mirror of
https://github.com/mvschwarz/openrig.git
synced 2026-11-07 05:56:21 -10:00
v-openrig-build
60ee1e57be
Founder-ruled unbuild from the over-engineering audit (qitem-20260811020356-64ecb896), DB disposition ruled at lock level (qitem-20260811020528-369f2e40). 1. W4 compaction-enforcement suite, FULL — commits56858cbea,d789fbe51,34fe36d55,07879b10b,89fd15bf5,d4236f5bd,df05193e4. Removes the compaction-control CLI, the 3 /api/compaction/control routes, enforcer-decision-store.ts, the human_hold skip reason, authorize_ttl_minutes (config key + env + settings), and the generic beforeSend hook. Grounds: a hold/authorize permission system for a control no human ever issued; the founding incident was later ruled NO-FAULT. 2. W1 guard-tail trims — the MF5 caller-supplied wake-intent-* rejection on POST /api/queue/outbox/record and its case-variant broadening (one block). W1's transactional closure core, drain, indeterminate handling and crash-boundary tests stay. 3. Gate-verdict containment tail, PARTIAL — keeps the plain outside-the-worktree typo guard; drops the tracked-destination, tracked-path-traversal, tracked-symlink-leaf and .git administrative-path legs plus their fixtures. 4. W2b poison-retry — revertsbba1ad264. The envelope mechanism (d685eb713) stays. Technique: each touched file was classified by whether its only commits since 56858cbea^ were the 7 named W4 commits. 12 W4-only files were restored wholesale to their pre-W4 content; 4 MIXED files got surgical edits. This matters becausea68a156bb(ACTIVITY 5b) also touches session-transport.ts, startup.ts, server.ts and test-app.ts — a blind revert-to-pre-W4 would have silently deleted in-flight ACTIVITY work, including the mapPaneState export. That work is preserved. DB, per the lock-level ruling: migration 068 is APPLIED history and its file STAYS, inert. New forward migration 071 drops enforcer_decisions. DROP TABLE IF EXISTS is load-bearing — 068 is excluded from the shared full-test DB fixture, so 071 runs there against a table that was never created. Two consequences named rather than buried: - Removing the MF5 route guard restores a forgeable wake-intent path by design (the only caller is the daemon's own localhost client). The exact-case drain selector is now the ONLY thing keeping a recorded WAKE-INTENT- case variant out of the executable drain; that W1 pin is kept and its now-false comment corrected. - canonicalizeDestination in gate-lane.mjs is retained: it normalizes macOS /var -> /private/var, so its justification needs no adversary, only an OS. Removing it made 6 of 7 gate-lane tests fail on honest paths. Verified at base1e4bfee83: daemon 7268 passed / 0 failed, cli 2260 passed env-less, test:repo 164 pass / 0 fail, gate-lane binding 7/7, tsc clean in both packages. Isolated daemon boots clean on a migrated copy of the live DB (/healthz ok, reconcile errors=0); the 3 control routes 404 while /state and /trigger stay; rig compaction-control is an unknown command. DB proof ran on a sqlite3 .backup copy — the live DB was never touched. Not reviewed yet: handed to dev-guard as qitem-20260811033226-683d25ad for accept-to-commit. Branch-only, not reachable from main, never pushed. Guard round 1 (dev-guard NOT-CLEAR on bda641883, verdict sha256 8eeeabc0…c2cec) — two bounded corrections applied, no scope change: HIGH-1: startup.ts kept a W4-only `compactionSettingsStore` local, introduced by56858cbeasolely so W4 could share the settings store with EnforcerDecisionStore. With that store deleted the local was single-use, so it left a second construction shape for no behaviour and contradicted the FULL W4 unbuild claim. The construction block is now byte-identical to 56858cbea^; all later non-W4 startup work retained. HIGH-2: four records still asserted the deleted route reservation exists — outbox-handler.ts:3-10 (prefix doc), outbox-handler.ts:281-290 (exact-case selector rationale), queue-repository.ts:691-694 (missing-target refusal), and the queue-transactional-closure describe label. Reworded to state the real effects: the prefix is the executable drain namespace and NOT a route reservation, exact-case selection is now the only thing keeping a recorded case variant out of the drain, and the missing-target refusal stands on its own. No deleted guard was re-added and no behaviour changed.