Skip to content

feat: surface pending iCloud provider indexing - #247

Open
seonghobae wants to merge 87 commits into
mainfrom
feat/provider-sync-dynamic-goals-followup
Open

feat: surface pending iCloud provider indexing#247
seonghobae wants to merge 87 commits into
mainfrom
feat/provider-sync-dynamic-goals-followup

Conversation

@seonghobae

@seonghobae seonghobae commented Aug 21, 2026

Copy link
Copy Markdown
Contributor

Summary

  • detect pending iCloud File Provider indexing and preserve fail-closed eviction readiness
  • retain bounded provider evidence, duplicate records, and attestation receipts
  • align cloud-plan copy-headroom preview authority with the destination/staging filesystem used by mutation-time copy
  • preserve current-main dependency/UI deltas while converging the follow-up stack non-destructively

Exact state

  • exact head: 43b696b2a14d54b9b6015d5ff3f40b3629ca80ec
  • live base: 7eb131c4b4ac628226b262d6406a663fc7dc632f
  • fresh main -> head comparison is ahead-only with behind_by = 0 and merge base exactly current main
  • PR remains Draft / mergeable; mergeability is not merge authorization
  • exact-head Test 32694816791, Security Scan 32694816807, and SAST Semgrep 32694816859 are queued; Release 32694816841 is in progress, so none of those pending paths is represented as passing evidence

Current product/test repair

plan_cloud_archive_from_snapshot() now computes preview headroom against each candidate's destination/staging filesystem through require_destination_copy_headroom(Path::new(&candidate.dst), candidate.bytes, now_ms), matching the mutation-time native-copy authority while retaining CloudPlanReport.local_volume as separate source-pressure diagnostics.

The first public-boundary regression for this repair used sentinel source timestamps and correctly tripped the planner's real source-snapshot-stale guard. That was a test-fixture defect, not a reason to weaken source-freshness validation. The current regression binds the fixture to the materialized source file's actual length/mtime and observed clock, then proves a symlinked destination ancestor cannot become capacity authority: the candidate remains dry-run-only and the plan reports local-volume-headroom-unverified while still returning source-volume diagnostics. The pinned Rust 1.97.1 focused run also passes the folded RFC 5322 mail-header planning regression retained below.

Stale-convergence preservation

The branch was non-destructively converged onto current main with a two-parent commit and force:false. Current-main dependency/UI blobs were preserved. Main's folded Received regression, which existed only as a private in-module cloud.rs test on the then-current base, is preserved on this stack through src-tauri/tests/folded_received_header_plan_regression.rs, which exercises the stronger public plan_cloud_archive boundary and verifies bounded header evidence without inspecting the message body.

Current review threads are resolved. Predecessor checks/reviews do not transfer to this changed head.

Merge policy

Keep Draft until one unchanged exact head satisfies every applicable Test/Release/Security/SAST and central gate, zero valid unresolved findings, fresh live-base ancestry, actual review governance, repository-wide exact non-vacuous 100% owned-production coverage without exclusions or threshold weakening, package/SBOM/provenance requirements, and effective enforceable main governance. The repository's current non-enforcing main protection is not merge permission. Pending, queued, skipped-required, failed, stale, predecessor, synthetic, status-only, model-only, no-source, or diagnostic-only evidence is non-passing.

@coderabbitai

coderabbitai Bot commented Aug 21, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

Next included review available in 7 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6d6696a0-1e0b-42a8-b0c3-7357125a552b

📥 Commits

Reviewing files that changed from the base of the PR and between 79067c1 and 629cd15.

