Repository navigation
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6d9a1b086f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a5c71e4a2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 42c5d3e3f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: db1e5d22e7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 052e1c9c1c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 10df9e73b0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7988a06699
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d805610a9c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ce53391f4b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a8a965f4af
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2eccf354dd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2fdd2e4065
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 08aa64222f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2999baaa9c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58da9a3046
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 403c764e27
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 33e6645f1e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 182e4b7f6d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
bffa0df to
41dee76
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5cb2eec77b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jeremi
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
65dcaf7 to
447780d
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b89a5ff5b8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The Coordinator gate refuses, on the whole forward closure, a runtime that reaches anything but product clients, cores, registry-record, and platform crates, a client that reaches the runtime, and any crate outside the facade and CLI reference tooling that depends on a Coordinator crate. The Casework and Scheduling gates refuse the Coordinator from their side, and root CI runs the gate on every Rust change and builds and tests the Coordinator bindings with the others. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
The unified Node.js and Python facades carry the coordinator namespace, and COORDINATOR_CLIENT_FIRST_RELEASE names v0.41.0 as the first release that publishes it, the same way the Scheduling client joins at v0.40.0. The release workflows select the Coordinator bindings from the roster, the assemblers refuse an earlier version unless --include-coordinator asks for local integration, and the client validators refuse a package whose coordinator namespace does not match its version. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Root AGENTS.md describes the Coordinator as explicitly started, finite, reviewed workflows separated by waits that sequence product calls for the caller who started the run, not as the way products connect, and replaces the rule that runtimes may not compose with one that names how they may: only through public product clients under a dependency gate. The Coordinator guide records what it owns, what it never owns, and how to verify a change. CLIENTS.md, the README, DEPLOYMENT.md, PRODUCT-CONTRACT.md and the site configuration reference name the maintained client. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Coordinator refusals now answer as RFC 9457 problem documents, the shape Casework, Messaging, and Scheduling already answer, so a caller handles every Registry Stack product's errors the same way. The runtime holds a closed vocabulary of 40 family.reason codes, each with one status, title, and detail, exported by the problem-catalog example and registered in the identifier catalog under registry-coordinator. Internal error codes map to it at the HTTP boundary only; edge rejections (unknown route, wrong method, oversized or mistyped body, malformed JSON) answer from the same vocabulary, and a missing run and a run the caller may not see both answer run.not-visible. A problem carries type, title, status, detail, code, and traceId, never a submitted value; the former suggestedAction member is dropped, and coordinatorctl keeps its own fix advice. review-completions keeps its 204 and refuses with problems. The OpenAPI document lists the problems each operation can answer. The Rust client accepts a refusal only as an exact problem document whose status, trace, code grammar, and type URI agree, and the Node.js and Python bindings pass its code through unchanged. Security review notes: this changes the refusal surface of every authenticated route. Problems echo no request value, title and detail are fixed per code, 401 keeps WWW-Authenticate: Bearer, every problem keeps cache-control: no-store, and run visibility stays non-oracular: an absent run and another caller's run answer the same document apart from the per-request traceId. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Registry Coordinator joins the release roster at v0.41.0 through COORDINATOR_FIRST_RELEASE, used the way the Messaging constant is. The core shard builds the Linux amd64 coordinator and coordinatorctl, the candidate and rehearsal smoke both and run coordinatorctl init and check, and the coordinator image carries coordinatorctl for the operator commands its deployment runbook runs against the runtime file. Nightlies from that base version record roster profile v2.1, the frozen v2.0 inventory plus Coordinator, so earlier v2.0 manifests stay readable. The image is deny-listed as a public package only. coordinator-candidate and the advisory baseline follow the GHCR bootstrap and a reviewed advisory-evidence rehearsal, as for any new image. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
The changelog opens with the runtime, coordinatorctl, problem documents, the unified clients, the Casework review wait, and the release binaries and image. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Add the Coordinator overview, flow authoring, deployment, and API pages, render its committed OpenAPI contract, gate every Coordinator page and shared-page mention to docsets that ship it, and link the existing configuration reference into the new pages. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
1ae4f58 to
d318e9b
Compare
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
…6-finish Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 313561bfb6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "hold": { | ||
| "description": "The hold being confirmed. Mutually exclusive with `admission`.", |
There was a problem hiding this comment.
