feat: consolidate TraceDecay V2 PR8-PR13 delivery - #421
Draft
ScriptedAlchemy wants to merge 4691 commits into
Draft
feat: consolidate TraceDecay V2 PR8-PR13 delivery#421ScriptedAlchemy wants to merge 4691 commits into
ScriptedAlchemy wants to merge 4691 commits into
Conversation
|
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
from
July 10, 2026 05:54
e50f8f5 to
4f5ab66
Compare
Owner
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 986f25cca6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
4 times, most recently
from
July 11, 2026 16:52
5862bd6 to
53502de
Compare
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
4 times, most recently
from
July 23, 2026 17:06
642a33a to
5f2f610
Compare
ScriptedAlchemy
changed the title
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
from
July 24, 2026 17:16
76dee0f to
0258866
Compare
ScriptedAlchemy
added a commit
that referenced
this pull request
Jul 27, 2026
Record the 2026-07-27 audit in the authoritative V2 status files. Three delivered claims (Plan 16 worktree/store identity, Plan 38 cursor repair, Plans 18/23 end-to-end sanitization) lost their tests in 9e3ca9f. Filed as verification-coverage corrections, not retractions: the assertion is missing, the behavior is not withdrawn. Also record the six instances of gates attesting to something they never checked, the libtest empty-filter asymmetry that hides them, the six product defects fixed tonight with their SHAs, and Plan 11's corrected open-gap list including two items the widened accessibility matrix surfaced. None of tonight's commits has CI validation: PR #421 has been conflicting since 05:13 UTC, so no CI has run since 01:24 UTC. Every fix is recorded as locally verified only.
ScriptedAlchemy
force-pushed
the
codex/tracedecay-total-redesign-plan
branch
from
August 1, 2026 18:32
062285a to
b73f8bf
Compare
`writer_owned_sqlite_snapshot_includes_committed_wal_data_and_readers_stay_read_only` called `Database::publish_test_runtime`, which materialises a sidecar *profile* shard next to the fixture database. The kernel initialises profile- and session-scoped shards through the fail-closed `tracedecay_runtime_core::ports::registered_schema` port, whose installer lives in `tracedecay-global-db` and can only be supplied by the root crate. The test never supplied it, so it failed with "no registered global/session schema installer is registered". Production reaches this through `DaemonSessionRuntimeRegistryV1::open`; peer root-crate fixtures (`graph::traversal`, `dashboard`) already call `register_registered_schema_installer()` for the same reason. This adds the same idempotent call. No assertion changed: the snapshot still must show committed WAL data and readers still must stay read-only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Assert scripts/dogfood.sh's rehearse-profile-backup call fires only when a named checksummed backup is present, and fix the runbook sentence that read as if a backup were mandatory in both modes.
391c20d guarded only the Windows job against rust-cache replaying a stale runner-local ORT link-search path; ci-test-full, ci-perf-gate-release, ci-clippy-full, ci-dashboard-full, and ci-hermes-integration-full share the same rust-cache/--all-features exposure and were missing the same guard.
…-total-redesign-plan
Codex records an activated plugin as [plugins."<plugin>@<marketplace>"] enabled = true in ~/.codex/config.toml plus a materialised bundle under ~/.codex/plugins/cache/<marketplace>/<plugin>/<version> — exactly what `codex plugin add` writes. Both are plain files TraceDecay already owns writers for, so install now activates the plugin itself instead of deferring to Codex's plugin UI, matching the Claude integration. Doctor reports Codex/Core as current once that pair is recorded, and the capability probe no longer claims an interactive-only host, so the receipt-backed lifecycle stops refusing Codex with UnsupportedCapability. An unparseable config, a non-table [plugins], or a foreign-shaped tracedecay@* record are all refused rather than rewritten; those cases defer with the exact one-time `codex plugin add` step. Uninstall clears only our own activation record. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
`env!("CARGO_PKG_VERSION")` resolves per compiled crate, so after the
workspace split every version `tracedecay-agent-hosts` stamped into a
host-visible artifact was this library's own 0.1.0 rather than the
`tracedecay` product version. Plugin manifests, Codex/Claude cache paths,
doctor staleness comparisons, host bundle snapshot ids, and the Hermes
provenance headers all carried it.
