Skip to content

feat: durably capture Core verdicts for prospective Candidates #321

Closed
#323
Closed
feat: durably capture Core verdicts for prospective Candidates#321
#323

Description

@James3014
James3014
opened on Oct 2, 2026

Parent research/contract: James3014/Nexus-new#1312 (parent #1278)
Core producer merged: James3014/nexus-core#77 -> 6c0cc48c9b3082470da40cb44697617de52b3988

Objective

Implement the DevSpace consumer side of prospective G2 Core-verdict capture without creating a second verifier, scheduler, Candidate authority, or acceptance path.

Current DevSpace main at issue creation: b1cc9cf68a074bd67ddc4340067d96f3ce2f50d8.

Current facts

  • CoreMutationSessionStore already owns pre-effect operation/attempt/source/AcceptanceContract identity and durable Candidate provenance.
  • Normal Candidate formation is server.ts -> coreMutationGuard.recordCandidate() -> CoreMutationSessionStore.recordCandidate().
  • Current binding core contains only protocol_version / acceptance_contract / acceptance_contract_hash.
  • Existing live required_verifier_ids are highly task-specific; late-bound verifier inference is forbidden.
  • Existing DurableOperationStore already owns stable attempt identity, request hash, terminal status, restart -> outcome_unknown, and reconciliation semantics. Reuse it; do not create another scheduler.
  • The merged Core machine interface is nexus-certify acquire, schema nexus.core.candidate_acquisition_cli_result.v1.

Design contract

1. Backward-compatible pre-effect verification profile binding

Extend RepositoryMutationBinding.core with an OPTIONAL hash-bound verification profile for compatibility with existing v1 callers/sessions.

When present, it SHALL contain:

  • profile_id
  • verifier_ids
  • verifier_commands (exact argv arrays paired positionally with verifier_ids)
  • timeout_seconds
  • profile_hash

Validation SHALL:

  • reject unknown profile keys/types/empty argv;
  • require exact verifier-id set equality with acceptance_contract.required_verifier_ids;
  • recompute the profile hash using the same canonical JSON rule as nexus-core:
    {profile_id, verifier_id_command_pairs(sorted by verifier_id), timeout_seconds};
  • include the profile in the overall binding hash;
  • make it immutable for the bound session/rebind/replay.

Legacy bindings without the profile remain parseable and preserve their existing hash semantics. They are not retroactively upgraded.

For G2 observation, a Candidate from a session without a bound profile yields explicit durable missingness PROFILE_NOT_BOUND; it does not block Candidate creation.

2. Reuse DurableOperationStore for exact acquisition effect identity

Add one bounded operation kind, e.g. core_candidate_acquisition, to the existing durable operation substrate.

Stable identity SHALL bind at least:

  • session id
  • Candidate head/tree
  • source head
  • AcceptanceContract hash
  • verification profile hash
  • ChangeSet hash
  • Core runtime identity

Exact replay reads/reconciles the same operation. Conflicting material under the same stable identity fails closed. DevSpace restart while nonterminal must become outcome_unknown; do not blindly spawn a second verifier run.

Do not add a second operation table/scheduler.

3. Durable non-authoritative shadow observation

Persist one observation/projection row linked to session + Candidate + durable operation. Minimum fields:

  • status/state
  • core_invoked
  • core_verdict
  • core_reason
  • receipt_hash
  • t_core_detection
  • orchestration_runtime_ms
  • missingness/error reason
  • acquisition request hash/id
  • profile hash
  • Core runtime identity
  • created/updated timestamps

The projection is evidence only. It grants no verification, acceptance, merge, release, deploy, or routing authority.

4. Candidate trigger and non-blocking behavior

After Candidate provenance is durably recorded, enqueue/start the exact shadow acquisition outside the authoritative Candidate transaction/return path.

Rules:

  • Candidate provenance success must not depend on Core observer success.
  • Core executable unavailable, profile absent, parse failure, verifier failure, or Core rejection are all durable observation outcomes, not worker errors.
  • Do not expose Core verdict to the worker as treatment feedback during G2.
  • Session close / PR / acceptance / merge remain independent.

5. Runtime binding

Add explicit DevSpace configuration for the Core acquisition executable/runtime identity. No PATH guessing.

