You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
id: implement ID conversion engine - linked transfer pairs and rate authorisation (design #2063) #5536
Implementation of an ID design that has not landed yet (partial implementation as of the 2026-11-04 inventory).
Design issue: #2063
Design doc: doc/2026-11-01_design_id2063.md (in developing-today/code)
Acceptance, in brief: the conversion engine with linked transfer pairs and rate authorisation per the design.
Current state: conversion types + PoC executor landed; the production engine and rate-authorisation flow are incomplete.
The design documents govern. If implementation shows the design is wrong or incomplete, file a design amendment rather than silently diverging.
Scope: pkgs/id and its tests. Filed 2026-11-04 under Drew's order to begin work on all not-implemented ID designs. Inventory: workspace/goals/keep-the-four-repos-healthy/files/id-design-implementation-inventory-2026-11-04.md (in the fleet workspace).
agent-note:v1
event: parked
task: 9603 (repo-health-code-pilot; repo-worker-code; lane code-y)
at: 2026-11-04T17:00Z
found_via: atomic queue claim (lane code-y; direct execution lane)
verified: Issue #5536 OPEN, no hard-stop labels. Its blockers — issue #5521 (RateAuthorisation signed ID-graph object) and issue #5522 (ID currencies v1) — are both still OPEN at fresh check 2026-11-04T17:00Z, so the #5536 conversion-engine implementation cannot land yet. No branch/worktree created, no implementation started.
next: Park 30 minutes; resume task 9603 once issues #5521 and #5522 are both merged/closed, then revalidate issue #5536 fresh.
What landed: scale-aware exact rational conversion over a 256-bit intermediate (the PoC quote lost valid results to u128 overflow and had no scales), fee_bps fee math, role transfer codes 0x0201/0x0202/0x0203 (id: design: currency control plane — registry, account factory, gateway #2062 §4.4 conversion range), zero-output rejection, min/max and transfer-ID validation. 13 tests pass on the laptop incl. 3 proptests with named oracles; currency + currency_poc suites green (54 passed).
Verification: 13/13 new tests on the laptop (incl. 3 proptests with named oracles), currency + currency_poc suites green (54 passed), Codex review completed with no findings, PR MERGEABLE; merged under the standing merge criteria.
Agent note — tracking gap found and wired (ID constant-progress pass, 2026-11-05)
This implementation issue (conversion engine, design #2063) was filed in the 2026-11-04 gap pass but carried no labels at all — no status, no app, no queue wiring — the same hygiene gap just found and fixed on #5525. Labeled status/needs-triage + app/id so triage/queue lanes can pick it up. No implementation dispatched tonight: the pass dispatched one new lane (#5525 boards v1, session ses_e5e5569a1d5ffecFbEWaQo1o5N); this issue is next in the un-wired set.
Agent note — direct OpenCode dispatch (fleet top-up, 2026-11-05)
Dispatched as a direct OpenCode session under Drew's 2026-11-05 01:12 CST directive to keep both lanes progressing and top up where capacity allows. Fleet census at dispatch: laptop load 4.47/7.53/12.41 on 16 cores (falling), 19 active sessions on the prod server — real headroom, and this issue was the one unclaimed, unqueued, non-gated implementation item in the #5521–#5546 ID series (no queue task in any status, labels were status/needs-triage only).
Session: ses_e5e54fe9c30ffenhUlBRdiahrJ on the laptop prod server (127.0.0.1:13420)
Route: opencode-route / workhorse (set at session creation)
Worktree: /home/user/git/wt-id5536, branch fix/id-5536 from origin/main (pushed)
Rate-authorisation event types, policy, validation/folding, and signing helpers exist (pkgs/id/src/currency.rs:60-124, :146-160, :238-320, :322-387). These are graph-object primitives, not a conversion gateway.
The executor/recovery code is still only under currency_poc; its module explicitly says it is a PoC and not the permanent feature (pkgs/id/src/currency_poc/mod.rs:1-5). The PoC executor accepts a separate RateQuote and request (currency_poc/executor.rs:27-72), so it does not bind the production authorisation/quote contract to the pure builder.
What remains: a production authorization/admission path that validates the signed offer and quote against caller/LP/account policy; durable idempotency, intent and concurrency-safe cap reservation before submission; a production ledger submission boundary that preserves definite-vs-ambiguous outcomes; exact-ID recovery/quarantine; and auditable receipt/reversal linkage. In particular, the PoC's recovery path cannot simply be promoted unchanged: it retries an absent ID set without representing the design's definite atomic-failure outcome.