📒 Files selected for processing (36)
  • .github/scripts/verify-release-artifacts.sh
  • .github/workflows/release.yml
  • CHANGELOG.md
  • docs/architecture/adr/0001-cloud-offload-goal-state.md
  • docs/architecture/adr/0006-redacted-icloud-health-evidence.md
  • docs/architecture/adr/0011-cloud-transfer-failure-and-materialization.md
  • docs/architecture/goals/cloud-offload-goal.json
  • docs/product-technical-gap-baseline.md
  • src-tauri/src/cloud.rs
  • src-tauri/src/cloud_plan_view.rs
  • src-tauri/src/cloud_transfer.rs
  • src-tauri/src/commands.rs
  • src-tauri/src/icloud_sync_health.rs
  • src-tauri/src/lib.rs
  • src-tauri/src/naruon_cloud_copy_readiness.rs
  • src-tauri/src/provider_evidence.rs
  • src-tauri/src/provider_global_sync.rs
  • src-tauri/src/provider_sync.rs
  • src-tauri/tests/cloud_copy_headroom_destination_contract.rs
  • src-tauri/tests/cloud_plan_destination_headroom_runtime.rs
  • src-tauri/tests/folded_received_header_plan_regression.rs
  • src-tauri/tests/naruon_active_fileprovider_transfer.rs
  • src-tauri/tests/naruon_locked_fileprovider_item.rs
  • src-tauri/tests/naruon_readiness_global_sync_identity.rs
  • src-tauri/tests/provider_global_sync_clear_state_integrity.rs
  • src-tauri/tests/provider_global_sync_disk_full_code_boundary.rs
  • src/lib/CloudArchive.svelte
  • src/lib/api.ts
  • src/lib/cloudArchiveAdmissionContract.test.ts
  • src/lib/cloudArchiveHealthTiming.test.ts
  • src/lib/cloudArchiveHealthTiming.ts
  • src/lib/cloudLineageExport.test.ts
  • src/lib/cloudLineageExport.ts
  • src/lib/cloudOffloadGoalProjectionContract.test.ts
  • src/lib/cloudReviewQueue.test.ts
  • src/lib/cloudReviewQueue.ts
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch feat/provider-sync-dynamic-goals-followup

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

devin-ai-integration[bot]

This comment was marked as resolved.

devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae
seonghobae marked this pull request as draft August 21, 2026 14:42
devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae
seonghobae changed the base branch from main to feat/provider-sync-dynamic-goals August 21, 2026 14:56
@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode review current head 587165a. Previous reviews are stale; publish exact-head approval only after current checks and focused numeric-marker regression evidence.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode review current head 973a82ac86320c0f09a1f5eefb732cd10c4060b0. This head fixes the Rust readiness-verifier include! compile boundary that caused the prior Test failure; the provider evidence and numeric disk-full changes are unchanged. Please publish exact-head review only after current hosted checks.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Requesting current-head review for 42655ae after merging the current provider-sync base. Please evaluate this exact head; prior reviews/checks are stale.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head base sync pushed at ae1a00d after updating feat/provider-sync-dynamic-goals to 3e72277099cb825aa238ee62133c38acaf96e869. Please review and rerun checks for this exact head.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head fix a0fa7bc: a timed-out lsof shell wrapper could leave descendants holding the pipe, consuming the independent ps probe budget and causing cloud_local_eviction_lsof_warning::slow_lsof_does_not_starve_the_process_command_probe to fail. The bounded lsof probe now creates/kills a process group; focused Rust test passed (3/3) with Rust 1.97.1. Please review this exact head.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Rebased by a normal merge of current parent 2b9833c63e01298453985af416d65e26ffbeddfc; no force-push. Current head is 67873b205973c38fc88ac2c1cfa446748d8b2f6c. The Finder/iCloud evidence and ADR amendment are retained, and the private-process-group lsof timeout fix remains covered by 3 focused tests. GitHub now reports mergeable; hosted checks/review are rerunning.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current head a7a37cccc92ac61b787f6a20045ccae15d5266fe adds the missing macOS File Provider stall signal. The bounded iCloud dump observed disk import: yes, active upload 5,202,024,494/5,462,125,152, and pending-indexable-count=30,960; these are aggregate provider markers and do not attest real_datasets.

DiskSage now retains only icloud-file-provider-disk-import-active, projects it into iCloud admission and Naruon readiness, shows it beside the existing Finder-cancel action, and keeps copy/attestation/eviction fail-closed. No Finder, bird, fileproviderd, CloudDocs database, source, or cloud object was changed.

Verification: cargo test --locked --manifest-path src-tauri/Cargo.toml icloud_sync_health::tests::file_provider_parser_records_disk_import_without_paths (pass); cargo test --locked --manifest-path src-tauri/Cargo.toml --test naruon_active_fileprovider_transfer active_fileprovider_transfer_exports_blocked_readiness (pass); npm run check (0 errors/0 warnings); npm test -- --run (31 files, 130 tests).}

@seonghobae

Copy link
Copy Markdown
Contributor Author

@coderabbitai review current exact head a7a37cccc92ac61b787f6a20045ccae15d5266fe. Review the iCloud/File Provider pending-indexing, disk-import, active-transfer admission, Finder-copy cancellation, and evidence/ADR behavior only for this exact head.

@coderabbitai

coderabbitai Bot commented Aug 21, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

requested_head='a7a37cccc92ac61b787f6a20045ccae15d5266fe'

echo '== Checked-out commit =='
git rev-parse HEAD
git status --short
git show -s --format='commit=%H%nparents=%P%nsubject=%s' HEAD

echo '== Requested commit availability =='
git cat-file -t "$requested_head"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$requested_head"

echo '== Files changed by requested commit =='
git diff-tree --no-commit-id --name-status -r "$requested_head"

echo '== Scoped diff =='
git show --format= --find-renames --find-copies "$requested_head" -- \
  'src-tauri/**' 'src/**' 'docs/**' '*ADR*' '*adr*' \
  | sed -n '1,2600p'

echo '== Candidate source and test files =='
fd -t f . | rg -i '(icloud|file.?provider|finder|nar[u]?on|evidence|archive|adr)'

echo '== Structural outlines for changed Rust/TypeScript files =='
git diff-tree --no-commit-id --name-only -r "$requested_head" \
  | rg '\.(rs|ts|tsx)$' \
  | while IFS= read -r f; do
      echo "--- $f"
      ast-grep outline "$f" --items all 2>/dev/null || true
    done

echo '== Focused symbol occurrences =='
rg -n -i -C 4 \
  '(disk import|pending-indexable|file.?provider|active.?transfer|finder.*cancel|cancel.*finder|evict|attest|receipt|evidence)' \
  src-tauri src docs 2>/dev/null || true

echo '== GitHub PR and check status =='
gh pr view 247 --repo ContextualWisdomLab/disksage \
  --json number,headRefOid,mergeStateStatus,statusCheckRollup \
  --jq '{number, headRefOid, mergeStateStatus, checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}]}'

Length of output: 6243


🏁 Script executed:

#!/bin/bash
set -uo pipefail

repo='ContextualWisdomLab/disksage'
pr='247'
head='a7a37cccc92ac61b787f6a20045ccae15d5266fe'

echo '== PR range and hosted checks =='
gh pr view "$pr" --repo "$repo" \
  --json baseRefOid,headRefOid,mergeStateStatus,statusCheckRollup \
  --jq '{baseRefOid, headRefOid, mergeStateStatus, checks: [.statusCheckRollup[] | {name, status, conclusion, detailsUrl}]}' \
  || echo 'ERROR: unable to query pull-request metadata.'

base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq .baseRefOid 2>/dev/null || true)"
printf 'base=%s\nhead=%s\n' "$base" "$head"

if [ -z "$base" ]; then
  echo 'ERROR: PR base SHA was unavailable.'
  exit 0
fi

echo '== PR-range changed files =='
git diff --name-status "$base" "$head" || true

echo '== Relevant PR-range diff =='
git diff --find-renames --find-copies "$base" "$head" -- \
  'src-tauri/src/icloud_sync_health.rs' \
  'src-tauri/src/provider_evidence.rs' \
  'src-tauri/src/naruon_cloud_copy_readiness.rs' \
  'src-tauri/src/private_evidence.rs' \
  'src-tauri/tests/naruon_active_fileprovider_transfer.rs' \
  'src-tauri/tests/provider_evidence_retention.rs' \
  'src/lib/CloudArchive.svelte' \
  'src/lib/IcloudLocalEviction.svelte' \
  'src/lib/cloudArchiveAdmissionContract.test.ts' \
  'src/lib/icloudLocalEvictionSafetyUiContract.test.ts' \
  'docs/architecture/adr/0006-redacted-icloud-health-evidence.md' \
  'docs/development/icloud-local-eviction-batch.md' \
  | sed -n '1,3600p' || true

