feat: persist scoped document upload attempts #416

Merged

admin merged 1 commits from codex/document-attempt-manifest into main 2026-11-02 02:50:20 +00:00

Conversation 0 Commits 1 Files Changed 3

+166

admin commented 2026-11-02 02:48:26 +00:00

Owner

Copy Link

Copy Source

Change

Add a durable internal upload-attempt manifest scoped by tenant, project and actor with forced PostgreSQL RLS. Require a non-superuser, non-BYPASSRLS database role and persist a one-way dispatch claim before a future caller performs a network write. Replays must match the original source checksum, size and fingerprint; a started attempt is never automatically retried or marked complete.

Validation

• Three real PostgreSQL tests pass using an isolated database and a non-superuser role, including cross-scope denial, no unscoped reads, repeated connections and eight concurrent dispatch attempts with exactly one claimant.
• A separate isolated PostgreSQL container was restarted; the started claim survived and the non-superuser still could not read unscoped rows. This is not production backup or restore proof.
• Full local suite: 1,263 passed, 193 skipped, including the three database tests which were separately executed with their opt-in test database. Typecheck, targeted lint and local Next.js build passed.
• Local build uses an existing copied dependency tree whose source lockfile differs; CI must verify a locked build.

This is an internal primitive only. It does not authenticate callers, authorize projects, calculate or verify the DOC0-compatible fingerprint, dispatch files, migrate production, reconcile storage, settle credits, or expose a customer route.

## Change Add a durable internal upload-attempt manifest scoped by tenant, project and actor with forced PostgreSQL RLS. Require a non-superuser, non-BYPASSRLS database role and persist a one-way dispatch claim before a future caller performs a network write. Replays must match the original source checksum, size and fingerprint; a started attempt is never automatically retried or marked complete. ## Validation - Three real PostgreSQL tests pass using an isolated database and a non-superuser role, including cross-scope denial, no unscoped reads, repeated connections and eight concurrent dispatch attempts with exactly one claimant. - A separate isolated PostgreSQL container was restarted; the started claim survived and the non-superuser still could not read unscoped rows. This is not production backup or restore proof. - Full local suite: 1,263 passed, 193 skipped, including the three database tests which were separately executed with their opt-in test database. Typecheck, targeted lint and local Next.js build passed. - Local build uses an existing copied dependency tree whose source lockfile differs; CI must verify a locked build. This is an internal primitive only. It does not authenticate callers, authorize projects, calculate or verify the DOC0-compatible fingerprint, dispatch files, migrate production, reconcile storage, settle credits, or expose a customer route.

admin added 1 commit 2026-11-02 02:48:26 +00:00

feat: persist scoped document upload attempts cf37a66d35

CODEOWNERS rules requested review from sax3l 2026-11-02 02:48:26 +00:00

admin merged commit 7541cdaba4 into main 2026-11-02 02:50:20 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

sax3l

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

siax-bot siax-ci siax-healer (siax-healer (CI self-healing agent)) admin (Simon Axelsson)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: admin/0pt#416