AEON: make six-Aspect trusted publisher contract uniform - #3631
AEON: make six-Aspect trusted publisher contract uniform#3631StephGlansberg wants to merge 2 commits into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 198067b874
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if !forward_buzz_publisher_credentials { | ||
| cmd.env_remove("BUZZ_RELAY_URL"); | ||
| cmd.env_remove("BUZZ_PRIVATE_KEY"); | ||
| } |
There was a problem hiding this comment.
When the harness is configured through the documented BUZZ_PRIVATE_KEY_FILE environment variable while --no-agent-publisher-credentials is enabled, this only removes BUZZ_PRIVATE_KEY, so the child inherits the key-file path and, because it runs as the same user, can read the required 0600 file and recover the signing key. The legacy BUZZ_ACP_PRIVATE_KEY alias and persona-provided key-file variables are likewise not treated as harness-bound, defeating the publisher-isolation contract; strip every supported private-key source and alias from both inherited and injected child environments.
Useful? React with 👍 / 👎.
| rootIds: readonly string[], | ||
| ): Promise<RelayEvent[]> { | ||
| const replies: RelayEvent[] = []; | ||
| const cappedRoots = rootIds.slice(0, MAX_FLATTEN_ROOTS); |
There was a problem hiding this comment.
When a private/DM channel window contains more than 40 roots with thread summaries, this slice silently omits every later root, so their non-broadcast replies never appear in the flattened timeline. This is permanent for older pages as well: the next pagination pass builds knownRootIds from all retained summaries, including the roots skipped here, and therefore never retries them; process all roots in bounded batches rather than discarding the remainder.
Useful? React with 👍 / 👎.
| for (const rootId of cappedRoots) { | ||
| let cursor: ThreadCursor | null = null; | ||
| for (let page = 0; page < MAX_THREAD_PAGES; page += 1) { | ||
| const response = await getThreadReplies(rootId, channelId, { |
There was a problem hiding this comment.
Opening or refetching a private room/DM awaits this helper before useChannelMessagesQuery returns even the already-fetched root messages, while this loop performs every root and page request sequentially. A window with 40 one-page threads therefore needs 40 consecutive relay round trips before rendering, and the configured bounds permit up to 2,000 sequential requests, making a slow relay leave the entire channel loading for an excessive period; hydrate roots concurrently with a bound or publish the reconciled timeline before background reply hydration.
Useful? React with 👍 / 👎.
Signed-off-by: StephGlansberg <StephGlansberg@users.noreply.github.com>
baf5a82 to
d102c84
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d102c84986
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if batch.events.len() != 1 { | ||
| return Err("ambiguous_event_count"); |
There was a problem hiding this comment.
When two or more events accumulate for a channel while its agent is busy, EventQueue::flush_next drains them into one batch (up to 50 events), so this check rejects the entire batch as ambiguous_event_count. The refusal path then sends PromptOutcome::Error with no recoverable batch, permanently discarding every queued user message; this is especially likely for the new Aspect configuration because it explicitly uses queue handling and allows two-hour turns. Dispatch trusted events individually or otherwise preserve and requeue the unprocessed events.
Useful? React with 👍 / 👎.
| .filter( | ||
| (message) => | ||
| message.parentId == null || isBroadcastReply(message.tags ?? []), | ||
| flattenReplies || | ||
| message.parentId == null || | ||
| isBroadcastReply(message.tags ?? []), |
There was a problem hiding this comment.
After a private/DM user has paged older history, a head refetch replaces the window with only its newest page, but reconcileChannelWindowMessages deliberately retains every cached non-broadcast reply, including replies hydrated for roots in the discarded tail pages. This new unconditional flattening then renders those retained replies as depth-zero posts even though their roots are no longer in the window, leaving stale orphaned messages in the main timeline after reconnect or refetch. Restrict flattened cache-only replies to roots retained by the current window, or clear the hydrated tail replies when the authoritative page chain is replaced.
Useful? React with 👍 / 👎.
Signed-off-by: StephGlansberg <StephGlansberg@users.noreply.github.com>
1 participant
Outcome\n\n- renders one shared six-Aspect private-office publication contract with exact room/tool substitutions\n- makes credential isolation, trusted inbound envelope, turn receipts, and exact base prompt fail closed as one configuration\n- adds operator semantic-health gating so running + agent_pool_ready is not sufficient\n- keeps fixed Gateway sessions, full OpenClaw tool/memory/identity ownership, and bypassPermissions posture unchanged\n\n## Proof\n\n- node --test deploy/local/aeon-aspects/worker.test.mjs (22/22)\n- cargo test -p buzz-acp (671/671 + lifecycle 9/9)\n- cargo clippy -p buzz-acp --all-targets -- -D warnings\n- cargo fmt --all -- --check\n- git diff --check\n\nRepository-wide pre-push also passed Desktop tests (3779/3779) and relevant Rust gates. Existing upstream failures remain in the Desktop file-size ratchet (desktop/src-tauri/src/archive/mod_tests.rs) and one Mobile test; neither path is changed here.\n\nNo Gateway or worker runtime mutation is part of this PR.