GovOPlaN/govoplan
2
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases 3 Wiki Activity

[Task] Adopt Core recovery ledger for module-owned external and multi-resource effects #36

New Issue
Closed
opened 2026-08-01 01:49:31 +02:00 by zemion · 5 comments
zemion commented 2026-08-01 01:49:31 +02:00
Owner
Copy Link
Copy Source

Objective

Apply the new Core recovery operation/checkpoint contract to consequential module operations instead of treating the shared primitive as automatic coverage. Parent: #13.

Acceptance criteria

  • Inventory operations spanning a database transaction, object storage, queue, filesystem, or external provider and classify each as atomic, compensation, snapshot restore, forward recovery, or irreversible.
  • Create owning-module child issues and prioritize Campaign delivery/build/retention, Files upload/deletion/integrity actions, Mail outbox/IMAP effects, connector sync, Dataflow/Workflow execution, and module lifecycle.
  • Record idempotency keys and canonical request hashes before side effects.
  • Record durable precondition/recovery evidence before entering running state and bind a fencing token where work may race across nodes.
  • Prevent partial or outcome-unknown effects from being reported as ordinary failure or blindly retried.
  • Require verified checks for success/recovery and expose unresolved operations through Ops.
  • Add module-permutation, crash-boundary, stale-fence, tampered-evidence, and retry tests plus user/admin documentation.

Current baseline

Core provides the schema, state machine, hash-chained checkpoints, secret rejection, idempotency conflict handling, and optional lease-fence binding. Campaign's shared artifact path has direct compensation and verification tests but is not yet recorded through the generic ledger.

## Objective Apply the new Core recovery operation/checkpoint contract to consequential module operations instead of treating the shared primitive as automatic coverage. Parent: #13. ## Acceptance criteria - [ ] Inventory operations spanning a database transaction, object storage, queue, filesystem, or external provider and classify each as atomic, compensation, snapshot restore, forward recovery, or irreversible. - [ ] Create owning-module child issues and prioritize Campaign delivery/build/retention, Files upload/deletion/integrity actions, Mail outbox/IMAP effects, connector sync, Dataflow/Workflow execution, and module lifecycle. - [ ] Record idempotency keys and canonical request hashes before side effects. - [ ] Record durable precondition/recovery evidence before entering running state and bind a fencing token where work may race across nodes. - [ ] Prevent partial or outcome-unknown effects from being reported as ordinary failure or blindly retried. - [ ] Require verified checks for success/recovery and expose unresolved operations through Ops. - [ ] Add module-permutation, crash-boundary, stale-fence, tampered-evidence, and retry tests plus user/admin documentation. ## Current baseline Core provides the schema, state machine, hash-chained checkpoints, secret rejection, idempotency conflict handling, and optional lease-fence binding. Campaign's shared artifact path has direct compensation and verification tests but is not yet recorded through the generic ledger.
zemion commented 2026-08-01 12:39:02 +02:00
Author
Owner
Copy Link
Copy Source

Codex State: progress

Summary

  • The institutional vertical now persists Cases and Committee aggregates transactionally and verifies their migrations and reconstruction path; no synthetic recovery success is claimed.

Verification

  • tools/checks/check-focused.sh: all focused backend suites and the SQL-backed institutional journey passed.

Next / Blocked

  • Keep this issue open for module-owned external or multi-resource effects that must adopt the Core recovery ledger and prove compensation/reconciliation behavior.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - The institutional vertical now persists Cases and Committee aggregates transactionally and verifies their migrations and reconstruction path; no synthetic recovery success is claimed. ### Verification - `tools/checks/check-focused.sh: all focused backend suites and the SQL-backed institutional journey passed.` ### Next / Blocked - Keep this issue open for module-owned external or multi-resource effects that must adopt the Core recovery ledger and prove compensation/reconciliation behavior. Suggested status label: `status/in-progress`
zemion commented 2026-08-03 03:10:06 +02:00
Author
Owner
Copy Link
Copy Source

Codex State: progress

The first adoption slice is pushed.

  • Added a machine-checked cross-module operation inventory and recovery-mode classification in govoplan@9370f50.
  • Opened owning-module work items for Campaign, Files, Mail, Connectors, Dataflow, Workflow Engine, and Core lifecycle effects.
  • Added Core's committed, lease-fenced durable operation boundary with idempotent successful replay, explicit stale-fence takeover, hash-chain verification, compensation, and unresolved-state handling in govoplan-core@bca6a7c.
  • Adopted it for Campaign build publication in govoplan-campaign@dd09b06: request/precondition evidence commits before object writes, object and database manifests are verified, compensation proves absence, and failed cleanup remains recovery-required.

Verification: Core 525 passed, 3 skipped, 251 subtests; Campaign 337 passed, 16 subtests; inventory/meta tests passed. The parent remains open for Campaign delivery/retention and the other planned inventory rows.

## Codex State: progress The first adoption slice is pushed. - Added a machine-checked cross-module operation inventory and recovery-mode classification in `govoplan@9370f50`. - Opened owning-module work items for Campaign, Files, Mail, Connectors, Dataflow, Workflow Engine, and Core lifecycle effects. - Added Core's committed, lease-fenced durable operation boundary with idempotent successful replay, explicit stale-fence takeover, hash-chain verification, compensation, and unresolved-state handling in `govoplan-core@bca6a7c`. - Adopted it for Campaign build publication in `govoplan-campaign@dd09b06`: request/precondition evidence commits before object writes, object and database manifests are verified, compensation proves absence, and failed cleanup remains recovery-required. Verification: Core `525 passed, 3 skipped, 251 subtests`; Campaign `337 passed, 16 subtests`; inventory/meta tests passed. The parent remains open for Campaign delivery/retention and the other planned inventory rows.
zemion added
status
in-progress
 and removed
status
ready
 labels 2026-08-03 03:10:12 +02:00
zemion commented 2026-08-03 04:23:15 +02:00
Author
Owner
Copy Link
Copy Source

Codex State: progress

The Files object-effect slice is pushed.

  • govoplan-files@6baf2a4: lease-fenced upload/finalization and repair intent before object writes; independent database/object verification; rollback compensation; tamper quarantine; forward-recovered orphan cleanup; optional Encryption fail-closed behavior; operator documentation.
  • govoplan@5bef966: files.upload.finalize and files.integrity.reconcile are now machine-recorded as adopted.
  • Verification: Files 104 tests; Ruff clean; module-matrix run 308 completed successfully.

Files hard purge and remote write-sync remain planned because neither effect is implemented. Work now moves to Mail SMTP/IMAP effects.

## Codex State: progress The Files object-effect slice is pushed. - `govoplan-files@6baf2a4`: lease-fenced upload/finalization and repair intent before object writes; independent database/object verification; rollback compensation; tamper quarantine; forward-recovered orphan cleanup; optional Encryption fail-closed behavior; operator documentation. - `govoplan@5bef966`: `files.upload.finalize` and `files.integrity.reconcile` are now machine-recorded as adopted. - Verification: Files `104 tests`; Ruff clean; module-matrix run 308 completed successfully. Files hard purge and remote write-sync remain planned because neither effect is implemented. Work now moves to Mail SMTP/IMAP effects.
zemion commented 2026-08-03 07:06:23 +02:00
Author
Owner
Copy Link
Copy Source

Codex State: progress

Summary

  • All currently implemented consequential Campaign, Files, Mail, Connectors, Dataflow, Workflow Engine, and Core lifecycle paths now use the Core recovery ledger and are machine-inventoried.
  • Core lifecycle adoption closed Core#281 in 729b84d; the inventory and operator guidance were updated in 5e449b0 and govoplan-ops cdcb477.

Verification

  • Recovery inventory tests: 2 passed; consolidated focused checks passed.

Next / Blocked

  • Four planned rows remain intentionally non-adopted because the production effects do not exist yet: Files hard retention purge, Files writable connector sync, Mail provider-side mailbox mutation, and a production connector external mutation. Their features must enter through the declared recovery contracts before shipping.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - All currently implemented consequential Campaign, Files, Mail, Connectors, Dataflow, Workflow Engine, and Core lifecycle paths now use the Core recovery ledger and are machine-inventoried. - Core lifecycle adoption closed Core#281 in 729b84d; the inventory and operator guidance were updated in 5e449b0 and govoplan-ops cdcb477. ### Verification - `Recovery inventory tests: 2 passed; consolidated focused checks passed.` ### Next / Blocked - Four planned rows remain intentionally non-adopted because the production effects do not exist yet: Files hard retention purge, Files writable connector sync, Mail provider-side mailbox mutation, and a production connector external mutation. Their features must enter through the declared recovery contracts before shipping. Suggested status label: `status/in-progress`
zemion commented 2026-08-03 08:49:30 +02:00
Author
Owner
Copy Link
Copy Source

Codex State: done

Summary

  • Every currently implemented consequential Campaign, Files, Mail, Connectors, Dataflow, Workflow Engine, and Core lifecycle effect now uses the Core recovery ledger and is machine-inventoried.
  • Idempotency, canonical request evidence, fencing, outcome-unknown handling, verified settlement, Ops visibility, crash/retry/tamper tests, and module-permutation evidence are in place.
  • Four inventory rows remain planned because their production effects do not exist: Files hard purge, Files writable connector sync, Mail provider-side mutation, and production connector external mutation. Their owning feature work is fail-gated by the declared recovery contracts.

Verification

  • Recovery inventory tests passed.
  • tools/checks/check-focused.sh passed, including 46 WebUI module permutations and full-product bundle budgets.
## Codex State: done ### Summary - Every currently implemented consequential Campaign, Files, Mail, Connectors, Dataflow, Workflow Engine, and Core lifecycle effect now uses the Core recovery ledger and is machine-inventoried. - Idempotency, canonical request evidence, fencing, outcome-unknown handling, verified settlement, Ops visibility, crash/retry/tamper tests, and module-permutation evidence are in place. - Four inventory rows remain planned because their production effects do not exist: Files hard purge, Files writable connector sync, Mail provider-side mutation, and production connector external mutation. Their owning feature work is fail-gated by the declared recovery contracts. ### Verification - `Recovery inventory tests passed.` - `tools/checks/check-focused.sh passed, including 46 WebUI module permutations and full-product bundle budgets.`
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
HTTP API contracts, routers, schemas, or API smoke behavior.
 area/auth
Authentication, sessions, access bootstrap, or login behavior.
 area/db
Database sessions, models, transactions, or persistence primitives.
 area/devex
Local developer workflow, scripts, tests, tooling, or release helpers.
 area/docs
Durable documentation and project guidance.
 area/governance
Governance policy, audit, privacy, retention, or compliance behavior.
 area/marketing
Public website, product messaging, publication copy, or legal page content.
 area/migrations
Alembic migrations, schema bootstrap, or persistence evolution.
 area/module-system
Module discovery, manifests, capabilities, routing, or optional integrations.
 area/rbac
Permissions, roles, delegation, or authorization policy.
 area/release
Versioning, release locks, tags, packaging, or dependency pins.
 area/security
Security posture, static analysis, supply-chain hardening, or vulnerability remediation.
 area/tenancy
Tenant boundaries, provisioning, or tenant-scoped data behavior.
 area/webui
Shared WebUI shell, frontend components, routing, or frontend tests.
 audit/complexity
Complexity finding from Radon, Xenon, or equivalent maintainability scans.
 audit/duplication
Duplicated-code finding from jscpd or equivalent similarity scans.
 audit/false-positive
Audit finding reviewed as a narrow false positive or acceptable risk.
 audit/needs-design
Audit finding that needs an architectural or product decision before implementation.
 audit/quick-fix
Audit finding that appears narrow and directly fixable.
 audit/structural
Audit finding that needs design, refactoring, or behavior review.
 codex/needs-human
Needs an explicit human decision before Codex should implement.
 codex/ready
Suitable for Codex to pick up with the existing issue context.
 module/access
GovOPlaN access, identity, authentication, RBAC, and administration behavior.
 module/addresses
GovOPlaN Addresses module behavior or integration.
 module/admin
GovOPlaN Admin module behavior or integration.
 module/appointments
GovOPlaN Appointments module behavior or integration.
 module/approvals
GovOPlaN Approvals module behavior or integration.
 module/audit
GovOPlaN Audit module behavior or integration.
 module/calendar
GovOPlaN Calendar module behavior or integration.
 module/campaign
GovOPlaN campaign module behavior or integration.
 module/cases
GovOPlaN Cases module behavior or integration.
 module/committee
GovOPlaN Committee module behavior or integration.
 module/connectors
GovOPlaN Connectors module behavior or integration.
 module/core
GovOPlaN core runner, shared primitives, shell, or extension points.
 module/dashboard
GovOPlaN Dashboard module behavior or integration.
 module/dataflow
GovOPlaN Dataflow module behavior or integration.
 module/datasources
GovOPlaN governed datasource contracts, catalogs, and integrations.
 module/decisions
GovOPlaN formal Decisions module behavior or integration.
 module/dist-lists
GovOPlaN Distribution Lists module behavior or integration.
 module/dms
GovOPlaN Dms module behavior or integration.
 module/docs
GovOPlaN Docs module behavior or integration.
 module/encryption
GovOPlaN Encryption key custody, cryptographic policy, and E2EE integration.
 module/erp
GovOPlaN Erp module behavior or integration.
 module/evaluation
GovOPlaN Evaluation module behavior or integration.
 module/files
GovOPlaN files module behavior or integration.
 module/fit-connect
GovOPlaN Fit Connect module behavior or integration.
 module/forms
GovOPlaN Forms module behavior or integration.
 module/forms-runtime
GovOPlaN Forms Runtime module behavior or integration.
 module/helpdesk
GovOPlaN Helpdesk module behavior or integration.
 module/identity
GovOPlaN Identity module behavior or integration.
 module/identity-trust
GovOPlaN Identity Trust module behavior or integration.
 module/idm
GovOPlaN Idm module behavior or integration.
 module/ledger
GovOPlaN Ledger module behavior or integration.
 module/mail
GovOPlaN mail module behavior or integration.
 module/mandates
GovOPlaN Mandates, jurisdiction, responsibility, and authority behavior or integration.
 module/notifications
GovOPlaN Notifications module behavior or integration.
 module/ops
GovOPlaN Ops module behavior or integration.
 module/organizations
GovOPlaN Organizations module behavior or integration.
 module/parties
GovOPlaN procedure Parties, representation, and delivery-authority behavior or integration.
 module/payments
GovOPlaN Payments module behavior or integration.
 module/permits
GovOPlaN Permits module behavior or integration.
 module/policy
GovOPlaN Policy module behavior or integration.
 module/poll
GovOPlaN Poll module behavior or integration.
 module/portal
GovOPlaN Portal module behavior or integration.
 module/postbox
GovOPlaN Postbox module behavior or integration.
 module/projects
GovOPlaN Projects module behavior or integration.
 module/quick-access
GovOPlaN configurable task-local Quick Access behavior and integrations.
 module/records
GovOPlaN Records and eAkte lifecycle behavior or integration.
 module/reporting
GovOPlaN Reporting module behavior or integration.
 module/risk-compliance
GovOPlaN Risk Compliance module behavior or integration.
 module/scheduling
GovOPlaN Scheduling module behavior or integration.
 module/search
GovOPlaN Search module behavior or integration.
 module/services
GovOPlaN versioned institutional Services behavior or integration.
 module/tasks
GovOPlaN Tasks module behavior or integration.
 module/templates
GovOPlaN Templates module behavior or integration.
 module/tenancy
GovOPlaN Tenancy module behavior or integration.
 module/tickets
GovOPlaN Tickets module behavior or integration.
 module/views
GovOPlaN governed task views, interface projections, and workflow view integration.
 module/voting
GovOPlaN Voting module behavior or integration.
 module/wiki
GovOPlaN Wiki module behavior or integration.
 module/workflow
GovOPlaN Workflow module behavior or integration.
 module/workflow-engine
GovOPlaN Workflow Engine runtime, persistence, or integration.
 module/xoev
GovOPlaN Xoev module behavior or integration.
 module/xrechnung
GovOPlaN Xrechnung module behavior or integration.
 module/xta-osci
GovOPlaN Xta Osci module behavior or integration.
priority
p0
Immediate stop-the-line priority.
priority
p1
High priority for the next focused work window.
priority
p2
Normal planned priority.
priority
p3
Low priority or opportunistic cleanup.
source/backlog-import
Imported from markdown backlog, roadmap, plan, or TODO files.
 source/security-audit
Created from a structured security or code-quality audit report.
 source/todo-scan
Imported from inline TODO/FIXME/HACK markers by the Gitea TODO importer.
status
blocked
Cannot progress without a decision, dependency, credential, or external change.
status
in-progress
Currently being worked.
status
needs-info
Needs clarifying input before implementation can proceed safely.
status
ready
Ready for implementation.
status
triage
Needs review, ownership, priority, or acceptance criteria.
type
bug
A reproducible defect, regression, or incorrect behavior.
type
debt
Cleanup, refactoring, risk reduction, or deferred engineering work.
type
docs
Documentation, process, or developer workflow work.
type
feature
New user-visible behavior or platform capability.
type
task
Implementation, maintenance, migration, or operational work.
type
user-story
End-to-end user journey or real-world process story used to steer product slices.
No labels area/db area/release area/security codex/ready module/core module/ops
priority
p1
status
in-progress
type
task
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
govoplan-package-publisher zemion (Albrecht Degering)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#36