feat: persist and reload live measurement sessions - #255
seonghobae wants to merge 12 commits into
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Keep identity-link history as a later slice and do not treat closed #159 as the persist vehicle. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
|
Warning Review limit reached
Next review available in: 18 minutes Limit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?Wait for the limit to reset, then comment An organization admin can change what happens after included review limits in Billing. How do review limits work?CodeRabbit enforces per-developer PR review limits within each organization. For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (21)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Store participants, consent, audit events, and export snapshot pointers in PostgreSQL so a buyer can continue after process death without re-consenting. Consent and audit payloads are AES-256-GCM sealed with purpose-bound keys; authorization stays ManageOwnSession. No scores, IRT, linking, or identity-link history are stored. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Keep identity-link history as a later slice and do not treat closed #159 as the persist vehicle. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Authorize invalid stored refs, collapse SQL helpers so each execute/query error path is reachable, and add real PostgreSQL tests for process-death equality, field rebind, missing later relations, and corrupt stored consent/audit evidence. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Collapse insert-or-classify so replay SELECT failures are reachable, restore a clean session before field rebinds, and add process-death, later-relation drop, and corrupt consent/audit reload tests. Invalid stored refs and export-pointer construction errors fail closed without a score kernel. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Hit audit-sort reload, overflow unix_ms, audit-only nonce rebind, invalid stored tenant/created_at, aborted-transaction SHOW, and remove the dead sealed_payload error arm. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Use one dyn classify predicate so unused monomorphizations cannot leave uncovered JSON lines, and replace matches! fail arms with an exhaustive error-name helper. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Run persist then process-death reload inside the crate tests so the adapter instantiations in the lib binary are actually executed. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
LLVM JSON line totals treat lib and integration Display copies as separate instantiations, so both must print every fail-closed variant. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
f7b5a2a to
f42ea4f
Compare
Hit persist_sealed_row classify when participant identity matches and only the stored consent nonce was rebound. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head1a348ae77cc8244f7a5b4c85d17371493617b18b. -
Head SHA:
1a348ae77cc8244f7a5b4c85d17371493617b18b -
Workflow run: 32132935757
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (8 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (8 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (10 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (10 files)"]
R2 --> V2["docs review"]
Evidence --> S3["Test (3 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (3 files)"]
R3 --> V3["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode cannot approve yet because required coverage evidence did not pass. Review outcome1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
Coverage evidenceCoverage Decision
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (8 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (8 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (10 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (10 files)"]
R2 --> V2["docs review"]
Evidence --> S3["Test (3 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (3 files)"]
R3 --> V3["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode cannot approve yet because required coverage evidence did not pass.
Review outcome
1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence
-
Problem: The required coverage-evidence job result was
failure, so OpenCode cannot establish approval sufficiency for this head. -
Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.
