[P0] Bound terminal authority pending-operation state and Future retention #64
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
nsaspy/prolog-rlm#64
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem
The #53/#54 core-hardening audit found that terminal authority records currently remain in
authority_pending/3andauthority_pending_control/5until the whole authority context is cleared.Resolved, denied, superseded, and cancelled operations can therefore retain resolution Futures and, depending on transition, private control state for the entire lifetime of a long-running session/runtime. A host that performs many approval operations can grow these registries without a bound.
The core-hardening contract explicitly requires no unbounded pending-operation registry growth after completed/cancelled operations.
Required invariant
Active pending state is bounded by active work. Terminal history, if retained for inspection/audit, must have an explicit bounded retention policy and must not retain executable continuations, validators, execution Futures, worker/thread references, or other live resources after they are no longer needed.
Acceptance
rlm_pending_approval/3,rlm_pending_approvals/2, andrlm_pending_resolution_async/2guarantee after resolution.pending, scheduling, or executing operations.Constraints
Do not add a TUI.
prolog-rlmowns policy/state/protocol; downstream clients own presentation. Preserve deferred/manual Futures for human latency and the canonical async-first execution direction.Implemented on PR #62, exact final head
1dddd22e0d4bdd8c862cc06c6a3d609c26c96094.Terminal executable control state is now separated from bounded sanitized history. Resolved/denied/superseded/cancelled operations immediately drop trusted continuation/edit-validator control state; execution Futures/gates are released after terminal transfer. Retained terminal history is capped at 64 records per authority context, with the corresponding resolved pending-resolution Futures bounded to the same retained set. Pruning never targets active work; a pruned ID disappears from pending lookup/resolution APIs and cannot be re-approved or revived.
Stress coverage creates more than the retention bound, verifies exactly 64 retained terminal records/Futures, verifies private controls are gone, verifies stale/pruned approval cannot revive work, and exercises long edit/supersede chains. Context/runtime teardown destroys remaining bounded resolution/execution resources.
Exact-head validation is green across the complete deterministic and configured REAL OpenRouter matrices.