Breadway/bread
1
0
Fork 0
Code Issues 9 Pull requests 2 Projects Releases Packages Wiki Activity Actions

feat(bug): breadd on-disk log/event store and bug.* IPC methods #22

Merged
Breadway merged 13 commits from feature/breadbug-store into main 2026-10-14 08:49:32 +08:00
Conversation 8 Commits 13 Files changed 17 +2195 -7
Breadway commented 2026-10-09 09:26:23 +08:00
Owner
Copy link

Closes BREAD-14

Stacked on #21 (bread-scrub); retarget to main after #21 merges. Part of ECO-EP1, spec ECO-66.

What

  • New bread-bug crate: Store (single writer), Reader (works with breadd down), BugConfig (~/.config/bread/breadbug.toml: upload toggle default OFF, excluded apps, endpoint, store limits) and well-known paths (~/.local/state/bread/bugstore).
  • Per app: log.jsonl, events.jsonl, markers.jsonl, each with one rotated generation. Per-file cap, global cap (oldest first), app cap (least recent evicted), long lines truncated on a char boundary. Dirs 0700, files 0600. App ids are validated, which is also the path-traversal guard.
  • Everything is scrubbed before it touches disk (bread-scrub). Events keep only allowlisted fields. Markers keep frames as module/offset/build-id only; build-ids survive, invalid ones are dropped.
  • Per-app exclusions: excluded apps store nothing, and apps newly excluded are wiped (also on open).
  • breadd: opens the store at startup (failure is non-fatal), records bus events under the owning app or breadd, mirrors its own tracing output through a tracing layer.
  • IPC (API 1.8.0): bug.log, bug.logs, bug.marker, bug.status, bug.wipe. App must be a registered app id or breadd. bug.marker publishes bread.bug.<panic|crash|freeze|recovered>; the bug domain is now reserved so apps cannot forge it.
  • bread doctor shows store health via health.bugstore.
  • api-schema.toml, Documentation.md updated; xtask check-docs passes.

Tests

  • 22 unit tests (rotation, caps, permissions, exclusion, scrubbed on disk, torn lines, reopen, wipe, eviction).
  • 4 new IPC integration tests (scrubbed on disk, marker stored and published, bad input rejected incl. forging bread.bug.*, wipe).
  • clippy -D warnings clean for the touched crates.

Notes

  • The existing ipc_integration suite has a pre-existing flake: a few unrelated tests (module-host and others) time out at ~45s when the whole file runs in parallel. Different tests fail from run to run, and it reproduces on unmodified main. Each passes alone. Not touched here.
  • bread-client lives in bread-ecosystem (bread-utils), so BREAD-16 (panic hook, heartbeat, log forwarding) will land there and just call these IPC methods.
Closes BREAD-14 Stacked on #21 (bread-scrub); retarget to main after #21 merges. Part of ECO-EP1, spec ECO-66. ## What - New `bread-bug` crate: `Store` (single writer), `Reader` (works with breadd down), `BugConfig` (`~/.config/bread/breadbug.toml`: upload toggle default OFF, excluded apps, endpoint, store limits) and well-known paths (`~/.local/state/bread/bugstore`). - Per app: `log.jsonl`, `events.jsonl`, `markers.jsonl`, each with one rotated generation. Per-file cap, global cap (oldest first), app cap (least recent evicted), long lines truncated on a char boundary. Dirs 0700, files 0600. App ids are validated, which is also the path-traversal guard. - Everything is scrubbed before it touches disk (bread-scrub). Events keep only allowlisted fields. Markers keep frames as module/offset/build-id only; build-ids survive, invalid ones are dropped. - Per-app exclusions: excluded apps store nothing, and apps newly excluded are wiped (also on open). - breadd: opens the store at startup (failure is non-fatal), records bus events under the owning app or `breadd`, mirrors its own tracing output through a `tracing` layer. - IPC (API 1.8.0): `bug.log`, `bug.logs`, `bug.marker`, `bug.status`, `bug.wipe`. App must be a registered app id or `breadd`. `bug.marker` publishes `bread.bug.<panic|crash|freeze|recovered>`; the `bug` domain is now reserved so apps cannot forge it. - `bread doctor` shows store health via `health.bugstore`. - api-schema.toml, Documentation.md updated; `xtask check-docs` passes. ## Tests - 22 unit tests (rotation, caps, permissions, exclusion, scrubbed on disk, torn lines, reopen, wipe, eviction). - 4 new IPC integration tests (scrubbed on disk, marker stored and published, bad input rejected incl. forging `bread.bug.*`, wipe). - clippy `-D warnings` clean for the touched crates. ## Notes - The existing ipc_integration suite has a pre-existing flake: a few unrelated tests (module-host and others) time out at ~45s when the whole file runs in parallel. Different tests fail from run to run, and it reproduces on unmodified main. Each passes alone. Not touched here. - bread-client lives in bread-ecosystem (bread-utils), so BREAD-16 (panic hook, heartbeat, log forwarding) will land there and just call these IPC methods.
feat(bug): breadd on-disk log/event store and bug.* IPC methods
All checks were successful
check / check (push) Successful in 1m34s
Details
1eaf8e23d1 
New bread-bug crate holds the store (Store writer, Reader for use with
breadd down), BugConfig (breadbug.toml: upload toggle, exclusions, limits)
and well-known paths. Everything is scrubbed on ingest via bread-scrub;
files are 0600 under 0700 dirs, rotate at a per-file cap with two
generations, and obey a global cap, an app cap and per-app exclusions.

breadd opens the store at startup (a broken store never blocks startup),
records bus events (names and allowlisted fields only) and mirrors its own
tracing output. New IPC methods bug.log, bug.logs, bug.marker, bug.status,
bug.wipe (API 1.8.0); bug.marker publishes bread.bug.<kind>. The bug event
domain is reserved. bread doctor reports store health.

Refs BREAD-14
fix(bugstore): reserve retained marker numbers on restart
Some checks failed
check / check (push) Has been cancelled
Details
29fe0b9b08
Merge branch 'feature/breadbug-scrubber' into feature/breadbug-store
Some checks failed
check / check (push) Has been cancelled
Details
11ad78e559
style(bugstore): format IPC wipe regression
Some checks failed
check / check (push) Failing after 10m38s
Details
d970e8f8a1
Breadway commented 2026-10-13 12:17:56 +08:00
Author
Owner
Copy link

Independent prerequisite assessment: changes requested

BREAD-14 exact live head d970e8f8a1, base feature/breadbug-scrubber at39ff3130583485dada208fe3c470954cacb56317. Full16-file list exhausted; complete diff read (new config/store source and all changed integration/docs/schema/lock/tests). Immutable detached feature/review-pr22-d970e8f. This defect assessment does not bypass blocked prerequisite PR21 or approve stacked integration. No merge/retarget or implementation.

Acceptance mapping:

  • PASS local disk persistence/reopen and marker repair: store.rs:213-267,583-622; store/tests.rs:6-26 and reopen regression. Single Store mutex shared across apps, retained numbers reserved from all three files and rotations. Independent23 bread-bug tests pass; actual report fixture at9117355 also passes42 tests including logsIP1/IP2 and notesIP3. Actual daemon restart/reload acceptance remains UNVERIFIED; unit reopening Store is not full daemon lifecycle.
  • FAIL strict bounded disk usage: store.rs:423-456 only invokes enforce_total at445 on rotation; writes without rotation can exceed configured cap. Compiled probe at exact PR22: max_total_bytes1000, max_bytes_per_file100000, 50 messages of "boring message ".repeat(30) => total24140 bytes. Existing tests.rs:148-162 allow cap+3file caps, not requested cap. Filed BREAD-40 (bread#39), confidence high. Oversized serialized records can also exceed per-file cap.
  • PASS reader tail/default event drop/scrub-before-disk in current tests: store.rs:300-379,583-622; permissions/exclusion/wipe/marker tests pass. New-file0600/private-directory0700 PASS; existing file permission hardening and failure cases not fully verified.
  • FAIL relevant app-unit journal ingestion: breadd/src/bugstore.rs:41-111 only bus events and daemon tracing; no journal reader/feed exists in this head (search breadd/src and bread-bug/src). PR23 report-time journal query does not persist on ingest and is not integrated.
  • UNVERIFIED real bread-client log delivery: IPC endpoints exist bugstore.rs:134-182, but capture implementation is unmerged bread-ecosystem PR68; no accepted installed-client integration evidence.
  • PASS local crash/freeze marker serialization/timestamp/version/build-id and exclusion/wipe API implementation/tests. UNVERIFIED bos-settings delete-local-data consumer integration.
  • UNVERIFIED user-visible bread doctor health: bread-cli/src/main.rs:932-946 renders health.bugstore; IPC health supplies it. Need real sandboxed daemon/CLI assertion for available/unavailable/error state, not diff-only evidence.

Actionable coordinator checklist on existing PR22:

  • store.rs:423-456,479-503 / store/tests.rs:148-162: enforce strict configured total and actual serialized per-file bounds on every append and open; define oversized-record policy. Assert usage <= cap after EACH append across apps/logs/events/markers, before rotation, after rotation and reopen. Repro BREAD-40.
  • breadd/src/bugstore.rs:41-111: implement relevant app-unit journal ingest with filtering, exclusions and scrubbing before disk, including bounded reader/error/absence paths and meaningful regression. Report-time-only read cannot satisfy this criterion.
  • verify daemon restart/reload persistence, real client delivery, bos-settings wipe consumer and bread doctor user-visible health in authorized isolated environments. If external consumers are intentionally separate, reconcile actual acceptance scope explicitly rather than silently waive it.
  • preserve stack; only retarget to main after safe accepted scrubber integration, re-review exact resulting head/base and CI.

Independent cargo test --locked -p bread-bug PASS23; crate all-target clippy -D warnings PASS; full workspace fmt PASS; check-docs PASS. No independent full workspace PR22 test/clippy pass claimed. Exact-head check / check (push) remains PENDING Actions132/job0; branch protections empty and authenticated reviews API[]. CI is not the reason for code rejection. Logs/probe /tmp/opencode/review-bread15/{tests22,clippy22,fmt22,docs22,probe22-results}.log or .txt.

Move BREAD-14 todo for coordinator repair, preserve PR and all stacked branches. No merge or done. PR21 remains blocked on integration acceptance and CI, evidence4307. Coordinator must verify integrated behavior before done.

## Independent prerequisite assessment: changes requested BREAD-14 exact live head d970e8f8a1fb8dd103b9c16faeadc26c0fbd1ceb, base feature/breadbug-scrubber at39ff3130583485dada208fe3c470954cacb56317. Full16-file list exhausted; complete diff read (new config/store source and all changed integration/docs/schema/lock/tests). Immutable detached feature/review-pr22-d970e8f. This defect assessment does not bypass blocked prerequisite PR21 or approve stacked integration. No merge/retarget or implementation. Acceptance mapping: - PASS local disk persistence/reopen and marker repair: store.rs:213-267,583-622; store/tests.rs:6-26 and reopen regression. Single Store mutex shared across apps, retained numbers reserved from all three files and rotations. Independent23 bread-bug tests pass; actual report fixture at9117355 also passes42 tests including logsIP1/IP2 and notesIP3. Actual daemon restart/reload acceptance remains UNVERIFIED; unit reopening Store is not full daemon lifecycle. - FAIL strict bounded disk usage: store.rs:423-456 only invokes enforce_total at445 on rotation; writes without rotation can exceed configured cap. Compiled probe at exact PR22: max_total_bytes1000, max_bytes_per_file100000, 50 messages of "boring message ".repeat(30) => total24140 bytes. Existing tests.rs:148-162 allow cap+3file caps, not requested cap. Filed BREAD-40 (bread#39), confidence high. Oversized serialized records can also exceed per-file cap. - PASS reader tail/default event drop/scrub-before-disk in current tests: store.rs:300-379,583-622; permissions/exclusion/wipe/marker tests pass. New-file0600/private-directory0700 PASS; existing file permission hardening and failure cases not fully verified. - FAIL relevant app-unit journal ingestion: breadd/src/bugstore.rs:41-111 only bus events and daemon tracing; no journal reader/feed exists in this head (search breadd/src and bread-bug/src). PR23 report-time journal query does not persist on ingest and is not integrated. - UNVERIFIED real bread-client log delivery: IPC endpoints exist bugstore.rs:134-182, but capture implementation is unmerged bread-ecosystem PR68; no accepted installed-client integration evidence. - PASS local crash/freeze marker serialization/timestamp/version/build-id and exclusion/wipe API implementation/tests. UNVERIFIED bos-settings delete-local-data consumer integration. - UNVERIFIED user-visible bread doctor health: bread-cli/src/main.rs:932-946 renders health.bugstore; IPC health supplies it. Need real sandboxed daemon/CLI assertion for available/unavailable/error state, not diff-only evidence. Actionable coordinator checklist on existing PR22: - [ ] store.rs:423-456,479-503 / store/tests.rs:148-162: enforce strict configured total and actual serialized per-file bounds on every append and open; define oversized-record policy. Assert usage <= cap after EACH append across apps/logs/events/markers, before rotation, after rotation and reopen. Repro BREAD-40. - [ ] breadd/src/bugstore.rs:41-111: implement relevant app-unit journal ingest with filtering, exclusions and scrubbing before disk, including bounded reader/error/absence paths and meaningful regression. Report-time-only read cannot satisfy this criterion. - [ ] verify daemon restart/reload persistence, real client delivery, bos-settings wipe consumer and bread doctor user-visible health in authorized isolated environments. If external consumers are intentionally separate, reconcile actual acceptance scope explicitly rather than silently waive it. - [ ] preserve stack; only retarget to main after safe accepted scrubber integration, re-review exact resulting head/base and CI. Independent cargo test --locked -p bread-bug PASS23; crate all-target clippy -D warnings PASS; full workspace fmt PASS; check-docs PASS. No independent full workspace PR22 test/clippy pass claimed. Exact-head check / check (push) remains PENDING Actions132/job0; branch protections empty and authenticated reviews API[]. CI is not the reason for code rejection. Logs/probe /tmp/opencode/review-bread15/{tests22,clippy22,fmt22,docs22,probe22-results}.log or .txt. Move BREAD-14 todo for coordinator repair, preserve PR and all stacked branches. No merge or done. PR21 remains blocked on integration acceptance and CI, evidence4307. Coordinator must verify integrated behavior before done.
Breadway commented 2026-10-13 14:37:06 +08:00
Author
Owner
Copy link

BREAD-40 independent review: changes requested

Reviewed exact PR22 head 5741945d3d against base 39ff313058 (feature/breadbug-scrubber), both Breadway/bread. Supplied b3f763f resolves to b3f763f438 and is stale. Current immutable detached review worktree: ~/.worktrees/bread/fix/review-bread40-5741945. All 16 changed files and full 2331-line diff read; PR/file lists exhausted. Actual BREAD-40/bread#39 and BREAD-14/BREAD-15 comments read. This is a BREAD-40-only verdict, not acceptance of BREAD-14 or PR21.

