Repository navigation
fix: harden escrow, share authorization and personal proofs (#75–77 partial) - #99
LIghtJUNction wants to merge 4 commits into
Conversation
One-use feature-branch materializer. It only applies the reviewed patch and publishes that branch; it does not merge, deploy, close issues, or weaken existing CI. The materializer removes itself before the final PR tree.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Publication/integration update: final feature head is now The local SQLite smoke was actually rerun in this publishing session: 76 tests passed in 82.07 s; JUnit reports zero failures, errors and skips. This is supporting evidence only, not production PostgreSQL evidence. The earlier baseline-head PR run was superseded after main advanced. Full unchanged Python 3.15/PostgreSQL/Valkey CI on the combined head is run 36348523874 and must finish successfully before merge. Scoped review checked the single escrow debit path, positive/funded balance and system-account binding, current buyer proof, decision/source-proof append in the same transaction, rollback/duplicate journal guards, current grant-chain attenuation, independent-source survival, immutable personal revision verification, and display-only pins. No arbitrary arbitrator payout or new security authority is enabled. The newly merged |
|
Coordination: #102 now contains a complete competing market/escrow lifecycle for #73–75, so merging both EscrowEngine implementations without reconciliation would be unsafe. For the parallel #74–76 request I am not publishing my alternative market implementation. I am isolating #76 live organization/ShareGrant/ancestor-topic revocation fixes and a real PostgreSQL cross-transport test matrix (HTTP/PathGET/GraphQL/MCP, history, search, Sync, outbox). These overlap your authorization hardening; please retain all negative cases when rebasing rather than choosing a whole-file overwrite. #77 work is outside my change. |
Full combined CI 36348523874 failed with 122 collection errors because test_service imported the directory-scoped installed fixture from the bare conftest module after tests/issue_78_80/conftest.py had been imported. Let pytest resolve installed by fixture name instead, and remove the redundant re-export import in test_transfer. No fixture, production code, assertion, or CI selection changes. Reproduced nested-conftest shadowing locally against both real test modules: 2 import errors before, all 8 selected tests collected after. Full Python 3.15/PostgreSQL CI will rerun on this commit. Refs #75, #76, #77.
|
CI integration fix: combined-head run 36348523874 failed during collection, before business tests ran. The newly merged nested Commit The unchanged full Python 3.15/PostgreSQL/Valkey workflow is rerunning on the corrected head: 36348904368. Merge remains blocked on its actual outcome. |
Integrate main b1ac767, preserving its CI shards, schema hardening and live notification lease fences. Add group-reshare revocation, historical reads, known-digest cache, search, Sync and independent-authority checks across HTTP, GET path, GraphQL, MCP HTTP, CLI and MCP stdio. Document versioned checkout/ACK/mail contracts and explicit remaining acceptance. Remove the temporary source export workflow from the final tree; the unchanged main CI now verifies all tests, conformance and builds. Refs #74, #75, #76. Includes the unchanged PR #99 dependency slice; no umbrella issue closure, production authority update or deployment.
|
The requested #74–76 continuation is published as #111. It starts at this PR's exact |
Implement atomic digest-bound managed checkout, explicit objective settlement, buyer-only minimal mail and signed post-settlement delivery acknowledgement. Validate complete signed snapshots and legacy settlement identity references. Add real HTTP/GET/GraphQL/MCP/CLI share-revocation coverage. Preserve legacy checkout/policy semantics and integrate main 4c46671 with all current completion fences. Includes the unchanged PR #99 dependency. Verified head 4ef3548, tree b55140f: run 36354944861 passed 1171 business/ security tests plus 8 conformance checks, all four shards, aggregate contracts gate and wheel/sdist builds. Zero test failures/errors/skips; exact node-ID coverage and artifact hashes independently verified. Refs #74, #75, #76. Remaining full arbitration, broader delivery and complete authorization matrix acceptance stays open. No production deployment or credential-policy update.
Scope
Refs #75, #76, #77. This publishes the previously delivered 20-file patch at the user's explicit request. Partial implementation only; do not close these three issues or claim deployment.
Publication and verification
Base:
054c213177afbd0834a2b8a05634157046410677, preserving both newer unrelated main commits after originalad256d0.The input patch SHA256 is
4690abe9cdb32d294ff455d4a4e794a6d345ce932a2af8cf64b97a4ae2bbf427. Because this session cannot directly reach GitHub over Git, a one-use feature-branch materializer applied that exact checksum-verified patch. Its workflow and four transport chunks are absent from the resulting PR tree. No existing CI workflow was changed. Squash merge is intended so no temporary publication files enter main history.Prior local evidence: 76 focused tests passed, including 24 new cases, on Python 3.13.5 with an explicitly test-only SQLite adapter, real Ed25519 and Git. This is not PostgreSQL or Python 3.15 evidence. Patch application and source compilation were independently rechecked in this session. Full existing Python 3.15/PostgreSQL/Valkey tests, conformance and build must pass on the final PR head before merge. The local-verification document records the original pre-publication state; this PR records publication and final CI evidence.
Remaining acceptance and deployment boundaries