Skip to content

Phase 2: create of an existing group is first-arrival-wins, not fold-based #165

Closed

Description

@dezren39

The wiring fix refuses a create naming an existing group, by arrival order. Two concurrent creates still settle by arrival, so replicas can diverge, and an attacker's create that arrives first can claim a derived friendship ID. The correct check belongs in the groups fold (src/groups/fold.rs), which is not wired into ingest yet. Needed before group creation is considered secure.

Activity

  1. dezren39 commented on Oct 24, 2026

    @dezren39
    MemberAuthor

    id train triage (2026-10-24): too-big-needs-design — fold-based group create; the correct check belongs in src/groups/fold.rs, which is not wired into ingest yet.

  2. dezren39 commented on Oct 29, 2026

    @dezren39
    MemberAuthor

    🤖 Agent note · picked up

  3. dezren39 commented on Oct 29, 2026

    @dezren39
    MemberAuthor

    🤖 Agent note · done (triage verdict: CONFIRMED)

    • Agent: queue worker (repo-worker-code), Lane A shift
    • Session / ID: queue task 2014 (triage)
    • Found via: queue claim · repo-health-code-pilot
    • Task: Triage complete — CONFIRMED at current main (HEAD 2953f27), routed to a scoped fix packet (queue task 2950).
    • Evidence:
      • The "wiring fix" is commit d5ec382 ("a create may not take over an existing group [P2.3]") and it is unchanged at HEAD: pkgs/id/src/membership/gate.rs:53-63 — for a create, admit() scans the operations applied so far and rejects GroupExists only if one names the same group; the doc comment (gate.rs:26-28) says it plainly: "The first create stands."
      • pkgs/id/src/membership/layer.rs:130-166: Membership::receive decides in arrival order (held only for missing causal dependencies). Two concurrent creates for one group — neither causally before the other — are settled by whichever arrives first at that node. No event-ID tie-break exists in this path.
      • The deterministic replays that do exist do not agree on a tie-break, and neither is consulted at admission: the groups fold orders concurrent events by smaller event ID (fold.rs header), while the event store's resolve.rs:108,186-213 replays a fresh membership layer in stored position-key order (author||seq||id, event_store/mod.rs:26) — for the same concurrent pair the two paths can crown different creates. Ingest stores and resolve replays; it never consults groups/fold.rs.
      • The friendship-ID claim is reachable: layer.rs:692 pins that a create may name a derived friendship group ID, so a stranger's create naming that ID is admitted whenever it is processed first. The only GroupExists test (layer.rs:725) is sequential — create, then stranger — and no test feeds concurrent creates in both arrival orders.
    • Expectation: fix task 2950 (small_fix, dedupe repo-health:v1:fix:developing-today/code:issue:165) — done = one canonical rule (causal order, smaller event ID wins, matching the fold) decides concurrent creates on the membership layer, the fold, and resolve; convergence tests in both arrival orders; CI green.
    • Links: follow-up task 2950 · gate https://github.com/developing-today/code/blob/main/pkgs/id/src/membership/gate.rs
  4. added
    queue/queuedHas a queued task in the Supabase agent queue
    work/assignedQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    and removed
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    queue/queuedHas a queued task in the Supabase agent queue
    on Oct 29, 2026
  5. 286 remaining items

  6. added
    queue/parkedQueue task is parked (waiting on CI, time, or an event)
    status/parkedDeliberately paused with a recorded resume condition
    and removed
    queue/claimedQueue worker lifecycle state
    on Nov 2, 2026
  7. dezren39 commented on Nov 2, 2026

    @dezren39
    MemberAuthor

    agent-note:v1 — state: parked (task 2950, OpenChamber scheduled lane)\n- Agent: repo-worker-code.\n- Fresh metadata-only evidence: #165 remains OPEN/assigned to Drew; canonical PR #4099 remains OPEN/authored by Drew. I did not inspect PR contents, checks, reviews, branch, or worktree.\n- Disposition: parked 30 minutes; no competing work. Parked labels restored; work/assigned remains.\n- Resume: only after explicit ownership release or handoff; then revalidate before work.\n

  8. added
    queue/claimedQueue worker lifecycle state
    and removed
    status/parkedDeliberately paused with a recorded resume condition
    queue/parkedQueue task is parked (waiting on CI, time, or an event)
    on Nov 2, 2026
  9. dezren39 commented on Nov 2, 2026

    @dezren39
    MemberAuthor

    🤖 Agent note · picked up

  10. dezren39 commented on Nov 2, 2026

    @dezren39
    MemberAuthor

    🤖 Agent note · done

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions