Repository navigation
Persist aggregate private-state stores - #336
Open
gmemuriuki wants to merge 3 commits into
Open
gmemuriuki wants to merge 3 commits into
gmemuriuki wants to merge 3 commits into
Conversation
gmemuriuki
added this pull request to stack #331
October 9, 2026 17:56
gmemuriuki
force-pushed
the
telemetry/aggregate-store-persistence
branch
2 times, most recently
from
October 14, 2026 07:51
2b1da69 to
68fee12
Compare
nikomatsakis
force-pushed
the
telemetry/aggregate-store-persistence
branch
from
October 16, 2026 09:02
68fee12 to
8ef131f
Compare
gmemuriuki
force-pushed
the
telemetry/aggregate-store-persistence
branch
2 times, most recently
from
October 20, 2026 13:26
0bb52fd to
da0933e
Compare
Add borrowed encode and owned decode wire shapes for the hook aggregate store without making runtime trackers generally serializable. Rebuild hook keys from the document identity scope and retain canonical BTreeMap ordering in the private TOML representation. Validate entry identity, duplicate reconstructed keys, complete and permanently incomplete session tracking, and contribution counts on both sides of the persistence boundary. Keep persisted subjects out of the wire shape so the document cannot supply derived identity. Narrow runtime state access behind persistence-specific bridges. Cover canonical round trips, malformed state, alternate identity scopes, and secret-safe subject reconstruction, and document the store bounds and TOML field-order constraint.
Add borrowed encode and owned decode wire shapes for the plugin-hook aggregate store without making runtime trackers generally serializable. Persist public-row spend, stable event identifiers, and public plugin coordinates while rebuilding derived subjects from the document scope. Validate strict public, unnamed, and overflow bucket shapes. Reject inconsistent spend, duplicate keys and row identifiers, mismatched entry identity, and invalid session contribution state on both encode and decode. Keep cross-family identifier uniqueness assigned to the root validator. Narrow runtime access behind persistence-specific bridges. Cover canonical round trips, incomplete trackers, malformed bucket shapes, alternate identity scopes, allowance rules, and duplicate state with focused tests, and update the module map.
Add borrowed encode and owned decode wire shapes for the extension-invocation aggregate store without making runtime trackers generally serializable. Persist public-row spend, stable event identifiers, and validated safe attribution while rebuilding derived subjects from the document identity scope. Validate exact public, unnamed, and overflow bucket shapes. Check independent attempted and completed session contributions, reconstructed keys, duplicate row identifiers, and allowance consistency on both encode and decode. Prove shallow and recursive attribution paths round-trip canonically through nested TOML. Reject unsafe depth and stored subjects, expose only narrow persistence bridges, and update the recording contract and module map.
gmemuriuki
force-pushed
the
telemetry/aggregate-store-persistence
branch
from
October 21, 2026 07:23
da0933e to
932455e
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR defines the private-state wire shapes for the hook, plugin-hook, and extension-invocation aggregate stores.
Each family uses a borrowed encoding view and an owned decoding form, keeping runtime trackers non-serializable. Decoding rebuilds aggregate keys and derived subjects from validated source dimensions under the document identity scope rather than trusting persisted subject bytes.
The named families persist their daily public-row spend and stable row identifiers. Their public, unnamed, and overflow buckets have strict, non-overlapping shapes. Public extension entries retain validated safe attribution so their subjects can be re-derived after a restart.
Family-local validation rejects duplicate keys and row identifiers, inconsistent spend, mismatched entry identity, malformed buckets, and invalid session state on both encode and decode. Tests cover canonical round trips, alternate identity scopes, incomplete trackers, recursive extension paths, allowance boundaries, and malformed representations.
Disclosure questions
AI disclosure.
Questions for reviewers.
Are the three wire shapes strict enough to reconstruct runtime identity without accepting derived subjects or malformed bucket combinations from the file?