Criterion evidence:

  • PASS normal strict global reservation on every append: store.rs:425-467,491-519. Independently recompiled original /tmp/opencode/review-bread15/probe.rs against this exact crate: 50 logs with max_total_bytes=1000 and max_bytes_per_file=100000 now retain 966 bytes, formerly 24140. Checked-in no-rotation and mixed app/log/event/marker per-append regressions pass.
  • PASS serialized per-file/global oversized policy: store.rs:426-431 rejects before any disk mutation with Ok(false), JSON escaping/newline counted. oversized_serialized_records_are_dropped_without_writes passes for logs/events/markers, then a small log is retained. IPC forwards stored=false and does not publish a dropped marker.
  • PASS lowered global/per-file limits on readable reopen: store.rs:238-241,499-503 and no-rotation/mixed lowered-cap tests pass.
  • FAIL error-path strict cap: store.rs:494-496 silently skips read_dir, entry and metadata failures; usage_of at548-568 also silently reports incomplete usage. High-confidence independently compiled error-probe.rs: store one 482-byte pad record, chmod apps/pad to000, append two 482-byte clip records. Both return Ok(true). Reported usage964; restore pad permissions and actual usage1446, above1000. No other machine or live desktop accessed. This continues existing BREAD-40, not a duplicate issue.

Actionable checklist on existing PR22:

  • store.rs:491-519: propagate directory enumeration, entry and metadata errors with path context. Do not claim reserved capacity or append when the total cannot be established. Ensure open also fails closed on unknown retained usage.
  • store.rs:548-568 and breadd/src/bugstore.rs:403-421: do not turn unknown usage into zero/healthy status; expose the accounting error rather than silently understating disk use.
  • store/tests.rs: add an unreadable retained-app regression matching the probe, plus failed eviction coverage. Assert append returns an error without writing new bytes and bounds remain trustworthy after permissions are restored. Normal flood tests alone do not cover this failure.

Independent commands at this head: cargo test --locked -p bread-bug PASS26; cargo clippy --locked -p bread-bug --all-targets -- -D warnings PASS; cargo fmt --all --check PASS; cargo run --locked -p xtask -- check-docs PASS. Original and permission probes compiled with rustc against this worktree's exact rlibs. Evidence: /tmp/opencode/review-bread40/{pr22.diff,tests.log,clippy.log,fmt.log,docs.log,prior-probe.txt,error-probe.rs,error-probe.txt}. Full workspace410 tests/all-target clippy are coordinator claims for the prior SHA, not independently reproduced here.

CI: actual .forgejo/workflows/check.yml requires work-branch push clippy/build/test. Current exact-head statuses are empty and no current-head run is observable in Actions list: check / check (push) MISSING, not success. Previous run132 belongs to d970e8f and is failure, not current-head evidence. Branch protections empty. Authenticated reviews API[]; existing PR comment4309 retains broader unresolved BREAD-14 acceptance.

PR21 still open/unmerged at39ff313; BREAD-15 remains review with blocked integration assessment4307. BREAD-14 client/settings/doctor acceptance reconciliation remains outside this scoped review. No merge/retarget/close/done or implementation. Preserve all branches and graph/user files. BREAD-40 to todo for coordinator repair, then fresh exact-SHA review and CI. Integration verification is still required before done.

## BREAD-40 independent review: changes requested Reviewed exact PR22 head 5741945d3dc35b977bbfa8159a55a21dc8b9cb48 against base 39ff3130583485dada208fe3c470954cacb56317 (feature/breadbug-scrubber), both Breadway/bread. Supplied b3f763f resolves to b3f763f43876b1dff1a248acff3d02a2d82dcc84 and is stale. Current immutable detached review worktree: ~/.worktrees/bread/fix/review-bread40-5741945. All 16 changed files and full 2331-line diff read; PR/file lists exhausted. Actual BREAD-40/bread#39 and BREAD-14/BREAD-15 comments read. This is a BREAD-40-only verdict, not acceptance of BREAD-14 or PR21. Criterion evidence: - PASS normal strict global reservation on every append: store.rs:425-467,491-519. Independently recompiled original /tmp/opencode/review-bread15/probe.rs against this exact crate: 50 logs with max_total_bytes=1000 and max_bytes_per_file=100000 now retain 966 bytes, formerly 24140. Checked-in no-rotation and mixed app/log/event/marker per-append regressions pass. - PASS serialized per-file/global oversized policy: store.rs:426-431 rejects before any disk mutation with Ok(false), JSON escaping/newline counted. oversized_serialized_records_are_dropped_without_writes passes for logs/events/markers, then a small log is retained. IPC forwards stored=false and does not publish a dropped marker. - PASS lowered global/per-file limits on readable reopen: store.rs:238-241,499-503 and no-rotation/mixed lowered-cap tests pass. - FAIL error-path strict cap: store.rs:494-496 silently skips read_dir, entry and metadata failures; usage_of at548-568 also silently reports incomplete usage. High-confidence independently compiled error-probe.rs: store one 482-byte pad record, chmod apps/pad to000, append two 482-byte clip records. Both return Ok(true). Reported usage964; restore pad permissions and actual usage1446, above1000. No other machine or live desktop accessed. This continues existing BREAD-40, not a duplicate issue. Actionable checklist on existing PR22: - [ ] store.rs:491-519: propagate directory enumeration, entry and metadata errors with path context. Do not claim reserved capacity or append when the total cannot be established. Ensure open also fails closed on unknown retained usage. - [ ] store.rs:548-568 and breadd/src/bugstore.rs:403-421: do not turn unknown usage into zero/healthy status; expose the accounting error rather than silently understating disk use. - [ ] store/tests.rs: add an unreadable retained-app regression matching the probe, plus failed eviction coverage. Assert append returns an error without writing new bytes and bounds remain trustworthy after permissions are restored. Normal flood tests alone do not cover this failure. Independent commands at this head: cargo test --locked -p bread-bug PASS26; cargo clippy --locked -p bread-bug --all-targets -- -D warnings PASS; cargo fmt --all --check PASS; cargo run --locked -p xtask -- check-docs PASS. Original and permission probes compiled with rustc against this worktree's exact rlibs. Evidence: /tmp/opencode/review-bread40/{pr22.diff,tests.log,clippy.log,fmt.log,docs.log,prior-probe.txt,error-probe.rs,error-probe.txt}. Full workspace410 tests/all-target clippy are coordinator claims for the prior SHA, not independently reproduced here. CI: actual .forgejo/workflows/check.yml requires work-branch push clippy/build/test. Current exact-head statuses are empty and no current-head run is observable in Actions list: check / check (push) MISSING, not success. Previous run132 belongs to d970e8f and is failure, not current-head evidence. Branch protections empty. Authenticated reviews API[]; existing PR comment4309 retains broader unresolved BREAD-14 acceptance. PR21 still open/unmerged at39ff313; BREAD-15 remains review with blocked integration assessment4307. BREAD-14 client/settings/doctor acceptance reconciliation remains outside this scoped review. No merge/retarget/close/done or implementation. Preserve all branches and graph/user files. BREAD-40 to todo for coordinator repair, then fresh exact-SHA review and CI. Integration verification is still required before done.
fix(bugstore): fail closed on filesystem accounting errors
Some checks failed
check / check (push) Failing after 13m33s
Details
a3e1854e53
Breadway commented 2026-10-13 15:02:44 +08:00
Author
Owner
Copy link

