docs: reconcile current gap baseline by seonghobae · Pull Request #258 · ContextualWisdomLab/disksage

seonghobae · 2026-08-25T03:09:35Z

Purpose

Refresh docs/product-technical-gap-baseline.md with the live protected-main head and exact current PR/check evidence captured on 2026-08-25. This is documentation-only and does not grant transfer, attestation, eviction, or merge authority.

Evidence

Protected main: 7eb131c4b4ac628226b262d6406a663fc7dc632f
Current heads and base freshness are recorded in the dated reconciliation table.
Pending checks and missing approvals remain explicitly non-completion states.

Validation

git diff --check
Live gh pr view inventory for PRs fix: make Git worktree audit help terminal #249, feat: surface pending iCloud provider indexing #247, feat: add accessible Storybook UX contracts #246, security: reject symlink roots before canonicalization #227, fix: replace starter shell metadata with DiskSage identity #204, and security: bind Homebrew execution to approved script bytes #206.

Summary by CodeRabbit

문서
- DiskSage의 제품 요구사항, 사용자 시나리오와 수락 기준을 정리했습니다.
- 검증된 복사 후 정리, 복사 취소·실패 기록 및 기존 복사본 검증 기준을 명확히 했습니다.
- 제공자별 동기화·용량 관리, 개인정보 보호, 자격 증명 저장 및 플랫폼 차이를 문서화했습니다.
- 제품·기술 격차 기준선, 호환성 정책, 검사 결과와 관련 인시던트 정보를 최신화했습니다.

coderabbitai · 2026-08-25T03:09:43Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

DiskSage 제품 요구사항이 메타데이터 판정, 복사 검증, 취소·실패 처리, 퇴거 제어, 캐시 롤백 및 개인정보 경계를 정의하도록 확장되었습니다. 기술 기준선은 2026-08-26 저장소 상태, 제공자 갭, Naruon schema 검증 및 Finder/iCloud 운영 증거를 반영하도록 갱신되었습니다.

Changes

제품 요구사항 및 기술 기준선

Layer / File(s)	Summary
제품 요구사항 정의 `docs/product-requirements.md`	메타데이터 판정 순서, Goal 상태 머신, 검증된 복사·퇴거, 복사 취소·실패 저널, 기존 복사본 검증, 캐시 롤백, 계보 개인정보 경계, 수락 증거 및 ADR 추적성을 정의했습니다.
기술 갭 및 저장소 기준선 조정 `docs/product-technical-gap-baseline.md`	저장소 헤드와 PR 인벤토리를 2026-08-26 상태로 갱신했습니다. 네이티브 복사 실패 저널, provider API 취소, materialization 선검증, 관리 provider 트리 차단 및 lineage 범위를 기술 갭에 추가했습니다. 실행 결과와 readiness schema를 갱신했습니다.
스키마 및 운영 검증 증거 `docs/product-technical-gap-baseline.md`	Naruon schema 3–6 레거시 envelope와 schema 7–8 네이티브·pre-copy 필드를 기록했습니다. Finder/iCloud 인시던트, provider backlog, 보호 검사, fail-closed 상태 및 `STRIX_PROVIDER_UNAVAILABLE` 상태를 갱신했습니다.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🟡 Moderate · up to 179d1

This documentation change updates the product baseline and requirements, but the current text still leaves provider-state transitions, durable success receipts, failure and cancellation outcomes, safety invariants, and cache exclusion insufficiently defined or evidenced. Merging now could leave teams relying on an inaccurate requirements baseline and ambiguous acceptance criteria, so follow-up is needed before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 기술적 갭 기준 문서를 현재 상태와 조정하는 변경을 정확히 설명합니다. 문서 중심 변경의 주요 목적과 일치하며 간결합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch docs/refresh-gap-baseline-2026-08-25

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

devin-ai-integration

Devin Review found 4 new potential issues.

devin-ai-integration · 2026-08-30T05:29:15Z

    destination: &Path,
    local_root: &Path,
    bytes: u64,
+    control: &ProviderUploadControl<'_>,


🟡 Cancelled setup still creates folders

Cancellation or expiry during provider setup bypasses control until chunk upload begins. Google can create folders after cancellation, while OneDrive leaves a session.

Prompt for agents

Thread ProviderUploadControl checks through the OneDrive and Google setup operations in src-tauri/src/provider_api_write.rs. Check before and after each network request and before each provider mutation, including metadata lookup, parent traversal/folder creation, and upload-session creation. On cancellation or deadline expiry, clean any command-created session or folders that can be proven command-owned without touching pre-existing provider objects.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-30T05:29:16Z

+    if let Err(error) = control.check() {
+        let cleanup = delete_uploaded_object(provider, &object_id, bearer_token);
+        return Err(match cleanup { Ok(()) => error, Err(cleanup_error) => format!("{error},provider-api-upload-cleanup-failed:{cleanup_error}") });


🟡 Late cancellation is ignored

After control.check() passes, the command remains cancellable through hashing and attestation but never checks again. An accepted cancellation can still produce a successful receipt.

Prompt for agents

Extend the provider-copy operation control beyond upload_file into the caller's post-upload lifecycle. Recheck cancellation and the same deadline during or immediately after source verification, before receipt persistence, and around attestation. If cancellation or expiry occurs before the immutable receipt commits, delete the completed provider object and journal the failure. Ensure cancel_cloud_copy cannot acknowledge a cancellation once the operation has crossed a clearly defined non-cancellable completion boundary.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-30T05:29:17Z

+fn preserve_upload_error_with_session_cleanup(agent: &ureq::Agent, session_url: &str, authorization: Option<&str>, upload: Result<String, String>) -> Result<String, String> {
+    match upload {
+        Ok(object_id) => Ok(object_id),
+        Err(error) => match abandon_upload_session(agent, session_url, authorization) {
+            Ok(()) => Err(error),
+            Err(cleanup_error) => Err(format!("{error},provider-api-upload-session-cleanup-failed:{cleanup_error}")),


🟡 Completion errors orphan uploaded objects

A malformed completed-upload response makes upload_chunks fail without an object ID. Session cleanup accepts 404 or 410, leaving the uploaded object and blocking retries.

Prompt for agents

Handle ambiguous completion separately from ordinary resumable-session failure in src-tauri/src/provider_api_write.rs. When a completion status is received but its body cannot yield an object ID, reconcile the exact destination through the provider API using command-bound identity before declaring cleanup successful. Delete only an object proven to belong to this upload, or return and journal an explicit ambiguous-completion error that does not claim the session cleanup removed the completed object. Add tests for malformed, truncated, and missing-ID 200/201 responses followed by 404/410 from the session URL.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-30T05:29:18Z

+    #[test]
+    fn provider_upload_rejects_pre_start_cancellation() {
+        let cancel = AtomicBool::new(true);
+        let control = ProviderUploadControl::new(&cancel, Instant::now() + Duration::from_secs(1));
+        assert_eq!(control.check().unwrap_err(), "cloud-copy-cancelled");
+    }
+
+    #[test]
+    fn provider_upload_observes_cancellation_between_chunks() {
+        let cancel = AtomicBool::new(false);
+        let control = ProviderUploadControl::new(&cancel, Instant::now() + Duration::from_secs(1));
+        control.check().unwrap();
+        cancel.store(true, Ordering::SeqCst);
+        assert_eq!(control.check().unwrap_err(), "cloud-copy-cancelled");
+    }
+
+    #[test]
+    fn provider_upload_observes_post_success_cancellation_before_receipt() {
+        let cancel = AtomicBool::new(false);
+        let control = ProviderUploadControl::new(&cancel, Instant::now() + Duration::from_secs(1));
+        cancel.store(true, Ordering::SeqCst);
+        assert_eq!(control.check().unwrap_err(), "cloud-copy-cancelled");
+    }
+
+    #[test]
+    fn provider_upload_enforces_one_overall_deadline() {
+        let cancel = AtomicBool::new(false);
+        let now = Instant::now();
+        let control = ProviderUploadControl::new(&cancel, now);
+        assert_eq!(control.check_at(now).unwrap_err(), "cloud-copy-deadline-exceeded");


🔍 Cancellation tests cover only the flag

The new tests call control.check directly. They do not exercise setup, chunk requests, cleanup, receipt persistence, or attestation.

Was this helpful? React with 👍 or 👎 to provide feedback.

docs: reconcile exact PR heads and checks

f731f01

devin-ai-integration Bot reviewed Aug 25, 2026

View reviewed changes

seonghobae added 6 commits August 25, 2026 12:38

docs: reconcile current Finder stall evidence

cc8f398

docs: bind baseline to current exact heads

0beaaa0

docs: refresh baseline after ADR evidence update

c72579d

docs: bind baseline to current ADR head

75cd304

docs: capture current headroom evidence

bd185e0

docs: record provider timeout after local cleanup

285766b

seonghobae marked this pull request as draft August 25, 2026 04:12

docs: reconcile current provider-lock head

c7ca2a4

seonghobae marked this pull request as ready for review August 25, 2026 04:40

This comment was marked as resolved.

Sign in to view

docs: refresh exact-head baseline after provider lock

0b4950e

seonghobae marked this pull request as draft August 25, 2026 05:24

docs: reconcile current DiskSage exact heads

e26f347

seonghobae marked this pull request as ready for review August 25, 2026 05:25

docs(gap): refresh live PR and provider evidence

d07b3a6

seonghobae marked this pull request as draft August 25, 2026 06:09

docs(gap): record stale provider stall detection

4a8e29f

seonghobae marked this pull request as ready for review August 25, 2026 06:12

seonghobae added 8 commits August 25, 2026 15:15

docs(gap): bind readiness contract fix

4368d2b

docs(gap): refresh exact current PR heads

b844d1b

docs(gap): record wrapped provider probe evidence

c0fb009

docs(gap): record security PR review readiness

ae439a0

docs(gap): refresh parser and exact heads

db64a4f

docs(gap): bind current protected heads

46c82a2

docs(gap): record cross-record parser guard

926c0ae

docs(gap): bind final current PR heads

77a89d6

This comment was marked as resolved.

Sign in to view

docs: refresh exact reclaim gap evidence

f5f59ad

This comment was marked as resolved.

Sign in to view

seonghobae added 2 commits August 30, 2026 09:36

docs: record final PhotoKit checkpoint evidence

924dfca

test: state receipt persistence boundary precisely

5ebc2e1

This comment was marked as resolved.

Sign in to view

docs: sync final reclaim evidence

b706705

This comment was marked as resolved.

Sign in to view

docs: record resolved clone stack conflict

8b18b62

This comment was marked as resolved.

Sign in to view

feat: bound provider uploads to operation lifecycle

aeffc86

This comment was marked as resolved.

Sign in to view

fix: retain provider post-upload failure evidence

5da4b27

This comment was marked as resolved.

Sign in to view

docs: sync current reclaim evidence

03c8b03

This comment was marked as resolved.

Sign in to view

fix: expose provider upload cancellation

3986163

This comment was marked as resolved.

Sign in to view

fix: report provider upload cancellation clearly

16556c7

This comment was marked as resolved.

Sign in to view

docs: record current reclaim receipts

4837daf

devin-ai-integration Bot reviewed Aug 30, 2026

View reviewed changes

seonghobae added documentation Improvements or additions to documentation priority: high High-priority or P1 work status: needs-review Open pull request requiring current-head review or checks type: feature New or expanded product capability labels Sep 2, 2026 — with ChatGPT Codex Connector

seonghobae mentioned this pull request Sep 2, 2026

chore(metadata): record public-surface label taxonomy wave 3 ContextualWisdomLab/.github#1653

Open

seonghobae removed type: feature New or expanded product capability priority: high High-priority or P1 work labels Sep 2, 2026

seonghobae added priority: medium Normal-priority or P2 work type: docs Documentation, ADR, PRD, or technical writing labels Sep 2, 2026 — with ChatGPT Codex Connector

Uh oh!

Conversation

seonghobae commented Aug 25, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Purpose

Evidence

Validation

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Aug 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

seonghobae commented Aug 25, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 25, 2026 •

edited

Loading