OSS-Singularity/zcode-dispatch-observatory
OSS-Singularity/zcode-dispatch-observatory
Watch
1
0
Fork
You've already forked zcode-dispatch-observatory
 0
Code Issues Pull requests Projects Releases 137 Packages Wiki Activity Actions

Pinky DD2: steer-unread hardening — non-dict payload guard, steer-dir poll-cache key, S-6 narrative correction (v1.34.1) #62

Merged
ClaudiuSchuster merged 1 commit from oss-oo/pinky-dd2-hardening into main 2026-10-02 02:18:17 +00:00
Conversation 0 Commits 1 Files changed 4 +165 -20
ClaudiuSchuster commented 2026-10-02 02:07:03 +00:00
Owner

Validation follow-ups from the v1.34.0 ACCEPT-WITH-FINDINGS round.

  • V-1 (MED): _steer_unread_sessions crashed on a truthy non-dict JSON payload in a fresh-mtime steer result file (AttributeError at data.get()), darking /api/sessions for the unread window. Fixed with an isinstance(data, dict) guard (+ belt-and-suspenders except); wrong-type payloads are inert — tested at derivation, composition and endpoint level, incl. malformed-among-valid.
  • V-2 (LOW): S-6 pre-fix narrative overstated the stale window. The state file was already fingerprinted at ns-mtime precision, so the exposure was the protocol-level POST→refresh race across the source-key micro-cache (CACHE_KEY_MS, default 250 ms; protocol-proven under a 5 s stress key window) — CACHE_TTL_S only the outer bound. Wording corrected (docstring, README, test narrative); no behavior change.
  • V-3 (LOW): STEER_DIR result files join the poll-cache _source_key — a steer completion flips the unread badge on the NEXT poll, killing the badge-lag asymmetry against the external path (unit differential red pre-fix; fixture CDP: isolated result file glows in 2.4 s against a 30 s TTL).
  • V-4 (LOW): documented the stream-history approximation — the glow rides the DELIVERY ts, not completion (chosen over a terminal-status cross-check: sweeper results leave no artifact in STEER_DIR).

Suite: 212 tests green (207 + 5 new). Super-Linter station recipe green (BASH, BASH_EXEC, MARKDOWN, PYTHON_PYLINT, PYTHON_RUFF, YAML). Version marker v1.34.1.

Validation follow-ups from the v1.34.0 ACCEPT-WITH-FINDINGS round. - **V-1 (MED)**: `_steer_unread_sessions` crashed on a truthy non-dict JSON payload in a fresh-mtime steer result file (AttributeError at `data.get()`), darking `/api/sessions` for the unread window. Fixed with an `isinstance(data, dict)` guard (+ belt-and-suspenders `except`); wrong-type payloads are inert — tested at derivation, composition and endpoint level, incl. malformed-among-valid. - **V-2 (LOW)**: S-6 pre-fix narrative overstated the stale window. The state file was already fingerprinted at ns-mtime precision, so the exposure was the protocol-level POST→refresh race across the source-key micro-cache (`CACHE_KEY_MS`, default 250 ms; protocol-proven under a 5 s stress key window) — `CACHE_TTL_S` only the outer bound. Wording corrected (docstring, README, test narrative); no behavior change. - **V-3 (LOW)**: STEER_DIR result files join the poll-cache `_source_key` — a steer completion flips the unread badge on the NEXT poll, killing the badge-lag asymmetry against the external path (unit differential red pre-fix; fixture CDP: isolated result file glows in 2.4 s against a 30 s TTL). - **V-4 (LOW)**: documented the stream-history approximation — the glow rides the DELIVERY ts, not completion (chosen over a terminal-status cross-check: sweeper results leave no artifact in STEER_DIR). Suite: 212 tests green (207 + 5 new). Super-Linter station recipe green (BASH, BASH_EXEC, MARKDOWN, PYTHON_PYLINT, PYTHON_RUFF, YAML). Version marker v1.34.1.
Validation follow-ups from the v1.34.0 ACCEPT-WITH-FINDINGS round:

- V-1 (MED): _steer_unread_sessions crashed on a truthy non-dict JSON
  payload in a fresh-mtime steer result file (AttributeError at
  data.get()), darking /api/sessions for the unread window. Guard with
  isinstance(data, dict) + belt-and-suspenders except; wrong-type
  payloads are inert (list/string/number/bool tested at derivation,
  composition and endpoint level, incl. malformed-among-valid).
- V-2 (LOW): the S-6 pre-fix narrative overstated the stale window —
  the state file was already fingerprinted at ns-mtime precision, so
  the exposure was the protocol-level POST->refresh race across the
  source-key micro-cache (CACHE_KEY_MS, default 250 ms; protocol-proven
  under a 5 s stress key window), with CACHE_TTL_S only the outer
  bound. Wording corrected in the invalidation docstring, README and
  the test-file narrative; no behavior change.
- V-3 (LOW): STEER_DIR result files join the poll-cache _source_key —
  a steer completion flips the unread badge on the NEXT poll, killing
  the badge-lag asymmetry against the external path (fixture CDP: an
  isolated result file glows in 2.4 s against a 30 s TTL).
- V-4 (LOW): documented the stream-history approximation — the glow
  rides the DELIVERY ts, not completion (chosen over a terminal-status
  cross-check: sweeper results leave no artifact in STEER_DIR).

Suite: 212 tests green (207 + 5 new); Super-Linter station recipe green
(BASH, BASH_EXEC, MARKDOWN, PYTHON_PYLINT, PYTHON_RUFF, YAML).
ClaudiuSchuster deleted branch oss-oo/pinky-dd2-hardening 2026-10-02 02:18:17 +00:00
ClaudiuSchuster referenced this pull request from a commit 2026-10-24 20:46:47 +00:00
Pinky ZZZZ: the retry-timestamp truth (owner finding #62, EIL: Diagnose-Vergiftung) — the STEER-RETRY button used to mint the fresh steer id at the RETRY moment, and the id's embedded send-ms is what every consumer trusts (queue FIFO, receipt sentMs, the delivered annotation's child-id parse): backlogged steers read YOUNGER than they were and the master's timeline got poisoned; the cure preserves the original sent_ms by construction (the retry id embeds the ORIGINAL send with an honest ordinal {orig-ms}-{n}-{sid}; retry-of-retry keeps the ROOT; the queue position follows the same law), gives the retry moment its OWN field everywhere (.retry.json lineage sidecar {retryOf, sentMs, retryMs, retryCount} + payload + the settled record's retryMs with the file's own birth preserved across the settle write), surfaces both times on the receipt (sentMs stays the ORIGINAL; retryMs/retryOf/retryCount join it), renders both in the deck's voice (gesendet: X beside Zustellung: Y · N. Versuch — retry fired Z, plus the honest toast), carries the original send through the dispatcher's ZCODE_DISPATCH_STEER_SENT_MS env seam, refuses an overwritten mint BY NAME at the product gate (proven red on a scratch-copy reintroduction — 11 discriminating legs — and green on the cure, with the honest negative pinning the retry's record/receipt diff to EXACTLY the settle keys), extends the attribution globs to retry-shaped prompt files (root-preferred on ties), and sweeps every sibling re-fire path (verdicts in the README) (v1.109.0)
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
OSS-Singularity/zcode-dispatch-observatory!62
No description provided.