echo '== Relevant implementation/test excerpts =='
for f in \
  src-tauri/src/icloud_sync_health.rs \
  src-tauri/src/provider_evidence.rs \
  src-tauri/src/naruon_cloud_copy_readiness.rs \
  src-tauri/tests/naruon_active_fileprovider_transfer.rs \
  src-tauri/tests/provider_evidence_retention.rs \
  src/lib/CloudArchive.svelte \
  src/lib/IcloudLocalEviction.svelte \
  src/lib/cloudArchiveAdmissionContract.test.ts \
  src/lib/icloudLocalEvictionSafetyUiContract.test.ts \
  docs/architecture/adr/0006-redacted-icloud-health-evidence.md
do
  if [ -f "$f" ]; then
    echo "--- $f"
    rg -n -i -C 12 \
      '(disk import|pending-indexable|file.?provider|active.?transfer|finder.*cancel|cancel.*finder|evict|attest|receipt|retain|bounded)' \
      "$f" || true
  fi
done

echo '== Full PR patch stat =='
git diff --stat "$base" "$head" || true

Length of output: 232196


🏁 Script executed:

#!/bin/bash
set -uo pipefail

base='2b9833c63e01298453985af416d65e26ffbeddfc'
head='a7a37cccc92ac61b787f6a20045ccae15d5266fe'

echo '== Persistence and blocked-duration call sites =='
rg -n -C 10 \
  '(write_icloud_sync_health_evidence|admission_blocked_since_ms|admission_blocked_since_ms|inspect_icloud_new_copy_admission|require_new_copy_admission)' \
  src-tauri/src || true

echo '== iCloud planning and copy command boundaries =='
for f in src-tauri/src/cloud.rs src-tauri/src/commands.rs; do
  echo "--- $f"
  git diff --find-renames "$base" "$head" -- "$f" || true
  rg -n -C 12 \
    '(icloud|new_copy_admission|require_new_copy_admission|copy|attest|evict|provider_sync_attested|local_eviction_authorized|admission_blocked)' \
    "$f" || true
done

echo '== API model and UI marker fingerprint =='
git diff "$base" "$head" -- src/lib/api.ts src/lib/CloudArchive.svelte || true
rg -n -C 8 \
  '(IcloudSyncHealthReport|IcloudFileProviderActivityEvidence|pending_indexable_count|disk-import|new_copy_admission_blockers|fingerprint)' \
  src/lib/api.ts src/lib/CloudArchive.svelte || true

echo '== ADR and product documentation changes =='
for f in \
  docs/architecture/adr/0001-cloud-offload-goal-state.md \
  docs/product-technical-gap-baseline.md \
  CHANGELOG.md
do
  echo "--- $f"
  git diff "$base" "$head" -- "$f" || true
done

echo '== Focused regression test changes =='
git diff "$base" "$head" -- \
  src-tauri/tests/provider_global_sync_disk_full_code_boundary.rs \
  src-tauri/tests/naruon_active_fileprovider_transfer.rs \
  src/lib/cloudArchiveAdmissionContract.test.ts || true

echo '== Diff whitespace validation =='
git diff --check "$base" "$head" || true

Length of output: 147191


🏁 Script executed:

#!/bin/bash
set -uo pipefail

echo '== Backend assignment and command return path =='
rg -n -C 16 \
  'admission_blocked_since_ms|write_icloud_sync_health_evidence|inspect_icloud_new_copy_admission' \
  src-tauri/src/commands.rs src-tauri/src/icloud_sync_health.rs || true

echo '== Frontend report contract and duration references =='
rg -n -C 10 \
  'admission_blocked_since_ms|icloudHealthBlockedSinceMs|IcloudSyncHealthReport' \
  src/lib src-tauri/tests || true

echo '== Exact frontend report interface =='
sed -n '820,865p' src/lib/api.ts

echo '== Exact health-refresh duration logic =='
sed -n '479,532p' src/lib/CloudArchive.svelte

Length of output: 46326


@seonghobae I reviewed exact head a7a37cccc92ac61b787f6a20045ccae15d5266fe.

The hosted checks are complete and successful. The PR is mergeable. The focused numeric-marker regression also covers exact errno 28, odresult_errno 28, and OSStatus -34 markers, and rejects extended numeric values.

I found one issue.

Restart-safe iCloud stall duration is not exposed to the UI.

src-tauri/src/commands.rs sets report.admission_blocked_since_ms after it persists and validates the bounded evidence. However, src/lib/api.ts omits this field from IcloudSyncHealthReport at Line 827. src/lib/CloudArchive.svelte then sets icloudHealthBlockedSinceMs to the current browser time at Line 516 when it receives the first blocked refresh.

If the UI restarts while the same pending-indexing or disk-import blocker remains active, the displayed duration resets to zero. The 15-minute Finder cancellation warning is delayed again. This conflicts with the new restart-safe duration behavior described in ADR-0001 and the changelog.

Expose admission_blocked_since_ms in the TypeScript contract. Use the persisted value when it is present and valid. Keep the in-memory timestamp only as a fallback when persistence fails or the backend omits the diagnostic field.

You are interacting with an AI system.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Pushed exact-head documentation update 5a6b4ed8743be1adf11e4388c4db94829c2f3794 after re-fetching a7a37cccc92ac61b787f6a20045ccae15d5266fe. ADR-0001 and docs/product-technical-gap-baseline.md now record the 04:05 KST read-only observation (pending-indexable-count=31,024, upload 95.24% unchanged, download 0/828, disk import: yes, stale pending-scan entries). No Finder/provider/source/cloud mutation occurred. Review and checks must use only exact head 5a6b4ed....

@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode review only the current exact head 5a6b4ed8743be1adf11e4388c4db94829c2f3794. Re-check the iCloud/File Provider pending-indexing, disk-import, active-transfer, Finder-copy warning, fail-closed eviction, and ADR/baseline evidence changes; predecessor reviews/checks are stale.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head docs refresh pushed as dac324d: the baseline now records the current protected PR inventory and explicitly invalidates predecessor checks/approvals after a push. No provider, Finder, cloud, or user-file mutation occurred. Please review only exact head dac324d.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode review only current exact head dac324d. Re-check the iCloud/File Provider pending-indexing, disk-import, active-transfer, Finder-copy warning, fail-closed eviction, ADR/baseline evidence, and current PR inventory; predecessor reviews/checks are stale.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head ADR amendment pushed as c44420d: ADR-0001 now binds the current protected PR inventory to the evidence rule and records that no provider/Finder/cloud/user-file mutation occurred. Review only this head; predecessor checks and approvals are stale.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode review only current exact head c44420d. Re-check the iCloud/File Provider pending-indexing, disk-import, active-transfer, Finder-copy warning, fail-closed eviction, ADR/baseline evidence, and current PR inventory. Do not reuse predecessor results.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head follow-up pushed at be1bbb1c5a22d9ce0c0f8cf1b49d3b07b4a80f8d. The regression test proves the requested File Provider state: isDownloaded=1, isMostRecentVersionDownloaded=1, isUploading=0, but isUploaded=0 remains local-current, maps to pending-upload, emits provider-sync-incomplete, and cannot authorize eviction. Focused Rust 1.97.1 test passed: provider_sync::tests::local_current_but_not_uploaded_is_pending_upload_evidence. No provider or user-file mutation.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode please review exact HEAD be1bbb1c5a22d9ce0c0f8cf1b49d3b07b4a80f8d.

@seonghobae

Copy link
Copy Markdown
Contributor Author

@OpenCode please review exact HEAD be1bbb1eb0371fab05c1b303e92d92dc6a381982.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head fix 304609b13f1af7fade6f978bb44c640d640ef77e: the Rust health command already returned the durable admission_blocked_since_ms from the integrity-checked iCloud evidence journal, but the frontend discarded it and restarted the visible stall clock after an app/system restart. The TypeScript report contract now carries the field and CloudArchive.svelte uses it with a current-observation fallback only when persistence is unavailable. Updated ADR-0006, CHANGELOG, and the product gap baseline. Verification: npm test (31 files, 130 tests), npm run check (0 errors/0 warnings), focused contract (3/3), and Rust admission_blocked_since_uses_only_contiguous_matching_evidence (1/1) passed locally. Hosted checks have restarted for this exact head; no predecessor result is being reused.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head verification update for 304609b13f1af7fade6f978bb44c640d640ef77e: Test, all three Release builds, LLM engine build, Windows home resolution, and CodeRabbit completed successfully; GPU/release publication jobs were correctly skipped. mergeStateStatus=CLEAN, but the PR still has no qualifying approvals and remains draft, so no merge was attempted. The persisted admission_blocked_since_ms wiring is now covered by the focused frontend contract test and the pinned Rust regression already reported above.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head update: the current head is fead25ea0e8953d050e7e101c43b0ac82a47298b. The repeated live observation and product baseline now record four no-progress File Provider fetches, 31,882 pending indexable items, unchanged aggregate transfer counters, needs-sync-up/down, Finder alive for roughly 18 hours, and only ~4.9 GiB free; the evidence remains aggregate and does not attest the seven real_datasets items.

The backend-clock fallback is now actually wired through cloudArchiveHealthTiming (the helper is no longer dead code), with the strict source contract updated. Local vitest (5 focused tests), npm run check, git diff --check, and CodeGraph sync pass. Hosted checks restarted on this exact head; no predecessor result is being reused.

seonghobae added a commit that referenced this pull request Aug 22, 2026
MAX_FILEPROVIDER_DUMP_BYTES was 1 MiB while the sibling
provider_global_sync probe allows 32 MiB, and reviewer evidence noted
real fileproviderctl dumps run ~5 MiB in the field. The probe was
therefore routinely truncating before the per-item exclusion/
materialization markers that follow the aggregate summary, which the
existing code comment already flagged as an ordering assumption.
Truncation stays fail-closed either way, but raising the cap removes
the routine-truncation risk outright rather than relying on that
assumption. No test hardcoded the prior byte value.

Addresses a reviewer finding on PR #247.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@opencode-agent opencode-agent Bot added the priority: medium Normal-priority or P2 work label Aug 22, 2026
devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Current-head RCA (exact 58e1dc52a93cd959daaea549a7f362eddc1601f5): required strix is the only terminal failure; Test/Release/Security/SAST and local product checks are successful. The run failed closed on provider infrastructure, not a source finding: NVIDIA NIM returned repeated rate-limit/upstream failures, the 49b fallback emitted a provider-failure signal despite a zero-vulnerability banner, and direct openai-direct/gpt-5.4 ended with HTTP 404. No vulnerability report artifact was authoritative, so no application-line patch is justified. This is external provider capacity/endpoint evidence; keep the security gate fail-closed and rerun on the unchanged exact head or after a provider-side recovery. No merge readiness or approval is inferred.

@seonghobae
seonghobae marked this pull request as draft August 25, 2026 04:17
@seonghobae

Copy link
Copy Markdown
Contributor Author

Fixed at exact HEAD b3e00c6a9bf13152562ccc50f2ed742b03f0bffa. normalize_native_copy_headroom_notices now verifies at least one unblocked candidate before clearing any destination-headroom blocker. When no candidate has verified staging headroom, the original candidate blocker and plan-wide fail-closed notice remain, so the backend cannot emit a copy-only approval phrase for an unverified destination. Added unit and runtime regressions; focused Rust tests pass.

@seonghobae
seonghobae marked this pull request as ready for review August 25, 2026 07:05
@seonghobae
seonghobae marked this pull request as draft August 25, 2026 07:16
devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Reviewed the two new informational notes at exact HEAD b3e00c6a9bf13152562ccc50f2ed742b03f0bffa. The legacy fingerprint helper is deliberately bounded to the compact serde wire contract and is covered by upgrade-compatibility tests; changing field order is a schema change that must update that contract rather than silently authorize anything. Provider Goal/ADR projections are explicitly non-authoritative dynamic views: a current provider-wide blocker intentionally marks the affected provider projections blocked, while receipt/provider evidence and mutation gates remain the authority. No additional source change is required for either informational note.

@seonghobae
seonghobae marked this pull request as ready for review August 25, 2026 07:24
devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Validated on current head 0de3f6a3672c6ff0f39726b7a4ddaeba757154b: added an end-to-end projection contract test that writes a valid immutable receipt under the runtime cloud-receipts directory and calls update_provider_goal_projections, asserting a blocked Goal is written. Also centralized the disk-import blocker literal through FILE_PROVIDER_DISK_IMPORT_NOTICE and restored the retention clock-regression guarantee in the comment. Focused Rust tests for iCloud, Google Drive, and receipt-directory projection all pass.

devin-ai-integration[bot]

This comment was marked as resolved.

@seonghobae

Copy link
Copy Markdown
Contributor Author

The latest Strix job failed at the provider boundary (NVIDIA NIM rate-limit/incomplete scan), not in the changed Rust source; the required gate remains fail-closed. Source, test, security, coverage-source-tree, and release checks are otherwise green. GitHub exposes no rerun endpoint for this job (404), so this remains an external provider blocker.

@seonghobae

Copy link
Copy Markdown
Contributor Author

Resolved the three informational Devin threads after checking the exact head: candidate headroom notices intentionally remain conservative while the mutation-time require_local_copy_headroom probe is authoritative; the 128-record retention is the documented bounded design; and the frontend candidate-specific notice is defensive while backend plan notices cover current emitted reasons. No fail-open path was identified, so no source change was needed.

@seonghobae
seonghobae marked this pull request as draft August 25, 2026 11:32
@seonghobae

Copy link
Copy Markdown
Contributor Author

Exact-head check evidence for 0de3f6a3672c6ff0f39726b7a4ddaeba757154b6: source-focused regressions remain locally valid, while hosted Strix Security Scan/strix run 32824454455 failed closed on provider infrastructure, not a repository finding. The log records NVIDIA NIM HTTP 429 on the primary and first fallback, followed by the contracted openai-direct/gpt-5.4 fallback returning 404 page not found; no structured vulnerability report was produced. This is the same central provider-outage class addressed by .github PR #1333, so no unsafe local bypass or synthetic approval is introduced. Merge remains gated on a clean exact-head scan and independent approval.

# Conflicts:
#	CHANGELOG.md
#	docs/architecture/adr/0001-cloud-offload-goal-state.md
#	src-tauri/src/naruon_cloud_copy_readiness.rs
#	src/lib/CloudArchive.svelte
#	src/lib/cloudArchiveAdmissionContract.test.ts
@seonghobae
seonghobae marked this pull request as ready for review August 26, 2026 10:41
@seonghobae
seonghobae enabled auto-merge (squash) August 26, 2026 10:41
devin-ai-integration[bot]

This comment was marked as resolved.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 new potential issue.

Open in Devin Review

Comment on lines +177 to +185
has_local_disk_full |=
contains_bounded_numeric_marker(&marker_lower, "odresult_errno ", "28")
|| contains_bounded_numeric_marker(&marker_lower, "errno ", "28")
|| marker_lower.contains("enospc")
|| contains_bounded_numeric_marker(&marker_lower, "code=", "28")
|| contains_bounded_numeric_marker(&marker_lower, "code ", "28")
|| contains_bounded_numeric_marker(&marker_lower, "osstatus -", "34")
|| marker_lower.contains("no space left on device")
|| marker_lower.contains("disk full");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: Disk-full OSStatus marker change is behavior-preserving

Changing contains_bounded_numeric_marker(..., "osstatus ", "-34") to ("osstatus -", "34") is equivalent: the numeric-boundary check inspects the byte after the digits in both forms, so OSStatus -34 matches and OSStatus -340 does not either way. The added regression cases confirm this.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@opencode-agent
opencode-agent Bot disabled auto-merge August 26, 2026 14:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

priority: medium Normal-priority or P2 work status: draft Draft pull request type: feature New or expanded product capability

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant