Repository navigation
DSV 회차 계약·서버 지오펜싱·영속 알림 P1–P3 구현 - #483
Merged
Merged
Conversation
Use additive logical execution fences and transactional intents to preserve legacy publication and event contracts. Persist raw-sample geofence evidence and bounded leased delivery work while new live sending remains OFF. Constraint: Server P1-P3 only; synthetic GPS, fake provider and disposable DB proof Rejected: Reusing child UUID or assignmentGeneration | neither tracks both content and attribution Confidence: high Scope-risk: broad Directive: Complete D01/D02/D04/D05/D07 and release evidence before live activation Tested: Prisma generate, full lint/typecheck/test/build, 3219 unit tests, 28 DSV and 37 G003 actual PostgreSQL tests, 23 frozen D03 cases, independent source review Not-tested: Actual GPS shadow, production migration/deploy, real FCM, app/device integration Refs: #482 Change-control: EVNSolution/clever-change-control#310
Keep generic grouped assignment APIs compatible through the shared immutable child successor. Serialize route mutation and execution mapping with the same route row lock to avoid advisory/row lock inversion. Constraint: Existing driver clients and partial-event evidence must remain valid Rejected: Rejecting grouped generic assignment | broke the existing PostgreSQL contract regression Confidence: high Scope-risk: moderate Directive: Keep route-row before context-row locking; preserve archived child evidence Tested: Full lint/typecheck/test/build, 3219 unit tests, actual PostgreSQL DSV 30/G002 7/G003 37, forced assignment-sync and internal-close races, independent source re-review Not-tested: Production migration/deployment, actual GPS, real provider/device integration Refs: #482 Change-control: EVNSolution/clever-change-control#310
A published draft needs every projection to be coherent before execution validation. Unpublished drafts do not establish a notification execution. Constraint: Preserve legacy grouped assignment and transaction rollback behavior Rejected: Synchronize inside child replacement | callers still have incomplete projections Confidence: high Scope-risk: moderate Directive: Synchronize each published successor at the completed business boundary in the same transaction Tested: Prisma generate; full lint, typecheck, 3221 unit tests and build; 272 disposable PostgreSQL tests and 5 original observation tests; P0 23-case fixture matching; independent source review Not-tested: Actual fleet GPS, devices, production migration, deployment and live notifications
Reject resource deletion while published work or active executions depend on it. Use confirmed exit evidence and immutable service dates for driver reminders. Preserve legacy partial-publication and skipped-command history. Refs #482 Change-control: EVNSolution/clever-change-control#310 Constraint: Existing clients and publication evidence must remain compatible; new live sending stays OFF. Rejected: Cascade historical executions or reopen them on another date | would erase evidence or change logical attribution. Confidence: high Scope-risk: moderate Directive: Do not treat synthetic policy values or this correction as operational activation approval. Tested: API prisma:generate, lint, typecheck, 3241 tests, build; 284 distinct disposable DB cases and 5 original-observation cases; independent code and design review. Not-tested: Actual fleet GPS, devices, production migration, deployment and live FCM.
Prelock sorted account, route and driver unions before linking. Retry only changed topology as a whole transaction and keep attribution and sessions atomic across every existing account-link writer. Constraint: Preserve route-before-resource writers, legacy clients and default-OFF sending Rejected: Retry SQL deadlocks | Cyclic lock order would remain Confidence: high Scope-risk: moderate Directive: Never acquire newly discovered account or route locks after driver locks Tested: Prisma generation, lint, typecheck, 3255 tests, build, 294 disposable PostgreSQL cases, 54 final DSV cases and 5 original-observation cases Not-tested: Production data, real GPS, device integration, migration deployment and real FCM sending Refs: #482 Change-control: EVNSolution/clever-change-control#310
This was referenced Oct 6, 2026
Connect candidate clients to a real Fastify and Prisma runtime with synthetic fixtures and a fake push provider. Cover competing workers and command recovery without production access. Constraint: Preserve legacy clients, default-OFF sending, business installs and Driver PR61 Rejected: Count synthetic Prisma storage as DB proof | It does not verify migrations or durable transactions Confidence: high Scope-risk: narrow Directive: Keep loopback fixtures and explicit disposable database guards out of production activation Tested: 102 real PostgreSQL cases, 2 real-DB browser cases, Prisma generation, shell syntax and secret scan Not-tested: Local full lint timed out at 600s; exact-SHA CI, native installation and real FCM evidence are separate
Constraint: The server CORS option accepts a string or false and the browser uses a same-origin proxy Rejected: Widen the production option type | The fixture needs no cross-origin permission Confidence: high Scope-risk: narrow Directive: Use the loopback proxy for browser fixtures Tested: Prior real HTTP four-case run and exact-SHA CI diagnosis Not-tested: Corrected exact-SHA CI is pending