At minimum bind:

  • exact executable path/argv root;
  • expected Core source revision 6c0cc48c9b3082470da40cb44697617de52b3988 (or later explicitly re-bound merged revision);
  • an immutable runtime/package digest/identity that can be read back.

If runtime identity is absent/mismatched, record CORE_RUNTIME_UNAVAILABLE_OR_MISMATCH; do not block Candidate creation and do not silently call another executable.

6. Census projection

Extend CoreMutationObservationEntry / existing read-only observation tool so session + Candidate + Core shadow observation are returned together.

Historical rows without contemporary Core observation remain missing; never backfill them as if Core had run at the time.

Negative controls

  1. Legacy binding without profile still parses with unchanged binding hash.
  2. New profile verifier IDs != AcceptanceContract IDs fails before first effect.
  3. Profile hash tamper fails.
  4. Same binding/profile cannot be changed after first effect/rebind.
  5. Candidate without profile -> durable PROFILE_NOT_BOUND, Candidate still succeeds.
  6. Runtime absent/mismatched -> durable missingness, Candidate still succeeds.
  7. Exact acquisition replay does not create a second verifier execution.
  8. Restart/nonterminal -> outcome_unknown/reconcile same durable operation.
  9. Conflicting replay request fails closed.
  10. Tampered Core result/receipt is not projected as valid success.
  11. Core REJECTED is recorded but does not block Candidate/session lifecycle.
  12. Observation/census read path is restart-safe and read-only.
  13. No Core verdict is returned through mutation tool output as worker guidance in G2.
  14. Existing Core mutation/rebind/direct-evidence tests remain green.

Scope guidance

Likely files:

  • src/core-mutation-session.ts
  • src/core-mutation-tools.ts
  • new bounded src/core-candidate-acquisition*.ts
  • src/durable-operations.ts
  • src/db/migrations.ts
  • src/db/schema.ts
  • src/config.ts
  • src/server.ts
  • focused tests adjacent to these owners

Keep the PR focused; no UI work, provider routing, agent-selection changes, acceptance changes, or #1278 G3 work.

Acceptance

  • Focused binding/profile/replay/tamper/restart tests pass.
  • Existing core mutation session/rebind/direct-evidence suites pass.
  • migration upgrade/idempotency tests pass.
  • server/tool-surface focused tests pass.
  • npm run typecheck, npm run build, git diff --check pass.
  • One physical local canary after merge/deploy creates a normal Candidate and later shows a durable Core verdict/receipt in the census while the worker path remains non-authoritative.
  • Restart readback returns the same observation/acquisition identity.

Maximum source-only claim before live deployment:
CORE_VERDICT_CAPTURE_SOURCE_COMPLETE_RUNTIME_UNPROVEN

G3 remains NOT READY.

