Preserve independent project read isolation review
Why: Keep the verified RDM candidate and independent replay available beyond temporary reviewer files. Evidence: Report, original receipt, and replay script were copied byte for byte; the archive and exact pins were validated before focused race replay. Impact: Documents only; the review covers P2, while time repair and performance acceptance remain separate gates. Refs: RDM 57a8d7caedf72d9be4bdca179ae2a93e456ba009; stage 6 W4a
This commit is contained in:
@@ -105,6 +105,7 @@ RDM保有领域、schema/事件与业务权限；Backend仅补必要通用公开
|
||||
- [W6项目模型历史来源逐项复验修订r1](../records/2026-10-14-rdm-two-trees-latest-templates/rdm-two-trees-stage6-w6-source-recheck-design-adjustment-r1.md)：独立复审发现候选`resolve_goal`把完整user/judge正文写入长期回执，已有RED证实。以实际纳入的稳定来源ID/版本/hash经可选领域接口逐项重验，移除原文持久化；用户于本聊天call_751be0cc02914fe2b1fe591042d029ec第0项选择“批准修订，继续 W6（推荐）”。批准对象SHA256 `d46168392d4fd8ea9aa7f73206be039268aff6be100faef63efa052323511616`；仅放行隔离分支，真实库迁移/tag/阶段验收仍按原边界。
|
||||
- [W9全部审计写入口截止水位修订r1](../records/2026-10-14-rdm-two-trees-latest-templates/rdm-two-trees-stage6-w9-all-writers-cutoff-adjustment-r1.md)：独立复审发现并在隔离PG以测试-only RED实测显式在线低ID绕过已批r1默认函数，`committed-prefix`误报并跨页漏行。所有INSERT同事务锁/单调门禁、UPDATE/DELETE不可改、排他离线复制与只前进序列由用户于本聊天call_4f521a6ddd0542178769f8d7231916b5第0项选择“批准修订，隔离实施验证（推荐）”；批准对象SHA256 `44f6f7cd34bf95a9c1eb844bfdd70a5c2233e1b5ffc89b3091359dcb5fc3b5d8`。仅隔离分支续办，真实运行库迁移仍未放行；当前W9 `63ebc85`本身不能强报已提交前缀。
|
||||
- [Backend X1/X2与最新main组合探针r1](../records/2026-10-14-rdm-two-trees-latest-templates/rdm-two-trees-stage6-backend-combination-probe-r1.md)：最新Backend main v31账号审计与W6/W9迁移重号在独立本地工作树按v31–v40重排，两个公开槽与surface合并；固定探针HEAD `d9b00c2` 的隔离PG全包/race/build SELF通过，独立限域复审未见新增高影响问题。仍非正式组件合入/CI/产品验收。
|
||||
- [W4a读取隔离P2独立限域复审](../records/2026-10-14-rdm-two-trees-latest-templates/rdm-two-trees-stage6-w4a-p2-independent-review-r1.md)：固定RDM `57a8d7caedf72d9be4bdca179ae2a93e456ba009` 的独立源码副本先验证源码/精确pins，再重放最小race集合；未发现新的高影响P2问题。报告、脚本与原始收据逐字节保存在records；工具标签仍为SELF，独立身份和被测archive在报告/输出中核验，不能用外层Dev HEAD代替被测RDM SHA。原时间RED另行修复，性能成本留增量A人审；当前结论不等于W4a、W3/W4b或全目标完成。
|
||||
|
||||
## 阶段6启动记录
|
||||
|
||||
|
||||
@@ -21,6 +21,7 @@
|
||||
- [W9全部审计写入口截止水位修订r1](rdm-two-trees-stage6-w9-all-writers-cutoff-adjustment-r1.md)：显式在线ID绕过后的DB门禁与排他复制修订已获用户批准，原对象保留评审前状态；强coverage仍待修复和验证。
|
||||
- [W9隔离PG显式低ID跨页RED原始SELF收据](evidence/backend-w9-explicit-low-red-20261014-01.json)：从Backend独立工作树源码外收据逐字节复制，副本与原件SHA256均为`21999df9ca7304288df42a5a0ac62687870636291bc61a8b1340fd92729bfd96`；退出码1是预期的失败用例，不是代码已修复或验收通过。
|
||||
- [Backend X1/X2与最新main组合探针r1](rdm-two-trees-stage6-backend-combination-probe-r1.md)：仅本地合并/测试证据，未推送或合入组件。
|
||||
- [W4a读取隔离P2独立限域复审](rdm-two-trees-stage6-w4a-p2-independent-review-r1.md)、[完整原始收据](evidence/rdm-p2-review-57a8d7ca-replay-20261014-01.json)及[重放脚本](evidence/rdm-p2-review-57a8d7ca-replay.sh)：逐字节保留审阅者原件。RDM固定对象57a8d7ca与外层Dev收据对象不同，输出已核验archive及pins；旧时间RED与性能人审未由本结论代替。
|
||||
- [阶段4源码与在途依赖快照](stage4-sources.json)
|
||||
- [模板与会议来源台账](rdm-two-trees-source-inventory.json)
|
||||
- [旧DOC源码补充](rdm-two-trees-legacy-source-addendum.md)
|
||||
|
||||
+34
File diff suppressed because one or more lines are too long
+22
@@ -0,0 +1,22 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
repo=/home/weichen/projects/Agent-System-RDM-wt-feature-rdm-two-trees-project-dictionary
|
||||
snapshot=/tmp/rdm-p2-review-8shrap
|
||||
source_sha=57a8d7caedf72d9be4bdca179ae2a93e456ba009
|
||||
verify_dir=$(mktemp -d /tmp/rdm-p2-receipt-verify-XXXXXX)
|
||||
git -C "$repo" archive "$source_sha" | tar -x -C "$verify_dir"
|
||||
diff -qr -x pins "$verify_dir" "$snapshot"
|
||||
printf 'SOURCE_SHA=%s SOURCE_TREE=IDENTICAL_TO_GIT_ARCHIVE\n' "$source_sha"
|
||||
for pin in agent-system-backend agent-system-core agent-system-frontend agent-system-ui; do
|
||||
expected=$(git -C "$repo" ls-tree "$source_sha:pins" "$pin" | awk '{print $3}')
|
||||
actual=$(git -C "$repo/pins/$pin" rev-parse HEAD)
|
||||
test "$actual" = "$expected"
|
||||
test -z "$(git -C "$repo/pins/$pin" status --porcelain=v1)"
|
||||
printf 'PIN_%s=%s MATCHES_GITLINK CLEAN\n' "$pin" "$actual"
|
||||
done
|
||||
diff -qr -x .git "$repo/pins" "$snapshot/pins"
|
||||
printf 'PIN_SOURCE=IDENTICAL_TO_VERIFIED_PIN_CHECKOUTS\n'
|
||||
printf 'SNAPSHOT_PATH=%s\n' "$snapshot"
|
||||
cd "$snapshot"
|
||||
GOWORK=off go test -race -v ./internal/domain ./internal/rdmapp -run 'TestFrozenWorldCopySeparatesNestedStateAndSharesOnlySealedLog|TestEventLogDoesNotAliasEventInputsOrOutputs|TestEventLogCloseSealsSettersRestoresAndTransactionClosures|TestPublishedReadPointersCannotPolluteOtherReaders|TestRuntimePrivateSeedSurvivesPublicDictionaryMutationBeforeFirstProjectRead|TestRuntimePublicDictionaryCannotPoisonProjectOrHistoricalReaders|TestRetainedTransactionWorldCannotPoisonCommittedCanonical|TestWorldForSharesOnlySealedLogWithinRevision|TestSameRevisionCanonicalCannotBeReplacedByAnotherProjection|TestLaterInstanceCommitRejectsOlderPendingCanonical|TestReaderWaitsForLocalCommitPublication|TestProjectTransactionPublishesOnlyAfterCommit|TestProjectTransactionSQLiteTwoInstanceCAS|TestLegacyAttributionRefreshesOtherRuntimeSQLite|TestCancelInFlightUpdatesCardSameSource' -count=1 -timeout 90s
|
||||
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
# RDM W2/W4a P2 read isolation: independent local review
|
||||
|
||||
Reviewed object: `57a8d7caedf72d9be4bdca179ae2a93e456ba009` against `7980551b78509c19074f7d683178dacbe6d956d7`. The supplied short name `57a8d7ce` does not resolve in this repository; the reviewed commit is `57a8d7c`. Reviewer: independent /root/w2_review agent. Scope: P2 read isolation only; no source edits, push, service operation, or full test rerun.
|
||||
|
||||
## Review result
|
||||
|
||||
No new high impact P2 defect was confirmed in the fixed source. The private canonical is returned only through `FrozenReadCopy`; a committed transaction publishes `FrozenCanonicalCopy` after commit. The clone separates the note tree, document tree, dictionary indexes, network, register, review state, requirements, conclusions, and nested maps/slices. The same generation shares only a sealed event log. `Append`, `Seed`, setters, and delayed restore closures cannot change that log; `Snapshot` copies mutable event `Payload` and `From`.
|
||||
|
||||
The production `Get()` constructor creates independent public and private dictionaries before returning. A test-created literal `Runtime` with no `privateDict` still copies public `Dict` on its first `dictionarySeed()` call, so mutation before that first call can contaminate its seed. No production literal constructor was found. This is a test-constructor boundary, not a confirmed production P2 defect.
|
||||
|
||||
The older deterministic three-case event-time RED remains an independent data-contract issue. It is not counted as a P2 regression. Full Go testing without excluding it is still failing. The new state-copy path preserves values within a generation and does not reconstruct missing legacy timestamps.
|
||||
|
||||
## Independent replay and provenance
|
||||
|
||||
The source was extracted with `git archive` into `/tmp/rdm-p2-review-8shrap`. The receipt command re-created the archive and compared every non-pin source file, checked all four pin Git heads against the reviewed commit's gitlinks and their clean state, then compared the copied pin files. It ran the focused domain/application `-race` suite. The command exited 0. The full, sanitized output is in:
|
||||
|
||||
- `/tmp/rdm-p2-review-57a8d7ca-replay-20261014-01.json` — `make evidence` RECEIPT capture, SHA-256 `3b8c0bc10d97b6564dc766b5df92738f6ede1ec2bd0456ed0a75a5ed3b2c15b9`
|
||||
- `/tmp/rdm-p2-review-57a8d7ca-replay.sh` — exact replay and identity-check script, SHA-256 `66658b68d8d4bad7282730c60df178a01355474718cff23fd4478682af27e6a7`
|
||||
|
||||
The receipt's Git `before.head` is the Dev checkout `d23fb4363dcc0a206e71e47f9cd23a644c7e1c70`, because that repository supplies the RECEIPT-capable evidence tool. It is **not** the tested RDM object. The tested archive SHA and pin identities are checked and printed inside the captured command output. The tool labels this local receipt `SELF`; the independent reviewer identity and command are stated here, without upgrading the receipt's source label.
|
||||
|
||||
The focused replay covered pointer pollution, nested clone aliases, event input/output aliases, sealed setters and restore closures, public/private seed, history/template reads, retained transaction pointers, same-revision first-wins, later-instance commits, commit-to-publication readers, SQLite two-instance CAS, attribution refresh, and the slowHost test-fixture race. All selected cases passed. The separate time test was run in the same fixed snapshot and failed in its three expected legacy-time cases; it was not included in the P2 receipt.
|
||||
|
||||
The author's task card has fixed-code SELF rows for all-package tests excluding the time RED, domain/application race tests, isolated PostgreSQL read/CAS/attribution tests, build, and Web/governance checks. This review did not independently replay PostgreSQL, full packages, build, CI, or PR gates.
|
||||
|
||||
## Performance and acceptance limit
|
||||
|
||||
Each warm `WorldFor` copies materialized state; per-read allocation and latency therefore grow with live object count. Event history is copied once per committed canonical generation, and `Snapshot` copies it on demand. The repository includes a profiling harness, but no human-approved cost threshold or production workload acceptance is established by this review. Performance remains a separate stage-6 review decision.
|
||||
|
||||
W3 and W4b remain outside this P2 conclusion.
|
||||
|
||||
Reference in New Issue
Block a user