nsaspy/zara-plugins

Fork 0

[WORKER] Integrations+Registry — plugin expansion, packaging and security hardening loop #52

New issue

Open

opened 2026-09-08 02:02:52 +00:00 by nsaspy · 19 comments

nsaspy commented

2026-09-08 02:02:52 +00:00

Owner

Mission

Continuously expand and harden the rest of the Zara plugin ecosystem: external integrations, registry/install UX, packaging, compatibility and cross-plugin correctness. This is the broad integration worker after the more specialized Android, voice/model, symbolics and provider workers have had their slots.

Stagger slot

fleet_cycle = 2h
slot = +90m

Start 15 minutes after Providers+Home (+75m). This is the final implementation slot in the cycle, leaving 30 minutes of quiet time before Frontier Research begins the next cycle.

Primary queue

zara-discord principal/capability isolation and production quality;
zara-agent-zero, zara-starintel-server, zara-local-recall, zara-emacs, zara-persona and other dependency-satisfied integrations;
plugin registry discovery/install/update/remove UX and integrity checks;
Nix/Home Manager/package/runtime discovery correctness;
compatibility tests across Core/plugin API revisions;
stale docs/catalog/manifest cleanup where source and registry disagree;
zara-org-todos once the Core replacement/composition seam is truly dependency-satisfied;
new plugin feature expansion identified by Frontier Research #645 when it does not belong to a specialist worker.

Feature-expansion rule

Do not add integrations as empty wrappers. A new or expanded plugin needs a real bounded capability, explicit unavailable/degraded behavior, deterministic tests and a clear reason it belongs outside Core.

Deep-testing contract

For every slice, exercise the relevant layers:

plugin metadata/schema/discovery compatibility;
clean install/update/remove and failure rollback;
API-version mismatch and stale package/registry state;
principal/capability isolation and guest/public restrictions;
malformed/oversized configuration and external responses;
lifecycle start/stop/reload and stale-handle behavior;
cancellation/timeout for long-running work;
secret/log redaction;
cross-plugin composition only through canonical Core seams;
deterministic integration fixtures with no live credentials by default;
full registry validation, plugin suites and nix flake check at exact head.

Where a plugin has UI or Android-visible behavior, require the appropriate consumer-side integration/screenshot/lifecycle tests from the owning repo rather than declaring completion from plugin unit tests alone.

Registry/package hardening

Treat installable plugin code as trusted executable software and keep installation explicit. Validate fetched registry metadata, revision/integrity, API compatibility and final discovered metadata before reporting success. Never execute downloaded plugin code as part of the download/copy step merely to validate it.

State loop

worker = integrations-registry
mode = RESEARCH | IMPLEMENT | REVIEW

RESEARCH: reconcile current registry/source/issues and #645 research; choose one non-overlapping slice.
IMPLEMENT: worktree, RED first, bounded implementation, focused/full gates, PR.
REVIEW: adversarial install/lifecycle/security/compatibility pass; independent final review remains Zara #646.

Output contract

WORKER_STATE
worker: integrations-registry
mode_used: <RESEARCH|IMPLEMENT|REVIEW>
result: <one-line outcome>
issue_or_pr: <refs or none>
head: <sha or none>
integration_tests: <summary>
registry_package_tests: <summary>
security: <principal/secrets/lifecycle summary>
core_handoffs: <refs or none>
blockers: <summary or none>
next_mode: <RESEARCH|IMPLEMENT|REVIEW>
next_target: <specific plugin/slice>

Guardrails

Never commit directly to main.
No secret values in issues/PRs/tests/logs.
Never weaken guest/public principal isolation to make an integration work.
Do not duplicate domains owned by Voice+Models, Symbolics+Dev or Providers+Home.
Prefer repairing correctness/security/packaging regressions before increasing catalog breadth.

## Mission Continuously expand and harden the rest of the Zara plugin ecosystem: external integrations, registry/install UX, packaging, compatibility and cross-plugin correctness. This is the broad integration worker after the more specialized Android, voice/model, symbolics and provider workers have had their slots. ## Stagger slot ```text fleet_cycle = 2h slot = +90m ``` Start 15 minutes after Providers+Home (+75m). This is the final implementation slot in the cycle, leaving 30 minutes of quiet time before Frontier Research begins the next cycle. ## Primary queue 1. `zara-discord` principal/capability isolation and production quality; 2. `zara-agent-zero`, `zara-starintel-server`, `zara-local-recall`, `zara-emacs`, `zara-persona` and other dependency-satisfied integrations; 3. plugin registry discovery/install/update/remove UX and integrity checks; 4. Nix/Home Manager/package/runtime discovery correctness; 5. compatibility tests across Core/plugin API revisions; 6. stale docs/catalog/manifest cleanup where source and registry disagree; 7. `zara-org-todos` once the Core replacement/composition seam is truly dependency-satisfied; 8. new plugin feature expansion identified by Frontier Research #645 when it does not belong to a specialist worker. ## Feature-expansion rule Do not add integrations as empty wrappers. A new or expanded plugin needs a real bounded capability, explicit unavailable/degraded behavior, deterministic tests and a clear reason it belongs outside Core. ## Deep-testing contract For every slice, exercise the relevant layers: - plugin metadata/schema/discovery compatibility; - clean install/update/remove and failure rollback; - API-version mismatch and stale package/registry state; - principal/capability isolation and guest/public restrictions; - malformed/oversized configuration and external responses; - lifecycle start/stop/reload and stale-handle behavior; - cancellation/timeout for long-running work; - secret/log redaction; - cross-plugin composition only through canonical Core seams; - deterministic integration fixtures with no live credentials by default; - full registry validation, plugin suites and `nix flake check` at exact head. Where a plugin has UI or Android-visible behavior, require the appropriate consumer-side integration/screenshot/lifecycle tests from the owning repo rather than declaring completion from plugin unit tests alone. ## Registry/package hardening Treat installable plugin code as trusted executable software and keep installation explicit. Validate fetched registry metadata, revision/integrity, API compatibility and final discovered metadata before reporting success. Never execute downloaded plugin code as part of the download/copy step merely to validate it. ## State loop ```text worker = integrations-registry mode = RESEARCH | IMPLEMENT | REVIEW ``` - RESEARCH: reconcile current registry/source/issues and #645 research; choose one non-overlapping slice. - IMPLEMENT: worktree, RED first, bounded implementation, focused/full gates, PR. - REVIEW: adversarial install/lifecycle/security/compatibility pass; independent final review remains Zara #646. ## Output contract ```text WORKER_STATE worker: integrations-registry mode_used: <RESEARCH|IMPLEMENT|REVIEW> result: <one-line outcome> issue_or_pr: <refs or none> head: <sha or none> integration_tests: <summary> registry_package_tests: <summary> security: <principal/secrets/lifecycle summary> core_handoffs: <refs or none> blockers: <summary or none> next_mode: <RESEARCH|IMPLEMENT|REVIEW> next_target: <specific plugin/slice> ``` ## Guardrails - Never commit directly to `main`. - No secret values in issues/PRs/tests/logs. - Never weaken guest/public principal isolation to make an integration work. - Do not duplicate domains owned by Voice+Models, Symbolics+Dev or Providers+Home. - Prefer repairing correctness/security/packaging regressions before increasing catalog breadth.

nsaspy referenced this issue

2026-09-08 02:03:14 +00:00

P0 — prove every published plugin installs and loads against current Zara #211

nsaspy commented

2026-09-08 02:17:50 +00:00

Author

Owner

WORKER_STATE
worker: integrations-registry
mode_used: RESEARCH
result: Froze a dependency-satisfied zara-discord lifecycle/false-success slice: startup currently returns normally when Discord credentials are unavailable, which can let Core treat a non-running integration as successfully started; next slice will make unavailable startup explicit/fail-closed without creating subscriptions/workers and lock it with lifecycle tests.
issue_or_pr: #508; relevant open PRs #511, #510, #24
head: 683bdd0e66
integration_tests: not run in RESEARCH; inspected zara-discord service lifecycle and current Zara Plugin API v1 contract. Core API v1 remains current (PLUGIN_API_VERSION = "1"), matching registry/source metadata for zara-discord 0.3.0.
registry_package_tests: not run in RESEARCH; current registry advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces.
security: principal/capability work remains highest-priority domain, but this bounded slice targets false-success/lifecycle correctness first: missing/invalid credentials must not look like a healthy started integration and must not leak subscriptions/workers. No secret values will be surfaced.
core_handoffs: none required for this slice; the public ServicePlugin.start/stop + PluginRuntime subscribe/start_worker contracts are sufficient.
blockers: none for the frozen slice. zara-org-todos remains separately dependent on the Core replacement/composition seam and is not selected.
next_mode: IMPLEMENT
next_target: zara-discord transactional startup/unavailable semantics — tests first for missing credentials and setup failure proving no subscription/worker leakage and no successful-start claim; then minimal implementation + exact-head plugin/registry/Nix gates in a focused branch/PR.

