Retire dev: final reconciliation into master - #99
Merged
Conversation
Port crash-safe outbox and idempotency, owner-thread Rabbit settlement, bounded retry/quarantine, durable target recovery and dispatch, revision-safe updates, and typed CouchDB view registration onto current dev without the superseded schema class model.
Preserve the hardened authentication, documentation, schema, and relation-repair work from the stable line while integrating dev's owner-thread Rabbit runtime, bounded retry/quarantine, outbox, target recovery, document update, view registry, and operational acceptance tests.
Preserve both branch histories while integrating the hardened stable line with dev's operational Rabbit, outbox, target recovery, document update, view registry, and container acceptance work. Validated by schema lock, operational source contract, hermetic unit tests, service-backed integration tests, and the full container stack.
…-key decoding HTTP integration tests launched *app* directly, bypassing the production authentication/authorization middleware in *server*, so route-level authorize! calls saw no principal and returned 403 missing_principal. The test harness now installs a request-scoped wrapper that binds the development security configuration per request (not around clackup, since Clack worker threads outlive those dynamic extents) and delegates to (lack.component:call *server* env). A test-only X-Test-Auth-Mode header selects dev-bypass, unauthenticated (401), or restricted-principal (403) contexts; the restricted principal is minted in an isolated memory credential store. The catch-all (error (pass)) handlers that swallowed 401/403 as expected RabbitMQ failures are replaced with exact status assertions. Also fixes decode-view-key: jsown parses bare leading t/f/n as true/false/null, so [dataset-1 tenant-1] decoded to (T). jsown is now only invoked on genuine JSON string arrays/objects; bare printed composite keys go to the narrow split-printed-view-key parser.
Reconcile hotfix PR #90 into dev
Fix CouchDB view query transport and result typing
Define distributed target lease and fencing semantics
Implement backend-neutral lease store protocol
Final semantic reconciliation of the long-lived dev line into the master-based reconciliation branch. Preserve master persistent human-user/auth work and dev authorization, target dispatch, CouchDB/outbox, lease protocol, and operational-salvage work. Resolve the seven overlapping paths explicitly without rewriting either published history.
The final dev-to-master reconciliation cannot satisfy the operational salvage gate while the workflow only listens to PRs targeting dev. Move that PR trigger to canonical master without changing the test command or patch-hygiene check.
This was referenced Aug 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Make
masterthe sole canonical development branch by performing the final semantic reconciliation of the diverged long-liveddevhistory into a branch created from currentmaster.After this PR, normal development must branch from current
masterand targetmaster;devis retired/deprecated and must receive no new work.Audited divergence
e2fa1991d8b08b74bcb2194c7a10f02da2431ad16d2feb103e57f2227b3609430ae7c68e7e834aa1e9586b935758dbae69283e6a099e30cdb29a5ba9The reconciliation commit is
bd4b9d1ecd808f5e3aecf53df0b9c54337500b94, with audited master as first parent and audited dev as second parent. Published history was not rewritten or force-pushed.Preserved from master
star:intelauthentication from PR feat(auth): add persistent users and first-run star:intel login #97Preserved from dev
Semantic conflict resolution
Seven paths were modified on both sides since the merge base:
.github/workflows/smoke-tests.yml: retained master's stronger Nix action, flake evaluation, build gate, timeouts, permissions, and concurrency controls. Branch policy is intentionally changed only after this reconciliation lands.scripts/stack-test.sh: retained dev's broader scoped authorization/denial stack coverage; persistent human users remain covered by the dedicated master unit/API code and test suite.source/gserver-settings.lisp: union of master human-user settings/public login path and dev Rabbit retry/quarantine settings.source/package.lisp: union of master human-user exports and dev authorization/target/Rabbit/CouchDB exports.source/starintel-gserver.asd: retained dev's newer runtime module graph and inserted masterauth/usersafter the shared auth store.starintel-gserver-tests.asd: retained dev's newer suites and inserted masterauth-users-test.t/run-tests.lisp: retained dev required suites and added fail-on-emptyauth-users-tests.All other master-only changed files were copied verbatim into the dev-derived reconciled tree; all other dev-only changes remain intact.
Open dev-targeting PR disposition
masterafter this PR lands.masterafter migration if kept open.Verification
CI on this PR is the authoritative execution environment because the connected execution environment has no direct GitHub/network checkout. Required repository workflows must complete successfully before merge. Exact commands/counts will be recorded from workflow evidence; zero-test discovery is treated as failure.
Resulting branch policy
Once merged, a follow-up policy slice will update checked-in docs/workflow triggers and issue #53 to state:
masteris canonical.master.master.devis retired/deprecated and receives no new work.