Constraint: Separate real database, browser, bundle, APK and live-provider evidence Confidence: high Scope-risk: narrow Directive: Keep unresolved operational policy and provider gates separate from isolated test completion Tested: Final 62-case local DSV DB run, G00337/G0027, server CI301 DB cases plus original5 and 3267 unit cases Not-tested: Live GPS, real FCM, operational policies and production deployment
Refresh only the transitive busboy lock entry from 3.2.0 to 3.2.2 within both existing parent dependency ranges. Constraint: Keep the production audit threshold and supported Fastify and Firebase versions Rejected: Audit exclusion or new override | The existing semver ranges accept the upstream patch Confidence: high Scope-risk: narrow Directive: Preserve production audit and verify multipart contracts when changing this dependency Tested: Production audit found zero vulnerabilities; local installed busboy is 3.2.2; lock diff is one entry Not-tested: New full exact-SHA CI is pending; live provider and production deployment remain excluded
Constraint: Keep all device fixtures loopback-only, disposable, synthetic, and backed by PostgreSQL with fake push providers.\nRejected: Directly inject geofence notifications | It would not validate telemetry jobs and geofence worker behavior.\nConfidence: high\nScope-risk: narrow\nDirective: Keep fixture actions out of production dependency wiring and lock resets during device flows.\nTested: PostgreSQL 17 with 113 migrations; 64 operational and HTTP integration tests passed with one worker.\nNot-tested: Physical Android UI flow and real FCM delivery are separate validation steps.
Constraint: The isolated Android flow must exercise the strict Driver parser without weakening product validation.\nRejected: Relax the incomplete-stop validator | It would hide malformed dispatch projections.\nConfidence: high\nScope-risk: narrow\nDirective: Preserve the complete normalized DSV payload when fixture actions change one field.\nTested: Actual Driver loadDriverDeliveryRoute parsed both live PostgreSQL fixture stops after metadata repair.\nNot-tested: Fresh disposable PostgreSQL regression is deferred until the active device flow releases its locked fixture.
The isolated client regression now creates the replacement driver before registration, verifies the canonical account subject, synchronizes the real execution context, and loads the reassigned route through the production Driver client. Constraint: Preserve production route-access authorization and the active device fixture. Rejected: Relax route-access checks | The failure came from an incomplete synthetic account binding. Confidence: high Scope-risk: narrow Directive: Reassignment fixtures must use the real driver registration link before route synchronization. Tested: git diff --check; live PostgreSQL route-access lookup returned the reassigned two-stop route after canonical binding. Not-tested: Fresh disposable PostgreSQL regression is pending release of the active device fixture.
Record the final fresh PostgreSQL regressions, production Driver reassignment path, actual device HTTP and DB evidence, and the exact runtime-to-final-source boundary. Constraint: Isolated evidence must not imply production activation, real provider delivery, or a final-source device runtime. Rejected: Merge earlier and final database counts | The final 109 tests are one fresh run across three new clusters. Confidence: high Scope-risk: narrow Directive: Keep runtime SHA, test-input SHA, fake provider evidence, and production activation claims separate. Tested: Fresh PostgreSQL 17 run applied 113 migrations per database; G002 7/7, G003 37/37, DSV operational and HTTP 65/65; git diff --check. Not-tested: Production runtime, AWS, production database, real FCM delivery, and operational deployment.
Use narrow route envelopes, direct assertions, synchronous serialized callbacks, and Prisma's inferred JSON input so the real-DB harness satisfies the existing typed lint policy. Constraint: Keep typed ESLint criteria and production authorization unchanged. Rejected: Disable unsafe-value lint rules | The external response boundary can use a narrow local contract. Confidence: high Scope-risk: narrow Directive: Type external Driver response envelopes before asserting fixture projections. Tested: Targeted typed ESLint with 4 GiB; delivery-api typecheck; fresh PostgreSQL 17 with 113 migrations and DSV operational/HTTP/Driver 65/65. Not-tested: G002 and G003 were unchanged after their final 7/7 and 37/37 run.
Add the CI lint finding, its narrow fix, and the fresh affected PostgreSQL rerun while retaining the earlier standalone G002 and G003 evidence. Constraint: Final evidence must preserve which SHA and cluster produced each result. Rejected: Recount G002 and G003 after test-only typing edits | Their owning source did not change. Confidence: high Scope-risk: narrow Directive: Keep the 109-test run and the later 65-test lint-fix rerun distinct. Tested: git diff --check; typed ESLint; delivery-api typecheck; fresh PostgreSQL DSV 65/65. Not-tested: Production runtime, real provider delivery, AWS, and deployment.