Plan: reuse the existing #2290 event model and Phase E builder; map the verified authorization/quote and resolved account data into a production request; implement the durable executor/recovery state machine behind explicit store and ledger boundaries; then add fault-injection/model-backed tests for admission, idempotency/cap races, linked success/failure, lost responses, restart, and partial/mismatched state. I will not create a rival authorization schema or treat unconstrained liquidity as an inventory guard. Issues #5521/#5522 and design issue #2290 are still open; if their unsettled gateway/account contract prevents a conforming implementation, I will post the precise blocker and required decision rather than silently diverge from doc/2026-11-01_design_id2063.md.
Blocker — cannot produce a conforming production PR yet
The checkout confirms that the remaining work depends on production contracts that are not present here:
currency::fold_authorisation consumes (verified author, decoded body) pairs; its contract says signature verification has already happened before the fold (pkgs/id/src/currency.rs:264-270). There is no production gateway/account resolver binding caller identity, LP accounts, the current offer, revocations, and quote admission.
The existing batch builder imports AccountId/Transfer from currency_poc::ledger (pkgs/id/src/conversion.rs:40), while the only executor/store/recovery module explicitly labels itself PoC (pkgs/id/src/currency_poc/mod.rs:1-5). The PoC does not implement the production admission/cap transaction or the design's distinct definite-failure vs ambiguous-response outcome.
What unblocks this: land the #5522 currency/account contract with deterministic constrained LP inventory accounts; settle and land the #2290/#3801/#3802 authorization and quote interfaces; and provide/approve the production single-writer ledger plus transactional intent/cap-reservation adapter boundary. The #2063 design owner/assignee for those contracts is Drewry Pope (also assignee of #5536, #5522, #2290, #3801 and #3802), so the sequencing/interface decision belongs there.
I have not added code or opened a partial PR: doing so now would either build on the explicitly PoC-only types or claim inventory/recovery guarantees that the available production interfaces cannot enforce. No design amendment is needed to describe a different behavior; the existing design already states these dependencies. Once the contracts land or their owner approves a compatible boundary, this issue can resume against the same acceptance criteria.
Activity
developing-today commentedon Nov 4, 2026
CODE-1363
dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
dezren39 commentedon Nov 4, 2026
agent-note:v1
event: parked
task: 9603 (repo-health-code-pilot; repo-worker-code; lane code-y)
at: 2026-11-04T17:00Z
found_via: atomic queue claim (lane code-y; direct execution lane)
verified: Issue #5536 OPEN, no hard-stop labels. Its blockers — issue #5521 (RateAuthorisation signed ID-graph object) and issue #5522 (ID currencies v1) — are both still OPEN at fresh check 2026-11-04T17:00Z, so the #5536 conversion-engine implementation cannot land yet. No branch/worktree created, no implementation started.
next: Park 30 minutes; resume task 9603 once issues #5521 and #5522 are both merged/closed, then revalidate issue #5536 fresh.
dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
dezren39 commentedon Nov 4, 2026
🤖 Agent note · parked
68 remaining items
dezren39 commentedon Nov 5, 2026
🤖 Agent note · picked up → PR opened (Phase E slice)
pkgs/id/src/conversion.rs— PR id(conversion): production pure quote + linked-batch layer (Phase E of #2063, refs #5536) #5777fee_bpsfee math, role transfer codes 0x0201/0x0202/0x0203 (id: design: currency control plane — registry, account factory, gateway #2062 §4.4 conversion range), zero-output rejection, min/max and transfer-ID validation. 13 tests pass on the laptop incl. 3 proptests with named oracles; currency + currency_poc suites green (54 passed).queue/9603-5536-conversion-pure-layerMerge pull request #5777 from developing-today/queue/9603-5536-conver…
dezren39 commentedon Nov 5, 2026
🤖 Agent note · done (this task's slice)
dezren39 commentedon Nov 5, 2026
Agent note — tracking gap found and wired (ID constant-progress pass, 2026-11-05)
This implementation issue (conversion engine, design #2063) was filed in the 2026-11-04 gap pass but carried no labels at all — no status, no app, no queue wiring — the same hygiene gap just found and fixed on #5525. Labeled status/needs-triage + app/id so triage/queue lanes can pick it up. No implementation dispatched tonight: the pass dispatched one new lane (#5525 boards v1, session ses_e5e5569a1d5ffecFbEWaQo1o5N); this issue is next in the un-wired set.
dezren39 commentedon Nov 5, 2026
Agent note — direct OpenCode dispatch (fleet top-up, 2026-11-05)
Dispatched as a direct OpenCode session under Drew's 2026-11-05 01:12 CST directive to keep both lanes progressing and top up where capacity allows. Fleet census at dispatch: laptop load 4.47/7.53/12.41 on 16 cores (falling), 19 active sessions on the prod server — real headroom, and this issue was the one unclaimed, unqueued, non-gated implementation item in the #5521–#5546 ID series (no queue task in any status, labels were status/needs-triage only).