When a workflow supplies an appointment with hold, this generated contract accepts it and coordinatorctl test can consume a synthetic success, but scheduling_call unconditionally returns invalid-command whenever hold is present or admission is absent (adapters.rs lines 960-965). A checked and scenario-tested workflow can therefore fail on every production run; generate a direct-admission-only contract or support the advertised hold confirmation in the adapter.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| DecisionProtocol::SystemOne => ["input_tokens", "output_tokens"] | ||
| .iter() | ||
| .any(|key| usage.get(key).is_some_and(|value| value.as_u64().is_none())), |
There was a problem hiding this comment.
When a SystemOne response omits input_tokens or output_tokens, usage.get(key) returns None, making is_some_and(...) false and allowing the incomplete response to advance the workflow. The official SystemOne OpenAPI contract marks both counters as required, so test for a present unsigned integer rather than rejecting only present invalid values.
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b736956678
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "state": { | ||
| "description": "The evaluated state: any JSON object, string or array." | ||
| } |
There was a problem hiding this comment.
The generated contract leaves state unconstrained, so an evaluate-decision mapping that produces null, a boolean, or a number passes both project checking and coordinatorctl test; a synthetic success can then certify the workflow. In production, Evaluation::parse accepts only objects, strings, or arrays and returns decision-invalid-command before dispatch, so the same checked workflow always fails at this step. Add the runtime's state and question constraints to the schema generator and regenerate this contract.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| "required": [ | ||
| "senderProfile", | ||
| "to" | ||
| ], |
There was a problem hiding this comment.
Because only senderProfile and to are required, this contract accepts a submission with neither template nor content (and also accepts both), allowing a scenario with a synthetic success to certify it. The real Messaging runtime calls SubmitMessageRequest::content() and rejects these shapes as request.unprocessable, so every production run using such a checked mapping is permanently refused. Generate a schema that enforces exactly one valid direct or template content shape.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| if !self.audit_path.is_absolute() | ||
| || self.audit_path.components().any(|c| { | ||
| matches!( | ||
| c, | ||
| std::path::Component::ParentDir | std::path::Component::CurDir | ||
| ) | ||
| }) |
There was a problem hiding this comment.
When deployment.auditFile ends in a writer-reserved companion suffix such as .lock (or has a basename beyond the writer limit), this predicate accepts it, so the runtime check reports a valid operator file. open_named later passes the same path to FileDestination::new, which rejects those paths before apply or service startup, making a checked deployment unusable. Run the writer's value-only path validation from DeploymentConfig::findings and mirror it in the generated schema.
AGENTS.md reference: AGENTS.md:L161-L163
Useful? React with 👍 / 👎.
| fn run_id(py: Python<'_>, value: &str) -> PyResult<Uuid> { | ||
| Uuid::parse_str(value) | ||
| .ok() | ||
| .filter(|run| run.to_string() == value) |
There was a problem hiding this comment.
When a Python caller supplies a valid simple, braced, or urn:uuid: run identifier, this canonical-string filter raises invalid-request before I/O even though the Coordinator route and Node binding accept every spelling parsed by Uuid::parse_str. That makes status and all recovery methods unavailable for such identifiers only in Python; remove the extra spelling check and retain parse validation.
AGENTS.md reference: AGENTS.md:L157-L159
Useful? React with 👍 / 👎.
| flows: &Flows, | ||
| remove: &[String], | ||
| ) -> Result<serde_json::Value> { | ||
| let d = config(runtime)?; |
There was a problem hiding this comment.
When a package expects a product connection that the runtime omits or binds to the wrong product—for example, a Messaging call whose logical connection is configured as BReg—coordinatorctl plan still reports the package as installable because this path never calls flows.validate(runtime). The immediately following apply does run that validation and refuses the same inputs, so the plan cannot reliably describe whether its proposed activation is applicable. Validate the loaded flows against the runtime before producing the plan.
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7dddf64242
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| .ok_or_else(|| { | ||
| CoordinatorError::new("request.invalid", "supply a bounded UUID run identifier") | ||
| })?; | ||
| let status = s.store.status_owned(run, &c.actor).await?; |
There was a problem hiding this comment.
When an owner or operator knows the UUID of a run whose flow is not listed in their current policy, status_owned completes before the flow-specific authorization on the next line; its audited wrapper therefore records an accepted status operation (and materializes the protected status) even though the HTTP request is subsequently returned as run.not-visible. Perform the ownership/status lookup without committing an accepted audit outcome, or pass the authorized flows into the audited operation so the durable audit reflects the actual authorization decision.
AGENTS.md reference: products/coordinator/AGENTS.md:L24-L28
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74ff6abfb9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "offering": { | ||
| "type": "string" | ||
| }, |
There was a problem hiding this comment.
When a workflow maps offering to an empty or otherwise invalid Scheduling identifier, this schema accepts it, so coordinatorctl check and a scenario with a synthetic success can certify the workflow. In production, SchedulingClient::availability rejects the selector before I/O and the adapter turns that into invalid-command, making the checked call fail every time. Add the Scheduling offering-identifier bounds and pattern to the schema generator, then regenerate this contract.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| ) -> Result<u64> { | ||
| Self::operator(actor)?; | ||
| self.audited("retention",actor,None, None,async { | ||
| if !(1..=100).contains(&limit)||before>Utc::now(){return Err(refused("retention-invalid","choose a past cutoff and a limit between 1 and 100"));} |
There was a problem hiding this comment.
When the Coordinator host clock is ahead of PostgreSQL, a cutoff that is in the service host's past can still be in the database's future, yet this check accepts it and the subsequent query erases every otherwise-eligible payload completed before that future database instant. Since completed_at is written with PostgreSQL time, validate the cutoff against transaction_timestamp() in the same retention transaction to avoid prematurely and irreversibly deleting recent run payloads under clock skew.
AGENTS.md reference: products/coordinator/AGENTS.md:L52-L54
Useful? React with 👍 / 👎.
| let mut client = self.client().await.map_err(unavailable)?; | ||
| let tx = client.transaction().await.map_err(unavailable)?; | ||
| self.authorize_run(&tx, run, actor).await?; | ||
| self.inspect_runtime(run, runtime).await |
There was a problem hiding this comment.
Each authorized inspection keeps one pooled connection and transaction alive while inspect_runtime opens a second connection; inspect_owned has the same pattern, and retry_same_owned nests through an additional store operation. With 32 concurrent requests—the configured pool size—all callers can hold their first connection while waiting for another, so they time out together and temporarily starve unrelated admissions and worker transactions. Perform authorization and inspection in one transaction, or commit/drop the authorization transaction before awaiting a method that acquires another pooled connection.
Useful? React with 👍 / 👎.
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2c8a9de3e6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "recordId": { | ||
| "type": "string" | ||
| } |
There was a problem hiding this comment.
When a workflow maps recordId to any non-UUID string, this schema accepts it and coordinatorctl test can certify a synthetic success, but the production adapter calls BaseRegistryClient::get_record, which requires a canonical lowercase UUID and converts violations to invalid-command. Encode that UUID spelling constraint here (and the BReg identifier constraint for collection) so checked workflows cannot be guaranteed to fail before I/O.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| "requesterReference": { | ||
| "type": "string" | ||
| }, | ||
| "resultConstraints": true, |
There was a problem hiding this comment.
When resultConstraints is present as null, a scalar, or an array, this unconstrained schema lets the scenario runner accept the call and consume a synthetic success. In production, ReviewCreateRequest deliberately preserves a present null, and submission_digest calls ReviewCreateRequest::check, which rejects every present non-object before dispatch, so the same checked workflow always fails as invalid-command; constrain this member to an object.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| "reason": { | ||
| "type": "string" | ||
| }, |
There was a problem hiding this comment.
When a workflow supplies an empty, overlong, or control-containing cancellation reason, this schema accepts it and a scenario can certify the call, but the real Casework client invokes ReviewCancelRequest::check and rejects that reason before making the request. Add the review protocol's nonempty bounded-text constraints so the generated contract matches the production adapter.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| "additionalProperties": { | ||
| "type": "string" | ||
| }, |
There was a problem hiding this comment.
When an external-get mapping produces a query value longer than 1024 bytes or containing control characters, this schema accepts it and coordinatorctl test can consume a synthetic response, but ExternalHttpConnection::get rejects the command before any request. Represent the adapter's query-value bound in the generated input contract so a scenario cannot certify a workflow that always fails in production.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| { | ||
| "additionalProperties": false, | ||
| "properties": { | ||
| "snapshot": true, |
There was a problem hiding this comment.
When a submitted review context maps snapshot to null, a scalar, or an array, this unconstrained schema accepts it and a scenario can certify a synthetic success. In production, submission_digest invokes ReviewCreateRequest::check, which requires submitted snapshots to be objects and returns invalid-command before dispatch for these shapes; constrain snapshot to an object.
AGENTS.md reference: products/coordinator/AGENTS.md:L48-L51
Useful? React with 👍 / 👎.
| let value: RunList = self.answer(self.send(request).await?).await?; | ||
| if value.runs.len() > query.limit as usize | ||
| || value.next_cursor.as_deref().is_some_and(|cursor| { |
There was a problem hiding this comment.
When a caller requests state=finished or attention=false and the service returns a valid RunList containing excluded effective states, list_page accepts the response because its postcondition checks only page length and cursor syntax. Filtered dashboards and automation can therefore act on rows their query explicitly excluded; reject any returned run whose state does not satisfy the requested state and attention filters. crates/CLIENTS.mdL15-L19
Useful? React with 👍 / 👎.
This branch has not been deployed
2 participants
Institutions need reviewed product calls to survive waits, outages and lost replies while each product keeps its own authority. This PR adds the optional Registry Coordinator runtime and CLI, maintained clients, finite YAML workflows with pure Rhai mappings, and encrypted durable PostgreSQL progress.
The concrete adoption path is BReg application → Casework review → BReg recheck → Messaging notice. A trusted starter derives bounded reviewer context, revision and digest from a real BReg record through maintained client and review-protocol helpers. After approval, Coordinator rereads BReg and submits a notice only while the reviewed revision matches and current contact permission permits it. The recipient comes from that read. Rejection, revision changes and revoked permission have explicit no-message outcomes. Messaging acceptance and observed local email delivery are reported separately.
Usable workflow and operator surfaces
wait-for.onCanceldurably follows an authored withdrawal path under existing cancellation authority. Timeout and operator withdrawal remain distinct; restart, repeated cancellation and reviewer-decision races preserve the actual result and original command.LocalId. Parity tests exercise consuming validators. Deployment planning checks product bindings; offline audit-path validation reuses the shared writer. SystemOne usage checks and Python UUID routes match their owning contracts.Coordinator uses maintained product clients and shared Platform dispatch, fencing, retries, crypto, canonical JSON, strict configuration, OIDC/HTTP, Rhai, audit and activation. The live fixture replaces hand-built JWT/DER signing with maintained dev-token tooling;
bregctl dev tokennow honors existing per-client issuer resource mappings. Runtime product calls cross public APIs; shared Platform crates retain mechanism ownership.The broader operations remain available: BReg reads/actions, Messaging, Scheduling, configured external GETs, typed decision evaluation and Casework review handoff. A run grants no downstream authority. This review gates the notice and grants no registry mutation permission.
Validation
The final review recheck passed 199 maintained PostgreSQL checks (three documented opt-in tests skipped), 138 affected offline tests, 78 schema-enabled library tests, 51 actual native Python binding tests, 26 script tests, schema drift, formatting and Clippy. Owning client, release-tooling and documentation checks also pass.
The real-service proof covers all six reviewed-notice outcomes, a restart while waiting, exactly one local email, lost-response receipt recovery and current-policy refusals. Its actual test timeout was 2.446 seconds; the maintained example retains fourteen days. The independent registered tutorial replay passed on final source
2c8a9de3e62886f96b4179051cdfe4536558a639: all eleven steps, one journey, zero skips or command adjustments, successful restart, one addressed Mailpit email and verified cleanup. The complete 199-check PostgreSQL gate and independent review pass; all 82 state tests pass after the four pool-saturation proofs were serialized. A deterministic 32-session owned-retry regression fails before the fix and passes afterward. Protected CI is pending on this exact source.Compatibility and follow-ups
Protected state is schema v2. Existing v1 namespaces are refused; use the documented fresh-namespace procedure and retain the old runtime for existing runs. Definitions without
onCancelretain ordinary cancellation behavior.Coordinator runtime release enablement remains held until package permissions and advisory evidence are ready. Maintained clients join 0.42. The published 0.41 manifest and artifact inventory remain identical to their tagged versions.
Separate follow-ups cover shared development-issuer tooling, typed product refusal routing stacked on this PR, Evidence/further BReg mutation journeys, and broader workflow-input validation parity. Event-started runs, callbacks and general compensation remain outside this workflow. Casework completion events wake existing waits.