Label the 9fff artifact and 96317 CI as initial evidence, distinguish the 3de7 database input, and link the completed Driver device record and canonical plan. Constraint: Earlier provenance must remain available without being presented as the final candidate. Rejected: Replace the initial artifact record | The build and login-only evidence remains valid for its original scope. Confidence: high Scope-risk: narrow Directive: Use the Driver completion record and canonical device-flow plan for the final native result. Tested: git diff --check; documentation provenance reviewed against Driver 6e2db49 and the canonical device-flow record. Not-tested: Documentation-only change; execution checks were not repeated.
This was referenced Oct 7, 2026
… be reviewed against the current route-grouping and completion code PR #483 was 29 commits behind main and GitHub reported it CONFLICTING. This merge takes main's live route change, cash receipt, delivery options and route-group deletion changes, and keeps the DSV execution hooks beside them. Constraint: main #522-#524 stopped cancelling sibling routes when a child route is deleted, so the DSV close hook for cancelled siblings no longer has a target and was dropped. Rejected: rebase of the 16 DSV commits | each commit would repeat the same 7 conflicts; one merge resolves them once Rejected: narrow Pick transaction type from the DSV branch | main's live-route validators require the full Prisma.TransactionClient; the export is kept for the DSV command service Confidence: medium Scope-risk: moderate Directive: the child publish transaction now runs main's membership lock and authority checks before the DSV CURRENT-guarded publish and execution sync; keep that order. Tested: prisma generate/validate, tsc, vitest 3437 pass (7 web-asset tests pass after route-ops-web build), DSV PostgreSQL integration 63 pass, typed eslint, env-authority Not-tested: CI on this merge, production migration order, real FCM or vehicle GPS Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ped routes after the main merge CI on 2bd3b17 failed route-grouping-save: assigning a driver without an average left the unchosen stops at the previous driver's 6 minutes. The merge had placed main's refreshPlannedRouteTimes call (which applies the driver average since #502) inside the DSV branch's "not synced by a child successor" gate, so grouped routes never re-applied the Stop time. The DSV execution hook keeps its gate; the planned-time refresh now runs on every driver change. Confidence: high Scope-risk: narrow Tested: route-grouping-save + admin-active-route-reorder 59 pass on PostgreSQL 17, full vitest 3444 pass, completion-assistance 35, kfood completion 4, live-route-change 45, cash completion 26, private demo 10, DSV operational 63 Not-tested: CI rerun (pushed for CI) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… the CI profile can run it after main's private driver demo The merged disposable profile started both the private driver demo container (main #506) and the DSV operational container on 127.0.0.1:55496, so the DSV step failed with exit 125 before any test ran. The DSV database moves to 55497; the exact-URL guards in the test and the HTTP harness follow. Confidence: high Scope-risk: narrow Tested: bash -n on both scripts, --plan output, tsc, DSV operational + isolated HTTP tests 63 pass on PostgreSQL 17 at 127.0.0.1:55497 Not-tested: docker-based CI profile (pushed for CI) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…I deadlock shows both statements CI run 38125390255 failed in the isolated HTTP harness seeding with a PostgreSQL deadlock (40P01) that ten local runs did not reproduce. The client error names only the two backend processes; the statements are in the server log, which the disposable container discards on cleanup. Confidence: high Scope-risk: narrow Tested: bash -n Not-tested: failure path in CI (only runs when the profile fails) Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…tion server branch Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DSV 배차 공개·변경·취소를 회차와 영속 알림에 연결합니다. 원자적 시작 승인, UVIS 지오펜싱, N01~N07 intent·알림함·resolver·발송 worker와 관제 API를 제공합니다. 구형 Driver 계약과 기본 OFF를 유지합니다.
계정 연결과 기사 삭제는 account → 전체 route → 전체 driver 순서로 잠급니다. topology가 바뀌면 전체 트랜잭션을 다시 시작합니다. epoch·수신자·intent·receipt·session은 같은 트랜잭션으로 일치합니다. 기존 grouped 배정·immutable child·부분 성공 이력과 resource 삭제 방어를 유지합니다.
격리 검증은 실제 PostgreSQL17.10, Fastify·Prisma·JWT와 관리자 cookie/CSRF를 사용합니다. 자료·GPS는 합성이며 fake push provider만 구성합니다. production audit 차단은 기존 parent 범위 안에서
@fastify/busboylock entry를 3.2.2로 갱신했습니다. audit 기준을 낮추지 않았습니다.44e6d880684609f7d075f3102c634a999b5c24ca6e2db49e0415786c018762a26a6b136bcef5b74372709e3afe67eb2700e9baf035a89c090b0effdf실제 기기에서 로그인 → 배송일·배차 선택 → N01/N02/N04 안내 → 시험 시각의 출발+300초 첫 N05와 최소300초 반복 → UI 시작 승인 후 반복 종료를 수행했습니다. N06 알림창 탭은 두 배송지 중 지정한 targetStopId를 열었습니다. 앱 미배송 보고는 실제 관제 N07로 이어졌고 확인·처리 완료 후에도 주문·배송지 결과를 유지했습니다.
