From 3f7d6dcbda40fd64e1ce768c04f6c744755d2ff6 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Mon, 13 Jul 2026 00:19:54 +0100 Subject: [PATCH] Order lifecycle mirrors by event time --- epiphany-core/src/cultmesh_integration.rs | 117 +++++++++++++++++- ...onceptual-substitution-audit-2026-07-12.md | 10 ++ notes/fresh-workspace-handoff.md | 3 + state/ledgers.msgpack | Bin 449641 -> 450341 bytes state/map.yaml | 2 +- 5 files changed, 129 insertions(+), 3 deletions(-) diff --git a/epiphany-core/src/cultmesh_integration.rs b/epiphany-core/src/cultmesh_integration.rs index 96cb21b9..2ce95f6d 100644 --- a/epiphany-core/src/cultmesh_integration.rs +++ b/epiphany-core/src/cultmesh_integration.rs @@ -8,6 +8,8 @@ use crate::default_substrate_gate_cultnet_contracts; use anyhow::Context; use anyhow::Result; use anyhow::anyhow; +use chrono::DateTime; +use chrono::FixedOffset; use cultcache_rs::CultSoaColumnValues; use cultcache_rs::DatabaseEntry; use cultcache_rs::SoaDocument; @@ -3519,10 +3521,17 @@ pub fn write_epiphany_cultmesh_daemon_service_lifecycle_receipt( let mut node = open_epiphany_cultmesh_node(store_path, runtime_id)?; let receipt_key = epiphany_cultmesh_daemon_service_lifecycle_receipt_key(&receipt.receipt_id); let written = node.put(receipt_key.as_str(), &receipt)?; - node.put( + let current_latest = node.get::( EPIPHANY_CULTMESH_DAEMON_SERVICE_LIFECYCLE_RECEIPT_LATEST_KEY, - &written, )?; + if current_latest.as_ref().is_none_or(|current| { + daemon_service_lifecycle_event_key(&written) >= daemon_service_lifecycle_event_key(current) + }) { + node.put( + EPIPHANY_CULTMESH_DAEMON_SERVICE_LIFECYCLE_RECEIPT_LATEST_KEY, + &written, + )?; + } node.flush()?; Ok(written) } @@ -3990,6 +3999,19 @@ fn validate_daemon_service_lifecycle_receipt( return Err(anyhow!("daemon service lifecycle receipt missing {label}")); } } + let started_at = DateTime::parse_from_rfc3339(&receipt.started_at_utc).map_err(|error| { + anyhow!("daemon service lifecycle receipt has invalid started at: {error}") + })?; + if let Some(completed_at) = receipt.completed_at_utc.as_deref() { + let completed_at = DateTime::parse_from_rfc3339(completed_at).map_err(|error| { + anyhow!("daemon service lifecycle receipt has invalid completed at: {error}") + })?; + if completed_at < started_at { + return Err(anyhow!( + "daemon service lifecycle receipt completed before it started" + )); + } + } if !receipt.required_document_types.is_empty() && (!receipt.schema_preflight_passed || receipt.executable_sha256.trim().is_empty() @@ -4003,6 +4025,22 @@ fn validate_daemon_service_lifecycle_receipt( Ok(()) } +fn daemon_service_lifecycle_event_key( + receipt: &EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry, +) -> (DateTime, &str) { + let event_time = receipt + .completed_at_utc + .as_deref() + .map(DateTime::parse_from_rfc3339) + .transpose() + .expect("validated lifecycle completion timestamp") + .unwrap_or_else(|| { + DateTime::parse_from_rfc3339(&receipt.started_at_utc) + .expect("validated lifecycle start timestamp") + }); + (event_time, receipt.receipt_id.as_str()) +} + pub fn epiphany_cultmesh_daemon_tool_invocation_intent_from_capability( intent_id: impl Into, requesting_agent_id: impl Into, @@ -7132,6 +7170,21 @@ mod tests { ids, vec!["service-lifecycle-first", "service-lifecycle-second"] ); + assert_eq!( + load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt( + &store, + "epiphany-test" + )?, + Some(second.clone()) + ); + + let mut delayed_first = first.clone(); + delayed_first.receipt_id = "service-lifecycle-delayed-first".to_string(); + write_epiphany_cultmesh_daemon_service_lifecycle_receipt( + &store, + "epiphany-test", + delayed_first, + )?; assert_eq!