Repository navigation
security(core/R-15): Gate 4 — journal, admission, rekey/recovery and cross-process serialization #922
Description
Activity
Linear control-plane mirror
- Linear: QNB-168
- Project: v1.30.0 — Complete Desktop At-Rest Encryption
- Project URL: https://linear.app/qnbs/project/v1300-complete-desktop-at-rest-encryption-1ea741fa2ae5
GitHub remains the implementation/evidence source of truth; Linear tracks sequencing, priority, dependencies and milestone progress.
Related desktop-lock owner — 2026-10-01
Coordinate Gate 4 cross-process serialization/admission with #831. #831 is not an automatic Gate 4 blocker, but Gate 4 must not create a second incompatible native ownership primitive and should reuse/share a trustworthy process-ownership mechanism where the evidence supports it.
Live Gate 4 checkpoint — 2026-10-02 10:21 CEST
Gate 3 is terminal via #949 → main
4f119e20d472a571c96ef9c43f479f68e3c47115: CI/CD 36981985445 SUCCESS, CodeQL 36981985385 SUCCESS, and Vercel Productiondpl_2r1QiNXDpGw1YdG52eUbuRc3p6fxis READY on the exact SHA. #921 and #357 are closed.Gate 4 is now active through PR #950, slice 4A, exact head
b72cb4125eb2d3cf0ab494c4bd9f9f05d3dbed39. Scope: cross-processroot_commit_mutexand guard enforcement around root publication/recovery/key-epoch writes. The current exact-head epoch is not terminal: Vercel Preview and several static/reviewer gates are green, while CodeQL, Security Audit, Cubic, CodeRabbit, DeepSource Rust/Shell and other checks are still running/pending. Sourcery is quota-limited; Codex review has been requested.Recorded Gate 4 sequence from #950: 4A root mutex → 4B unified admission (#360) → 4C journal/paged manifest → 4D crash-resumable rotation/rekey (#359 + Gate-3 key-epoch crash window) → 4E first enable/disable refusal + Gate 4 closure.
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.#950 exact-head review checkpoint — b72cb41
The re-enabled Codex GitHub App is reviewing again. Its current P2 is validated independently and overlaps CodeRabbit:
- P2 / data-integrity:
load_committed_root()is not actually read-only. It reads the committed anchor, then callsensure_pointer(), which can rewrite the pointer without holdingroot_commit_mutex. A stale reader can therefore restore the prior pointer after a concurrent writer's E2 readback but before F. Fix by making the load path read-only, or move repair under the mutex with anchor revalidation. - CodeRabbit minor:
RootCommitGuard::guards()compares lexical paths; equivalent symlink/normalized paths can be rejected despite holding the same OS lock. This is fail-closed (not an authority bypass) but is a real functional-path-identity issue. - CodeAnt nitpick: child-process cleanup in a failing root-lock test can leave the helper alive until its timeout; test-hygiene only.
Current positive evidence on this head: CodeQL, Security Audit, Verified Signatures, Core/Tauri Rust, Linux/macOS/Windows secure-store evidence, Semgrep, GitGuardian, CodeScene, CodeAnt and Vercel Preview are green. Node 22/24 and Cubic are still running at the latest readback. Sourcery remains quota-limited.
Hold merge. Finish the exact-head epoch, then batch validated findings into one correction wave and restart exact-head verification.
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.- P2 / data-integrity:
#950 correction-wave head — 791d608
The first review wave was fixed in one push:
- Codex/Cubic/CodeRabbit stale-pointer race: fixed by making cold start pointer-read-only and adding guarded
repair_root_pointerwith anchor re-read/re-authentication. - Root guard path identity: canonicalized; equivalent paths now match, different/unresolvable roots remain fail-closed.
- Child-holder test cleanup: fixed with drop-time release/kill/reap.
- Contract/ledger wording drift: corrected.
Fresh-head evidence: Codex re-review says no major issues; Cubic SUCCESS; CodeRabbit confirms the path-identity fix; CodeQL, Security Audit, signatures, Core/Tauri Rust and all three OS evidence lanes are green; Vercel Preview
dpl_GC837iV9M15QtQCw56Mif9RuVx44is READY on the exact head. Node 22/24 remain in progress at the latest readback.New current-head finding: CodeAnt reports that
load_committed_root()now reads the recoverable pointer only to computepointer_stale, butread_pointer()still propagates non-NotFound I/O errors. Because the contract states the filesystem pointer is recoverable state and the secure anchor is authority, a pointer-only read failure should not make an otherwise authenticated committed root unreadable. Validate/fix this before merge (e.g. represent pointer state as stale/unknown without weakening authenticated root checks; keep repair under the mutex).PR remains NOT merge-ready until this finding is dispositioned and the new exact-head epoch is terminal.
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.- Codex/Cubic/CodeRabbit stale-pointer race: fixed by making cold start pointer-read-only and adding guarded
Gate 4A TERMINAL — 2026-10-02
#950 merged from final head
f2dde0e65bb4dacfd6753f16a6bce1e28bf13078into main4f33d7786076c1d00e73d5db9c527fbd1ea31693(2026-10-02T10:14:59Z; 5 commits, 15 files, +625/−36).Resulting main:
- CI/CD 36994420903 passed (18 jobs succeeded, 1 skipped).
- CodeQL 36994420828 passed.
- Vercel Production
dpl_7Z1r45ckAp4YeYpdHWtHdzQ8BWNNis READY on the exact SHA; HTTP 200.
