id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624

Activity

1. developing-today commented on Nov 4, 2026

   

   developing-todayBot

   on Nov 4, 2026 – with developing.today

   Contributor

   More actions

   CODE-1393
2. dezren39

   added

   kind/bugSomething isn't working (prefixed form of the classic bug label)Something isn't working (prefixed form of the classic bug label)

   status/needs-triageNot yet triaged; needs a first lookNot yet triaged; needs a first look

   priority/normalOrdinary priority (the default)Ordinary priority (the default)

   effort/mMedium: expected under 1 day of workMedium: expected under 1 day of work

   app/idPackage/app: id (pkgs/ or apps/ in this repo)Package/app: id (pkgs/ or apps/ in this repo)

   source/queue-workerFiled or worked by the queue/worker pilotFiled or worked by the queue/worker pilot

   meta/enrichedIntake review done: acceptance criteria, links, and normalized labels addedIntake review done: acceptance criteria, links, and normalized labels added

   on Nov 4, 2026
3. dezren39 commented on Nov 4, 2026

   

   dezren39

   on Nov 4, 2026

   MemberAuthor

   More actions

   Intake review

   • Related: Receipt-audit follow-up from Phase 3 (audit) of #3231 — field-by-field receipt-validation audit for pkgs/id artifacts + contract statement #3232 / design Design: a signed artifact is validated as strictly as it is built — one receipt contract for pkgs/id artifacts #3231; the rejecting contract is id(artifact): friend_remove requests is the one known-kind body parsed() never validates — any count, any shape, any length passes, and every string lands permanently in the directory's removed_requests void guard #3146's friend_remove.requests validation. Evidence: Phase 3 (audit) of #3231 — field-by-field receipt-validation audit for pkgs/id artifacts + contract statement #3232 comment 6578677909; source in pkgs/id/src/directory.rs and pkgs/id/src/artifact.rs. Sibling follow-ups: id(artifact): preserve pre-upgrade log replay for duplicate after and non-NFC fields #5625, id(artifact): validate known-kind bodies in generic signing helpers #5623.
   • Notes: A trap state: a correctly signed but noncanonical ID is admitted and persisted, then makes the friendship unremovable through the normal artifact path. Both halves matter — admission validation alone strands existing state; a removal path alone keeps admitting new bad IDs.
   • Risks: The legacy removal path must not become a general bypass of the receipt contract.
   • Suggested approach: Validate shape at Directory::receive admission; for persisted noncanonical IDs, allow removal via a path that carries the stored ID verbatim without re-deriving it through the rejecting parser.
     — fleet monitor intake, 2026-11-04
4. github-actions

   assigned

   dezren39

   on Nov 4, 2026
5. dezren39

   added

   queue/queuedHas a queued task in the Supabase agent queueHas a queued task in the Supabase agent queue

   task/triageQueue packet kind: verify, reproduce, and route this itemQueue packet kind: verify, reproduce, and route this item

   work/assignedQueue worker lifecycle stateQueue worker lifecycle state

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   and removed

   status/needs-triageNot yet triaged; needs a first lookNot yet triaged; needs a first look

   on Nov 5, 2026
6. 65 remaining items

   Load more
7. dezren39

   added

   status/parkedDeliberately paused with a recorded resume conditionDeliberately paused with a recorded resume condition

   and removed

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   on Nov 5, 2026
8. dezren39 commented on Nov 5, 2026

   

   dezren39

   on Nov 5, 2026

   MemberAuthor

   More actions

   🤖 Agent note · handed off

   • Agent: repo queue worker, lane code-v (repo-worker-code)
   • Session / ID: cron repo-queue-worker-shift-v run 2026-11-05; task 10521
   • Found via: claimed task 10521 this shift; execution-lane assignment returned opencode
   • Task: task 10521 for issue id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624 (Fix). Fresh check: issue id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit). Handed off to the opencode claimant — the claimant launches the bound opencode session; this lane does not work it directly.
   • Expectation: claimant session drives task 10521 to a terminal state.
   • Links: task 10521 · issue id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624
9. dezren39

   added

   queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

   status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

   and removed

   status/parkedDeliberately paused with a recorded resume conditionDeliberately paused with a recorded resume condition

   queue/parkedQueue task is parked (waiting on CI, time, or an event)Queue task is parked (waiting on CI, time, or an event)

   on Nov 5, 2026
10. dezren39

    added a commit that references this issue on Nov 5, 2026

    fix(id/directory): validate friend-request IDs at admission, preserve…

    ...

    aab9b8c
11. dezren39

    closed this as completedin #6239on Nov 5, 2026
12. developing-today

    added

    status:done

    on Nov 5, 2026
13. dezren39

    removed

    status/in-progressQueue worker lifecycle stateQueue worker lifecycle state

    queue/claimedQueue worker lifecycle stateQueue worker lifecycle state

    work/assignedQueue worker lifecycle stateQueue worker lifecycle state

    on Nov 5, 2026
14. developing-today commented on Nov 5, 2026

    

    developing-todayBot

    on Nov 5, 2026 – with developing.today

    Contributor

    More actions

    🤖 Agent note · done

    • Agent: repo queue worker, lane code-x (repo-worker-code)
    • Session / ID: cron repo-queue-worker-shift-x run 2026-11-05 12:39 CST; task 10521
    • Found via: claimed task 10521 this shift; execution-lane assignment returned direct (attempt 4/4, resumed — not restarted)
    • Task: PR fix(id/directory): validate friend-request IDs at admission, preserve legacy removals (#5624) #6239 (branch queue/10521-5624-validate-friend-request-ids) already carried the full implementation from prior attempts. This lane verified it fresh: every Codex review thread on PR fix(id/directory): validate friend-request IDs at admission, preserve legacy removals (#5624) #6239 is dispositioned — the final round (findings on directory.rs:2311 and :2124) was fixed in HEAD 7a3621a (removal artifacts correlated with their own journal entries by hash; FriendRemovalNoted receipts for no-effect artifacts) with reply dispositions on both threads, and no later Codex review exists. Targeted verification on the laptop worktree: cargo test --manifest-path pkgs/id/Cargo.toml --lib — 2271 + 317 passed, 0 failed (directory subset 69/69, including the new property tests for admission shape and removal recovery). Squash-merged PR fix(id/directory): validate friend-request IDs at admission, preserve legacy removals (#5624) #6239; issue id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624 auto-closed.
    • Links: task 10521 · issue id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624 · PR fix(id/directory): validate friend-request IDs at admission, preserve legacy removals (#5624) #6239 · merge sha aab9b8c
15. developing-today commented on Nov 5, 2026

    

    developing-todayBot

    on Nov 5, 2026 – with developing.today

    Contributor

    More actions

    🤖 Agent note · done (already_done — queue bookkeeping only)

    • Agent: repo queue worker, lane code-v (repo-worker-code)
    • Session / ID: cron repo-queue-worker-shift-v run 2026-11-05; task 10521
    • Found via: claimed task 10521 this shift (attempt 4/4); execution-lane assignment returned direct, so this lane revalidated fresh instead of handing off.
    • Fresh verification (2026-11-05T19:1xZ, gh): issue id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624 is CLOSED (closed 2026-11-05T19:04:29Z); PR fix(id/directory): validate friend-request IDs at admission, preserve legacy removals (#5624) #6239 is MERGED at 2026-11-05T19:04:28Z, merge sha aab9b8c. The implementation and merge were completed by lane code-x (see its done note on this issue); the queue task itself had not been completed, so this lane completes task 10521 with outcome already_done and the evidence above. No new code work was done or needed.
    • Links: task 10521 · issue id(directory): validate friend-request IDs before persistence and preserve legacy removals #5624 · PR fix(id/directory): validate friend-request IDs at admission, preserve legacy removals (#5624) #6239