Skip to content

Reject database snapshots for a replaced source selection - #165

Closed
dayebishouji wants to merge 1 commit into
aoci-spec:v0.2.0-linefrom
dayebishouji:fix/database-stale-snapshot
Closed

dayebishouji wants to merge 1 commit into
aoci-spec:v0.2.0-linefrom
dayebishouji:fix/database-stale-snapshot

Conversation

@dayebishouji

Copy link
Copy Markdown
Contributor

Problem

Replacing a database source can leave a valid saved snapshot for its previous selection. The inventory and evidence bundle commands could use that snapshot, and baseline acceptance could write it under the current source ID.

Change

  • Check the saved manifest against the current source declaration before inventory, bundle export, or baseline acceptance.
  • Return database_snapshot_selection_mismatch with instructions to collect a new snapshot.
  • Cover a SQLite path replacement, rejection by all three commands, no baseline write on rejection, and recovery after a fresh snapshot.

The check reuses the selection comparison already used by Database Cognition.

alkor2000 pushed a commit that referenced this pull request Nov 3, 2026
Replacing a database source could leave a valid saved snapshot of its
previous selection. inventory and evidence bundle answered from it, and
baseline accept wrote it as the Baseline under the current source ID.

All three commands now compare the saved manifest with the current source
declaration first, through the selection comparison Database Cognition
already uses, and refuse a mismatch with database_snapshot_selection_mismatch
and an instruction to take a new snapshot; a refused accept writes no
Baseline. A CLI regression replaces a SQLite path, checks the three
refusals and the absent Baseline, and recovers after a fresh snapshot.

Ported from the contributor's branch onto the 0.2.0 line, excluding the
governance assets, which the line re-authors.

Closes #165

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
alkor2000 pushed a commit that referenced this pull request Nov 3, 2026
- CHANGELOG: one Unreleased bullet each for the deletion-only delta proof
  (#164) and the replaced-selection snapshot refusal (#165), both by
  dayebishouji.
- The zh-CN database.error.snapshot_selection message follows its
  neighbours: "数据库source %s", "已保存Snapshot", no spaces around ASCII.
- The delivery contract's paragraph that #164 extended is rewrapped to the
  file's width; no word changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@alkor2000

Copy link
Copy Markdown
Contributor

Landed on v0.2.0-line as b6e6492 with your authorship; the governance files were regenerated on this tree. Without the fix your regression fails at the first inventory after --replace (exit 1 instead of 2), so the stale snapshot really was being read. In c421d41 I aligned the zh-CN message with its neighbours (数据库source %s, 已保存Snapshot) and added a CHANGELOG entry. Closing this PR by hand since the branch is not the default one.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants