feat: implement project verification goals and proof runs (#187) - #331
Closed
Joncallim wants to merge 65 commits into
Closed
feat: implement project verification goals and proof runs (#187)#331Joncallim wants to merge 65 commits into
Joncallim wants to merge 65 commits into
Conversation
…(issue #187) Implements the PR #331 architecture for issue #187 verification goals: - Add migration 0035 with protected policy, run, event, evidence, and schedule tables plus shared-ledger dual execution subjects. - Add TypeScript contracts for policy, run lifecycle, system limits, Git safety profile, and operation execution profiles. - Add trusted executable registry, filesystem authority loader, repository profile computer, and root-anchored command launcher. - Add manual run admission, synchronous runner, and POST/GET API route. - Update privilege reconciliation, CI ACL inventory, and installer checks for the nine new protected tables and protected routines. - Add schema-content tests and update existing schema/ingress tests. This is a partial implementation. Remaining architecture slices: - Redis-delivered worker queue claim/ACK instead of synchronous API run. - TrustedProjectRootLease retention across the full runner lifecycle. - History/aggregate evidence reader and reliability-v2 child ingest. - Bounded scheduler with schedule bindings/heads/slots. - Queue expiry/recovery, capacity enforcement, and policy settings API. - Comprehensive adversarial/Git/root/lease tests and operator docs. Validation: npm run test (2116 passed, 64 skipped), npm run lint, npx tsc --noEmit, npm run build.
…eduler authority (issue #187 Slice C/E) Migration 0036 adds the protected business routines the worker, dispatcher, scheduler, and API depend on: capacity-checked idempotent admission, lease claim/renew with a recovery fence, child-operation finalization with the closed v2 outcome mapping, repository/environment snapshot recorders, queue expiry, the Redis dispatch marker, the prefix-validating atomic terminalizer, and schedule binding/slot authority keyed per (project, goal). It also drops the unreleased 0035 terminalizer that accepted a caller-supplied outcome without prefix validation, and the manual runner now finalizes children and runs exclusively through the protected routines. Fresh-install validation against PostgreSQL 16 (installer-equivalent chain through 0036 plus the privilege reconciler) surfaced and fixed: - 0035: missing temporary REFERENCES grants, a missing composite identity unique index, run events referencing later snapshot surfaces, and the shared-ledger expansion running under the wrong role; - 0036: extract() call grammar, the operation_runs CHECK role boundary, reconcile FOUND capture, verifier-required mapping, admission/claim guards, and capacity-blocked schedule slot retention; - the legacy normalizer/proof contamination counts for the 49-table latest position. Privilege reconciliation now verifies the exact runtime-routine owner/ACL boundary, and migrate-through-0036 joins the managed-migration proofs.
- claim routine accepts queued rows only; expired running rows belong to the recovery fence, never to a competing worker - finalize child operation now carries the claim lease token so proof writes are fenced to the current lease holder - idempotent manual replay resolves before capacity accounting so a retried identical request returns its run even at a capacity limit - begin child appends the child_begun event - terminalizer requires repository and environment evidence for passed - reconcile script tracks the 9-arg finalize and 6-arg slot-claim signatures
- add the immutable launcher contract digest for run environment evidence - re-verify the pinned executable identity (device, inode, content digest) immediately before launch; a replaced executable disables execution instead of launching the new file - classify spawn-level failures (ENOENT, EACCES, STDIO_MAXBUFFER) as spawnError, never as exit 0; killed children classify as timedOut - pin the launch promise as observed at creation so an abort during the handle-close window cannot trip process-level unhandled-rejection policy - buildSafeLaunchEnvironment strips NODE_OPTIONS/NODE_PATH and all GIT_* path redirections even when passed through overrides
…sue #187) - admission now calls forge_admit_verification_goal_run_v1, the single authoritative write path; the direct INSERT (for which the application login has no privilege) is removed - the live policy head revision id and sequence travel as real routine parameters; the JSON resolved policy serializes the sequence as text so a bigint never crosses the JSON boundary - code-owned eligibility is enforced at admission: an operation outside the reviewed allowlist/profile throws before any run row is created - the route resolves the live policy head (or seeds the default) and maps the closed SQLSTATE set: P1871/P1872/P1873/P1876 to 409 and P1874 to 429 - trusted executable resolution anchors to the project root as well as the worker cwd
…h (issue #187) - keep the business lease renewed on the reviewed 10-second cadence; any renewal failure or non-owner response disables further proof writes and a lost lease is never re-claimed by the runner - execute the exact bound operations in canonical ordinal order via the reviewed eligibility binding; verifier/classifier/profile drift against the stored digests terminalizes as operation_contract_changed - record the repository and environment evidence snapshots before a passed terminalization, including the launcher contract digest, trusted executable identities, and the git safety profile digest - finalize child operations with the claim lease token - compute the repository profile through the retained project-root descriptor (/dev/fd) with the safe launch environment and deterministic metadata fingerprint; expose headOid on the profile - map launcher failures to specific terminal codes instead of a generic internal error
- launcher: exit classification, spawnError for ENOENT/STDIO_MAXBUFFER (never exit 0), killed-as-timeout, executable change, root dev/ino mismatch, abort, and safe-environment stripping under overrides - runner: happy path with evidence snapshots and lease-fenced finalize, legacy policy key, spawnError, digest drift, lease loss, launcher error, and dirty repository - admission: protected routine call shape, real bigint params, idempotent replay, and allowlist/capability enforcement before any DB call - migration: text assertions on the hardened routine signatures, claim guard, lease-token fencing, passed-evidence guard, and child_begun event, mirrored in the reconcile script - route: POST/GET happy paths, 401/503/400/404/409 guards, SQLSTATE mapping to 409/429, and generic 500 without secret leakage
Joncallim
force-pushed
the
architecture/issue-187-goal-run-policy-final
branch
from
August 19, 2026 16:56
388e9d7 to
5d1aa85
Compare
This was referenced Sep 3, 2026
Open
Owner
Author
Superseded by VNext — implementation branch retiredThis PR is now intentionally superseded and should not be rebased, merged, or cherry-picked wholesale. The repository-wide VNext readiness pass confirmed:
The reviewed requirements have been preserved in the canonical current plan:
Useful test/design ideas from this PR (bounded command/resource policy, restart/idempotency cases, output/redaction limits, schedule dedupe cases and run-history semantics) remain historical evidence and may be reimplemented where they fit the current contracts. The branch structure/table/module choices are not authoritative. No code from this PR should be treated as the implementation base for new work. New implementation branches start from current |
This was referenced Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Status: superseded by Forge VNext
This pre-VNext monolithic delivery PR is intentionally closed without merge.
The verification-goal registry/import/revision foundation already landed through PRs #328–#330. Remaining useful requirements from this branch have been moved to current, dependency-scoped issues:
The old branch remains historical evidence for reviewed test cases/edge conditions only. New implementation must start from current
main; do not rebase/cherry-pick this 65-commit branch wholesale.Reason: continuing it would create project-specific execution/scheduling truth beside ADR 0014 and carries substantial unrelated branch drift.