-
Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports
successwith required evidence or explicit no-source not-applicable evidence. -
Regression test: Keep the approval branch checking
needs.coverage-evidence.result == successbefore posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present. -
Result: REQUEST_CHANGES
-
Reason: coverage-evidence result was
failure, so required test/docstring evidence was not proven for current head1a348ae77cc8244f7a5b4c85d17371493617b18b. -
Head SHA:
1a348ae77cc8244f7a5b4c85d17371493617b18b -
Workflow run: 32139446034
-
Workflow attempt: 1
Coverage evidence
Coverage Decision
- Result: FAIL
- Test evidence: not proven passing
- Docstring evidence: not proven passing when configured
- Failure count: 1
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Changed file (8 files)"]
S1 --> I1["repository behavior"]
I1 --> R1["Review risk: Changed file (8 files)"]
R1 --> V1["required checks"]
Evidence --> S2["Docs (10 files)"]
S2 --> I2["operator or user guidance"]
I2 --> R2["Review risk: Docs (10 files)"]
R2 --> V2["docs review"]
Evidence --> S3["Test (3 files)"]
S3 --> I3["regression suite"]
I3 --> R3["Review risk: Test (3 files)"]
R3 --> V3["targeted test run"]
|
@opencode-agent Please review only exact head 4509cb8 against protected main 5544149. Earlier REQUEST_CHANGES reviews cited superseded heads or coverage evidence from those heads; do not transfer them. Report only actionable findings against this current SHA, and approve only from current-head evidence. |
|
Updated the original branch to exact head |
|
@opencode-agent Please review only exact head |
|
Current-head review recheck at c61bd99: the outstanding OpenCode CHANGES_REQUESTED record is coverage-only and cites superseded head 1a348ae. The branch already has the exact-head local measurement-session persistence, reference-integrity, anonymous command-authorization, integration-publisher, documentation, all-targets, format, clippy, rustdoc, and PostgreSQL evidence recorded in the prior reconciliation comments. No current-head code finding is identified; independent review and protected checks remain required. |
|
Closing as a superseded/architecturally competing persistence line. Current protected main |
2 participants
Why
After #225, persist/reload of a live measurement session remained the standing product Target. Buyers already grant purpose-specific consent and expect a later process or request to continue from that grant. In-memory aggregates disappear when the writer dies. Closed restore-reconcile work (#159, #158, #147, #133, #114, #124) is not a current landing. This PR implements the durable store.
What
MeasurementSessionas 3NF PostgreSQL 18 relations:assessment_participant,measurement_session,session_membership,session_consent_record,session_audit_event, andexport_snapshot_pointer.persist_then_process_death_reloads_consent_audit_and_membershipdrops the writer connection, reloads on a new connection, and continues without re-consenting.measurement_session_persist. Authorization isManageOwnSessiononly.Rebase
Rebased onto current
mainafter#231(d5443cdc1a52df8c7a34f0633a7353acfc79e008) leftmergeable_state: dirty. Conflicted files wereCHANGELOG.mdanddocs/TRACEABILITY.mdonly.Coverage follow-up
f42ea4f4d58bf8e4598113f81457a992d097da26passed Production line coverage (job 95580193494) and failed Production branch coverage 1425/1426 (job 95580193552). Format/lint/test/rustdoc, Strix, and coverage-evidence (job 95580299429) were green.Remaining on that head, from job 95580193552 diagnose:
src/postgres_measurement_session.rs51/52 —UNCOVERED_BRANCH ...:363:0:1persist_sealed_rowclassifystored_identity == identity_ref && stored_nonce == noncenever ran false after an identity match. Consent content rebind keeps the derived nonce (samesession_ref+event_ref); participant rebind short-circuits before the nonce comparison. Audit nonce-only rebind hitspersist_audit_insert(575:0:1), not this arm.This head adds
persist_then_reload_rejects_consent_nonce_only_rebind: persist, process-death reload, then exact replay after only the stored consent nonce is rebound. That evaluates the identity-true / nonce-false AND short-circuit.Local
cargo +nightly-2026-08-01 llvm-cov --branch --lib --test postgres_measurement_session:src/measurement_session.rs1127/1127 lines, 40/40 branchessrc/postgres_measurement_session.rs639/639 lines, 52/52 branchesUNCOVERED_BRANCHon those filesLane cut follows ADR-0004 / ADR-0007. This PR does not implement IRT, linking, scoring, or any psychometric kernel. It does not raise or reopen #159. It does not reopen identity-link #52. It is not stacked on #231 or #249.
Verification
cargo test --test postgres_measurement_session persist_then_reload_rejects_consent_nonce_only_rebindcargo +nightly-2026-08-01 llvm-cov --branch --lib --test postgres_measurement_sessioncargo fmt --all -- --checkIndependent non-author approval and required checks on the unchanged exact head remain merge gates. Never self-approve.
Operator next action
Review persist/reload equality, purpose-limited authorization, and sealed consent/audit. After this lands, keep identity-link history as a later slice. Do not add scores or reopen #159 on this branch.