( load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt( &store, @@ -7142,6 +7195,66 @@ mod tests { Ok(()) } + #[test] + fn service_lifecycle_receipt_refuses_invalid_or_reversed_time() -> Result<()> { + let temp = tempfile::tempdir()?; + let store = temp + .path() + .join("epiphany-service-lifecycle-invalid-time.ccmp"); + let mut receipt = EpiphanyCultMeshDaemonServiceLifecycleReceiptEntry { + schema_version: EPIPHANY_CULTMESH_DAEMON_SERVICE_LIFECYCLE_RECEIPT_SCHEMA_VERSION + .to_string(), + receipt_id: "service-lifecycle-invalid-time".to_string(), + service_id: "epiphany-daemon-supervisor-service".to_string(), + scheduler_id: "epiphany-daemon-supervisor".to_string(), + runtime_id: "epiphany-test".to_string(), + daemon_selector: "epiphany-daemon-supervisor".to_string(), + action: "windows-service-status".to_string(), + status: "running".to_string(), + command: "powershell.exe".to_string(), + args: Vec::new(), + cwd: None, + process_id: None, + exit_code: Some(0), + started_at_utc: "not-a-time".to_string(), + completed_at_utc: None, + operator_artifact_ref: "test://invalid-time".to_string(), + private_state_exposed: false, + notes: Vec::new(), + executable_sha256: String::new(), + preflight_witness_id: String::new(), + required_document_types: Vec::new(), + schema_preflight_passed: false, + schema_catalog_sha256: String::new(), + }; + assert!( + write_epiphany_cultmesh_daemon_service_lifecycle_receipt( + &store, + "epiphany-test", + receipt.clone(), + ) + .is_err() + ); + receipt.started_at_utc = "2026-07-13T02:00:00Z".to_string(); + receipt.completed_at_utc = Some("2026-07-13T01:00:00Z".to_string()); + assert!( + write_epiphany_cultmesh_daemon_service_lifecycle_receipt( + &store, + "epiphany-test", + receipt, + ) + .is_err() + ); + assert!( + load_latest_epiphany_cultmesh_daemon_service_lifecycle_receipt( + &store, + "epiphany-test" + )? + .is_none() + ); + Ok(()) + } + #[test] fn service_execution_audit_checks_expose_operator_artifact_refs() -> Result<()> { let report = epiphany_service_execution_audit_report(&[ diff --git a/notes/conceptual-substitution-audit-2026-07-12.md b/notes/conceptual-substitution-audit-2026-07-12.md index f3ffc4b5..7152e35e 100644 --- a/notes/conceptual-substitution-audit-2026-07-12.md +++ b/notes/conceptual-substitution-audit-2026-07-12.md @@ -501,3 +501,13 @@ for each service family; attention is derived from that event. History retains older failures without letting them impersonate current state. Adversarial tests prove a newer recovery supersedes an old failure and a newer failure is not hidden by an old recovery. + +## Last writer presented as latest lifecycle event + +The lifecycle `latest` mirror was overwritten on every write. A delayed retry +or replay of an older receipt could therefore move the stored present backward +even though immutable history contained the correct ordering. Lifecycle writes +now validate RFC3339 start/completion timestamps, reject completion before +start, and update the mirror only when `(event time, receipt ID)` is not older +than the current mirror. A delayed old receipt remains in history without +becoming current. diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 0cfcfa00..56a3e029 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -128,6 +128,9 @@ The confirmed conceptual substitutions have been cut: - Service lifecycle projection selects the actual latest family event. An old attention receipt no longer masquerades as current state after recovery; newer failures still surface immediately. +- The lifecycle `latest` mirror is event-time-owned, not last-writer-wins. + Invalid/reversed timestamps are refused and delayed old receipts cannot move + the mirror backward. The presentation boundary is now plain: `swarm overview` is a generic compact read-only projection. Gjallar is a downstream TUI application on Nightwing and is not an Epiphany organ, provider, owner, runtime, or architectural dependency. Eve/CultUI graphs may be lowered or composited downstream without Epiphany caring which presentation client does it. diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 5c4126b18d1086887b98376ae233fa4632ccadce..4da356351818b0b3735cd0dfe6fa9d8c038a02f1 100644 GIT binary patch delta 633 zcmdT=u}T9$5Opu{1nmVmA_KPWk=#Wk5riO!jg44|&FZeXh0U(+ZgQjwV&M-M?+fe& z3$?Mdv9Pfb#KO+Ma4zT{*jPMfn0+(v?fbfqt{BJd74}4g{8UFE{5H$%`{D0P%b!Nnu9i4i!SqWAV6wl4w%9h zD*zkGQH-wx7m5w>xKTWX$w3EJ^qAC;N#~6nLN0w~`X0w!E1Z+Mi}Iz@7&^tqdpLiP zf|7@pA-5bmIAP8$qvnz7^OBC+)ErY|Ir=ZHNj