Authorize exact authenticated compaction summaries
Problem
Automatic compaction writes its summary below .system/execution, while a durable task's read grant covers its inputs. Model projection rejects the summary. Authorizing a summary by its mutable provenance path also permits cross-task substitution and requires a coordinator history scan.
Design
Authenticate the exact summary reference against the journal's task-derived execution and the original harness upload. Recover the provenance from its original filesystem operation generation and canonical protected upload metadata, then verify its operation, nonempty covered range and complete output FileRef. Reuse the body already read during upload recovery. Head files and agent publications cannot substitute for that original upload.
Publish a small reservation-origin locator atomically with each canonical declaration, admission or start through StreamProvider::commit. Resolve its immutable cached commit outcome through the existing idempotency query, requiring the locator and canonical event to share one commit. Original owner verification no longer reads the coordinator history. Session declaration and configuration retain their atomic publication. Temporary summary buffers release their preparation-accounting custody after projection.
Decisions
- Provenance remains a file in the task's existing private volume. The derived origin locator must commit atomically with its canonical stream record; a separate volume file would require a cross-provider transaction. Use the existing StreamProvider atomic commit, with no new store or protocol.
- Summary authority is bound to the journal's task and derived execution. An inherited summary from another task needs an explicit exact read capability; automatic authorization does not transfer across tasks.
- Task/tool grants and all limits remain unchanged. Authorize one authenticated reference, never a directory prefix.
- Historical owner verification requires origin indexes. Coordinator histories created before this format need an explicit migration before their original journals can reopen; this PR does not implement that migration.
- Indexed lookups have constant RPC count and payload bytes. The SDK's balanced replay index has logarithmic metadata probes. The work test measures both retained history and new-key growth; its negative control executes the former canonical sequence lookup through the same native observer.
- The compaction regression captures a real LocalHarness-produced summary and checks the production preflight with the summary exception enabled and disabled. The disabled variant reproduces main's Unauthorized policy; this is an in-process control, not a separate main build.
Deletions
Remove the full-history original-reservation scan and step-only summary provenance key. Reuse existing protected upload recovery and its already-read body. Net +1,825 lines (+2,050/-225), including verification and the fuzz lockfile. Retain main's explicit pinned manifest fixture and all 998 real publication/cancellation cuts; the expanded independent boundary inventory and its omission controls are checked.
Tests
- Earlier functional revision: 88 focused Linux tests passed. Longest suite: the complete 998-cut admission recovery sweep, 4.670 s; other suites at most 0.487 s. Covers production LocalHarness compaction and its disabled-authorization control, task/turn substitution, original uploads, forged/agent files, malformed protected provenance at the correct key, projection preflight, retained hooks, recovery, staged references and future bounds.
- Shrinking properties (256 cases each) check task/turn rejection before storage, every immutable reference field, output-comparison deletion, full scoped summary-buffer/list accounting, generated invalid fixture inputs, exact path syntax and the fixed-width locator codec. The latter codecs and summary JSON also round-trip in the fuzz target.
- Eight checked-in qualification-runner tests passed in 0.043 s, including rejection of zero/skipped models and preservation of the dependency instrumentation flags.
- Instrumented origin publication model passed in 0.01 s. Uses real cfg-instrumented Stream locks and detects the stale re-fencing negative control.
- Parser fuzz passed 1,000 executions in 0.301 s (pinned nightly, debug ASan, seven checked-in seeds).
- Latest Windows
cargo check -p acyclic-harness --lib --testspassed through lb.ps1 in 2m37s, excluding the 435 s queue, with defaults andfilesystem-local,native-execution,terminal,mcp-http,test-support(hooks and both MCP transports included).
Paired native original-owner lookup measurements (unchanged calls/payload work; bounded indexed probes):
| Coordinator records | Calls | Source/authority bytes each | Indexed items | Old sequence-lookup control items |
|---|---|---|---|---|
| 3 | 6 | 2,206 | 280 | 283 |
| 131 | 6 | 2,206 | 281 | 412 |
| 259 | 6 | 2,206 | 280 | 539 |
The origin model and fuzz results above belong to the earlier functional revision. This verification update changes no parsing or concurrency behavior. The latest native test binary and Windows check were rebuilt after merging main to resolve the two coverage-inventory conflicts.
The control uses the same native observer and must fail the indexed-work bound. No work allowances or grants increased.
Verification re-review: the buffer property now uses a real task-bound journal with published protected provenance and a model scope lacking file grants. It invokes the full executor preflight, checks exact custody after each repeated multi-reference projection, and runs separate omitted-buffer-release and omitted-summary-list-release variants through the same detector. The fixture property generates nulls, booleans, strings, arrays, objects and fractional numbers, verifies real admission rejection, and detects a permissive {} input schema with the same input-validation predicate. Both retain 256 shrinking cases. False cleanup instantiations are internal test controls; production always releases both allocations.
Latest merged-head validation: 20/20 focused Linux tests passed after one native test-target build (6m33s). Journal authorization and both new 256-case properties: 6/6, 4.651 s; projection authorization: 1/1, 0.039 s; production automatic compaction: 1/1, 0.489 s; native future bounds: 2/2, 0.027 s; complete admission recovery, including all 998 crash cuts and omission controls: 10/10, 6.922 s. The exact boundary inventories from main passed without reducing cases or raising allowances.