github-devloop implementation for #50

[chronoai-fkst]

github-devloop implementation PR for issue #50

[chronoai-fkst]

github-devloop PR child open

[chronoai-fkst]

github-devloop PR is ready for review

[chronoai-fkst]

github-devloop PR is ready for review

[chronoai-fkst]

github-devloop PR review decision: reject
Verdicts: teleology=reject parsimony=reject fidelity=reject natural-ownership=reject proportional-containment=reject
Blocking gap: Memory handoff identity mismatch

teleology:
The root claim—restart convergence with equivalent repository semantics—fails under established transactional-outbox/idempotent-projection practice, which requires the durable operationId to be the authoritative insert-once key. No peer claim moves my position; the parsimony claim that Memory substitutes public identity is confirmed by the head: materializeHandoff() queries and inserts using intent.id (control-plane/src/storage/memory-repository.ts:423, control-plane/src/storage/memory-repository.ts:424, control-plane/src/storage/memory-repository.ts:426). Thus the same operationId paired with a different id creates a second handoff instead of throwing "handoff operation integrity failure". Mongo instead upserts by intent.operationId and separately enforces unique id (control-plane/src/storage/mongo-repository.ts:130, control-plane/src/storage/mongo-repository.ts:572). The shared contract tests changed URL under one operation and changed operation under one public ID, but omit the decisive same-operation/different-ID case (control-plane/src/storage/repository-contract.test.ts:438, control-plane/src/storage/repository-contract.test.ts:440). This directly violates the stated requirements for operation-keyed materialization, handoff-ID collision rejection, and Memory/Mongo equivalence; no proof justifies deviating from the established identity rule.

parsimony:
Established transactional-outbox/durable-intent practice requires idempotent projection by the immutable operation identity; no evidence shows that practice is inapplicable. The root requirement explicitly makes operationId the insert-once identity and requires Memory/Mongo equivalence. The unanimous peer claims reinforce rather than move my position: PendingHandoffIntent separates operationId from public id (control-plane/src/domain/types.ts:72), but MemoryRepository.materializeHandoff() looks up and inserts solely by intent.id (control-plane/src/storage/memory-repository.ts:423). Thus the same operationId with a different id finds no existing entry and creates a second handoff, contrary to the required integrity failure. Mongo instead upserts by _id: intent.operationId and separately enforces unique id (control-plane/src/storage/mongo-repository.ts:130, control-plane/src/storage/mongo-repository.ts:568). The shared contract tests cover changed payload and changed operationId with unchanged id, but omit same operationId with different id (control-plane/src/storage/repository-contract.test.ts:438). This is a direct stated-requirement failure, not advisory scope expansion.

fidelity:
Established transactional-outbox/durable-intent practice requires idempotent projection by the authoritative operation identity, with public identity enforced separately; no evidence shows that practice is inapplicable. The peers corroborate rather than defeat the root claim. PendingHandoffIntent distinguishes internal operationId from public id (control-plane/src/domain/types.ts:72), but MemoryRepository.materializeHandoff() queries and inserts solely by intent.id (control-plane/src/storage/memory-repository.ts:423). Thus, retrying the same operationId with a different id creates a second handoff instead of the required integrity failure. Mongo correctly upserts by operationId and separately detects either identity (control-plane/src/storage/mongo-repository.ts:568), so repository equivalence fails. The shared contract tests same-operation/different-URL and different-operation/same-ID, but omit same-operation/different-ID (control-plane/src/storage/repository-contract.test.ts:438). This directly violates the stated insert-once-by-operation-identity and handoff-ID collision requirements.

natural-ownership:
Established transactional-outbox/durable-intent practice governs: the aggregate owns immutable intent, and projection is idempotent by authoritative operation identity. No peer claim moves my position; teleology’s “same operationId with a different handoff id creates a second record” claim independently confirms the root defect. PendingHandoffIntent defines operationId separately from public id (control-plane/src/domain/types.ts:72), but Memory queries and inserts solely by intent.id (control-plane/src/storage/memory-repository.ts:423), whereas Mongo keys materialization by intent.operationId and separately enforces unique public IDs (control-plane/src/storage/mongo-repository.ts:130, control-plane/src/storage/mongo-repository.ts:568). Thus one operation replayed with another public ID bypasses collision detection in Memory, violating the explicit operation-idempotency and repository-equivalence requirements. The contract tests cover changed URL and changed operation with unchanged public ID, but not unchanged operation with changed public ID (control-plane/src/storage/repository-contract.test.ts:438), so they do not defeat the objection. No evidence proves established operation-identity practice is inapplicable.