BREAD-40 exact-SHA re-review: blocked on CI/integration

Reviewed head a3e1854e53, base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread. Current API head/base match inputs. Detached immutable worktree ~/.worktrees/bread/fix/review-bread40-a3e1854. PR and changed-file lists exhausted (22 PRs,16 files); complete prior diff review carried forward only after reading all changes since5741945 (3 files,136 additions/32 deletions). No unrelated repair churn. BREAD-40 comments read; earlier issue/dependency acceptance and review4309 are not waived.

BREAD-40 criteria locally verified:

  • PASS strict normal flood cap: store.rs:425-467,491-523 and store tests. Original50-log compiled probe retains966 bytes under1000 cap, not24140.
  • PASS intact oversized serialized-record policy: store.rs:426-431; log/event/marker escaping and mixed-record tests pass. Actual serialized bytes/newline reserved before append.
  • PASS lowered per-file/global caps on readable reopen: store.rs:238-241,504-507; regressions pass.
  • PASS accounting error repair: store.rs:471-487,491-523,542-568 now propagate app/file enumeration, entry, metadata and removal errors instead of omitting retained bytes. Re-ran original permission probe unprivileged uid1000, compiled against current-head rlibs. Only probe adjustment was printing Result rather than unwrap for newly expected usage error. One482-byte pad log; chmod pad000; both clip appends now Err(Permission denied), usage Err(account .../apps/pad), restored actual usage482 <=1000. Original bad result was1446. No new bytes accepted.
  • PASS eviction failure: store/tests.rs:191-220 failed_eviction_does_not_allow_append passes unprivileged; append errors, seed retained, total <=600. App directory eviction removal now propagates at483-484 and its enumeration/time reads propagate too.
  • PASS truthful health on accounting failure: breadd/src/bugstore.rs:426-434 and health_exposes_accounting_failure_without_false_byte_count PASS; available=false, explanatory error, no false total_bytes. No additional scoped BREAD-40 defect found.

Independent commands: cargo test --locked -p bread-bug PASS28; cargo test --locked -p breadd health_exposes_accounting_failure_without_false_byte_count PASS1; cargo clippy --locked --workspace --all-targets -- -D warnings PASS; cargo fmt --all --check PASS; cargo run --locked -p xtask -- check-docs PASS. No independent full workspace test pass claimed for this SHA. Probe sources/output/logs and diffs: /tmp/opencode/review-bread40-a3e1854/.

Required exact-head check / check (push) FAILURE at /Breadway/bread/actions/runs/134/jobs/0, run134 API id2406 workflow check.yml commit a3e1854e53. Status API says Failing after13m33s. Workflow runs work-branch clippy, workspace build and test via ci/build.sh. Failure cause not established here; local passes cannot waive it. All134 Actions runs paginated and exact SHA matched. Branch protection API[]; authenticated reviews API[], previous broader changes-request comment4309 still not resolved by this scoped assessment.

Verdict BLOCKED, not pass: scoped code criteria now pass, required CI fails and PR21 prerequisite remains open/unmerged/blocked; BREAD-14 broader client/settings/doctor acceptance remains unresolved. Leave BREAD-40 review. Coordinator: inspect run134 job0 logs, repair/re-run exact-head CI, retain accepted cap/error regressions, obtain fresh SHA-bound review if code changes. Resolve prerequisite and broader acceptance separately before integration. No merge/retarget/done, implementation, remote-host/live-desktop access or graph/user-file modifications.

## BREAD-40 exact-SHA re-review: blocked on CI/integration Reviewed head a3e1854e53d3e1ab8d32fa456be4373c7dda7945, base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread. Current API head/base match inputs. Detached immutable worktree ~/.worktrees/bread/fix/review-bread40-a3e1854. PR and changed-file lists exhausted (22 PRs,16 files); complete prior diff review carried forward only after reading all changes since5741945 (3 files,136 additions/32 deletions). No unrelated repair churn. BREAD-40 comments read; earlier issue/dependency acceptance and review4309 are not waived. BREAD-40 criteria locally verified: - PASS strict normal flood cap: store.rs:425-467,491-523 and store tests. Original50-log compiled probe retains966 bytes under1000 cap, not24140. - PASS intact oversized serialized-record policy: store.rs:426-431; log/event/marker escaping and mixed-record tests pass. Actual serialized bytes/newline reserved before append. - PASS lowered per-file/global caps on readable reopen: store.rs:238-241,504-507; regressions pass. - PASS accounting error repair: store.rs:471-487,491-523,542-568 now propagate app/file enumeration, entry, metadata and removal errors instead of omitting retained bytes. Re-ran original permission probe unprivileged uid1000, compiled against current-head rlibs. Only probe adjustment was printing Result rather than unwrap for newly expected usage error. One482-byte pad log; chmod pad000; both clip appends now Err(Permission denied), usage Err(account .../apps/pad), restored actual usage482 <=1000. Original bad result was1446. No new bytes accepted. - PASS eviction failure: store/tests.rs:191-220 failed_eviction_does_not_allow_append passes unprivileged; append errors, seed retained, total <=600. App directory eviction removal now propagates at483-484 and its enumeration/time reads propagate too. - PASS truthful health on accounting failure: breadd/src/bugstore.rs:426-434 and health_exposes_accounting_failure_without_false_byte_count PASS; available=false, explanatory error, no false total_bytes. No additional scoped BREAD-40 defect found. Independent commands: cargo test --locked -p bread-bug PASS28; cargo test --locked -p breadd health_exposes_accounting_failure_without_false_byte_count PASS1; cargo clippy --locked --workspace --all-targets -- -D warnings PASS; cargo fmt --all --check PASS; cargo run --locked -p xtask -- check-docs PASS. No independent full workspace test pass claimed for this SHA. Probe sources/output/logs and diffs: /tmp/opencode/review-bread40-a3e1854/. Required exact-head check / check (push) FAILURE at /Breadway/bread/actions/runs/134/jobs/0, run134 API id2406 workflow check.yml commit a3e1854e53d3e1ab8d32fa456be4373c7dda7945. Status API says Failing after13m33s. Workflow runs work-branch clippy, workspace build and test via ci/build.sh. Failure cause not established here; local passes cannot waive it. All134 Actions runs paginated and exact SHA matched. Branch protection API[]; authenticated reviews API[], previous broader changes-request comment4309 still not resolved by this scoped assessment. Verdict BLOCKED, not pass: scoped code criteria now pass, required CI fails and PR21 prerequisite remains open/unmerged/blocked; BREAD-14 broader client/settings/doctor acceptance remains unresolved. Leave BREAD-40 review. Coordinator: inspect run134 job0 logs, repair/re-run exact-head CI, retain accepted cap/error regressions, obtain fresh SHA-bound review if code changes. Resolve prerequisite and broader acceptance separately before integration. No merge/retarget/done, implementation, remote-host/live-desktop access or graph/user-file modifications.
Breadway commented 2026-10-13 19:13:44 +08:00
Author
Owner
Copy link

BREAD-40 independent rerun: BLOCKED

Exact reviewed and freshly re-read live head a3e1854e53; base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread. Expected head matches. Existing cancelled-session review4344/card1893 was actually persisted; this rerun independently confirms the scoped result rather than assuming its tests passed. BREAD-40/bread#39, BREAD-14 and BREAD-15 actual bodies/comments read. Paginated lists exhausted:22 PRs,16 changed files,134 Actions runs, reviews[]. Full2435-line actual base/head diff read in clean detached ~/.worktrees/bread/fix/review-bread40-a3e1854. Preserve broader changes-request4309; this is not BREAD-14/PR21 approval.

Criterion mapping:

  • PASS strict serialized global/per-file reservation on each append: bread-bug/src/store.rs:425-467,491-523. Original50-log probe freshly compiled against exact-head worktree retains966 bytes <=1000 (original24140). Mixed app/log/event/marker strict per-append bounds tests pass.
  • PASS oversized records rejected intact with stored=false before writes: store.rs:426-431; serialized escaping/newline, log/event/marker oversized regression passes; IPC forwards dropped outcome and publishes markers only when stored.
  • PASS lowered readable reopen caps: store.rs:238-241,504-507 and lowered total/per-file tests pass.
  • PASS fail-closed accounting and eviction errors: store.rs:471-487,494-500,519,550-568. Original permission probe independently recompiled/rerun unprivileged uid1000. One482-byte pad log, chmod pad000, both clip appends return Err(Permission denied); usage returns accounting error; after permission restoration actual482 <=1000, not prior1446. Only source adjustment prints usage Result instead of unwrapping the now-expected error. Unreadable-app and failed-eviction tests both pass without skipping.
  • PASS truthful health on accounting failure: breadd/src/bugstore.rs:426-434 and targeted health regression pass: available=false, error, no false total_bytes.

Independent commands all succeeded: cargo test --locked -p bread-bug (28 tests); cargo test --locked -p breadd health_exposes_accounting_failure_without_false_byte_count (1); cargo clippy --locked --workspace --all-targets -- -D warnings; cargo fmt --all --check; cargo run --locked -p xtask -- check-docs. No full workspace test pass claimed. No additional scoped BREAD-40 code defect found. Fresh logs/probe sources/results/full diff: /tmp/opencode/review-bread40-rerun/. No implementation, graph/user-file changes or remote-host/live-desktop access.

CI BLOCKER freshly observed for this exact head: check / check (push) FAILURE, Actions134/job0, run API id2406, commit_sha matches reviewed SHA; description Failing after13m33s. check.yml requires workspace clippy, build and test via ci/build.sh. Branch protections[]. Local successes do not waive CI. Cause is not established; coordinator must inspect run134 job0 logs and repair/re-run. Do not assume permission tests or any pre-existing failure caused it without logs.

Integration BLOCKER: PR21 remains open/unmerged at39ff313 and BREAD-15 acceptance remains blocked; BREAD-14 broader client/settings/doctor acceptance is unresolved separately. Leave BREAD-40 review. No merge/retarget/done or approval submitted. Next: repair exact-head CI, fresh review if SHA changes, resolve prerequisites and broader consumer acceptance before integration.

## BREAD-40 independent rerun: BLOCKED Exact reviewed and freshly re-read live head a3e1854e53d3e1ab8d32fa456be4373c7dda7945; base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread. Expected head matches. Existing cancelled-session review4344/card1893 was actually persisted; this rerun independently confirms the scoped result rather than assuming its tests passed. BREAD-40/bread#39, BREAD-14 and BREAD-15 actual bodies/comments read. Paginated lists exhausted:22 PRs,16 changed files,134 Actions runs, reviews[]. Full2435-line actual base/head diff read in clean detached ~/.worktrees/bread/fix/review-bread40-a3e1854. Preserve broader changes-request4309; this is not BREAD-14/PR21 approval. Criterion mapping: - PASS strict serialized global/per-file reservation on each append: bread-bug/src/store.rs:425-467,491-523. Original50-log probe freshly compiled against exact-head worktree retains966 bytes <=1000 (original24140). Mixed app/log/event/marker strict per-append bounds tests pass. - PASS oversized records rejected intact with stored=false before writes: store.rs:426-431; serialized escaping/newline, log/event/marker oversized regression passes; IPC forwards dropped outcome and publishes markers only when stored. - PASS lowered readable reopen caps: store.rs:238-241,504-507 and lowered total/per-file tests pass. - PASS fail-closed accounting and eviction errors: store.rs:471-487,494-500,519,550-568. Original permission probe independently recompiled/rerun unprivileged uid1000. One482-byte pad log, chmod pad000, both clip appends return Err(Permission denied); usage returns accounting error; after permission restoration actual482 <=1000, not prior1446. Only source adjustment prints usage Result instead of unwrapping the now-expected error. Unreadable-app and failed-eviction tests both pass without skipping. - PASS truthful health on accounting failure: breadd/src/bugstore.rs:426-434 and targeted health regression pass: available=false, error, no false total_bytes. Independent commands all succeeded: cargo test --locked -p bread-bug (28 tests); cargo test --locked -p breadd health_exposes_accounting_failure_without_false_byte_count (1); cargo clippy --locked --workspace --all-targets -- -D warnings; cargo fmt --all --check; cargo run --locked -p xtask -- check-docs. No full workspace test pass claimed. No additional scoped BREAD-40 code defect found. Fresh logs/probe sources/results/full diff: /tmp/opencode/review-bread40-rerun/. No implementation, graph/user-file changes or remote-host/live-desktop access. CI BLOCKER freshly observed for this exact head: check / check (push) FAILURE, Actions134/job0, run API id2406, commit_sha matches reviewed SHA; description Failing after13m33s. check.yml requires workspace clippy, build and test via ci/build.sh. Branch protections[]. Local successes do not waive CI. Cause is not established; coordinator must inspect run134 job0 logs and repair/re-run. Do not assume permission tests or any pre-existing failure caused it without logs. Integration BLOCKER: PR21 remains open/unmerged at39ff313 and BREAD-15 acceptance remains blocked; BREAD-14 broader client/settings/doctor acceptance is unresolved separately. Leave BREAD-40 review. No merge/retarget/done or approval submitted. Next: repair exact-head CI, fresh review if SHA changes, resolve prerequisites and broader consumer acceptance before integration.
fix(ci): pin integrated unprivileged shared build runner
Some checks failed
check / check (push) Failing after 2m21s
Details
2b641bb421
Breadway commented 2026-10-13 19:28:47 +08:00
Author
Owner
Copy link

BREAD-40/BREAD-41 exact-SHA follow-up

Reviewed live head2b641bb4213c6ae1631f414953a9dd7783afd28c, base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread; matches expected head. Clean detached ~/.worktrees/bread/fix/review-bread40-41-2b641bb. Paginated22 PRs,17 changed files,135 runs; reviews[] and branch protections[]. Full prior actual PR diff independently reviewed in4391; independently verified the complete delta is ONLY ci/bread-ecosystem.rev:1 from147cfbbf96ae4b171027defa1130d2caddb934b1 to25bf3af49a3de240f64ed90e6eebd2958e672d10. Store, daemon and regressions byte-identical to reviewed a3e1854. Actual BREAD40/41 bodies/comments read.

BREAD40: changes_requested for a reproducibility defect in the failed-eviction regression, not a newly reproduced cap bypass. Existing functional criteria remain locally verified: serialized strict caps/oversized drop/reopen at store.rs:238-241,425-467,491-523; fail-closed errors471-487,494-500,519,550-568; truthful health bugstore.rs:426-434. Original independently measured flood966 <=1000 and permission probe restored482 <=1000 at identical source, PR4391. Fresh current-head cargo test --locked -p bread-bug passes28 locally. Prior workspace clippy/fmt/docs independent evidence remains source-identical except pin; coordinator414 workspace pass is not an independent claim here.

NEW observable verification FAIL at exact head: Actions135/job0 runs unprivileged sufficiently for unreadable_app_fails_closed_and_usage_reports_error to PASS, but failed_eviction_does_not_allow_append FAILS store/tests.rs:214: snapshot clip.logs.len left0 right1;27 pass1 fail. This is not the old root assertion. store.rs:510-515 sorts eviction tuples by rotation,mtime,path. tests.rs:204-209 writes pad then clip without establishing distinct mtimes; on equal mtimes path ordering can remove clip seed before attempting unwritable pad. append still errors and cap remains bounded, but the regression assumes pad is chosen first without establishing it.

Actionable checklist on existingPR22:

  • bread-bug/src/store/tests.rs:191-220: establish deterministic oldest victim with explicitly distinct file mtimes before chmod/append, or assert only the documented eviction/error contract. Keep a genuine unprivileged removal failure and assert no incoming record was stored, usage bounded, error propagated. Do not skip/weaken permission coverage or claim atomic rollback unless implemented and required. Prove this regression under equal-resolution/tied timestamps and actual CI.
  • Re-run exact-head workflow after repair and request fresh SHA review. Local28 pass cannot waive failing remote test.

BREAD41: BLOCKED pending successful actual runner validation. Pin implementation inspected at immutable integrated25bf3af ci/build.sh: host-created writable registry/git/target bind mounts, per-product flock held through copy, docker --user id-u:id-g, read-only passwd/group, no root cache paths. bash -n PASS. Actual shared PR55 API merged=true mergeSHA25bf3af; independent review comment2789 read. Pin is integrated, not an unmerged mock. Retrieved run134 logs independently: clippy/build pass; both permission tests fail explicit unprivileged assertions; finally unlinkat src/target/.rustc_info.json permission denied. Old147cfbb script indeed lacks --user. New run135 clippy/build pass, unreadable permission test passes, no final cleanup error observed in retrieved complete log; full workflow still FAILS due to BREAD40 test above. Future owner cleanliness is not proven solely by script inspection; required exact-head workflow success remains unmet. No remote cleanup or host access.

Fresh exact-head status: check / check (push) FAILURE, Actions135/job0 run id2415, Failing after2m21s. Not pending anymore. Logs obtained once, no polling loop. Evidence /tmp/opencode/review-bread40-41-2b641bb/{run134.log,run135.txt,status-final.json,tests.log,shared-build.sh}. PR21 open/unmerged at39ff313 and BREAD14 broader consumer acceptance unresolved. No merge/retarget/done, implementation or graph/user modifications. BREAD40 todo for regression repair; BREAD41 review blocked on successful validation. Preserve existing stack.

## BREAD-40/BREAD-41 exact-SHA follow-up Reviewed live head2b641bb4213c6ae1631f414953a9dd7783afd28c, base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread; matches expected head. Clean detached ~/.worktrees/bread/fix/review-bread40-41-2b641bb. Paginated22 PRs,17 changed files,135 runs; reviews[] and branch protections[]. Full prior actual PR diff independently reviewed in4391; independently verified the complete delta is ONLY ci/bread-ecosystem.rev:1 from147cfbbf96ae4b171027defa1130d2caddb934b1 to25bf3af49a3de240f64ed90e6eebd2958e672d10. Store, daemon and regressions byte-identical to reviewed a3e1854. Actual BREAD40/41 bodies/comments read. BREAD40: changes_requested for a reproducibility defect in the failed-eviction regression, not a newly reproduced cap bypass. Existing functional criteria remain locally verified: serialized strict caps/oversized drop/reopen at store.rs:238-241,425-467,491-523; fail-closed errors471-487,494-500,519,550-568; truthful health bugstore.rs:426-434. Original independently measured flood966 <=1000 and permission probe restored482 <=1000 at identical source, PR4391. Fresh current-head cargo test --locked -p bread-bug passes28 locally. Prior workspace clippy/fmt/docs independent evidence remains source-identical except pin; coordinator414 workspace pass is not an independent claim here. NEW observable verification FAIL at exact head: Actions135/job0 runs unprivileged sufficiently for unreadable_app_fails_closed_and_usage_reports_error to PASS, but failed_eviction_does_not_allow_append FAILS store/tests.rs:214: snapshot clip.logs.len left0 right1;27 pass1 fail. This is not the old root assertion. store.rs:510-515 sorts eviction tuples by rotation,mtime,path. tests.rs:204-209 writes pad then clip without establishing distinct mtimes; on equal mtimes path ordering can remove clip seed before attempting unwritable pad. append still errors and cap remains bounded, but the regression assumes pad is chosen first without establishing it. Actionable checklist on existingPR22: - [ ] bread-bug/src/store/tests.rs:191-220: establish deterministic oldest victim with explicitly distinct file mtimes before chmod/append, or assert only the documented eviction/error contract. Keep a genuine unprivileged removal failure and assert no incoming record was stored, usage bounded, error propagated. Do not skip/weaken permission coverage or claim atomic rollback unless implemented and required. Prove this regression under equal-resolution/tied timestamps and actual CI. - [ ] Re-run exact-head workflow after repair and request fresh SHA review. Local28 pass cannot waive failing remote test. BREAD41: BLOCKED pending successful actual runner validation. Pin implementation inspected at immutable integrated25bf3af ci/build.sh: host-created writable registry/git/target bind mounts, per-product flock held through copy, docker --user id-u:id-g, read-only passwd/group, no root cache paths. bash -n PASS. Actual shared PR55 API merged=true mergeSHA25bf3af; independent review comment2789 read. Pin is integrated, not an unmerged mock. Retrieved run134 logs independently: clippy/build pass; both permission tests fail explicit unprivileged assertions; finally unlinkat src/target/.rustc_info.json permission denied. Old147cfbb script indeed lacks --user. New run135 clippy/build pass, unreadable permission test passes, no final cleanup error observed in retrieved complete log; full workflow still FAILS due to BREAD40 test above. Future owner cleanliness is not proven solely by script inspection; required exact-head workflow success remains unmet. No remote cleanup or host access. Fresh exact-head status: check / check (push) FAILURE, Actions135/job0 run id2415, Failing after2m21s. Not pending anymore. Logs obtained once, no polling loop. Evidence /tmp/opencode/review-bread40-41-2b641bb/{run134.log,run135.txt,status-final.json,tests.log,shared-build.sh}. PR21 open/unmerged at39ff313 and BREAD14 broader consumer acceptance unresolved. No merge/retarget/done, implementation or graph/user modifications. BREAD40 todo for regression repair; BREAD41 review blocked on successful validation. Preserve existing stack.
test(bugstore): establish deterministic failed eviction victim
All checks were successful
check / check (push) Successful in 9m28s
Details
74d436e098
Breadway commented 2026-10-13 19:33:36 +08:00
Author
Owner
Copy link

BREAD-40/BREAD-41 re-review: BLOCKED pending current-head CI

Exact reviewed/live head74d436e098603bf451b6f60fcdb7bfef8b07948f matches expected; base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread. Clean immutable detached ~/.worktrees/bread/fix/review-bread40-41-74d436e. Actual card bodies/comments read. Lists exhausted22 PRs,17 files,136 runs, reviews[]; branch protections[]. Prior full diff reviewed4391, pin review4399; entire new delta independently read:14 added test lines only, no implementation/pin changes.

BREAD40 local criteria PASS: strict serialized per-file/global reservation, intact oversized rejection, lowered reopen caps, fail-closed enumeration/eviction and truthful health remain identical to independently verified store a3e1854 (PR4391 flood966 <=1000, permission result482 <=1000). Current-head cargo test --locked -p bread-bug PASS28 as uid1000; cargo clippy --locked -p bread-bug --all-targets -- -D warnings PASS; cargo fmt --all --check PASS. No new scoped defect.

Prior eviction-test rejection repaired: bread-bug/src/store/tests.rs:206-220 opens pad/log.jsonl, sets modified time explicitly to UNIX_EPOCH via FileTimes, then asserts actual read-back pad mtime strictly older than clip before chmod0500. store.rs:510-515 uses those mtimes before path tie-break, so the unwritable victim is now deterministically first even when initial consecutive writes tie. No sleep, skipped test, softened error assertion or relaxed cap/no-new-record check. Filesystem refusing timestamp update fails the test explicitly. Permission restored before result assertions. Local regression passes. Previous left0/right1 timestamp-order assumption is resolved in source.

BREAD41 pin criterion remains PASS: unchanged ci/bread-ecosystem.rev:1 integrated25bf3af sharedPR55, inspected unprivileged invoking uid/gid, writable bind caches, passwd/group and per-product locks (4399). Successful complete runner/cache-copy/cleanup validation remains UNVERIFIED until exact-head workflow completes; no remote cleanup authorized or performed.

Required current-head check / check (push) PENDING at Actions136/job0, run id2416 commit_sha74d436e. One current status/log snapshot retrieved, not a polling loop. Available log shows clippy and workspace build completed; workflow/test completion and final cleanup not yet observed. Old run135 failure is not this head outcome. No independent full-workspace test pass claimed.

Both verdicts BLOCKED, not pass, because current-head required CI is incomplete and PR21 remains open/unmerged/blocked; broader BREAD14 acceptance remains unresolved separately. Leave both cards review. Next coordinator action: obtain completed run136 result/logs, repair genuine failures if any without weakening permission coverage, fresh SHA review if changed; resolve prerequisites and broader consumer acceptance before integration. No merge/retarget/done, implementation, remote-host access or graph/user modifications. Fresh evidence /tmp/opencode/review-bread40-41-74d436e/{delta.diff,tests.log,clippy.log,fmt.log,status.txt,run136.txt}.

## BREAD-40/BREAD-41 re-review: BLOCKED pending current-head CI Exact reviewed/live head74d436e098603bf451b6f60fcdb7bfef8b07948f matches expected; base39ff3130583485dada208fe3c470954cacb56317, both Breadway/bread. Clean immutable detached ~/.worktrees/bread/fix/review-bread40-41-74d436e. Actual card bodies/comments read. Lists exhausted22 PRs,17 files,136 runs, reviews[]; branch protections[]. Prior full diff reviewed4391, pin review4399; entire new delta independently read:14 added test lines only, no implementation/pin changes. BREAD40 local criteria PASS: strict serialized per-file/global reservation, intact oversized rejection, lowered reopen caps, fail-closed enumeration/eviction and truthful health remain identical to independently verified store a3e1854 (PR4391 flood966 <=1000, permission result482 <=1000). Current-head cargo test --locked -p bread-bug PASS28 as uid1000; cargo clippy --locked -p bread-bug --all-targets -- -D warnings PASS; cargo fmt --all --check PASS. No new scoped defect. Prior eviction-test rejection repaired: bread-bug/src/store/tests.rs:206-220 opens pad/log.jsonl, sets modified time explicitly to UNIX_EPOCH via FileTimes, then asserts actual read-back pad mtime strictly older than clip before chmod0500. store.rs:510-515 uses those mtimes before path tie-break, so the unwritable victim is now deterministically first even when initial consecutive writes tie. No sleep, skipped test, softened error assertion or relaxed cap/no-new-record check. Filesystem refusing timestamp update fails the test explicitly. Permission restored before result assertions. Local regression passes. Previous left0/right1 timestamp-order assumption is resolved in source. BREAD41 pin criterion remains PASS: unchanged ci/bread-ecosystem.rev:1 integrated25bf3af sharedPR55, inspected unprivileged invoking uid/gid, writable bind caches, passwd/group and per-product locks (4399). Successful complete runner/cache-copy/cleanup validation remains UNVERIFIED until exact-head workflow completes; no remote cleanup authorized or performed. Required current-head check / check (push) PENDING at Actions136/job0, run id2416 commit_sha74d436e. One current status/log snapshot retrieved, not a polling loop. Available log shows clippy and workspace build completed; workflow/test completion and final cleanup not yet observed. Old run135 failure is not this head outcome. No independent full-workspace test pass claimed. Both verdicts BLOCKED, not pass, because current-head required CI is incomplete and PR21 remains open/unmerged/blocked; broader BREAD14 acceptance remains unresolved separately. Leave both cards review. Next coordinator action: obtain completed run136 result/logs, repair genuine failures if any without weakening permission coverage, fresh SHA review if changed; resolve prerequisites and broader consumer acceptance before integration. No merge/retarget/done, implementation, remote-host access or graph/user modifications. Fresh evidence /tmp/opencode/review-bread40-41-74d436e/{delta.diff,tests.log,clippy.log,fmt.log,status.txt,run136.txt}.
feat: register ram in the known-apps registry
All checks were successful
check / check (push) Successful in 5m26s
Details
bc3b608f41
Merge pull request #35: Register ram in the known-apps registry
All checks were successful
dev release / build (push) Successful in 34m5s
Details
05125ef00c
Merge pull request #21: bread-scrub library prerequisite
All checks were successful
dev release / build (push) Successful in 42m43s
Details
4a164fd98a
Merge main into feature/breadbug-store after PR21 landed
All checks were successful
check / check (push) Successful in 20m58s
Details
1505b0d445
Breadway changed target branch from feature/breadbug-scrubber to main 2026-10-13 21:08:58 +08:00
Breadway commented 2026-10-14 08:49:15 +08:00
Author
Owner
Copy link

Independent exact-head review: pass

Reviewed live head 1505b0d445 against base 4a164fd98a. Expected head matched. The only change since 74d436e is the main merge, and the only main-side file change is the BREAD-36 ram registry line in bread-shared/src/apps.rs. Prior change requests at d970e8f (4309), 5741945 (4327), and 2b641bb (4399) are addressed at this head. CI blocks at a3e1854 and 74d436e are resolved.

BREAD-14

  • Disk store, rotation, per-app and total caps, 0700/0600, reopen retention: bread-bug/src/store.rs write_line/enforce_total and store/tests.rs. Independent cargo test -p bread-bug --locked: 28 passed.
  • Scrub before write, exclusions, wipe, crash/freeze markers: store.rs append/record_marker/wipe and tests log_roundtrip, excluded_apps, markers_are_scrubbed, wipe_all.
  • Journal ingest of mapped user units, scrubbed before write, exclusions honored, 64KiB bound, child reaped on shutdown: breadd/src/bugstore.rs APP_UNITS and journal_recorder lines 19-233. Independent cargo test -p breadd --locked --bin breadd journal_tests: 3 passed.
  • Reload and restart retention plus doctor health: breadd/tests/ipc_integration.rs bug_store_survives_module_reload_and_reports_health and bug_store_survives_daemon_restart_without_marker_collisions. Both passed. bread-cli doctor prints health.bugstore and does not invent a byte count when unavailable (bread-cli/src/main.rs:932-944). Location documented at Documentation.md:1741.
  • Cards stay in review. Two-pass consumer verification is on main after PR23, not done here.

BREAD-40

  • Strict total cap without waiting for rotation, oversized records dropped intact, lowered caps on reopen, fail-closed accounting: store.rs:425-523 and tests.rs total_cap_is_enforced_without_rotation_and_on_reopen, unreadable_app_fails_closed_and_usage_reports_error, failed_eviction_does_not_allow_append (pad mtime UNIX_EPOCH). Same 28-test run passed as uid 1000.

BREAD-41

  • ci/bread-ecosystem.rev pins 25bf3af49a3de240f64ed90e6eebd2958e672d10, merged bread-ecosystem PR55. Shared ci/build.sh uses --user $(id -u):$(id -g), host-writable cache binds, passwd/group mounts, and per-product flock. Exact-head check.yml job 2446 (Actions run 141) succeeded in 20m58s: checkout, clippy, build --workspace, test, Complete job all success. No cleanup permission failure.

Checks

  • Required workflow is check.yml on feature/** push. Commit status check / check (push) success for 1505b0d. No branch protection rules. Reviews API empty. No outstanding formal review to dismiss.
  • Also: cargo clippy -p bread-bug --locked --all-targets -- -D warnings clean.

Scratch worktree: ~/.worktrees/bread/review-pr22-1505b0d. Primary checkout and feature/breadbug-* worktrees were not modified.

## Independent exact-head review: pass Reviewed live head 1505b0d445c7715f551fd0f8870dfff8c22d6ca3 against base 4a164fd98a9c749a6afa1ffd7b70ce0a5df83b86. Expected head matched. The only change since 74d436e is the main merge, and the only main-side file change is the BREAD-36 `ram` registry line in bread-shared/src/apps.rs. Prior change requests at d970e8f (4309), 5741945 (4327), and 2b641bb (4399) are addressed at this head. CI blocks at a3e1854 and 74d436e are resolved. ### BREAD-14 - Disk store, rotation, per-app and total caps, 0700/0600, reopen retention: bread-bug/src/store.rs write_line/enforce_total and store/tests.rs. Independent `cargo test -p bread-bug --locked`: 28 passed. - Scrub before write, exclusions, wipe, crash/freeze markers: store.rs append/record_marker/wipe and tests log_roundtrip, excluded_apps, markers_are_scrubbed, wipe_all. - Journal ingest of mapped user units, scrubbed before write, exclusions honored, 64KiB bound, child reaped on shutdown: breadd/src/bugstore.rs APP_UNITS and journal_recorder lines 19-233. Independent `cargo test -p breadd --locked --bin breadd journal_tests`: 3 passed. - Reload and restart retention plus doctor health: breadd/tests/ipc_integration.rs bug_store_survives_module_reload_and_reports_health and bug_store_survives_daemon_restart_without_marker_collisions. Both passed. bread-cli doctor prints health.bugstore and does not invent a byte count when unavailable (bread-cli/src/main.rs:932-944). Location documented at Documentation.md:1741. - Cards stay in review. Two-pass consumer verification is on main after PR23, not done here. ### BREAD-40 - Strict total cap without waiting for rotation, oversized records dropped intact, lowered caps on reopen, fail-closed accounting: store.rs:425-523 and tests.rs total_cap_is_enforced_without_rotation_and_on_reopen, unreadable_app_fails_closed_and_usage_reports_error, failed_eviction_does_not_allow_append (pad mtime UNIX_EPOCH). Same 28-test run passed as uid 1000. ### BREAD-41 - ci/bread-ecosystem.rev pins 25bf3af49a3de240f64ed90e6eebd2958e672d10, merged bread-ecosystem PR55. Shared ci/build.sh uses `--user $(id -u):$(id -g)`, host-writable cache binds, passwd/group mounts, and per-product flock. Exact-head check.yml job 2446 (Actions run 141) succeeded in 20m58s: checkout, clippy, build --workspace, test, Complete job all success. No cleanup permission failure. ### Checks - Required workflow is check.yml on feature/** push. Commit status `check / check (push)` success for 1505b0d. No branch protection rules. Reviews API empty. No outstanding formal review to dismiss. - Also: `cargo clippy -p bread-bug --locked --all-targets -- -D warnings` clean. Scratch worktree: ~/.worktrees/bread/review-pr22-1505b0d. Primary checkout and feature/breadbug-* worktrees were not modified.
Breadway commented 2026-10-14 08:50:05 +08:00
Author
Owner
Copy link

Merged

Pass comment: #22 (comment)

Re-read immediately before merge: head 1505b0d445, base 4a164fd98a, mergeable, required check / check (push) success (Actions run 141, job 2446, all steps success). Merge API Do=merge, delete_branch_after_merge false. Confirmed merged=true, merge SHA aea9879d61. feature/breadbug-store still exists for stacked PR23.

Cards stay in review. Two-pass consumer verification is on main after PR23, not done on this merge.

## Merged Pass comment: https://git.breadway.dev/Breadway/bread/pulls/22#issuecomment-4597 Re-read immediately before merge: head 1505b0d445c7715f551fd0f8870dfff8c22d6ca3, base 4a164fd98a9c749a6afa1ffd7b70ce0a5df83b86, mergeable, required check / check (push) success (Actions run 141, job 2446, all steps success). Merge API Do=merge, delete_branch_after_merge false. Confirmed merged=true, merge SHA aea9879d61deaf55000ec7b5a377e79299170232. feature/breadbug-store still exists for stacked PR23. Cards stay in review. Two-pass consumer verification is on main after PR23, not done on this merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
breadbug

   
bug

   
phase-1

   
phase-2

   
privacy
No labels
breadbug
bug
phase-1
phase-2
privacy
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Breadway/bread!22
No description provided.