WORKER_STATE worker: integrations-registry mode_used: RESEARCH result: Froze a dependency-satisfied zara-discord lifecycle/false-success slice: startup currently returns normally when Discord credentials are unavailable, which can let Core treat a non-running integration as successfully started; next slice will make unavailable startup explicit/fail-closed without creating subscriptions/workers and lock it with lifecycle tests. issue_or_pr: #508; relevant open PRs #511, #510, #24 head: 683bdd0e66d2d8bc403ca3a4f6ff3bc0c4de3908 integration_tests: not run in RESEARCH; inspected zara-discord service lifecycle and current Zara Plugin API v1 contract. Core API v1 remains current (`PLUGIN_API_VERSION = "1"`), matching registry/source metadata for zara-discord 0.3.0. registry_package_tests: not run in RESEARCH; current registry advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces. security: principal/capability work remains highest-priority domain, but this bounded slice targets false-success/lifecycle correctness first: missing/invalid credentials must not look like a healthy started integration and must not leak subscriptions/workers. No secret values will be surfaced. core_handoffs: none required for this slice; the public ServicePlugin.start/stop + PluginRuntime subscribe/start_worker contracts are sufficient. blockers: none for the frozen slice. zara-org-todos remains separately dependent on the Core replacement/composition seam and is not selected. next_mode: IMPLEMENT next_target: zara-discord transactional startup/unavailable semantics — tests first for missing credentials and setup failure proving no subscription/worker leakage and no successful-start claim; then minimal implementation + exact-head plugin/registry/Nix gates in a focused branch/PR.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Completed one bounded zara-discord startup-safety slice in PR #513. Added lifecycle regressions first, moved Discord client construction ahead of subscription allocation, added rollback/cleanup for worker-registration failures, made stop clear plugin-owned handles, and preserved zero-secret API-v1 compatibility for missing credentials with no subscription/worker allocation and bounded generic logging. Exact-head CI also exposed that the originally frozen false-success requirement cannot be completed inside plugin API v1: ServicePlugin.start(runtime) -> None has no canonical unavailable/disabled result, while compatibility intentionally starts optional plugins without provider secrets. Filed precise Core contract blocker lost-rob0t/zara#658 rather than adding a plugin-specific sentinel or importing Core internals.
refs: #513; lost-rob0t/zara#658; CI run 34102142018
head: da1a0e7917
tests: TDD lifecycle tests cover missing-config zero-allocation, client-construction failure zero-leakage, and worker-registration rollback. Exact-head CI PASS: whitespace, compatibility contract tests, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package builds, and zara-avatar idle CPU budget.
blockers: Canonical Core-visible unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. API v1 exposes only start/stop/tools and plugin runtime status is read-only, so Plugin D cannot honestly make Core distinguish a credential-disabled integration from a successful start without a Core contract change. No blocker remains for reviewing/merging the resource-safety slice itself.
next_mode: REVIEW
next_target: Adversarially review PR #513 at exact head for resource rollback correctness, secrets/raw ConfigError leakage, compatibility/registry drift, false-success claims, permission/capability bypass, and whether any plugin-specific workaround accidentally substitutes for Core #658; merge only if the reviewed exact head remains green and the blocker is accurately scoped.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Completed one bounded zara-discord startup-safety slice in PR #513. Added lifecycle regressions first, moved Discord client construction ahead of subscription allocation, added rollback/cleanup for worker-registration failures, made stop clear plugin-owned handles, and preserved zero-secret API-v1 compatibility for missing credentials with no subscription/worker allocation and bounded generic logging. Exact-head CI also exposed that the originally frozen false-success requirement cannot be completed inside plugin API v1: ServicePlugin.start(runtime) -> None has no canonical unavailable/disabled result, while compatibility intentionally starts optional plugins without provider secrets. Filed precise Core contract blocker lost-rob0t/zara#658 rather than adding a plugin-specific sentinel or importing Core internals. refs: #513; lost-rob0t/zara#658; CI run 34102142018 head: da1a0e79175deb3ba212c2f4eeee3c57ba9da5e3 tests: TDD lifecycle tests cover missing-config zero-allocation, client-construction failure zero-leakage, and worker-registration rollback. Exact-head CI PASS: whitespace, compatibility contract tests, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package builds, and zara-avatar idle CPU budget. blockers: Canonical Core-visible unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. API v1 exposes only start/stop/tools and plugin runtime status is read-only, so Plugin D cannot honestly make Core distinguish a credential-disabled integration from a successful start without a Core contract change. No blocker remains for reviewing/merging the resource-safety slice itself. next_mode: REVIEW next_target: Adversarially review PR #513 at exact head for resource rollback correctness, secrets/raw ConfigError leakage, compatibility/registry drift, false-success claims, permission/capability bypass, and whether any plugin-specific workaround accidentally substitutes for Core #658; merge only if the reviewed exact head remains green and the blocker is accurately scoped.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial review of PR #513 found one merge-blocking partial-start rollback defect: if runtime-events worker registration succeeds and gateway worker registration then fails, the plugin closes client/subscription state but does not stop/join the already-created Core ManagedWorker, leaving stale runtime-owned worker state after failed startup. Also found root README drift (zara-discord 0.2.0 vs source/registry 0.3.0). Core #658 remains correctly scoped to unavailable-vs-ready lifecycle state and is not needed to fix this rollback bug.
refs: #513; #513 comment https://github.com/lost-rob0t/zara-plugins/pull/513#issuecomment-5568621505; lost-rob0t/zara#658; CI run 34102142018
head: da1a0e7917
tests: Exact-head CI PASS at 34102142018: whitespace, compatibility contracts, source/installed compatibility diagnostics, registry/plugin tests, package builds, and avatar CPU budget. Review shows coverage gap: lifecycle tests assert subscription/client rollback but do not assert ManagedWorker.request_stop()/bounded join() after second-worker registration failure.
blockers: PR #513 must not merge until the first managed worker is explicitly rolled back on partial startup failure. Separate Core-visible unavailable/disabled state remains blocked on lost-rob0t/zara#658. No new principal/capability bypass, raw token/ConfigError leakage, plugin-specific unavailable sentinel, or registry API-version mismatch found in changed paths.
next_mode: IMPLEMENT
next_target: Repair PR #513 tests-first: add RED partial-worker-start rollback coverage using the public ManagedWorker handle, minimally call request_stop() + bounded join() when later worker registration fails, update stale root README zara-discord version while in-scope, then rerun focused lifecycle + exact-head registry/compatibility/Nix gates.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial review of PR #513 found one merge-blocking partial-start rollback defect: if `runtime-events` worker registration succeeds and `gateway` worker registration then fails, the plugin closes client/subscription state but does not stop/join the already-created Core `ManagedWorker`, leaving stale runtime-owned worker state after failed startup. Also found root README drift (`zara-discord` 0.2.0 vs source/registry 0.3.0). Core #658 remains correctly scoped to unavailable-vs-ready lifecycle state and is not needed to fix this rollback bug. refs: #513; #513 comment https://github.com/lost-rob0t/zara-plugins/pull/513#issuecomment-5568621505; lost-rob0t/zara#658; CI run 34102142018 head: da1a0e79175deb3ba212c2f4eeee3c57ba9da5e3 tests: Exact-head CI PASS at 34102142018: whitespace, compatibility contracts, source/installed compatibility diagnostics, registry/plugin tests, package builds, and avatar CPU budget. Review shows coverage gap: lifecycle tests assert subscription/client rollback but do not assert `ManagedWorker.request_stop()`/bounded `join()` after second-worker registration failure. blockers: PR #513 must not merge until the first managed worker is explicitly rolled back on partial startup failure. Separate Core-visible unavailable/disabled state remains blocked on lost-rob0t/zara#658. No new principal/capability bypass, raw token/ConfigError leakage, plugin-specific unavailable sentinel, or registry API-version mismatch found in changed paths. next_mode: IMPLEMENT next_target: Repair PR #513 tests-first: add RED partial-worker-start rollback coverage using the public `ManagedWorker` handle, minimally call `request_stop()` + bounded `join()` when later worker registration fails, update stale root README zara-discord version while in-scope, then rerun focused lifecycle + exact-head registry/compatibility/Nix gates.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Repaired PR #513 tests-first at the reviewed partial-start seam. Added RED lifecycle coverage that captures the public ManagedWorker returned by PluginRuntime.start_worker() and requires request_stop() plus bounded join(timeout=1.0) when later gateway worker registration fails; then implemented that rollback without touching Core internals. Also fixed the reviewed root README drift from zara-discord 0.2.0 to 0.3.0. Core manager behavior was re-checked: on plugin startup failure it calls plugin stop and PluginRuntime._shutdown(), so the runtime-owned worker registry is cleared by Core after the plugin performs immediate cooperative worker shutdown. Registry/source remain aligned at zara-discord 0.3.0 / API v1 with tool + Nix install surfaces.
refs: #513; test commit 0c66b2c0ff; implementation commit b029b42039; docs commit dd21a25d7d; lost-rob0t/zara#658; CI run 34112972653
head: dd21a25d7d
tests: Exact-head CI is running on dd21a25d. Already PASS on whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, and zara-avatar idle CPU budget. Registry/plugin tests are currently in progress; package/Nix builds are still pending in the same exact-head run. The new lifecycle test is part of that registry/plugin test phase. No stale pre-head CI is being used as evidence.
blockers: Do not merge until CI run 34112972653 completes green at exact head. Separate false-success semantics remain blocked on Core lost-rob0t/zara#658 because API v1 has no canonical unavailable/disabled result; this slice does not add a plugin-specific sentinel, leak raw ConfigError/token material, or bypass principal/capability policy.
next_mode: REVIEW
next_target: Adversarially review PR #513 at exact head dd21a25d after CI completion. Verify the new worker-handle rollback is bounded/idempotent with Core cleanup, no secrets or permission/capability bypass were introduced, README/registry/install/Nix compatibility remains aligned, and Core #658 remains the only false-success lifecycle blocker; merge only if the exact-head run is fully green.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Repaired PR #513 tests-first at the reviewed partial-start seam. Added RED lifecycle coverage that captures the public `ManagedWorker` returned by `PluginRuntime.start_worker()` and requires `request_stop()` plus bounded `join(timeout=1.0)` when later gateway worker registration fails; then implemented that rollback without touching Core internals. Also fixed the reviewed root README drift from zara-discord 0.2.0 to 0.3.0. Core manager behavior was re-checked: on plugin startup failure it calls plugin stop and `PluginRuntime._shutdown()`, so the runtime-owned worker registry is cleared by Core after the plugin performs immediate cooperative worker shutdown. Registry/source remain aligned at zara-discord 0.3.0 / API v1 with tool + Nix install surfaces. refs: #513; test commit 0c66b2c0ff4e75654963fd6f4cf4abbf93eaa94b; implementation commit b029b4203992c4a082248442d51698540636f189; docs commit dd21a25d7d8be74716cc1eeedfe4f13007555636; lost-rob0t/zara#658; CI run 34112972653 head: dd21a25d7d8be74716cc1eeedfe4f13007555636 tests: Exact-head CI is running on dd21a25d. Already PASS on whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, and zara-avatar idle CPU budget. Registry/plugin tests are currently in progress; package/Nix builds are still pending in the same exact-head run. The new lifecycle test is part of that registry/plugin test phase. No stale pre-head CI is being used as evidence. blockers: Do not merge until CI run 34112972653 completes green at exact head. Separate false-success semantics remain blocked on Core lost-rob0t/zara#658 because API v1 has no canonical unavailable/disabled result; this slice does not add a plugin-specific sentinel, leak raw ConfigError/token material, or bypass principal/capability policy. next_mode: REVIEW next_target: Adversarially review PR #513 at exact head dd21a25d after CI completion. Verify the new worker-handle rollback is bounded/idempotent with Core cleanup, no secrets or permission/capability bypass were introduced, README/registry/install/Nix compatibility remains aligned, and Core #658 remains the only false-success lifecycle blocker; merge only if the exact-head run is fully green.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial review of PR #513 at exact head dd21a25d passed after the partial-start rollback repair; exact-head CI completed fully green, registry/source/install metadata stayed aligned, no new secret/principal/capability bypass or plugin-specific false-success workaround was found, and PR #513 was squash-merged as eaef813695.
refs: #513 (merged); merge eaef813695; lost-rob0t/zara#658; CI run 34112972653
head: dd21a25d7d (reviewed PR head); merged main commit eaef813695
tests: Exact-head CI PASS on dd21a25d: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests (including the new zara-discord lifecycle rollback regression), plugin package builds, and zara-avatar idle CPU budget.
blockers: Canonical Core-visible unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. No blocker remains for the merged zara-discord resource-safety slice.
evidence: REVIEW verified first-worker rollback uses public ManagedWorker.request_stop() + bounded join(timeout=1.0), plugin-owned client/subscription handles are cleared, missing ConfigError text is not logged raw, registry/source/root README agree on zara-discord 0.3.0 / API v1 with tool + Nix install surfaces, and changed paths do not alter principal/capability authorization. Core #658 remains accurately scoped; no plugin-local sentinel or permission bypass was introduced.
next_mode: RESEARCH
next_target: Reconcile current zara-discord principal/capability isolation against Core/API-v1 authorization and active issues/PRs, then freeze the highest-value dependency-satisfied security/correctness slice; if no Discord gap is actionable, move to registry install/update/remove integrity and runtime/Nix/Home Manager compatibility before broadening catalog scope.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial review of PR #513 at exact head dd21a25d passed after the partial-start rollback repair; exact-head CI completed fully green, registry/source/install metadata stayed aligned, no new secret/principal/capability bypass or plugin-specific false-success workaround was found, and PR #513 was squash-merged as eaef81369584453a5a6020d6043415b2489098ca. refs: #513 (merged); merge eaef81369584453a5a6020d6043415b2489098ca; lost-rob0t/zara#658; CI run 34112972653 head: dd21a25d7d8be74716cc1eeedfe4f13007555636 (reviewed PR head); merged main commit eaef81369584453a5a6020d6043415b2489098ca tests: Exact-head CI PASS on dd21a25d: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests (including the new zara-discord lifecycle rollback regression), plugin package builds, and zara-avatar idle CPU budget. blockers: Canonical Core-visible unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. No blocker remains for the merged zara-discord resource-safety slice. evidence: REVIEW verified first-worker rollback uses public ManagedWorker.request_stop() + bounded join(timeout=1.0), plugin-owned client/subscription handles are cleared, missing ConfigError text is not logged raw, registry/source/root README agree on zara-discord 0.3.0 / API v1 with tool + Nix install surfaces, and changed paths do not alter principal/capability authorization. Core #658 remains accurately scoped; no plugin-local sentinel or permission bypass was introduced. next_mode: RESEARCH next_target: Reconcile current zara-discord principal/capability isolation against Core/API-v1 authorization and active issues/PRs, then freeze the highest-value dependency-satisfied security/correctness slice; if no Discord gap is actionable, move to registry install/update/remove integrity and runtime/Nix/Home Manager compatibility before broadening catalog scope.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: RESEARCH
result: Reconciled current zara-discord security/compatibility state and froze the next dependency-satisfied slice as transactional installer/update rollback. The highest-priority guest/public principal isolation gap is still structurally blocked in Core by lost-rob0t/zara#251, so this loop does not fake a plugin-local authorization boundary. On current main, registry/source remain aligned at zara-discord 0.3.0 / Plugin API v1, but the bundled installer updates the private library non-transactionally: it deletes the existing lib before renaming staging into place, then copies the plugin wrapper afterward. A failure during either replacement can leave a previously working install missing or version-skewed while the command has already mutated live state.
refs: #508; closed plugin scope #26; lost-rob0t/zara#251; lost-rob0t/zara#658; merged #513; main eaef813695; plugins/zara-discord/lib/zara_discord_service/install.py; scripts/validate-registry.py; plugins.json
head: eaef813695
integration_tests: not run in RESEARCH. Inspected current Discord moderation routing/tool scoping and confirmed the plugin already binds moderation actions to ephemeral message/author context tokens and protected-target checks, while Core #251 remains the required guest-principal/capability boundary for service-plugin turns.
registry_package_tests: not run in RESEARCH. Current plugins.json is schema v1, updated 2026-09-07, and advertises zara-discord 0.3.0 / api_version 1 with both packaged tool and Nix-run install surfaces. Registry validation statically checks source/registry metadata/path/install-command alignment, but it does not prove transactional live update/rollback behavior.
security: Do not weaken Discord guest/public isolation; #251 remains the structural blocker. No secret-handling change is proposed. Installer slice must preserve existing config/token/settings, never execute installed plugin code to validate a copy, and fail without destroying the last known-good install.
core_handoffs: lost-rob0t/zara#251 for derived guest principals/capabilities; lost-rob0t/zara#658 for canonical unavailable-vs-ready lifecycle state.
blockers: Principal/capability isolation is blocked on Core #251, so it is not dependency-satisfied here. The installer rollback slice itself has no Core dependency. zara-org-todos remains dependency-gated by its Core replacement/composition seam.
next_mode: IMPLEMENT
next_target: zara-discord installer transactional update/rollback — tests first for an existing install where library replacement fails and where wrapper publication fails; require old library+wrapper remain intact, staging/backup cleanup is bounded, config/token/settings remain untouched, and success publishes one coherent new library+wrapper pair. Then minimally implement same-filesystem staged/backup replacement with rollback, run focused installer tests plus registry/compatibility/plugin/Nix exact-head gates, and open a focused PR without touching main directly.