Activity

  1. github-actions commented on Oct 2, 2026

    @github-actions
    github-actionsBot
    on Oct 2, 2026 – with GitHub Actions

    Authority: RESEARCH_OBSERVATION_ONLY / NO_ENGINEERING_AUTHORITY

    Hybrid replication capture receipt 
    {
  "body_gzip_base64": "H4sIAAAAAAACA41ZXXPbuhF9569AJy9Jr0T6K7aTTO+MY+smvrUtj+2k0ycJIiGJ1xSpAqBtTaf/vWcXAAnZup2+2BKJj8Xu2bNnoVupVW2FVkZJnS+zvKmtlrn9LH6XK2UO9/aPshv10pphrZ7f7R/uH4j3azfn3f7ByemH5LzRSqx1U7S50mKl9EIV8eyaZ+cY9e7kRAx/FdPjfC/Pj07zT7PDvdODo5O9Qh7t5bOjo+NPJ8f7J4X6eDA7/HR6Ok2Sd+/EePaHym35pJLkcrWu1Ir2tkslLtTT/VrmSsBm02JjYcpCiWZO1pi1myS+HQiycPikdFHmVuRybVtY/FzaZdPiu1bSlvVCSGEUVioERpbzUumBMPlSFW1FH89lXZSFtErIFhN1aTcD0Wgh81ytraxhxlraZZok561m93TmrWRZC2lFaUyr/H5N/VlMZ/t5/imfH5/KvZOjWXF8UhT50eHR3h4+fTqeH+bqYP5xrzidpuyIsPAc4TFJMhRTOth1a3m9e2UM/bN4NhWywjbFRjTPtYE71FDN53CIaNZK8/BMWqtWa5uZptW5ys66c5x7BAg4s7Y4p8DRRdFqOatU5Ac4+UnVNCOFLTeNXskqej2nB7QTzi2mRmm4NbWGAJBHZn9rpS5SDc/ropv8/gMN+7PTvR09JQuCe2YlniOe05w9QYBGAIxo6mojprDaNnlTTWAOrSiyKISTgP7dTydLaZa81+ilNAyaiiA21epfbalVMQnQmZSFQRAAs2W5WGJfK83jkDCJ1/kXUcHs4axpI7SJsp4rHACAgcPgvVlZIABbu00vXBTGIYq7om0sB8rHt4viQJCVylhBpxgIq/SqrBEyjLetodf4pC1nKBIjb1Zq0taPNRadDhgD5Pc6L6vSxdWolcTSuUnFnWoN7LZfRNGIuvFZBSPweUmJGRKJjvOA3HU0wSFGfuTLssb0GjbNpXPA1NOG0racA4I5e3jqcnIl/fuUYpzmAQkTHmZKMm+SV+UEZ2ormz7t+xS6UKZc1CIElJ69E/up+Crzx2cAETS1QhqX5MAoa1yMcndsIGhe4r3HWZKMXqyCd6Z3at1g70ZvAmq/uiGpQyIxDjwixrcPl+ObsysOxBYKXu0AEIhgELyOTOQlVIDD0z7YrIJXTWZcfhgc8x9LRUuA0Gs7QEzE/fezq6uQB58RAL8+QIovMWTjr9gY4S2MeK9eKCOkXjzhj5YbEIoktAs+LnaFDd60eLEPWM2WKwUsTRyzmmhvOnuS/JQVBY4OzVaSdVoR3wsPvc4Zj2pjMrtZK5MRrjds0Bcez9AQzsxgwbAsAFAr8FL2rpvuyOp0d/a6pcn9LYBM9SZYQqaL1lAE6LFBpUMc6qZG/Crx+/34RuiWMtCIvvZ9ToSY/rv3/CD2VXD2hBxr3ptGW7h3tonHfBi89uZ/2Mayzqu22LYQ9Ya+gp81YtMxIhlOU1bykZJVlKtV68iCkEYzHBg9mDKtaCb+rSu5AbKu1ELmm7Cc6UpovLVWXO4gESAomIewIKMRBYBGlroHMHsyohEww4ZZkyhEK6sbyUUc8GrXCy0LVcCM32AsqnozozUZPKCnuPLoZsXVnE/RWSn96YKlm1JVgLd6WVdlDm+ECrdCnYZxNaaL6e3d+LfLq9HkZvww+Tr+cXMx/UKeKxpl2MhZ1eSP0d6huqeOWg4CNe4kbna7z66euIQnnUDcSXJWFKhePjoARlfExSNCMRAqXaSu3E12UiFY0zYcpc7z4bD9UqadGeSDRTVP7h0qOgHgGITiTjqmUtJYytTgYeaR3gdL1KLMaqVoCKsLfoRvO0QG88BwN//5d+dLWS/UveoGc9XQbU35ELlpxJ50aBVUEE0WKhai1aVqd+QUC9VzBJ89ArECG5DA5GPdDzevfDGXZWVEXjUGYOxFXqiez0uyHGTQ1ddVi5o7IyZRbwtrVzBnFbwLnJu1BOm90aJ0XATmwg2WAEQ3pA8hW5pFtZYxeJgG9JFZwyBfJatjs5RF8xznUpLckjKCzQS56EWGsLASx04ac2DwI8AIZAUc/BKB4Je3EEvFdVmXq3Yl5px6DCEWHxn9I7gwhsv6qcHK4asX7uErAmtgJZOzKtdOlFGpmfDrQllnIx41aGgUg5r0gAfMZEVlKEryTGmNPOzWjVMxlkwZw/w1NndCcej1T5G1a/JGwdSNQ67WEO4Pji6DLyF21BNNBYpIo6bi0gqQXW2JYrYyYxCp0oHTUKTbKCHxoQDyG9eVaOCMe5rQq3gsHKVRiKwuFwtAixiakMFcRrNmaimfykaDeeaA8U7NT2a7CG+E0+OKmKiGv1qVuVxwjENJ6WEWuxYWcrtGg7YxGVsoayPZTUhltG11aLLuAHAG0E7bTAs3gb459Shh4BqSaNiWA+ZQTbrUDUxDJNWLyn1JbGv5hFSnz4Mu6nLmVBWXN6YCtJJ9Ke+fIAYOGiqEmcoaFeMuLfrMEp4VIMLJ2OdGP2IthiWb5rMelQqk49YN3azndT8FisMS8LhFnitVzKBraUeK6rcDWss3Uo7A0Obc3m31OvjCsAp1HKTErsOCHkIfUdI83jsFTAWqq6NxWz4vF60npyAx2Pytctf5PHudSCnaSnF79vBdLFrFCQsjziyy1/EIGUAgcCCLgkcoyVix6qaxX3gIXQiElsOXJY3EY2/8/1cS4j3OQe2b7k7MGeB1vO9rwsIfaGtI/l5p+SNm8NCjhJ+LcgFiyLryYpeS7ihqJCHXMEEhxKkv529ohlLQATIDnaF+EfEPfDaK6fn4bjS5+3HzcHk9mvy4Oft5dnl19hVaZnw3ub68vz57OP8e15/dQsY1/26MQQrUdFzqOrrerne7R8gxSEbVpjURy/VdUtzVj/scGEEPbKaAXydR6PRDbtrjVLFNg5b1z2qOC+6bmsbJ5wiEK9ZCkeUw9zv2AvGQbkdJ6xUt9QboMhot9SamDOmrAueGryFfoPKJSyhQIImKUL6iVCznbirModiRdKIEoBi6bvQGepoZj1uRpkJtQC+6rbI7kwIFwTnYgwnI2QumylkhFVtCP00gPm/UczexI6nLCyP+8rddYozeOH0zU3MWqGhHrBekaQIlcRv3QFTPPOmBp1Bb7mXPClnYF2BmgOGTN1NyVYnX9q1GmnyMC9Trow9/7djzjS6Pb+ici5jbVQHLjnvKepMv8aKRKPhfy52kYvRGtHvZ2TUG4QLkjZBz6cItwil1B1wqs1gwwqJXMrHXsU6TvpVWyadtNdupYKdftkRrsr+HVotjF/jQ3ZNkXlIRsdAZfPpSxIx4ola9L5j7+6mbejf6fXT+MLqgSUEIiFn75z1SuKuAgEToNznxxj6wGpFBljv+YAIkLneLs6uGRs6Vv47yBIH5h1wqtkojTwkpv4QiWizFyhOPoxF4eU2NoQn1c9HCQhY3NZfL/aO0v3xzd1V+gdAbFyXObIedgLMw0gSCWKAHcp2guM8Rq259tNLlI3W1BGuWMVOj84wE7DDsMPRuSq2Z7h5AZzD+dY1ED+1hP7TrBocRVP8ar+iRNOyQZLbezpApi90v3D3ctnVU7+Mn3a0vPZk3OTrhwrtIFn9AI9RBwUCLAOdoPJLk70qtmSghTfycLySEf1xymFiMkbs7lQtVvMBKcFjltZYjGhPL5f4Z6jf/ciG+HfKCLkA9G9LN+m/e1ldc5q9CMkd8Wej53InW0gnJDjB5DJjXlyqvgWPaEst0i3RuDxcfpBBQkFBDURu2N3RezggOQ9O6G9RtZ4eR03q94lJE92iIX/44HfQPZ21ZFfRgQTcc5XwuhkM3qFtgjJZwvdwYrphIa/wFxqhIOk5n+ZO5RsRTIEKN6L36cYDS14kos6S6K/vfF6IU7vnI3Wd5VnAtdiR7mSFczpm3PS7Z7WmWKYM1sWOG+FYgYp+Y1zspmiTX8oVVpxOPTprklSxXoVryjwHu8KTAPydOg/0c3V1cnj9Mzs9uH37g+/34x935aHI+vr69Gj3EGg1V7efoZpokgGY4DyocOPbs4p/pfwF89ZpwqxsAAA==",
  "capture_sha256": "e8fd5a0a3221a870605498299895f9aa675c495a90f6e3dc2b09a4122040d0c4",
  "captured_at": "2026-10-02T05:10:03Z",
  "contract_sha256": "06da8648372f0b6a46defab7f55cb032d68ce8388d84e7eee742edad013fa6c3",
  "created_at": "2026-10-02T05:09:57Z",
  "default_branch": "main",
  "issue_number": 321,
  "issue_updated_at": "2026-10-02T05:09:57Z",
  "pre_implementation_revision": "b1cc9cf68a074bd67ddc4340067d96f3ce2f50d8",
  "repository": "James3014/devspace",
  "schema": "nexus.hybrid_replication.capture.v1",
  "source_event_id": "actions:36967718804:1",
  "title": "feat: durably capture Core verdicts for prospective Candidates"
}

  2. github-actions commented on Oct 2, 2026

    @github-actions
    github-actionsBot
    on Oct 2, 2026 – with GitHub Actions

    Authority: RESEARCH_OBSERVATION_ONLY / NO_ENGINEERING_AUTHORITY

    {
  "activation_boundary": "2026-10-02T02:36:35Z",
  "activation_state": "AUTOMATIC_CAPTURE_READY",
  "admitted_at": "2026-10-02T05:10:03Z",
  "capture_sha256": "e8fd5a0a3221a870605498299895f9aa675c495a90f6e3dc2b09a4122040d0c4",
  "disposition": "CROSS_REPO_SCOPE_GAP",
  "exclusion_set_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
  "implementation_pr_numbers": [],
  "issue_state_at_admission": "open",
  "receipt_sha256": "cdf33ddd70df6b81efc832a5856677aa576c46022c22ac1140c83d8dd97bb929",
  "schema": "nexus.hybrid_replication.admission.v1",
  "task_key": "James3014/devspace#321",
  "tracked_parent_created_at": null,
  "tracked_parent_issue_number": null
}

  3. James3014 commented on Oct 2, 2026

    @James3014
    James3014
    on Oct 2, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Wave B dispatch reconciliation — v1/v2 pre-Candidate attempts

    waveB-impl-v1 never launched a provider. Its first native agent_start failed pre-launch because authorizedToolCeiling was supplied without a toolProjectionManifest; a second pre-launch validation then observed Nexus capability-discovery drift (4204054... -> 4fdd24a...). The zero-effect Core session was closed ABANDONED.

    waveB-impl-v2 opened a fresh Core session against current discovery and launched exactly one DevSpace agent: agt_27906349.

    Observed failure mode:

    • DevSpace agent_status rapidly projected idle / terminal=true while the HerdR/Agy UI text still showed the model thinking.
    • Core session retained writerReconciliationState=OUTCOME_UNKNOWN, writerDomains=[AGENT].
    • agent_reconcile physically proved: HEAD remained exact base b1cc9cf68a074bd67ddc4340067d96f3ce2f50d8, worktree clean, changedPaths=[], no Candidate, scope within bounds.
    • The exact agent was then durably cancelled/stopped. No second writer was launched.
    • agent_continue correctly refused because the HerdR agent had been explicitly stopped.

    Source inspection confirms a lifecycle gap: current Core close-time inspection can classify a stopped AGENT writer as CLEAR, but there is no standalone AGENT-writer reconciliation action. Because no Candidate exists, the session cannot COMPLETE; because first-effect admission was recorded, it also cannot ABANDON. Reusing this session with a differently named agent attempt would additionally make direct-candidate evidence fail DISPATCH_INTENT_ATTEMPT_MISMATCH.

    Therefore v2 is classified PHYSICAL_NO_EFFECT / PROVIDER_OUTCOME_UNKNOWN / SESSION_NOT_REUSABLE_FOR_CANDIDATE_EVIDENCE.