proportional-containment:
Established transactional-outbox/durable-intent practice requires projections to be idempotent by the immutable operation identity, with public identifiers treated as secondary lookup keys; no evidence justifies deviating here. The root claim—one logical handoff converges across retries and restarts—fails because MemoryRepository.materializeHandoff() queries and inserts solely by public intent.id (control-plane/src/storage/memory-repository.ts:423), so the same operationId paired with a different id creates a second record instead of throwing "handoff operation integrity failure" (control-plane/src/storage/memory-repository.ts:424, control-plane/src/storage/memory-repository.ts:426). Any counterclaim that link-ID uniqueness is sufficient is defeated by the model’s explicit separation of operationId and id (control-plane/src/domain/types.ts:72) and Mongo’s operation-keyed upsert plus separate unique public-ID index (control-plane/src/storage/mongo-repository.ts:130, control-plane/src/storage/mongo-repository.ts:572). The teleology, parsimony, fidelity, and natural-ownership peers independently identify this same requirement-breaking divergence. Existing tests vary URL under one operation and operation under one link ID, but omit the decisive same-operation/different-link-ID case (control-plane/src/storage/repository-contract.test.ts:438, control-plane/src/storage/repository-contract.test.ts:440), so they cannot establish Memory/Mongo equivalence.

⟦AI:FKST⟧

[chronoai-fkst]

github-devloop merge gate failed: Memory handoff identity mismatch
Reproduce locally with scripts/run.sh test from the repository root.

[chronoai-fkst]

github-devloop fix pushed for re-review

Previous reviewed head: cbfd331
New head: 1eeda8e

[chronoai-fkst]

github-devloop PR is ready for review

[chronoai-fkst]

github-devloop PR review decision: approve
Verdicts: teleology=approve parsimony=approve fidelity=approve natural-ownership=approve proportional-containment=approve

teleology:
ESSENCE: This is a dual-write convergence problem: a Task transition must survive crashes while its derived handoff remains reproducible and consumable once. Established transactional-outbox/durable-intent practice makes an immutable operation identity authoritative, with idempotent projection and generation-fenced compare-and-set consumption. IDEAL: atomically store complete replay authority in the Task aggregate, materialize by operationId, reject every identity collision, and consume against current Task authority. The named gap is closed: MemoryRepository.materializeHandoff() now searches by operationId before checking public id, and rejects any non-identical match with "handoff operation integrity failure" (control-plane/src/storage/memory-repository.ts:423, control-plane/src/storage/memory-repository.ts:430); the shared Memory/Mongo contract now exercises the decisive same-operation/different-link case (control-plane/src/storage/repository-contract.test.ts:428). This matches Mongo’s operation-keyed upsert and full-record comparison (control-plane/src/storage/mongo-repository.ts:572, control-plane/src/storage/mongo-repository.ts:582). Six smells: no magic numbers were introduced by the fix; no proxy-over-truth because operationId remains the projection identity; no symptom branch because one complete-record rule handles both identity collision directions; no narrative-over-verification because the missing contract assertion is now executable; no missing-inevitability because the implementation is forced by the issue’s explicit operation-keyed semantics; no skipped-purpose because the change restores Memory/Mongo restart-convergence equivalence rather than merely making the prior test pass.

parsimony:
ESSENCE: This is a dual-write convergence problem governed by transactional-outbox/durable-intent practice: immutable aggregate-owned authority is projected idempotently by an internal operation identity, while public identity remains a separately validated lookup key. IDEAL: persist the complete generation-fenced intent atomically with the Task transition; materialize insert-once by operationId; reject divergence in any field, including id; consume once through current Task authority. SIX SMELLS: The named gap is closed. Memory now searches first by operationId, then by public id, and applies the complete sameHandoff integrity check, matching Mongo’s operation-keyed upsert and secondary public-ID collision handling (control-plane/src/storage/memory-repository.ts:423, control-plane/src/storage/mongo-repository.ts:568). The formerly absent same-operation/different-link test is added and the shared contract runs against both Memory and Mongo (control-plane/src/storage/repository-contract.test.ts:428, control-plane/src/storage/repository-contract.test.ts:2737, control-plane/src/storage/repository-contract.test.ts:2742). No magic number or symptom branch was introduced; the single additional identity lookup expresses the governing invariant. There is no proxy-over-truth because operationId is now authoritative, no narrative-over-verification because the exact regression is tested, no missing-inevitability because the two identities are explicitly distinct (control-plane/src/domain/types.ts:72), and no skipped-purpose because the change directly restores repository-equivalent restart convergence.

fidelity:
Established practice is transactional-outbox/durable-intent design: persist immutable operation authority with the aggregate, project idempotently by that operation identity, retain public identifiers as secondary keys, and verify exact collisions through shared repository contracts. ESSENCE: one logical handoff must remain one handoff across retries and restarts; neither a public-link variation nor a storage implementation may redefine its identity. IDEAL: Task-owned durable intent, operation-keyed insert-once projection, complete-record equality checks, generation-fenced atomic consumption, and deterministic Memory/Mongo contract tests. The named gap is closed: MemoryRepository.materializeHandoff() now searches by operationId before public id, then rejects any non-identical record through sameHandoff, which compares both identities and every authority field (control-plane/src/storage/memory-repository.ts:41, control-plane/src/storage/memory-repository.ts:423). The shared contract now directly proves that an unchanged operation with a changed link ID throws "handoff operation integrity failure" (control-plane/src/storage/repository-contract.test.ts:428), while Mongo remains operation-keyed (control-plane/src/storage/mongo-repository.ts:568). Six smells: magic numbers—none added by the fix; proxy-over-truth—closed because immutable operation identity, not public link identity, governs reconciliation; symptom branches—the lookup expresses the two required uniqueness constraints rather than a failure-specific workaround; narrative-over-verification—closed by the exact previously missing cross-repository test; missing-inevitability—standalone stores require this explicit operation/public-ID dual check; skipped-purpose—preserving one logical handoff and repository equivalence is directly enforced. No in-scope fix regression is evidenced.

natural-ownership:
The named gap is closed. MemoryRepository.materializeHandoff() now locates an existing projection by authoritative operationId before checking the public link id, and rejects any non-identical record with "handoff operation integrity failure" (control-plane/src/storage/memory-repository.ts:423, control-plane/src/storage/memory-repository.ts:430). This matches Mongo’s operation-keyed upsert and separate public-ID uniqueness rule (control-plane/src/storage/mongo-repository.ts:130, control-plane/src/storage/mongo-repository.ts:568). The shared contract adds the previously missing same-operationId/different-id collision case (control-plane/src/storage/repository-contract.test.ts:428) and runs it for both repositories (control-plane/src/storage/repository-contract.test.ts:2737, control-plane/src/storage/repository-contract.test.ts:2742). The invariant is enforced at its natural owner—the repository materialization boundary—rather than delegated to service retries or consumers, and no fix-induced regression within the issue’s stated bounds is evident.

proportional-containment:
ESSENCE: This is a durable-intent/idempotent-materialization problem governed by aggregate-owned authority, operation-keyed idempotency, optimistic concurrency, and generation fencing. IDEAL: keep the Task intent authoritative, materialize sidecars only after the winning CAS, and make MemoryRepository and MongoRepository enforce identical identity and one-time-consumption rules. Six-smell comparison: magic numbers—none evidenced in the fix; proxy-over-truth—avoided because Task remains authoritative; symptom branches—none added beyond the existing reconciliation path; narrative-over-verification—the fix adds the decisive contract case for same operationId with a different public id (control-plane/src/storage/repository-contract.test.ts:428); missing-inevitability—no evidence, since standalone Mongo and the stated no-cross-document-transaction boundary require this pattern; skipped-purpose—none. The prior named gap is closed: MemoryRepository.materializeHandoff() now searches by operationId before falling back to public id and rejects mismatches (control-plane/src/storage/memory-repository.ts:423), matching Mongo’s operation-keyed upsert and collision validation (control-plane/src/storage/mongo-repository.ts:572). The change is narrow, preserves the natural repository owner, and the added assertion directly proves the previously missing equivalence invariant.

⟦AI:FKST⟧

[chronoai-fkst]

github-devloop is merging PR #51

[chronoai-fkst]

github-devloop merged PR #51