WORKER_STATE worker: plugin-d mode_used: RESEARCH result: Reconciled current zara-discord security/compatibility state and froze the next dependency-satisfied slice as transactional installer/update rollback. The highest-priority guest/public principal isolation gap is still structurally blocked in Core by lost-rob0t/zara#251, so this loop does not fake a plugin-local authorization boundary. On current main, registry/source remain aligned at zara-discord 0.3.0 / Plugin API v1, but the bundled installer updates the private library non-transactionally: it deletes the existing `lib` before renaming staging into place, then copies the plugin wrapper afterward. A failure during either replacement can leave a previously working install missing or version-skewed while the command has already mutated live state. refs: #508; closed plugin scope #26; lost-rob0t/zara#251; lost-rob0t/zara#658; merged #513; main eaef81369584453a5a6020d6043415b2489098ca; plugins/zara-discord/lib/zara_discord_service/install.py; scripts/validate-registry.py; plugins.json head: eaef81369584453a5a6020d6043415b2489098ca integration_tests: not run in RESEARCH. Inspected current Discord moderation routing/tool scoping and confirmed the plugin already binds moderation actions to ephemeral message/author context tokens and protected-target checks, while Core #251 remains the required guest-principal/capability boundary for service-plugin turns. registry_package_tests: not run in RESEARCH. Current plugins.json is schema v1, updated 2026-09-07, and advertises zara-discord 0.3.0 / api_version 1 with both packaged tool and Nix-run install surfaces. Registry validation statically checks source/registry metadata/path/install-command alignment, but it does not prove transactional live update/rollback behavior. security: Do not weaken Discord guest/public isolation; #251 remains the structural blocker. No secret-handling change is proposed. Installer slice must preserve existing config/token/settings, never execute installed plugin code to validate a copy, and fail without destroying the last known-good install. core_handoffs: lost-rob0t/zara#251 for derived guest principals/capabilities; lost-rob0t/zara#658 for canonical unavailable-vs-ready lifecycle state. blockers: Principal/capability isolation is blocked on Core #251, so it is not dependency-satisfied here. The installer rollback slice itself has no Core dependency. zara-org-todos remains dependency-gated by its Core replacement/composition seam. next_mode: IMPLEMENT next_target: zara-discord installer transactional update/rollback — tests first for an existing install where library replacement fails and where wrapper publication fails; require old library+wrapper remain intact, staging/backup cleanup is bounded, config/token/settings remain untouched, and success publishes one coherent new library+wrapper pair. Then minimally implement same-filesystem staged/backup replacement with rollback, run focused installer tests plus registry/compatibility/plugin/Nix exact-head gates, and open a focused PR without touching main directly.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Completed one bounded tests-first zara-discord installer-integrity slice in PR #518. Added RED rollback regressions at f0ae681 for failed library publication and failed wrapper publication, then implemented same-filesystem staged publication at 8dc7297 using os.replace plus explicit backup/rollback so an update failure preserves the previous coherent library+wrapper pair. Existing settings.json and token are not part of the transaction and remain untouched; installer validation still copies files only and does not execute installed plugin code.
refs: #518; test commit f0ae681048; implementation commit 8dc7297c15; CI run 34129263920; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 8dc7297c15
integration_tests: Focused installer regressions are committed and included in the repository plugin-test phase. Local clone/test execution was unavailable in this worker environment because direct container DNS cannot resolve github.com, so exact-head GitHub CI is the execution evidence. At state write, CI run 34129263920 is in progress on the exact head; whitespace and compatibility gate contract checks are already PASS, with source compatibility diagnostics running.
registry_package_tests: Registry/source were re-read before implementation: plugins.json remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces; source installer remains under the registered plugin. Exact-head registry/plugin tests and package/Nix builds are pending in run 34129263920 and must be green before merge.
security: No principal/capability behavior was changed. Core guest/public isolation remains structurally blocked on lost-rob0t/zara#251, and canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. This slice does not log/copy token contents, alter settings/token files, execute downloaded plugin code during publication, or add a plugin-local authorization/lifecycle bypass.
core_handoffs: lost-rob0t/zara#251 for derived guest principals/capabilities; lost-rob0t/zara#658 for canonical unavailable lifecycle state.
blockers: Do not merge PR #518 until CI run 34129263920 completes fully green at exact head 8dc7297, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and the repository CPU gate. Principal isolation remains separately blocked on Core #251.
next_mode: REVIEW
next_target: Adversarially review PR #518 at exact head after CI completion. Verify rollback under both publication failure points preserves one coherent old pair, backup/staging cleanup cannot destroy last-known-good state, fresh-install behavior remains correct, no config/token/secret or permission boundary is touched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Completed one bounded tests-first zara-discord installer-integrity slice in PR #518. Added RED rollback regressions at f0ae681 for failed library publication and failed wrapper publication, then implemented same-filesystem staged publication at 8dc7297 using `os.replace` plus explicit backup/rollback so an update failure preserves the previous coherent library+wrapper pair. Existing `settings.json` and `token` are not part of the transaction and remain untouched; installer validation still copies files only and does not execute installed plugin code. refs: #518; test commit f0ae68104850f8a01d349c284c1ef1da836d50f0; implementation commit 8dc7297c1515908a5147831de29355d1c8b66578; CI run 34129263920; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 8dc7297c1515908a5147831de29355d1c8b66578 integration_tests: Focused installer regressions are committed and included in the repository plugin-test phase. Local clone/test execution was unavailable in this worker environment because direct container DNS cannot resolve github.com, so exact-head GitHub CI is the execution evidence. At state write, CI run 34129263920 is in progress on the exact head; whitespace and compatibility gate contract checks are already PASS, with source compatibility diagnostics running. registry_package_tests: Registry/source were re-read before implementation: `plugins.json` remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces; source installer remains under the registered plugin. Exact-head registry/plugin tests and package/Nix builds are pending in run 34129263920 and must be green before merge. security: No principal/capability behavior was changed. Core guest/public isolation remains structurally blocked on lost-rob0t/zara#251, and canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. This slice does not log/copy token contents, alter settings/token files, execute downloaded plugin code during publication, or add a plugin-local authorization/lifecycle bypass. core_handoffs: lost-rob0t/zara#251 for derived guest principals/capabilities; lost-rob0t/zara#658 for canonical unavailable lifecycle state. blockers: Do not merge PR #518 until CI run 34129263920 completes fully green at exact head 8dc7297, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and the repository CPU gate. Principal isolation remains separately blocked on Core #251. next_mode: REVIEW next_target: Adversarially review PR #518 at exact head after CI completion. Verify rollback under both publication failure points preserves one coherent old pair, backup/staging cleanup cannot destroy last-known-good state, fresh-install behavior remains correct, no config/token/secret or permission boundary is touched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial review of PR #518 found one merge-blocking interrupted-update recovery defect. Exact-head CI is fully green and exception rollback works for the covered publication failures, but _publish_install() unconditionally deletes fixed .lib.backup / .zara_discord.py.backup artifacts before publishing. If a prior installer process was killed after moving a live artifact into backup, that backup can be the last known-good copy; the next install can delete it and then fail, leaving no old artifact to restore and violating the slice's last-known-good guarantee.
refs: #518; #518 review comment https://github.com/lost-rob0t/zara-plugins/pull/518#issuecomment-5572223422; CI run 34129263920; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 8dc7297c15
integration_tests: Exact-head CI PASS at 34129263920. Existing RED/GREEN installer tests cover in-process library-publication and wrapper-publication exceptions and preserve settings/token. Review identified an uncovered process-interruption state: pre-existing backup with missing live artifact followed by a later failed update.
registry_package_tests: Exact-head CI PASS, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, whitespace, compatibility contracts, and repository CPU gate. Registry/source remain aligned at zara-discord 0.3.0 / Plugin API v1 with tool + Nix install surfaces.
security: No principal/capability, secret-handling, false-success, or permission-boundary changes were introduced in #518. Core guest/public principal isolation remains blocked on lost-rob0t/zara#251; canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. Installer still does not execute installed plugin code during publication.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: PR #518 must not merge until interrupted-update recovery is safe. Fixed backup names are currently treated as disposable even when they may be the only known-good artifact left by a killed prior installer.
next_mode: IMPLEMENT
next_target: Repair PR #518 tests-first for interrupted installer recovery. Seed states where live lib or wrapper is absent but its backup exists, inject a subsequent publication failure, and require the old coherent pair to survive/restore with bounded cleanup. Minimally replace destructive fixed-backup startup behavior with unique per-attempt backup/staging or an explicit recovery protocol, then rerun focused installer tests and every exact-head registry/compatibility/plugin/Nix gate before re-review.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial review of PR #518 found one merge-blocking interrupted-update recovery defect. Exact-head CI is fully green and exception rollback works for the covered publication failures, but `_publish_install()` unconditionally deletes fixed `.lib.backup` / `.zara_discord.py.backup` artifacts before publishing. If a prior installer process was killed after moving a live artifact into backup, that backup can be the last known-good copy; the next install can delete it and then fail, leaving no old artifact to restore and violating the slice's last-known-good guarantee. refs: #518; #518 review comment https://github.com/lost-rob0t/zara-plugins/pull/518#issuecomment-5572223422; CI run 34129263920; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 8dc7297c1515908a5147831de29355d1c8b66578 integration_tests: Exact-head CI PASS at 34129263920. Existing RED/GREEN installer tests cover in-process library-publication and wrapper-publication exceptions and preserve settings/token. Review identified an uncovered process-interruption state: pre-existing backup with missing live artifact followed by a later failed update. registry_package_tests: Exact-head CI PASS, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, whitespace, compatibility contracts, and repository CPU gate. Registry/source remain aligned at zara-discord 0.3.0 / Plugin API v1 with tool + Nix install surfaces. security: No principal/capability, secret-handling, false-success, or permission-boundary changes were introduced in #518. Core guest/public principal isolation remains blocked on lost-rob0t/zara#251; canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658. Installer still does not execute installed plugin code during publication. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: PR #518 must not merge until interrupted-update recovery is safe. Fixed backup names are currently treated as disposable even when they may be the only known-good artifact left by a killed prior installer. next_mode: IMPLEMENT next_target: Repair PR #518 tests-first for interrupted installer recovery. Seed states where live `lib` or wrapper is absent but its backup exists, inject a subsequent publication failure, and require the old coherent pair to survive/restore with bounded cleanup. Minimally replace destructive fixed-backup startup behavior with unique per-attempt backup/staging or an explicit recovery protocol, then rerun focused installer tests and every exact-head registry/compatibility/plugin/Nix gate before re-review.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Repaired PR #518 tests-first for interrupted installer recovery. RED commit 889e0f9676 seeds killed-update states where the live Discord library or wrapper is absent but its fixed backup survives, then injects a subsequent publication failure. Implementation commit 88fb98ed11 stops treating those backups as disposable scratch: _publish_install() first rolls surviving backup state back into the live artifact, then begins the new transaction, so a prior process death cannot cause the next install to delete the only last-known-good copy.
refs: #518; RED 889e0f9676; GREEN 88fb98ed11; PR comment #issuecomment-5572953916; CI run 34139611330; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 88fb98ed11
integration_tests: Interrupted-update recovery tests are committed before the implementation and are part of the exact-head repository plugin-test phase. Existing tests also cover ordinary failed library/wrapper publication and preservation of settings.json/token. Exact-head CI is currently in progress; whitespace, compatibility gate contract, and source compatibility diagnostics are PASS, installed compatibility is running, and registry/plugin tests are pending.
registry_package_tests: Current branch registry remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with both packaged tool and Nix install surfaces; current Zara Core still exposes PLUGIN_API_VERSION = "1". Exact-head package/Nix build gates are pending in CI run 34139611330 and must pass before merge.
security: No principal/capability behavior, secret handling, or false-success semantics changed. Surviving backup artifacts contain plugin code only; settings.json/token stay outside the transaction and are untouched. The installer still copies/publishes code without executing the installed plugin. Guest/public derived-principal isolation remains structurally blocked on lost-rob0t/zara#251, and canonical unavailable-vs-ready lifecycle status remains blocked on lost-rob0t/zara#658; no plugin-local bypass/sentinel was added.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: Do not merge PR #518 until CI run 34139611330 completes fully green at exact head 88fb98ed, including installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and repository CPU gate. No implementation blocker remains for the interrupted-backup repair itself.
next_mode: REVIEW
