Conversation
Make the workload Envoy the owner of a single PTY and separate terminal bytes from structured operation telemetry over lease-private channels. Specify Reploy bootstrap, runtime mounting, dynamically published private Envoy endpoints whose container ports and launch command are reserved from application override, direct cast and raw-output handling, trust boundaries, implementation slices, and acceptance gates. Define ordered controller-synthesized prompt and command presentation without treating those events as workload bytes. Define real, suppressed, and replacement-output publication over retained private byte ranges, exclusive checked ranges that exclude authored-input echo through raw-log spans closed on an output-side drain rather than on a racy terminal-mode reading or an input-side boundary, and that admit no surviving output writer, typed workload-side filesystem inspection, and controller-observed readiness raced against long-running operation termination. Preserve legacy output assertions through split logical stdout/stderr evidence for non-interactive operations and exact post-line-discipline PTY output for interactive operations. Preserve incremental realtime output while buffering and retiming presentation output after completion and the logical post-enter pause. Distinguish planned recording-end finalization, which validates non-exit assertions after termination and drain, from failure or user cancellation. Keep the shell's own behaviour when operation source ends it: exit, errexit, exec, and a crash are one outcome carrying the status the Envoy reaps as the shell's parent, which operation source cannot overwrite with an EXIT trap of its own, leaving the operation's complete range to non-exit assertions — but not when its own policy or an authored gate says otherwise, so a writer surviving a suppressed, replaced, or checked operation still fails it, and an operation that declared inspections fails rather than finishing with them unevaluated. Bind authored terminal input to the operation it was authored for, since the unframed channel carries no identity of its own, and carry a written-byte count on execute so an operation cannot start while input for the previous one is still in flight on a separate connection. Resolve a control request that crosses its own operation's terminal result against that result instead of failing the capture. Carry output stream identity and timing as sender-stamped output marks over raw-log offsets, so recorded timing is assigned by the Envoy rather than derived from controller arrival times, and assertion evidence is the complete retained output rather than a bounded copy. Presentation-timed operations remain the deliberate exception, require exclusive observation so no surviving writer can push their compressed schedule back out to wall-clock, and publish on their authored schedule, and a signed session offset re-anchors at every return from an authored schedule to sender time, taking its anchor from the first Envoy-stamped operation boundary rather than from the next event to arrive, so neither a discarded command duration nor controller scheduling becomes a cast pause while a slow command's own startup delay survives at its real length; output surviving from an earlier unchecked real operation publishes under that operation's policy; and one monotonicity rule keeps the merged cast from rewinding. Define the field shape of a failure that occurs before an operation starts. Bound the private raw log per session and fail the capture at the bound rather than truncating it, frame produced-directory digests over fixed-size per-entry hashes so distinct trees cannot collide without a SHA-256 collision, and report no status when an operation is cancelled before it starts. Documentation only. The awsh persistent-Bash feasibility prototype and its focused tests are delivered separately in #18.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
You have reached your Codex usage limits for security reviews. Please try again later. |
Successor to the approved design slice: PR #1 may not be rewritten, so the round-1 findings of the local deep-design-review trail land here. Contract changes: resize is legal in the continuing state so a controller may pipeline continue and resize; concurrently tracked descendants gain a budget (4,096 per operation) with the typed tracked-descendant-limit failure; a recording that ends while an operation waits at the terminal- input barrier cancels it rather than finalizing; ready carries elapsed_us 0, defining the epoch; and operation_failed carries one of a closed v1 code set, freezing the failure-class codes B1 would otherwise invent. Documentation corrections: the trusted implementation boundary is anchored to the rebuilt stack's base on main instead of the reused PR number 8; the launch-affecting environment-name enumeration is owned by the Reploy environment design and referenced from the other two sites; the re-anchor summary covers the pre-start boundary; the delivery-phase summary matches the plan's five phases; the progress ledger records A1 as approved; and the freshness stamps reflect the amendment dates. Trail: temp/reviews/pr-1 (rounds 1-2, findings R1-1 through R1-11, all accepted by owner disposition on 2026-08-20). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Successor to the approved design slice: PR #1 may not be rewritten, so the
round-1 findings of the local deep-design-review trail land here.
Contract changes: resize is legal in the continuing state so a controller
may pipeline continue and resize; concurrently tracked descendants gain a
budget (4,096 per operation) with the typed tracked-descendant-limit
failure; a recording that ends while an operation waits at the terminal-
input barrier cancels it rather than finalizing; ready carries elapsed_us
0, defining the epoch; and operation_failed carries one of a closed v1
code set, freezing the failure-class codes B1 would otherwise invent.
Documentation corrections: the trusted implementation boundary is anchored
to the rebuilt stack's base on main instead of the reused PR number 8; the
launch-affecting environment-name enumeration is owned by the Reploy
environment design and referenced from the other two sites; the re-anchor
summary covers the pre-start boundary; the delivery-phase summary matches
the plan's five phases; the progress ledger records A1 as approved; and
the freshness stamps reflect the amendment dates.
Trail: temp/reviews/pr-1 (rounds 1-2, findings R1-1 through R1-11, all
accepted by owner disposition on 2026-08-20).
Co-Authored-By: Claude Fable 5 noreply@anthropic.com
Stack created with Sapling. Best reviewed with ReviewStack.