Seal the admission and egress files by name by lamemustafa · Pull Request #434 · lamemustafa/bridge

lamemustafa · 2026-09-16T08:23:29Z

Implements the first #416 decision: seal the admission and egress files by name. The report-only coverage check (the second decision) was split out after review and follows in its own PR.

Pin 14 files; raise `MAX_SURFACE_FILES` 218 → 232

Found by looking for unpinned production modules declared by pinned ones, keeping only those whose own body holds a rule about what Bridge posts or prepares for posting, or what may leave the machine. Each is named beside the constant with what it holds.

what Bridge posts or prepares for posting	what leaves the machine
`tally/approved_import.rs` · `agent_import_post.rs` · `agent_import_ledger.rs` · `agent_company.rs` · `agent_import_cash_bank.rs` · `bridge-tally-protocol/src/group_ancestry.rs` · `agent_import_persistence.rs` · `tally/runtime_control.rs` · `endpoint_coordination.rs`	`documents.rs` · `axal.rs` · `agent_protocol.rs` · `agent_egress.rs` · `agent_delivery.rs`

agent_import_identity.rs was on the #416 list; #308 pinned it while this was in progress.

Corrected after review. The first version of the reasons overstated 11 of 13 and made one false causal claim (that widening retryable() re-sends a single-attempt request — SINGLE_ATTEMPT lives in runtime_control.rs with maximum_attempts: 1, and the loop stops at the limit regardless). Each reason now says what the file holds, not a guarantee it shares with pinned files. A second review narrowed five more and found agent_import_ledger.rs — which derives whether a batch was dispatched and refuses a second dispatch intent — met the stated criterion but was missing; it is now pinned. Commits 294bf4bc and 315782aa list every correction and what it was checked against.

Guard against losing them

src-tauri/tests/admission_and_egress_files_stay_pinned.rs follows the guard book_presence_tests.rs keeps. Measured with axal.rs dropped from the surface and resealed:

reseal --verify                exit=0    gate blind
compat tool cap assertion      exit=0    blind (it would pass with all 14 dropped)
this guard                     exit=101  "dropped from the compatibility surface: [src-tauri/src/axal.rs]"

Verified locally

reseal.sh --verify exit 0 · bridge-tally-compatibility tests exit 0 · guard 2/2. No open PRs touch the 14 files.

Follow-ups

The coverage report, rebuilt around rustc's module rules, in its own PR.
angry-curie will pin six read-path files (232 → 238) after this merges, each with its own reason, and rewrite the "Not pinned, and deliberately" paragraph accordingly.

🤖 Generated with Claude Code

bridge#416. Thirteen files decide, in their own bodies, what Bridge admits into a customer's book or lets leave the machine, and each was the unpinned half of a pair whose other half was pinned: `agent_import.rs` pinned while `agent_import_post.rs`, which holds the only POST and its double-post guard, was not; `agent_catalog.rs` pinned for argument admission while `agent_company.rs` did company-identity admission unsealed; every other caller of `group_ancestry.rs` pinned while the walk itself was not. Raises MAX_SURFACE_FILES from 218 to 231. The constant's rule is one file for one named reason, not headroom, so each of the thirteen is named beside it with its own reason. Every reason was checked at its cited function before being written, and two were narrowed when the check did not support the first wording. Deliberately not pinned, and recorded beside the constant: feature-gated files absent from every shipped build, operator filing labels, dead or declaration-only modules, and the read-path files that compute reported figures or decide when a change cursor may advance. Adds src-tauri/tests/admission_and_egress_files_stay_pinned.rs, following the guard book_presence_tests.rs keeps for its own contract. The gate cannot see a pin disappear: rehash-surface never adds paths, so a merge that takes the base side of the surface drops these entries while keeping the raised cap. Measured, not asserted: with axal.rs removed from the surface and resealed, `reseal.sh --verify` exits 0 and the compatibility tool's cap assertion passes, while this guard fails naming the dropped path. It lives in an unpinned file so the same merge cannot resolve it away. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

