Repository navigation
id: PoC: intermittent-signature live stream for collaborative editing #2241
Description
Throwaway prototype: run the existing collaborative-editing live path through a session header, MAC-authenticated frames and segment checkpoints, and prove a late joiner can reconstruct from a checkpoint.
Why
#2034 investigation (doc: doc/2026-10-29T10-45-00Z_investigation_ephemeral_live_data_retention/) found the current live path is already unsigned and bounded — web/collab.rs carries steps and cursors as unsigned MessagePack frames, cursors are dropped 5 min after disconnect, document state 1 h after the last client leaves (world/mod.rs limits) — but nothing produces a signed checkpoint that makes that low-retention stream auditable afterwards. This PoC answers whether the checkpoint shape actually works before anyone commits to it.
Scope (prototype only)
- Take
pkgs/id/src/web/collab.rssteps/cursors and put them behind a session header + per-session MAC key (no per-keystroke signature). - Emit segment checkpoints every ~2 s or ~256 events, plus on commit/blur, chained to the previous checkpoint's signature.
- Demonstrate: a late joiner loads the latest checkpoint and reconstructs state; a reconnecting peer reconciles at the next checkpoint boundary; a truncated tail is detectable by a verifier.
- Measure the signature count and bytes saved versus signing every event.
Hard rule (program, #2056)
Proof of concept — must NOT be merged into the permanent feature, and no permanent feature may be built on it before a review round. Land it as a throwaway (branch or examples/) that the reviewer can run, not as a change to the production path.
Blocked by
- id: design: session header + segment checkpoint event kind #2240 (session header + segment checkpoint design) — the wire shape comes from there.
Activity
developing-today commentedon Oct 29, 2026
CODE-1109
dezren39 commentedon Nov 1, 2026
🤖 Agent note · picked up
dezren39 commentedon Nov 1, 2026
Triage verdict: confirmed, with an important qualification
At main
0f4731ea0,pkgs/id/src/web/collab.rs:6-16,207-225defines unsigned MessagePack live steps/cursors held in memory. Optional first-message token authentication (:698-759) is not a per-frame signature. Disconnect immediately broadcasts cursor removal; server state retains the disconnected cursor for up to five minutes (:1178-1209), and idle document state is removed after one hour without clients (:182-185,1213-1232).A signed saved document revision already exists (
pkgs/id/src/web/routes.rs:1194-1201,1233-1264), so “no signed checkpoint” is true only for a signed live-segment checkpoint binding ordered steps, session and previous root—not for saved snapshots. The save path does not attest each live edit or contributor.A throwaway PoC is plausible, but signer authority, canonical segment hashing, retained verification material and race-safe snapshot/reconnect semantics need specification. A checkpoint alone does not prove complete history or non-equivocation. #2240 remains open and supplies the required wire shape: do not start the PoC until it is settled. Any prototype must stay out of the permanent feature until reviewed.
🤖 Agent note · triaged
105 remaining items
dezren39 commentedon Nov 3, 2026
Current triage — 2026-11-03
#2241 remains OPEN. Its design dependency #2240 is CLOSED (completed), and design PR #3867 is MERGED. The existing throwaway PoC PR #4435 is OPEN at head 957cc11; its current check rollup is SUCCESS (1/1), but it has no approvals, codeowners are pending, and three unresolved Codex P2 findings remain:
pkgs/id/examples/session_checkpoint_poc.rs: the 2-second segment limit is not enforced while frames are idle; the timeout boundary waits for another frame/disconnect.These are material gaps in the requested PoC demonstrations, not work already landed on main. PR #4435 is the canonical fix path; do not create a competing PR or touch the merged design PR #3867. Keep #2241 open until the existing PR findings are addressed and the required review round completes. A follow-up queue task will target #4435. Added
user/reviewfor the outstanding reviewer/codeowner gate; no hard-stop labels were present.dezren39 commentedon Nov 3, 2026
agent-note:v1
event: done
task: 7317 (repo-health-code-pilot, repo-worker-code; OpenChamber scheduled lane; session ses_e5e5c3748bbffeCrbxVyjhADa8)
state: Triage completed. #2241 remains OPEN; design #2240 is CLOSED and PR #3867 MERGED. Existing canonical PoC PR #4435 is OPEN with CI SUCCESS (1/1), no approvals, codeowners pending, and three unresolved Codex P2 findings (idle time-boundary checkpoint, late-joiner replay/snapshot consistency, header-core hash binding). Findings and blocker are recorded on #2241; no competing PR or code edits made.
disposition: Follow-up task 8925 queued as a PR shepherd against existing PR #4435; issue remains open with user/review for codeowner review.
links: #2241 · #2240 · #3867 · #4435 · task 8925
dezren39 commentedon Nov 3, 2026
🤖 Agent note · picked up
poc(id): address #2241 PR #4435 Codex P2 findings (task 8925)
dezren39 commentedon Nov 4, 2026
🤖 Agent note · done
What landed in commit e851254 (
pkgs/id/examples/session_checkpoint_poc.rsonly):Producer::tick(at_ms)clock API checkpoints an idle segment withCloseReason::Intervalat the boundary;build_sessionticks at 4560 ms during the pause. Test:idle_segment_checkpoints_on_tick_at_time_boundary.SegmentBodycarriesstate_before_snapshot;verify_segmentparses and applies every frame onto it and requires landing exactly on the committed snapshot before reporting replay-verified. Test:keyless_verification_rejects_snapshot_the_frames_do_not_produce(owner-signed forged snapshot now rejected).header_core_bytes;verify_segmentandverify_chainrecompute the header hash viaverify_header. Test:tampered_header_participant_is_rejected.Verification (laptop worktree
~/git/fleet/8925):cargo test --example session_checkpoint_poc— 6/6 pass;cargo run --example session_checkpoint_poc— ALL DEMOS PASSED (6 checkpoints, segment 1 closed by the tick). PR #4435 fresh state: OPEN, MERGEABLE, head e851254; basic line-limit check queued at completion time.