feat(zotero): execute verified rollback receipts - #20
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
# Conflicts: # docs/PRD.md # docs/TRD.md # docs/product-technical-gap-baseline.md
Non-force two-parent restack onto current approved-execution parent. Preserve rollback semantics while inheriting the repaired Foundation CI, receipt, and authorization lineage. Signed-off-by: Seongho Bae <me@seonghobae.me>
# Conflicts: # docs/TRD.md # docs/product-technical-gap-baseline.md
|
Current-stack correction (2026-09-05): exact base |
Signed-off-by: Seongho Bae <me@seonghobae.me>
…st framing in PR 20
1 participant
Latest bounded-read integration checkpoint
Exact head
a03a7248c894a1e0765968ddf58514d98c517da3normally merges parent62c19ee23e3c827bc7db15c79f4755ff040489e9while retaining previous child4fb1ad073cfbe25d269d063c90914636f27619da. Base remainsautoresearch/zotero10-approved-execution. The #9 whole-snapshot elapsed-time repair and its RED/GREEN evidence are inherited without reverse-merging later features or discarding predecessor deltas.This exact head passes Rust 1.98.0 locked workspace tests=116 suites=21, including doctests and excluding filtered subprocess duplicates, strict all-target Clippy, warnings-denied rustdoc, formatting, the existing CI contract and diff checks. Log:
/private/tmp/conceptweave-deadline-pr20-20260906.log. Intermediate coverage is not inferred from owner/final-endpoint coverage. No new dependency, actual paper read/decision, Zotero mutation or authority issuer was used.Draft and protected prerequisites remain. Local tests are not hosted GREEN, independent approval, merged/released source or evidence for another head. Earlier checkpoints below are retained history, not the current head.
Verified local approval-order repair — 2026-09-06 checkpoint
Exact head:
autoresearch/zotero10-rollback-execution@4fb1ad073cfbe25d269d063c90914636f27619da. Exact base:autoresearch/zotero10-approved-execution@de9df48d727fe22a3f1efb881d7d17ef0566b620.Original planner owner #13 preserves regression
505e111c993d8269e5b7b9e17a25a5ce20f8606eand repair8a684882005085d8b3cb47812e185975084e0475. Every existing local request/mode/item/metadata check finishes before the external approval verifier. Invalid requests invoke it zero times; valid complete requests invoke it exactly once. Local validation errors intentionally precede approval denial. Deterministic operations and complete before/after/rollback metadata are unchanged.This exact head passed locked Rust 1.98.0 workspace tests (113 tests / 21 unfiltered suites, doctests included), strict all-target Clippy, formatting, warnings-denied rustdoc, CI contract and diff checks before normal push. Normal parent integration retains both the prior child and verified parent as ancestors. Coverage from another stack head is not attributed to this head.
Keep Draft behind the existing prerequisite stack. This is local verification, not hosted current-head GREEN, independent approval, protected merge or release. No later full-text feature was reverse-merged into an earlier owner. Full-text-aware write admission, authentic decisions and independent authority remain separate gaps; no real Zotero/model request, label, approval or write was performed for this repair.
Earlier coordinates and status claims below are historical.
Prior PR description, retained without discarding evidence
Current source-integrity note — 2026-09-05
autoresearch/zotero10-rollback-execution@d605e1517d2838b077bfa18cfd5c15d5246ea1cd.autoresearch/zotero10-approved-execution@9dc1387a588a3ecfe2be255f68467be68a9fc591.e7d4e59f1b55b5954c5f8436527bc96e7ef2fb13through ordinary merge ancestry. The source-snapshot digest binds complete captured raw provider JSON and the actual typed classifier inputs; source evidence and derived proposals retain separate identities.GoldenSetApproval.proposal_digestis required and binds the complete proposal records used for evaluation. The current proposal digest is checked before the caller-owned governance verifier. Do not backfill old receipts: regenerate evidence and obtain a new approval bound to the reviewed evidence.Earlier heads, runtime snapshots, campaign counts, and verification statements below are historical notes, not current acceptance evidence.
Historical PR notes — original text retained
Outcome
Executes reverse-ordered rollback evidence through the existing reviewed Zotero 10 adapter without adding a parallel mutation implementation. Mixed-server/stale evidence is rejected before mutation; failed inverse writes are reconciled without automatically retrying indeterminate state, and complete operator evidence is retained.
Current exact stack — 2026-09-05
autoresearch/zotero10-approved-execution@b6c11b280ad7d04e45f9fd694026bddc80370658;53a91d33acb9c459808548b2f80d07984ccdfaee;Rollback contract already present
ClassificationRollbackOperationbinds each inverse operation to the server id, post-write item revision, expected post-write collections/tags, and complete restoration state. Preflight rejects mixed server identity, stale item evidence, or inconsistent library state before mutation. Execution follows receipt order, advances the library version only after a verified inverse write, and on failure re-reads the item to distinguish restored, unchanged, and indeterminate state. The receipt keeps restored, failed, indeterminate, not-attempted, and safely retryable remaining operations separate; an indeterminate operation retains its full metadata for operator reconciliation rather than being retried automatically.The mock transport reads complete HTTP requests before serving deterministic responses. These tests exercise orchestration mechanics only and do not establish live-provider safety.
Inherited security and governance gates
#20 inherits #19 -> #18 -> #17 -> #16 -> #15 -> #13 -> #12 -> #11 -> #10 -> #9 -> Foundation. Descendant rollback evidence does not back-prove predecessor contracts.
#15's receipt/execution source repairs remain independently acceptance-gated. #18 documents the Zotero loopback HTTP boundary consistently in
THREAT_MODEL.md,SECURITY.md, anddocs/TRD.md; API-key confidentiality against a hostile same-host process remains outside what the provider transport can prove.Therefore no execution or rollback path in this stack may be advertised or released as enterprise-secure live write-back until predecessor exact heads satisfy their own protected gates and the residual provider-transport risk is either removed by a protected transport or explicitly accepted through product-security/governance.
Merge gate
Keep Draft. Require one unchanged exact head with terminal Product/security/SAST/dependency/review evidence after all predecessor gates are independently satisfied. No self-approval, routine administrator bypass, force-push, destructive rebase, secret persistence, provider-security overclaim, automatic retry of indeterminate rollback, or live mutation without reviewed evidence.
Refs #8.