next_target: Adversarially review PR #518 at exact head 88fb98ed after CI completion. Verify both interrupted-backup RED cases actually restore the old coherent pair under subsequent failure; ordinary/fresh install behavior still works; recovery and rollback cleanup are bounded/idempotent; settings/token/secrets and principal/capability boundaries remain untouched; registry/source/install/Nix metadata stay aligned; and merge only if every exact-head gate is green.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Repaired PR #518 tests-first for interrupted installer recovery. RED commit 889e0f96761aa4bde9aa4ea81bc00904ca6ac696 seeds killed-update states where the live Discord library or wrapper is absent but its fixed backup survives, then injects a subsequent publication failure. Implementation commit 88fb98ed1152563bc0b3cf3509cabec470051b2a stops treating those backups as disposable scratch: `_publish_install()` first rolls surviving backup state back into the live artifact, then begins the new transaction, so a prior process death cannot cause the next install to delete the only last-known-good copy. refs: #518; RED 889e0f96761aa4bde9aa4ea81bc00904ca6ac696; GREEN 88fb98ed1152563bc0b3cf3509cabec470051b2a; PR comment #issuecomment-5572953916; CI run 34139611330; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 88fb98ed1152563bc0b3cf3509cabec470051b2a integration_tests: Interrupted-update recovery tests are committed before the implementation and are part of the exact-head repository plugin-test phase. Existing tests also cover ordinary failed library/wrapper publication and preservation of settings.json/token. Exact-head CI is currently in progress; whitespace, compatibility gate contract, and source compatibility diagnostics are PASS, installed compatibility is running, and registry/plugin tests are pending. registry_package_tests: Current branch registry remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with both packaged tool and Nix install surfaces; current Zara Core still exposes PLUGIN_API_VERSION = "1". Exact-head package/Nix build gates are pending in CI run 34139611330 and must pass before merge. security: No principal/capability behavior, secret handling, or false-success semantics changed. Surviving backup artifacts contain plugin code only; settings.json/token stay outside the transaction and are untouched. The installer still copies/publishes code without executing the installed plugin. Guest/public derived-principal isolation remains structurally blocked on lost-rob0t/zara#251, and canonical unavailable-vs-ready lifecycle status remains blocked on lost-rob0t/zara#658; no plugin-local bypass/sentinel was added. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: Do not merge PR #518 until CI run 34139611330 completes fully green at exact head 88fb98ed, including installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and repository CPU gate. No implementation blocker remains for the interrupted-backup repair itself. next_mode: REVIEW next_target: Adversarially review PR #518 at exact head 88fb98ed after CI completion. Verify both interrupted-backup RED cases actually restore the old coherent pair under subsequent failure; ordinary/fresh install behavior still works; recovery and rollback cleanup are bounded/idempotent; settings/token/secrets and principal/capability boundaries remain untouched; registry/source/install/Nix metadata stay aligned; and merge only if every exact-head gate is green.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial review of PR #518 found a remaining merge-blocking crash-recovery defect despite fully green exact-head CI: successful publication deletes library_backup and wrapper_backup sequentially, so process death after deleting only the library backup leaves a stale old wrapper backup beside the new coherent live pair; the next install independently restores that lone wrapper backup and can reconstruct new-library + old-wrapper mixed generations before its transaction begins.
refs: #518; PR review comment #issuecomment-5573499045; CI run 34139611330; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 88fb98ed11
integration_tests: Existing TDD covers ordinary failed library/wrapper publication and interrupted states where a live artifact is absent and its fixed backup survives. Review identified an untested reachable boundary during successful backup cleanup: live new library + live new wrapper + only old wrapper backup remaining. A later failed update can restore that stale wrapper alone and violate coherent-pair recovery.
registry_package_tests: Exact-head CI run 34139611330 PASS in full: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package/Nix builds, and zara-avatar CPU gate. Registry at reviewed head remains schema v1 with zara-discord 0.3.0 / api_version 1 and tool + Nix install surfaces; Zara Core still exposes Plugin API v1.
security: No new principal/capability bypass, secret exposure, plugin-code execution during install validation, false-success sentinel, or permission weakening found in changed paths. settings.json/token remain outside the code transaction. Guest/public principal isolation is still blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state on lost-rob0t/zara#658.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: PR #518 must not merge until crash recovery treats library+wrapper as one generation/transaction rather than independently restoring whichever fixed backup survives cleanup. Green CI does not cover this process-death boundary.
next_mode: IMPLEMENT
next_target: Repair PR #518 tests-first for interrupted successful-cleanup recovery: add RED coverage for a coherent new live pair with only stale wrapper backup surviving (plus other reachable cleanup boundaries), then minimally make recovery generation-aware/transaction-marker-based so the next failed update preserves one coherent pair; rerun focused installer tests and every exact-head compatibility/registry/Nix gate.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial review of PR #518 found a remaining merge-blocking crash-recovery defect despite fully green exact-head CI: successful publication deletes `library_backup` and `wrapper_backup` sequentially, so process death after deleting only the library backup leaves a stale old wrapper backup beside the new coherent live pair; the next install independently restores that lone wrapper backup and can reconstruct new-library + old-wrapper mixed generations before its transaction begins. refs: #518; PR review comment #issuecomment-5573499045; CI run 34139611330; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 88fb98ed1152563bc0b3cf3509cabec470051b2a integration_tests: Existing TDD covers ordinary failed library/wrapper publication and interrupted states where a live artifact is absent and its fixed backup survives. Review identified an untested reachable boundary during successful backup cleanup: live new library + live new wrapper + only old wrapper backup remaining. A later failed update can restore that stale wrapper alone and violate coherent-pair recovery. registry_package_tests: Exact-head CI run 34139611330 PASS in full: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package/Nix builds, and zara-avatar CPU gate. Registry at reviewed head remains schema v1 with zara-discord 0.3.0 / api_version 1 and tool + Nix install surfaces; Zara Core still exposes Plugin API v1. security: No new principal/capability bypass, secret exposure, plugin-code execution during install validation, false-success sentinel, or permission weakening found in changed paths. settings.json/token remain outside the code transaction. Guest/public principal isolation is still blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state on lost-rob0t/zara#658. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: PR #518 must not merge until crash recovery treats library+wrapper as one generation/transaction rather than independently restoring whichever fixed backup survives cleanup. Green CI does not cover this process-death boundary. next_mode: IMPLEMENT next_target: Repair PR #518 tests-first for interrupted successful-cleanup recovery: add RED coverage for a coherent new live pair with only stale wrapper backup surviving (plus other reachable cleanup boundaries), then minimally make recovery generation-aware/transaction-marker-based so the next failed update preserves one coherent pair; rerun focused installer tests and every exact-head compatibility/registry/Nix gate.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Repaired PR #518 tests-first at the interrupted-success cleanup boundary. Added RED coverage proving stale fixed backups left after a committed coherent install must not overwrite the live generation on the next failed update, then replaced independent backup recovery with a transaction marker that records the pre-update pair. Marker deletion is now the commit point: while present, recovery rolls both components back as one generation; after deletion, any surviving fixed backup is cleanup residue and is discarded instead of restored. Legacy no-marker backups are only restored when the corresponding live path is absent, preserving recoverable pre-marker interrupted states without letting stale cleanup clobber a coherent live pair.
refs: #518; test commit f3aa55da6d; implementation commit 550eba0cbc; CI run 34148287479; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 550eba0cbc
integration_tests: TDD coverage now includes ordinary library/wrapper publication rollback, interrupted missing-live backup recovery, and the reviewed committed-new-pair + stale-backups + subsequent-failure case. The new test was committed separately before implementation. Exact-head CI is running on 550eba0c; whitespace and compatibility gate contract tests are already PASS, source compatibility diagnostics are in progress, and installed compatibility, registry/plugin tests, package/Nix builds, and the CPU gate remain pending at cutoff.
registry_package_tests: Re-read registry/source compatibility before implementation: zara-discord remains 0.3.0 / Plugin API v1 with packaged tool + Nix install surfaces, matching current Zara Core PLUGIN_API_VERSION = "1". No registry metadata was changed in this slice.
security: settings.json/token remain outside the code transaction and untouched; the marker contains only two booleans describing whether code artifacts existed. No plugin code is executed during publication/recovery, no secret values are logged or copied into transaction metadata, and no principal/capability or false-success behavior changed. Core guest/public isolation remains blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658; no plugin-local bypass or sentinel was added.
blockers: Do not merge PR #518 until exact-head CI run 34148287479 completes fully green on 550eba0c, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and repository CPU gate. Independent REVIEW should also adversarially check malformed/corrupt transaction-marker behavior and process-death boundaries around marker publication/deletion before merge.
next_mode: REVIEW
next_target: Adversarially review PR #518 at exact head 550eba0c after CI completion. Verify transaction-marker recovery preserves one coherent generation at every reachable crash boundary, stale no-marker backups cannot clobber a coherent live pair, malformed marker handling fails safely without deleting last-known-good code, cleanup is bounded/idempotent, settings/token/secrets and principal/capability boundaries remain untouched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Repaired PR #518 tests-first at the interrupted-success cleanup boundary. Added RED coverage proving stale fixed backups left after a committed coherent install must not overwrite the live generation on the next failed update, then replaced independent backup recovery with a transaction marker that records the pre-update pair. Marker deletion is now the commit point: while present, recovery rolls both components back as one generation; after deletion, any surviving fixed backup is cleanup residue and is discarded instead of restored. Legacy no-marker backups are only restored when the corresponding live path is absent, preserving recoverable pre-marker interrupted states without letting stale cleanup clobber a coherent live pair. refs: #518; test commit f3aa55da6dc209c7995ff5f3b9644195a93808ac; implementation commit 550eba0cbc3bc8af0429a05caf7f66e5a40fa260; CI run 34148287479; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 550eba0cbc3bc8af0429a05caf7f66e5a40fa260 integration_tests: TDD coverage now includes ordinary library/wrapper publication rollback, interrupted missing-live backup recovery, and the reviewed committed-new-pair + stale-backups + subsequent-failure case. The new test was committed separately before implementation. Exact-head CI is running on 550eba0c; whitespace and compatibility gate contract tests are already PASS, source compatibility diagnostics are in progress, and installed compatibility, registry/plugin tests, package/Nix builds, and the CPU gate remain pending at cutoff. registry_package_tests: Re-read registry/source compatibility before implementation: zara-discord remains 0.3.0 / Plugin API v1 with packaged tool + Nix install surfaces, matching current Zara Core PLUGIN_API_VERSION = "1". No registry metadata was changed in this slice. security: settings.json/token remain outside the code transaction and untouched; the marker contains only two booleans describing whether code artifacts existed. No plugin code is executed during publication/recovery, no secret values are logged or copied into transaction metadata, and no principal/capability or false-success behavior changed. Core guest/public isolation remains blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658; no plugin-local bypass or sentinel was added. blockers: Do not merge PR #518 until exact-head CI run 34148287479 completes fully green on 550eba0c, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and repository CPU gate. Independent REVIEW should also adversarially check malformed/corrupt transaction-marker behavior and process-death boundaries around marker publication/deletion before merge. next_mode: REVIEW next_target: Adversarially review PR #518 at exact head 550eba0c after CI completion. Verify transaction-marker recovery preserves one coherent generation at every reachable crash boundary, stale no-marker backups cannot clobber a coherent live pair, malformed marker handling fails safely without deleting last-known-good code, cleanup is bounded/idempotent, settings/token/secrets and principal/capability boundaries remain untouched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial review of PR #518 at exact head 550eba0c found a remaining merge-blocking malformed-marker recovery defect. Exact-head CI is fully green and generation-aware commit/recovery is materially better, but _recover_interrupted_publish() mutates one live component before validating the complete transaction-marker schema. A syntactically valid incomplete marker such as {"library_existed": true} can restore/remove the library and then raise on missing wrapper_existed, leaving a mixed or missing generation. Marker values are also coerced with bool(...) rather than requiring actual JSON booleans. Recovery therefore does not yet satisfy the recorded fail-safe malformed/corrupt marker requirement.
refs: #518; PR blocker comment #issuecomment-5574507822; CI run 34148287479; lost-rob0t/zara#251; lost-rob0t/zara#658; plugins/zara-discord/lib/zara_discord_service/install.py; plugins.json
head: 550eba0cbc
integration_tests: Existing TDD covers ordinary library/wrapper publication rollback, interrupted missing-live backup recovery, and committed-new-pair plus stale-backup cleanup residue. Review identified the uncovered malformed-marker boundary: incomplete/wrong-type marker data can trigger partial live mutation before validation failure. No new test currently proves zero mutation for malformed/corrupt markers.
registry_package_tests: Exact-head CI run 34148287479 PASS in full on 550eba0c: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package/Nix builds, and zara-avatar idle CPU budget. Current registry remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces.
security: No principal/capability bypass, secret exposure, plugin-code execution during install validation, false-success sentinel, or settings/token mutation found in the changed paths. Core guest/public principal isolation remains open/blocked on lost-rob0t/zara#251, and canonical unavailable-vs-ready lifecycle state remains open/blocked on lost-rob0t/zara#658. The blocker is install correctness: malformed local transaction metadata can partially rewrite live code before failure.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: PR #518 must not merge until transaction-marker parsing/schema validation is fully non-destructive before any component recovery. Incomplete, extra/wrong-type/corrupt marker states must either be rejected with zero live/backup mutation or handled by a deterministic safe recovery policy; pair recovery must not begin until the whole marker is validated.
next_mode: IMPLEMENT
next_target: Repair PR #518 tests-first for malformed/corrupt transaction markers. Add RED cases for missing keys, non-boolean values, and invalid JSON proving zero live/backup mutation before rejection/cleanup; minimally parse and validate the complete marker into a typed state before touching either artifact, then recover the pair as one generation. Rerun focused installer tests and every exact-head compatibility/registry/plugin/Nix gate, keep #518 unmerged until green, then return to REVIEW.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial review of PR #518 at exact head 550eba0c found a remaining merge-blocking malformed-marker recovery defect. Exact-head CI is fully green and generation-aware commit/recovery is materially better, but `_recover_interrupted_publish()` mutates one live component before validating the complete transaction-marker schema. A syntactically valid incomplete marker such as `{"library_existed": true}` can restore/remove the library and then raise on missing `wrapper_existed`, leaving a mixed or missing generation. Marker values are also coerced with `bool(...)` rather than requiring actual JSON booleans. Recovery therefore does not yet satisfy the recorded fail-safe malformed/corrupt marker requirement. refs: #518; PR blocker comment #issuecomment-5574507822; CI run 34148287479; lost-rob0t/zara#251; lost-rob0t/zara#658; plugins/zara-discord/lib/zara_discord_service/install.py; plugins.json head: 550eba0cbc3bc8af0429a05caf7f66e5a40fa260 integration_tests: Existing TDD covers ordinary library/wrapper publication rollback, interrupted missing-live backup recovery, and committed-new-pair plus stale-backup cleanup residue. Review identified the uncovered malformed-marker boundary: incomplete/wrong-type marker data can trigger partial live mutation before validation failure. No new test currently proves zero mutation for malformed/corrupt markers. registry_package_tests: Exact-head CI run 34148287479 PASS in full on 550eba0c: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package/Nix builds, and zara-avatar idle CPU budget. Current registry remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces. security: No principal/capability bypass, secret exposure, plugin-code execution during install validation, false-success sentinel, or settings/token mutation found in the changed paths. Core guest/public principal isolation remains open/blocked on lost-rob0t/zara#251, and canonical unavailable-vs-ready lifecycle state remains open/blocked on lost-rob0t/zara#658. The blocker is install correctness: malformed local transaction metadata can partially rewrite live code before failure. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: PR #518 must not merge until transaction-marker parsing/schema validation is fully non-destructive before any component recovery. Incomplete, extra/wrong-type/corrupt marker states must either be rejected with zero live/backup mutation or handled by a deterministic safe recovery policy; pair recovery must not begin until the whole marker is validated. next_mode: IMPLEMENT next_target: Repair PR #518 tests-first for malformed/corrupt transaction markers. Add RED cases for missing keys, non-boolean values, and invalid JSON proving zero live/backup mutation before rejection/cleanup; minimally parse and validate the complete marker into a typed state before touching either artifact, then recover the pair as one generation. Rerun focused installer tests and every exact-head compatibility/registry/plugin/Nix gate, keep #518 unmerged until green, then return to REVIEW.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Repaired PR #518 tests-first for malformed/corrupt transaction-marker recovery. RED commit 8575766da3 adds missing-key, non-boolean, extra-key, and invalid-JSON cases that require zero live/backup/marker/settings/token mutation and bounded staging cleanup. GREEN commit 37bbd7ffaa now parses and validates the complete marker before any component recovery, requires exactly the two expected keys with actual JSON booleans, emits only bounded generic marker errors, and cleans only staging artifacts when validation fails.
refs: #518; PR comment #issuecomment-5574999310; RED 8575766da3; GREEN 37bbd7ffaa; CI run 34156522933; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 37bbd7ffaa
integration_tests: New malformed-marker regressions are committed before the implementation and are included in the exact-head plugin-test phase. The tests-first CI run 34156498524 was cancelled by the newer push before execution completed, so exact RED execution is not claimed. Exact-head CI 34156522933 is in progress; whitespace and compatibility gate contract checks are PASS, source compatibility diagnostics are running, and installed compatibility, registry/plugin tests, package/Nix builds, and CPU gate remain pending.
registry_package_tests: Re-read current branch registry/source: plugins.json remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces; current Zara Core still exposes PLUGIN_API_VERSION = "1". No registry/Nix metadata changed in this slice. Full exact-head registry/plugin/package gates are pending in run 34156522933.
security: Marker parsing is fail-closed before live-code mutation and does not include marker contents in raised error text. settings.json/token remain outside the transaction and untouched; no plugin code is executed during install validation/recovery. No principal/capability, permission, or false-success behavior changed. Guest/public principal isolation remains structurally blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658; no plugin-local bypass/sentinel was added.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: Keep PR #518 unmerged until exact-head CI run 34156522933 is fully green on 37bbd7f, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and CPU gate. Independent review must verify marker-validation rejection really leaves both code generations and recovery evidence untouched, and re-check crash boundaries around marker creation/commit.
next_mode: REVIEW
next_target: Adversarially review PR #518 at exact head 37bbd7ffaa after CI completion. Verify malformed marker cases reject before any live/backup mutation, typed schema is strict and bounded, staging cleanup cannot erase recovery evidence, every reachable marker publication/deletion crash boundary preserves one coherent generation, settings/token/secrets and principal/capability boundaries remain untouched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Repaired PR #518 tests-first for malformed/corrupt transaction-marker recovery. RED commit 8575766da3fe3176ce178dca9de0d9d79bc086da adds missing-key, non-boolean, extra-key, and invalid-JSON cases that require zero live/backup/marker/settings/token mutation and bounded staging cleanup. GREEN commit 37bbd7ffaa2c2ac56f6ada148a2940c60321296b now parses and validates the complete marker before any component recovery, requires exactly the two expected keys with actual JSON booleans, emits only bounded generic marker errors, and cleans only staging artifacts when validation fails. refs: #518; PR comment #issuecomment-5574999310; RED 8575766da3fe3176ce178dca9de0d9d79bc086da; GREEN 37bbd7ffaa2c2ac56f6ada148a2940c60321296b; CI run 34156522933; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 37bbd7ffaa2c2ac56f6ada148a2940c60321296b integration_tests: New malformed-marker regressions are committed before the implementation and are included in the exact-head plugin-test phase. The tests-first CI run 34156498524 was cancelled by the newer push before execution completed, so exact RED execution is not claimed. Exact-head CI 34156522933 is in progress; whitespace and compatibility gate contract checks are PASS, source compatibility diagnostics are running, and installed compatibility, registry/plugin tests, package/Nix builds, and CPU gate remain pending. registry_package_tests: Re-read current branch registry/source: plugins.json remains schema v1 and advertises zara-discord 0.3.0 / api_version 1 with tool + Nix install surfaces; current Zara Core still exposes PLUGIN_API_VERSION = "1". No registry/Nix metadata changed in this slice. Full exact-head registry/plugin/package gates are pending in run 34156522933. security: Marker parsing is fail-closed before live-code mutation and does not include marker contents in raised error text. settings.json/token remain outside the transaction and untouched; no plugin code is executed during install validation/recovery. No principal/capability, permission, or false-success behavior changed. Guest/public principal isolation remains structurally blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains blocked on lost-rob0t/zara#658; no plugin-local bypass/sentinel was added. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: Keep PR #518 unmerged until exact-head CI run 34156522933 is fully green on 37bbd7f, including source/installed compatibility diagnostics, registry/plugin tests, package/Nix builds, and CPU gate. Independent review must verify marker-validation rejection really leaves both code generations and recovery evidence untouched, and re-check crash boundaries around marker creation/commit. next_mode: REVIEW next_target: Adversarially review PR #518 at exact head 37bbd7ffaa2c2ac56f6ada148a2940c60321296b after CI completion. Verify malformed marker cases reject before any live/backup mutation, typed schema is strict and bounded, staging cleanup cannot erase recovery evidence, every reachable marker publication/deletion crash boundary preserves one coherent generation, settings/token/secrets and principal/capability boundaries remain untouched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial REVIEW passed PR #518 at exact head 37bbd7ffaa2c2ac56f6ada148a2940c60321296b; exact-head CI is fully green, malformed marker recovery is non-destructive before full schema validation, the transaction marker correctly brackets one coherent library+wrapper generation across reachable process-interruption boundaries, and no in-scope security/compatibility blocker remains. Posted review PASS and merged #518 as main commit dbcc7a763cad688f057394d38b6744825738f723.
refs: #518; PR review PASS comment #issuecomment-5575430574; merge dbcc7a763cad688f057394d38b6744825738f723; exact-head CI run 34156522933; lost-rob0t/zara#251; lost-rob0t/zara#658
head: dbcc7a763c (merged main); reviewed PR head 37bbd7ffaa
integration_tests: Exact-head CI PASS. Installer TDD covers ordinary library/wrapper publication rollback, interrupted missing-live backup recovery, committed-new-pair with stale cleanup backups, and malformed markers (missing/extra keys, wrong types, invalid JSON) requiring zero live/backup/marker/settings/token mutation before rejection. Review additionally walked marker creation, live->backup, staged publication, wrapper publication, marker commit deletion, and post-commit backup-cleanup boundaries; each reachable process-interruption state preserves or deterministically restores one coherent generation.
registry_package_tests: Exact-head run 34156522933 PASS: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package/Nix builds, and zara-avatar CPU gate. Registry/source remain aligned at zara-discord 0.3.0 / Plugin API v1 with packaged tool + Nix install surfaces.
security: No principal/capability bypass, permission weakening, secret exposure, raw marker-content leakage, installed-code execution during validation/recovery, or plugin-local false-success sentinel found. settings.json/token stay outside the code transaction. Core guest/public derived-principal isolation remains open on lost-rob0t/zara#251; canonical unavailable-vs-ready lifecycle state remains open on lost-rob0t/zara#658.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: No blocker remains for #518; merged. Highest-priority zara-discord principal/capability isolation is still dependency-blocked on Core #251, and unavailable lifecycle semantics remain blocked on Core #658. zara-org-todos remains dependency-gated by its Core replacement/composition seam.
next_mode: RESEARCH
next_target: Reconcile the post-#518 ecosystem and select the highest-value dependency-satisfied integration/registry gap. Start with registry/install/update/remove integrity across tool + Nix/Home Manager surfaces (especially uninstall/update false-success, stale discovered metadata, and cleanup/rollback semantics); only return to zara-discord principal isolation if Core #251 becomes dependency-satisfied.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial REVIEW passed PR #518 at exact head `37bbd7ffaa2c2ac56f6ada148a2940c60321296b`; exact-head CI is fully green, malformed marker recovery is non-destructive before full schema validation, the transaction marker correctly brackets one coherent library+wrapper generation across reachable process-interruption boundaries, and no in-scope security/compatibility blocker remains. Posted review PASS and merged #518 as main commit `dbcc7a763cad688f057394d38b6744825738f723`. refs: #518; PR review PASS comment #issuecomment-5575430574; merge `dbcc7a763cad688f057394d38b6744825738f723`; exact-head CI run 34156522933; lost-rob0t/zara#251; lost-rob0t/zara#658 head: dbcc7a763cad688f057394d38b6744825738f723 (merged main); reviewed PR head 37bbd7ffaa2c2ac56f6ada148a2940c60321296b integration_tests: Exact-head CI PASS. Installer TDD covers ordinary library/wrapper publication rollback, interrupted missing-live backup recovery, committed-new-pair with stale cleanup backups, and malformed markers (missing/extra keys, wrong types, invalid JSON) requiring zero live/backup/marker/settings/token mutation before rejection. Review additionally walked marker creation, live->backup, staged publication, wrapper publication, marker commit deletion, and post-commit backup-cleanup boundaries; each reachable process-interruption state preserves or deterministically restores one coherent generation. registry_package_tests: Exact-head run 34156522933 PASS: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, registry/plugin tests, plugin package/Nix builds, and zara-avatar CPU gate. Registry/source remain aligned at zara-discord 0.3.0 / Plugin API v1 with packaged tool + Nix install surfaces. security: No principal/capability bypass, permission weakening, secret exposure, raw marker-content leakage, installed-code execution during validation/recovery, or plugin-local false-success sentinel found. settings.json/token stay outside the code transaction. Core guest/public derived-principal isolation remains open on lost-rob0t/zara#251; canonical unavailable-vs-ready lifecycle state remains open on lost-rob0t/zara#658. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: No blocker remains for #518; merged. Highest-priority zara-discord principal/capability isolation is still dependency-blocked on Core #251, and unavailable lifecycle semantics remain blocked on Core #658. zara-org-todos remains dependency-gated by its Core replacement/composition seam. next_mode: RESEARCH next_target: Reconcile the post-#518 ecosystem and select the highest-value dependency-satisfied integration/registry gap. Start with registry/install/update/remove integrity across tool + Nix/Home Manager surfaces (especially uninstall/update false-success, stale discovered metadata, and cleanup/rollback semantics); only return to zara-discord principal isolation if Core #251 becomes dependency-satisfied.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: RESEARCH
result: Reconciled post-#518 registry/install state and froze the next highest-value dependency-satisfied slice as zara-local-recall transactional installer/update rollback. Current main is dbcc7a763c. zara-local-recall 0.1.0 / Plugin API v1 is registry-aligned and exposed through both packaged tool + Nix app surfaces, but its imperative installer still deletes the live lib before renaming staging into place and publishes the discovery wrapper afterward with a separate copy. A failure during either step can destroy or version-skew a previously working install. Existing installer tests only prove successful placement/idempotence/staging cleanup; they do not cover failed library publication, failed wrapper publication, interrupted-update recovery, or preservation of last-known-good code.
refs: #508; merged #518; main dbcc7a763c; plugins/zara-local-recall/tools/zara-local-recall; plugins/zara-local-recall/test/test_install.py; plugins.json; flake.nix; lost-rob0t/zara#251; lost-rob0t/zara#658
head: dbcc7a763c
integration_tests: not run in RESEARCH. Source inspection shows zara-local-recall installer currently does rmtree(library_dir) followed by staging.rename(library_dir), then separately copyfile(entry_source, plugin_entry). Current deterministic installer tests cover only initial install and idempotent re-install; no failure-injection or interrupted-update rollback coverage exists.
registry_package_tests: not run in RESEARCH. Current plugins.json is schema v1, updated 2026-09-07, and advertises zara-local-recall 0.1.0 / api_version 1 with python3 plugins/zara-local-recall/tools/zara-local-recall install and nix run github:lost-rob0t/zara-plugins#zara-local-recall -- install. flake.nix packages the tool and immutable runtime layout generically from registry metadata, so the imperative tool remains a supported install surface and must not false-succeed or corrupt an existing install.
security: No principal/capability boundary change is proposed. Local Recall remains an owner-local integration; this slice is install correctness only. Preserve existing config/daemon policy files, never execute installed plugin code during copy/validation, never log secret/token material, and never use a plugin-local workaround for Discord guest authorization or lifecycle state. Core guest/public isolation remains open on lost-rob0t/zara#251; canonical unavailable-vs-ready lifecycle state remains open on lost-rob0t/zara#658.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: none for the frozen zara-local-recall installer slice. zara-discord principal isolation remains dependency-blocked on Core #251; zara-org-todos remains dependency-gated by its Core replacement/composition seam. No overlapping open zara-local-recall issue/PR was found beyond worker #508.
next_mode: IMPLEMENT
next_target: zara-local-recall transactional installer/update rollback — tests first in test_install.py for an existing coherent install where library publication fails and where wrapper publication fails; require the prior library+wrapper pair remains intact, staging/backup cleanup is bounded, unrelated config/state remains untouched, and fresh/successful update publishes one coherent new pair. Reuse the now-reviewed transaction pattern from zara-discord where appropriate rather than inventing a second semantics, but keep the diff local to zara-local-recall. Then run focused Local Recall tests plus exact-head registry/compatibility/plugin/Nix gates and open a focused PR; no direct main commit.

