Repository navigation
ElastOS 0.7: protected-content foundation, collaboration, and runtime lifecycle - #38
Merged
Merged
Conversation
Add the canonical system-map navigation, layered C4 model, hash-bound interactive viewer, and code-path index. Define human/agent parity, durable task and approval recovery, model-provider lifecycle, and private-network membership without collapsing Profile identity, capsules, transport, or Runtime authority. Clarify destination admission and the first-party dKMS-over-Carrier boundary.
…view/collaboration-candidate
Review checks: cargo test -p elastos-server browser_reconciliation. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: node --test capsules/library/browser/src/events.test.mjs; node scripts/library-menu-smoke.mjs. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: node scripts/library-product-layout-smoke.mjs. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: cargo test -p elastos-server gateway_home_terminal; node scripts/home-cli-browser-smoke.mjs; node scripts/home-cli-fallback-recovery-smoke.mjs. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: cargo test -p elastos-server runtime_control; cargo test -p elastos-server home_cmd. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: cargo test -p elastos-server home_cmd; node scripts/home-cli-browser-smoke.mjs. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: node scripts/home-shell-recovery-smoke.mjs; node scripts/home-shell-post-attach-recovery-smoke.mjs; node scripts/home-shell-switchback-recovery-smoke.mjs. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: cargo test --manifest-path capsules/home-cli/Cargo.toml; node scripts/inbox-product-behavior-smoke.mjs. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Review checks: git diff --check. Rust workspace commands run from elastos/. Installed product acceptance is tracked separately.
Keep protection and create-only behavior unchanged while satisfying the workspace Clippy argument limit. Verified: full workspace Clippy, cargo check and workspace tests with Rust 1.91.0 and warnings denied; all 25 capsule workspace suites.
Read the checkout manifest directly in the content test. Keep the extracted collaboration setup fixture rooted in the repository and reuse the existing toolchain. Record remaining platform CI and installed acceptance gates. Verified: full workspace tests, Clippy and cargo check with warnings denied; collaboration setup smoke; source gates and formatting.
Keep all 61 findings, seven sheets and 1046 formulas. Replace 75 private evidence paths with labels, reconcile stale merged notes and identify the installed audit snapshot separately from later PR39 source. Verified: full XLSX package privacy scan, cell/formula/metric and conditional-style comparison, all-sheet visual review, and Home entropy checks.
…tion mark A crash between the protect session's close settlement and mark_intent_completed leaves the runtime mint intent at SettledBeforeDraft(Closed) while every durable step of the mint (draft, custody provisioning, availability evidence) may already be persisted. The deterministic intent identity then bricks the source object permanently with "Runtime custody mint was settled before draft persistence" (ELACITY-2307). The intent never records a mint id before completion, so recovery re-links the two through their shared content-access identity: RuntimeMintJournal::find_mint_record_for_intent performs a bounded, validated scan under the store lock and matches on content_access_id plus the full custody selection (nodes, pool, epoch, committee), failing closed on ambiguity and unreadable records. publish_runtime_custody_library_object now adopts the record for a Closed-settled intent when it is fully terminal (custody provisioned, availability recorded): the intent is completed and the publish returns the same completed facts a normal replay would. A record that is not fully terminal cannot roll forward (the content key material is gone), so it fails closed with the reconciliation-required message and the orphaned custody evidence logged via tracing. With no record at all the terminal abort stands unchanged, so the existing settled-before-draft expectations keep holding. Covered by five journal unit tests for the new lookup and two server regression tests seeding the exact crash state, one per window.
Keep Recovery and Profile ownership explicit, record the planned content-capsule distribution and WSL-first contracts, and retain current source and installed readiness limits. Carry the reviewed documentation from f4ebe53, b513eee and 17fc7de without their stale release-state claims. Record the remaining Carrier and logger integration work.
Require 10% free source/data volume capacity before builds. Retain one default Browser VM backup set and reject invalid retention before mutation. Remove the private Runtime staging directory on success and controlled failure; preserve the original build. Verified: installation receipt smoke; collaboration configuration, capacity and retention smoke; Mac restart fixture including pre-existing recovery data; shell syntax.
Preserve the operator rules and align the current source, PR stack and deferred work across the active documentation. Separate source integration from installed acceptance and release publication; correct the request-framing security note and the matching documentation guards.
Remove release and branch snapshots from general documentation and retire the duplicate protected-content extraction ledger. Keep current proof in state.md, open work in TASKS.md, and contract and artifact identifiers with their owners. Replace assertions that required stale prose and reject release snapshots in standing docs.
Anders' privacy-reviewed Home journey workbook becomes the standing reference for stability and correctness. An e2e-audit skill carries the working rules and a stdlib workbook reader, AGENTS.md gains the Journey Register Gate, and TASKS.md records the automated pre-release extraction of scriptable journey checks.
This was referenced Aug 31, 2026
3 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR tracks the 0.7 release line: everything reviewed and integrated on
upstream/0.7-dev, proposed formain. Merging is the chain owner's decision; this PR exists so the remaining 0.7 work is visible and checkable in one place.What this contains
review/collaboration-candidate(PR Collaboration implementation #16 line) including thedocs/system-mapmerge and thebrowser-local-exitorphan-reaping hotfix (PR fix(browser): reap browser-local-exit when its launching Runtime dies #24) — the base reconciliation.just test-elastos/test-capsules/test-all, provider process binaries built--releaseand wired into CI, the system-map and provider-inventory gates wired intojust verify.drm/rights/key/decryptcapsules remain the registered product path — the retirement guard (scripts/protected-content-provider-contract-smoke.sh) stayed green at every checkpoint and on this tip.Remaining for 0.7 completion
Working checklist — items get checked as they land on this branch:
0x3b6= 950 ROYALTY_SHARE units out of 1000 (creator 95%,protocolShares()= 50 → protocol 5%); constant renamed…ROYALTY_SHARE_UNITS(commit 90bbe15).mark_intent_completedleaves the source object permanently unmintable with orphaned custody shares; needs intent-state adoption or an earlier completion mark.Provision installed custody + chain prerequisites (ELACITY-2297): signed owner-only 3-node 2-of-3 custody composition, private multi-source Chain config with funded accounts, packaged protect + custody + decrypt via installer/ProviderRegistry — includes registering→ moved to Provision installed custody and chain prerequisites (ELACITY-2297) #44protected-content-decrypt-provider(ships but is currently unregistered; play fails closed) and wiringreconcile_runtime_custody_viewers_after_decrypt_registrationat boot.Installed inactive e2e proof (ELACITY-2298): 3 replicas + repair-after-loss on the installed product path.→ moved to Installed inactive e2e proof: 3 replicas and repair-after-loss (ELACITY-2298) #45Atomic cutover (ELACITY-2299): remove the provisional→ moved to Atomic cutover: retire the provisional drm/rights/key/decrypt surface (ELACITY-2299) #46drm/rights/key/decryptsurface in one step — no parallel decoders, no compatibility path.Installed acceptance (ELACITY-2300): one Runtime, two principals, mint → buy → play end to end.→ moved to Installed acceptance: one Runtime, two principals, mint → buy → play (ELACITY-2300) #47PQ / external cryptographic review (tracked in TASKS.md): the contracts + custody crates (canonical codec, EIP-191 recovery, HPKE/Shamir, golden vectors) have had internal review only.→ moved to External / PQ cryptographic review of the protected-content contracts and custody crates #48PR feat(protected-content): runtime lifecycle — mint, buy, play, purchase closeout #36 secondary flags:→ moved to PR #36 secondary flags: buy granularity, ledger file discipline, ProviderBridge lifecycle #49buycapability granularity + ERC-20 approval-stage idempotency; purchases-ledger file discipline (flock/O_NOFOLLOWparity with the mint journal); unbound-vs-pending signal at the Runtime layer; docs posture ("not wired" vs the liveobject://…/buysurface);ProviderBridgelifecycle-state refactor (Attached/Spawned/ShutDowninstead ofOption<Child>+ flag).Close the stacked PRs (Collaboration implementation #16, feat(collaboration): signed network protocol, Carrier transport, Profile authority #27–feat(protected-content): runtime lifecycle — mint, buy, play, purchase closeout #36) once this line merges — their content is contained here.→ moved to Close the stacked PRs #16, #27–#36 after the 0.7 line merges to main #50Verification at this tip
Full workspace suite + all 25 own-workspace capsule suites +
elastos/tools/browser-local-exit: zero failures. Alignment, entropy, system-map, vendor-ui, close-handshake, product-UI proofs, and the provisional-retirement guard: green.state.md/TASKS.mdcarry the review-complete truth.