오프라인 전송 뒤 suffix 앱을 재실행했습니다. 저장된 명령과 입력을 복구했습니다. 첫 보고201 응답을 proxy에서 유실시켰습니다. 자동 재시도는 같은 commandId로200
duplicate=true였습니다. 직접 SQL에서 report·N07·command receipt 각1, target stop=PENDING, STOP_FAILED0, provider attempt0을 확인했습니다. 보고 처리 직후 route=IN_PROGRESS이며 최종 CANCELLED는 이후 합성 취소 시험의 결과입니다.인증 만료의 resolve401→refresh200→같은 알림 resolve200, 계정 변경·재배정·취소의 stale resolver404를 실제 화면에서 확인했습니다. 새 배송원의 canonical 계정 연결과 두 배송지 표시도 확인했습니다. 보호 알림 버튼이 system navigation으로 밀리는 결함을 SafeArea overlay로 수정했습니다. 새 APK에서 두 버튼을 탭하고 입력 보존·fresh 목적지 이동을 다시 확인했습니다. 합성 fixture metadata와 authSubject 누락도 수정하고 실제 Driver parser·route-access 회귀를 추가했습니다.
최종 APK는
com.evnsolution.clever.driver.integration, version0.1.14(23), arm64, Android Debug 서명입니다. SHA256은2c78ef20bc8522dd46d8c57965ca664727f397aaa5f8557709c2334dd98d09d7입니다. 설치본 base.apk의 hash도 일치합니다. 최종 APK 실행 소스는 Driver1075507dedc3838356a372fc9bce9756157a1fe4입니다. 앞선 주요 업무 흐름 APK 소스47825ad9c8d271cc1277ebe8a44afb14577ad957와 수정 후 재검증을 구분합니다. 최종 Driver head의 차이는 문서뿐입니다.실기기 서버 runtime 소스는
55a8979d476df4e07e3c3ac0b2dd1ca0094e4217입니다. 이후 변경은 fixture metadata·계정 연결 회귀·typed lint·검증 문서입니다. 최종 DB 전체109건의 입력 소스는3de7a884a8592fe6442e33abe7d543b051e1f41f이며 lint 수정 소스86d7194cf615367ee0752d267a49319f6f48e12e에서65건을 다시 통과했습니다. 실행 소스와 문서 head를 같은 실행으로 표현하지 않습니다.기존 실제 DB 검사는 동시 명령, 재배정·권한 상실·다른 사업장, CSRF, 2worker 경쟁·재시작·lease 회수와 transaction rollback도 포함합니다. 이전 합성 Prisma source harness는 실제 DB 결과로 계산하지 않습니다. 구형 클라이언트와 기본 OFF를 유지합니다. 웹 W1은 조회한 정확한 회차 상태를 알 수 없으면 새 SAME_EXECUTION/select를 차단합니다. NEW_EXECUTION과 불확실 명령의 동일 commandId 재시도는 구분합니다. 미조회 ID와 최종 업무 권한은 서버가 검증합니다.
서버 검증 기록, 서버 기술 계약, Driver 실기기 기록, Web 기록에 증거를 연결했습니다. 로컬 dossier는 canonical server의
.omx/plans/dsv-android-device-flow-20261007.md, sanitized PNG·HTTP·SQL·hash manifest는.omx/reports/dsv-android-device-flow-20261007에 보존합니다. CI의 외부 Driver 소스가 없는 guarded skip은 통과로 계산하지 않습니다.합성 Android local notification 클릭은 실제 FCM 수신 증거가 아닙니다. 실제 FCM·background/terminated 전달, 실차 GPS, camera/POD·다기기·Safari, 운영 Firebase·배포 서명·runtime은 미검증입니다. 미전송 초안의 process 종료 후 복구도 미검증입니다. Issue62 audit high20/critical0은 지원되는 수정 버전이 없어 출시 차단으로 남습니다. D01/D02/D04/D05/D07과 반복 최대6회는 승인하지 않습니다. P7은 별도입니다.
기본 checkout, 다른 worktree, Driver PR61 Draft
a7959e5a84393d7dc57e2caa654ea2f8edad202c를 보존했습니다. 업무용 package0.1.15(26)의 split4개 hash와 설치 시각이 전후 일치합니다. 업무용 앱·데이터·서명 자료를 변경하지 않았습니다. 소유 테스트 프로세스와 reverse만 종료했습니다. 격리 통합·실기기 흐름 완료는 운영 활성화 완료가 아닙니다. PR 병합·운영 배포·AWS·운영 DB 변경·실제 알림 발송을 수행하지 않았습니다.Refs #482
Change-control: EVNSolution/clever-change-control#310