    Recovery policy: create a fresh isolated worktree and a new waveB-impl-v3 Core/agent attempt only after rebinding current DevSpace/Nexus main. This is a separately identified recovery attempt after proven zero physical effect, not a blind resend. The AGENT-writer reconciliation lifecycle gap remains a separate dispatch-control defect and must not be hidden by the #321 feature implementation.

  4. James3014 commented on Oct 2, 2026

    @James3014
    James3014
    on Oct 2, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Wave B v3 reconciliation — partial effect preserved as donor, not Candidate

    Attempt waveB-impl-v3 / agent agt_e49bf2a4 was terminated after the HerdR/DevSpace status projection became stale and agent_continue rejected the agent's own physical mutations as Foreign workspace mutation.

    Physical reconciliation at stop:

    • base/head still b1cc9cf68a074bd67ddc4340067d96f3ce2f50d8
    • dirty tracked/untracked scope is exactly:
      • src/config.ts
      • src/core-candidate-acquisition.ts
      • src/db/migrations.ts
      • src/db/schema.ts
      • src/durable-operations.ts
    • no unexpected paths
    • no commit/Candidate
    • diff hash 68556839ea58e445e08df8c12160938850810591ac8d3caf6c6845b88fcbbcf8
    • provider state remains OUTCOME_UNKNOWN; terminal reason is cancelled

    Independent cross-repo oversight against merged nexus-core#77@6c0cc48c9b3082470da40cb44697617de52b3988 found three concrete incompatibilities in the partial implementation:

    1. profile hash shape is wrong (DevSpace prefix-array vs Core canonical object);
    2. CLI argv is wrong (certify acquire --request-json vs actual nexus-certify acquire --request -/stdin);
    3. request/result schema is wrong (internal DevSpace envelope / request_id, verdict vs Core's exact acquisition request and acquisition_request_id, request_hash, core_verdict, core_reason_codes, receipt_hash, ...).

    Also required before acceptance:

    • hash/read back the exact configured Core executable bytes and compare the configured runtime digest before invocation;
    • persist durable acquisition operation/observation identity after Candidate provenance but before the worker-facing commit path returns, while the expensive Core verifier remains nonblocking;
    • keep core_verification_profiles derived-only from a validated session-bound profile, never an independent selection authority.

    Recovery plan: v3 worktree remains frozen as evidence. A new clean waveB-impl-v4 worktree will mechanically import only this bounded partial patch as a donor, then repair it against the exact Core producer contract and complete the remaining server/session/test wiring. v4 is a separately identified recovery attempt after the v3 physical effect was fully observed; it is not a blind resend.

  5. James3014
    closed this as completedin #323on Oct 2, 2026
  6. James3014
    reopened this on Oct 2, 2026

  7. James3014 commented on Oct 2, 2026

    @James3014
    James3014
    on Oct 2, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Physical canary found a real consumer bug — #321 reopened

    Post-merge source/deployment work reached a real local Candidate -> nexus-core acquisition path on deployed DevSpace 9e756740ff7ef69f4289545a2c5894551155a5a6 with exact nexus-core producer/runtime 6c0cc48c9b3082470da40cb44697617de52b3988.

    The v2 physical canary created a Candidate and invoked nexus-certify acquire, which terminated deterministically with:

    ERROR / CHANGE_SET_HASH_MISMATCH

    • DevSpace sent expected hash: sha256:c84e9fa610c01b52165a2584a96b46a5da7a000d92e3cc8a4a4a53c3bab7b8de
    • nexus-core re-derived: sha256:b6bd746f790b3d0f61133652e345e40b3a0d7aa3eb35f5db29015cb02ed0c572

    Root cause is now source-supported and live-reproduced: DevSpace passes the durable physical Core-mutation changeSetHash directly as expected_change_set_hash. nexus-core#77 intentionally derives a separate acquisition-specific ChangeSet whose change_set_id is acq-change-<acquisition_request_id[:16]>, while DevSpace physical provenance uses nexus.core.physical-change-set-id.v1 over session provenance. The canonical hash function is the same; the subject identifier is not, so the hashes must differ.

    The repair remains consumer-side. DevSpace must preserve its physical Candidate ChangeSet hash as provenance/operation identity, but compute the Core acquisition expected_change_set_hash from the exact Candidate manifest using nexus-core#77's acquisition-specific ChangeSet identity. No nexus-core producer change is justified.

    Important retry fact: the failed canary Core effect was terminal ERROR, not timeout/outcome-unknown. That Candidate will not be replayed. A fresh Candidate/recovery identity will be used only after the source repair is merged/deployed.

    #321 remains open until: repair merge -> DevSpace redeploy -> new physical Candidate reaches VERDICT_RECORDED / VERIFIED -> isolated server restart returns the exact same operation/request/receipt identity.

  8. James3014 commented on Oct 2, 2026

    @James3014
    James3014
    on Oct 2, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Post-merge physical canary continuation

    Production DevSpace source/runtime is already converged at current main 9e756740ff7ef69f4289545a2c5894551155a5a6 / devspace-1.0.7-9e756740, and exact nexus-core #77 runtime 6c0cc48c9b3082470da40cb44697617de52b3988 is installed at a versioned local runtime path with executable SHA256 742d25f32f24f2aff4e27152692c788ad3693f8b66664748ad774f7ba45e9807.

    The first canary-control attempt opened Core session cms_e113de012fa547cea6e4315855884d9a on an isolated clean worktree, but two pre-canary bash --help probes were admission-rejected while still leaving a PROCESS writer pin. Physical snapshot proves exact source HEAD/tree, clean worktree, changedPaths=[], deletedPaths=[], and no Candidate/source effect. The live server exposes core_mutation_session_recover_orphaned_process, but this ChatGPT client projection is stale and does not currently expose that recovery action despite a successful tools/list_changed refresh request.

    To avoid mutating production state or replaying the pinned session, the final #321 acceptance canary will now run on an isolated loopback DevSpace instance using the same deployed build 9e756740, a separate stateDir/port, and the exact installed nexus-core runtime. It will exercise the public MCP path end-to-end: open workspace -> Core-bound Candidate -> real nexus-certify acquire -> durable shadow observation/receipt -> restart same isolated instance/stateDir -> read back the same observation/receipt identity.

    This is a physical-runtime acceptance canary, not a replacement implementation attempt; it does not create a second source change or production authority.

  9. James3014 commented on Oct 2, 2026

    @James3014
    James3014
    on Oct 2, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Runtime acceptance re-open — exact Core ChangeSet hash mismatch

    #321 source was merged by PR #323 and DevSpace runtime was successfully cut over to current main 9e756740ff7ef69f4289545a2c5894551155a5a6 / devspace-1.0.7-9e756740. Exact nexus-core#77 runtime is installed from 6c0cc48c9b3082470da40cb44697617de52b3988.

    Physical managed-worktree canary reached a real Candidate and invoked nexus-certify acquire, but Core failed closed:

    • Candidate: 9b7761c7d641523c6794f19742cf1a692dd7c14b
    • Candidate tree: 0aa285b02105b0901630d7687f21425a55ec285e
    • DevSpace Candidate change_set_hash: sha256:9481e3eb512856b69872a4f6b344c15bee8d40408fdd2fdb024205a948b5061a
    • Core re-derived acquisition ChangeSet hash: sha256:d734e103d3c86d68470b4c945c6823074f74e3eef2bcfefe4fb7dbc053481300
    • Core error: CHANGE_SET_HASH_MISMATCH

    Root cause is now physically reproduced and source-supported: DevSpace passes its own Candidate ChangeSet hash into expected_change_set_hash, but nexus-core acquisition intentionally constructs a different acquisition-scoped ChangeSet:

    • DevSpace Candidate ChangeSet uses a DevSpace hash-derived change_set_id and target_revision=git-commit:<candidate_head>.
    • nexus-core acquisition uses change_set_id=acq-change-<acquisition_request_id[:16]> and target_revision=git-tree:<candidate_tree>.

    Independent recomputation with the exact installed nexus-core change_set_hash() function and the physical canary values returns exactly sha256:d734e103d3c86d68470b4c945c6823074f74e3eef2bcfefe4fb7dbc053481300, matching the live Core failure.

    Therefore #321 is reopened until DevSpace computes the exact Core acquisition ChangeSet hash, the repair is merged/deployed, one fresh managed-worktree canary records a Core verdict+receipt, and restart readback proves the same observation identity.

