You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Protected main already persists immutable result snapshots, but a process restart could not reconstruct the stored provenance and copied observations. A later result-serving worker would have no published snapshot to return, so buyers lose scores after deploy or crash.
This work is superseded by #157 through #137. Exact ancestry was reverified before closure: #137 is two commits ahead of this unchanged head, and #157 is two commits ahead of #137, with neither successor behind its predecessor. #157 carries this reload primitive plus current-session tip selection, contiguous observation-order enforcement, and fail-closed cyclic/all-superseded detection. Do not merge this predecessor.
Supersession evidence
This predecessor head: 2350c691ba87f5818f2c4745fbec70cfd8e36e2e
The successor remains Draft and is still subject to unchanged exact-head CI/security/review gates. Closing this PR does not promote successor behavior to protected-main truth.
A published result must survive process restart without calling the
scoring engine again. Reconstruct stored provenance and copied
observations so operators can serve the same snapshot, exact persist
replay stays Duplicate, and gapped or noncanonical evidence fails closed.
Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
The reason will be displayed to describe this comment to others. Learn more.
Stale comment
Review of 2350c69 (Draft). No independent last-push review and exact-head CI were still queued at review time. Do not merge #119.
The persist-then-reload primitive is sound: missing header is None, empty observations and noncanonical provenance fail closed, and exact persist replay stays Duplicate. Scope holds: no #97 owner/session binding, no HTTP transport, no psychometric recomputation, no postgres_recovery_invariants.rs edits.
Two holes keep this from being the slice a buyer can use after restart:
TRACEABILITY/CHANGELOG say gapped observation sets fail closed, but load never checks observation_order. The test named result_snapshot_gap deletes every observation row, not a middle gap. Orders 0,2 would rebuild and could be served as the published score.
load_result_snapshot requires a remembered result_snapshot_ref. After deploy or crash the serving path has the assessment session, not that id. Nothing in production calls load.
Successor #137 (feat(result): load current session snapshot after restart) rejects non-contiguous observation_order and adds load_current_result_snapshot_for_session for the unique non-superseded tip. Prefer #137 over this head.
Do not self-approve. Merge only after exact-head Runtime CI, coverage, and an independent last-push review on the preferred head.
The reason will be displayed to describe this comment to others. Learn more.
Prefer #157 (106a89b) over this head and over #137.
This slice reloads a result only when the worker already remembers result_snapshot_ref, and it accepted gapped observation_order such as 0,2. #137 added session-current tip load and contiguous-order fail-closed. #157 keeps that and fails closed when a supersession cycle leaves no tip, so a restarted worker cannot treat corruption as "no score yet".
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Why
Protected main already persists immutable result snapshots, but a process restart could not reconstruct the stored provenance and copied observations. A later result-serving worker would have no published snapshot to return, so buyers lose scores after deploy or crash.
This work is superseded by #157 through #137. Exact ancestry was reverified before closure: #137 is two commits ahead of this unchanged head, and #157 is two commits ahead of #137, with neither successor behind its predecessor. #157 carries this reload primitive plus current-session tip selection, contiguous observation-order enforcement, and fail-closed cyclic/all-superseded detection. Do not merge this predecessor.
Supersession evidence
2350c691ba87f5818f2c4745fbec70cfd8e36e2eaef54c9c81c90cdb842c3c9d7a04117b2e1648b5(aheadby 2, behind by 0)106a89b7c24c91ad596c3899803857ab707d2e8e(aheadof feat(result): load current session snapshot after restart #137 by 2, behind by 0)The successor remains Draft and is still subject to unchanged exact-head CI/security/review gates. Closing this PR does not promote successor behavior to protected-main truth.