Repository navigation
Conversation
…venance CI-007 had no way to import "all available" Actions history with a recorded reason for its lower bound: a UI shortcut copied the catalog creation day into an explicit date, and nothing survived a reload. Provisional owner decision (2026-10-11), Q-007 (a): an explicit administrative "All available" choice resolves to the repository creation instant floored to its UTC day at save time. The command carries an optional populationBoundSource whose single initial or expansion bound must equal that floor; omitted and null serialize identically, so existing command digests are unchanged. After repository authorization, outside any transaction and inside the existing 20-second deadline, the server classifies a retained receipt first (no provider read on replay), then reads the scoped repository once through the admitted installation-token repositories.get_by_id operation and the shared creation-date grammar. Provider failure is 503; missing, mismatched or database-future creation metadata is a typed 422 (creation_date_missing / creation_date_mismatch / creation_date_in_future) without writes and without a fallback floor. Explicit-date saves are unchanged. Expand revision 20261012_0020 adds capability ci-actions-history-population-bound/v1 with the append-only relation ci_history_population_bounds (exact catalog contract, UTC-day-floor, source and identity checks, dataset FK, PUBLIC revoked) and runtime SELECT/INSERT. The configuration transaction records provenance for every initial or strictly earlier bound, refuses a catalog source without a matching server observation, and binds catalog-source replay to its row. Status keeps ci-economics-history-status/v1 and projects populationBound from the earliest current-generation row only when it equals the cursor bound, otherwise unrecorded. Only history configuration and status require the new capability. A companion audit event was rejected because the audit ledger is not a query authority. Archive v1 catalog, codecs and receipt bytes are unchanged. The shared runtime role needs a drain in both directions: predecessor attestation rejects the new grant. In-repo PostgreSQL witnesses project the predecessor manifest (admitted after expand, successor grants rejected, predecessor apply revokes them); a real predecessor-image rollback witness remains shared qualification work. All migration-head pins move to 0020. The History editor offers an explicit "All available" / "From a specific date" choice, never imports on enable, drops the source when the date is edited, refuses missing or invalid catalog metadata, states that GitHub may not retain the oldest runs and shows recorded, explicit or unrecorded provenance after reload. OpenAPI and the generated client are regenerated; docs, requirements, Proofkit routes and the ROADMAP CI-007 row are updated. Native PostgreSQL, unit, vitest, browser and mutation witnesses are unexecuted locally and run only in GitHub CI; no provider, deployment or live completeness evidence is claimed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
CI-007 lacked an explicit "All available" import with a recorded, reload-surviving reason for the lower bound. The earlier UI shortcut only copied the catalog creation day into an explicit date. Provisional owner decision (2026-10-11), Q-007 (a): an explicit "All available" choice resolves to the repository creation date (UTC-day floor) at save time; provenance is recorded and shown; nothing is imported on enable; missing creation metadata refuses the choice. The audit ledger is not a query authority (persistence.md:77-78), so provenance gets its own capability and table.
What changed
populationBoundSourceon the configuration command; its bound must be the UTC-day floor of the asserted instant. Omitted andnullare equivalent in the backend and the frontend client, and existing digests are unchanged.GET /repositories/{id}must report an equal creation instant. Retained receipts replay without a read. Provider failure is 503; missing, mismatched or database-future dates are 422 with no writes.20261012_0020addsci-actions-history-population-bound/v1and the append-onlyci_history_population_bounds(exact catalog contract, floor/source/identity checks, dataset foreign key, PUBLIC revoked, runtime SELECT/INSERT). Only configure and status require it. Archive v1 bytes are untouched.populationBound(explicit/repository_created_at/unrecorded). The UI validator enforces the same rules as the backend: floor, creation ≤ recorded, and bound ≤ recorded. Old strict clients fail closed.Expected result
After merge and exact-head CI: an operator can choose "All available"; the server verifies and records the bound's source; status shows it after reload; explicit-date flows behave exactly as before.
Non-claims: no native or local test was executed; this is not a provider snapshot; it does not prove GitHub retains the oldest runs; there is no live or dense-history qualification; there is no zero-downtime shared-role coexistence; the real predecessor-image rollback test is not run (shared remaining work for expand migrations); there is no automatic import and no fallback floor.
Provisional decisions: Q-007 (a) (2026-10-11).
Independent review: gpt-6-astra (xhigh); findings addressed or rejected with reasons in the single commit. Provisional owner decisions (2026-10-11) are labelled in the changed documents.