  10. James3014 commented on Oct 2, 2026

    @James3014
    James3014
    on Oct 2, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Current-main physical canary + restart readback PASS

    PR #327 is merged on current main 4fef445fa217a51794f13ac641a6b991db5d54ec (devspace-1.0.7-4fef445f). A fresh isolated managed-worktree physical canary on that exact source has now completed the real DevSpace -> nexus-certify acquire path using nexus-core #77 runtime 6c0cc48c9b3082470da40cb44697617de52b3988.

    Exact physical evidence:

    • Core session: cms_e828c533d76f41b6848d604e118ff71e
    • Candidate: 1018977f21c3715f4a950dfdb28524b3f5cef92c
    • Candidate tree: 550691a0e0028e6e8b2f6d9736b3cc2f42a2595f
    • Acquisition operation: cca_168f25ccc84a1ceb91018811587c5b20
    • Acquisition status: VERDICT_RECORDED
    • Core verdict: VERIFIED
    • Request hash: sha256:64cc57642fe608976a8791c116bd6133bb3a28a775d4d6aeb8881fcfc121dd10
    • Receipt hash: sha256:14abfacaf52a2aa3b94a5433424fb53c5ea67947c8481f31ab3468aa0020e984
    • Core runtime executable identity: nexus-core 6c0cc48..., executable SHA256 742d25f3e42f6e836f8a97756cbda6b0460d3727fa34a3b9a4c32aec1824ede5

    The isolated DevSpace instance was then physically restarted. Server instance changed from 8dcb9dd8-ec31-4ddd-ad22-4dff358a5780 to 48bb808a-b104-4bd8-824b-aef2b0e68feb. After restart, read-only MCP census returned the same session/Candidate and exact same operation ID, request hash, and receipt hash; acquisition remained VERDICT_RECORDED / VERIFIED (identityMatch=true).

    The earlier production cutover blocker e4a8d729-c784-4962-9390-e366bb8cb0d2 has now been independently reconciled/closed with its exact durable witness, so the remaining #321 gate is only production synchronization from live f486e127... to a build containing current main 4fef445..., followed by exact live-runtime readback. No #321 source defect remains.

  11. James3014 commented on Oct 2, 2026

    @James3014
    James3014
    on Oct 2, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    #321 terminal closeout — production runtime synchronized

    The final remaining #321 gate is now satisfied.

    Current live DevSpace readback:

    • accepted deployment: 4fef445fa217a51794f13ac641a6b991db5d54ec / devspace-1.0.7-4fef445f
    • installed build: 4fef445fa217a51794f13ac641a6b991db5d54ec / devspace-1.0.7-4fef445f
    • running build: 4fef445fa217a51794f13ac641a6b991db5d54ec / devspace-1.0.7-4fef445f
    • running server instance: a02f6a36-fcea-40c1-8540-bfdc73458b45
    • capability manifest: 1598eab8064b4ee990eb39810ef881acfcc6e50466e165f3057c8c90522eedd5
    • cutover 4d4c3739-8b37-4931-9296-3b6ebecd56c2: phase=closed, reconciliationRequired=false
    • cutover comparison: server instance changed and source/build/capability manifest all match
    • reconciliation receipt: workspace/queryable=true, agent/queryable=true, agentReconciled=true

    Previously established #321 physical acceptance remains:

    • fresh managed-worktree Candidate reached real nexus-certify acquire
    • acquisition cca_168f25ccc84a1ceb91018811587c5b20
    • VERDICT_RECORDED / VERIFIED
    • request hash sha256:64cc57642fe608976a8791c116bd6133bb3a28a775d4d6aeb8881fcfc121dd10
    • receipt hash sha256:14abfacaf52a2aa3b94a5433424fb53c5ea67947c8481f31ab3468aa0020e984
    • restart readback returned the same session/Candidate/operation/request/receipt identities.

    Source implementation was merged by PR #323 and the later ChangeSet-hash repair is present on current main. No remaining #321 source/runtime gate is open.

    Terminal disposition: COMPLETED / CORE_VERDICT_CAPTURE_PATH_VERIFIED_AND_DEPLOYED.

  12. James3014
    closed this as completedon Oct 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions