Identify a voucher by the marker Bridge wrote into its narration - #308
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c50c4dc343
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 474bfef40e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
474bfef to
676c984
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 676c984665
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
676c984 to
1a02b9b
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1a02b9ba60
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 462aa94a5a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
462aa94 to
d4b9f7c
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d4b9f7ca7b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
d4b9f7c to
4e2a4e1
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8c67d49b0d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1136254641
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aeefb356cf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e76d177585
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 66d5f40114
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
#308's open thread held that the nonempty-window short-circuit made `PresenceBasis::NarrationMarker` unreachable: the adapter refused before any verdict was built, so the basis was contract-complete and operationally dead. #397 was expected to fix that by letting a `Partial` window answer. Nothing proved it. The adapter's ADR 0018 tests cover reader/writer agreement, legacy labels, ambiguous markers, bounds and refusals, but no end-to-end marker verdict, and `window_xml` carries no `NARRATION` at all -- so the existing nonempty-window test's two `present` verdicts are both by voucher number. The reachability also depended on a step below where the reasoning stopped: the adapter must declare `narration_evidence: ColumnEvidence::Observed`, or the marker path stays dead with the short-circuit gone. It does. This drives it. The same nonempty (therefore `Partial`) window carries a marker in JV-1's narration, under `automatic` numbering so that Tally's discarding of a supplied number leaves the marker as the only basis that can produce `present`. It comes back `present` with `basis: narration_marker`. Proven by mutation rather than by passing: - Neutralise the marker in the narration and the verdict drops to `possibly_present`, so the marker is what decides. - Reinstate the pre-#397 short-circuit and the identical request returns `isError: true` with `presence_window_incomplete` and no verdicts at all, so the short-circuit is exactly what made the basis unreachable. Both restored byte-identical afterwards. `agent_presence_tests.rs` is pinned, so the surface is resealed: one hash changed, pin set still 217, no path missing from either parent. Verified under the pinned 1.96.0 toolchain: fmt clean; src-tauri workspace 1538 passed, 0 failed, 1 ignored (the manual live replay); doctests 2 passed; tools workspace 55 passed; clippy `-D warnings` clean on both workspaces with no warning or error lines; `reseal.sh --verify` exit 0, read directly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The test asserts that a reported difference echoes the source's spelling rather than the master it bound to. Repairing it after "Rectify unqualified folded ledger binding" removed the folded basis, I used the catalogue's exact name -- which makes the two sides the same string and so is the one fixture under which the assertion cannot decide between those behaviours. It also made the test byte-equivalent to a_party_difference_compares_the_observed_party_field_not_every_ledger. This takes the #308 lane's version instead: bind on an identifier embedded in the master name, the remaining basis that decides without byte equality, so the source spells it its own way and still binds. Driven to failure two ways, restored byte-identical after each: - master name without the identifier -> fails at expect("party difference") - `proposed: Some(label(catalog_name))` in book_presence.rs, i.e. echoing the binding -> left "Alpha Traders 9876543210", right "ALPHA 9876543210" The second is the behaviour the name denies, and the previous fixture passed it unchanged. Also reseals the compatibility surface. The branch head failed `scripts/reseal.sh --verify` before this change -- confirmed against a clean 78e2237 with the exit status read directly rather than through a pipe, and not caused by this edit, which touches only the unpinned tests file. Pins 216 before and after, compared as sets rather than by count: none added or dropped. Gate: 1497 passed, 0 failed, 1 ignored; clippy silent on both workspaces; reseal --verify exits 0. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
`ci.yml` filtered `pull_request` to `branches: [master]`, so a pull request stacked on another branch triggered no run at all. The consequence was not a missing badge: such a PR reports `mergeStateStatus: CLEAN`, because the only check that does run is GitGuardian, and "clean" means "no required check failed" rather than "the suite ran". A stack accumulated unchecked changes until its root merged, at which point the first real run met several pull requests' worth of change at once. This was reached, not hypothesised. #397 merged into `claude/voucher-presence` with one check on it; #308 sat on that branch through a base sync, a conflict resolution and a test rewrite, showing CLEAN throughout. A manual `workflow_dispatch` on #308's branch was the first Bridge CI run it ever had, and it passed on macOS and Windows -- so the gap was coverage, not a latent failure. It could as easily have been the other way. The `push` trigger stays master-only: a branch worth checking has a pull request, and that is what triggers the run, so filtering the push side avoids a second run per branch rather than losing coverage. `ci.yml` is in the compatibility surface, so the surface and matrix are resealed: one hash changed, pin set unchanged at 212, `reseal.sh --verify` exit 0 read directly. Verified: `check-ci-workflow-consistency.mjs` passes; the compatibility gate passes; tools workspace 11 binaries, 53 passed, 0 failed. The workflow parses and keeps its 9 jobs, with `pull_request` now carrying only `types`. Not changed, and worth a separate decision: `dependency-security.yml` carries the same `branches: [master]` filter, and `docs/proposed-merge-gate-ci.md` proposes a merge-gate workflow with it too. Both inherit this gap. Co-authored-by: t <dev@example.invalid> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
fdd1f61 to
ef5ae0e
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
ef5ae0e to
856d053
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
Rebases the narration-marker work onto current master. The branch had diverged badly: #294 squash-merged onto master, so git chose a merge base from before the presence engine existed on either side and reported the whole of book_presence.rs, book_presence_tests.rs, agent_presence.rs and agent_presence_tests.rs as add/add conflicts. Master's copies of the first two are byte-identical to the branch at 64b8666, so the real resolution was six files, not ten. Two of master's fixes had to be carried into code the branch restructured: - present_text() from #400 replaces row["party"].as_str() and row["voucher_number"].as_str() at all four sites inside book_window's marker match arms. A voucher with no party carries "" rather than a missing key, and the raw read made a blank name look like a real one -- which is what made a whole 864-master book report as incomplete. - The agent_catalog.rs doc comment on the admission-contract test keeps master's corrected text from #409. The branch still carried the claim that the file is not in the compatibility surface; it is pinned. MAX_SURFACE_FILES goes to 218. Master raised it to 217 for dependency-security-scheduled.yml and this branch raised it to 217 for agent_import_identity.rs -- the same number for different files, so the merged pin set is their union. Both reasons are recorded; the seals are regenerated with scripts/reseal.sh --pins-changed, never by hand. The cap's own history comment is corrected while it is being edited. It said 212 to 215 and then 216 to 217, leaving a step nothing accounted for; #294 in fact raised the constant 212 to 216 in one commit, pinning four files at once. The enumeration now says so, rather than being reconcilable only against a later paragraph. docs/module-decomposition.md and docs/proposed-rust-module-conventions.md quote the cap and the pin count, and were correct at 217; they are updated here because this change is what makes them stale. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
856d053 to
644e07b
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
HELD for operational qualification. Source-side completeness evidence for nonempty voucher windows remains unavailable. Current local tests do not establish live presence verdicts or authorize importing vouchers. Addresses the presence review debt tracked by #317.
Functional summary
The presence contract compares proposals with an observed book window using bounded identity and diagnostic evidence. The production adapter refuses unqualified nonempty windows with
presence_window_incomplete; even agreeing bounded reads do not establish source cardinality. Only the existing qualified empty-window control can construct Complete.A supplied, observed REMOTEID conflicts with a numbered voucher whose REMOTEID is missing or different. Unread identity evidence withholds a decision before conflict classification; duplicate proposal numbers and unobserved voucher types retain their existing rules. A remote- or marker-identified row cannot settle against a contradictory absent manual number. Both identity candidates remain visible when REMOTEID and marker select different vouchers; automatic numbering and omitted manual numbers retain their separate rules. No candidate is chosen automatically.
Admission caps the proposal/window product at 1,000,000 and indexed resemblance work at 5,000,000 units. The weighted bound includes posting-list walks, pooled candidates and party-key fanout, including work for identity-settled proposals. Exact observed ledger and party spellings must exist in the catalogue; raw spellings and folded comparison keys remain separate and bounded. Numbering declarations retain count and aggregate-byte limits, and internal voucher-number whitespace remains significant. Raw proposal admission caps 5,000 proposals, 100,000 entries, 4 MiB of entry bytes and a separate 4 MiB of metadata, including derived narration markers, before conversion. PresenceRequest requires an opaque ProposedBatch with unique source positions; separate batches cannot be concatenated into an unchecked vector. Raw observation admission similarly caps 20,000 rows, 100,000 entries, 4 MiB of entry bytes and a separate 4 MiB of identifying metadata, including identifying and ambiguous markers, before descriptor allocation or core parsing/cloning/folding. The public batch constructor retains named REMOTEID and narration evidence columns; preconverted constructors are crate-private. ADR0017 preserves voucher-number Unicode form with outer trimming and states missing/unequal observed REMOTEID conflict explicitly.
This PR adds persisted Bridge narration-marker identity to #294. Collision evidence retains all evaluated identity bases, including unidentified marker observations. Both manual-number collision branches expose ambiguous-marker candidates as well as counting them as touched. Unread REMOTEID or narration remains the reason for nondecisive candidates; an exact voucher-type mismatch is included among identity-match differences. Marker survival is limited to the measured licensed 7.1 Silver Journal slice. Missing or unqualified evidence cannot authorize absence or replay. The complete #294 history through
17bfe9786bf48794b0f2a0a197042e8be29f5e0eand current master are integrated through a normal merge. An ambiguous occurrence of a proposal marker on a different book voucher now blocks settlement by another identity and retains both candidates. Raw ambiguous occurrences are capped at 64 per voucher and 100,000 per window before conversion or cloning; retained marker indexes additionally admit at most 100,000 memberships and 4 MiB of marker-key bytes before indexing. Limits fail with distinct typed errors rather than truncating evidence.Test or reproduction command
Candidate
f4955600c7190418c05ceabf1715425ed3947334, based onclaude/voucher-presence. Master06528eeb615b827896b9649ea476034143bbf7f9is in its ancestry.cargo test --locked --manifest-path src-tauri/Cargo.toml -p bridge-tally-core --lib: 290 passed on the final runtime/test bytes. The integrated controls include all nondecisive unread-REMOTEID classes, unread narration with retained candidates, exact voucher-type differences and the three-row manual-number/ambiguous-marker collision.-D warningspassed; direct core rustfmt andgit diff --checkpassed.cargo test --locked --manifest-path src-tauri/Cargo.toml -p bridge --lib agent::presence::tests: 28 passed, 1 existing authorized-live test ignored. No live replay was run.agent_catalog.rsproposal schema is a required compatibility pin. The bound is exactly 217 for the base 216-pin surface plus shared marker derivation; all paths are unique and match actual bytes. Rehash/seal/repoint/gate passed with manifestb03407b845a250ac0bf58dd97431e909e6e0c56c01d412e5ccfcbc572c2a959e.Migration compatibility
No destructive database migration or persisted-schema change. Difference reports can now include the
voucher_typefield value with exact proposed/observed spelling; consumers should handle this additional difference kind. Direct core callers useProposedVoucher::from_inputsto obtain an opaqueProposedBatch, andBookWindow::from_observations(ObservedWindow { ... })with raw observations and named REMOTEID/narration evidence; the internal preconverted constructors cannot bypass admission. Incomplete reads remain typed refusals. The operational live-evidence gate remains open; clean status against a feature branch does not establish master acceptance.Rollback notes
Revert the PR to remove this presence contract and endpoint extension. Preserve unknown-outcome lookup and never automatically replay financial writes. Windows interactive/package qualification and source-complete nonempty presence behavior remain unproven.
Security impact
This is a read-only comparison path. Company admission, exact catalogue coverage, bounded declarations and refusal on incomplete evidence remain enforced. No credential changes, live Tally write, import, or client financial mutation occurred in this rectification.
Windows validation evidence: native filesystem/package and interactive qualification are still missing.
macOS validation evidence: the local Rust 1.96 core and adapter suites above passed; source-complete nonempty live qualification is still missing.