fix(consent): stop documenting event-identity tail order by cursor[bot] · Pull Request #142 · ContextualWisdomLab/psychometrics-commons

cursor · 2026-08-16T15:52:04Z

Why

#134 fails closed when two durable consent_event rows share occurred_at_unix_ms and created_at. Its module rustdoc still said the tail was ordered by occurrence time, insertion time, then event identity. That is the exact opaque-key tie-breaker this slice rejects.

Prefer this head over #134 at 729a2bd. Do not merge #70 at 3180620, #112 at 040bcf7, #120 at 3f72446, #123 at 6643041, or #134 at 729a2bd.

What

Successor of #134 on the same fail-closed tail:

Module rustdoc now requires a unique durable tail ordered by occurrence time, then insertion time.
Persist-level RED/GREEN: a complete ledger plus either the tied grant or the tied revoke envelope leaves integration_outbox empty.
ADR-0006 records the tied-tail invariant and cites Helsinki 2024, ISO/IEC 29184:2020, and ISO/IEC TS 27560:2023. NIST Privacy Framework 1.0 remains the published framework; 1.1 is still an initial public draft.

This does not change consent purposes, infer consent, duplicate identity credentials, or weaken research opt-in separation.

Verification

cargo test --lib postgres_consent_propagation::envelope_tests
cargo test --test documentation_architecture_contract --test traceability_active_pr_contract
cargo clippy --all-targets -- -D warnings
full Runtime CI, exact statement/branch coverage, docs, security and independent review on the exact head

Next after this lands: make persist_consent_ledger_with_outbox the sole product consent write path, then purpose-specific consent HTTP (POST /v1/consents).

Independent non-author approval and required checks on the unchanged exact head remain merge gates. Never self-approve.

Reject a grant-only snapshot after a stored revocation by locking the participant ledger and requiring the durable event tail to match the envelope before enqueue. Record the Active PR composition in traceability, changelog, ERD, UML, and as-built schema. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Exercise missing ledger or event rows, time and identity mismatch, timestamp overflow, and dropped relations so the tail lock stays at full statement and branch coverage. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Same-millisecond grant then revoke must bind the later-inserted revoke, not a lexicographically larger grant event_ref. Keep the ledger FOR UPDATE lock and fail closed on a grant-only snapshot after that revoke. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Reject a consent/outbox bind when two events share occurrence time and created_at, and require every durable event identity in the submitted ledger so opaque event_ref cannot reopen the #112 grant-beside-revoke hole. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Point TRACEABILITY, ERD, UML, and AS_BUILT at #134 so agents do not land #70, #112, #120, or #123. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Module rustdoc still described occurrence, insertion, then event identity. That is the exact tie-breaker this slice rejects. Align the rustdoc, prove both tied envelopes fail closed at persist, and cite Helsinki 2024 plus ISO/IEC 29184 and TS 27560 for the consent-record interchange target. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Prefer #142 over #134. The earlier head still documents event identity as a durable-tail key. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

Keep the authorization write-path gate independent of durable-tail ordering and point agents at #142 instead of #134. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

cursor

Stale comment

Consent/outbox landing vehicle

Head 75d71eb is the correct successor of #70/#112/#120/#123/#134.

Verified:

Durable tail is ORDER BY occurred_at_unix_ms DESC, created_at DESC with no event_ref sort key.

Tied created_at fails closed (tied != 1 → InvalidPropagationEnvelope).

Module and function rustdoc no longer say “then event identity”.

Same-millisecond later revoke beats a lexicographically larger grant.

Do not merge #70, #112, #120, #123, or #134 in parallel.

Residuals for later slices, not this merge: persist_consent_ledger is still a public write path; make persist_consent_ledger_with_outbox the sole product write after land; ledger reload stays on #140; then POST /v1/consents.

Independent last-push approval and exact-head required checks remain required. This review does not approve.

_{Sent by Cursor Automation: Fix Issues}

cursor

Prefer this exact head (75d71eb) over #134 at 729a2bd, #123 at 6643041, #120 at 3f72446, #112 at 040bcf7, and #70 at 3180620.

The unique slice matches the code. Module and function rustdoc require a unique durable tail ordered by occurrence time, then insertion time. They mention opaque event identity only to reject it. require_durable_ledger_tail locks consent_ledger, requires every durable consent_event identity in the submitted ledger, orders only by occurred_at_unix_ms DESC, created_at DESC, and fails closed when tied != 1. Persist-level equal_created_at_cannot_bind_either_tied_envelope submits a complete grant+revoke ledger with either tied envelope and leaves integration_outbox empty. ADR-0006 invariants 7–8 cite Helsinki 2024, ISO/IEC 29184:2020, and ISO/IEC TS 27560:2023. NIST Privacy Framework 1.0 stays; 1.1 is still CSWP 40 IPD.

No blocking production defect on this slice. Independent non-author approval and required checks on this unchanged head remain the merge gates. Do not self-approve.

persist_consent_ledger is still a public skip-outbox write path. That is the next product gap after this lands, then purpose-specific POST /v1/consents. Do not fold those onto this head. Do not merge the predecessor outbox PRs in parallel.

Reload remains independent #140. Session HTTP remains #149 and must not stack here.

_{Sent by Cursor Automation: Fix Issues}

cursor · 2026-08-16T15:59:19Z

+- `consent_ledger` and `consent_event` persist the already-merged `src/consent.rs` append-only ledger through `migrations/0005_consent_lifecycle.sql`. Active PR #142 composes those existing rows with `integration_outbox` in one caller-owned transaction after locking the participant ledger, requiring the submitted ledger to contain every durable event identity, and selecting a unique durable tail by occurrence time then `created_at`; it adds no new physical objects. HTTP consent transport and derived snapshot tables remain Target.
 - `participant_identity_link` is the persistence target accepted by ADR-0020. The current `src/participant.rs` `keyverse_subject_ref` field is an application-domain first-link projection, not the future mutable persistence source of truth.
 - `longitudinal_enrollment`, `longitudinal_observation_record`, and `temporal_analysis_submission` make the ADR-0008 Commons-owned Gyeot/TEPP orchestration boundary explicit. No TEPP analytical kernel is duplicated here.
 - `integration_outbox`, `integration_delivery_attempt`, `integration_inbox`, and `integration_consumption` reflect `src/integration.rs` domain semantics. Outbox/inbox/delivery-attempt tables are on protected main; `integration_consumption` pending/processing/completed/quarantined persistence and expire-and-reclaim of a crashed processing claim exist only on this Active PR until merged.


This adjacent sentence still says integration_consumption exists only on this Active PR. Protected main already ships migrations/0012_integration_consumption.sql and TRACEABILITY maps that adapter as implemented. Leave it off this consent/outbox head; correct the leftover on a docs-only follow-up after #142 lands.

Protected-main #81 requires claim_deadline_at on processing integration_consumption rows. Recovery fixtures that omit the column fail constraint integration_consumption_claim_deadline_shape.

opencode-agent · 2026-09-03T08:01:33Z

Scheduled review-feedback autofix for this PR head.

Head SHA: 47568be07b2b991715b4e1171037426026e71814

opencode-agent · 2026-09-24T13:59:49Z

Scheduled review-feedback autofix for this PR head.

Head SHA: 47568be07b2b991715b4e1171037426026e71814

seonghobae and others added 27 commits August 14, 2026 18:15

test(consent): require atomic consent outbox persistence

23e8acf

feat(consent): persist lifecycle with bound outbox event

0b4dae6

feat(consent): export transactional propagation adapter

15f9842

test(consent): cover propagation envelope boundaries

d499867

test(consent): preserve consent failure boundary in outbox composition

9c65cb2

style(consent): apply rustfmt to propagation tests

bf1dfe7

style(consent): apply rustfmt to outbox transaction tests

f1d23ff

style(consent): terminate propagation module with newline

0c414a6

style(consent): terminate propagation transaction test

1ff6411

test(consent): reject stale propagation after revocation

43a7ddb

fix(consent): bind propagation to latest consent change

65ee847

test(consent): reject cross-tenant propagation envelopes

bf1a8d5

fix(consent): bind propagation to authorized tenant

f2c050e

test(consent): carry tenant authority into error boundary

1f71fbb

test(consent): bind latest-event propagation to tenant

2d4da10

fix(consent): reject tenant alias spellings

3744334

style(consent): apply rustfmt to latest-event test

93092fd

style(consent): apply rustfmt to transaction test

cf78b37

Merge branch 'main' into feat/consent-outbox-transaction-20260814-1821

3180620

docs(consent): name Active PR #120 as the outbox merge candidate

3f72446

Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

docs(consent): name Active PR #134 as the outbox merge candidate

729a2bd

Point TRACEABILITY, ERD, UML, and AS_BUILT at #134 so agents do not land #70, #112, #120, or #123. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

docs(consent): name Active PR #142 as the outbox merge candidate

75d71eb

Prefer #142 over #134. The earlier head still documents event identity as a durable-tail key. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>

cursor Bot requested a review from seonghobae August 16, 2026 15:52

This was referenced Aug 16, 2026

fix(consent): fail closed on ambiguous durable tail #134

Closed

feat(consent): reload persisted ledgers after restart #140

Closed

seonghobae mentioned this pull request Aug 16, 2026

feat(consent): authorize owner before durable writes #145

Closed

cursor Bot commented Aug 16, 2026

View reviewed changes

This was referenced Aug 16, 2026

fix(consent): fail closed on reordered stored history #156

Closed

feat(consent): persist only after owner authorization #170

Closed

This was referenced Aug 16, 2026

fix(consent): order durable tail by insertion time #120

Closed

fix(consent): bind outbox to durable ledger tail #112

Closed

This was referenced Aug 16, 2026

feat(consent): persist anonymous session consent after expiry checks #181

Draft

feat(item-delivery): reload persisted ledgers after restart #186

Closed

test(recovery): seed processing claim_deadline_at after inbox expiry

47568be

Protected-main #81 requires claim_deadline_at on processing integration_consumption rows. Recovery fixtures that omit the column fail constraint integration_consumption_claim_deadline_shape.

seonghobae mentioned this pull request Aug 16, 2026

fix(consent): order durable outbox tail by insert time #123

Closed

seonghobae added bug Something isn't working type: bug priority: high labels Sep 7, 2026 — with ChatGPT Codex Connector

Navigation Menu

fix(consent): stop documenting event-identity tail order - #142

fix(consent): stop documenting event-identity tail order#142
cursor[bot] wants to merge 28 commits into
mainfrom
cursor/bc-67661417-bfc3-45ad-bb83-dcde94bd10d5-3ec5

cursor Bot commented Aug 16, 2026

Uh oh!

cursor Bot left a comment •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 16, 2026

Uh oh!

opencode-agent Bot commented Sep 3, 2026

Uh oh!

opencode-agent Bot commented Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

cursor Bot commented Aug 16, 2026

Why

What

Verification

Uh oh!

cursor Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Consent/outbox landing vehicle

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 16, 2026

Choose a reason for hiding this comment

Uh oh!

opencode-agent Bot commented Sep 3, 2026

Uh oh!

opencode-agent Bot commented Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

cursor Bot left a comment •

edited

Loading