feat: integrate Jerry’s Phase 2 turn-delivery line#14
Closed
plotarmordev wants to merge 25 commits into
Closed
Conversation
…y_version (#23) * fix: link candidate matching tolerates prod turns missing stable_key_version Prod observations persist meta.stable_key without stable_key_version; the linker's version-equality gate excluded every real turn so nothing ever linked (live canary 2026-07-21). Normalize only the missing marker (valid stable_key + version None -> v1) on the candidate side; submission identity and exact owner-hash matching unchanged. Prod-shape regressions included. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: guard-regression for candidate identity normalization strictness Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Restores the July change-gate defeated by Phase 2: unchanged re-observations (the overwhelming steady-state for idle workers) short-circuit before any public-sanitizer work, while still triggering submission-link settlement. Any mismatch falls through to the canonical sanitize+merge path. Live daemon burned ~47% CPU in the sanitize family with zero clients (py-spy, 2026-07-21). Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…efuses (herdr 0.7.5 compat) (#25) * fix: resolve terminal-id send targets via agent.list when agent.get refuses Herdr 0.7.5 (auto-update 2026-07-21) stopped resolving terminal-id targets through agent.get; agent.list still publishes terminal_id -> pane_id. On a definite HerdrErrorResponse for a terminal_id binding, fall back to the listing before terminalizing. Live outage: every Telegram->pane command rejected 'could not resolve the private send target' for ~3h; verified fixed E2E (31s round trip). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: regression for agent.list fallback on terminal-id resolution Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…th + component backoff (#26) * perf: gate submission-link sweep off under legacy; de-sanitize settle path; component backoff The settle sweep ran ungated under turn_model=legacy (nothing reads links there) and its candidate loading invoked the full public sanitizer per row per pass — 58% of live daemon CPU (py-spy, 2026-07-21). Sweep now runs only when turn_model != legacy; the settle path reads raw owner/fingerprint/id fields with zero sanitize calls; no-action components back off until their window state can change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: bound the empty-component settle backoff (dual/shadow wedge) A component sweeping with zero candidates stored an indefinite backoff; under dual/shadow with a prod-shape worker (no version marker) no re-arm signal fires on observation, wedging the link until restart or hard TTL. Empty components now defer a bounded 30s instead. Regression covers the exact sequence (verifier-reproduced). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Only validated canonical public (workspace_id, pane_id) pairs feed stable-key derivation; raw observations stay private with an identity_source marker so no observation path can feed divergent representations into the HMAC. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The installed-candidate benchmark needs TENDWIRE_BENCHMARK_HERDRES_ROOT pointing at a herdres checkout; CI has none, so main has been red on this single environmental failure since #29. Proper skipif; with the env set all tests still run. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
herdres sync now uses turn delta (watermarked after bootstrap) instead of full turns lists; the pinned exact sequence predates it. Watermark tokens are run-specific, so they are shape-validated then normalized; the sequence stays exactly comparable. Verified against a fresh herdres main clone (CI's configuration): all 7 benchmark tests pass. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Merged by Gitmoot after policy gate passed.
Empty-installation subscription rejection falls back to a global-only old-shape subscription; agent.list terminal-id fallback fails closed on duplicate matches; id-less error-envelope tolerance scoped to subscription negotiation only. Regressions for each. (plotarmordev's review of our upstream compat PR — these were latent in prod.) Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…owed id-less tolerance) (#39) * fix: port upstream terminal-ID convergence and narrowed id-less tolerance Ports two integration refinements from plotarmordev/tendwire 6975c51: terminal-ID fallback now converges duplicate-identical mapping rows and fails closed only on distinct conflicts or malformed listings; id-less error tolerance narrowed to the exact herdr schema-rejection shape (invalid_request + 'invalid request:' prefix, marked uncorrelated) so correlated server errors and malformed envelopes reconnect instead of downgrading the subscription. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: pin zero-match terminal-id fallback re-raise Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Merged by Gitmoot after policy gate passed.
Merged by Gitmoot after policy gate passed.
…ow floor The outbox round's new tests used 'with sqlite3.connect()' (commits, never closes); leaked WAL sidecar handles perturbed the sidecar-replacement permissions test's entry-set expectations under CI filesystem timing. Adds a regression pinning that retention count-bounds never prune rows younger than the safety floor. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The fd-set assertion in the sidecar-permissions test detects any fd delta across the suite ordering; four net-new bare connects (leaked handles GC'd mid-test under CI timing) remained after the first sweep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
fix: converged deploy set — consumer fix-forward, content capture, outbox hardening, unified identity strip
Owner
Author
|
Closing this cross-fork integration PR. We will wait for Jerry Fane to prepare and submit the upstream PR directly so its scope, branch history, and conflict resolution are contributor-owned and reviewable. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR brings Jerry Fane’s current Tendwire main line back to the upstream repository for review.
It includes the Phase 2 turn-submission and delta model, delivery-aware outbox work, stable-owner and pane-identity convergence, Herdr 0.7.5 compatibility ports, bounded reconciliation/performance work, and the latest SQLite connection-leak fixes from the fork.
Review context
jerryfane/tendwire:mainatc153ef1plotarmordev/tendwire:mainat6975c516ad2e43; the fork is 25 commits ahead of that base while upstream has 7 distinct commits.Validation
Fork-side tests and CI are represented by the branch history. Upstream review and CI should be treated as authoritative for this integration.