Status token:
R15_GATE4=SLICE_4A_ROOT_COMMIT_MUTEX.What landed:
- The mutex: the cross-process
root_commit_mutex(§11.1). On Unix it is aflockon the canonical root directory itself; on Windows it isLockFileExon a no-delete-share lock file. The OS releases it when the holder crashes. - The guard: it is not
Sync, and it is required bycommit_root,recover_root,write_key_epochandrepair_root_pointer. A catalog commit re-reads the root and commits under it. - Read-only cold start: cold start never rewrites the pointer; repair happens only under the mutex.
The review waves fixed:
- the stale-reader pointer-repair race;
- recoverable pointer error semantics;
- canonical root identity;
- lock-target replacement;
- the same-guard concurrent writers;
- test cleanup and postconditions.
One test-hygiene P3 (pre-clean
moved) is deferred to the next PR that touchesgate4a_root_lock_test.rs. Codex was quota-limited on the final head (recorded as unavailable). Its last completed review, on791d608b, found no major issues. Sourcery was quota-limited.Gate 4 state: 4A TERMINAL. NEXT = 4B, the unified admission gate (#360 / QNB-12). After that come 4C (journal and paged manifest), 4D (rotation/rekey, plus #359 and the key-epoch crash window) and 4E (first enable, disable refusal, closure). Gate 4 remains active.
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO. Execution is paused until 2026-10-06 00:00 Europe/Berlin (weekly usage reset).Gate 4B integration — live exact-head checkpoint
PR = #952 HEAD = 401b81b8be2d4fc0f007d1e043e9aae36f52b119 BASE / CURRENT_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052 PR_STATE = OPEN / MERGEABLE / NOT MERGE_READY PR_SIZE = 16 files / 2853 meaningful lines / 3 commits CI_CD = 37115923615 SUCCESS CODEQL = 37115923652 SUCCESS CORE_RUST = SUCCESS TAURI_RUST = SUCCESS NODE_22_24 = SUCCESS PLATFORM_LINUX_MACOS_WINDOWS = SUCCESS SECURITY_AUDIT = SUCCESS VERIFIED_SIGNATURES = SUCCESS CI_SUCCESS_AGGREGATOR = SUCCESS VERCEL_PREVIEW = dpl_GcxxZ4ZWbSxJUYFyyEMYww6y53vA READY exact HEAD VERCEL_PRODUCTION = dpl_9W7p2XZ4dscci5d2sXasPHK7iibz READY exact CURRENT_MAIN CODESCENE = RED — remaining findings are test-maintainability metrics; production findings improved DEEPSOURCE_RUST = RED / advisory; current test findings evidence-dispositioned MERGE_READY = NO PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NOThe first correction wave fixed the original macOS failure and the prior CodeAnt/Codex/CodeRabbit clusters. Fresh exact-head review found a narrower second wave:
- VALID: retained-epoch transient read errors must preserve undecided
Iosemantics instead of reporting authenticated corruption/recovery. - VALID: reject the reserved
<installation>/ordinary-writersroot collision centrally before snapshot/provider/key observation on every operation path. - VALID: failed unlock must retain the exclusive guard across panic/unwind; do not
take()the stored guard before verification succeeds. - VALID: a durable PENDING marker followed by a failed/busy PENDING-root event must latch local recovery-pending state so lock/shutdown cannot report a clean drain. Keep this bounded to Gate 4B; do not pull the Gate 4C persistent journal/manifest into this PR.
- NON-MATERIAL / contract clarification: clean shutdown need not retain a permanent cross-process fence after the local storage instance is closed. The retained fence contract applies to confirmed
lockuntil verified unlock; shutdown must drain/refuse unresolved recovery, then may release on completion/exit. - NON-MATERIAL as deletion authority:
SnapshotRetention::is_referencedis explicitly non-authorizing; reclamation already validates coordinator ownership/scope before consulting it. - PARTIALLY_VALID documentation: distinguish the logical
Arc<Snapshot>pin from per-operation physical location pins; do not introduce a new hazard-pointer/RCU/persisted-pin architecture without a newly proven contract requirement.
CodeAnt's prior two Majors are resolved at this head and its Quality Gate reports PASS. CodeRabbit and Codex independently agree on the transient-I/O finding; Codex additionally raised the reserved-root and unrooted-PENDING cases. CodeScene remains red only on the integration-test structure after production-code improvements; its remaining metrics have been individually dispositioned without suppression or test weakening.
Split gate: keep #952 together only for this narrow correction if it remains the same Gate-4B semantic/proof unit and is near-net-neutral. At 2853 meaningful lines there is almost no size reserve. If the next correction materially exceeds ~3000 lines, adds another independent authority/recovery abstraction, or begins 4C/4D semantics, split at a real lifecycle/recovery proof boundary before pushing.
Next cadence remains: one narrow coherent correction → signed push → entirely fresh exact-head CI/reviewer epoch. No stale-head merge.
Gate 4B integration remains ACTIVE through #952. #360 stays OPEN until final-head convergence, normal protected merge, resulting-main CI/CodeQL/platform/security/signature proof, exact-SHA Production verification, housekeeping and GitHub/Linear reconciliation. 4C/4D/4E remain pending.
