Repository navigation
Retain observed execution footprints (first part of #716) - #844
Conversation
Ports the evidence foundation of draft PR #716 onto current main, per the owner direction to split that PR for re-integration. - ActualFootprint records the graph resources an execution touched and compares them with the declared Footprint; ActualFootprintPosture states what a record may claim. - ExecutionGraphView is the executor-only capability that records reads before the declared-footprint guard applies, so an unwind cannot erase the access that caused it. - RuleExecutor chooses the execution ABI per rule: Observed for native rules, Legacy for frozen compatibility callbacks such as provider-v1, which produce UnavailableLegacyExecutor evidence. - ExecutionFootprintEvidence keyed by canonical execution sequence is kept per worldline (last_execution_footprints) and carried through worker merges and worldline checkpoints. ExecItem takes that sequence explicitly. - The branch tests for the recorder, worker invariance, checkpoints and the differential write check come with it. Adapted to main: - WorldlineStateParts and the rollback copy carry the new field. - One host test fixture that assigns a GraphView executor is wrapped as RuleExecutor::legacy, keeping its behaviour. - New sequence arguments in tests use checked conversions. - Two conflicts kept main, which already had the change in fuller form: the domain-separated snapshot root and a test lint allowance. Not included, and why: - The admission proposal: moved to #842. - Writer-lease release and barren-epoch fixes: already on main. - The trusted_runtime_host.rs change: on inspection it only moves the inline test module, a relocation that belongs with #821. - required-features for feature-gated test targets: a separate improvement. Refs #716. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configuration
📒 Files selected for processing: 44
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6fbddddad0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…re the transcript - Engine::last_execution_footprints, and the copy in worldline state, now hold only evidence from an execution whose worker changes merged. An attempt that unwinds or fails publishes to last_aborted_execution_footprints instead: a failure artifact, cleared at the next execution, never part of worldline state, checkpoints or history. The access that caused an unwind is still inspectable, which is the point of recording reads before the guard. - The retained transcript is held behind shared ownership, so a rollback marker or checkpoint no longer deep-copies the previous execution records. - execution_evidence.rs states what a record does not claim yet: it is not bound to its commit, does not carry the declared footprint, and reports UnavailableBuildProfile without enforcement. Those belong to the admission design in #842. Found by review of #844. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bd4672bdbe
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
An operation can satisfy its declared footprint and still fail when the merged patch is applied, for example a DeleteNode for a node that does not exist. Evidence was promoted to retained right after the merge, so such a tick left retained evidence although it sealed nothing. Evidence now waits in the aborted slot through the merge and the patch application, and commit promotes it only after the snapshot, receipt and history entry exist. A test deletes a missing node and checks that nothing is retained and the attempt is in the aborted record. Found by review of #844. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Ports the evidence foundation of draft PR #716 onto current
main, per the owner direction (2026-10-13) to split #716 for re-integration.What it adds
ActualFootprintrecords the graph resources an execution actually touched and compares them with the declaredFootprint.ActualFootprintPosturestates what a record may claim.ExecutionGraphViewis the executor-only capability that records each read before the declared-footprint guard applies, so an unwind cannot erase the access that caused it.RuleExecutorchooses the execution ABI per rule:Observedfor native rules,Legacyfor frozen compatibility callbacks such as provider-v1, which yieldUnavailableLegacyExecutorevidence.ExecutionFootprintEvidence, keyed by canonical execution sequence, is kept per worldline (last_execution_footprints) and carried through worker merges and worldline checkpoints.ExecItemtakes that sequence explicitly.This is the trusted footprint source that site-scoped settlement (#798) needs.
Adapted to
mainWorldlineStatePartsand the rollback copy carry the new field.GraphViewexecutor is wrapped asRuleExecutor::legacy, keeping its behaviour.main, which already had the change in fuller form: the domain-separated snapshot root and a test lint allowance.Not included, and why
maintrusted_runtime_host.rschangerequired-featuresfor feature-gated test targetsdocs/topics/FalsificationWitnesses.md(1,792 lines)So there is no substantive second, host-side pull request. Once this merges I'll propose closing #716.
Evidence (guarded container, after merging current
main)warp-core: 1,484 tests with default features, 1,824 with the runtime features; 843 withdelta_validatebefore the merge.warp-wasmengine kernel: 55.missing_docs; rustdoc;cargo fmt --check; both ban scripts; licence headers.Refs #716.
🤖 Generated with Claude Code
Summary by CodeRabbit