0a7a4aac49
test(pi): drop contract guards that policed the process only
...
Three checks existed to keep the staged rollout honest and would fail on any
legitimate future change:
- schema.rs / migration.rs / backup.rs pinned by SHA-256
- the impl Database write-surface symbol inventory pinned by name
- specific restore test function names asserted to exist
Behavioural assertions, the DML column-authority scanner, the type barriers
and the pinned oracle fixture hashes stay: those catch real regressions. The
infra path list survives because the DML scanner still needs it.
2026-08-03 08:44:45 +00:00
fff5d7ede9
fix(pi): align credential retry scope
2026-08-03 08:32:41 +00:00
a2fa86bea1
fix(pi): localize UI and isolate credential health
2026-08-03 08:07:19 +00:00
a8246da3d6
test(pi): retire process-only guards from the contract suites
...
The suites were written as executable contracts for the implementation
process. Three of their checks only policed that process and would fail on
any legitimate future change:
- schema.rs/migration.rs/backup.rs pinned by SHA-256
- the impl Database write-surface symbol inventory pinned by name
- specific restore test function names asserted to exist
The behavioural assertions, the DML column-authority scanner, the type
barriers and the pinned oracle fixture hashes are kept: those catch real
regressions.
Headers are rewritten as contract documentation; the stale red/green
ledgers no longer described reality.
2026-08-03 08:01:24 +00:00
56acfd266e
docs(pi): drop process-only handoff documents
...
The handoff, contracts, restructure ruling, reviewer spec and main-project
contract were scaffolding for the implementation process, not deliverables.
Their technical invariants now live in the code and the certification suites.
Kept: the extensions design appendix (future work) and the restore hardening
debt register (known issues in shipped code).
Certification suite comments that pointed at the removed restructure ruling
are made self-contained.
2026-08-03 07:56:09 +00:00
43dc18a2c5
fix(pi): unify gateway and shared-file boundaries
2026-08-03 07:30:16 +00:00
a221e086a3
fix(pi): bind native publication to durable ownership
2026-08-03 05:17:33 +00:00
0b609158d7
fix(pi): bind native and prompt recovery to revisions
2026-08-03 04:43:44 +00:00
c94983d5fa
fix(pi): reconcile prompt authority without partial state
2026-08-03 04:09:23 +00:00
692ef41883
fix(pi): bind recovery to durable native authority
2026-08-03 04:09:18 +00:00
914fc99b4c
feat(pi): expose explicit prompt library reconciliation
2026-08-03 03:23:57 +00:00
2ba603fb77
fix(pi): treat stale skill cleanup as post-commit state
2026-08-03 03:23:51 +00:00
40e087c072
fix(pi): harden gateway publication and retry responses
2026-08-03 03:23:48 +00:00
1e9e59051a
fix(pi): refresh desired takeover state after failures
2026-08-03 02:08:52 +00:00
5360061bb6
fix(pi): reconcile native resources across directory moves
2026-08-03 02:08:44 +00:00
969cdaed5b
fix(pi): make catalog compensation conflict-safe
2026-08-03 02:08:38 +00:00
57ba6beb43
fix(pi): harden gateway runtime boundaries
2026-08-03 02:08:32 +00:00
93eddd5521
docs(pi): refresh final scope audit
2026-08-03 00:38:38 +00:00
9f910270ef
fix(pi): surface pending takeover state
2026-08-03 00:38:34 +00:00
9d0e75d56a
fix(pi): restore catalog and takeover authority boundaries
2026-08-03 00:38:29 +00:00
26447effa2
fix(pi): preserve skill ownership through install failures
2026-08-03 00:38:06 +00:00
cf978c1346
fix(pi): make shared file commits collision safe
2026-08-03 00:38:02 +00:00
6953f9fffd
fix(pi): harden gateway failover and command isolation
2026-08-03 00:37:57 +00:00
816a8b3928
