Repository navigation
id(hosted_binding): closing lifecycle audit — transition table for every public method + module-header contract statement (Phase 4 of #5047) #5048
Description
id(hosted_binding): closing lifecycle audit — transition table for every public method + module-header contract statement (Phase 4 of #5047)
Phase 4 of design #5047 ("A name is claimed once — the hosted binding lifecycle contract", design doc files/designs/code-id-hosted-binding-lifecycle.md in the keep-the-four-repos-healthy goal workspace). Gated on Phases 1–3 (#4868, #4871, #4887).
Scope
Audit every public method of HostedBindingService (pkgs/id/src/hosted_binding.rs) against the lifecycle contract recorded on #5047 — a challenge, a pairing code, and a rebind target key are each claimed exactly once, by exactly one holder, for exactly their stated lifetime; every transition out of a live state (consumption, supersession, expiry, reservation, release) is named — and write the resulting transition table into the module header beside the §3.4 failure-semantics prose it completes. Close #4868/#4871/#4887 with evidence if their phases have not already closed them.
Required dispositions
(a) Expired pairing codes: pairing_codes entries whose challenge expired are swept only when presented to exchange_pairing_code. State whether mint/lookup sweeps them, or record that the leak is bounded by the challenge TTL (5 min) and why that is acceptable.
(b) consumed_challenges growth: consumed IDs accumulate for the life of this in-memory service. State the bound, or the reason none is needed at this slice (e.g. tied to challenge issuance rate limits), in the header table's notes.
(c) Reservation scan cost: the target-key reservation (Phase 3, #4887) is a predicate over pending requests. If the pending set can grow beyond a trivial scan, disposition the named alternative — an index keyed by target key — with the reason it is or is not taken (the design doc records why a second index loses by default: it is a second place for state to disagree).
(d) Old-key-side symmetry: confirm the delayed path's old key needs no symmetric reservation statement (it is already reserved via the binding's rebind_pending status) — confirm in the table, do not re-derive.
Acceptance criteria
- Every public
HostedBindingServicemethod appears in the transition table with its claims/transitions dispositioned (conforming / fixed in this change / explicitly out of scope with a reason). - The module header carries the lifecycle transition table next to the §3.4 prose; header,
CeremonyErrordocs andRebindErrordocs agree on expiry/consumption semantics. - Dispositions (a)–(d) are each recorded in the table or its notes.
- id(hosted_binding): expired challenge is recorded as consumed — a second presentation returns ChallengeReplay, and create_pairing_code's documented ChallengeReplay branch is unreachable #4868, id(hosted_binding): create_pairing_code does not supersede earlier codes — multiple live pairing codes per challenge, none revocable #4871, id(hosted_binding): a pending delayed rebind does not reserve its target key — another account can bind it during the 30-day wait, and effect_due_rebind silently overwrites that binding's by-key index entry #4887 are closed (by their phases or here) with evidence comments; existing hosted_binding tests still pass (
cargo test -p id --lib hosted_binding, CI or laptop per fleet rules).
Activity
dezren39 commentedon Nov 3, 2026
agent-note: filed by design-architect pass 45 (2026-11-03) as Phase 4 (closing audit) of design #5047, gated on Phases 1–3 (#4868, #4871, #4887) — status/blocked until they land. Triage packet → pilot task 8683 (queue repo-health-code-pilot, status queued, verified by dedupe re-read). Linked as a sub-issue of #5047. Triage: confirm scope against current main, record the gating, and enqueue the implementation follow-up with this issue's acceptance intact once Phases 1–3 land; do not start the audit early.
dezren39 commentedon Nov 3, 2026
agent-note:v1
state: handed_off
task: task 8683 (triage, repo-health-code-pilot, lane code-l)
worker: repo-worker-code
issue: #5048
Execution lane assigned: opencode. Handed off to the laptop claimant, which launches the bound session to drive task 8683 to its terminal state.
34 remaining items
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: picked_up
task: 9326 (small_fix, repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 335a5d1f-bfc1-4831-99ea-850c8939a727)
by: openchamber-scheduled-lane
at: 2026-11-04T19:47:30Z
Fresh revalidation: #5048 and epic #5047 are OPEN; #5048 has no hard-stop labels and already has queue/claimed, status/in-progress, and work/assigned. Searches found no open PR for either issue. Both issues are assigned to dezren39, but no PR is owned and the packet calls for an audit, not a Drew-only decision. I will resume the audit on the task branch and avoid unrelated behavior changes.
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: parked
task: 9326 (small_fix, repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 335a5d1f-bfc1-4831-99ea-850c8939a727)
by: openchamber-scheduled-lane
at: 2026-11-04T20:06:15Z
Parked for 20 minutes with PR #5646 open. Laptop test
cargo test -p id --manifest-path pkgs/id/Cargo.toml --lib hosted_bindingpassed (31 passed, 0 failed). Freshgh pr checksshowed only CodeRabbit pending; no workflow runs appeared for the branch. I inspected.github/workflows/id-check.yml: its triggers arescheduleandworkflow_dispatchonly, with nopull_request; there is no alternatepkgs/idPR workflow. This is a CI coverage gap, not a green CI result.labels: queue/parked and status/parked set; queue/claimed and status/in-progress removed; work/assigned retained.
resume: re-fetch issue #5048 and PR #5646, inspect the CI-trigger gap, and continue only after fresh checks or a documented follow-up. Do not assume CI passed.
dezren39 commentedon Nov 4, 2026
🤖 Agent note · handed off