make it depend directly on the immutable candidate, full package verification, and every runtime matrix result. Remove the no-op approval hop, keep id-token permission scoped to publish, and install the hosted verification toolchain with lifecycle scripts so the frozen-schema SQLite fixtures have a usable native binding. Mutation-lock dependency, environment, OIDC, lifecycle, fail-closed, checksum, and pack-once invariants to prevent either release bypass from recurring.
Document the exact npm trusted-publisher workflow filename, protected environment, and allowed publish action across all shipped languages. Explain that the real publish job waits for maintainer approval and requests the OIDC token under the same environment claim, while full verification installs native SQLite test tooling without substituting repository code for the preserved candidate.
Teach the T110 load-bearing aggregate to require the protected environment and OIDC permission on the real publish job, along with direct candidate, full-verification, and runtime dependencies. Mutation-test skipped runtime verification, missing publish protection, and disabled native dependency lifecycle so the aggregate gate matches the hardened trusted-publishing topology.
Regenerate the pnpm lockfile from the 0.18 dependency contract so better-sqlite3 resolves to a Node 26-capable release and Prettier stays on the exact declared version. Add a fail-closed consistency test covering every direct root specifier, undeclared importer entries, the compatibility-critical SQLite resolution and engine range, and the exact Prettier pin. Mutation cases prove stale ranges, stale SQLite versions, and a missing Node 26 capability are rejected.
Repair all fifteen stale TypeScript fences across the Spanish, French, and Chinese READMEs by awaiting asynchronous APIs, removing duplicate declarations, importing current types, and using the released search, backup, filter-validation, and rollback contracts. Extend the exact-tarball smoke to classify and strict-typecheck all eighteen localized examples from the installed package. Execute each locale's deterministic read-only library flow and configuration example against the synthetic Store fixture, and assert the complete per-locale evidence so packaged-file existence cannot satisfy the documentation gate.
Document the official tag-workflow artifact handoff, checksum and metadata binding, protected-approval hold, and production-only installation of the preserved tarball. Define the complete live, custom-path, and newly-created-backup operation matrix for both library and CLI entry points. Separate the pre-freeze T113 source/unchanged-consumer certification from the post-freeze T115 formal-artifact attestation, including provenance, exhaustive association, rollback/retry, legacy key binding, I/O isolation, private modes, and zero-residue evidence. Add a section-scoped regression validator with mutations for missing identity files, local repacking or registry substitution, merged attestation boundaries, omitted operations, and nonzero off-scope, canary, repeated-sync, or residue evidence.
Include the private release-verification procedure in the npm files allowlist so the main and localized README links remain valid after installation. Make the exact-tarball smoke traverse every local Markdown link in the installed package, reject missing or escaping targets, and report nonempty closure evidence. Add a source-level manifest mutation proving that dropping the linked procedure fails before publication.
Run both the official artifact-verification sequence and the production tarball bootstrap under strict shell error, unset-variable, and pipeline handling. A failed cleanliness check, artifact-count assertion, checksum, metadata binding, or install can no longer fall through to a later successful command. Add section-scoped mutations that remove fail-fast handling from either executable block and require the release documentation contract to reject both unsafe procedures.
Define the real-corpus lane as an exhaustive Composer-only, empty-Store v0.16 import/repeat and candidate upgrade/repeat check through the pinned unchanged consumer. Define a separate wholly fictional Composer-plus-Store transaction lane for complete replacement, late-failure rollback and reopen, retry, and final zero-write synchronization without deriving any value from private input. Bind certification before imports to the candidate, oracle, ARR, harness, dependency tree, and policy; require fresh safe extraction, owner-only artifacts, exact whole-tree immutability, non-excepted durable-value checks, code-block coverage, separately counted scalar exceptions, and deletion of private evidence.
Update the shipped release-verification contract test for the pre-freeze candidate, oracle, ARR, harness, runtime dependency, safe extraction, and whole-tree immutability bindings. Require separately attested real Composer-only compatibility and wholly fictional transaction lanes, including code-block coverage, durable scalar exception accounting, zero-write repeats, no real-value derivation, cleanup, and exhaustive association language. Add mutations that fail when either lane or its empty-Store and non-substitution boundaries are removed, and reject nonzero idempotence, derivation, or residue evidence.
Replace the quadratic full-corpus gate with a deterministic, source-only structure-coverage policy capped at eight logical sessions. Lock the 41 predicate registry, selection tie-breaks, isolated projection rules, additive-field validation, and synthetic mutant mappings. Keep every real-data value, derivative, membership, count, hash, and result outside repository history and recurring CI. Remove stale real-corpus statistics and the proposed evidence-only follow-up commit so certification leaves the candidate revision unchanged. Separate session/content mutations from sync_metadata statements and logical metadata changes for every real and fictional synchronization phase, including attempted versus committed writes across forced rollback. Add contract mutations and a synthetic unknown Composer bubble-type regression.
Extend the T110 aggregate with mutation guards for v0.16 locale ordering, canonical-versus-physical UUID binding, metadata-only atomic migration, pointer-only membership, Store-gap active branches, and packed backup-envelope topology. Keep recurring compatibility tests explicitly cursor-history-owned and generic; reserve exact vibe-history adapter and persistence claims for the owner-private T113 certification. Record the maintainer decision that T114 audits feature-added or modified paths, exact package inputs, and recurring CI without changing or claiming remediation of unchanged pre-feature material. Validated with the affected compatibility/fault suites, release-verification contract tests, typecheck, ESLint, Prettier, and diff checks.
Replace the absolute development checkout path introduced by feature 016 with repository-relative links and an explicit <repo-root> placeholder. Use a clearly fictional workspace path in the Store path regression so release artifacts and recurring tests do not retain maintainer-specific environment details. This change is deliberately limited to feature 016 files identified by the T114 preflight audit; pre-existing unrelated material is left untouched.
Parse the Source Read Limits policy version and every default from the unique implementation object, and bind all nine policy artifacts by exact content hash so version and documentation drift cannot retain a stale marker. Canonicalize and privately create aggregate evidence with owner checks, exclusive no-follow output handling, and repository-containment enforcement. Reject nested Composer carrier symlinks and special files while preserving documented direct database, User-root, and workspaceStorage-root inputs. Add mutations for policy drift, repository escapes, overwrite attempts, and carrier-boundary violations.
Require the implementation defaults object to contain only the canonical policy version and thirteen ordered numeric declarations, rejecting spread, shorthand, computed, and extra syntax. Separate the fixed nine-artifact inventory from its content-hash map so deleting either side fails the release lock. Require the aggregate-evidence parent to pre-exist as an owner-private directory, preventing symlink ancestors from creating repository residue before containment checks. Expand nested Composer carrier symlink mutations across containers, instances, and state databases.
Treat every session identifier as a byte-exact public value, including canonical UUID syntax, so differently cased values no longer alias during lookup, catalog grouping, workspace association, Composer/Store merging, or migration. Keep compact Store directory collision checks case-sensitive and update catalog/storage comments to reflect the exact-ID contract. Replace the former UUID-folding regressions with live, backup, Store, scoped-context, migration, public-library, and built-CLI coverage for exact hits, opposite-case not-found behavior, distinct case variants, pointer isolation, and non-collateral mutation.
Document that v0.18 preserves v0.16 case-sensitive Session.id behavior across lookup, grouping, cross-source association, pointer membership, and destructive migration. Synchronize the feature specification, plan, research, data model, CLI/library/internal contracts, quickstart, task traceability, implementation checklists, release verification registry, changelog, root README, and localized guides. Rebind all nine Source Read Limits normative artifact hashes after the contract update without changing the source-read policy fingerprint or limits.
Clarify that T113 occurrence coverage is classified from adapter-validated raw carrier fingerprints before public projection. Require the private adapter to pass an explicit replica state and make the sampler fail closed instead of inferring duplicate state from stable v0.16 output, which can hide divergent physical records behind an identical public projection.
Add the documented format check to the source-quality job so a formatting failure blocks candidate creation. Extend the workflow verifier and mutation coverage to detect a missing or failure-swallowing format gate, and keep unsupported source tooling out of minimum-runtime smoke jobs.
Compare own-property presence for the six released v0.16 optional message fields so an omitted value cannot silently become own undefined. Add a focused negative compatibility case and assert that cancelled Composer tools retain their structured cancelled status. Both regressions are mutation-proven against the previously surviving optional-omitted-materialized and cancelled-status-rewritten faults.
Generate the packed Store topology inside the private smoke workspace instead of copying the pre-feature Store fixture or its path-derived identifiers. Move the fatal JSON source-limit case and feature-added read-context lifecycle coverage onto temporary feature-owned fixtures with fictional IDs, paths, timestamps, and payloads. Preserve all pre-feature fixture files and their original test consumers while closing the T114 sanitation boundary for new recurring and package evidence.
A Composer payload cell may legally hold an empty TEXT value rather than SQL NULL. The two storage classes reach the corrupted-message placeholder through different branches — NULL short-circuits on an explicit guard, an empty string throws out of JSON.parse — so the shared outcome cannot be inferred from the existing NULL coverage and is pinned on both sides: the v0.16 projector reproduction and the candidate reader. Both cases are mutation-verified: inverting the candidate's empty-value result fails exactly one test, and inverting the projector's parse-failure placeholder fails the new case alongside the existing malformed-JSON one.
The bounded eight-session sample exists only to bound the cost of the public differential. Running that comparison over every enumerable v0.16 logical session subsumes it: each registry predicate the corpus exercises is then covered by construction, so the registry drives reporting rather than selection and no synthetic-coverage mapping is required for a predicate the corpus actually contains. A predicate the corpus never exercises still needs its fictional regression and drift-detecting mutation. T113 is restated as three separable properties — per-field equivalence, derivation locality, and unchanged-consumer persistence and rollback — with either path acceptable provided all three are established and the attestation records which path produced each. The isolated-projection and consumer lanes may use a smaller explicit subset because they establish structural rather than statistical properties; only per-field equivalence gains strength from breadth. FR-073's full-corpus labelling ban is narrowed accordingly: a bounded-sample run still must not be described as full-corpus, while a run that compared every enumerable session may claim it for that comparison alone and must still scope its isolation and consumer-lane claims to the subset exercised. Re-locks the two policy artifacts whose bytes changed and marks T112 done; T113's pass/fail deliberately stays out of the repository per its own rule.
Run the release workflow's own gates before merge instead of only at tag time: source quality on the Node 24 toolchain, one immutable packed candidate, and the checksum-addressed runtime matrix smoked with the same backup-driver and node:sqlite capability expectations. Source tooling stays on the packaging runtime because Vite 7 requires Node 20.19+, so product runtimes are covered through the packed candidate rather than by running vitest on the minimum runtime. No separate full-package smoke job: npm test already runs it via tests/e2e/package-smoke.test.ts.
Gating pull requests raises the barrier to community contributions and changes what arrives for review: a contributor pushing until CI turns green can reshape the tests, so the first review lands on adjusted tests instead of the contributor's original intent. Maintainer review comes first; the release gates in npm-publish.yml still run before any publication.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Compatibility issues: Preserve v0.16 library identities and incremental-sync compatibility across Composer/Store merging #36
Workspace-filtered session indices can resolve to sessions from another workspace #33