ses_e5e54fe9c30ffenhUlBRdiahrJon the laptop prod server (127.0.0.1:13420)/home/user/git/wt-id5536, branchfix/id-5536from origin/main (pushed)doc/2026-11-01_design_id2063.md), pkgs/id + tests, PR against main, start-of-work diagnosis comment on this issue.Session will post its own diagnosis comment as its first step. — fleet census agent
dezren39 commentedon Nov 5, 2026
Implementation kickoff
What already exists in this checkout:
pkgs/id/src/conversion.rs:299-356) and builds an ordered linked transfer batch with a sharedconversion_id, role codes, and fixed caller-supplied transfer IDs (:358-418, :420-536; merged as id(conversion): production pure quote + linked-batch layer (Phase E of #2063, refs #5536) #5777).pkgs/id/src/currency.rs:60-124, :146-160, :238-320, :322-387). These are graph-object primitives, not a conversion gateway.currency_poc; its module explicitly says it is a PoC and not the permanent feature (pkgs/id/src/currency_poc/mod.rs:1-5). The PoC executor accepts a separateRateQuoteand request (currency_poc/executor.rs:27-72), so it does not bind the production authorisation/quote contract to the pure builder.What remains: a production authorization/admission path that validates the signed offer and quote against caller/LP/account policy; durable idempotency, intent and concurrency-safe cap reservation before submission; a production ledger submission boundary that preserves definite-vs-ambiguous outcomes; exact-ID recovery/quarantine; and auditable receipt/reversal linkage. In particular, the PoC's recovery path cannot simply be promoted unchanged: it retries an absent ID set without representing the design's definite atomic-failure outcome.
Plan: reuse the existing #2290 event model and Phase E builder; map the verified authorization/quote and resolved account data into a production request; implement the durable executor/recovery state machine behind explicit store and ledger boundaries; then add fault-injection/model-backed tests for admission, idempotency/cap races, linked success/failure, lost responses, restart, and partial/mismatched state. I will not create a rival authorization schema or treat unconstrained liquidity as an inventory guard. Issues #5521/#5522 and design issue #2290 are still open; if their unsettled gateway/account contract prevents a conforming implementation, I will post the precise blocker and required decision rather than silently diverge from
doc/2026-11-01_design_id2063.md.dezren39 commentedon Nov 5, 2026
Blocker — cannot produce a conforming production PR yet
The checkout confirms that the remaining work depends on production contracts that are not present here:
currency::fold_authorisationconsumes(verified author, decoded body)pairs; its contract says signature verification has already happened before the fold (pkgs/id/src/currency.rs:264-270). There is no production gateway/account resolver binding caller identity, LP accounts, the current offer, revocations, and quote admission.AccountId/Transferfromcurrency_poc::ledger(pkgs/id/src/conversion.rs:40), while the only executor/store/recovery module explicitly labels itself PoC (pkgs/id/src/currency_poc/mod.rs:1-5). The PoC does not implement the production admission/cap transaction or the design's distinct definite-failure vs ambiguous-response outcome.doc/2026-11-01_design_id2063.md:243-252). The account/registry implementation issue id: implement ID currencies v1 (design #2043) #5522 is still OPEN/in progress. Gateway verification and quote binding are also separate OPEN prerequisites id(currency): gateway verification flow + revocation-set check for RateAuthorisation (Phase 2 of #2290) #3801 and id(currency): quote issuance + binding for RateAuthorisation (Phase 3 of #2290) #3802; id: design: RateAuthorisation as a signed ID-graph object — schema, signing, revocation #2290 remains OPEN. The design's own phase table ties B/C/D/F to these contracts (doc/2026-11-01_design_id2063.md:326-334).What unblocks this: land the #5522 currency/account contract with deterministic constrained LP inventory accounts; settle and land the #2290/#3801/#3802 authorization and quote interfaces; and provide/approve the production single-writer ledger plus transactional intent/cap-reservation adapter boundary. The #2063 design owner/assignee for those contracts is Drewry Pope (also assignee of #5536, #5522, #2290, #3801 and #3802), so the sequencing/interface decision belongs there.
I have not added code or opened a partial PR: doing so now would either build on the explicitly PoC-only types or claim inventory/recovery guarantees that the available production interfaces cannot enforce. No design amendment is needed to describe a different behavior; the existing design already states these dependencies. Once the contracts land or their owner approves a compatible boundary, this issue can resume against the same acceptance criteria.