[P0] Bound terminal authority pending-operation state and Future retention #64

Closed
opened 2026-08-16 23:52:17 +00:00 by lost-rob0t · 1 comment
lost-rob0t commented 2026-08-16 23:52:17 +00:00 (Migrated from github.com)

Problem

The #53/#54 core-hardening audit found that terminal authority records currently remain in authority_pending/3 and authority_pending_control/5 until the whole authority context is cleared.

Resolved, denied, superseded, and cancelled operations can therefore retain resolution Futures and, depending on transition, private control state for the entire lifetime of a long-running session/runtime. A host that performs many approval operations can grow these registries without a bound.

The core-hardening contract explicitly requires no unbounded pending-operation registry growth after completed/cancelled operations.

Required invariant

Active pending state is bounded by active work. Terminal history, if retained for inspection/audit, must have an explicit bounded retention policy and must not retain executable continuations, validators, execution Futures, worker/thread references, or other live resources after they are no longer needed.

Acceptance

  • Define the terminal retention contract: what rlm_pending_approval/3, rlm_pending_approvals/2, and rlm_pending_resolution_async/2 guarantee after resolution.
  • Drop trusted continuation/edit-validator references as soon as an operation becomes terminal.
  • Destroy or release execution Futures once their terminal result has been safely transferred to the pending-resolution contract.
  • Bound retained terminal records/Futures per authority context, or move audit history to a bounded/event representation that does not hold live resources.
  • Pruning never removes active pending, scheduling, or executing operations.
  • Edit/supersede chains cannot leak old control Futures indefinitely.
  • Context/runtime teardown remains deterministic and idempotent.
  • Add a stress test that creates/resolves/cancels many approval operations and asserts registry/Future counts return to the documented bound.
  • Add a test that a pruned terminal operation cannot be accidentally re-approved or revived.
  • Full deterministic suite and scheduler/concurrency tests remain green.

Constraints

Do not add a TUI. prolog-rlm owns policy/state/protocol; downstream clients own presentation. Preserve deferred/manual Futures for human latency and the canonical async-first execution direction.

## Problem The #53/#54 core-hardening audit found that terminal authority records currently remain in `authority_pending/3` and `authority_pending_control/5` until the whole authority context is cleared. Resolved, denied, superseded, and cancelled operations can therefore retain resolution Futures and, depending on transition, private control state for the entire lifetime of a long-running session/runtime. A host that performs many approval operations can grow these registries without a bound. The core-hardening contract explicitly requires no unbounded pending-operation registry growth after completed/cancelled operations. ## Required invariant Active pending state is bounded by active work. Terminal history, if retained for inspection/audit, must have an explicit bounded retention policy and must not retain executable continuations, validators, execution Futures, worker/thread references, or other live resources after they are no longer needed. ## Acceptance - [ ] Define the terminal retention contract: what `rlm_pending_approval/3`, `rlm_pending_approvals/2`, and `rlm_pending_resolution_async/2` guarantee after resolution. - [ ] Drop trusted continuation/edit-validator references as soon as an operation becomes terminal. - [ ] Destroy or release execution Futures once their terminal result has been safely transferred to the pending-resolution contract. - [ ] Bound retained terminal records/Futures per authority context, or move audit history to a bounded/event representation that does not hold live resources. - [ ] Pruning never removes active `pending`, scheduling, or executing operations. - [ ] Edit/supersede chains cannot leak old control Futures indefinitely. - [ ] Context/runtime teardown remains deterministic and idempotent. - [ ] Add a stress test that creates/resolves/cancels many approval operations and asserts registry/Future counts return to the documented bound. - [ ] Add a test that a pruned terminal operation cannot be accidentally re-approved or revived. - [ ] Full deterministic suite and scheduler/concurrency tests remain green. ## Constraints Do not add a TUI. `prolog-rlm` owns policy/state/protocol; downstream clients own presentation. Preserve deferred/manual Futures for human latency and the canonical async-first execution direction.
lost-rob0t commented 2026-08-17 05:52:23 +00:00 (Migrated from github.com)

Implemented on PR #62, exact final head 1dddd22e0d4bdd8c862cc06c6a3d609c26c96094.

Terminal executable control state is now separated from bounded sanitized history. Resolved/denied/superseded/cancelled operations immediately drop trusted continuation/edit-validator control state; execution Futures/gates are released after terminal transfer. Retained terminal history is capped at 64 records per authority context, with the corresponding resolved pending-resolution Futures bounded to the same retained set. Pruning never targets active work; a pruned ID disappears from pending lookup/resolution APIs and cannot be re-approved or revived.

Stress coverage creates more than the retention bound, verifies exactly 64 retained terminal records/Futures, verifies private controls are gone, verifies stale/pruned approval cannot revive work, and exercises long edit/supersede chains. Context/runtime teardown destroys remaining bounded resolution/execution resources.

Exact-head validation is green across the complete deterministic and configured REAL OpenRouter matrices.

Implemented on PR #62, exact final head `1dddd22e0d4bdd8c862cc06c6a3d609c26c96094`. Terminal executable control state is now separated from bounded sanitized history. Resolved/denied/superseded/cancelled operations immediately drop trusted continuation/edit-validator control state; execution Futures/gates are released after terminal transfer. Retained terminal history is capped at 64 records per authority context, with the corresponding resolved pending-resolution Futures bounded to the same retained set. Pruning never targets active work; a pruned ID disappears from pending lookup/resolution APIs and cannot be re-approved or revived. Stress coverage creates more than the retention bound, verifies exactly 64 retained terminal records/Futures, verifies private controls are gone, verifies stale/pruned approval cannot revive work, and exercises long edit/supersede chains. Context/runtime teardown destroys remaining bounded resolution/execution resources. Exact-head validation is green across the complete deterministic and configured REAL OpenRouter matrices.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
nsaspy/prolog-rlm#64
No description provided.