feat: derive causal diagnostics roundtrip - #128
Merged
Conversation
Set roundtrip confirmed in exactly one place: the download acceptance of the same active operation, which already validated the request, attestation, authorization, response, keys, epochs, bindings, nonces, digests, payloads, and TTL for one explicit tuple. No new message type, endpoint, helper, bridge, or wire behavior is added. Cover the cross-operation replay property: a valid response artifact republished at a second operation's exact path fails chain validation and ends as conflict without download or roundtrip evidence.
Record the M7 evidence boundary: the roundtrip field derives only from the same operation's upload-then-download chain and claims scoped causal propagation — never global sync health, future delivery, byte accounting, or a direct peer. Real-device evidence remains explicitly owner-waived; VaultSync 2.0 stays NO-GO until release and rollout.
📝 WalkthroughWalkthroughChangesThe PR defines same-operation causal roundtrip evidence, records it after validated upload and download acceptance, updates diagnostics UI/localizations, and adds failure plus cross-operation replay tests. Causal roundtrip diagnostics
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 6 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (6 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Implement the owner-authorized M7 causal-roundtrip derivation of Decision 024 step 10.
roundtrip confirmedis set in exactly one place — the download acceptance of the same active operation — after that acceptance has already validated the request, attestation, authorization, response signature, keys, epochs, homeserver/folder bindings, operation ID, nonces, digests, payloads, and TTL for one explicit tuple. No new message type, endpoint, helper, bridge, Relay, or wire change ships with this milestone.The signed owner-device suite was not executed — owner-approved physical-device waiver (2026-07-15). It is replaced by fresh exact-head simulator and isolated Syncthing substitute evidence listed under Testing; no real-device, hardware-keychain, real-APNs, background-wake, or TestFlight-hardware behavior is claimed.
Evidence boundary
f41f597d3ceca73da102e5e447382dfae07d2e08.Component(s)
Testing
roundtrip confirmedwith all three evidence fields; stale, tampered, generation-changed, cancelled, restarted, and rate-limited scenarios keep roundtrip falsecd notify && go test ./... -count=1on macOS, plusgo vetandgofmtCompatibility and rollback
Existing-user upgrade, app launch, Settings inspection, Relay/APNs activity, and ordinary/background sync create no key, pairing, trust, namespace, peer, share, artifact, rescan, or configuration change. Old or downgraded helpers yield capability unavailable without fallback. App/helper rollback preserves credentials, namespace authorization, opaque copies, backups, versions, conflicts, history, tombstones, mappings, and user data; retained copies never regain validity and cannot derive a late roundtrip. Forward recovery starts with a fresh capability and never resumes an old proof.
Security and privacy
The derivation adds no transport, storage, logging, telemetry, crash annotation, durable proof, Relay/APNs/StoreKit call, or global success flag. The user-facing copy in all four languages states the scoped claim explicitly: one operation's causal propagation, never global sync health.