id: F12.13 journal replication (read replicas over a signed stream)

From .opencode/plans/phase-12-platform-flexibility.md (workstream E, F12.13), which has no tracking issue. Phase 12 stack (PR #801).

What and why

Read replicas that follow a world's journal over a signed stream. A world keeps a single writer, so there are no write conflicts. Replicas serve spectators and survive the writer being offline. The rollback and format rules from F11.12 apply to the stream.

Dependencies

F11.12 journal format/version header (Define rollback compatibility for world profile journal entries #227).
F12.6 structured audit log (epic id: Phase 12 designs to run through the research workflow #534 D1-024) for the stream framing.

Acceptance

A replica reproduces the writer's records.
A tampered stream is refused.

Acceptance criteria

The body's ## Acceptance bullets hold: a read replica reproduces the writer's journal records from the signed stream, and a tampered stream is refused.
Replicas serve spectators while the writer is offline.
Stream framing follows the F11.12 journal format/version rules (Define rollback compatibility for world profile journal entries #227) and the F12.6 audit-log framing (epic id: Phase 12 designs to run through the research workflow #534).

Intake review

Related: Phase 12 stack PR #801 (merged); dependencies #227 (F11.12 journal format) and epic #534 (F12.6). No merged PR resolves this (verified 2026-10-26).

Notes: Large, dependency-gated feature scope (effort l, priority low until its dependencies are scheduled). The body already had an ## Acceptance list; the criteria above restate it in the standard section.

Risks: Signed-stream replication is security-sensitive; tamper-refusal needs a negative test, not just a happy-path replica test.

Suggested approach: Design the stream framing against F11.12/F12.6 first, then a single-writer replica with record-for-record parity and tamper tests.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane D
Session / ID: queue task 2245
Found via: queue claim
Task: Triage id: F12.13 journal replication (read replicas over a signed stream) #806 (F12.13 journal replication / read replicas) against current main — verify, then route or close with evidence
Expectation: effort l feature; triage done = verdict comment + routing
Links: task 2245 in queue repo-health-code-pilot

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane D
Session / ID: queue task 2245
Found via: queue claim
Task: Triage verdict for id: F12.13 journal replication (read replicas over a signed stream) #806 (F12.13 journal replication) against current main
Expectation: verdict below; issue stays open — confirmed, not implemented as specified, dependencies unmet
Links: dependencies Define rollback compatibility for world profile journal entries #227 (closed, narrower than F11.12), epic id: Phase 12 designs to run through the research workflow #534 (open)

Triage verdict: CONFIRMED — not implemented as specified; both named dependencies are unmet

Verified at main HEAD 35726e8e9d93698e9922e85ba5d072d557edb36d (2026-10-28T18:50:35Z):

What exists is a different mechanism. The replica code at HEAD is world records replication over iroh-docs: pkgs/id/src/world_records.rs ("World records in iroh-docs: persistent, replicated structured data"), the Replica::start + world_records::replicate path in commands/world.rs:149-171, and the id world replicate CLI (cli.rs:1476). directory_log.rs replicas are in-memory convergence of directory records. None of this is a read replica following a world's journal over a signed stream, and none of it serves spectators from the journal while the writer is offline — the F12.13 acceptance bullets do not hold.
F12.6 dependency absent: code search for a structured audit log (audit_log / AuditLog) at HEAD returns nothing in pkgs/id, and epic id: Phase 12 designs to run through the research workflow #534 (which carries F12.6) is still OPEN — so the stream framing this feature is specified to follow does not exist yet.
F11.12 dependency only partial: Define rollback compatibility for world profile journal entries #227 is closed, but it defined rollback compatibility for world profile journal entries; PR id: Phase 13 first slice — shell contract (F13.1), SSH transports (F13.2/F13.3), F13.7 design #842's gate note records that F11.12 journal-format management itself "has NOT landed (only the JOURNAL_VERSION refusal exists)". The format/version rules the stream must follow are therefore not in place either.

Route: L feature gated on #534/F12.6 and the F11.12 journal-format work — no scoped small_fix is enqueueable from this triage. #806 stays open and is re-queued (queue/queued + status/needs-triage) to re-enter triage once its dependencies land; the records-over-iroh-docs replication above is the adjacent substrate a future implementation should evaluate first, but it does not satisfy this issue as written.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-q
Session / ID: task 6699
Found via: queue claim
Task: Issue id: F12.13 journal replication (read replicas over a signed stream) #806 Phase 5 replica operator interface and resilience — execution-lane assignment returned opencode; handing task 6699 to the opencode claimant. Prior checkpoint on task 6699 records a Drew A/B/C spectator-admission decision as outstanding; the bound session should re-check the latest comments on issue id: F12.13 journal replication (read replicas over a signed stream) #806 for a decision Drew may already have recorded before treating it as still blocked.
Expectation: effort l; done = Phase 5 work for issue id: F12.13 journal replication (read replicas over a signed stream) #806 landed, or re-blocked with the exact outstanding decision.
Links: task 6699 (repo-health-code-pilot queue); branch queue/6699-806-replica-operator-resilience

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-i
Session / ID: task 6699
Found via: queue claim
Task: task 6699 for issue id: F12.13 journal replication (read replicas over a signed stream) #806 handed off to the opencode claimant (assigned_lane=opencode); claimant launches the bound opencode session
Expectation: l — claimant drives task 6699 to a terminal state
Links: issue id: F12.13 journal replication (read replicas over a signed stream) #806

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-c
Session / ID: task 6699
Found via: queue claim
Task: Handing off task 6699 for issue id: F12.13 journal replication (read replicas over a signed stream) #806 (Phase 5 replica operator/resilience) to the opencode claimant per execution-lane assignment (assigned_lane=opencode). Re-verified issue id: F12.13 journal replication (read replicas over a signed stream) #806 OPEN, no hard-stop labels; Policy B already adopted per prior progress.
Expectation: claimant launches the bound opencode session and drives task 6699 to terminal state; no competing PR created by this lane.
Links: branch queue/6699-806-replica-operator-resilience (recorded, not present per prior progress); PR Phase 4: read-only replica world service and spectators (#806) #4708 merged prerequisite

agent-note:v1
state: handed-off
queue: repo-health-code-pilot
task: 6699 (small_fix, worker repo-worker-code, lane code-k), attempt 30
by: repo-worker-code lane code-k
at: 2026-11-04T21:17:00Z

Handed off to the opencode execution lane (assigned_lane=opencode via repo-queue lane). Fresh check: issue #806 OPEN, no hard-stop labels. Prior progress on branch queue/6699-806-replica-operator-resilience stands (policy B adopted); the claimant session resumes from there — do not restart. Note: task 6699 is at attempt 30/32, near its cap. Parked 1200s to release the claim for claimant binding. Labels synced: queue/parked + status/parked, work/assigned retained; queue/claimed + status/in-progress removed.

agent-note:v1
event: picked_up
task: 6699 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc)
state: Claimed for Phase 5 resume.
fresh_evidence: #806 is OPEN with no hard-stop labels. PR #4708 is MERGED at 31c041d. No open PR matching "replica operator" was found. Drew's explicit policy-B ruling for new spectators during writer outage is recorded in #806 (comment); the stale A/B/C blocker is superseded.
next: Inspect the recorded task worktree and branch without discarding unknown work; then continue only if the prior work is present and coherent.
labels: queue/claimed + status/in-progress added; queue/parked + status/parked removed; work/assigned retained.

agent-note:v1
event: parked
task: 6699 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc)
state: Parked for 30 minutes after recording the fresh worktree and Phase 5 gap map. #806 remains OPEN; hard-stop labels absent; PR #4708 is MERGED at 31c041d; no competing Phase 5 PR found. Policy B is explicitly adopted in comment 6634842315, superseding the stale A/B/C blocker.
progress: Fetched origin and fast-forwarded primary main (already current). Recreated clean branch queue/6699-806-replica-operator-resilience at /home/user/git/fleet/6699-806-replica-operator-resilience, based on origin/main 8de9292. No code edits or tests this run. Identified remaining scope: replica network client; signed, source/cursor-bound module and directory-fact transfer; replica CLI/config and source/world/cursor/staleness reporting; configurable writer-signed policy-B admission lease; end-to-end outage/restart/reconnect/compaction coverage. Existing unit tests cover receiver reset/reopen in isolation.
resume: Continue on the clean recorded worktree; implement the receiver client and authenticated sidecar transfer first, then operator/reporting and policy-B leases; add the operator-driven resilience tests. Preserve the records-only world mirror and keep #806 open until all acceptance criteria hold.
bookkeeping: openchamber scheduled lane — sandbox backlog and sweep log deferred to fleet reconciliation.

agent-note:v1
event: parked_correction
task: 6699 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 02cafe76-eafd-4d0b-aaa6-2b7a737d68dc)
correction: A fresh status check after parking shows the preserved worktree remains clean but its branch is now 4 commits behind the updated origin/main. No source changes or tests were made. On resume, fetch and fast-forward the clean task branch to fresh origin/main before implementation; preserve the recorded branch/worktree and revalidate #806 plus PR ownership. The prior base SHA (8de9292) was current when the branch was created.

agent-note:v1
event: picked_up
task: 6699 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 7b47536b-c162-444c-be8a-3a9538cc4cb5)
state: claimed; labels synchronized to work/assigned + queue/claimed + status/in-progress.
fresh_evidence: #806 is OPEN; no held, user/owned, do-not-merge, or do-not-auto-edit labels. PR #4708 and #4634 are MERGED; open PR search found no competing Phase 5 PR. Policy B was explicitly adopted for new spectators in #806 comment 6634842315.
next: inspect recorded worktree/branch without discarding unknown work, then continue the Phase 5 scope only within this scheduled run budget.

agent-note:v1
event: parked
task: 6699 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane 7b47536b-c162-444c-be8a-3a9538cc4cb5)
state: parked for 20 minutes; labels synchronized to queue/parked + status/parked; work/assigned retained.
verified: #806 remains OPEN with no hard-stop labels; PR #4708 is MERGED at 31c041d; no competing Phase 5 PR found; policy B is explicitly adopted in comment 6634842315.
progress: Primary main and the clean task branch/worktree are current at 19aa97c. No code edits or tests. Read-only exploration found the remaining scope is a connected security/operations path; a partial journal-only or serve-only slice would omit authenticated sidecars and policy-B lease enforcement.
resume: Continue on /home/user/git/fleet/6699-806-replica-operator-resilience, branch queue/6699-806-replica-operator-resilience. Implement pinned-source sync, authenticated module/directory refresh, source/world/cursor/staleness reporting, policy-B writer-signed lease gating, and outage/restart/reconnect/compaction-reset coverage. Preserve the records-only world mirror and keep #806 open.
bookkeeping: openchamber scheduled lane — sandbox bookkeeping deferred to fleet reconciliation.

agent-note:v1
state: picked-up
queue: repo-health-code-pilot
task: 6699 (small_fix, worker repo-worker-code, lane 9aca43b4-5439-4939-9f71-323f5d32521b)
by: openchamber-scheduled-lane
at: 2026-11-05T00:24:49Z

Fresh revalidation: #806 is OPEN with no hard-stop labels; PRs #4447, #4589, #4634, and #4708 are MERGED; open PR search found no competing phase-5 implementation. Policy B (writer-signed admission lease; stop new admissions at lease expiry) is explicitly adopted in issue comment 6634842315. I am resuming from the prior analysis checkpoint and will inspect the recorded task branch/worktree before deciding whether any safe work fits this run.

agent-note:v1
state: parked
queue: repo-health-code-pilot
task: 6699 (small_fix, worker repo-worker-code, lane 9aca43b4-5439-4939-9f71-323f5d32521b)
by: openchamber-scheduled-lane
at: 2026-11-05T00:26:01Z

Parked for 20 minutes due the scheduled-run budget. The acceptance is a connected security/operations path, so no partial product slice was safe in this run. The recorded task worktree exists and is clean, has no commits ahead of origin/main, and is one commit behind; no source changes or tests were made. Resume by revalidating GitHub, fast-forwarding the clean task branch to current origin/main, and implementing the connected acceptance. Preserve the records-only world_records mirror and keep #806 open.

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-a
Session / ID: task 6699, repo-queue-worker-shift 2026-11-04 18:40 CST
Found via: queue claim
Task: task 6699 (small_fix for issue id: F12.13 journal replication (read replicas over a signed stream) #806, F12.13 phase 5) is assigned to the opencode execution lane; handed off to the laptop claimant — this lane does not work it directly. Claim labels re-synced (queue/parked/status/parked from a prior park replaced with queue/claimed/status/in-progress).
Expectation: claimant launches the bound opencode session, which drives task 6699 to a terminal state; if unlaunched, task 6699 returns to the queue at lease expiry. Note for the executing session: acceptance still requires Drew's explicit A/B/C offline-admission decision — do not choose silently.
Links: id: F12.13 journal replication (read replicas over a signed stream) #806

agent-note:v1 — task 6699 picked up by lane code-n, handed off to opencode claimant.

Task: task 6699 (small_fix, developing-today/code id: F12.13 journal replication (read replicas over a signed stream) #806)
State: claimed → handed_off (execution_lane: opencode)
Fresh check: id: F12.13 journal replication (read replicas over a signed stream) #806 OPEN, no hard-stop labels
Next: opencode-claimant launches the bound session; it drives task 6699 to terminal state.
Attempts: 32/32

agent-note:v1 agent=opencode-claimant state=handed-off task=6699 session=ses_e5e56a78ac4ffenVKnK3xVacbV at=2026-11-05T01:35:29.629Z

OpenCode worker launched for the already-claimed task; the session is bound in the queue record.

🤖 Agent note · handed off

Agent: fleet monitor
Session / ID: task 6699 (repo-fleet-monitor run 2026-11-05T15:45:48Z)
Found via: monitor reconciliation (Duty 1 claim/label divergence repair)
Task: Claim evaporated: task 6699 is queued and unclaimed in repo-health-code-pilot, but this issue still carried claimed labels. Labels reset to the truth (queue/queued + status/needs-triage). Checkpoint stage at evaporation: launched.
Expectation: The next lane claim picks task 6699 up from the queued state and posts a fresh pickup note.

Navigation Menu

Repository navigation

id: F12.13 journal replication (read replicas over a signed stream) #806

What and why

Dependencies

Acceptance

Acceptance criteria

Intake review

Triage verdict: CONFIRMED — not implemented as specified; both named dependencies are unmet

411 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: F12.13 journal replication (read replicas over a signed stream) #806

Description

What and why

Dependencies

Acceptance

Acceptance criteria

Activity

dezren39 commented on Oct 26, 2026

Intake review

dezren39 commented on Oct 28, 2026

dezren39 commented on Oct 28, 2026

Triage verdict: CONFIRMED — not implemented as specified; both named dependencies are unmet

411 remaining items

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 4, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions