fix: retain modeled wait-path obligations - #243
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (37)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe change adds semantic projection program identity to projection ownership, persisted changes, observations, replay data, query protocol mapping, causal proof, wait-path handling, and command-runtime tests. It also adds migration version 7 and validates identity across restarts and fan-out models. ChangesSemantic projection identity
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant CommandRuntime
participant QueryProtocol
participant ProjectionRepository
participant CausalService
CommandRuntime->>QueryProtocol: request projection observation
QueryProtocol->>ProjectionRepository: read persisted program identity
ProjectionRepository-->>QueryProtocol: return change and observation data
QueryProtocol->>CausalService: provide matching causal evidence
CausalService-->>CommandRuntime: retire overlay and seal receipt
Merge Risk: ⚪ Minimal · up to No actionable merge-blocking risk was identified in the semantic projection identity changes. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Full details: Docstring CoverageExplanation Docstring coverage is 40.23% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 87 functions across 34 files. (3 skipped: 3 unsupported.) ✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
1 participant
Summary
This change makes causal projection evidence identify the semantic projection program that authored it. Modeled wait-path receipts retain their event-derived obligations, and query/live responses use the persisted program identity when they emit observations.
When a cell commits a terminal
succeededreceipt before an asynchronous projection has written its proof, status evaluation checks the retained obligations instead of dropping them. The public command state remainssucceeded; exact matching observations are exposed only after durable proof exists. A proof with a different semantic program identity remains pending.The JavaScript command runtime now treats a terminal
succeededstatus with the complete exact observations as delivered forreceipt.projected, while keeping the accepted optimistic layer until a canonical query or live frame confirms read-model membership. This keeps@loadoperations valid without forcing every operation to become@liveor issuing an unconditional refetch.Why this matters
An aggregate command can be durably accepted before its asynchronous projection is visible. The client must keep its optimistic layer until the exact causal observation arrives, but a physical projector name is not enough to distinguish two program revisions sharing the same owner and topology.
The durable projection change and observation rows now carry the versioned program identity present at commit time. The identity is preserved through SQLite, PostgreSQL, in-memory, replay, and live-wire paths. A nullable
program_idmigration is intentional: pre-migration rows remain readable, but unversioned history cannot mint modeled causal proof or be relabeled by a new active deployment. A valid prior program identity remains distinct from a replacement program, including after a cold restart and during fan-out.This preserves the existing strict causation, model, scope, revision, and incarnation checks. Atomic/direct projections, unselected projections, and legacy physical-name evidence retain their existing paths. The change does not claim queue delivery, projector completion, or record-clock ordering from a command receipt.
Verification
npm test— 388 passed, 0 failednpm run check— passednode --test tests/replica-command-runtime.test.mjs— 73 passed, 0 failedcargo test --features graphql,sqlite --lib— 1,019 passed, 0 failedcargo test --no-default-features --features graphql,sqlite --test graphql_query_protocol -- --nocapture— 17 passed, 0 failedcargo check --features graphql,postgres— passedgraphql_succeeded_status_evaluates_retained_projection_evidence— passed; exercises the SQLite ledger, GraphQLcommandStatus, ordered modeled projector, pending proof, matching proof, and mismatched semantic program identitywire_snapshot_preserves_persisted_modeled_identity_and_receipt_scope— passed; exercises SQLite commit, persisted identity,wire_live_metadata, and public observation token equalitywait_path_observation_proof_requires_the_persisted_semantic_program_identity— passed; covers matching, missing, wrong-program, wrong-causation, wrong-model, cold-restart, and replacement identitiesNo application UI copy or behavior was changed; the JavaScript README documents the delivery-versus-canonical-retirement boundary.