Repository navigation
Rounds 2 and 3 of the roadmap: feature/round-2 into main - #11
Merged
Merged
Conversation
The latest release, 0.3.6, has the peer range convex ^1.42.0 and convex-helpers ^0.1.115, which admit the pinned convex 1.46.0 and convex-helpers 0.1.124. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ed targets and the local reading of Sc L2-9 at their Specs Each ruled fork carries its answer and the owner's words it rests on; the licence fork says it is not ruled. The Specs stop calling 100 lines provisional: it is the bound PlaceOrder's declaration carries, the example's promise and no platform limit, and the open questions on OQ3 close. The first experiment states its latency, throughput and contention targets for the pinned local backend. Sc L2-9 reads as the local observation on the production composition, its concurrency half is the contention run, and no Spec claims hosted parity. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ts and the reading of Sc L2-9 The latency sample counts operations, the speed targets are set for the local backend rather than said to hold, the contention shape admits engine failures, the mapping risk and the bound's ceilings say no more than the ruling, and the multi-document gap keeps only its size budget open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…lean as the ruling Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The order decider gains cancel and OrderCancelled, refusing an order with no event (orderNotFound) and a cancelled one (orderAlreadyCancelled). The stock item decider gains release and AllocationReleased over its two totals, refusing a release above the quantity allocated (insufficientAllocation). Orders gains the cancel operation, Inventory the release operation, and the parent the CancelOrder use case, which calls Orders first and releases the lines Orders returned in the same mutation. The order DTO admits cancelled, so the order summary row CancelOrder writes says cancelled. Generated component files of the production composition from a fresh codegen. Spec: the example domain's model carries every name, shape, code and message, and owns an example space with six examples, each bound to a native test on the production composition; pure decider tests with the fold and rebuild, pure executor tests and convex-test tests beside them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ator entry on paper A read model is installed through its first rebuild, declares its projection versions as a list, and keeps batch progress on a row no command reads. The rebuild's lifecycle is pinned with every transition and who makes it. The gate, the audit records and the one operator entry contract are pinned for the builds that follow. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…th the owner's words Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…the engine's retry count, the deployed tables checked, the record type spelled out The table a conflict named now carries the component that holds it, and each request's refused executions are checked against the engine's own retry count. Rows left behind are reported as not deployed only while the composition's schemas declare no such table. The Measurement record type in the first-experiment Spec names the shapes of the latency and throughput readings, the paths and the caller answers the code writes. The unrelated-stock tests say which tenant layout they run, and the timing command keeps a backend binary the caller exported. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…t Specs in the corpus form The no-job assertions of the order summary and the three order sizes keep their function-log window and add the read of _scheduled_functions in the parent and both contexts, taken once after the commands, so that place() makes no extra read. Each of the five example Specs changes only its clause about a delayed job. F18 to F20 and their examples take the form of the earlier facts and probes: the status line, a narrative paragraph, an outcome per fact and per example, and step texts that read as sentences. F19 states the range of times seen under load and asserts none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… ledger A read of the Spec text for what would make a test and a build disagree. Each fix follows the text the designer decided: the progress row gets its update time at insertion, the batch that ends a pass records its counts, an empty tenant list still reads the gate, a purged generation drops its retirement fields, the history batch replaces steps 4 and 5, the restore's exemption names the progress rows `resumeChain` writes, a closed entry reopens only at its generation's switch or abort, and the stale sentences on the first activation, the tenant iteration and the audit tenant rule follow the text. The ledger records what the text closes and what the build must still show. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Tests: the cancel keeps placedAt on the order and its summary row, at the native and convex-test tiers; a caller without orders.cancel is refused for an order never placed too, which shows the check comes before Orders decides; the order DTO's validator admits cancelled; the order rebuild is compared with a state written out. Each fails with its rule removed. Spec: a decider returns a rejection and its context's adapter throws it; quantities and prices are safe whole numbers; stockLimitExceeded is named; the call order and the quantities' source are shown at the pure tier, not by the native examples; decidedBy D3 and D6. README: the corpus and the application package counts, the E-46 row's maximum. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…aceOrder The first experiment's Spec keeps the measurement record type, the capture bullets and the timing command of the measurement, and the largest order, the dataset sizes, the contention shape and the speed targets as the rulings on the forks wrote them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… in the example domain The corpus count, the expected check line and the package rows of the design README are recomputed from the merged tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The restore's run record keeps who finished it. A restore drives the progress rows of generations in building and verifying only, and resumeGeneration continues a started purge from its progress row. In the backfill mode a null candidate deletes a row only when the row is older, so the version compare has no exception. The Layer 3 repair operations run under the established human or service actor that holds the tenant grant. The progress row's field is pass. The restore's read-model check without a compare mode enters the ledger as open. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…dgets and page byte checks The largest order's verification bullet keeps both lanes' changes: the maximum of 100 lines and the read of the scheduled functions table. The corpus count, the expected check line and the foundation row are recomputed from the merged tree. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…argest order and the documents a command reads Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…re read, the contention example in its pack, the refused execution's record, the fourth cost target's count, a page's byte reading and the settled OQ3 row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…cution time the log reports, not the engine's cap Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rite pause, operators, audit and tenancy on paper The two read-model examples keep the first rebuild as their setup and the read of the scheduled functions table; the application pack keeps its recomputed count with the registry examples' new wording. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…irst rebuild Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Step 9 and readModelWrites call applyHistoryProjection once per command for each bound history read model with the entries' events and no version, and check the row count after that call; a history row counts once in the limit and in readModelRows. ReadModelBinding accepts a HistoryProjection, and binding once per source applies to history projections only. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… versions is empty fnDiagnosticLine places versionsOmitted on every line that measures more than limitDiagnosticBytes, counted in the fit; the code left it out when no entry was cut, which the pure proof refused. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
tests/hosted/hosted-examples.test.ts binds the four hosted examples and runs them in order: Probe 7's retention reads the planting records and the parent's scheduler rows before anything is deployed or imported, then deploys the copy and plants; Probe 7's replacement in place exports, changes and imports on that copy with the run's own labels, counts the import in the planting records and lets every kept schedule finish; the production composition is deployed and places an order through an ordinary client; Probe 3 deploys the copy again and reads the usage around three sets of calls. Written and type-checked; no hosted deployment was contacted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
npm run test:hosted runs vitest.hosted.config.ts, whose one project, hosted, runs the driver with the hosted run's global setup; the root configuration includes none of it. .github/workflows/hosted.yml runs on dispatch and at 03:00 UTC on Monday and Thursday in the environment hosted, one run at a time, gives the key only to the steps that need it, masks its forms, and prints the captured log and uploads the record as hosted-evidence only after the record check finds no form. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
# Conflicts: # design/README.md # design/specs/platform/acceptance-contract.sdp.md # design/specs/platform/native-harness.sdp.md
The acceptance contract takes the ruled pass of the first experiment, the README counts twenty-four rows, restore records the enumeration of a stream awaiting a baseline as an open question and inventories it, a parent query relays writePaused unchanged, entry names every kind of entry, the aggregate form joins ReadModelBinding, the f19 ID is corrected, the tier and work words are fixed, and "backup archive" names the exported artifact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The receipt sweep refuses a now later than the mutation's time, reads through boundedPage with list's byte bound so a run ends at 1,000 rows or 8 MiB, deletes what it read without the dead classification, and checks now and limit first in sweepNext too; both are exported through the command index, and the receipt Specs name fnSweepNext and the byte bound. convex-test cases show each refusal and the early end. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The versions cut of a diagnostic line finds its longest fitting prefix by a binary search, which a pure test at 1,000 versions holds equal to the linear search; a sink that returns a thenable has its record counted as lost by one gap line and its rejection handled, as fnEmitDiagnostic now says. The pure fit test fails a build that leaves versionsOmitted out, a convex-test case shows a skipped generation left out of readModelRows, and the support helper, its virtual modules, a title and a comment say what they are. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The history fold's pure test folds every interleaving in every one of the 32 contiguous splits, replaces an allocation on a second StockAllocated from the same stock item, and leaves a prior row unchanged under events it does not name. The Sc ALL-1 verifiers share BaselineOperationsWorld, and the control command runs in the after step of its own; both pass on the native backend. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
redactError redacts an error's name as its message and finds a key in a cause or in an AggregateError's errors, walked to the same bounded depth; pure tests plant a key in each. The hosted pure test asserts that the socket client the admin access builds gets the redacting logger and that a socket log line carrying the planted key comes out redacted. A pure test runs scripts/acceptance.mjs on a temporary corpus and asserts exit 1 for a record that fails a scenario and 0 for one that fails none. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The hosted in-place example says the five states are planted before the export and read after the import from an archive with no scheduler table, and that the restored pending reference is cancelled; its test compares the documents and the scheduler rows of every scope the copy mounts, a fixed list. Probe 3 asserts the documents each call read, the usage settles against a 300 s deadline, and the retention example checks each age against the reading's time. The five hosted examples join the foundation pack, the README states 237 Specs, and the harness Spec names the deploy key on a hosted deployment, allows a same-run before and after comparison, and says where the hosted examples run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ve holds Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ting for the first hosted run, the restore finding's note Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
redactError replaces an error with a redacted stub when its walk reaches the depth bound with something left to read, and walks the values of a plain object as it walks a cause and nested errors; a pure test covers each path. The sweep's byte-bound test states 8 MiB as a literal, and the acceptance script test takes 60 s, which two graph builds need under load. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
STATE.md describes the branch at its close: round 3's mini roadmap done but for the hosted tier's first runs, which are the owner's after the merge; the one pull request into main; what each lane, the integration, the review, the fold-in and its read showed; the code as it is; decision 42 amended and 52 added; the owner queue and the leads brought to the present, with CI's failure at d2a8d1b recorded. ROADMAP.md marks 4a, 4c, 4d and 4f done and the hosted tier built. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The blobs payload is an ASCII string, not bytes: convex/values converts bytes to base64 in JavaScript, which took the combined write 0.44 s of its 1 s budget unloaded. The string takes 0.065 s at the same document size and still fails on the bytes-written limit. The test measures the combined write's execution time from the function log. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
interruptGeneration reads and writes the generation row alone: it refuses verified, active and purged, bumps the fence and records who and when. The batch one fence below, the pending batch of the chain the interrupt replaced, records the interruption on the progress row with the operator from changedBy and schedules nothing, so an interrupt conflicts with a batch only through the generation row. CI at d2a8d1b showed the interrupt losing every rerun to back-to-back checkpoints. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The generation row gains interruptedFence, which interruptGeneration sets to the new fence and every other fence bump leaves. A stale batch records the interruption on the progress row only while interruptedFence equals the fence and the row does not already hold the note, so a batch pending across an interrupt and a resume writes nothing and one pending across two interrupts records the second once. Codegen leaves both compositions' generated files unchanged. STATE.md closes the L2-5 half of Leads 43. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… writes no read-model row Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Important Review skippedToo many files! This PR contains 416 files, which is 316 over the limit of 100. To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch. Upgrade to a paid plan to raise the limit. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters (9)
📒 Files selected for processing (416)
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
- The timing command no longer forces the owner's Linux backend binary. The harness picks the pinned release for the platform and downloads it into .cache/, or takes CONVEX_BACKEND_BINARY when the caller sets it. - Probe 7's hosted in-place example covers depot/migrations, the migrations component the depot mounts. The archive parser reads nested _components/<a>/_components/<b>/ paths, the scheduler rows are read in that scope, and the binding counts scopes by the key's last slash. A throwaway run on a local native backend running the hosted copy passed with depot/migrations/migrations compared; the hosted deployment has not run it. - STATE.md takes the corpus digest the check prints, 90b4b34a0c53c54a, and says what the review found. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The receipt sweep deleted expired receipts without reading the maintenance gate, and sweepNext reached it through sweep, while spec:application.write-pause promises that every writer in a scope reads the gate inside its own mutation and the restore door keeps every writer out. The Spec side is right (review of 2026-10-10, F2). - sweep calls assertWritable after its argument check and before its first receipt read, with the scopes "all" and the tenant's and no source scope, because it writes no source stream; a closed scope refuses the run with writePaused and it deletes nothing. sweepNext reads the gate through sweep, after its tenant-list read. - The write-pause, receipt-table and idempotency-and-receipts Specs say so where they describe the gate's callers and the sweep's reads; the gate's header comment names the sweep among the callers. - convex-test, both compositions: a closed deployment and a closed tenant refuse sweep and sweepNext with the transient writePaused and the receipts remain; the restore door refuses with "write paused for all: restore"; the same call deletes after the resume or once the variable is cleared. Removing the gate read fails all six and no other test. - Native, tests/native/gate.test.ts: the restore door refuses the sweep on a running backend and it deletes nothing, and the same call deletes the expired receipt once the variable is cleared. - STATE.md records the repair and its re-measured corpus digest. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
A gpt-6.1-sol read of the review repair (job-mv27ccog-b3a71a66) found the typeScopeKey entry of spec:application.write-pause still saying a scope is built only by scopesOfUseCase, startGeneration, the rebuild's batches, the journal's baseline driver and the operator entries, while the repaired sweep builds its tenant scope through tenantScope. The entry now names the receipt sweep among the builders. STATE.md records the read and its re-measured corpus digest. Code and tests unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
