Repository navigation
feat(recovery): W3-02f startup recovery before DB open - #425
Merged
Merged
Conversation
Startup now reads update-recovery.json before init_store and the queue dispatcher: an interrupted install is validated against the journal's nonce, binary and database, writes resume only after that check, a failed check restores the backup, and any other outcome refuses to open the database so writes stay blocked. Test-First: src-tauri/src/delivery_recovery/startup.rs::delivery_recovery::startup::tests::no_journal_opens_without_any_effect Test-First: src-tauri/src/delivery_recovery/startup.rs::delivery_recovery::startup::tests::interrupted_install_is_validated_then_resumed_before_open Test-First: src-tauri/src/delivery_recovery/startup.rs::delivery_recovery::startup::tests::wrong_nonce_binary_or_database_blocks_writes Test-First: src-tauri/src/delivery_recovery/startup.rs::delivery_recovery::startup::tests::recovery_needed_restores_and_keeps_writes_blocked Test-First: src-tauri/src/delivery_recovery/startup.rs::delivery_recovery::startup::tests::live_validate_reports_the_observed_files_and_the_journal_nonce Test-First: src-tauri/src/main.rs::tests::update_recovery_runs_before_the_database_and_the_dispatcher Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flagged the string literal passed as nonce in the test as a hard-coded cryptographic value. Test-only change; the nonce is now built at runtime. No-Test: test-only change, behaviour covered by the existing test Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Cuarroc
marked this pull request as ready for review
October 5, 2026 01:41
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…atch Review finding (kimi-k3 F1): the denylist let any future UpdatePhase variant default to writes allowed. Behavior is unchanged today. No-Test: behavior-preserving refactor, covered by the existing startup tests
Cuarroc
added
the
review-ok
Owner
Author
|
@Mergifyio queue |
12 tasks done
Contributor
Merge Queue Status
This pull request spent 12 minutes 48 seconds in the queue, including 12 minutes 31 seconds running CI. Required conditions to merge
|
This was referenced Oct 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Beim Start liest ProjectA jetzt zuerst das Update-Journal, noch bevor die Datenbank geöffnet oder die Warteschlange gestartet wird. Ein unterbrochenes Update wird gegen Nonce, Programmdatei und Datenbank geprüft, erst danach darf wieder geschrieben werden. Stimmt etwas nicht oder war eine Wiederherstellung nötig, öffnet die App die Datenbank nicht und es wird nichts geschrieben.
Report
What changed (299 diff lines incl. tests, base
e3bd932, which is origin/main at fetch time)delivery_recovery/startup.rs:recover_before_opendrives the existingRecoveryDriver(validate -> resume writes; restore / quarantine onRecoveryNeeded) and returnsErrunless the journal is pre-install or has resumed writes.LiveEffectsanswers the handshake from the running exe and the DB file (sha256, journal nonce); install, backup, promote are refused at startup.main.rs:delivery_recovery::recover_at_startup(&dir)?runs right beforeinit_store, hence before the dispatcher; anErraborts setup.Evidence
bash scripts/ci/gates.sh lane prepushat HEAD9815d5b: exit 0 (log /tmp/w3-02f-prepush.log, local).cargo test --bin projecta startup: exit 0, 5 new startup tests + source-order testupdate_recovery_runs_before_the_database_and_the_dispatcher.Test-First: path::nametrailers, one per test.git ls-remote=9815d5b.Architecture drift: no new findings, no allowlist change.
NICHT ABGEDECKT
#[cfg(windows)]tests; Windows lane runs in the merge queue).LiveEffects::validatechecked with temp files, not with a real installed binary.RecoveryNeeded(no close/acknowledge transition exists), so the next start blocks again until a human or a follow-up package closes it.quarantineis a no-op effect plus block. The "health" assertion is the identity/DB-hash match, not a DB open (it runs before the DB opens).Review: done, see Review disposition below.
🤖 Generated with Claude Code
live_validate_reports_…wird zur Laufzeit gebildet statt als Literal (CodeQL "Hard-coded cryptographic value", startup.rs:277). Nur Test,gates.sh lane prepushExit 0, Linux-Lauf; Windows-Bahn läuft in der Merge-Queue.Review disposition
Candidate reviewed:
2e33ee6; fix commit1bffd67(prepush at1bffd67: exit 0, 376 s, Windows half only). Reviewers (Ollama Cloud, via.pa/review_transport.py; author family is Claude):kimi-k3:cloud,glm-5.2:cloud. Driver: Claude (verified every finding against the code).startup.rs:45-54, write gate is a denylist): partly refuted, hardened.UpdatePhasehas noQuarantinedvariant (delivery_recovery.rs:124-135), so no reachable phase bypasses the gate today. The future-variant risk was real, so accepted: gate is now an exhaustivematch(commit1bffd67, behavior unchanged,No-Testtrailer).startup.rs:101, handshake echoes the nonce): confirmed, accepted as wording only. The startup identity binding is the exe and DB sha256, not the nonce; the PR claim "gegen Nonce geprüft" is just the driver's own comparison. No code change; real nonce passing needs the helper process (follow-up with W3 install package).startup.rs:122-124,restoreignores its arguments): rejected.restore_previous_runtimerefuses unless the action equalsjournal.next_action()(restore.rs:19) and unless writes are not resumed (restore.rs:16), so a diverging journal fails closed.9815d5b): accepted.2e33ee6only changed a test nonce; evidence is now bound to1bffd67(see above).main.rsseam is held by this PR alone (diff is 15 lines).