Repository navigation
design(id): #2818 region-seam handoff format - #3875
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 20 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4dfcaa3965
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| | Import never arrives / B is down before import | `HandoffStarted`; after export, A also has `EntityExported` and the full payload. | Keep the entity in transit; retry the same envelope when B is available. Alert after the stuck threshold. The state remains recoverable from A's journal. | Do not delete A's export, declare completion, or reactivate writes at A merely because a timer expired. | | ||
| | B commits import but reply is lost; import is sent twice | A has export; B has one `EntityImported` keyed by the same ID and digest. | B returns the existing import receipt on exact duplicate. Coordinator verifies the receipt and proceeds to completion. | Do not create a second entity or accept a different payload for that ID. | | ||
| | B goes down after import but before coordinator completion | A has export; B's journal has import (assuming durable append completed). | Keep routing/status in transit until B can be inspected and its import receipt is verified; then append completion. | Do not infer import failure from an unavailable B or roll back A. | | ||
| | Coordinator dies after `HandoffStarted`, before source export | Coordinator has start; A has no export and remains writable owner. | Replay the start and retry export. If cancelling, append `HandoffCancelled` only after verifying no source export committed. | Do not expose transit or move the route before the source fence. | |
There was a problem hiding this comment.
If an export request is still in flight when the coordinator restarts, querying A can report no committed export, allowing the coordinator to journal HandoffCancelled; the delayed request can then reach A and commit EntityExported because cancellation does not change the owner epoch or create a source-side rejection record. This removes/fences the entity for a handoff the coordinator now considers terminal, leaving it unavailable without an active recovery path. Require a durable cancellation tombstone serialized with export in A's actor before recording coordinator cancellation, or disallow cancellation once an export request may have been sent.
Useful? React with 👍 / 👎.
Summary
Adds the decision-ready handoff design at
doc/2026-11-01_design_id2818.md, grounded in #2818 and currentpkgs/idjournal/replay code. It recommends dedicated source/destination journal records and coordinator open/close records, with no cross-region transaction.sequenceDiagram Coordinator->>Coordinator: persist HandoffStarted Coordinator->>A: request export A->>A: prepare/validate, persist EntityExported + payload (fence) A->>A: apply prepared event; acknowledge Coordinator->>Coordinator: persist ExportObserved Coordinator->>B: send envelope B->>B: validate, persist EntityImported B->>B: apply prepared event; acknowledge Coordinator->>Coordinator: persist ImportObserved + Completed Coordinator-->>Client: route to B at new owner epochThe note specifies record fields, fresh handoff IDs, complete entity payloads and bounds, client transit semantics, recovery, invariants, and five sequentially mergeable implementation packets. Follow-up: #3870.
Evidence
WorldProgramhas opaque inputs and whole-program snapshots, but no entity transfer hooks;CrossWorldWriterecords a policy setting, not a data handoff.git diff --checkpassed. Documentation only; no runtime tests were run.Merge Danger
Door: Two-way — this is a design recommendation that can be revised before implementation.
Blast Radius: Low — one new Markdown design record; no implementation behavior changes.
References #2818; does not close it.