`build.rs` now reads the root package's `version` out of the workspace-root
`Cargo.toml` — the one place release-plz already authors it — and bakes it
into `TRACEDECAY_PRODUCT_VERSION`, mirroring how it already bakes
`TRACEDECAY_GIT_SHA`. The parser lives in `src/product_version/`, compiled
both as a crate module and by the build script, so the value baked and the
value asserted come from one implementation. Every former site now reads
`crate::PRODUCT_VERSION`; no site wanted the sub-crate version.
Two drift guards: a unit test comparing the baked constant against the
root manifest, and a root-crate test comparing it against `PACKAGE_VERSION`.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…-total-redesign-plan
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The first query against a restored generation paid the whole cold path: the sealed decode (which re-mints every file's exact-extraction authority with a canonical SHA-256 over every chunk, then repeats the full canonical validation sweep), plus the exact-admission sweep, record lookup indices, lane owners, and test-attribution join — all deferred behind OnceLocks and charged to whichever request happened to arrive first. That is O(store) on the serving path, violating the invariant in docs/SERVING-PATH-PERFORMANCE. Activation now owns that work: - mount runs the worktree open on the blocking pool instead of an async runtime worker, and warms every per-generation derivation there; - reconcile completion warms the generation it just published; - the publication store gains a single-flight decode barrier. The cache lock is never held across a decode, concurrent callers for the same generation share one decode instead of duplicating it, and a publication landing mid-decode retires the superseded result via an epoch guard; - the active generation is pinned outside the LRU, so cursor traffic over superseded generations can never evict it. Fail-closed is unchanged: only success is memoized, so a corrupt store still runs the complete check and errors on every request, and warming is best-effort — it is a pre-warm, never a gate. Measured on a release build over a 1.4K-file fixture: first-query cost 3.57s -> 88ms. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…-total-redesign-plan
Cold generation decode spent 40%+ of its cost in ExactExtractionAuthorityV1 mint/restore: every chunk was serialized to canonical JSON and SHA-256'd one at a time on one thread. Fan the per-chunk sweeps (mint, validate_all, admit_all, and the per-chunk leg of CodeFileChunksV1::validate) across the pool above a 16-chunk threshold. Digests are independent, results are collected in chunk order, and the reported failure is still the lowest-index one, so callers observe exactly what the sequential short-circuit produced. Cut the allocation churn inside canonical writing: strings and object keys now stream their JSON escapes straight into the sink instead of allocating a String per value via serde_json::to_string, integers format into a stack buffer, and already-sorted objects skip the collect-and-sort Vec. Output stays byte-identical, covered by escape-class and number equivalence tests against the rendering they replace. Measured on a 1201-chunk fixture (release, min of 25): mint 10.98ms -> 2.0ms; the canonical change alone takes the single-threaded sweep 10.98ms -> 9.6ms. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The explicit-only gating design it anchored was superseded by the directive to remove branch-added migration machinery entirely. Surgical two-file removal; the background_reads addition from the same commit window stays. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fresh V2 stores are created at their final schema; nothing on disk predates this branch, so every migrate-old-to-new path the branch added was dead weight and the source of live failures: the unbounded observation-projection retry spin, 30s migration-txn aborts under the 150K-chunk vector rewrite, and a format-revision skew that silently disabled retention. Removed: the observation projection V1-to-V4 migration, its silent full-rebuild fallback and the worker's advance pass (creation now installs the final V4 shape and any other shape is refused typed with a fresh-start remedy); the legacy inline-vector payload migration and its rebuild receipts (stores are born row-per-vector; the liveness inventory read path survives); the legacy memory cutover drains, V1 feedback-history repair and backfill pipeline plus their scheduler drains and the memory-cutover CLI verb (the archive-merge half stays - branch retirement still preserves memory through it); session-temporal repair; the transcript-facts drain driver; Ladder B stepwise convergence. Fresh-store schema verified byte-identical to all live stores minus the empty migration ledger. memory_status loses legacy_backfill_complete, which could never complete again. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