- VALID: retained-epoch transient read errors must preserve undecided
Gate 4B exact-head checkpoint — 7878df9
PR = #952 HEAD = 7878df9084457fea1633506ce326d4eae3c819b9 BASE / VERIFIED_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052 STATE = OPEN / MERGEABLE / NOT MERGE_READY COMMITS = 4 FILES = 16 MEANINGFUL_LINES = 2994 GITHUB_DIFF = +2940/-54 PR_SIZE_GOVERNANCE = SUCCESS with over-hard-tier warning VERCEL_PREVIEW = dpl_DWs2jZ1QW4K9q2YpPXLYSRGr1nD8 READY exact HEAD CI_CD = 37119007516 IN_PROGRESS CODEQL = 37119007529 QUEUED MERGE_READY = NO PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NOCorrection commit:
fix(core): fence recovery and unlock cancellation (#445).The new commit remains inside Gate 4B and addresses the validated second-wave clusters:
- retained-epoch read errors now distinguish
NotFoundfrom transient I/O; - reserved
ordinary-writersroot collision is centrally rejected before authority/key observation across operation paths; - failed/unwound unlock retains the exclusive fence and clears runtime keys;
- a local pending-record latch refuses clean lock/shutdown drain until same-identity reconciliation/write clears it;
- shutdown semantics are clarified as coordinator close, not a durable installation-wide LOCKED authority;
- SnapshotRetention wording is explicitly non-authorizing.
No Gate 4C journal/manifest, Gate 4D rekey state machine, collector, deletion path or production authority switch was added.
Current exact-head external evidence:
- CodeAnt Quality Gates/coverage/SCR/SAST/SCA = SUCCESS;
- CodeRabbit status = SUCCESS;
- Vercel = SUCCESS/READY exact head;
- DeepSource Python/Docker/Shell = SUCCESS; Rust remains FAILURE on the same test-only
dropanalyzer class and must be evidence-dispositioned, not called green; - CodeScene remains red on test-only cohesion/assertion metrics (19 isolated integration cases; 8 large assertion blocks), with production root-store health improved.
Important review note: the new
pending_recordlatch is intentionally conservative and is set before the admitted mutation/reconciliation call. Fresh reviewers should explicitly verify that early non-durable failures cannot create an unintended permanent local recovery latch or require an impossible recovery path.Split gate: 2994 meaningful lines leaves effectively zero correction reserve. Freeze scope now. Any new substantive architecture/recovery work, 4C/4D semantics, or material LOC growth should trigger a real split rather than another expansion of #952.
Do not merge until the full exact-head CI/reviewer epoch is terminal and every new finding is dispositioned.
- retained-epoch read errors now distinguish
Gate 4B exact-head terminal-CI / fresh-Codex checkpoint — 7878df9
PR = #952 HEAD = 7878df9084457fea1633506ce326d4eae3c819b9 BASE / VERIFIED_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052 STATE = OPEN / MERGEABLE FILES = 16 COMMITS = 4 MEANINGFUL_LINES = 2994 CI_CD = 37119007516 SUCCESS CODEQL = 37119007529 SUCCESS VERCEL_PREVIEW = dpl_DWs2jZ1QW4K9q2YpPXLYSRGr1nD8 READY exact HEAD MERGE_READY = NO PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NOAll CI/CD jobs on the exact head are terminal green: policy, security, signatures, Core Rust, Tauri Rust, Node 22/24, Linux/macOS/Windows secure-store evidence, Storybook, Build, Playwright, E2E Deep Coverage, Browser Quality and the CI Success aggregator. CodeQL is also SUCCESS.
Fresh Codex review on exact head
7878df90raised one material P2:
Clear the mutation latch after a stale CAS.Validated control flow:
ProtectedStorage::try_write_recordsetspending_recordbefore callingprotected_write_admitted. The lower write path first reconciles, then checksexpected_generation, and returnsProtectedError::StaleGenerationbeforebegin_writewhen the CAS is stale. The current?therefore exits with the local latch still set even though no new PENDING write was begun. This can make latertry_lock/try_shutdownincorrectly returnRecoveryPending.Correction requirements:
- fix this narrowly inside Gate 4B;
- do not clear the latch for genuinely uncertain/durability-relevant failures;
- before clearing on a proven-resolved stale-CAS outcome, preserve the existing physical/admission identity checks (record/location pin, writer guard, operation admission); if those checks fail, remain fail-closed;
- add deterministic regression proof that stale CAS leaves no false recovery latch and a subsequent clean lifecycle transition does not require an unnecessary reconciliation/write;
- audit adjacent error exits only far enough to ensure the fix does not accidentally broaden clearing semantics.
PR budget is effectively exhausted at 2994 meaningful lines. Prefer line-neutral/line-reducing correction and test reshaping over growth. Do not introduce 4C journal/manifest, 4D rekey, collector, deletion or cutover scope. No suppressions/test weakening.
DeepSource Rust remains advisory red on the test-only
dropanalyzer class; CodeScene remains red on test-only cohesion/assertion metrics. Neither should drive semantic weakening.After a signed fix push, all current-head evidence becomes stale: start a completely new exact-head CI/reviewer epoch. Normal protected merge only after final-head convergence; no admin/bypass/self-authorization.
Gate 4B anti-cascade decision: superseding split, not merge.
PR #952 is frozen at e34aae2 (16 files / 5 signed commits / 3000 meaningful lines). Prepared-root recovery finding remains VALID and merge-blocking; no source push or suppression will squeeze its full R1–R5 proof into a saturated PR.
Replacement A: read/snapshot admission only, from verified main 3cd2b6a. Replacement B: mutation/root-recovery/lifecycle closure, only from A's terminal resulting main, reusing recover_root before fresh capture under shared admission → writer serialization → finite root event. No new durable format, journal, or rekey state machine.
Exact A/B/S/D extraction and finding ownership are recorded locally in crates/target/PR952-SUPERSEDING-EXTRACTION-2026-10-03.md; existing #952 remains the immutable review provenance. The prepared-root Critical belongs to B/R1–R5; retained snapshots/locators/read lifetime to A; commit-refresh/stale-CAS/lifecycle to B; physical collection and rotation remain later gated owners. #952 stays OPEN until replacement A is safely open/cross-linked and B ownership is durably recorded.
WorldScript-Studio#360 / QNB-12 stays OPEN / In Progress. Gate 4 / QNB-168 / M3 stays active. 4C/4D/4E pending.
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.PR #953 final-head checkpoint —
3c118bc652210a5861fe408e9d89e4893a66a3a0.- 15 files / 1925 meaningful lines / 4 signed commits
- final mid-capture publication/rebind race fixed in one-file commit
fix(core): make snapshot publication rebind atomic (#445) - deterministic interleaving test proves N→N+1 external commit between state observation and anchor read cannot poison
AuthorityCell.current; exact key usability and exact anchor equality are proven before publication; subsequent capture remains usable - earlier read/snapshot P2s remain closed
- CodeAnt legacy-write observation is partially valid but explicitly deferred to Successor B mutation/writer-admission owner; it does not invalidate the immutable pinned read proof and does not admit mutation scope into feat(core): admit protected reads through pinned snapshots (#445) #953
- CodeQL, CodeAnt gates, Vercel, CHANGELOG/Text guards are green exact-head
- DeepSource Rust and CodeScene remain advisory reds for already-dispositioned test-fixture/test-method metrics; no suppression or proof weakening
- CI/CD still converging (Node 22/24 currently running at this checkpoint)
- fresh Codex review on exact
3c118bc6...still pending - MERGE_READY = NO until terminal CI + fresh exact-head reviewer convergence
- no Successor B / 4C; production authority switch remains NO
PR #953 continuation authorization — 2026-10-04.
Fresh Codex exact-head review on
3c118bc652210a5861fe408e9d89e4893a66a3a0produced three VALID Read/Rebind P2s:- prepared-only anchor changes can currently lock/strand a reader even though committed read authority did not change;
KeyState::Lockedcannot distinguish explicit lock from a stale previously-unlocked session, so same-key forward auto-rebind can violate explicit-lock refusal;- before first capture,
current=Noneprovides no baseline, so a stale previously-unlocked runtime cannot rebind after an external same-key advance.
NEW EXECUTION POLICY: these findings are explicitly authorized for further correction on #953. Do NOT stop merely because another fixable same-slice P2 appears. Continue correction → local proof → signed push → fresh exact-head review/CI cycles until #953 genuinely converges and can be merged normally. Only an unfixable platform/auth/protection blocker or a scope change into Successor-B mutation/root-recovery/4C may stop execution.
Preferred common design direction: preserve a non-secret provider session-binding witness (scope + committed root, or equivalent) that survives stale-root detection but is cleared by explicit lock. Use it to distinguish explicit lock from stale binding and to establish a safe pre-first-capture baseline. Prepared-root-only changes must not be treated as read-authority changes; compare/revalidate the committed read-authority projection rather than the whole AnchorState where appropriate.
#360 / QNB-12 remain open. Successor B remains mutation/root-recovery/lifecycle. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.
- added a commit that references this issue
on Oct 4, 2026 Gate 4D sequence checkpoint — 2026-10-04
#957 is merged and resulting-main remains exact at
8f1400c4bb6a84be8da940584b86b00233df1d4b. Vercel Production remainsREADYon that SHA. The five #957 preview candidates remain present and individually classify as non-production / non-rollback.Cursor could not mutate Vercel: MCP has read capability but no deployment/alias delete wrapper, its CLI session is logged out, and no token is present. No deletion was attempted. Therefore:
POST_#957_RETENTION = NOT COMPLETE PR_958 = FROZEN MERGE_#958 = NO FURTHER_PUSH_#958 = NO SLICE_B_IMPLEMENTATION = NO NEXT = authenticated local Vercel cleanup via Claude Code CLI Sonnet / existing operator session PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NOAfter retention becomes terminal, re-fetch the full #958 three-channel review census and address its two root-cause families in one docs-only correction wave.
