feat(domain): prove the tutor D1 event-store seam - #18
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 344f3d85f3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const SOURCE_CANDIDATE_PARENT = "266185e98d22718576653df9973ece8246da124a"; | ||
| const SOURCE_CANDIDATE_COMMIT = "7ddca9eb18c307f7c6baf47134793eda5c299db6"; | ||
| const CANONICAL_INTEGRATION_BASE = "0f09064d4d85039f51127bd25b6501b71696980e"; |
There was a problem hiding this comment.
The proof runner emits 266185e... as the source-candidate parent and 0f09064... as the canonical integration base, while the newly committed spec identifies those parents as d04f237... and e214c87... respectively. Consequently every otherwise repeatable evidence document contains lineage that contradicts its own authority, so its digest cannot serve as the claimed provenance receipt; derive these values from the reviewed lineage or make the runner and spec agree.
Useful? React with 👍 / 👎.
| const result = yield* decodeCanonicalJson(row.result_bytes, "result_bytes"); | ||
| const descriptor = yield* decodeStoredDescriptor(row.descriptor_bytes); |
There was a problem hiding this comment.
When an imported, manually inserted, or corrupted receipt contains canonical JSON such as {} in result_bytes, readReceipt accepts it because only JSON canonicality is checked, and an exact command retry then returns that row as a successful DuplicateResult. The migration permits arbitrary BLOB contents on insertion, and the descriptor is likewise not checked against the command/result, so this bypasses the adapter's fail-closed integrity boundary and can return a response that was never an accepted observation; decode the closed observation shape and verify its command/descriptor identities before exposing the receipt.
Useful? React with 👍 / 👎.
1 participant
Design spec
design-specs/0017-tutor-d1-event-store-proof.mdJourney
A maintainer runs the tutor command lifecycle against the bounded D1-compatible event-store proof, observes append/receipt behavior, and verifies rejected or failed writes leave stream heads unchanged.
Experience it
bun --cwd packages/domain proof:d1as recorded in the spec.Evidence
What is real
The local D1-compatible SQL proof and failure atomicity are executable. This does not claim a deployed D1 binding, Worker route, scheduling, provider behavior, migration of production data, or production acceptance.