fix(outbox): classify lease expiry from the database clock by cursor[bot] · Pull Request #105 · ContextualWisdomLab/psychometrics-commons

cursor · 2026-08-16T15:10:48Z

Summary

Repair for #60 at dbeea2be. Exclusive outbox delivery-lease recovery now classifies liveness from PostgreSQL clock_timestamp(), matching fenced attempt recording. A worker can no longer pass a future observed_at_unix_ms and steal a still-live lease.

This branch contains the #60 persist slice plus that fail-closed expire-clock fix. Prefer this head over #60 until #60 picks up the same change.

What changed

expire_outbox_delivery_lease compares lease_expires_at_unix_ms to the database clock, not the caller observation.
RED/GREEN evidence: future_caller_timestamp_cannot_expire_a_live_database_lease.
Existing still-live fail-closed coverage now uses a live database-clock lease plus a future caller timestamp.
Logical ERD records the exclusive-lease columns; as-built/traceability notes now say expire recovery is database-clock authoritative.
integration_consumption is recorded as protected-main after feat(integration): persist PostgreSQL inbox consumption distinct from receipt #58, not as Active PR feat(integration): persist PostgreSQL inbox consumption distinct from receipt #58.

Test plan

cargo test --test postgres_outbox_delivery_lease_authority --test postgres_outbox_delivery_lease against a real PostgreSQL database
cargo fmt --all -- --check
cargo clippy --locked --all-targets -- -D warnings

Next operator action

Review this head for the expire-clock contract, then land it instead of #60 or cherry-pick 69d0fa5 onto #60 before merge.

Claim a pending integration-outbox row with a fencing token so two workers cannot deliver the same event. Expired leases recover to pending without transferring that fence, and unfenced attempts fail closed while the lease is live.

Look up integration_outbox_lease_presence_check in the current schema so a second isolated search_path can install its own presence check. Serialize shared-schema lease fixtures behind an advisory lock to stop parallel CREATE SCHEMA/table races.

Replace isolated Result `?` tails that Linux llvm-cov counted as uncovered, and add claim-classify plus leased-update database-failure tests so exclusive delivery recovery stays fail-closed.

A failed claim aborts the transaction, so expire and leased-attempt error arms never ran. Use one transaction per operation.

Treat landed PostgreSQL readiness as Implemented and keep #60 as the Active outbox-lease slice. Expire classify now observes a still-live lease so the unmatched UPDATE path can fail the later SELECT.

Treat landed migration rollback coverage as Implemented and keep #60 as the Active persist slice.

Claim validation treated expires_at == 0 as InvalidTimestamp, but CI branch coverage only saw claimed_at == 0. Prove the second operand and satisfy rustfmt on the fencing-integrity helper.

Claiming with a positive start and a zero expiry must fail closed, and lease tokens decoded from PostgreSQL reject negative values. Expire classify uses an explicit match so the SELECT error arm is covered.

…ative fence Zero-expiry already short-circuited the claim window. Claimed-at overflow, UPDATE failure, and a negative returned fencing token need independent fail-closed evidence.

Lease Display arms were only exercised by lib unit tests, so the integration-test instantiation stayed eight lines short. Also split the concurrency acceptance fixture so clippy pedantic limits pass.

Keep Active PR #60 after the stale #76 heading, and seed the #81 claim deadline on the inherited #72 recovery fixture so exact-head CI can classify the processing restore row.

A future caller observation can no longer steal a still-live exclusive outbox delivery lease. Expiry recovery now uses PostgreSQL clock_timestamp(), matching fenced attempt classification. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

cursor · 2026-08-16T20:11:07Z

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

…c8-55ae

seonghobae

Independent last-push review of exact head c2541b96 (opencode-agent merge of protected main). Required checks opencode-review, noema-review, and coverage-evidence are SUCCESS. Classify lease expiry from the database clock is ready to land.

seonghobae · 2026-08-17T08:15:42Z

Hourly loop: exact head c2541b96 has opencode-review/noema-review/coverage-evidence SUCCESS. Last-push is opencode-agent[bot], so an independent last-push APPROVE was recorded. gh pr merge is still BLOCKED by base-branch policy (auto-merge is disabled; admin merge is forbidden). Leave merge to a protection-satisfying reviewer/path. This comment does not change that.

Keep persist-backed session HTTP as Active PR #232. Cover command-table load, insert-sink, and replay-lookup Database arms from the library.

seonghobae · 2026-08-17T09:42:49Z

Hourly loop: exact head c2541b96 merged to protected main as 7cf94226 after last-push APPROVE (last author opencode-agent[bot]) and CLEAN merge state. Outbox lease expiry now classifies from the database clock on protected main.

