Repository navigation
id: validation — Phases 0–8 + platform completion acceptance audit #1075
Description
Validation task: Phases 0–8 + platform completion
Drew (2026-10-26): make tasks to validate the delivered work and ensure the tests are thorough and pass.
Scope: audit Phases 0–8 (events/storage, membership, sync/relays, groups/encryption, tags/documents, invites/pull/CLI, connectivity, Open Design items — plan of record: doc/2026-10-11T11-08-42Z_design_remaining_work/plan-phases.md) and the platform-completion acceptance brief (doc/2026-10-14T_platform_completion/acceptance-brief.md, PRs #209–#213) against what is actually on main today.
Work:
- Walk every phase step / acceptance checkbox; mark each verified, broken, or untested, with evidence (test name, run, or repro).
- Run the full test layers (Rust unit + integration, web unit/typecheck, Playwright E2E,
nix flake checkfor pkgs/id) and record the results on this issue. - Where coverage is thin (a delivered feature with no test that would catch its regression), add the missing tests.
- File a separate issue for every failure or gap found — do not fix-and-hide inside this task — and link them here.
Exit: every in-scope item is either verified by a passing test or has its own tracked issue; the full-suite results are recorded on this issue. Known starting point: ProseMirror revision replication to peers is an accepted gap (#792) — verify the rest of the brief still holds.
Coordination (2026-10-26 reprioritization, per Drew): every id roadmap item now has its own GitHub issue, and priority encodes the order: (1) the path to Phase 12 — now + priority/high; (2) Phase 12 itself — next; (3) Phase 13 and long-term ideas — priority/low. The dashboard mirrors this list (org Project "Developing Today" #4, Area id-train; Grist Program roadmap, Area id). If this item turns out to be blocked, wrong, or superseded, park or close it with a note rather than letting it stall the queue — dropping an issue is always allowed; silently stalling is not.
Acceptance criteria
- Every Phases 0–8 step and every platform-completion acceptance checkbox is marked verified, broken, or untested, with evidence (test name, run, or repro) recorded on this issue.
- Full test layers are run and recorded here: Rust unit + integration, web unit/typecheck, Playwright E2E, and
nix flake checkfor pkgs/id. - Delivered features with no regression-catching test gain one, or the gap is filed separately.
- Every failure/gap has its own filed issue linked here (known accepted gap: ProseMirror revision replication, id phase-8/platform-completion: ProseMirror save revisions are signed and stored locally but never replicated to peers #792).
Activity
developing-today commentedon Oct 27, 2026
CODE-218
dezren39 commentedon Oct 27, 2026
Intake review
Related: Plan of record:
doc/2026-10-11T11-08-42Z_design_remaining_work/plan-phases.md· acceptance brief PRs #209–#213 · known gap: #792Notes: The widest of the four validation tasks (#1075–#1078, filed 2026-10-27). The acceptance brief is from 2026-10-14, so some checkboxes may have been overtaken by later phases — mark those superseded with a pointer rather than failed.
Risks: Checkbox-by-checkbox auditing of eight phases is the largest single validation scope in the batch; partial coverage should be reported as coverage, not implied complete.
Suggested approach: Work phase by phase, oldest first; keep a running results table on the issue; file gap issues as found (do not fix-and-hide inside this task, per the brief).
Labels were already normalized by the filer (kind, source/human, status/needs-triage, priority, effort, app/id all present); this pass appended the acceptance criteria above and adds
meta/enriched.🤖 Agent note · filed
dezren39 commentedon Oct 27, 2026
Sequencing (Drew's Phase 12 reprioritization, 2026-10-26): this audit is step 4 of the ordered Path-to-Phase-12 queue in #1235 — work it after #241-and-#551-CI-trust-steps, before the next step. The full order, the tier rules, and the drop rule live in #1235. Reminder of this issue's contract: verify the phase against its plan, add missing tests until the suite is thorough, and file a separate issue for every gap found — the follow-ups join the tier-1 queue.
72 remaining items
dezren39 commentedon Oct 27, 2026
🤖 Agent note · picked up
dezren39 commentedon Oct 27, 2026
🤖 Agent note · done — slice 4 (final) + closeout (queue task 1256)
Evidence base: current main
37418e56339c315cf0ddf3e61c9c55c1e9d0c0a2(verified twice:ghcommits/main API == laptop worktree~/git/fleet/1256-auditrev-parse, sparse checkout disabled in that worktree only), read directly. Method matches slices 1–3: each step checked against its implementation module and its named tests in-tree (test existence and intent verified by reading them; the recorded full-suite pass remains the slice-1 nightly, see closeout). Plan of record:doc/2026-10-11T11-08-42Z_design_remaining_work/plan-phases.md§10–§12; brief:doc/2026-10-14T_platform_completion/acceptance-brief.md.Phase 5 — tags, documents, search
src/tag_claims.rs:1— clear removes only claims in its causal past (transitive closure ofafter+ backlink); teststests/tag_claims.rs:134–254(seen/unseen/concurrent/transitive clears) + oracle property:423. Planted-bug half ✗: no planted/mutation check for the tag fold anywhere (plan §13 layer 11 names tags explicitly) — filed as #1421, the tags counterpart of #1395src/tag_index.rs:1— α(subject,name,value,claim)/ Ω(value,name,subject,claim), field-terminated so prefixes match whole fields; propertytests/tag_index.rs:80; the"a"vs"a\0b"regressions at:125(name) and:138(value, both directions); bare vs empty value:157compacted_claimsone-pass fold (tag_claims.rs:220) with the agreement propertytests/tag_claims.rs:454and the shrunk P5.1/P5.3 counterexample histories replayed at:481–505. The plan's literal snapshot-at-a-cut storage form was not built; state-preservation under pruning is instead covered by P8.2 belowsrc/documents.rs:1— signeddocument.putevents over blob hashes,verify_contentrefusal; two-replica convergencetests/documents.rs:234. Collab-server snapshots:src/web/collab.rsinit frame carries server doc state. Save on explicit save + idle: webmain.ts:88manual save (Ctrl+S/button),:52debounce autosave after 2s idle; saves publish signed revisions (src/web/routes.rs:1091returns thedocument.putevent ID)src/search.rs:50,84;tests/search.rs— contested tag returns both values:206, cleared claim not returned:230, whole-field matching:302, oracle property (search == filter over live set):443documents.rsheader (P5.6):document.removemarks only, bytes and tags kept, only the author's removal counts;tests/documents.rs:315clear-of-tag leaves the document; cross-ref slice-3 P2.6 (tests/content_removal.rs)src/aliases.rs+tests/aliases.rs(contested shown never picked:131,195, primary:158, petname:177, shortest-unique-prefix:234,268; also slice-3 P2.9). Two holes, both disclosed in the module header: (1) the list's date element — "not shown, because the signed header has no time field (open)" — filed as #1422; (2) a user's primary alias has no user subject yet — already tracked as #160 (open)Phase 6 — invites, pull, CLI
src/seitan/— derivations checked against Keybase's V2 vectors (seitan/tests.rs:139–213), stage payloads byte-for-byte:168, accept message is the Keybase map in declaration order:233, any-byte-change refusal:281, admin admit path (revocation/expiry/single-use):340–428. Caveat the module itself discloses: no Keybase-produced vector covers an accept message, so accept bytes are verified by construction, not against an external vectorsrc/seitan/freshness.rs—DEFAULT_WINDOW300s (tests.rs:510); boundary tests 4:59 admitted / exactly 5:00 admitted / 5:01 refused with the window named (:456–491); resolution inviter → world → server → default (:506)src/invites/invitation.rs— pasted text is a standard irohEndpointTicket(any iroh client parses it), pasted text trimmed at:31; link formid:join?group=G&ticket=T&by=K; the signed invite event is checked when present, before the accept is