docs(pi): record parity and pinned behavior evidence
2026-08-02 22:52:40 +00:00
a88a58b516
feat(pi): expose first-class desktop workflows
2026-08-02 22:52:35 +00:00
7609ff799e
feat(pi): add native catalog and gateway data plane
2026-08-02 22:52:26 +00:00
26a95aeb05
docs(pi): define main project contract
2026-08-02 17:05:14 +00:00
9fffc8853d
fix(pi): close native inspection review gaps
2026-08-02 16:40:45 +00:00
d2ad7995a3
fix(pi): fail closed on unrepresentable compat spread
2026-08-02 16:16:14 +00:00
bd3e2e54fc
docs(pi): adopt incremental review scope
2026-08-02 15:47:02 +00:00
2a0a8125eb
fix(pi): certify pinned native inspection semantics
2026-08-02 15:24:48 +00:00
15c735f040
fix(pi): mirror pinned native runtime semantics
2026-08-02 13:56:18 +00:00
2f856b0ffb
fix(pi): validate deferred headers after resolution
2026-08-02 12:05:25 +00:00
9b5a146323
refactor(pi): certify native inspection boundary
2026-08-02 10:12:00 +00:00
2533db035a
docs(database): close restore hardening prerequisite
2026-08-02 10:10:45 +00:00
3fa6b1f158
refactor(database): scope untrusted restore to N/N-1
2026-08-02 05:29:48 +00:00
ce6edf68a0
fix(database): reject hidden migration source columns
2026-08-01 19:56:17 +00:00
c036c6359e
refactor(database): construct untrusted migrations from source specs
2026-08-01 19:45:36 +00:00
29cccd5bd3
fix(database): fail closed across restore migrations
...
Classify every historical migration boundary, thread the restore context through the full chain, reject repair or synthesis for untrusted inputs, and add SQL/binary public-entry certification for damaged and valid legacy fixtures.
2026-08-01 17:04:54 +00:00
28530ff641
fix(database): enforce canonical restore trust boundaries
2026-08-01 16:01:00 +00:00
89961dff28
fix(database): close canonical restore review gaps
2026-08-01 14:12:08 +00:00
9a87512224
refactor(database): certify canonical restore boundary
2026-08-01 12:55:39 +00:00
2841811700
refactor(database): complete prerequisite B
2026-08-01 11:44:50 +00:00
22c010079a
fix(provider): enforce durable identity boundaries
2026-08-01 09:09:14 +00:00
37e78166c1
refactor(provider): complete prerequisite A ownership
2026-08-01 08:37:49 +00:00
2bc92e0f79
refactor(provider): certify typed write ownership
...
Freeze prerequisite A as a component-level certification unit. Add the immutable v5 certification suite, split create/update row DTOs, preserve immutable creation time, map strict-create races to AppError::Conflict, make aggregate compensation insert-or-restore, and enforce reconcile preconditions through a single-lock transaction primitive.
Old save_provider callsite classification remains exhaustively recorded in 4f78451405575158ff6562c7021c7f31f2860780; this checkpoint does not add or reclassify an omitted legacy callsite. It tightens the remaining reconciliation classifications there: default live import is [create]; OpenCode/OpenClaw/Hermes existing branches are [update] and absent branches are [create]; universal Claude/Codex/Gemini branches are [create/update] selected from an observed fingerprint. The sealed compensation helper remains the only [restore] path. The old reconcile_provider_record symbol is deleted.
Remaining update_provider_settings_config callsites are classified as [update]: codex_history_migration updates an already-read Codex row; proxy token synchronization updates already-read Claude, Codex, Gemini, and GrokBuild rows. Each now uses ProviderKey plus ProviderRowUpdate, explicitly removes hydrated endpoint projections, preserves endpoint authority, and fails on a missing row instead of silently succeeding.
2026-08-01 07:48:57 +00:00
10f2dacbe4
config(pi): execute pinned native schema and composer oracles
...
Evaluate raw Pi documents with the vendored upstream TypeBox schema and replay composer/transport expectations captured by actually executing Pi ab366ebe94cacd419d986be454f12b1b9913aaca.
Bind all 252 canonical fields to successful raw and own-layer composer evidence (70 provider, 92 model, 90 override), fail closed where pinned runtime context is unavailable, expose structured inspection, and enforce module/write/restore boundaries with negative fixtures.
2026-07-31 18:07:21 +00:00
4f78451405
storage(pi): isolate typed provider writes and canonical restore
...
Replace the generic Provider save/upsert surface with strict typed
create/update/rename/endpoint operations. Keep aggregate hydration read-only,
preserve nullable endpoint timestamps end to end, and make service create own
the initial endpoint set atomically.
Restore SQL and binary backups only through UntrustedScratch, migrate and copy
fixed data columns into a fresh CanonicalStage, validate the canonical result,
then publish through the Backup API. The imported schema is never eligible to
become the live schema.
Old save_provider callsite classification
==========================================
Inventory authority: abandoned 5a385fc8 tree. The old definition at
src-tauri/src/database/dao/providers.rs:180 is deleted and is not a callsite.
Production callsites:
- src-tauri/src/commands/provider.rs:253 [create] Claude Desktop import creates
one absent aggregate; it now strict-inserts the row and initial endpoints in
one transaction.
- src-tauri/src/database/dao/providers.rs:638 [create] official seed first
proves absence, then strict-creates; a racing insert is a conflict.
- src-tauri/src/database/dao/providers.rs:704 [create] on-demand seed first
proves absence, then strict-creates; it cannot overwrite an existing row.
- src-tauri/src/services/omo.rs:291 [create] OMO import constructs a new
aggregate and strict-creates it; OMO is not eligible for rename.
- src-tauri/src/services/provider/endpoints.rs:85 [update] endpoint last-used
is not a Provider-row save; it now calls the exact touch endpoint operation.
- src-tauri/src/services/provider/live.rs:1567 [create/update] default live
import is reconciliation: read first, then strict create or strict update.
- src-tauri/src/services/provider/live.rs:1743 [update] an existing OpenCode
live provider follows the strict row-update branch.
- src-tauri/src/services/provider/live.rs:1770 [create] a new OpenCode live
provider follows the strict aggregate-create branch.
- src-tauri/src/services/provider/live.rs:1825 [update] an existing OpenClaw
live provider follows the strict row-update branch.
- src-tauri/src/services/provider/live.rs:1858 [create] a new OpenClaw live
provider follows the strict aggregate-create branch.
- src-tauri/src/services/provider/live.rs:1900 [update] an existing Hermes live
provider follows the strict row-update branch.
- src-tauri/src/services/provider/live.rs:1926 [create] a new Hermes live
provider follows the strict aggregate-create branch.
- src-tauri/src/services/provider/mod.rs:2568 [create] ProviderService::add owns
strict aggregate creation and all initial endpoints.
- src-tauri/src/services/provider/mod.rs:2680 [rename] an additive DB-only key
change now uses the dedicated transactional rename after eligibility checks.
- src-tauri/src/services/provider/mod.rs:2711 [update] OMO edit updates exactly
the existing main row after its live-file coordination.
- src-tauri/src/services/provider/mod.rs:2740 [update] additive-provider edit
updates exactly the existing main row after resolving live ownership.
- src-tauri/src/services/provider/mod.rs:2750 [update] switch-mode edit updates
exactly the existing main row and never inserts.
- src-tauri/src/services/provider/mod.rs:2948 [update] remove-from-live changes
only the existing provider's live-managed marker.
- src-tauri/src/services/provider/mod.rs:3120 [update] switch backfill updates
only the existing current provider row.
- src-tauri/src/services/provider/mod.rs:3174 [update] successful additive
switch changes only the existing live-managed marker.
- src-tauri/src/services/provider/mod.rs:3315 [update] common-config migration
updates only each already-read existing row.
- src-tauri/src/services/provider/mod.rs:3895 [update] Gemini credential scrub
updates only each already-read existing row.
- src-tauri/src/services/provider/mod.rs:4082 [update] sort ordering is routed
to the dedicated sort-index state operation, not row replacement.
- src-tauri/src/services/provider/mod.rs:4636 [create/update] universal-to-
Claude reconciliation reads the target and selects strict create or update.
- src-tauri/src/services/provider/mod.rs:4651 [create/update] universal-to-
Codex reconciliation reads the target and selects strict create or update.
- src-tauri/src/services/provider/mod.rs:4665 [create/update] universal-to-
Gemini reconciliation reads the target and selects strict create or update.
Required indirect ownership paths:
- src-tauri/src/deeplink/provider.rs [create] the old indirect flow called
ProviderService::add and then appended endpoints one by one. It now supplies
every non-primary endpoint to one strict aggregate create, so hydration is
complete atomically and a duplicate is zero-side-effect.
- [restore] no old generic-save callsite is reclassified as restore. Exact
aggregate replacement exists only as the sealed
restore_provider_aggregate_on_tx compensation primitive.
Test-only callsites:
Every item below is classified [test]. Each is fixture setup, not a production
write authority, and is migrated to a real ProviderService entry where the
behavior is under test or to the cfg(test)-only typed fixture reconciler where
the test merely needs pre-existing rows.
- src-tauri/src/codex_history_migration.rs:1442 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:1452 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2174 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2176 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2199 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2219 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2247 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2267 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2288 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2320 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2393 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2449 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2498 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2555 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2604 [test] migration fixture setup.
- src-tauri/src/codex_history_migration.rs:2625 [test] migration fixture setup.
- src-tauri/src/database/dao/providers.rs:754 [test] DAO fixture setup.
- src-tauri/src/proxy/provider_router.rs:351 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:352 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:377 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:378 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:410 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:411 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:447 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:448 [test] router fixture setup.
- src-tauri/src/proxy/provider_router.rs:488 [test] router fixture setup.
- src-tauri/src/services/provider/mod.rs:485 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:586 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:813 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:825 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1472 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1607 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1737 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1945 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1952 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:1978 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2006 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2056 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2130 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2167 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2207 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2235 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2270 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2320 [test] service fixture setup.
- src-tauri/src/services/provider/mod.rs:2362 [test] service fixture setup.
- src-tauri/src/services/proxy.rs:3762 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:3948 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4034 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4095 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4114 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4263 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4341 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4421 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4533 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4651 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:4787 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5264 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5320 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5385 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5387 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5460 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5462 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5611 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5613 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5615 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5698 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5700 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:5998 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6000 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6173 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6175 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6417 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6419 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6553 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6555 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6635 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6637 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:6919 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7173 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7175 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7240 [test] proxy fixture setup.
- src-tauri/src/services/proxy.rs:7242 [test] proxy fixture setup.
- src-tauri/tests/profile_roundtrip.rs:112 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:116 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:126 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:133 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:292 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:501 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:505 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:670 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:677 [test] profile fixture create.
- src-tauri/tests/profile_roundtrip.rs:762 [test] Linux Desktop fixture create.
- src-tauri/tests/profile_roundtrip.rs:769 [test] Linux Desktop fixture create.
- src-tauri/tests/provider_commands.rs:69 [test] command fixture create.
- src-tauri/tests/provider_service.rs:2927 [test] service fixture create.
2026-07-31 18:06:59 +00:00
3dc188313e
domain(pi): add managed model and capability contracts
2026-07-31 17:52:59 +00:00
119d795121
docs(pi): freeze support contracts and extension design
2026-07-31 17:52:24 +00:00
SaladDay