WORKER_STATE worker: plugin-d mode_used: RESEARCH result: Reconciled post-#518 registry/install state and froze the next highest-value dependency-satisfied slice as zara-local-recall transactional installer/update rollback. Current main is dbcc7a763cad688f057394d38b6744825738f723. zara-local-recall 0.1.0 / Plugin API v1 is registry-aligned and exposed through both packaged tool + Nix app surfaces, but its imperative installer still deletes the live `lib` before renaming staging into place and publishes the discovery wrapper afterward with a separate copy. A failure during either step can destroy or version-skew a previously working install. Existing installer tests only prove successful placement/idempotence/staging cleanup; they do not cover failed library publication, failed wrapper publication, interrupted-update recovery, or preservation of last-known-good code. refs: #508; merged #518; main dbcc7a763cad688f057394d38b6744825738f723; plugins/zara-local-recall/tools/zara-local-recall; plugins/zara-local-recall/test/test_install.py; plugins.json; flake.nix; lost-rob0t/zara#251; lost-rob0t/zara#658 head: dbcc7a763cad688f057394d38b6744825738f723 integration_tests: not run in RESEARCH. Source inspection shows `zara-local-recall` installer currently does `rmtree(library_dir)` followed by `staging.rename(library_dir)`, then separately `copyfile(entry_source, plugin_entry)`. Current deterministic installer tests cover only initial install and idempotent re-install; no failure-injection or interrupted-update rollback coverage exists. registry_package_tests: not run in RESEARCH. Current plugins.json is schema v1, updated 2026-09-07, and advertises zara-local-recall 0.1.0 / api_version 1 with `python3 plugins/zara-local-recall/tools/zara-local-recall install` and `nix run github:lost-rob0t/zara-plugins#zara-local-recall -- install`. flake.nix packages the tool and immutable runtime layout generically from registry metadata, so the imperative tool remains a supported install surface and must not false-succeed or corrupt an existing install. security: No principal/capability boundary change is proposed. Local Recall remains an owner-local integration; this slice is install correctness only. Preserve existing config/daemon policy files, never execute installed plugin code during copy/validation, never log secret/token material, and never use a plugin-local workaround for Discord guest authorization or lifecycle state. Core guest/public isolation remains open on lost-rob0t/zara#251; canonical unavailable-vs-ready lifecycle state remains open on lost-rob0t/zara#658. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: none for the frozen zara-local-recall installer slice. zara-discord principal isolation remains dependency-blocked on Core #251; zara-org-todos remains dependency-gated by its Core replacement/composition seam. No overlapping open zara-local-recall issue/PR was found beyond worker #508. next_mode: IMPLEMENT next_target: zara-local-recall transactional installer/update rollback — tests first in `test_install.py` for an existing coherent install where library publication fails and where wrapper publication fails; require the prior library+wrapper pair remains intact, staging/backup cleanup is bounded, unrelated config/state remains untouched, and fresh/successful update publishes one coherent new pair. Reuse the now-reviewed transaction pattern from zara-discord where appropriate rather than inventing a second semantics, but keep the diff local to zara-local-recall. Then run focused Local Recall tests plus exact-head registry/compatibility/plugin/Nix gates and open a focused PR; no direct main commit.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Completed one bounded zara-local-recall transactional installer/update rollback slice in PR #521. Tests were committed first at e8b6d2fd02 for failed library publication and failed wrapper publication against an existing coherent install; implementation at 769e276af0 stages the wrapper, backs up the previous library+wrapper pair, restores both on publication failure, and bounds staging/backup cleanup while leaving unrelated Local Recall config state untouched.
refs: #521; RED/tests-first e8b6d2fd02; GREEN 769e276af0; CI run 34167433283; merged #518 pattern reference; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 769e276af0
integration_tests: Added deterministic failure-injection coverage in plugins/zara-local-recall/test/test_install.py. Library-publication failure must preserve the previous wrapper and previous library sentinel; wrapper-publication failure after library publication must restore the prior coherent pair. Both cases require unrelated daemon-policy config to remain byte-stable and transaction scratch to be bounded/removed. Existing fresh install/idempotent coverage remains. Exact-head CI run 34167433283 is currently in progress on the PR head; no green claim yet.
registry_package_tests: No registry/Nix metadata changed. zara-local-recall remains 0.1.0 / Plugin API v1 on both packaged tool and Nix install surfaces as frozen in the prior RESEARCH state. Exact-head registry/compatibility/plugin/package/Nix gates are running in CI 34167433283 and PR #521 must remain unmerged until they pass.
security: Scope is install correctness only. No principal/capability behavior, secret handling, runtime lifecycle semantics, or permissions changed. Unrelated Local Recall config/policy stays outside the code transaction; installed plugin code is copied, not executed, during install. Discord guest/public principal isolation remains dependency-blocked on open Core #251 and canonical unavailable-vs-ready lifecycle state remains open on Core #658; no plugin-local bypass/sentinel was introduced.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: No implementation blocker for the bounded exception-rollback slice. Do not merge #521 until exact-head CI is fully green. Independent REVIEW must specifically adversarially inspect process-death/interrupted-update states because this first slice uses fixed backups and in-process rollback; a crash between live->backup/publication/cleanup may still expose last-known-good or mixed-generation recovery gaps similar to the defects previously found and fixed in zara-discord #518.
next_mode: REVIEW
next_target: Adversarially review PR #521 at exact head 769e276af0 after CI completion. Verify both injected failure paths truly preserve one coherent old pair, fresh/successful update behavior remains correct, fixed-backup startup/cleanup cannot delete the only last-known-good artifact after process death, library+wrapper cannot become mixed generations at any reachable interruption boundary, config/state/secrets and principal/capability boundaries remain untouched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Completed one bounded zara-local-recall transactional installer/update rollback slice in PR #521. Tests were committed first at e8b6d2fd02658e3c2ebac06df239817634f8fdb3 for failed library publication and failed wrapper publication against an existing coherent install; implementation at 769e276af066a8116f5f6c1fb53d1684f4176d5f stages the wrapper, backs up the previous library+wrapper pair, restores both on publication failure, and bounds staging/backup cleanup while leaving unrelated Local Recall config state untouched. refs: #521; RED/tests-first e8b6d2fd02658e3c2ebac06df239817634f8fdb3; GREEN 769e276af066a8116f5f6c1fb53d1684f4176d5f; CI run 34167433283; merged #518 pattern reference; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 769e276af066a8116f5f6c1fb53d1684f4176d5f integration_tests: Added deterministic failure-injection coverage in plugins/zara-local-recall/test/test_install.py. Library-publication failure must preserve the previous wrapper and previous library sentinel; wrapper-publication failure after library publication must restore the prior coherent pair. Both cases require unrelated daemon-policy config to remain byte-stable and transaction scratch to be bounded/removed. Existing fresh install/idempotent coverage remains. Exact-head CI run 34167433283 is currently in progress on the PR head; no green claim yet. registry_package_tests: No registry/Nix metadata changed. zara-local-recall remains 0.1.0 / Plugin API v1 on both packaged tool and Nix install surfaces as frozen in the prior RESEARCH state. Exact-head registry/compatibility/plugin/package/Nix gates are running in CI 34167433283 and PR #521 must remain unmerged until they pass. security: Scope is install correctness only. No principal/capability behavior, secret handling, runtime lifecycle semantics, or permissions changed. Unrelated Local Recall config/policy stays outside the code transaction; installed plugin code is copied, not executed, during install. Discord guest/public principal isolation remains dependency-blocked on open Core #251 and canonical unavailable-vs-ready lifecycle state remains open on Core #658; no plugin-local bypass/sentinel was introduced. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: No implementation blocker for the bounded exception-rollback slice. Do not merge #521 until exact-head CI is fully green. Independent REVIEW must specifically adversarially inspect process-death/interrupted-update states because this first slice uses fixed backups and in-process rollback; a crash between live->backup/publication/cleanup may still expose last-known-good or mixed-generation recovery gaps similar to the defects previously found and fixed in zara-discord #518. next_mode: REVIEW next_target: Adversarially review PR #521 at exact head 769e276af066a8116f5f6c1fb53d1684f4176d5f after CI completion. Verify both injected failure paths truly preserve one coherent old pair, fresh/successful update behavior remains correct, fixed-backup startup/cleanup cannot delete the only last-known-good artifact after process death, library+wrapper cannot become mixed generations at any reachable interruption boundary, config/state/secrets and principal/capability boundaries remain untouched, registry/install/Nix metadata stays aligned, and merge only if every exact-head gate is green.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial review of zara-local-recall PR #521 found a merge-blocking interrupted-update recovery defect: fixed .lib.backup / .zara_local_recall.py.backup files are deleted unconditionally at the start of the next install, so a process killed after live->backup can leave the backup as the only last-known-good copy and the next run will destroy it before recovery. There is also no durable commit/generation marker tying library+wrapper recovery together, so reachable crash boundaries can leave ambiguous/mixed generations. Exact-head CI is independently red.
issue_or_pr: #521; review comment https://github.com/lost-rob0t/zara-plugins/pull/521#issuecomment-5576791251; #508; CI run 34167433283; pattern reference merged #518; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 769e276af0
integration_tests: Existing new deterministic tests prove in-process exception rollback for failed library publication and failed wrapper publication against an existing coherent install, with unrelated daemon-policy config preserved. REVIEW found no interrupted-process/crash-state coverage. Exact-head CI run 34167433283 completed with Run registry and plugin tests FAILURE; source and installed compatibility diagnostics passed, whitespace/compatibility-contract checks passed, avatar CPU passed, and package/Nix build step was skipped after the test failure.
registry_package_tests: Registry at reviewed head remains schema v1 with zara-local-recall 0.1.0 / api_version 1 and both imperative tool + Nix install surfaces. No metadata drift was introduced by #521, but required exact-head registry/plugin/package/Nix gate set is not green because registry/plugin tests failed and package builds were skipped.
security: No principal/capability, secret, permission, or runtime lifecycle changes were introduced in #521. Local Recall config/policy remains outside the code transaction in the changed paths. Discord guest/public isolation is still structurally blocked on open Core #251; canonical unavailable-vs-ready lifecycle semantics remain open on Core #658. No plugin-local bypass or false-success workaround was introduced.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: #521 must not merge. Crash after library_dir.rename(.lib.backup) and before coherent commit can leave .lib.backup as the only good library, but the next install immediately deletes it. Similar single-component/mixed-generation crash states are not recoverable without durable generation/commit evidence. Exact-head CI is also red in registry/plugin tests and skipped package builds.
next_mode: IMPLEMENT
next_target: Repair #521 tests-first for interrupted-update recovery. Add RED state-based tests for process death after library backup, after library publication before wrapper backup/publication, after wrapper backup/publication before commit, and during cleanup. Preserve pre-existing recovery backups, recover/rollback library+wrapper as one generation, and use a durable strictly validated transaction/commit marker (or equivalent atomic generation scheme) before deleting recovery evidence, reusing the reviewed zara-discord #518 semantics where practical. Keep Local Recall config/policy and security boundaries untouched, diagnose/fix the current registry/plugin test failure if caused by the branch, then rerun focused Local Recall plus exact-head registry/compatibility/plugin/package/Nix gates; no direct main commit.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial review of zara-local-recall PR #521 found a merge-blocking interrupted-update recovery defect: fixed `.lib.backup` / `.zara_local_recall.py.backup` files are deleted unconditionally at the start of the next install, so a process killed after live->backup can leave the backup as the only last-known-good copy and the next run will destroy it before recovery. There is also no durable commit/generation marker tying library+wrapper recovery together, so reachable crash boundaries can leave ambiguous/mixed generations. Exact-head CI is independently red. issue_or_pr: #521; review comment https://github.com/lost-rob0t/zara-plugins/pull/521#issuecomment-5576791251; #508; CI run 34167433283; pattern reference merged #518; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 769e276af066a8116f5f6c1fb53d1684f4176d5f integration_tests: Existing new deterministic tests prove in-process exception rollback for failed library publication and failed wrapper publication against an existing coherent install, with unrelated daemon-policy config preserved. REVIEW found no interrupted-process/crash-state coverage. Exact-head CI run 34167433283 completed with `Run registry and plugin tests` FAILURE; source and installed compatibility diagnostics passed, whitespace/compatibility-contract checks passed, avatar CPU passed, and package/Nix build step was skipped after the test failure. registry_package_tests: Registry at reviewed head remains schema v1 with zara-local-recall 0.1.0 / api_version 1 and both imperative tool + Nix install surfaces. No metadata drift was introduced by #521, but required exact-head registry/plugin/package/Nix gate set is not green because registry/plugin tests failed and package builds were skipped. security: No principal/capability, secret, permission, or runtime lifecycle changes were introduced in #521. Local Recall config/policy remains outside the code transaction in the changed paths. Discord guest/public isolation is still structurally blocked on open Core #251; canonical unavailable-vs-ready lifecycle semantics remain open on Core #658. No plugin-local bypass or false-success workaround was introduced. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: #521 must not merge. Crash after `library_dir.rename(.lib.backup)` and before coherent commit can leave `.lib.backup` as the only good library, but the next install immediately deletes it. Similar single-component/mixed-generation crash states are not recoverable without durable generation/commit evidence. Exact-head CI is also red in registry/plugin tests and skipped package builds. next_mode: IMPLEMENT next_target: Repair #521 tests-first for interrupted-update recovery. Add RED state-based tests for process death after library backup, after library publication before wrapper backup/publication, after wrapper backup/publication before commit, and during cleanup. Preserve pre-existing recovery backups, recover/rollback library+wrapper as one generation, and use a durable strictly validated transaction/commit marker (or equivalent atomic generation scheme) before deleting recovery evidence, reusing the reviewed zara-discord #518 semantics where practical. Keep Local Recall config/policy and security boundaries untouched, diagnose/fix the current registry/plugin test failure if caused by the branch, then rerun focused Local Recall plus exact-head registry/compatibility/plugin/package/Nix gates; no direct main commit.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: IMPLEMENT
result: Repaired zara-local-recall PR #521 for the REVIEWed interrupted-update hole by adding tests-first crash-state coverage and porting the already-reviewed zara-discord #518 generation/commit protocol. Local Recall now uses a strict durable transaction marker to tie library+wrapper recovery together, restores the pre-update pair while the marker exists, treats marker deletion as the commit point, and prevents stale post-commit backups from clobbering a coherent live generation. Existing exception tests were retargeted to the atomic os.replace publication boundary.
issue_or_pr: #521; test commit 4abed8ac73; implementation commit 162be23f10; test-boundary commit 85f620a8d2; PR comment #issuecomment-5577276482; CI run 34173884208; pattern reference merged #518; lost-rob0t/zara#251; lost-rob0t/zara#658
head: 85f620a8d2
integration_tests: Added deterministic state-based coverage for process death after live library -> backup, after new-library publication, after wrapper publication before commit, and post-commit stale-backup cleanup residue. Each recovery path is followed by an injected subsequent publication failure and requires one coherent prior/new pair plus bounded scratch cleanup and byte-stable daemon-policy state. Existing in-process failed-library/failed-wrapper rollback tests remain and now inject at the atomic os.replace publication boundary. Exact-head CI 34173884208 is pending; no green claim yet.
registry_package_tests: Re-read current branch plugins.json: schema v1 still advertises zara-local-recall 0.1.0 / api_version 1 with both imperative tool and Nix install surfaces; no registry/Nix metadata changed. Prior exact-head 769e276a had source/installed compatibility + whitespace/contracts + CPU green but registry/plugin tests red and package builds skipped. The branch-side test harness was coupled to the old Path.rename/copyfile publication mechanics; current tests now target the new atomic os.replace boundary. Full exact-head registry/plugin/package/Nix results are pending in run 34173884208.
security: No principal/capability, permission, secret, or runtime lifecycle behavior changed. Local Recall config/policy remains outside the code transaction; transaction metadata contains only strict booleans and installed plugin code is copied/published without execution. Core guest/public isolation remains open/blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains open/blocked on lost-rob0t/zara#658; no plugin-local bypass or false-success sentinel was added.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: Do not merge #521 until exact-head CI run 34173884208 is fully green, including registry/plugin tests and package/Nix builds. Independent REVIEW must adversarially verify strict malformed-marker handling and every marker creation/publication/commit/cleanup crash boundary, because this slice intentionally reuses #518 semantics but still needs Local Recall-specific verification.
next_mode: REVIEW
next_target: Adversarially review PR #521 at exact head 85f620a8d2 after CI completes. Check principal/capability and secret boundaries remain untouched; strict transaction-marker schema fails before live mutation; recovery never mixes library+wrapper generations; stale no-marker backups cannot clobber coherent live code; config/policy remains untouched; registry/source/install/Nix compatibility stays aligned; false-success semantics are not introduced; and merge only if every exact-head gate is green.

WORKER_STATE worker: plugin-d mode_used: IMPLEMENT result: Repaired zara-local-recall PR #521 for the REVIEWed interrupted-update hole by adding tests-first crash-state coverage and porting the already-reviewed zara-discord #518 generation/commit protocol. Local Recall now uses a strict durable transaction marker to tie library+wrapper recovery together, restores the pre-update pair while the marker exists, treats marker deletion as the commit point, and prevents stale post-commit backups from clobbering a coherent live generation. Existing exception tests were retargeted to the atomic os.replace publication boundary. issue_or_pr: #521; test commit 4abed8ac731197eea252b1d8f0af58d4e22e40c5; implementation commit 162be23f106f7c26cc9237d402381837db54900c; test-boundary commit 85f620a8d21cafafd843d8722d125832dedfcce0; PR comment #issuecomment-5577276482; CI run 34173884208; pattern reference merged #518; lost-rob0t/zara#251; lost-rob0t/zara#658 head: 85f620a8d21cafafd843d8722d125832dedfcce0 integration_tests: Added deterministic state-based coverage for process death after live library -> backup, after new-library publication, after wrapper publication before commit, and post-commit stale-backup cleanup residue. Each recovery path is followed by an injected subsequent publication failure and requires one coherent prior/new pair plus bounded scratch cleanup and byte-stable daemon-policy state. Existing in-process failed-library/failed-wrapper rollback tests remain and now inject at the atomic os.replace publication boundary. Exact-head CI 34173884208 is pending; no green claim yet. registry_package_tests: Re-read current branch plugins.json: schema v1 still advertises zara-local-recall 0.1.0 / api_version 1 with both imperative tool and Nix install surfaces; no registry/Nix metadata changed. Prior exact-head 769e276a had source/installed compatibility + whitespace/contracts + CPU green but registry/plugin tests red and package builds skipped. The branch-side test harness was coupled to the old Path.rename/copyfile publication mechanics; current tests now target the new atomic os.replace boundary. Full exact-head registry/plugin/package/Nix results are pending in run 34173884208. security: No principal/capability, permission, secret, or runtime lifecycle behavior changed. Local Recall config/policy remains outside the code transaction; transaction metadata contains only strict booleans and installed plugin code is copied/published without execution. Core guest/public isolation remains open/blocked on lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains open/blocked on lost-rob0t/zara#658; no plugin-local bypass or false-success sentinel was added. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: Do not merge #521 until exact-head CI run 34173884208 is fully green, including registry/plugin tests and package/Nix builds. Independent REVIEW must adversarially verify strict malformed-marker handling and every marker creation/publication/commit/cleanup crash boundary, because this slice intentionally reuses #518 semantics but still needs Local Recall-specific verification. next_mode: REVIEW next_target: Adversarially review PR #521 at exact head 85f620a8d21cafafd843d8722d125832dedfcce0 after CI completes. Check principal/capability and secret boundaries remain untouched; strict transaction-marker schema fails before live mutation; recovery never mixes library+wrapper generations; stale no-marker backups cannot clobber coherent live code; config/policy remains untouched; registry/source/install/Nix compatibility stays aligned; false-success semantics are not introduced; and merge only if every exact-head gate is green.

nsaspy commented

2026-09-08 02:17:51 +00:00

Author

Owner

WORKER_STATE
worker: plugin-d
mode_used: REVIEW
result: Adversarial REVIEW of zara-local-recall PR #521 at exact head 85f620a8d21cafafd843d8722d125832dedfcce0 confirms the generation-aware transaction protocol preserves coherent library+wrapper recovery across the reviewed marker/live->backup/publication/commit/cleanup crash boundaries, but the PR remains merge-blocked: exact-head CI is red in registry/plugin tests with package/Nix builds skipped, and Local Recall lacks malformed/corrupt transaction-marker regressions proving zero mutation before rejection.
refs: #521; REVIEW blocker comment https://github.com/lost-rob0t/zara-plugins/pull/521#issuecomment-5577758973; CI run 34173884208; merged pattern reference #518; lost-rob0t/zara#251; lost-rob0t/zara#658; plugins/zara-local-recall/tools/zara-local-recall; plugins/zara-local-recall/test/test_install.py; plugins.json
head: 85f620a8d2
integration_tests: Source/tests were independently re-read. Crash-state coverage exists for death after library backup, after new-library publication, after wrapper publication before commit, and post-commit stale-backup cleanup residue, plus ordinary library/wrapper publication rollback. REVIEW walked marker creation, recovery while marker exists, component publication, marker deletion commit, and stale post-commit backup handling; no mixed-generation defect found in those paths. Coverage gap remains for invalid JSON, missing/extra marker keys, and non-boolean marker fields with explicit zero-live/backup/marker/config mutation assertions.
registry_package_tests: Exact-head CI run 34173884208 completed FAILURE. PASS: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, zara-avatar CPU. FAIL: Run registry and plugin tests. SKIPPED: Build plugin packages, so the required package/Nix gate is not green. Registry/source at the reviewed head remain aligned at zara-local-recall 0.1.0 / Plugin API v1 with both imperative tool and Nix install surfaces.
security: No principal/capability, permission, secret, or runtime-lifecycle changes are present in #521. Local Recall config/policy remains outside the code transaction; transaction metadata contains only booleans; installed code is published without execution. Discord guest/public principal isolation remains open/blocked on Core lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains open/blocked on Core lost-rob0t/zara#658. No plugin-local authorization or false-success workaround found.
core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658
blockers: #521 must not merge. Exact-head registry/plugin tests are red and package/Nix builds were skipped. Additionally, the recorded malformed-marker safety property is not locally regression-tested even though the implementation currently validates the full marker before recovery.
next_mode: IMPLEMENT
next_target: Repair #521 tests-first: add RED Local Recall malformed/corrupt marker cases (invalid JSON, missing/extra keys, non-boolean values) requiring zero live/backup/marker/config mutation before rejection, diagnose and fix the exact-head registry/plugin test failure with the smallest branch-local change, then rerun focused Local Recall plus every exact-head compatibility/registry/plugin/package/Nix/CPU gate. No direct main commit and keep #521 unmerged until the full exact-head set is green.

WORKER_STATE worker: plugin-d mode_used: REVIEW result: Adversarial REVIEW of zara-local-recall PR #521 at exact head `85f620a8d21cafafd843d8722d125832dedfcce0` confirms the generation-aware transaction protocol preserves coherent library+wrapper recovery across the reviewed marker/live->backup/publication/commit/cleanup crash boundaries, but the PR remains merge-blocked: exact-head CI is red in registry/plugin tests with package/Nix builds skipped, and Local Recall lacks malformed/corrupt transaction-marker regressions proving zero mutation before rejection. refs: #521; REVIEW blocker comment https://github.com/lost-rob0t/zara-plugins/pull/521#issuecomment-5577758973; CI run 34173884208; merged pattern reference #518; lost-rob0t/zara#251; lost-rob0t/zara#658; plugins/zara-local-recall/tools/zara-local-recall; plugins/zara-local-recall/test/test_install.py; plugins.json head: 85f620a8d21cafafd843d8722d125832dedfcce0 integration_tests: Source/tests were independently re-read. Crash-state coverage exists for death after library backup, after new-library publication, after wrapper publication before commit, and post-commit stale-backup cleanup residue, plus ordinary library/wrapper publication rollback. REVIEW walked marker creation, recovery while marker exists, component publication, marker deletion commit, and stale post-commit backup handling; no mixed-generation defect found in those paths. Coverage gap remains for invalid JSON, missing/extra marker keys, and non-boolean marker fields with explicit zero-live/backup/marker/config mutation assertions. registry_package_tests: Exact-head CI run 34173884208 completed FAILURE. PASS: whitespace, compatibility gate contracts, source compatibility diagnostics, installed compatibility diagnostics, zara-avatar CPU. FAIL: `Run registry and plugin tests`. SKIPPED: `Build plugin packages`, so the required package/Nix gate is not green. Registry/source at the reviewed head remain aligned at zara-local-recall 0.1.0 / Plugin API v1 with both imperative tool and Nix install surfaces. security: No principal/capability, permission, secret, or runtime-lifecycle changes are present in #521. Local Recall config/policy remains outside the code transaction; transaction metadata contains only booleans; installed code is published without execution. Discord guest/public principal isolation remains open/blocked on Core lost-rob0t/zara#251 and canonical unavailable-vs-ready lifecycle state remains open/blocked on Core lost-rob0t/zara#658. No plugin-local authorization or false-success workaround found. core_handoffs: lost-rob0t/zara#251; lost-rob0t/zara#658 blockers: #521 must not merge. Exact-head registry/plugin tests are red and package/Nix builds were skipped. Additionally, the recorded malformed-marker safety property is not locally regression-tested even though the implementation currently validates the full marker before recovery. next_mode: IMPLEMENT next_target: Repair #521 tests-first: add RED Local Recall malformed/corrupt marker cases (invalid JSON, missing/extra keys, non-boolean values) requiring zero live/backup/marker/config mutation before rejection, diagnose and fix the exact-head registry/plugin test failure with the smallest branch-local change, then rerun focused Local Recall plus every exact-head compatibility/registry/plugin/package/Nix/CPU gate. No direct main commit and keep #521 unmerged until the full exact-head set is green.

nsaspy referenced this issue

2026-09-08 02:20:15 +00:00

Add structured zara-emacs integration #507