darko-mijic
added a commit
that referenced
this pull request
Oct 10, 2026
The three pull requests of the unit are merged or ready: #11 into main as a758ba4, the Protocol's #28 as 415b095 and #29 as 822aea4, and #12 retargeted to main, merging after this close. The pin is 822aea4 (b5fb659). The third read of the history Specs has run, so the owner's ready on the history projection waits for nothing else, and the history rebuild's waits for OD-157 alone; the roadmap's 5d and 4e say so. The measured block, the corpus digest and the close's gates are re-measured at the new pin, the native tier included. Two owner-queue rows closed by the merges are dropped: the three pull requests, and the gen-1 quotes question that preceded their pushes. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rounds 2 and 3 of the roadmap, the tooling unit and sitting two: everything on
feature/round-2sincemainat592f1dc, for the owner's review and merge.design/STATE.md("Where the work stands") has what each unit showed, at the tier named.design/ROADMAP.mdhas what comes next.What the branch holds, by unit
CancelOrderandrelease, Probe 6 (the migrations component is not used by the rebuild) and Probe 7 (scheduler, restore, scheduled arguments), the gate with its audit record and operator entries, the stock item ID bound, and a review with its fold-in.dev/hosteddeployment.CONTEXT.md, and the Apache-2.0LICENSE.entry; the tier names compiled, pure test,convex-testand native backend; the harness's backup archive names.design-hosted-tier.mdsection 7: redaction, the record'starget,hostedTarget, the selection kinds,npm run test:hostedand.github/workflows/hosted.yml. It has never run against a hosted deployment.Proof
CI runs on the push. On the integrated head (
e97db90):npm testpassed 1,029; the whole tier had 1,178 passed, 2 failed and 5 skipped. The two failures were Probe 4's 1 s timeouts under a load average of 10, and both passed alone. Acceptance had 34 passed and 4 missing: two L2-6 examples, L2-7 and L2-8, which have no verifier yet. After the fold-in:npm testpassed 1,046, and the Sc ALL-1 verifiers and touched native files passed. CI's first push of the close failed one file, Probe 4's nested example, which hit its 1 s execution limit. An earlier push had also failed Sc L2-5 intermittently, becauseinterruptGenerationlost every OCC retry to the rebuild's own batches. Both are fixed: Probe 4's documents hold an ASCII string in place of bytes, and the interrupt now touches only the generation row, withinterruptedFence. CI on131b48apassed: 175 files, 174 passed and 1 skipped; 1,201 tests passed; acceptance 34 passed, 0 failed, 4 missing, "run passed · tree clean".The close ran one behavior review (
gpt-6-astraat xhigh, 17 mutations, 14 caught) and four line reads (gpt-6.1-sol). An Opus agent read the GPT-written code. Forty-three findings were ruled and folded in, and sol read the fold-in. The defects that mattered were found twice, independently, by reviewers from both families: two gaps where a deploy key could leak through an error'snameor anAggregateError, and the sweep's missing byte bound. All three are fixed, with tests.What waits for the owner
git apply ~/dev-libar-supporting-context/calibration/application-platform-sitting-two/patch-doc-sitting-two.diff. Only the owner edits the doc.npm run test:hosted, then the scheduled workflow onmain. Thehostedenvironment admits onlymain.clean-capybara-16, the unused production deployment, if nothing uses it.tmp-convex-findings.txtin the main tree makes every local run record "not clean" until it is moved.Not in this branch
The history view's build (5d), baselines and migration (5a), restore (5b), the adopter-facing cut (5c),
readyon any Spec (4e, the owner's), and Layers 3 to 6.Review repair (2026-10-10)
A review of the four open pull requests on 2026-10-10 found one contract break on this branch. The receipt sweep,
sweepinsrc/command/receipts.tsandsweepNextthrough it, deleted expired receipts without reading the maintenance gate, so a write pause and the restore door did not hold it, whilespec:application.write-pausepromises that every writer in a scope reads the gate inside its own mutation, names the mutations that skip the read with the sweep among none of them, and says the restore door keeps every writer out. The Spec side was right.sweepnow callsassertWritablefor the scopesalland the tenant's after its argument check and before its first receipt read, the restore door read first, so a closed scope refuses the run with the transientwritePausedand deletes nothing, andsweepNextinherits the read after its tenant-list read. The three Specs that describe the sweep,spec:application.write-pause,spec:command.receipt-tableandspec:command.idempotency-and-receipts, and the gate's header comment changed in the same commit. Proof by tier:convex-test, six new tests intests/simulator/receipts-sweep.test.tson both compositions, where a closedallrefuses both entries and the receipts remain, a closed tenant refuses that tenant while another tenant sweeps,MAINTENANCE_MODE=restorerefuses withwrite paused for all: restoreand deletes nothing, and the same call deletes afterresumeGateor once the variable is cleared, with exactly those six failing when the gate read is taken out; native backend, one test intests/native/gate.test.tswhere the restore door refusesinternal.receipts.sweepon a running backend and the same call deletes after the variable is cleared; the compiled and pure tiers are unchanged and pass, and CI'snativejob runs on the push. Drift repair, not a decision: no register row. The commit isbb82f33, "fix(receipts): the sweep reads the gate before it deletes";design/STATE.mdrecords it, with its measured block re-measured there. Agpt-6.1-solread of the repair (job-mv27ccog-b3a71a66) found thetypeScopeKeyentry ofspec:application.write-pausestill naming the builders of a scope without the sweep, which builds its tenant scope throughtenantScope;44a89c1adds it, with the digest re-measured.🤖 Generated with Claude Code