[Debt] Adopt the Core recovery ledger for Campaign build, delivery, and retention effects #92

New Issue

2026-08-03T02:11:44+02:00

zemion commented

2026-08-03 02:11:44 +02:00

Objective

Bind Campaign operations that span PostgreSQL, shared object storage, queues, SMTP/IMAP, Postbox, or print providers to Core recovery operations and hash-chained checkpoints.

Acceptance criteria

Campaign build records a canonical request hash, durable preconditions, a fencing token, object-write checkpoints, verified success, and explicit compensation/reconciliation state.
Delivery records the idempotency key before provider acceptance; accepted, rejected, and outcome-unknown effects map to distinct ledger states and are never blindly retried.
Retention records deletion intent and preserves database references until object deletion is verified.
Existing orphan reconciliation in #91 consumes build operation evidence.
Crash-boundary, retry, stale-fence, tamper, and module-permutation tests prove the behavior.
User/operator documentation explains unresolved outcomes and recovery actions.

Parent: GovOPlaN/govoplan#36. ## Objective Bind Campaign operations that span PostgreSQL, shared object storage, queues, SMTP/IMAP, Postbox, or print providers to Core recovery operations and hash-chained checkpoints. ## Acceptance criteria - [ ] Campaign build records a canonical request hash, durable preconditions, a fencing token, object-write checkpoints, verified success, and explicit compensation/reconciliation state. - [ ] Delivery records the idempotency key before provider acceptance; accepted, rejected, and outcome-unknown effects map to distinct ledger states and are never blindly retried. - [ ] Retention records deletion intent and preserves database references until object deletion is verified. - [ ] Existing orphan reconciliation in #91 consumes build operation evidence. - [ ] Crash-boundary, retry, stale-fence, tamper, and module-permutation tests prove the behavior. - [ ] User/operator documentation explains unresolved outcomes and recovery actions.

zemion added the

type

debt

module/campaign area/db area/security

labels 2026-08-03 02:11:44 +02:00

zemion commented

2026-08-03 03:10:09 +02:00

Codex State: progress

Campaign build publication now serves as the reference recovery-ledger adoption (dd09b06). It uses a canonical request hash/idempotency key, a distributed version fence, a reserved opaque storage prefix, exact SHA-256/size verification, committed database/object manifests, verified compensation, and explicit recovery-required state for uncertain cleanup. User/admin recovery documentation and crash/tamper/retry tests are included.

The issue remains open for the two remaining slices: external-channel delivery and generated-artifact retention/reconciliation.

## Codex State: progress Campaign build publication now serves as the reference recovery-ledger adoption (`dd09b06`). It uses a canonical request hash/idempotency key, a distributed version fence, a reserved opaque storage prefix, exact SHA-256/size verification, committed database/object manifests, verified compensation, and explicit recovery-required state for uncertain cleanup. User/admin recovery documentation and crash/tamper/retry tests are included. The issue remains open for the two remaining slices: external-channel delivery and generated-artifact retention/reconciliation.

zemion commented

2026-08-03 03:55:34 +02:00

Implemented and pushed the complete Campaign adoption slice. Build remains the reference operation; normal/background delivery, synchronous batches, explicit test/resend actions, IMAP Sent append, and generated-artifact retention now start fenced Core recovery operations before effects and independently verify business/provider/object evidence afterward. Added terminal rejected for definitive no-effect/provider rejection; unknown and partial effects remain visible to Ops. Campaign full suite: 358 passed plus 16 subtests. Core full suite: 527 passed, 3 skipped plus 251 subtests. Commits: Core 01f9115, Campaign 9da0309 and 50ce8b0, Ops 63f393a, inventory 5e80b39. This child can close when the cross-repository module matrix is green; the remaining parent rows are tracked in their module-specific issues.

Implemented and pushed the complete Campaign adoption slice. Build remains the reference operation; normal/background delivery, synchronous batches, explicit test/resend actions, IMAP Sent append, and generated-artifact retention now start fenced Core recovery operations before effects and independently verify business/provider/object evidence afterward. Added terminal `rejected` for definitive no-effect/provider rejection; unknown and partial effects remain visible to Ops. Campaign full suite: 358 passed plus 16 subtests. Core full suite: 527 passed, 3 skipped plus 251 subtests. Commits: Core `01f9115`, Campaign `9da0309` and `50ce8b0`, Ops `63f393a`, inventory `5e80b39`. This child can close when the cross-repository module matrix is green; the remaining parent rows are tracked in their module-specific issues.

zemion commented

2026-08-03 08:49:11 +02:00

Codex State: done

Summary

Campaign build, delivery, IMAP append, Postbox delivery, retention, and reconciliation effects are fully adopted through the Core recovery ledger.
The remaining closure gate has passed: the consolidated focused check completed all backend suites, 46 module permutations, and full-product bundle budgets.

Verification

Campaign full suite previously recorded: 358 passed plus 16 subtests.
Core full suite previously recorded: 527 passed, 3 skipped plus 251 subtests.
tools/checks/check-focused.sh passed on 2026-08-03.

## Codex State: done ### Summary - Campaign build, delivery, IMAP append, Postbox delivery, retention, and reconciliation effects are fully adopted through the Core recovery ledger. - The remaining closure gate has passed: the consolidated focused check completed all backend suites, 46 module permutations, and full-product bundle budgets. ### Verification - `Campaign full suite previously recorded: 358 passed plus 16 subtests.` - `Core full suite previously recorded: 527 passed, 3 skipped plus 251 subtests.` - `tools/checks/check-focused.sh passed on 2026-08-03.`

zemion closed this issue

2026-08-03 08:49:11 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#92