19 remaining items
Gate 4D Slice D2b-2 (manifest authority-first epoch preflight) is terminal on resulting main
18630d7693961db469aab09e91dca81f15c6ed8cvia #1004: resulting-main CI/CD (37717028036) and CodeQL (37717027958) succeeded, Productiondpl_TRn38nYsAgdGomdeVCjbi7WJTLXkis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). B2, C1, D1, D2a, D2b-1 and D2b-2 are terminal; Gate 4D and Gate 4 remain in progress. Next: D2b-3 read-only admission (registry-resolved journal key route), then D3, streaming capture, C2. Details and open criteria: #359 issuecomment-6051161562. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D Slice D2b-3a (registry-resolved key route of a bound journal) is terminal on resulting main
014c1c18548386cbc56cc04d18395aff4fe3b8b6via #1005: resulting-main CI/CD (37736258294) and CodeQL (37736258202) succeeded, Productiondpl_8gHMgs7CMCustYohgRzyUFhyhmgmis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). B2, C1, D1, D2a, D2b-1, D2b-2 and D2b-3a are terminal; Gate 4D and Gate 4 remain in progress. Next: D2b-3b read-only admission (wire the route into the composed journal operations and drop the caller-supplied key), then D3, streaming capture, C2. Details and open criteria: #359 issuecomment-6054183103. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D Slice D2b-3b (the journal-owner operations use the key route; no caller-supplied journal key) is terminal on resulting main
6ee0db777523ec407dd944211101f34f5bdd5093via #1006: resulting-main CI/CD (37747908889) and CodeQL (37747908987) succeeded, Productiondpl_s6atn7q4kbXERdvqAG2o4sRBiKTwis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). Slice D2b is complete (source-key retention, manifest authority-first preflight, registry-resolved key route and its wiring); B2, C1, D1, D2a and D2b are terminal; Gate 4D and Gate 4 remain in progress. Next: the epoch-relation validation slice (ROTATE target > source,ENVELOPE_MIGRATIONrelation stated first), then D3, streaming capture, C2. Details and open criteria: #359 issuecomment-6056185184. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D epoch-relation validation (a journal's target epoch follows its operation:
ENABLE0 -> 1,ROTATEtarget > source,ENVELOPE_MIGRATIONkeeps the key epoch) is terminal on resulting main5a1474bb5605fee1e71a6ccbb60160aeeba22bb2via #1007: resulting-main CI/CD (37760960561) and CodeQL (37760960559) succeeded, Productiondpl_2h5r5Mqx3rCA6E7bJm8FaUrz77SCis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). B2, C1, D1, D2a, D2b and the epoch relation are terminal; Gate 4D and Gate 4 remain in progress. Next: D3 read-only admission, then streaming capture and C2. Details and open criteria: #359 issuecomment-6058049029. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D Slice D3a (the cursor and the lease across journal successors: within a phase the cursor never regresses, a forward phase change enters the new phase at
(0, 0), entering recovery keeps the last cursor, an ordinary successor never touches the lease, and the same-owner renewal exists as a predicate) is terminal on resulting mainf10b30d0b53d9556152d4039916293dee2b7784cvia #1008: resulting-main CI/CD (37774706261) and CodeQL (37774706198) succeeded, Productiondpl_9LkSbnWuGLj4QEwJBrrdPFtqPL8iis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). B2, C1, D1, D2a, D2b, the epoch relation and D3a are terminal; Gate 4D and Gate 4 remain in progress. Next: D3b read-only admission (wiring the renewal), then streaming capture and C2. Details and open criteria: #359 issuecomment-6060229800. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D Slice D3b (the journal owner renews its own lease through a composed operation of its own: a fenced publish of the renewal and a root binding step that proves the renewal relation under the root lock; the ordinary checkpoint and the plain advance still cannot carry a lease change) is terminal on resulting main
bc7d248a4ec972ef410bf1dc8791bcf9f553b1ecvia #1009, which completes D3: resulting-main CI/CD (37788245553) and CodeQL (37788245538) succeeded, Productiondpl_9K7UQuCe4woooYMeekVXZefrMbpMis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). B2, C1, D1, D2a, D2b, the epoch relation and D3 are terminal; Gate 4D and Gate 4 remain in progress. Next: streaming capture read-only admission, then C2. Details and open criteria: #359 issuecomment-6062050668. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D streaming capture, stage one (building and staging a captured inventory one page at a time, so a very large inventory no longer has to be resident in memory; each page sealed once and staged in a private pending directory that is never authority, the successor built by the same function as
capture_inventory) is terminal on resulting mainedcd9535a25e7ef5869dd7bd4bbb8da29532e968via #1010: resulting-main CI/CD (37825712187) and CodeQL (37825714367) succeeded, Productiondpl_g83XFkCJgD9fKjABp9jEZeLHh4QVis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). B2, C1, D1, D2a, D2b, the epoch relation, D3 and the staging stage are terminal; Gate 4D and Gate 4 remain in progress. Next: stage two (promotion and the composed commit), then C2. Details and open criteria: #359 issuecomment-6067262533. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D streaming capture, stage two (a) (a staged inventory is promoted into the digest directory page by page and the successor published and bound under the root lock, in
commit_inventory_capture's order and through one shared core; the staged files go only after the root has committed, so a retry still has them) is terminal on resulting mainabd49cf99a1dcd4b21a25fc655f6cdc1ded6a08avia #1011: resulting-main CI/CD (37845701613) and CodeQL (37845701689) succeeded, Productiondpl_FeW7A38bTyBdwxKv6pFSpTPLtQpkis READY on the exact SHA with HTTP 200, and post-merge retention is complete (0 previews, 0 unknown). B2, C1, D1, D2a, D2b, the epoch relation, D3 and streaming S1 and S2a are terminal; Gate 4D and Gate 4 remain in progress. Next: S2b admission (the key-routed staging session), then C2. Details and open criteria: #359 issuecomment-6069729328. PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4D streaming capture S2b TERMINAL — PR #1012 (mirror)
CURRENT_MAIN = d5878c18e81d4f15ed486edf4240b96e9dbe6942 PR_1012 = MERGED (3 signed commits; 10 files; 3 review threads, 0 unresolved) RESULTING_MAIN_CI_CD = 37859962668 / SUCCESS CODEQL = 37859962546 / SUCCESS VERCEL_PRODUCTION = dpl_AVqAuddhF9EHfXGmqGvt9yaQi6vz / READY / exact main / canonical HTTP 200 ROLLBACK = dpl_FeW7A38bTyBdwxKv6pFSpTPLtQpk RETENTION = TERMINAL (3 previews deleted by exact ID, absence proven; 29 production/PROMOTED deployments + 3 canonical aliases retained; 0 previews; UNKNOWN = 0) STREAMING_S2B = TERMINAL GATE_4D = IN PROGRESS OPEN_PRS = 0 PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NObegin_streamed_capture/StagingSession: a capture is staged and committed without the caller holding a key; the journal key is routed from the authenticated root/registry, the committed manifest and binding are read from the root, and one journal directory value is held per capture. Full text and proof: #359 issuecomment-6071500665.Open before Gate 4 terminal: C2 exclusive conversion driver; inheriting unchanged pages; bounded adapter defaults; pending-directory reclamation; Gate 4E write barrier. NEXT: read-only admission of the C2 driver on exact main.
Gate 4D C2a TERMINAL — PR #1013 (mirror)
CURRENT_MAIN = d50dcbb5d4f1995b42f180f7cda4d2548c2e5398 PR_1013 = MERGED (3 signed commits; 9 files; 1 review thread, 0 unresolved) RESULTING_MAIN_CI_CD = 37868374940 / SUCCESS CODEQL = 37868374924 / SUCCESS VERCEL_PRODUCTION = dpl_HJ5UFEHKrTx88paGFh2JNeV4ZbyU / READY / exact main / canonical HTTP 200 ROLLBACK = dpl_AVqAuddhF9EHfXGmqGvt9yaQi6vz RETENTION = TERMINAL (2 previews deleted; 30 production/PROMOTED + 3 aliases retained; 0 previews; UNKNOWN = 0) C2A = TERMINAL GATE_4D = IN PROGRESS OPEN_PRS = 0 PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NObegin_conversion: the entry gate of the exclusive conversion driver. It needs the installation's exclusive admission (by mutable borrow; a shared guard does not type-check), derives the root layout from the admitted scope, re-reads the committed binding, the registry-routed key and the root-named manifest, and returns a session only for the owner of the lease inADMITorCONVERTwith the final inventory captured. Read-only: no write, no lock, no key, no clock. Full text and proof: GH #359 issuecomment-6072537648.Open before Gate 4 terminal: C2b (owner steps through the gate, first caller of the D3b renewal), C2c (cursor-driven iteration, crash/resume), inheriting unchanged pages, bounded adapter defaults, pending-directory reclamation, Gate 4E write barrier. NEXT: read-only admission of C2b.
Gate 4D C2b-1 TERMINAL — PR #1014 (mirror)
CURRENT_MAIN = 5cdf12cb44185918931a3b4f4dfe8d609c45d6a1 PR_1014 = MERGED (7 signed commits; 8 files; 21 review threads, 0 unresolved) RESULTING_MAIN_CI_CD = 37881709739 / SUCCESS CODEQL = 37881709758 / SUCCESS VERCEL_PRODUCTION = dpl_G5Yi6KMAVaJCUxfED8a9utf3CRpx / READY / exact main / canonical HTTP 200 ROLLBACK = dpl_HJ5UFEHKrTx88paGFh2JNeV4ZbyU RETENTION = TERMINAL (6 previews deleted; 31 production/PROMOTED + 3 aliases retained; 0 previews; UNKNOWN = 0) C2B1 = TERMINAL GATE_4D = IN PROGRESS OPEN_PRS = 0 PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NOConversionSession::renew_lease: the first real caller of the D3b renewal, and the first step that moves the journal through the exclusive gate. The root event is taken through the held admission, the committed journal is read back under it and the root settles the outcome, every file operation goes through canonical paths, the journal directory is pinned below the installation and outside the root, and a differing crashed candidate is quarantined. Disclosed: six review waves (the QNB-11 text asked for one) and 1042 meaningful lines (over target, inside the hard tier). Open: C2b-2, C2c, handle-relative adapter I/O (Gate 4E/5), inheriting pages, adapter defaults, pending-directory reclamation, write barrier. NEXT: read-only admission of C2b-2. Full text: GH #359 issuecomment-6074441537.Gate 4D C2b-2 TERMINAL — PR #1015 (mirror)
CURRENT_MAIN = c4628b5440143e154364ee9bc99b1595b32251fc PR_1015 = MERGED (3 signed commits; 6 files; 4 review threads, 0 unresolved) RESULTING_MAIN_CI_CD = 37890155449 / SUCCESS CODEQL = 37890155447 / SUCCESS VERCEL_PRODUCTION = dpl_BKPsiSMc6X6PipP9Nt9S3oJuUYaL / READY / exact main / canonical HTTP 200 ROLLBACK = dpl_G5Yi6KMAVaJCUxfED8a9utf3CRpx RETENTION = TERMINAL (2 previews deleted; 32 production/PROMOTED + 3 aliases retained; 0 previews; UNKNOWN = 0) C2B2 = TERMINAL GATE_4D = IN PROGRESS OPEN_PRS = 0 PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NOThe conversion session enters
CONVERTand moves the checkpoint cursor through the same fenced step as the lease renewal; the admission check now follows every outcome of the commit call. One consolidated correction wave; the cursor-against-page finding is deferred to C2c with a criterion. Open: C2c-1 (authenticated page access, page-local cursor), C2c-2 (iteration, crash/resume,VERIFY), handle-relative adapter I/O (Gate 4E/5), inheriting pages, adapter defaults, pending-directory reclamation, write barrier. NEXT: read-only admission of C2c-1. Full text: GH #359 issuecomment-6075712353.Gate 4D C2c-1 TERMINAL — PR #1016 (mirror)
CURRENT_MAIN = 4428fdd81c9e656be37861895a6cb001ef129dbc PR_1016 = MERGED (3 signed commits; 6 files; 0 inline threads, 1 reviewer note fixed) RESULTING_MAIN_CI_CD = 37901688894 / SUCCESS CODEQL = 37901688906 / SUCCESS VERCEL_PRODUCTION = dpl_DBXbZkbSJDN2ii4yqSxfsDuC9XMp / READY / exact main / canonical HTTP 200 ROLLBACK = dpl_BKPsiSMc6X6PipP9Nt9S3oJuUYaL RETENTION = TERMINAL (2 previews deleted; 33 production/PROMOTED + 3 aliases retained; 0 previews; UNKNOWN = 0) C2C1 = TERMINAL GATE_4D = IN PROGRESS OPEN_PRS = 0 PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NOThe conversion session authenticates the page set once, reads pages keylessly, and the checkpoint cursor is page-local (the contract now says what the entry index means); the cursor is checked against the authenticated entry count of the selected page. One correction wave. Codex was rate-limited for this PR (
NO_SIGNAL). Open: C2c-2 (iteration, per-entry step, crash/resume,VERIFY), handle-relative adapter I/O (Gate 4E/5), inheriting pages, adapter defaults, pending-directory reclamation, write barrier. NEXT: read-only admission of C2c-2. Full text: GH #359 issuecomment-6077415264.Gate 4 / Gate 4D: C2c-2 is terminal — PR #1017 merged as
92bf64ac: the conversion session iterates the inventory through the caller's idempotentEntryStep(page-bounded batches, persisted page-local cursor, crash/restart resume) and leavesCONVERTforVERIFYonly after it saw the end. Resulting-main CI/CD37923143912and CodeQL37923143923success; Productiondpl_B31kADJeBvN6uXPhg4dAFusYkEw3exact92bf64ac; retention terminal (4 previews removed, 34 Production, 3 aliases, 0 previews). Full proof, one deferred cosmetic criterion and the remaining Gate 4 list: #359 (comment). Gate 4 stays in progress; Gate 5 does not start early.PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.Gate 4 / Gate 4D: F1 is terminal — PR #1018 merged as
d1710f0a:DurableFs::read_at_mostandlist_dir_at_mostare required trait methods (no default that loads everything first), pinned by a compile-fail doctest triple; test doubles usetest-support-only helpers; no runtime behaviour changed. Resulting-main CI/CD37930964197and CodeQL37930964418success; Productiondpl_9T9o3RvF7LkaFmToPnaUX5VqMMgbexactd1710f0a; retention terminal (1 preview + 1 alias removed, 35 Production, 3 aliases, 0 previews). Proof, residuals and the remaining Gate 4 list: #359 (comment). Gate 4 stays in progress; Gate 5 does not start early.PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.
CURRENT CONTROL-PLANE CHECKPOINT — 2026-10-06 — GATE 4 ACTIVE / RETENTION TERMINAL
B2a root-bound resume is terminal via #967. B2 and Gate 4 remain open. Retention completion removes the operational hold but does not authorize source mutation or any later gate.
HISTORICAL / SUPERSEDED CONTROL-PLANE CHECKPOINT — 2026-10-04 — GATE 4D-A MERGED / RETENTION UNBLOCKED
HISTORICAL / SUPERSEDED — previous control-plane checkpoint
Successor B is correctly based on the #953 resulting main and carries the semantic A+B union: #953 SessionBinding/rebind semantics plus the mutation/root-recovery/lifecycle mechanisms extracted from frozen #952. The prepared-root Step-F same-instance recovery R1–R5 proof remains this PR's material closure scope.
Do not close Gate 4B, #922, #445, or advance #359/4D until #954 converges on its exact final head, merges normally, and the exact resulting-main CI/CD + CodeQL + Vercel Production gate is terminal.
HISTORICAL / SUPERSEDED — Successor A exact-head checkpoint — PR #953 — 2026-10-03
The Terra/Codex closure commit
e9bd7556...is now on the remote despite the executor's final report having observed a delayed remote ref. The earlier transport blocker is therefore RESOLVED / transient.The three P2s from
12cf7833...are implemented and their threads are now resolved:Fresh exact-head Codex review on
e9bd7556...found one additional VALID same-slice blocker: a mid-capture TOCTOU can occur whenprovider.state()observes the old runtime as Unlocked, another process commits root N+1, then the subsequent anchor read sees N+1. Current code publishes N+1 intoAuthorityCell.currentbefore proving the provider is bound to N+1;resolve_refthen returns Locked, and future retry cannot take the strict-forward rebind path because N+1 has already poisonedcurrent.Required invariant for closure: never publish a newer snapshot into
currentbefore provider/key usability for that exact anchor is established. Prefer rebinding/validation before publication, or otherwise restore/retain the previous snapshot on resolution failure. Preserve explicit-lock, route-change/rotation, rollback, same-generation mismatch and incompatible-authority refusals.This is still Read/Snapshot scope, but anti-cascade remains binding. One surgical race fix with a deterministic mid-capture regression is admissible; if it needs broad provider redesign or another architectural expansion, stop/split rather than cascade.
The new CodeScene Large Method warning on the 134-line cross-process integration test is non-material and resolved by evidence; no suppression or proof weakening.
Resource horizon remains unchanged: after #953 protected merge + exact resulting-main CI/CD/CodeQL/Vercel Production + cleanup/retention, executor reports and STOPs. No successor B or 4C.
CURRENT EXECUTION MODE — 2026-10-03 — RESOURCE-BOUNDED GATE 4B SPLIT
Anti-cascade/resource decision: PR #952 is no longer a correction target. It is the immutable reviewed extraction source. The current coding-agent run is deliberately bounded to the first successor PR only and must stop after its normal protected merge, exact resulting-main CI/CD + CodeQL + Vercel Production verification, worktree/branch cleanup, and safe Vercel retention. It must not start successor B or 4C in the same execution epoch.
Control-plane ownership is also split deliberately: GitHub issue, Linear, milestone, release-program and checkpoint curation is performed from the ChatGPT control-plane session; the coding agent should only read those records when needed and should not spend token/week quota duplicating status maintenance.
The prepared-root Step-F coordinator-recovery Critical is Gate 4B successor-B scope, not Gate 4D. Gate 4D remains crash-resumable rotation/rekey after 4B and 4C. #360/QNB-12 remains open until complete Gate 4B closure.
CURRENT R-15 CHECKPOINT — PR 952 / e34aae2 — recovery finding blocks merge
The minimal stale-CAS correction is signed/pushed and locally verified: success and reconciled stale CAS clear the local mutation latch only after physical/writer/admission revalidation; all uncertain errors remain fail-closed. Normal Git transport works; no sandbox/protection/signing bypass occurred.
New material finding: after an injected step-F COMMIT failure, the public coordinator reconciliation returns
PreparationPendingeven when the provider fault is removed. Existing authenticatedrecover_rootis not integrated into the provider-owning coordinator operation API. Lock/shutdown correctly refuse, but same-instance recovery is incomplete. Diagnostic proof is retained locally; temporary probes were removed from source. Do not merge or close 360/QNB-12 until this is fixed with fault proof and fresh exact-head convergence.No-op RootBusy is separately proved retryable after contention release; its conservative latch is not the prepared-root recovery defect. Remaining DeepSource Rust / CodeScene reds are understood test-only advisory findings, not green. No 4C journal, 4D rekey, collector, deletion, current-app authority change or Gate-7 switch was introduced. At saturated budget, establish a bounded mutation/root-recovery/lifecycle proof slice rather than expand or delete meaningful safety evidence.
HISTORICAL / SUPERSEDED — prior Gate-4B foundation checkpoint
CURRENT R-15 CHECKPOINT — 2026-10-03 — GATE 4B FOUNDATION TERMINAL VIA #951
All resulting-main CI/CD jobs succeeded, including Security Audit, Verified Signatures, Node 22/24, Core/Tauri Rust, Linux/macOS/Windows platform evidence, Build, Playwright, Deep Coverage, Storybook, Browser Quality, CI Success and Pages. Final-head CodeRabbit/CodeAnt/Codex review converged with no actionable finding and no unresolved thread. The two DeepSource test false positives remain evidence-dispositioned advisory red, not green; unavailable reviewer quotas remain recorded.
This terminal checkpoint is for the kernel admission foundation only. It does not complete issue 360, Gate 4B overall, Gate 4 or production Core authority. The next bounded engineering owner remains 4B integration, not 4C.
HISTORICAL / SUPERSEDED — #951 merged, post-merge proof was pending
Final-head CI/CD and CodeQL succeeded; CodeRabbit, CodeAnt and Codex reviewed the final delta/head without remaining actionable findings. All review threads are resolved. The two DeepSource test findings remain evidence-dispositioned advisory false positives, not a green status; quotas are recorded as unavailable. The normal protected squash merge did not close #360 or switch production Core authority. No next semantic slice or retention deletion starts before the exact resulting-main gate.
HISTORICAL / SUPERSEDED — pre-merge #951 checkpoint
Live reconciliation confirms Gate 4A terminal, including exact resulting-main CI/CD, CodeQL and Production evidence. Gate 4B is the current renderer-neutral admission/fencing owner. Historical legacy filesystem defects remain provenance; this checkpoint does not claim a production authority switch or Gate 4 closure.
HISTORICAL / SUPERSEDED — CURRENT EXECUTION — 2026-10-02 10:21 CEST — GATE 4 / SLICE 4A ACTIVE — superseded by verified Gate 4A terminal checkpoint
#950 is based directly on terminal Gate-3 main. It adds the cross-process root commit lock and guard ownership around root publication/recovery/key-epoch writes. Current exact-head evidence is partial: Vercel Preview, CodeScene, CodeAnt quality gates and several governance/security checks are green; CodeQL, Security Audit, Cubic, CodeRabbit, DeepSource Rust/Shell and remaining CI are still pending/running. Sourcery is quota-limited and Codex has been requested.
Program position
Child owner of #445 for R-15 Gate 4.
Objective
Build the durable control plane that makes enable/disable/rotate/migrate operations crash-resumable, race-free and cross-process serialized.
Required state machine
Persist authenticated operation ID/version, source/target epochs, bounded inventory/checkpoints, per-record progress or equivalent cursor, prepared/committed authority generation, recovery-required state, and exact resume/abort/finalize semantics including shutdown/cancellation.
Admission / concurrency
Existing P0 reconciliation
Acceptance
Non-goals