With no database migrations in the product, the persisted boundary marker, its checksum and state-machine legality tables, and the forward-recovery gate existed to shepherd schema migrations that no longer happen. The forward-only binary policy stays: identity checks, the strict dogfood-forward-only post-update mode, the backup contract, and a post-install failure path that proves the daemon stopped and prints forward-recovery instructions inline. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Delete the code orphaned by the removal commits: the session-temporal repair paged audit drivers (the trigger-backed invariants themselves survive), the memory cutover's canonical-label helper, the migrate registry's unread field, and the vector-generation test helpers, taking workspace dead-code warnings from twelve to zero. Regenerate the dashboard contracts schema, whose stale legacy_backfill_complete requirement failed the blocking contracts:check step. Close the serving-path doc's 150K publication open issue as superseded, rewrite its forward-migration wording, and mark the plan doc's memory-cutover section superseded. Drop an unreferenced build-support draft and ignore the .superpowers session-notes directory. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Fold the branch-added v19-v25 ladder stages into creation DDL - proven byte-identical by stepping a live v18 store and an empty store through the restored ladder and diffing every sqlite_master object against a freshly created store. Stores are created at user_version 25; any other populated shape gets a typed refusal naming the fresh-start remedy, per the intentional V2 breaking cutover. The migration-reindex surface is renamed GraphRebuild since its real producer is the generation stamp, not the ladder; reindex-on-new-store behavior is unchanged. Narrow migration_sql to what schema install and bulk index replacement actually use: the zero-caller single-statement schema step dies, the SchemaMigration policy becomes AuthorizedLongLease, and the renewing per-step lease is kept deliberately - the >1M-row full-index replace depends on it. Delete the writerless memory_v2 lineage layer (the sole production writer died with the backfill) except insert_event, which the live purge path still calls; PurgeIntent collapses to a struct. Reseed the pr_autotrack fixtures through the ordinary V2 write path; the four remaining failures document the archive-merge dropping the V1 mirror, which the memory_v2-sole-design change dissolves and will gate. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The extracted-seam composition replaced the migrate crate's host admission facade with a stub whose every method returned retained_unavailable, so the legacy Hermes state.db import failed unconditionally in production; it now re-exports the real usecases facade. canonicalize_existing_prefix appended a trailing separator to any path with a missing tail, and since the project registry matches on the stored string form, alias lookups for moved projects silently missed. The graph-schema identity check in the shared test-runtime publisher now applies only to graph shards; registered shards carry their own schema family and sit at user_version zero by design. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Remove the eight V1-to-V2 profile-consolidation CLI verbs and the pipeline behind them - plan, apply, verify, export, reconstruct, rollback, registry-gc and consolidate dispatch - none of which had a production caller after the fresh-store cutover. The daemon-facing machinery those verbs shared stays: registry GC and inventory keep their MCP admin actions, hermes migration keeps its agent_cmd callers, profile backup keeps its dogfood verbs, and memory_cutover's archive-merge is untouched. consolidate/sqlite is trimmed to the closure memory_cutover actually calls. A live error remedy that told users to run the deleted consolidate verb now says to retire the extra shard. Test fixtures create profile-identity roots through PrivateStoreIo so suites pass under any umask, hermes tests wire the profile-pin host port they always implicitly required, and the registry-gc concurrency test drives one mount like production instead of racing two. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The three projection failures blamed on the migration removal trace to the earlier recall fix that narrowed derived logical copies to genuine re-emissions: a parent-message link is threading, not a copy. The tests encoded the old every-reply-is-a-copy semantics and are re-contracted; copy persistence, restart idempotency, and back-off coverage are unchanged in strength. The retrieval candidate fixture had aborted at seed time since its FK on session_turns went unsatisfied, so its expectations had never run; it now seeds parent turns, scopes the snapshot to the fixture session, asserts all in-window occurrences, and narrows three query-plan assertions that were unsatisfiable by query shape. One assertion stays red on purpose: the root-wide derived candidate query full-scans session_derived_evidence because its covering index leads with session_id - a real performance question, not a test defect. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
# Conflicts: # crates/tracedecay-migrate/src/manifest/runtime.rs # tests/storage_suite/migration_manifest_test.rs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This draft PR is the consolidated delivery branch for TraceDecay V2 PR8 through PR13.
The branch also contains the supporting rusqlite runtime cutover, worktree-aware incremental indexing, storage retention/Doctor integration, and direct product tests required by the canonical V2 plans.
Verification
cargo check --all-featurescargo test --all-featurescargo clippy --workspace --all-targets --all-features -- -D warningscargo fmt --all -- --checkCurrent status: implementation is still being consolidated from the shared checkout and CI is red. This PR remains draft until the working tree is committed, broad verification is stable, and the historical conventional-commit blocker is resolved. It must not be merged in its current state.
Safety boundaries
GitHub review ingestion is read-only. Semantic indexing never blocks exact/lexical/graph retrieval and publishes only complete compatible generations. Local coordination logs, private transcript evidence, secrets, and ad hoc artifacts are excluded from commits.