Description
Design prerequisite for TSO-0197 (bound expanded startup replay memory without stranding accepted ingress work). Retained diagnosis identifies replay amplification, but bounded storage reads, oversized-original progress and first-cover delivery need a coherent protocol before implementation. This commission produces a reviewed design and exact implementation packets from source and retained evidence only. It does not implement remediation, establish a measured safe limit, authorize a new production capture, or close the parent.
Acceptance Criteria
- #1 A source-grounded design accounts for process-wide preparation and retained memory across stream and webhook routes and tailnet providers, including bounded WAL reads, decoding, operation tapes, log staging and first-cover materialization; disk WAL capacity remains distinct.
- #2 The design specifies bounded progress for an individually oversized already-accepted original, staging integrity and ownership, crash recovery, cancellation, disk-full handling, durable ACK, original route/timestamp/generation, one process-local effect entry, immutable retry payloads and both signal outcomes before generation-checked retirement.
- #3 An offline proof specification maps all four parent criteria to discriminating negative and positive checks, representative ordinary process overhead and cgroup peak accounting. Missing original-shape inputs are explicitly recorded as unmet implementation admission prerequisites, not measured results.
- #4 An independent design/security review resolves blocking findings or returns an explicit park. The final packet names exact producer and consumer files, shared seams, dependency order, acceptance commands or clearly identified harness work, and attempt lineage. Parent acceptance remains unchecked.
Definition of Done
- #1 Retain the reviewed design, evidence matrix and review receipt in ignored local evidence; put only a sanitized summary and artifact location in tracker notes.
Implementation Plan
loop32: one source-grounded design owner produces the complete protocol, proof matrix, ownership packets and hashed evidence index; root obtains independent design/security review, corrects only design artifacts within three review-repair rounds, then accepts or parks. No source implementation or new production capture; parent criteria stay unchecked.
Implementation Notes
loop32 independent design review identified incomplete semantic producer/consumer and global-resource/recovery protocol. Root selected a semantics-preserving external-memory design correction within the existing commission; no compatibility narrowing, source implementation or capture. First correction is in progress; maximum three review-repair rounds. Missing protected original-shape inputs remain a later implementation prerequisite; parent criteria and zero implementation-attempt lineage unchanged.
loop32 delta review upheld the reference-valued/disk-semantic architecture and failed-collection retention choice, but blocked completion on callback phase cutoffs, bounded pending-freeze lineage/cover admission and active Go JSON-engine identity. Correction 2 of maximum 3 addresses only those engineering deltas. Source unchanged; no runtime proof or parent implementation attempts. All implementation packets remain blocked by protected workload inputs and separate implementation commissioning.
loop32: design accepted after independent initial and delta security reviews; two of three allowed design corrections completed, zero parent implementation attempts. Exact source 871860d0e2de5e9dc26c73d6ed2d91549d3fdf67 unchanged. Reviewed artifacts at /Users/rob/repos/tailscale2otel/codex/loop32/design/; canonical receipt /Users/rob/repos/tailscale2otel/codex/loop32/design-review.md and full final PASS /Users/rob/repos/tailscale2otel/codex/loop32/design-review-delta2.md. All four child design AC and ignored-evidence DoD satisfied under explicit design-only exception. W1 protected original-shape/ordinary inputs and separate implementation commission remain unmet; all packets BLOCKED. No runtime gate, CodeRabbit, source change, capture or measured safe cap.
Final Summary
Completed the source-grounded bounded-reference replay protocol, process-global resource/recovery model, full parent proof matrix, exact serial implementation packets and hashed evidence index. Independent guarded delta review passed the final design; root verified final artifact identity and unchanged source. Design-only completion, not remediation or sizing proof. Parent acceptance remains entirely unchecked; later work needs protected workload inputs and explicit implementation commissioning.