[bootjp]

Design: docs/design/2026_10_30_proposed_raft_catalog_bootstrap.md
Runbook: docs/raft_bootstrap_enablement.md

Summary

• Add explicit offline observation, all-member signed baseline assembly,
  backup-preserving preparation/resume, post-preparation attestation and
  activation certification for an existing quiesced cluster.
• Bind native WAL identity to the complete preparation manifest. Reject lost
  WAL, mismatched identities, divergent cuts and incomplete preparation rather
  than deleting data or bootstrapping a replacement voting identity.
• Wire --raftBootstrapPeerConfigDir through production construction, recovered
  policy, shared TLS listeners, local activation and Control/DataReady.
• Retain receiver-owned operation generations through proposal enqueue,
  children, maintenance and terminal results. Revoke on native term/config
  changes, interrupt blocked public transports and join before retirement.
• Apply protected metadata, data, configuration and applied progress atomically.
  Dedicated TSO compares the complete reconstructed control namespace before
  accepting retained durable state; incomplete snapshots cannot downgrade it.
• Use runtime-local pinned TLS for ordinary internal forwarding and separate
  authenticated typed startup controls before all groups are DataReady.
• Retain the original protected Redis wire MULTI operation through queued
  commands, EXEC or DISCARD. Bound queue memory both per connection and across
  protected queues server-wide, close overflowing transactions, bound idle ownership, join
  cancelled work and preserve ambiguous submitted outcomes.
• Add authenticated explicit-key encrypted legacy data-group migration, including
  complete logical history and retained WAL/snapshot verification without
  rewriting ciphertext, epochs or nonce state.
• Add receiver-owned external rotation with ADMIN bearer plus verified mTLS,
  pinned identity/epoch, bounded concurrency, original-generation transfer and
  strictly read-only reconciliation after an unknown outcome.
• Add receiver-owned startup rotation recipes, installed encryption projection
  verification and paired invalidation around key/wrapper publication. Separate
  current leader completion from explicit read-barrier-fenced follower permission.
• Authenticate typed writer registration before policy/rotation readiness. Decode
  final encrypted payloads outside the arbiter, bind declarations to plaintext,
  and seal the actual ciphertext at native enqueue.
• Discard generation-stale initial catalog observations and independently reload
  them before DataReady; retain fatal errors and refuse unguarded initialization.

Scope And Risks

The offline migration accepts plaintext native state and explicit-key encrypted
data-group baselines with an already populated replicated catalog. Encrypted
sources require all historical keys and matching durable checkpoints/writer
registrations. Preserve original ciphertext, source backups, encryption sidecars,
KEK access and full writer identities. This does not prove historical
serializability or repair divergent replicas. Encrypted scalar TSO migration
remains unsupported.

The protected encryption extension requires an already active storage envelope
and supports both the exact local startup recipe requested by
--encryptionRotateOnStartup and separately authenticated external RotateDEK.
External rotation is not unrestricted admin authority: it requires ADMIN bearer,
verified client mTLS, the local full node identity and pinned purpose epoch.
Startup credentials cannot authorize it. Cancelled or unknown commands are never
reproposed by the supervisor. Arbitrary enable/bootstrap operations remain
fail-closed. Cold seed, lost-state replacement, protected
membership changes and the complete v5 snapshot/journal protocol remain separate
gates. Legacy mode remains separate and unchanged.

Protected RAW requests no longer detach into cross-request microbatches; each
request retains its entire atomic command and original context. Throughput is
not claimed unchanged. Revoking a blocked stream may close its shared physical
connection and interrupt other multiplexed requests; that is not proof that their
writes were absent. EXEC disconnection is observed after the synchronous wire
handler returns; ownership is retained and the work is joined in the meantime.

No production deployment, throughput result or operational stability claim is
made by this PR. This is not completion of the full v5 design or the isolation
audit associated with #1355.

Verification

Composed-source test results and exact latest-push review/CI receipts are recorded
in the follow-up comment. Earlier checkpoint approvals do not approve later
pushes.

Author: bootjp

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 416 files, which is 316 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

Usage-priced reviews support at most 300 files.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 34d99cc6-a1f5-45fa-875c-4fcfa477ed65

Commits

Reviewing files that changed from the base of the PR and between e939af5 and f22e306.

Files ignored due to path filters: 3

• internal/peersession/wire/session.pb.go is excluded by !**/*.pb.go
• internal/peersession/wire/session_grpc.pb.go is excluded by !**/*.pb.go
• proto/internal.pb.go is excluded by !**/*.pb.go

Files selected for processing: 416

• adapter/distribution_server.go
• adapter/dynamodb.go
• adapter/internal.go
• adapter/internal_bootstrap_policy.go
• adapter/internal_prepare_evidence.go
• adapter/internal_read_watermark_test.go
• adapter/migration_ownership_refresh_test.go
• adapter/migration_quorum_partition_acceptance_test.go
• adapter/migration_quorum_unknown_rejection_test.go
• adapter/redis.go
• adapter/redis_blocking_execution_test.go
• adapter/redis_compat_helpers.go
• adapter/redis_delta_compactor.go
• adapter/redis_execution_budget.go
• adapter/redis_execution_budget_test.go
• adapter/redis_expire_cmds.go
• adapter/redis_hash_cmds.go
• adapter/redis_keys.go
• adapter/redis_lists.go
• adapter/redis_lua.go
• adapter/redis_lua_context.go
• adapter/redis_owned_lifecycle_test.go
• adapter/redis_protected_network_test.go
• adapter/redis_proxy.go
• adapter/redis_proxy_leader.go
• adapter/redis_pubsub.go
• adapter/redis_quit_admission_test.go
• adapter/redis_read_admission_test.go
• adapter/redis_reply_budget.go
• adapter/redis_reply_budget_test.go
• adapter/redis_reply_budget_wire_test.go
• adapter/redis_reply_buffer.go
• adapter/redis_reply_sink.go
• adapter/redis_request_admission.go
• adapter/redis_request_admission_test.go
• adapter/redis_request_propagation_test.go
• adapter/redis_server_cmds.go
• adapter/redis_set_cmds.go
• adapter/redis_stream_cmds.go
• adapter/redis_strings.go
• adapter/redis_txn.go
• adapter/redis_wire_budget.go
• adapter/redis_wire_budget_test.go
• adapter/redis_wire_transaction.go
• adapter/redis_wire_transaction_test.go
• adapter/redis_zset_cmds.go
• adapter/request_admission.go
• adapter/request_admission_http.go
• adapter/request_admission_http_test.go
• adapter/request_admission_http_transport_test.go
• adapter/runtime_network.go
• adapter/s3.go
• adapter/s3_blob_cluster.go
• adapter/split_migration_auth.go
• adapter/split_migration_auth_test.go
• adapter/split_migration_auth_tls_test.go
• adapter/split_migration_namespace_test.go
• adapter/split_migration_native_auth_integration_test.go
• adapter/split_migration_split_range_auth_test.go
• adapter/split_prepare_evidence_auth_integration_test.go
• adapter/sqs.go
• distribution/bootstrap_plan.go
• distribution/bootstrap_plan_test.go
• distribution/catalog.go
• docs/design/2026_10_30_proposed_raft_catalog_bootstrap.md
• docs/raft_bootstrap_enablement.md
• internal/backup/snapshot_reader.go
• internal/backup/snapshot_reader_live_test.go
• internal/encryption/applier.go
• internal/encryption/applier_test.go
• internal/encryption/cache_invalidation.go
• internal/encryption/cache_invalidation_test.go
• internal/encryption/nonce_observation.go
• internal/encryption/nonce_observation_test.go
• internal/encryption/rotation_material.go
• internal/encryption/rotation_material_test.go
• internal/filesystem/fuseadapter/colliding_mount_core_test.go
• internal/filesystem/fuseadapter/mount_e2e_test.go
• internal/filesystem/fuseadapter/server_ops_test.go
• internal/grpc.go
• internal/peersession/authorization.go
• internal/peersession/authorizer_test.go
• internal/peersession/call_credentials.go
• internal/peersession/client.go
• internal/peersession/codec.go
• internal/peersession/credentials.go
• internal/peersession/doc.go
• internal/peersession/format_test.go
• internal/peersession/handshake.go
• internal/peersession/lifecycle_test.go
• internal/peersession/limits_test.go
• internal/peersession/method_factory_test.go
• internal/peersession/mixed_methods.go
• internal/peersession/mixed_methods_test.go
• internal/peersession/native_test.go
• internal/peersession/negative_test.go
• internal/peersession/owner.go
• internal/peersession/receipt.go
• internal/peersession/recovery.go
• internal/peersession/recovery_test.go
• internal/peersession/server.go
• internal/peersession/snapshot_stream_test.go
• internal/peersession/transport_abort.go
• internal/peersession/transport_tls.go
• internal/peersession/types.go
• internal/peersession/wire/session.proto
• internal/raftadmission/arbiter.go
• internal/raftadmission/arbiter_test.go
• internal/raftadmission/operation.go
• internal/raftadmission/prepared.go
• internal/raftadmission/prepared_test.go
• internal/raftadmission/publication.go
• internal/raftadmission/publication_test.go
• internal/raftadmission/registration_binding_test.go
• internal/raftadmission/request_rotation.go
• internal/raftadmission/request_rotation_test.go
• internal/raftadmission/rotation.go
• internal/raftadmission/rotation_review_test.go
• internal/raftadmission/rotation_test.go
• internal/raftbootstrap/activation.go
• internal/raftbootstrap/activation_receipt.go
• internal/raftbootstrap/activation_receipt_test.go
• internal/raftbootstrap/activation_test.go
• internal/raftbootstrap/baseline.go
• internal/raftbootstrap/baseline_codec.go
• internal/raftbootstrap/baseline_signature.go
• internal/raftbootstrap/baseline_test.go
• internal/raftbootstrap/control.go
• internal/raftbootstrap/control_test.go
• internal/raftbootstrap/doc.go
• internal/raftbootstrap/encoder_bound_test.go
• internal/raftbootstrap/intent.go
• internal/raftbootstrap/intent_test.go
• internal/raftbootstrap/policy.go
• internal/raftbootstrap/policy_test.go
• internal/raftbootstrap/publication.go
• internal/raftbootstrap/publication_staging.go
• internal/raftbootstrap/publication_staging_test.go
• internal/raftbootstrap/publication_test.go
• internal/raftbootstrap/readiness.go
• internal/raftbootstrap/readiness_codec.go
• internal/raftbootstrap/readiness_signature.go
• internal/raftbootstrap/readiness_test.go
• internal/raftbootstrap/receipt.go
• internal/raftbootstrap/receipt_test.go
• internal/raftbootstrap/store.go
• internal/raftbootstrap/store_test.go
• internal/raftengine/admission.go
• internal/raftengine/apply_configuration.go
• internal/raftengine/etcd/admission_revocation_test.go
• internal/raftengine/etcd/apply_bootstrap_policy.go
• internal/raftengine/etcd/apply_entry_identity_test.go
• internal/raftengine/etcd/apply_native_configuration.go
• internal/raftengine/etcd/apply_native_configuration_test.go
• internal/raftengine/etcd/bootstrap_baseline.go
• internal/raftengine/etcd/bootstrap_baseline_ack.go
• internal/raftengine/etcd/bootstrap_baseline_configuration.go
• internal/raftengine/etcd/bootstrap_baseline_initial_journal_test.go
• internal/raftengine/etcd/bootstrap_baseline_migration.go
• internal/raftengine/etcd/bootstrap_baseline_observe.go
• internal/raftengine/etcd/bootstrap_baseline_observe_test.go
• internal/raftengine/etcd/bootstrap_baseline_ownership.go
• internal/raftengine/etcd/bootstrap_baseline_preparation.go
• internal/raftengine/etcd/bootstrap_baseline_source.go
• internal/raftengine/etcd/bootstrap_baseline_swap_darwin.go
• internal/raftengine/etcd/bootstrap_baseline_swap_linux.go
• internal/raftengine/etcd/bootstrap_baseline_swap_other.go
• internal/raftengine/etcd/bootstrap_baseline_test.go
• internal/raftengine/etcd/bootstrap_baseline_wal.go
• internal/raftengine/etcd/encryption_admission_test.go
• internal/raftengine/etcd/engine.go
• internal/raftengine/etcd/factory.go
• internal/raftengine/etcd/factory_bootstrap_test.go
• internal/raftengine/etcd/grpc_transport.go
• internal/raftengine/etcd/grpc_transport_open_test.go
• internal/raftengine/etcd/identity_reconciliation_test.go
• internal/raftengine/etcd/namespace_recovery.go
• internal/raftengine/etcd/namespace_recovery_test.go
• internal/raftengine/etcd/namespace_runtime_links_other.go
• internal/raftengine/etcd/namespace_runtime_links_unix.go
• internal/raftengine/etcd/namespace_runtime_ownership.go
• internal/raftengine/etcd/namespace_runtime_test.go
• internal/raftengine/etcd/namespace_runtime_wal.go
• internal/raftengine/etcd/native_admission.go
• internal/raftengine/etcd/native_admission_test.go
• internal/raftengine/etcd/offline_baseline_crypto.go
• internal/raftengine/etcd/offline_baseline_crypto_test.go
• internal/raftengine/etcd/owned_proposal.go
• internal/raftengine/etcd/peer_proposal_rejection_test.go
• internal/raftengine/etcd/peer_session_cancellation_test.go
• internal/raftengine/etcd/peer_session_client.go
• internal/raftengine/etcd/peer_session_client_test.go
• internal/raftengine/etcd/peer_session_decoder.go
• internal/raftengine/etcd/peer_session_decoder_test.go
• internal/raftengine/etcd/protected_configuration_recovery_test.go
• internal/raftengine/etcd/protected_step.go
• internal/raftengine/etcd/protected_step_test.go
• internal/raftengine/etcd/recovery_admission.go
• internal/raftengine/etcd/recovery_admission_test.go
• internal/raftengine/etcd/recovery_read.go
• internal/raftengine/etcd/recovery_read_test.go
• internal/raftengine/etcd/removal_notification.go
• internal/raftengine/etcd/removal_notification_protected_test.go
• internal/raftengine/etcd/wal_identity.go
• internal/raftengine/etcd/wal_identity_test.go
• internal/raftengine/etcd/wal_preparation_recovery_test.go
• internal/raftengine/etcd/wal_store.go
• internal/raftengine/factory.go
• internal/raftengine/owned_proposal.go
• internal/raftengine/statemachine.go
• internal/snapshotoffload/scheduler_test.go
• kv/compactor.go
• kv/coordinator.go
• kv/encryption_apply_admission.go
• kv/encryption_apply_admission_test.go
• kv/fsm.go
• kv/fsm_apply_entry_identity_test.go
• kv/fsm_raft_bootstrap.go
• kv/fsm_raft_bootstrap_activation.go
• kv/fsm_raft_bootstrap_activation_test.go
• kv/fsm_raft_bootstrap_admission.go
• kv/fsm_raft_bootstrap_new_apply_test.go
• kv/fsm_raft_bootstrap_test.go
• kv/fsm_reserved_opcode_test.go
• kv/grpc_conn_cache.go
• kv/grpc_conn_cache_runtime_test.go
• kv/leader_admin_proposer.go
• kv/leader_admin_proposer_test.go
• kv/leader_routed_store.go
• kv/lock_resolver.go
• kv/operation_admission.go
• kv/operation_admission_test.go
• kv/owned_proposal.go
• kv/owned_proposal_test.go
• kv/phase_d_control_admission.go
• kv/phase_d_control_admission_test.go
• kv/raft_bootstrap_guard.go
• kv/raft_bootstrap_guard_test.go
• kv/raft_bootstrap_recovery.go
• kv/raft_bootstrap_recovery_test.go
• kv/raft_payload_observation.go
• kv/raft_payload_observation_test.go
• kv/read_watermark_advance.go
• kv/read_watermark_advance_test.go
• kv/runtime_network.go
• kv/shard_store.go
• kv/shard_store_prepare_evidence.go
• kv/sharded_coordinator.go
• kv/startup_control_rpc.go
• kv/startup_control_rpc_test.go
• kv/store_mutation.go
• kv/store_mutation_test.go
• kv/transaction.go
• kv/tso_bootstrap_baseline.go
• kv/tso_bootstrap_baseline_test.go
• kv/tso_bootstrap_control.go
• kv/tso_bootstrap_control_snapshot.go
• kv/tso_bootstrap_control_test.go
• kv/tso_bootstrap_guard.go
• kv/tso_bootstrap_guard_test.go
• kv/tso_fsm.go
• kv/tso_raft.go
• main.go
• main_bootstrap_activation_fixture_test.go
• main_bootstrap_activation_runtime.go
• main_bootstrap_adapter_admission.go
• main_bootstrap_artifact_commands.go
• main_bootstrap_artifact_commands_test.go
• main_bootstrap_artifacts.go
• main_bootstrap_artifacts_test.go
• main_bootstrap_auth_exception.go
• main_bootstrap_auth_exception_test.go
• main_bootstrap_auth_wiring.go
• main_bootstrap_baseline_cli.go
• main_bootstrap_baseline_cli_test.go
• main_bootstrap_catalog_defer_test.go
• main_bootstrap_control_client.go
• main_bootstrap_control_gate.go
• main_bootstrap_control_gate_test.go
• main_bootstrap_domain.go
• main_bootstrap_enablement_e2e_test.go
• main_bootstrap_enablement_multi_e2e_test.go
• main_bootstrap_encrypted_payload.go
• main_bootstrap_encrypted_payload_factory.go
• main_bootstrap_encrypted_payload_factory_test.go
• main_bootstrap_encrypted_payload_rotation.go
• main_bootstrap_encrypted_payload_rotation_test.go
• main_bootstrap_encrypted_payload_test.go
• main_bootstrap_encryption_domain.go
• main_bootstrap_encryption_domain_test.go
• main_bootstrap_encryption_installed.go
• main_bootstrap_encryption_installed_test.go
• main_bootstrap_encryption_projection.go
• main_bootstrap_encryption_projection_test.go
• main_bootstrap_encryption_runtime_io.go
• main_bootstrap_encryption_runtime_io_test.go
• main_bootstrap_encryption_startup.go
• main_bootstrap_encryption_startup_test.go
• main_bootstrap_external_rotation_e2e_test.go
• main_bootstrap_external_rotation_lifecycle_test.go
• main_bootstrap_external_rotation_recipe.go
• main_bootstrap_external_rotation_recipe_material_test.go
• main_bootstrap_external_rotation_recipe_test.go
• main_bootstrap_external_rotation_runtime.go
• main_bootstrap_external_rotation_runtime_test.go
• main_bootstrap_flag_test.go
• main_bootstrap_format_test.go
• main_bootstrap_fsm_test.go
• main_bootstrap_ingress.go
• main_bootstrap_ingress_test.go
• main_bootstrap_ingress_transport_test.go
• main_bootstrap_launch.go
• main_bootstrap_launch_test.go
• main_bootstrap_methods.go
• main_bootstrap_methods_test.go
• main_bootstrap_migration_cli.go
• main_bootstrap_network.go
• main_bootstrap_network_redis_e2e_test.go
• main_bootstrap_network_test.go
• main_bootstrap_network_wiring.go
• main_bootstrap_observation_cli.go
• main_bootstrap_observation_cli_test.go
• main_bootstrap_offline_encryption.go
• main_bootstrap_offline_encryption_cli.go
• main_bootstrap_offline_encryption_cli_test.go
• main_bootstrap_offline_encryption_e2e_test.go
• main_bootstrap_offline_encryption_test.go
• main_bootstrap_offline_format.go
• main_bootstrap_offline_store.go
• main_bootstrap_offline_store_test.go
• main_bootstrap_operator.go
• main_bootstrap_outcome_test.go
• main_bootstrap_payload.go
• main_bootstrap_payload_rotation.go
• main_bootstrap_payload_scope.go
• main_bootstrap_payload_scope_test.go
• main_bootstrap_payload_test.go
• main_bootstrap_peer_config.go
• main_bootstrap_peer_config_test.go
• main_bootstrap_prepared_runtime.go
• main_bootstrap_prepared_runtime_test.go
• main_bootstrap_prepared_source.go
• main_bootstrap_prepared_source_test.go
• main_bootstrap_public_methods.go
• main_bootstrap_recovery_race_test.go
• main_bootstrap_registration.go
• main_bootstrap_registration_cipher_test.go
• main_bootstrap_registration_test.go
• main_bootstrap_rotation_e2e_test.go
• main_bootstrap_rotation_recipe.go
• main_bootstrap_rotation_recipe_test.go
• main_bootstrap_rotation_rpc.go
• main_bootstrap_rotation_rpc_test.go
• main_bootstrap_rotation_runtime.go
• main_bootstrap_rotation_runtime_test.go
• main_bootstrap_runtime.go
• main_bootstrap_runtime_test.go
• main_bootstrap_token.go
• main_bootstrap_tso.go
• main_bootstrap_tso_baseline.go
• main_bootstrap_tso_baseline_test.go
• main_bootstrap_tso_enablement_e2e_test.go
• main_bootstrap_tso_recovery.go
• main_bootstrap_tso_recovery_test.go
• main_bootstrap_tso_test.go
• main_encryption_fanout.go
• main_encryption_registration.go
• main_leader_balance.go
• main_migration_membership.go
• main_migration_membership_probe.go
• main_migration_namespace_membership.go
• main_migration_ownership_readiness_test.go
• main_migration_tls_fixture_test.go
• main_raft_envelope_wiring.go
• main_s3.go
• main_sqs.go
• multiraft_runtime.go
• proto/internal.proto
• store/bootstrap_baseline_encryption.go
• store/bootstrap_baseline_encryption_test.go
• store/bootstrap_baseline_probe.go
• store/bootstrap_baseline_probe_test.go
• store/bootstrap_baseline_transform.go
• store/bootstrap_baseline_transform_test.go
• store/encryption_projection.go
• store/encryption_projection_test.go
• store/lsm_migration.go
• store/lsm_store.go
• store/migration_cleanup.go
• store/migration_ownership.go
• store/migration_ownership_partition_store.go
• store/migration_promote.go
• store/migration_readiness.go
• store/migration_serving_admission.go
• store/migration_versions.go
• store/mvcc_store.go
• store/nonadvertised_mvcc.go
• store/raft_control_durability_test.go
• store/raft_control_metadata.go
• store/raft_control_metadata_test.go
• store/raft_control_offline.go
• store/raft_control_offline_test.go
• store/raft_control_projection_snapshot_test.go
• store/raft_control_projection_test.go
• store/raft_control_restore_validation.go
• store/raft_control_snapshot.go
• store/raft_control_snapshot_test.go
• store/raft_entry.go
• store/raft_entry_fsm_scope_audit_test.go
• store/raft_entry_memory.go
• store/raft_entry_memory_writer_audit_test.go
• store/raft_entry_readiness.go
• store/raft_entry_readiness_test.go
• store/replicated_control.go
• store/snapshot_external.go
• store/snapshot_pebble_sst.go

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[bootjp]

@codex review
Please review design HEAD 4d9ff3c and identify the SHA. This is a docs-only draft, not an implemented startup protocol or a fix for #1355. Independent design review closed prior scope/admission/recovery blockers, including follower permission distinct from local rotation completion and successor learner catch-up authorization. Please check the complete finite protocol and source anchors: authenticated strict-marker/session boundaries, no voting after lost term/vote state, indexed duplicate-before-witness crash recovery, receiver-owned subordinate TSO operations, generation revocation and nonrepair/A7 exclusions. Every runtime/wire/storage/acceptance gate remains open; do not infer implementation success from proposal review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T12:18:41.488234Z	f22e306	Manual request
🔒 Security Review	✅ Completed 2026-11-02T12:19:05.866261Z	f22e306	Manual request

Security findings

Advisory findings (3)

• 🟡 Add an aggregate cap for protected MULTI queues · Medium · Resolved
• 🟡 Reject replayed DEKs across encryption purposes · Medium
• 🟡 Add a global budget for protected Redis replies · Medium

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: 4d9ff3c700

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 4d9ff3c700

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[github-actions]

TLA+ spec divergence review (auto-triggered)

This PR touches files that the TLA+ safety spec has an anchor on (per
docs/design/2026_05_28_implemented_tla_safety_spec.md §3),
so an AI review is requested below to verify the implementation has not drifted
from the model.

Anchored files changed in this PR head (1f95523):

• distribution/bootstrap_plan.go
• distribution/bootstrap_plan_test.go

What to check, by subsystem:

• kv/hlc*.go — Next() must respect the HLC-4 preconditions (i)/(ii)/(iii) from the design doc: bounded skew, logical-counter handoff on leader change (the TSO allocation floor; legacy modes have none and are pinned as known gaps), and the NextFenced ceiling fence (fail-closed when wall_now >= physicalCeiling or when the next value's physical half exceeds it). Any change to the bit layout (48/16), the CAS loop, or the ceiling getter/setter is in scope.
• kv/tso*.go — RaftTSOAllocator must Observe the committed allocation floor before reserving and commit the new floor before handing a window out (HLC.tla IssuanceMode = "tso").
• kv/coordinator.go, kv/sharded_coordinator.go — RunHLCLeaseRenewal, hlcRenewalInterval, hlcPhysicalWindowMs constants, and which node stamps StartTS / CommitTS (HLC-3; legacy ShardedCoordinator stamping is the known gap G10). Any change to renewal cadence, group selection, or fail-closed behaviour is in scope.
• kv/transaction.go, kv/lock_resolver.go — OCC commit-ts assignment, lock-map encoding (key, lock_ts) -> start_ts, and the LockResolver action OCC-3 depends on (OCC.tla; G0 / G1 are pinned as known gaps).
• kv/fsm.go, kv/fsm_migration_serving.go — FSM apply of HLC lease entries (SetPhysicalCeiling), the one-phase / PREPARE / COMMIT validation OCC.tla models, verifyComposed1, and the migration serving guard Composed.tla relies on for unpinned writes.
• store/mvcc_store.go, store/lsm_store.go — version visibility, resumable compaction, the commit-ts apply fence, and the MVCC-1 / MVCC-4 / MVCC-5 invariants.
• adapter/ts.go — the snapshot start timestamp OCC.tla assumes (applied watermark; MaxUint64 on an empty store).
• distribution/** — route catalog versioning, SplitRange atomicity, and CatalogWatcher async fan-out (M4 scope).

If the change is correct but requires a spec update, edit tla/hlc/HLC.tla (or the corresponding M2..M5 module once landed) and the design doc in the same PR. The tla-check workflow runs the TLC model check on the same paths.

---

@claude review please verify TLA+ spec divergence per the checklist above.

@codex review please verify TLA+ spec divergence per the checklist above.

[bootjp]

@codex review

Please review exact latest HEAD 1f95523, including security review. The implemented scope is durable local intent/marker primitives plus a nonmutating exact-snapshot catalog plan, not runtime activation. Review canonical/aggregate size bounds, error propagation, atomic file ordering/crash boundaries, monotone identity/policy cross-checks, mutation/read-set cloning and unknown/lost-state behavior. Runtime startup/session/policy/baseline/admission remain explicitly incomplete and this PR remains Draft.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 1f95523454

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 1f95523454

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[bootjp]

Checkpoint gates complete for HEAD 1f95523: explicit latest-head normal/security reviews and every CI check now pass, including full Go race/full-length gRPC, both Jepsen modes, TLA, lint, build, CodeQL and DCO. No new root inline findings. This remains Draft: only the local durable-format and nonmutating planner foundations are implemented, not the accepted v5 runtime, native baseline, authenticated sessions, guarded apply/receipts or operational readiness. The production direct-write diagnostic remains red and #1355 remains blocked by its actual P1, irrespective of this green checkpoint.

[github-actions]

TLA+ spec divergence review (auto-triggered)

This PR touches files that the TLA+ safety spec has an anchor on (per
docs/design/2026_05_28_implemented_tla_safety_spec.md §3),
so an AI review is requested below to verify the implementation has not drifted
from the model.

Anchored files changed in this PR head (6346b98):

• distribution/bootstrap_plan.go
• distribution/bootstrap_plan_test.go
• store/lsm_store.go
• store/mvcc_store.go

What to check, by subsystem:

• kv/hlc*.go — Next() must respect the HLC-4 preconditions (i)/(ii)/(iii) from the design doc: bounded skew, logical-counter handoff on leader change (the TSO allocation floor; legacy modes have none and are pinned as known gaps), and the NextFenced ceiling fence (fail-closed when wall_now >= physicalCeiling or when the next value's physical half exceeds it). Any change to the bit layout (48/16), the CAS loop, or the ceiling getter/setter is in scope.
• kv/tso*.go — RaftTSOAllocator must Observe the committed allocation floor before reserving and commit the new floor before handing a window out (HLC.tla IssuanceMode = "tso").
• kv/coordinator.go, kv/sharded_coordinator.go — RunHLCLeaseRenewal, hlcRenewalInterval, hlcPhysicalWindowMs constants, and which node stamps StartTS / CommitTS (HLC-3; legacy ShardedCoordinator stamping is the known gap G10). Any change to renewal cadence, group selection, or fail-closed behaviour is in scope.
• kv/transaction.go, kv/lock_resolver.go — OCC commit-ts assignment, lock-map encoding (key, lock_ts) -> start_ts, and the LockResolver action OCC-3 depends on (OCC.tla; G0 / G1 are pinned as known gaps).
• kv/fsm.go, kv/fsm_migration_serving.go — FSM apply of HLC lease entries (SetPhysicalCeiling), the one-phase / PREPARE / COMMIT validation OCC.tla models, verifyComposed1, and the migration serving guard Composed.tla relies on for unpinned writes.
• store/mvcc_store.go, store/lsm_store.go — version visibility, resumable compaction, the commit-ts apply fence, and the MVCC-1 / MVCC-4 / MVCC-5 invariants.
• adapter/ts.go — the snapshot start timestamp OCC.tla assumes (applied watermark; MaxUint64 on an empty store).
• distribution/** — route catalog versioning, SplitRange atomicity, and CatalogWatcher async fan-out (M4 scope).

If the change is correct but requires a spec update, edit tla/hlc/HLC.tla (or the corresponding M2..M5 module once landed) and the design doc in the same PR. The tla-check workflow runs the TLC model check on the same paths.

---

@claude review please verify TLA+ spec divergence per the checklist above.

@codex review please verify TLA+ spec divergence per the checklist above.

[bootjp]

@codex review

Review exact latest pushed HEAD6346b9817213badd49e4557f9df5861f466c5389 including security. Adds independently reviewed actual mTLS connection/exporter-bound peer-session primitives and bridge, atomic protected control/data/config/index staging for native and affected-key memory overlay, readiness caller composition, external snapshot/backup fail-closed and maintained durability/snapshot/OCC regressions. Two original store P2s plus actual SST projection-watermark P2 were reproduced and fixed; parent unchanged original independent regressions race3 PASS11.147s. All snapshots retain rows and exact advertised watermark; SST magic required, no row fallback.
Fixed composed export full race gates: root98.363s KV79.167 store143.398 backup3.948 distribution2.489 bootstrap5.531 peer-session3.157; full36 adapter auth/ownership cases race3 PASS5.084s, full hook lint0. Separate bounded composition/caller review reports no additional validated P1/P2. Signed bootjp/contact+DCO, normal push only. Require latest exact-HEAD review and every CI, not old1f955 receipts.
Draft remains. These are components, NOT completed v5 runtime: production direct-write startup diagnostic still RED; policy/W activation, guarded membership journal/receipt/replay, production all-decoder wiring, TSO/control atomicity, required manifest/agreed native baseline and OLD-member recovery remain open. #1355 actual P1 is not fixed and no rollout readiness claimed.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 6346b98172

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 6346b98172

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: dfcd192317

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[bootjp]

Final verification receipt

HEAD: dfcd1923175585deb3539aeb6653038f9a722dc0.
Author and committer: bootjp contact@bootjp.me. GitHub reports the GPG signature Verified; DCO passes. The working tree is clean and the remote branch matches this SHA.

The latest-push normal review and security review both identify this HEAD and report no findings. No new root inline findings were submitted for this push. Earlier approvals were not reused after subsequent pushes.

All current CI checks succeed, including Linux race and unchanged full-length gRPC sequences, Jepsen encryption off/on, CodeQL, build, proto, lint, TLA and DCO. The Linux run first encountered an interrupted close in an unchanged in-memory FUSE fixture. The identical HEAD passed on attempt 2 without modifying or skipping that test. The precise interrupt origin remains unproven.

Implemented in this checkpoint:

• Protected wire MULTI/EXEC/DISCARD retains its original operation owner, joins cancelled work and preserves ambiguous submitted outcomes.
• Protected startup encryption rotation uses immutable exact recipes, actual installed key/wrapper verification, native generation fences, leader-owned completion and distinct follower permission.
• Typed authenticated registration works before policy/rotation readiness; decrypted declarations and actual ciphertext proposal seals remain separate.
• The aggregate-memory finding is addressed: protected queue copies share a server-wide 64 MiB budget reserved before allocation, retained through EXEC/child joins, and released on cleanup. Overflow closes and poisons the connection rather than executing buffered commands as new requests. Legacy nil-hook behavior is unchanged.
• Generation-stale initial catalog observations are discarded and independently reloaded before DataReady. Same-version route sets are still structurally verified; newer watcher versions never authorize a stale local loaded receipt. Fatal/corrupt/closed/cancelled observations are not silently accepted.

Focused validation evidence:

• Budget/wire/proxy/healthy regressions: race x5, 7.983s; broader Redis/proxy race suite: 63.648s; composed lint: zero issues.
• Actual active-encryption rotation/write/read/restart tests pass. The original startup E2E passes race x10, 80.841s.
• Deterministic registration/catalog overlap fails against the old implementation and passes after the fix, including encrypted writes and restart. Catalog recovery and deferral regressions pass race x3, 85.694s; four recovery cases pass race x5, 141.046s.
• Three-member catch-up/forwarding and stale-read-result checks pass repeated race tests. The final combined three-member/catalog regression run passes in 62.120s. No writes are blindly retried and no old operation handle is renewed.
• The main Clojure unit suite passes 345 tests / 1391 assertions. The separate upstream Redis submodule unit entrypoint has a pre-existing missing jepsen.redis namespace; this was not represented as a passing distributed campaign.

Scope remains the documented accepted-baseline profile and exact local startup rotation with active storage encryption. Encrypted legacy/offline migration, arbitrary external encryption admin operations, cold seed, lost-state replacement, protected membership changes and the full v5 snapshot/journal protocol are not claimed complete. Three-member encrypted fault injection remains outside the demonstrated E2E coverage. No production deployment or operational-stability claim is made.

GitHub reports this non-draft PR MERGEABLE / CLEAN. The PR remains open and has not been merged.

[github-actions]

TLA+ spec divergence review (auto-triggered)

This PR touches files that the TLA+ safety spec has an anchor on (per
docs/design/2026_05_28_implemented_tla_safety_spec.md §3),
so an AI review is requested below to verify the implementation has not drifted
from the model.

Anchored files changed in this PR head (652c630):

• distribution/bootstrap_plan.go
• distribution/bootstrap_plan_test.go
• distribution/catalog.go
• kv/coordinator.go
• kv/fsm.go
• kv/lock_resolver.go
• kv/sharded_coordinator.go
• kv/transaction.go
• kv/tso_bootstrap_baseline.go
• kv/tso_bootstrap_baseline_test.go
• kv/tso_bootstrap_control.go
• kv/tso_bootstrap_control_snapshot.go
• kv/tso_bootstrap_control_test.go
• kv/tso_bootstrap_guard.go
• kv/tso_bootstrap_guard_test.go
• kv/tso_fsm.go
• kv/tso_raft.go
• store/lsm_store.go
• store/mvcc_store.go

What to check, by subsystem:

• kv/hlc*.go — Next() must respect the HLC-4 preconditions (i)/(ii)/(iii) from the design doc: bounded skew, logical-counter handoff on leader change (the TSO allocation floor; legacy modes have none and are pinned as known gaps), and the NextFenced ceiling fence (fail-closed when wall_now >= physicalCeiling or when the next value's physical half exceeds it). Any change to the bit layout (48/16), the CAS loop, or the ceiling getter/setter is in scope.
• kv/tso*.go — RaftTSOAllocator must Observe the committed allocation floor before reserving and commit the new floor before handing a window out (HLC.tla IssuanceMode = "tso").
• kv/coordinator.go, kv/sharded_coordinator.go — RunHLCLeaseRenewal, hlcRenewalInterval, hlcPhysicalWindowMs constants, and which node stamps StartTS / CommitTS (HLC-3; legacy ShardedCoordinator stamping is the known gap G10). Any change to renewal cadence, group selection, or fail-closed behaviour is in scope.
• kv/transaction.go, kv/lock_resolver.go — OCC commit-ts assignment, lock-map encoding (key, lock_ts) -> start_ts, and the LockResolver action OCC-3 depends on (OCC.tla; G0 / G1 are pinned as known gaps).
• kv/fsm.go, kv/fsm_migration_serving.go — FSM apply of HLC lease entries (SetPhysicalCeiling), the one-phase / PREPARE / COMMIT validation OCC.tla models, verifyComposed1, and the migration serving guard Composed.tla relies on for unpinned writes.
• store/mvcc_store.go, store/lsm_store.go — version visibility, resumable compaction, the commit-ts apply fence, and the MVCC-1 / MVCC-4 / MVCC-5 invariants.
• adapter/ts.go — the snapshot start timestamp OCC.tla assumes (applied watermark; MaxUint64 on an empty store).
• distribution/** — route catalog versioning, SplitRange atomicity, and CatalogWatcher async fan-out (M4 scope).

If the change is correct but requires a spec update, edit tla/hlc/HLC.tla (or the corresponding M2..M5 module once landed) and the design doc in the same PR. The tla-check workflow runs the TLC model check on the same paths.

---

@claude review please verify TLA+ spec divergence per the checklist above.

@codex review please verify TLA+ spec divergence per the checklist above.

[bootjp]

@codex review

Latest HEAD: 652c630.

Implemented explicit-key encrypted legacy data-group migration and authenticated external EncryptionAdmin.RotateDEK. Offline verification authenticates complete logical history and retained native state while preserving original ciphertext, epochs and nonce state. External requests retain the original receiver generation, require ADMIN bearer plus verified mTLS, and never replay an unknown command under a renewed process context.

Added real encrypted legacy migration -> activation -> protected write/read/restart E2E, public RPC rotation/restart E2E, rejection/lost-reply checks and shutdown/panic lifetime tests. Independent review identified snapshot checkpoint/cutover boundary gaps; both are fixed and old-code overlays reproduce the regressions.

Local evidence: root full race 355.435s; store 212.380s; native 190.969s; admission 1.672s; final migration/lifecycle race 10.540s, post-boundary migration race 10.288s; Jepsen unit 345 tests / 1391 assertions; composed lint zero issues. Commits are signed and Signed-off-by bootjp contact@bootjp.me. No deployment or production-stability claim. Encrypted scalar TSO migration, multi-member encrypted fault injection, cold seed and arbitrary protected membership remain outside this checkpoint.

[chatgpt-codex-connector]

Codex Review: Something went wrong. Try again later by commenting “@codex review”.

Unknown error

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bootjp]

@codex review

Retrying the reviewer infrastructure error at #1364 (comment). Please review current HEAD 652c630. No code has changed since the previous request.

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 652c630872

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 652c630872

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

TLA+ spec divergence review (auto-triggered)

This PR touches files that the TLA+ safety spec has an anchor on (per
docs/design/2026_05_28_implemented_tla_safety_spec.md §3),
so an AI review is requested below to verify the implementation has not drifted
from the model.

Anchored files changed in this PR head (66c2697):

• distribution/bootstrap_plan.go
• distribution/bootstrap_plan_test.go
• distribution/catalog.go
• kv/coordinator.go
• kv/fsm.go
• kv/lock_resolver.go
• kv/sharded_coordinator.go
• kv/transaction.go
• kv/tso_bootstrap_baseline.go
• kv/tso_bootstrap_baseline_test.go
• kv/tso_bootstrap_control.go
• kv/tso_bootstrap_control_snapshot.go
• kv/tso_bootstrap_control_test.go
• kv/tso_bootstrap_guard.go
• kv/tso_bootstrap_guard_test.go
• kv/tso_fsm.go
• kv/tso_raft.go
• store/lsm_store.go
• store/mvcc_store.go

What to check, by subsystem:

• kv/hlc*.go — Next() must respect the HLC-4 preconditions (i)/(ii)/(iii) from the design doc: bounded skew, logical-counter handoff on leader change (the TSO allocation floor; legacy modes have none and are pinned as known gaps), and the NextFenced ceiling fence (fail-closed when wall_now >= physicalCeiling or when the next value's physical half exceeds it). Any change to the bit layout (48/16), the CAS loop, or the ceiling getter/setter is in scope.
• kv/tso*.go — RaftTSOAllocator must Observe the committed allocation floor before reserving and commit the new floor before handing a window out (HLC.tla IssuanceMode = "tso").
• kv/coordinator.go, kv/sharded_coordinator.go — RunHLCLeaseRenewal, hlcRenewalInterval, hlcPhysicalWindowMs constants, and which node stamps StartTS / CommitTS (HLC-3; legacy ShardedCoordinator stamping is the known gap G10). Any change to renewal cadence, group selection, or fail-closed behaviour is in scope.
• kv/transaction.go, kv/lock_resolver.go — OCC commit-ts assignment, lock-map encoding (key, lock_ts) -> start_ts, and the LockResolver action OCC-3 depends on (OCC.tla; G0 / G1 are pinned as known gaps).
• kv/fsm.go, kv/fsm_migration_serving.go — FSM apply of HLC lease entries (SetPhysicalCeiling), the one-phase / PREPARE / COMMIT validation OCC.tla models, verifyComposed1, and the migration serving guard Composed.tla relies on for unpinned writes.
• store/mvcc_store.go, store/lsm_store.go — version visibility, resumable compaction, the commit-ts apply fence, and the MVCC-1 / MVCC-4 / MVCC-5 invariants.
• adapter/ts.go — the snapshot start timestamp OCC.tla assumes (applied watermark; MaxUint64 on an empty store).
• distribution/** — route catalog versioning, SplitRange atomicity, and CatalogWatcher async fan-out (M4 scope).

If the change is correct but requires a spec update, edit tla/hlc/HLC.tla (or the corresponding M2..M5 module once landed) and the design doc in the same PR. The tla-check workflow runs the TLC model check on the same paths.

---

@claude review please verify TLA+ spec divergence per the checklist above.

@codex review please verify TLA+ spec divergence per the checklist above.

[bootjp]

@codex review

Please review latest HEAD 66c2697 after the final push.

Addressed the protected QUIT P2: terminal validation and buffered reply publication precede physical close; trailing parsed pipeline commands and MULTI queued writes are discarded. Added real-wire, denied-terminal, child-join and panic regressions. Legacy behavior and enforced overflow/poison shutdown remain unchanged.

The prior Linux CI failure was an unchanged process-global runtime.NumGoroutine assertion running under t.Parallel. Isolated only that measuring test; all 40 groups, 3 workers and strict original thresholds remain. A naive one-goroutine-per-group overlay still fails (42 is not below 22). Package race x5 passes in 103.573s. The original CI count violation was not reproduced locally; local old-code repetition instead timed out in WAL fsync, and is not claimed as a reproduction.

All composed lint passes; targeted QUIT/wire transaction race x5 passes. Earlier HEAD reviews/CI are stale and are not used as approval for this push.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 66c2697915

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 66c2697915

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[bootjp]

Final verification receipt

HEAD: 66c26979153aee323cf91d4eeb5f8e772545836a.

Author and committer of all three new commits are bootjp contact@bootjp.me. GitHub verifies every signature; DCO passes. The local tree is clean and its HEAD matches the remote PR.

The last-push normal review and security review both identify this HEAD and report no findings. No new root inline findings exist for this push, and no review threads remain unresolved. Earlier HEAD approvals were not reused.

CI is complete: 17 successful checks, no failures or pending checks. Two conditional pull_request_review helper jobs were skipped (Claude Code and the test branch of Review approval events); the actual test workflows ran successfully:

• Linux race and unchanged full-length 10,000-iteration gRPC sequences: both test steps pass.
• Jepsen encryption off/on: both matrix jobs pass.
• CodeQL: all analyses pass.
• Build, proto, composed lint, TLA and DCO pass.

This checkpoint implements:

• Explicit-key encrypted legacy data-group migration through observation, preparation/resume, attestation and activation. Historical storage rows, retained WAL and supported native row-stream snapshots are authenticated. Logical equality is separate from exact preservation of original ciphertext, epochs, nonce state and backups.
• Sidecar/checkpoint/registration binding, historical-key requirements, wrong-key/tamper rejection and KEK alias protection. Same-index checkpoint state disagreement and future/missing cutover headers are rejected.
• Authenticated external EncryptionAdmin.RotateDEK with ADMIN bearer, verified client mTLS, pinned full node identity/purpose epoch, bounded concurrency and original request-generation transfer. Unknown or cancelled external commands are reconciled read-only, never reproposed under a fresh process handle.
• Real encrypted legacy migration -> protected business write/read -> restart E2E, authenticated public rotation/restart E2E, malformed/lost-reply/cancellation checks and shutdown/panic/child-join lifetime coverage.
• The QUIT finding is fixed: terminal validation and buffered reply publication precede physical close. Parsed trailing pipeline commands and MULTI queued writes are discarded; legacy behavior and enforced overflow/poison closure remain unchanged.

The previous Linux CI count failure was in an unchanged process-wide goroutine measurement running in parallel with other tests. Only that measuring test is isolated now: 40 groups, 3 workers and the strict original thresholds remain. A naive one-goroutine-per-group overlay still fails. The original CI count violation was not reproduced locally; an earlier local old-code repetition timed out in WAL fsync and is not represented as a reproduction.

Local focused evidence includes final migration/snapshot race tests, external RPC/recipe/lifecycle race tests, QUIT/wire transaction repetition, scheduler package race x5 and the Jepsen unit suite (345 tests / 1391 assertions). Negative old-code overlays fail for the fixed snapshot boundaries and unbounded worker implementation.

Scope remains the documented accepted-baseline encrypted data-group profile. Encrypted scalar TSO migration, encrypted multi-member fault injection, cold seed, lost-state replacement, arbitrary protected membership changes and full v5 snapshot/journal completion are not claimed. No production deployment or operational-stability claim is made.

GitHub reports this non-draft PR MERGEABLE / CLEAN. It remains open and has not been merged.

[bootjp]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 66c2697915

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Here are some automated security review suggestions for this pull request.

Reviewed commit: 66c2697915

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[bootjp]

Additional security review follow-up

The earlier verification receipt predates two newly submitted findings on HEAD 66c2697 and is superseded for merge-readiness purposes:

• raft: enable accepted-baseline protected startup #1364 (comment) — duplicate AES material under another DEK identity/purpose.
• raft: enable accepted-baseline protected startup #1364 (comment) — unbounded aggregate protected RESP reply capacity.

Both paths are being fixed and independently checked. The update will reject actual material reuse before request authorization and before apply mutation, and reserve shared RESP backing capacity before allocation with bounded network-output lifetime. Fresh review and CI on the next pushed HEAD are required; existing approval receipts are not reused. No merge or deployment has been performed.

[github-actions]

TLA+ spec divergence review (auto-triggered)

This PR touches files that the TLA+ safety spec has an anchor on (per
docs/design/2026_05_28_implemented_tla_safety_spec.md §3),
so an AI review is requested below to verify the implementation has not drifted
from the model.

Anchored files changed in this PR head (f22e306):

• distribution/bootstrap_plan.go
• distribution/bootstrap_plan_test.go
• distribution/catalog.go
• kv/coordinator.go
• kv/fsm.go
• kv/lock_resolver.go
• kv/sharded_coordinator.go
• kv/transaction.go
• kv/tso_bootstrap_baseline.go
• kv/tso_bootstrap_baseline_test.go
• kv/tso_bootstrap_control.go
• kv/tso_bootstrap_control_snapshot.go
• kv/tso_bootstrap_control_test.go
• kv/tso_bootstrap_guard.go
• kv/tso_bootstrap_guard_test.go
• kv/tso_fsm.go
• kv/tso_raft.go
• store/lsm_store.go
• store/mvcc_store.go

What to check, by subsystem:

• kv/hlc*.go — Next() must respect the HLC-4 preconditions (i)/(ii)/(iii) from the design doc: bounded skew, logical-counter handoff on leader change (the TSO allocation floor; legacy modes have none and are pinned as known gaps), and the NextFenced ceiling fence (fail-closed when wall_now >= physicalCeiling or when the next value's physical half exceeds it). Any change to the bit layout (48/16), the CAS loop, or the ceiling getter/setter is in scope.
• kv/tso*.go — RaftTSOAllocator must Observe the committed allocation floor before reserving and commit the new floor before handing a window out (HLC.tla IssuanceMode = "tso").
• kv/coordinator.go, kv/sharded_coordinator.go — RunHLCLeaseRenewal, hlcRenewalInterval, hlcPhysicalWindowMs constants, and which node stamps StartTS / CommitTS (HLC-3; legacy ShardedCoordinator stamping is the known gap G10). Any change to renewal cadence, group selection, or fail-closed behaviour is in scope.
• kv/transaction.go, kv/lock_resolver.go — OCC commit-ts assignment, lock-map encoding (key, lock_ts) -> start_ts, and the LockResolver action OCC-3 depends on (OCC.tla; G0 / G1 are pinned as known gaps).
• kv/fsm.go, kv/fsm_migration_serving.go — FSM apply of HLC lease entries (SetPhysicalCeiling), the one-phase / PREPARE / COMMIT validation OCC.tla models, verifyComposed1, and the migration serving guard Composed.tla relies on for unpinned writes.
• store/mvcc_store.go, store/lsm_store.go — version visibility, resumable compaction, the commit-ts apply fence, and the MVCC-1 / MVCC-4 / MVCC-5 invariants.
• adapter/ts.go — the snapshot start timestamp OCC.tla assumes (applied watermark; MaxUint64 on an empty store).
• distribution/** — route catalog versioning, SplitRange atomicity, and CatalogWatcher async fan-out (M4 scope).

If the change is correct but requires a spec update, edit tla/hlc/HLC.tla (or the corresponding M2..M5 module once landed) and the design doc in the same PR. The tla-check workflow runs the TLC model check on the same paths.

---

@claude review please verify TLA+ spec divergence per the checklist above.

@codex review please verify TLA+ spec divergence per the checklist above.

[bootjp]

@codex review

[bootjp]

@codex security review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: f22e3060bc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: f22e3060bc

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[bootjp]

Verification on f22e306\n\n- Reused AES DEK material is refused across retained IDs and storage/Raft purposes before external proposal and Raft apply mutation. Exact active-request retry remains valid; temporary plaintext is cleared.\n- Protected Redis replies use a receiver-wide 128 MiB backing-capacity budget, direct bounded network publication, and a pre-backend execution gate. Four blocked XREADs cannot exclude direct or Lua XADD producers. This is not a total backend/parser allocation or RSS bound.\n- Local: full root race suite, broad adapter race suite (excluding only the two full-length gRPC sequences run by CI), repeated focused Redis race tests, encryption race tests, Jepsen unit suite (345 tests / 1391 assertions), and full lint passed. Guard-disabled negative controls failed as expected.\n- Linux Test workflow attempt 1 failed in the unchanged forced-leadership-transfer migration test with a 60-second context deadline. Its isolated race test passed 3 local repetitions. The same-SHA workflow rerun (attempt 2) passed both broad race coverage and full-length gRPC sequences. This establishes a green check, not a diagnosed root cause for the first timeout.\n- The separate vendor-like jepsen/redis scaffold test cannot load its own jepsen.redis namespace; it was not counted as passing.\n- Fresh normal and security reviews both inspected f22e306 and reported no findings. All PR checks are success/skipped, and both security threads are resolved. No deployment or merge was performed.