Repository navigation
Prove auxiliary response-handoff storage and lifetime accounting #48
Description
Acceptance Criteria
- Close sync final backing, header-map storage and construction/terminal overlap, preserving separate auxiliary, probe-config, probe-output/cache and static populations.
- Change charges only after independent ownership/lifetime proofs justify them; retain the single additive budget and actual boot/CLI parity controls.
Blocking And Review Gates
- Blocked by: #33.
Use native blocked-by/blocking links for unconditional issue relationships. Conditional target gates are not universal blockers; link only the selected applicable path after its contract is frozen.
Shared Acceptance Requirements
Every implementation issue ships its own unit/conformance, failure, resource and privacy tests. A later integration issue does not postpone those checks. New untrusted decoders include generated hostile-input controls; changed hot paths include repeatable measurements. Use the existing engine, host services, validated config/push path and EdgeZero handler registration. Preserve privacy, authorization, cookie integrity, HTTPS/SSRF protections, deadlines, exact sent coverage, authoritative bidder/alias attribution and bounded work/storage. Standalone and embedded behavior share policy rather than fork implementations.
No issue may claim a missing capability from metadata import, compilation, observed allocations, a signed cookie, or a different artifact's old evidence. New public/configuration behavior requires its reviewed design before execution. No workload reduction, raised ceiling or replacement budget equation is implied. Bodies and evidence must not publish credentials, identifiers, raw consent, private provider addresses or customer configuration.
Technical Ownership
Sources: M7-R0 design/plan, ISSUES.md resource rows and schema qualification record.
Source Contracts
- Approved roadmap
- Product vision
- Issue ledger and qualification limitations
- Schema qualification record
Resource Proof Responsibilities
Responsible technical roles: core response/storage maintainers and the applicable target qualification maintainers.
Next verification action: justify application-owned backing, map indices/entries/duplicate values, header names/values, complete cookie construction and terminal overlap across all applicable auxiliary success/error, info, health, fallback and probe paths. Independently verify source/ABI/container/allocator bounds and the applicable SDK/provider-copy contract, not only sync wire lengths or native observed peaks. Keep auxiliary, independent probe-config, probe-output/cache, static and auction populations distinct. Retain conservative charges and leave this issue open wherever a required bound is unavailable; assigning a missing proof to #50 or a target owner is not completion.
Source: approved shared resource ownership contract, delivered for review in #162. This records responsibility and the next verification action, not completed proof, target qualification, changed workload limits or permission to close this issue.
Activity
Plan shared resource ownership and bounded auxiliary responses (#161)
Bound auxiliary response storage and document resource owners
aram356 commentedon Nov 11, 2026
CREATOR: The #162 reconciliation against merged #160 leaves two specific health-lifetime controls outstanding: authorized JSON egress completion/abandonment must observe the original auxiliary output/work receipt, and cancellation during the post-configuration bounded Secret Store read must release that same receipt exactly once while independent probe/static capacity remains available. Current ingress terminal rows exercise health denial; separate health authorization tests do not observe those receipts. Core response/storage maintainers own these controls under this existing issue. The 4096-byte token limit bounds accepted backend/value bytes, not provider materialization peaks. Conservative accounting is unchanged, this issue stays open, and neither these controls nor the remaining physical/guest/provider-copy bounds are claimed complete.
aram356 commentedon Nov 11, 2026
CREATOR: The previously recorded application verification gaps are implemented in PR #162 at
d2d8cfa33ffbebbebb0d29f93fae004d7b461d24. This supersedes the missing health-controls portion of the earlier checkpoint comment, not its physical-proof limitations.Author ran the full workspace, separate secure-core graph, registry targets, real bootstrap/CLI parity, strict Clippy, formatting and repository gates on the committed source. All exited 0. Verbatim final-source lines for the two expanded targets, executed by the full workspace command recorded in the PR:
The workspace reports 6,596 passed/0 failed/19 existing ignores; secure core 1,227/0/1; registry 55/0/0; explicit resource parity 21/0/0. Four temporary guard mutations were caught and restored before that final suite. The committed-source audit passes, with clean matching source and
required_fit = falseon every adapter. Current-head hosted CI is running; these are author-side results, not independent approval or completed hosted acceptance.This issue stays open. Complete retained-response R, header-map/container/allocator, phase-overlap, applicable guest-layout and SDK/provider-copy proofs are still missing. The new Axum persistent-client/pool correspondence is recorded under existing #50/#72. Preserve conservative
(A + P) * (H * D + T)accounting; these tests do not justify a smaller charge, a guest/provider certificate or a fit claim. No workload, limit, ceiling, SDK pin or configuration path changed.