sent (src/invites/mod.rsheader + check flow)src/invites/mod.rsheader documents exposure in full: who learns the inviter's addresses from the link, the joiner's exposure on accept, what the link does not reveal (role/expiry/members/join secret)src/pull_policy.rs— Open (default) / Members gate implemented and unit-tested, checked before any event is sent. But the module header states "id servedoes not read it yet, and no session builds a gate from config" — the wiring half is exactly #798 (open) — not re-filedsrc/encryption/tests.rs:1252test_fork_recovery_removes_the_forked_key_and_reenrols_a_new_one(decision 17); the re-enrolled device reads from the re-enrol point on (:1310)tests/cli_groups.rs(8 tests over create/policy/add/remove/role/list surface insrc/commands/group.rs). The join verb is declared but not wired — #797 (open) — not re-filedtests/cli_delegation.rsover the P2.5 surface (slice-3 P2.5)tests/cli_documents.rs(8 tests: publish/events/frontier/history, JSON forms, refusals) +tests/cli_tags.rs(7 tests)src/rejection.rs— oneReasonenum (voided/waiting/frozen) mapped from ingest, groups fold, and encryption errors; each reason rendered exactly intests/views_explorer.rs:8,29,50;tests/production_ingest.rs:175voided reason end-to-endPhase 7 — connectivity for later servers
tests/relay_ops.rs:324kit has tunnel + vps modes;:371tunnel mode has no inbound/privileged port (cross-ref slice-3 P3.8)doc/2026-10-14T10-18-19Z_design_p7_2_cloudflare_workers.mdexists on main; implementation deferred by the plan itself pending owner approvalsrc/dht.rs— off by default, opt-in turns on publish+lookup (tests/dht_opt_in.rs:130,160,189), testnet peers find each other (tests/dht_testnet.rs:87). Deviation the module discloses: iroh binds address lookup per-endpoint, so one opted-in world enables the DHT for every world that endpoint serves — per-world intent, endpoint-wide effect, documented in the headerPhase 8 — later items
tests/retention_pruning.rs— pruning behind a causal cut protects open removals' pasts and frontiers; roster / live tag claims / document folds identical before and after pruning (:144,300,327,383)tests/multidevice.rs+ device authorization/revocation in the groups fold (src/groups/fold.rs:209,224,294P8.3)tests/views_explorer.rs+ the web home/explore surface (brief walk below)tests/cli_warnings.rsoversrc/groups/warnings.rs(cross-ref slice-3 P4.9)Platform-completion acceptance brief — walk
src/web/world_ws.rs:1145;.wasmupload/run and invalid-admin coverage in the same module's tests; CLI path per brief (cli_integrationworld compile test)web/src/editor.ts,web/src/collab.ts,src/web/collab.rs; saves publish signeddocument.putrevisions (above). Not complete, as the brief itself states: theLocalEventsstore is not replicated to peers — tracked as #792 (open, known accepted gap)src/web/world_ws.rs); SSH line chat,/records,/documents, bounded read-only/document(src/world_ssh.rs+ SSH tests intests/cli_integration.rs)src/web/home.rs— server-scoped explorer + default-world chat + recent/popular document and tag feeds, popularity honestly labelled ("number of visible global tags on the document",:161); 5 tests insrc/web/mod.rs:319,334,349,496,504Test-layer closeout
id e2e nightlyrun 40457980141 ondd4ee06e— Rust unit + integration ✅, web unit + typecheck ✅, NixOSnixos-serve/nixos-e2e✅; failures all tracked: Playwright Firefox websocket cluster → Firefox e2e sandbox hardening: autosave save-count race + websocket-spec server stall (#229 follow-up) #1230,nixos-integrationtimeout → id(ci): nixos-integration VM test still times out silently — #896 acceptance recurrence (nightly 40457980141) #1372,nixos-playwright-e2eharness → id(ci): nixos-playwright-e2e VM test fails on first curl — no server readiness wait (nightly 40457980141) #1374, clippy → clippy: panic! in #1043 MisplacedNode test (markdown.rs:1999) breaks clippy-lint on main for every PR #1245 (fixed by PR fix(clippy): replace panic! in MisplacedNode test so clippy-lint passes (#1245) #1299 after that SHA).idworkflow is green on the slice-3 base452d69e6(run 40492562723) and on its latest completed run today (e7997db9, run 40515279605, success 13:48Z).37418e56was stillin_progressat closeout; per the no-wait-on-CI rule it was not held on. Any new failure in it is new evidence for the fleet monitor / a follow-up audit, not a blocker for this closeout, whose full-layer record is slice 1 above.Closeout — disposition of the whole audit
Every Phases 0–8 step and every platform-completion checkbox has now been walked on this issue (slices 1–4) and marked verified, broken, or untested with evidence. Every failure/gap found has its own tracked issue:
Per this issue's exit criteria, #1075 is closed with this comment as the closeout record. The remaining work lives in the gap issues above, which carry
app/id+priority/high+nowwhere the audit filed them.dezren39 commentedon Oct 27, 2026
🤖 Agent note · correction to the slice-4 closeout above (queue task 1256)
One row of the closeout was wrong. The brief follow-up row "protocol questions" stated "#185, #183, #195 closed; #194 and #160 still open". Fresh verification (2026-10-27T15:05Z,
gh issue viewon each) shows all five are still OPEN: #194 (Seitan V2 Keybase server side), #185 (who may clear a tag claim), #160 (user subject for tags), #183 (persisted incremental tag index), #195 (document removal semantics). The brief's condition — resolve/document those questions before claiming the complete original plan — therefore remains unmet, tracked by those five open issues themselves. Nothing else in the closeout changes: every Phases 0–8 step and brief checkbox was walked, and every other gap has its own issue; the five protocol questions were always filed as their own issues, which is why #1075's own exit criteria (each item verified or separately tracked) still stand.dezren39 commentedon Nov 3, 2026
Correction/update to the #1075 acceptance evidence, based on fresh run 41488645351 on main
7297b5d354c8fdfa9dc1f226232e7b857af11b95(2026-11-02): it does not reproduce the old silent integration-VM timeout. The job failed innix flake check (full)before any VM boot. At 17:19:59Z Magic Nix Cache returned HTTP 418/ResourceExhausted; Nix disabled its proxy for 60 seconds and at 17:20:08Z reported missing substituters for private paths. Independently, the id build reported compile errors (includingE0053atsrc/world_ssh.rs:308andE0624atsrc/world_ssh.rs:921), plus web formatting drift; see run log. PR #1246 already raised the VM integration test globalTimeout to 3600 seconds. The corrected failure mode is pre-VM build/cache/format failure, not an integration timeout. Current preserved branch fixes the two remaining authored compile errors and formatter drift; validation is in progress in task 6572. Cache-policy follow-up is already owned/tracked by open issue #774; its existing direction is to remove Nix from Actions.dezren39 commentedon Nov 3, 2026
Final update for the #1372 re-baseline
Run 41488645351 failed before any VM boot: Magic Nix Cache returned 418 at 17:19:59Z (log 859–920), but Nix disabled the proxy and continued; the fatal checks were id/lib-test compile failures, web formatting, and shfmt/recipe drift (not an integration timeout). See the detailed line-by-line correction on #1372.
PR #4696 is merged as
e4af344. On the updated branch, all-target Rust check, web format, shfmt, and just-recipe drift checks passed. No post-fix full NixOS VM run is claimed; a renewed timeout verdict needs evidence that the VM actually booted. The 60-minute timeout from #1246 remains in place. Cache policy follow-up stays with #774 / Drew's direction to remove Nix from Actions.