Repository navigation
feat(replay): show incident hold and effect evidence - #217
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (2)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8615986741
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 782d0929e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 63d283967c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b3dbb46503
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ea462cd42
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2f704c06a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f674defac9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24c7b50599
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex security review |
There was a problem hiding this comment.
🛡️ Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 0ad3654605
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
@codex security review |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
Incident replay previously read only a Work correlation, omitting organization hold/release and Task-linked effect evidence. The local-owner incident view now reads those relationships in one verified SQLite snapshot and reports admission, stop, late accounting and effect status without re-executing work or exposing raw payloads or global ledger positions.
Supporting history remains private. The reader follows owned references in both directions, checks event and record claims independently, and retains duplicate and escaped occurrences for exact validation. Selection covers Knowledge/Lab evidence, completion reviews and evaluations, inbox observations, manifests, stop references, inference context and routing origins. Consumed v2-v5 manifests reconstruct prior Knowledge through the actual use boundary. Foreign Organization claims and global identity conflicts fail closed, including missing or displaced counterparts. Stored timestamps, active domains and raw numeric fields follow their owning writer/recovery rules.
Orphan records retain every applicable correlation and owned organization claim, including Task routing organizations, across public and private selection. Incoming governed Knowledge consumption of a selected lease is checked through both capability-check lease channels and independent event/record ownership. A shared consumer's exclusion requires one matching typed organization through its owned containers; missing/nontext tenant fields and duplicate containers cannot hide the claim. Valid shared authority users, ordinary observation references and opaque generic record content do not expand the incident. Reference-first global event-ID lookup avoids repeatedly expanding each consumer's references for unrelated capability checks.
Storage v13–v15 adds guarded incoming-link indexes and versioned evidence grammar. The v15 grammar retains reserved lifecycle detail and value references even when projection/admission discriminators are damaged, and independently recognizes typed record bodies carrying physical admission metadata. Metadata-empty generic records remain opaque. Raw Knowledge consumption follows retained event and record ownership independently: validation references cannot be suppressed by invalid status, method or principal fields, and Agent creator-binding exclusions require unambiguous projection/value paths and a single known non-Agent creator kind. Ordinary Runtime provenance remains excluded from Agent-specific binding. Reads check the exact index/trigger definitions and complete contents against retained sources. Migration verifies the old grammar before atomic backfill and preserves source bytes. Restoring a removed guard cannot conceal missing or forged links; complete privileged rewriting remains outside origin guarantees.
Public event evidence retains its 256-event/2-MiB limit. One transaction-local support budget enforces 4,096 items/32 MiB across unique private and transient events, projection/freeze/authority/inbox records, inference accounting and policy history, public nested references, derived inbox bindings, late-effect records and final admission annotations. The duplicate preliminary 768-item/2-MiB inference pass is removed. Raw metadata and reference occurrences are charged before payload collection or array decoding; invalid UTF-8 reference JSON is rejected before SQLite/Go decoding can undercount it. Source reuse prevents duplicate charges without skipping owning validation. Task effects are classified as public before private closure and appear once in the returned timeline; the complete assembled history remains subject to authority, graph, completion, inbox and containment validation. Any bound or validation failure returns no partial report.
The reader evaluates expensive raw-family/ownership predicates only when applicable and fetches the bounded preflight's exact integer sequence identities without repeating selection. Completion admission reuses operation-local indexes and validated Team prefixes; recovery selects exact current completion transitions in one global event scan with indexed record probes. All reuse belongs to one operation or read transaction. Global integrity/index verification still scans retained history on each public request, and a short public timeline can require extensive supporting history.
Verification includes actual writer histories and public application/HTTP entry points, recovery comparisons, independently damaged event/record evidence, all thirteen scalar projection layouts, global lease/admission identities, stored metadata, legacy manifests, temporal boundaries, duplicate/escaped references, snapshot concurrency, cancellation/rollback, VACUUM, reseal/reopen and migrations. The 744-case candidate differential compares against unfiltered scalar owners. New regressions demonstrate shared-budget overflows through combined public/private items and bytes, private/transient reference occurrences, effects and annotations, with healthy lower controls. Separate controls cover public/private byte domains, public effects reused by private owners, raw reference encoding and direct shared-helper mixed batches.
CI runs the complete normal Go suite and every race test, example and fuzz seed target. Fresh compiler discovery assigns all app roots to two complete-root groups and all ledger roots to seventeen groups, including the entire 744-case differential in its own process. Those groups and the remaining packages run in parallel CI jobs on the same workflow revision. No roots, children, generated cases or history sizes are excluded from race testing. Each group retains count=1, its package working directory and the 20-minute deadline; root completion must match fresh discovery, and all four app growth children must pass in their owning group. The full normal suite preserves package-wide shared-process interactions. The required CI verification result depends on successful discovery, code/document checks and every applicable race job; failed, cancelled or unexpectedly skipped prerequisites cannot yield a passing result. Parallel scheduling uses more simultaneous runners; compilation, runner availability and the slowest group determine actual elapsed time, with measured final-head completion of 15m49s for PR CI and 25m29s for push CI. These runs include every applicable normal/code/document/race check; runner availability still affects future duration.
Final lifecycle regressions compare actual writers with full event replay and independent storage-aware recovery, including source-only references, missing or displaced counterparts, invalid creator metadata and duplicate ancestors. Healthy Runtime provenance and opaque generic-record controls preserve valid exclusions. The lifecycle implementation passed local standard checks on its committed tree: build, vet, lint, module consistency, the full normal Go suite, controlled documents, architecture and vulnerability checks. The complete local race corpus also passed with those unchanged Go inputs: all 35 non-ledger packages and all 512 ledger roots/2,000 child cases, with no ledger skips or failures. The longest ledger process took 829 seconds within its unchanged 20-minute deadline; local results do not establish remote CI readiness. The CI follow-up changes no Go code, test bodies, fixtures or dependency versions. Its 30 harness/classification/required-result tests and workflow lint pass. The complete normal suite and architecture checks passed on the CI follow-up tree. Both actual app race groups passed all 117 roots and 150 child cases, including all four growth sizes, without skips or failures; the groups took 238 and 554 seconds locally. These local timings do not establish hosted CI duration. The latest scheduling refinement splits each former ordinary ledger group into two disjoint groups of at most 32 current roots, using sixteen ordinary groups plus the separate differential. Fresh compiler discovery accounts for all 512 ledger roots exactly once, and the 30 harness tests pass. The full local hook passed on the refinement tree. Both halves of the previously timed-out group passed all 64 roots and 287 child cases, exactly matching its prior complete corpus, with no skips or failures. The two processes took 477 and 376 seconds locally; those results do not establish hosted duration or completion of the other new groups. Final-head general and security reviews completed without new findings, and all 62 review threads are resolved. Both push and PR CI passed all 23 jobs, including the 20 race jobs. Each run retained all 512 ledger roots/2,000 child cases, 117 app roots/150 children and the other 34 race-tested packages, and passed the full normal suite of 36 packages. Dashboard and release-artifact checks also passed.
The final lifecycle comparison runs the same 23 complete public-operation workloads against the previously published source. At three iterations per workload, the near-bound read changed from 3.043 to 3.191 seconds (+4.85%); the 16-start/256-unrelated-row/eight-Knowledge workload changed from 710 to 999ms (+40.7%). A small shared-lease read changed from 57 to 81ms and allocated about 0.94MB more. These observations retain the correctness cost and do not establish a service target, concurrent throughput or an improvement over the previous source. A separately controlled comparison confirms that moving repeated selected-reference checks outside the lifecycle-owner loop removes a contributor to the added cost.
The dashboard pins transitive
devalueat patched version5.9.3for both SvelteKit and Svelte, within their declared^5.8.1ranges. This addresses the high-severity dependency advisories that stopped both CI triggers at the audit step. The regenerated embedded license manifest records the updated lockfile hash; browser bundles are unchanged. Clean Windows and Linux checks using Node24.19.0and pnpm11.19.0pass frozen installation, peer checks, the vulnerability audit, Svelte checks, all 33 dashboard tests and the build. The Linux-generated license manifest matches byte for byte. The final-head dashboard and release-artifact checks also passed.Refs #178; this does not close its remaining coordination/output/external-effect audit or add Task resumption. The separate live freeze-reader/cache gap remains tracked in #221. Task-linked effects do not establish execution causality, complete historical authorization or remote termination.