Repository navigation
Integrate aggregates into private telemetry state - #337
Open
gmemuriuki wants to merge 3 commits into
Open
gmemuriuki wants to merge 3 commits into
gmemuriuki wants to merge 3 commits into
Conversation
gmemuriuki
added this pull request to stack #331
October 9, 2026 17:56
gmemuriuki
force-pushed
the
telemetry/aggregate-state-codec
branch
2 times, most recently
from
October 14, 2026 07:51
bab0ff2 to
084ccef
Compare
nikomatsakis
force-pushed
the
telemetry/aggregate-state-codec
branch
from
October 16, 2026 09:02
084ccef to
d3b0d1c
Compare
gmemuriuki
force-pushed
the
telemetry/aggregate-state-codec
branch
2 times, most recently
from
October 20, 2026 13:26
8d6f47f to
224a2e8
Compare
Exercise complete TelemetryStateV1 fixtures through the production decode and encode entry points instead of invoking TOML directly. Keep direct TOML use confined to tests of lower-level aggregate wire adapters. Add one test-only decoding helper and update schema rejection assertions to expect content-free InvalidState locations instead of raw parser messages. This prepares the tests for a non-Serde runtime state without changing production behavior.
Add the aggregate-state wire envelope around the three persisted families and validate invariants that span their individual stores. Require every store to agree with the identity high-water day, and reject event identifiers shared by plugin-hook and extension rows. Use the same validator before encoding and after decoding so invalid runtime and persisted state fail consistently. Cover canonical round trips, each store-day diagnostic, and cross-family identifier collisions in both directions.
Include all three aggregate stores in telemetry-state.toml through the private state codec. Keep runtime trackers non-serializable, rebuild derived subjects under the stored identity scope, and surface typed, content-free invariant failures. Advance every aggregate store with the identity high-water day before mutating identity state. Day rollover clears closed-day entries and resets public-row spend, while identifier rotation clears entries without granting a fresh daily allowance. Cover canonical round trips and lifecycle behavior for same-day recording, day and identifier-window rollover, identifier reset, and telemetry clear. Document the persisted shape and transition rules.
gmemuriuki
force-pushed
the
telemetry/aggregate-state-codec
branch
from
October 21, 2026 07:23
224a2e8 to
4b36256
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
This PR integrates aggregate stores into the version 1 private-state codec and lifecycle.
TelemetryStateV1is no longer directly serializable. The codec owns a strict borrowed encoding view and owned decoding form, requires all three aggregate sections, and preserves typed, content-free aggregate invariant failures. Root validation requires every store day to match the identity high-water day and prevents plugin-hook and extension entries from sharing anevent_id.Every accepted recording operation advances all three aggregate stores before identity state changes, including low-volume-only operations. Day rollover clears closed-day entries and resets public-row spend; identifier-window rollover and identifier reset clear old-epoch entries without granting another same-day allowance. Telemetry clear resets aggregate state together with its public files and stopped-day marker.
State fixtures now use the production codec. Tests cover canonical byte round trips, required aggregate state, typed invariant failures, same-day recording, day and identifier-window rollover, identifier reset, clear, and all-or-nothing day preflight.
Disclosure questions
AI disclosure.
Questions for reviewers.
Does the codec keep private aggregate reconstruction strict and secret-safe, and are the day, identifier-reset, and clear lifecycle rules enforced at the right boundary?