From 26eeab209ed79c8cca5e6f315ad0d63385b81196 Mon Sep 17 00:00:00 2001 From: JB Date: Fri, 4 Sep 2026 10:59:04 -0400 Subject: [PATCH] docs: record lock remediation rejection --- docs/workflow/develop-workflow-record.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/docs/workflow/develop-workflow-record.md b/docs/workflow/develop-workflow-record.md index acebc55..23f8f18 100644 --- a/docs/workflow/develop-workflow-record.md +++ b/docs/workflow/develop-workflow-record.md @@ -2,9 +2,9 @@ ## Status -- Status: active -- Current phase: exceptional remediation review -- Next safe action: commit this final review brief, prove its metadata-only scope, and launch fresh independent reviewers. +- Status: blocked +- Current phase: architecture escalation gate +- Next safe action: obtain an explicit user decision because portable pathname `stat` followed by `unlink` cannot provide atomic compare-and-delete against external replacement. ## Request and scope @@ -199,8 +199,9 @@ Before integration, abandon only by preserving evidence and obtaining cleanup ap - Post-rebase review specification reviewer: display `:1`, profile/child unavailable, session `01a06ce5-2764-7596-96a7-50a52309b921`; digest confirmed; CHANGES REQUESTED. - Accepted medium finding: checkpoint cleanup unconditionally unlinked the lock pathname. If the invocation-owned lock was removed and replaced while its original handle remained open, cleanup could delete another invocation’s lock. - Exceptional remediation: capture the acquired lock inode/device identity and unlink the lock pathname only when its current identity still matches; regression test replaces the lock during active cleanup and proves the replacement remains. -- Exceptional remediation standards reviewer: pending fresh identity and digest confirmation. -- Exceptional remediation specification reviewer: pending fresh identity and digest confirmation. +- Exceptional remediation standards reviewer: `develop-workflow-exception-standards` / `precedent-locator` / child `f28de7de` / session `01a06ceb-bd79-7050-86d5-693b50a01fe7`; digest confirmed; CHANGES REQUESTED. +- Exceptional remediation specification reviewer: `develop-workflow-exception-spec` / `claim-verifier` / child `4d059ea9` / session `01a06ceb-eace-7afb-afdd-df094bb66f6a`; digest confirmed; CHANGES REQUESTED. +- Remaining medium finding: `stat(lock)` followed by `unlink(lock)` is still a check-then-act race, and `stat` follows symlinks. An external replacement in that gap could be deleted. The regression replaced the lock after closing the original handle and did not model the exact scenario. - This review-brief checkpoint is necessarily a metadata-only commit after the pinned product HEAD because a record cannot contain the digest of bytes that include its own digest. Prove it touches only this record. ## Integration and rollback @@ -230,6 +231,7 @@ Rebase the feature branch onto the latest remote/local `main` when available, re - Post-rebase review outcome: standards approved; specification requested a focused lock-ownership fix. Both reviewers reported unchanged clean Git state. - Escalation decision: after two earlier remediation cycles, the user explicitly authorized one exceptional focused remediation cycle for this lock-ownership finding. - Approved remediation scope: capture the acquired lock identity, unlink only when the pathname still resolves to that identity, and add a regression test that replaces the pathname during an active checkpoint. -- Remediation result: implemented the approved scope at `52576c755666f95a40907b0500f095c6d314c346`; focused tests now pass 14/14, link tests pass 8/8, `bun run typecheck` exits 0, and `bun run test` exits 0. -- Final review fingerprint: tree `e60ba10af999203234edaeea29fc06f93e7b0a39`, digest `8da3680c6f0a9065ed6f509ba431253d91d89190ce048b4ece2d05e1b2755be0`. -- Next safe action: commit this metadata-only brief and obtain fresh independent approval. +- Remediation result: implemented the approved scope at `52576c755666f95a40907b0500f095c6d314c346`; focused tests pass 14/14, link tests pass 8/8, `bun run typecheck` exits 0, and `bun run test` exits 0. +- Review result: both axes rejected the remediation because identity verification and pathname deletion are not atomic; reviewers remained read-only with unchanged clean state. +- Architecture constraint: another conforming helper invocation cannot replace an existing lock because acquisition uses `open(..., "wx")`; the disputed race requires out-of-protocol filesystem mutation. Portable Node filesystem APIs provide no atomic compare-and-delete primitive for defending a path lock against that mutation. +- Next safe action: commit this failure evidence and ask the user whether to narrow the contract to cooperative actors, authorize a platform-specific advisory-lock redesign, or stop blocked.