chatgpt-codex-connector · 2026-09-16T08:23:34Z

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Review found 11 of the 13 reasons beside MAX_SURFACE_FILES overstated what the code does, and one causal claim false. Each was checked against the code before rewriting: - runtime_control.rs: "widening retryable re-sends a request runtime.rs marked single-attempt" was false. SINGLE_ATTEMPT is defined in this file with maximum_attempts: 1, and the loop stops at the attempt limit regardless of class. The file still holds the attempt limits. - agent_import_post.rs was "the only POST path"; every Tally read is an HTTP POST, and the double-post refusal is split with agent_import.rs. It admits only a single saved Journal batch. - agent_company.rs matches on GUID; "exactly one loaded company matches the requested identity" claimed the full tuple. - agent_protocol.rs does not guarantee a receipt precedes every response: a failed receipt can still send a recovery or build-failure response. - axal.rs: the no-redirect client is its own; documents.rs builds another. - approved_import.rs: Windows consent is Yes, not a post button. - agent_import_persistence.rs refuses nothing itself; its check runs whenever the import admission lock is taken. - endpoint_coordination.rs: an advisory lease, per user and per port, taken by the shipped post path. - agent_egress.rs, documents.rs, agent_import_cash_bank.rs: narrowed to what each holds. The framing also claimed each was "the unpinned half of a pair"; that is not true of agent_delivery.rs, whose caller was unpinned. It now says how the files were found. The guard's doc comment said taking one side is the correct way to resolve a generated artifact, contradicting release-process.md, which requires the pin list to be merged. Corrected, and it now notes the cap assertion would pass with all thirteen pins dropped. The report-only coverage script is removed from this PR and moves to its own: review showed it misses a child declared in any #[path]-loaded file, which rustc resolves beside the file rather than under its stem. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Second review of the reasons found one file the stated criterion covers but the list left out, and five wordings still broader than the code. agent_import_ledger.rs derives whether a batch was dispatched from its dispatch-intent records (line 127) and refuses a second dispatch intent for one batch (import_ledger_duplicate_dispatch). That is part of the refusal to post one batch twice, in a production module declared by the pinned agent_import.rs, so the criterion already covered it. Pinned, and the cap raised to 232. Narrowed: - agent_import_post.rs held "its half" of the double-post refusal; it is one part of three, with the ledger replay and agent_import.rs. - agent_company.rs is called by the company-scoped read tools, not all of them: list_companies, read_evidence, egress_log and status do not. - endpoint_coordination.rs: the lease directory is per OS user, so it holds between one user's processes, not any two. - agent_egress.rs: a failed rollback is reported as egress_record_rollback_failed rather than rolled back. - agent_delivery.rs: a receipt attests more than a hash -- its fields, the response hash, and that only a persisted preparation yields a write-completion token. The guard test still described each path as "the unpinned half of a pair whose other half was already pinned", which the previous commit removed from lib.rs as untrue of agent_delivery.rs. It now says what was measured: each was unpinned while a module declaring it was pinned. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Brings docs/module-decomposition.md in line with bridge#416 and #434. Documentation only. - The worked example listed seven unpinned collaborators of agent_import.rs; #434 pinned five. It now names the two production collaborators still unpinned and why: agent_import_schema.rs, whose loosening cannot widen admission because agent_import.rs re-checks the bounds, and agent_desktop_journal_review.rs, which delegates review, post and reconcile to the pinned agent_desktop_journal.rs. agent_desktop_journal_review.rs was missed by the #416 measurement; the cause of that undercount is not established. - "None by design" corrected: RESERVED_SURFACE_FILES arrived in #223 with the cap at exactly count + 15. Exact-count caps date from #260, and a named reason beside the constant for each raise from #278. In the slack period #246 added eight pins without touching the cap. - The first rule now matches the #416 decision to report rather than require: pin the parts of a split that decide what Bridge posts or lets leave the machine, each with a named reason. - The pin count is no longer stated in prose, since each raise stales it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Review traced released_fields to the generic tool-response path: it describes the response of every tool, post_import included, not a read's. Its own reason was accurate; the framing around it was not. The intro now says five of the six are read-path files and places agent_receipt_fields.rs with the egress record, which is where bridge#416 had it (borderline). The guard's list becomes READ_PATH_AND_RECEIPT for the same reason. docs/proposed-rust-module-conventions.md no longer quotes a pin count; it said 218 and had been stale since #434. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Follows #434 on bridge#416. #434 pinned fourteen files that decide what Bridge posts or lets leave the machine. This pins six more from the same search, whose own bodies decide what a read tells a caller or when a sync may move past rows: agent_movement.rs, agent_movement_math.rs, agent_outstandings.rs, agent_change_parse.rs, agent_changes.rs and agent_receipt_fields.rs. MAX_SURFACE_FILES goes 232 to 238, each file named beside it with its own reason, headroom still zero. Reasons follow #434's rule: say what the file holds, and use "only" only where that file's code enforces it alone. Three first drafts failed that check and were narrowed against the code -- checkpoint_advanceable falls back to the requested checkpoint when a page returns nothing; changed_since applies the predicate per axis; a closing balance exists only when an opening was observed. The "Not pinned, and deliberately" paragraph no longer lists these files, and now names observability.rs with a reason that holds: tally_telemetry_preview returns what it builds, but nothing in the frontend calls that command and nothing sends the result off the machine. The pin guard gains READ_PATH beside ADMISSION_AND_EGRESS. Dropping agent_movement_math.rs from the real surface fails read_path_files_are_still_pinned by name; restored byte-identical after. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Review traced released_fields to the generic tool-response path: it describes the response of every tool, post_import included, not a read's. Its own reason was accurate; the framing around it was not. The intro now says five of the six are read-path files and places agent_receipt_fields.rs with the egress record, which is where bridge#416 had it (borderline). The guard's list becomes READ_PATH_AND_RECEIPT for the same reason. docs/proposed-rust-module-conventions.md no longer quotes a pin count; it said 218 and had been stale since #434. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

…ither bridge#416's second decision: report, and let a person decide. Rebuilt on master after #434's squash, and after two reviews. scripts/surface_coverage_report.py runs after every successful reseal.sh (not --verify) and never fails it. Against the merge-base with origin/master it lists a dropped pin, and a module declared directly by a pinned module and newly left unpinned -- a new file, a newly attached file, or one pinned at the base. What it does not check is stated where it will be read: in its all-clear line, its docstring, docs/release-process.md and the reseal.sh comment. Review showed the first wording ("code moved between existing files") named one blind spot and implied it was the only one. It also misses a new module under an unpinned parent even when carved out of a pinned file, deeper descendants, a pinned file that stops being compiled, a test-only or feature-gated module becoming production, and a new crate root. Module resolution follows rustc, walked from crate roots: a bare `mod` resolves beside a file that owns its directory (crate root, mod.rs, or #[path]-loaded) and under <stem>/ otherwise; #[path] resolves beside the declaring file. Review compared file sets, not just counts, with rustc's dep-info for every crate here and found them identical. The docstring lists the forms it does not handle, none of which occurs in the repo. Relative --surface paths now resolve against the caller's directory, and paths are compared as real paths: on macOS /tmp and /var are symlinks, and the first version reported a surface under a symlinked root as outside the repository. 32 tests, run against 34 mutations -- the 19 from the first version, and 15 more including every survivor review found -- and all 34 fail a test. Six needed the tests strengthened first: #[path] in an ordinary file (the shape agent.rs uses for nearly every agent_*.rs), inheritance of test-only and feature gates through a file, restricted visibility with a cfg, the new-file and pinned-at-base report clauses, a relative surface from a subdirectory, and an escaped quote in a char literal. docs/module-decomposition.md now points at the report and says what it does not catch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Seal the read-path files that decide what a read reports Follows #434 on bridge#416. #434 pinned fourteen files that decide what Bridge posts or lets leave the machine. This pins six more from the same search, whose own bodies decide what a read tells a caller or when a sync may move past rows: agent_movement.rs, agent_movement_math.rs, agent_outstandings.rs, agent_change_parse.rs, agent_changes.rs and agent_receipt_fields.rs. MAX_SURFACE_FILES goes 232 to 238, each file named beside it with its own reason, headroom still zero. Reasons follow #434's rule: say what the file holds, and use "only" only where that file's code enforces it alone. Three first drafts failed that check and were narrowed against the code -- checkpoint_advanceable falls back to the requested checkpoint when a page returns nothing; changed_since applies the predicate per axis; a closing balance exists only when an opening was observed. The "Not pinned, and deliberately" paragraph no longer lists these files, and now names observability.rs with a reason that holds: tally_telemetry_preview returns what it builds, but nothing in the frontend calls that command and nothing sends the result off the machine. The pin guard gains READ_PATH beside ADMISSION_AND_EGRESS. Dropping agent_movement_math.rs from the real surface fails read_path_files_are_still_pinned by name; restored byte-identical after. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> * Stop calling the receipt field walker a read-path file Review traced released_fields to the generic tool-response path: it describes the response of every tool, post_import included, not a read's. Its own reason was accurate; the framing around it was not. The intro now says five of the six are read-path files and places agent_receipt_fields.rs with the egress record, which is where bridge#416 had it (borderline). The guard's list becomes READ_PATH_AND_RECEIPT for the same reason. docs/proposed-rust-module-conventions.md no longer quotes a pin count; it said 218 and had been stale since #434. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: t <dev@example.invalid> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

…ither bridge#416's second decision: report, and let a person decide. Rebuilt on master after #434's squash, and after two reviews. scripts/surface_coverage_report.py runs after every successful reseal.sh (not --verify) and never fails it. Against the merge-base with origin/master it lists a dropped pin, and a module declared directly by a pinned module and newly left unpinned -- a new file, a newly attached file, or one pinned at the base. What it does not check is stated where it will be read: in its all-clear line, its docstring, docs/release-process.md and the reseal.sh comment. Review showed the first wording ("code moved between existing files") named one blind spot and implied it was the only one. It also misses a new module under an unpinned parent even when carved out of a pinned file, deeper descendants, a pinned file that stops being compiled, a test-only or feature-gated module becoming production, and a new crate root. Module resolution follows rustc, walked from crate roots: a bare `mod` resolves beside a file that owns its directory (crate root, mod.rs, or declaring file. Review compared file sets, not just counts, with rustc's dep-info for every crate here and found them identical. The docstring lists the forms it does not handle, none of which occurs in the repo. Relative --surface paths now resolve against the caller's directory, and paths are compared as real paths: on macOS /tmp and /var are symlinks, and the first version reported a surface under a symlinked root as outside the repository. 32 tests, run against 34 mutations -- the 19 from the first version, and 15 more including every survivor review found -- and all 34 fail a test. Six needed the tests strengthened first: #[path] in an ordinary file (the shape agent.rs uses for nearly every agent_*.rs), inheritance of test-only and feature gates through a file, restricted visibility with a cfg, the new-file and pinned-at-base report clauses, a relative surface from a subdirectory, and an escaped quote in a char literal. docs/module-decomposition.md now points at the report and says what it does not catch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

lamemustafa force-pushed the surface/416-pin-admission-and-egress branch from 97efda4 to 294bf4b Compare September 16, 2026 08:40

lamemustafa changed the title ~~Seal the admission and egress files, and report what a branch moves out of the seal~~ Seal the admission and egress files by name Sep 16, 2026

lamemustafa and others added 2 commits September 16, 2026 14:17

Merge branch 'master' into surface/416-pin-admission-and-egress

46c3b00

lamemustafa mentioned this pull request Sep 16, 2026

Report pins a branch drops and modules it leaves unsealed, without refusing either #436

Merged

lamemustafa merged commit 3676d6a into master Sep 16, 2026
12 checks passed

lamemustafa deleted the surface/416-pin-admission-and-egress branch September 16, 2026 09:01

This was referenced Sep 16, 2026

Bring the decomposition guide in line with #416 and #434 #437

Merged

Compatibility surface has zero headroom, which blocks every decomposition of a pinned file #416

Closed

Seal five read-path files and the egress receipt's field walker #438

Merged

Navigation Menu

Seal the admission and egress files by name - #434

Seal the admission and egress files by name#434
lamemustafa merged 4 commits into
masterfrom
surface/416-pin-admission-and-egress

lamemustafa commented Sep 16, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lamemustafa commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pin 14 files; raise MAX_SURFACE_FILES 218 → 232

Guard against losing them

Verified locally

Follow-ups

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lamemustafa commented Sep 16, 2026 •

edited

Loading

Pin 14 files; raise `MAX_SURFACE_FILES` 218 → 232