38 lines
4.2 KiB
Markdown
38 lines
4.2 KiB
Markdown
|
# Artifact recovery independent review — 2026-09-06
|
||
|
|
|
||
|
|
## Scope and finding
|
||
|
|
|
||
|
|
Read-only review covered artifact lifecycle drafts and UI, actual Owner/Presence slot composition, exact history reset, and semantic recovery admission. The material finding was a fresh artifact picker that asked `Project::layer_of` about an ArtifactLink identity; that API resolves elements/relations, so ordinary artifacts disappeared unless selected/history state reinserted them. The implementation worker changed the test to start from an empty editor and corrected filtering to inspect the artifact owner, including neutral owners. `.local/source6-artifacts-final-tests.log` observed the failure; `.local/source6-artifacts-final-tests2.log` confirms all six artifact tests pass after correction.
|
||
|
|
|
||
|
|
No additional material mutation-scope defect was found. This conclusion is bounded to the inspected code and those tests. Native artifact creation/deletion and minimum-size controls are not established by this review. The Owner candidate picker enumerates all identities without search or pagination; large-model usability remains a limitation to evaluate.
|
||
|
|
|
||
|
|
## Independent stored-payload falsifiers
|
||
|
|
|
||
|
|
Added `crates/oa-desktop/src/semantic_review/artifacts_recovery_falsifier_tests.rs`, registered only as a test module. The fixture authors a reservation and eight explicit reviews through normal addressed events. It then stores version-2 JSON through `State::recovery_snapshot` and restores through `State::from_recovery`. Tests do not construct private recovery DTOs or call their private admission helpers.
|
||
|
|
|
||
|
|
Four tests cover both OA→SA and SA→OA:
|
||
|
|
|
||
|
|
| Test boundary | Explicit probes and oracle |
|
||
|
|
| --- | --- |
|
||
|
|
| Reservation admission | Duplicate seed; existing source identity with its correctly corresponding generated alias; wrong owner; wrong alias. Each must refuse restoration. |
|
||
|
|
| Authored draft admission | Owner encoded with the wrong Raw variant; duplicated exact facet address; unknown artifact payload field. Each must refuse restoration. |
|
||
|
|
| Destination identity admission | Unreserved nonexistent UUID and an existing element UUID substituted into an artifact draft address. Each must refuse restoration. |
|
||
|
|
| Legitimate rejected input | Invalid Owner text, absent Revision with retained multiline text, and explicitly present empty Fragment survive exact snapshot round-trip. No command is available until explicit Owner repair. Restored and uninterrupted reviews then prepare identical full projects and canonical sources. Accepted project/source remain unchanged, with no reserved artifact created by restore or preparation. |
|
||
|
|
|
||
|
|
Each refusal also checks the original authored snapshot and accepted project/source remain unchanged and the legitimate invalid draft remains non-executable. Assertions do not depend on a particular diagnostic string.
|
||
|
|
|
||
|
|
## Evidence status
|
||
|
|
|
||
|
|
**Verified: all four tests pass**, covering both transition directions, with 518 other desktop tests filtered out. Windows command (root-authorized exclusive Cargo lease):
|
||
|
|
|
||
|
|
```powershell
|
||
|
|
. .local/toolchain/env.ps1
|
||
|
|
cargo test --workspace --locked artifacts_recovery_falsifier_tests
|
||
|
|
```
|
||
|
|
|
||
|
|
`.local/artifact-recovery-falsifier-tests2.log` records exit 0, 22.24 seconds incremental compilation, and 3.36 seconds for the four tests. Other workspace test binaries selected zero tests; this is a focused result, not a new full-workspace pass. The Windows Cargo lease was released immediately afterward.
|
||
|
|
|
||
|
|
The first run compiled successfully but failed all four tests at a fixture helper that incorrectly assumed the checkpoint contained one row. Switching direction correctly retains the prior direction's row. The test helper now finds exactly one row by the checkpoint's active RowAddress before altering its artifact payload. `.local/artifact-recovery-falsifier-tests.log` preserves that initial test-only failure. No production behavior changed; the only existing-source edit is the new `#[cfg(test)]` module declaration. Owned test formatting and scoped diff checks passed.
|
||
|
|
|
||
|
|
These probes do not cover every malformed payload, crash durability, all size limits, or source-version migration. Existing outer fingerprint/size checks were inspected; this addition specifically falsifies the artifact payload admission gap identified during review.
|