Repository navigation
Tracer: delete a PersonaBot with explicit optional Memory erasure #896
Description
Delivered — 2026-10-08
Merged in #923 at 6f3a2bad3b647ef24f0ba4e332618d447842e5a6; final reviewed head f140fe07 passed GitHub verify (3,131 tests passed, 9 skipped), all required checks and build. Project V1 · Memory is Done; Milestone remains v1.1.
Two-axis final review has zero remaining findings. Genuine light/dark screenshots, default/explicit Memory scope, cancel/reopen reset and native Windows folder opening are verified. Actual deletion/retention/erasure/drain/cold restart were exercised through the authenticated Host API. The PR and evidence README disclose the different screenshot viewport dimensions and lack of a separate Human visual sign-off. The Human explicitly authorized this continuation to review, add screenshots and merge if sound, superseding the prior paused handoff; no separate Human sign-off is claimed.
Original acceptance/specification follows for traceability. This delivery does not implement full Profile Backup or Messaging Content Purge.
Parent
Native sub-issue of #138; Profile portability coordination #882. Milestone v1.1, Project V1 · Memory. Target contract: ADR-0130 (design PR linked from #138).
Observable behavior
Human opens Delete PersonaBot, inspects its actual Memory Repository or opens that folder on the Host, and confirms deletion with an Also delete Memory files checkbox that starts unchecked. Unchecked deletion retains the repository and readable historical attribution; a checked and revalidated exclusive repository is removed, with honest partial-failure feedback. A replacement Bot receives a fresh identity and no inherited authority.
Acceptance
- Existing Human deletion entry opens one native confirmation showing Bot identity, resolved Memory location and a bounded dependency report. Also delete Memory files is unchecked on every opening; cancellation, reopening and failure never save the selection as a default. Final confirmation visibly states the selected scope.
- Open Memory folder uses the existing native Host file-opening capability. Provide a one-click installed file-manager action and access to available folder handlers; disclose that remote Web opens on the Host. Missing path/handler is explained without creating a directory. Opening does not select erasure or execute deletion.
- Registry/lifecycle deep modules persist a deleted-identity tombstone, stable historical attribution and the retained repository locator/status; historical Session Ownership, Reports, Channel content and accounting remain inspectable. Normal unarchive/restart/late delivery cannot reactivate it; same-name creation cannot inherit its ID, grants or routes.
- Before completion, close new admissions, wakes, Session creation/resume, saved approval applicability and external effects, then stop/drain the owned native AgentHandle tree. Preserve actual already-issued model/provider/Outbox outcomes, do not invent successful cancellation or disturb unrelated Bots/provider accounts.
- Unchecked deletion retains complete Soul/Memory including uncommitted and Git files. Checked deletion revalidates the reviewed dedicated/exclusive repository and ownership, including custom locations outside the default layout. Shared/overlapping paths, path drift, symlink escape, unresolved ownership and unrelated directories cannot be recursively removed; explain why the checkbox cannot execute while ordinary deletion remains possible.
- The checked scope never deletes Workspace contents, DSH Session backend files, Git remotes, shared credentials, external exports or manual backups, and does not silently run Messaging Content Purge/Purge Everywhere. Preview discloses copies remaining in DSH transcripts and outside control.
- Crash/failure reconciliation is owned and bounded: no false atomic file/database claim or false success if Memory cleanup fails; preserve the reviewed locator and incomplete cleanup status for explicit repair. Repeated commands and cold restart cannot delete another path or revive execution.
- Complete Profile Backup can enumerate retained repositories for deleted identities and distinguish intentionally erased repositories from missing required data; do not implement backup here or leave retained custom repositories unlocatable.
- Real DSH E2E covers unchecked retention, checked exclusive removal, cancel/reopen, folder opening, shared/custom-path refusal, restart, stale scope and injected cleanup failure. Use disposable QA repositories only, include genuine before/after screenshots or recording in the PR, focused regressions and required checks; pause for Human QA.
Blocked by
- 设计：PersonaBot / Channel 破坏性删除与 Purge 依赖契约 #138 — accepted deletion and dependency design. No implementation before its design PR is approved/merged.
Non-goals
Messaging Content Purge, a general filesystem deletion endpoint, broad Purge Everywhere, native Session erasure, provider-side recall, full backup or automatic file pruning. Memory erasure does not promise removal from older offline backup files.
Activity
DoodleBears commentedon Oct 5, 2026
Agent work claim
codex/local/01a0f25f-2150-75e3-8895-23d35394b8d8(not a DSH Session)codex/896-personabot-deletion#138 merged via #898 after Human approval and complete exact-head CI. #896 had no existing comments/claim, assignee or open PR at preflight. No Messaging Content Purge, native Session erasure or full Profile Backup is implemented here. All destructive QA uses disposable task-owned repositories. Prior browser-tool denial and prohibition on alternate capture routes are preserved; any missing genuine visual evidence will remain explicit at the PR handoff.
Qualify custom and shared Memory paths on the real Host (#896)
DoodleBears commentedon Oct 5, 2026
Agent work outcome
codex/local/01a0f25f-2150-75e3-8895-23d35394b8d8(not a DSH Session).baa425191b11ed0f432df7678576940ca4521433.Merge updated main guide ledger without changing deletion scope (#896)
Refresh Chinese documentation OG font after #896 architecture copy
DoodleBears commentedon Oct 8, 2026
Agent work claim — PR #923 review and UI acceptance
codex/local/01a119e5-5192-7832-a281-213e81f6118c(not a DSH Session)codex/896-personabot-deletion(isolated review checkout)The previous task explicitly handed off paused-for-Human-QA status with Draft PR #923. The Human has now requested screenshots and authorized merge if verification finds no problem. Existing claim/outcome history is retained.
Merge main and complete PersonaBot deletion review
Merge current main into PersonaBot deletion review
Fence new registry settings after PersonaBot deletion
Confirm PersonaBot deletion and optional Memory erasure (#923)
DoodleBears commentedon Oct 8, 2026
Agent work outcome
codex/local/01a119e5-5192-7832-a281-213e81f6118c(not a DSH Session).6f3a2bad3b647ef24f0ba4e332618d447842e5a6.f140fe07149bb67cddf01449ea3138b45ceee17e.