Retarget onto current protected main after #105/#84/#243/#244. Record shipped persist, narrative, credential, authorization, and outbox-lease evidence. Keep remaining persist and HTTP health Active PR. Keep main's recovery fixture that preserves the exact claim deadline. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

seonghobae and others added 30 commits August 14, 2026 10:47

test(integration): expose schema-scoped lease migration bug

dd9f602

fix(coverage): cover outbox lease database error paths

8b12fb9

Replace isolated Result `?` tails that Linux llvm-cov counted as uncovered, and add claim-classify plus leased-update database-failure tests so exclusive delivery recovery stays fail-closed.

test(integration): serialize remaining lease database cases

3bf4336

merge(main): reconcile persist PR #60 after #64

ff8a582

test(integration): isolate missing-outbox database paths

ea9a1ec

A failed claim aborts the transaction, so expire and leased-attempt error arms never ran. Use one transaction per operation.

merge(main): reconcile persist PR #60 after #62

3d9b792

Treat landed PostgreSQL readiness as Implemented and keep #60 as the Active outbox-lease slice. Expire classify now observes a still-live lease so the unmatched UPDATE path can fail the later SELECT.

test(outbox): prove lease fencing generation integrity

b2d2dc5

fix(outbox): constrain active fence to lease generation

06c9ca9

merge(main): reconcile persist PR #60 after #63

b38f0c2

Treat landed migration rollback coverage as Implemented and keep #60 as the Active persist slice.

test(outbox): cover zero expiry claim timestamps

50e4534

Claim validation treated expires_at == 0 as InvalidTimestamp, but CI branch coverage only saw claimed_at == 0. Prove the second operand and satisfy rustfmt on the fencing-integrity helper.

fix(integration): cover zero-expiry claims and negative lease tokens

c02eed2

Claiming with a positive start and a zero expiry must fail closed, and lease tokens decoded from PostgreSQL reject negative values. Expire classify uses an explicit match so the SELECT error arm is covered.

Merge protected main into outbox-lease slice

7c60e38

Merge protected main into outbox delivery lease slice

8ecacf3

Merge branch 'main' into feat/outbox-delivery-lease-20260814

1d395c4

test(integration): expose lease authority regressions

147fcee

style(test): rustfmt lease authority regressions

f082125

test(integration): isolate lease fencing schema

55aa094

test(integration): align lease tests with database clock

7c463cc

fix(integration): make lease authority database-clock fenced

43f2cb7

docs(architecture): map active outbox lease schema

75f29b1

test(integration): cover corrupt lease shape fail-closed path

969610c

test(integration): prove concurrent outbox claim exclusivity

9d9aa71

test(integration): serialize migration isolation schemas

a98687a

fix(ci): format outbox lease concurrency acceptance

09a0db3

fix(outbox): borrow claim race barrier

b175c70

test(outbox): cover lease replay and database-clock failure edges

d59c029

test(integration): require repairable lease column constraints

fbda49b

fix(integration): make lease constraints independently repairable

a0bd2af

seonghobae and others added 9 commits August 15, 2026 15:09

test(outbox): cover claimed-at overflow, claim query failure, and neg…

de7db2e

…ative fence Zero-expiry already short-circuited the claim window. Claimed-at overflow, UPDATE failure, and a negative returned fencing token need independent fail-closed evidence.

test(integration): prove blocked concurrent lease claim

db965a6

docs(architecture): reconcile lease evidence tests

db60451

fix(ci): rustfmt concurrent lease acceptance

0a309db

test(outbox): verify lease constraint reapplication definitions

4fc5302

style(outbox): apply rustfmt to concurrency acceptance

51f3f1f

fix(outbox): cover lease error displays and satisfy clippy

4fc3334

Lease Display arms were only exercised by lib unit tests, so the integration-test instantiation stayed eight lines short. Also split the concurrency acceptance fixture so clippy pedantic limits pass.

merge(main): reconcile persist PR #60 after #85

dbeea2b

Keep Active PR #60 after the stale #76 heading, and seed the #81 claim deadline on the inherited #72 recovery fixture so exact-head CI can classify the processing restore row.

seonghobae marked this pull request as ready for review August 16, 2026 20:11

seonghobae and others added 3 commits August 17, 2026 07:10

merge(main): reconcile protected anonymous credential lifecycle

078e082

Merge branch 'main' into cursor/bc-d00f59be-1bb0-4e1d-9e7a-08b0c394b9…

b5a0449

…c8-55ae

Merge branch 'main' into cursor/bc-d00f59be-1bb0-4e1d-9e7a-08b0c394b9…

c2541b9

…c8-55ae

seonghobae approved these changes Aug 17, 2026

View reviewed changes

seonghobae merged commit 7cf9422 into main Aug 17, 2026
33 checks passed

seonghobae added a commit that referenced this pull request Aug 17, 2026

merge(main): reconcile protected outbox clock after #105

8eacd55

Keep persist-backed session HTTP as Active PR #232. Cover command-table load, insert-sink, and replay-lookup Database arms from the library.

seonghobae mentioned this pull request Aug 17, 2026

feat(api): start and reload sessions over persist-backed HTTP #232

Merged

4 tasks

seonghobae added a commit that referenced this pull request Aug 17, 2026

merge(main): reconcile outbox lease-expiry clock after #105

21056aa

Navigation Menu

Uh oh!

fix(outbox): classify lease expiry from the database clock - #105

fix(outbox): classify lease expiry from the database clock#105
seonghobae merged 42 commits into
mainfrom
cursor/bc-d00f59be-1bb0-4e1d-9e7a-08b0c394b9c8-55ae

cursor Bot commented Aug 16, 2026

Uh oh!

cursor Bot commented Aug 16, 2026

Uh oh!

seonghobae left a comment

Uh oh!

seonghobae commented Aug 17, 2026

Uh oh!

Uh oh!

seonghobae commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

cursor Bot commented Aug 16, 2026

Summary

What changed

Test plan

Next operator action

Uh oh!

cursor Bot commented Aug 16, 2026

Uh oh!

seonghobae left a comment

Choose a reason for hiding this comment

Uh oh!

seonghobae commented Aug 17, 2026

Uh oh!

Uh oh!

seonghobae commented Aug 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants