Handoff: Finish required CI and native attempt verification for the stream name policy

Updated 2026-10-23T08:23:37.260717+00:00.

RE-VERIFY: Write-time snapshot. Read https://github.com/CodexCoder21Organization/UrlProtocol/pull/857 state/head/checks and fetch current main before acting. Last GraphQL check at08:22UTC: OPEN, unmerged, head21f8625a; buildSUCCESS, testsIN_PROGRESS. No merge or enqueue is authorized.

Design decisions in force

Owner request, 2026-10-21, carried verbatim in the lane brief: "Then, do another round, Your goal is to add end-to-end integration tests which identify bugs (the tests should initially fail), and then fix the bug in the implementation."

Lane direction, 2026-10-22: "Validation of the peer-ID format must be decided by whoever owns the identity format (the provider / transport layer that produced it), not hard-coded into the generic decoder — or the generic decoder must accept exactly what the generic announcement path accepts while the libp2p-specific path keeps its strict check. Keep the earlier fixes: malformed IDs still rejected where the format is known, relay listener survives a bad message, descriptive error messages with the offending value. Public API must stay backwards compatible."

Lane limits, verbatim: "You may not merge, enqueue, publish artifacts, deploy, restart services, or delete/rerequest buildtest runs." "Never raise timeouts, cut iterations or weaken assertions." Local commands only: scripts/build.bash --local and scripts/test.bash --local --test <name> --log <file.xml>. Do not use mocks, reflection, disabled/skipped/deleted tests, private-to-public changes, or JVM tuning flags. A pass counts only if the first attempt passed and native XML has no attempt-history. GitHub status polling is limited to once per two minutes; use build-watchman in plain watch-only mode. These requirements continue to bind the remaining work.

The BUG8i brief also requires first-attempt six-test passes in three rounds, a mutation removing the libp2p rule, one locked full suite with counts, then a leased PR push, JSON PATCH/readback and required-check watching. It caps the lane at four hours and CI watching at90minutes. GitHub polls at most once per two minutes. Evidence belongs only on WIP branches. Commits end Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>; PR descriptions end 🤖 Generated with [Claude Code](https://claude.com/claude-code).

Remaining work and current state

Finish watching required Actions on head 21f8625a1cc63aecb71356f26c9dce4d41fe3d12, inspect native test-attempt-history XML, PATCH/read back PR evidence, preserve evidence, stop owned local monitors and leave the PR open. Current build passed; tests are running. Watcher stopped at08:20UTC2026-10-23 with exit124 at the lane cutoff; source is already pushed and body readback matches. Do not repush unchanged source or rely on old-head green checks. No CI run was cancelled, rerun or rerequested.

What the continuation established

• The former concrete-provider check lost policy under Kotlin delegation. Public GossipInputStream now carries an optional name rule, default accept-any; Libp2pRpcStream supplies the libp2p rule. UrlProtocol decodes once and applies the input rule before classification/dispatch. Delegation retains it. Explicit adapters may replace it to support opaque names. Existing provider/stream interfaces are unchanged. Generic parse/announcement parity, relay checks, bad-frame listener continuity and bounded descriptive errors remain.
• Prior candidate 5b41cdc16 had an independently reviewed implementation, and its three new regressions each failed all three attempts on oldPRhead3fb (9/9 failures). BUG8i recovered the previous six-test run:5/6; the opaque-policy case failed all three attempts because CLEAN observations intentionally coalesce within a15-minute bucket. The test expected two entries in one bucket. BUG8i injected ManualClock only into PeerRegistry, asserted the announcement entry, advanced exactly the public bucket duration and retained the exact final two-entry assertion. No production clock/timeout/assertion/iteration was loosened.
• Corrected source snapshot 2099e158c: six tests in three rounds 18/18first-attempt passes, no histories. Removing only the libp2p stream validator made the three new regressions fail all three native attempts (9/9failures). Exact source restored afterward.
• One full suite under machine-wide flock waited57m31s then ran48m13s, completed06:49:15UTC. Native aggregate3194/3194exit0, but first-attempt3192passes and2failures (both second attempts passed). This is not a clean full-suite proof. All45added/modified PR tests passed attempt1. Full XML, all stacks, phase/memory, changed-case audit. Global oom16/oom_kill1 unchanged; final shared memory10730471424bytes against10737418240limit.
• Wider failures: testAnnouncementFloodChurnReturnsResourceBaseline had socket7 instead of6 in cohort85 (64160ms); testRelayReRegistrationCancelsTransportCloseWithdrawalTombstone did not see both initial announcements before any transport close (8005ms). Neither path exercises the new input policy; tests and underlying factory/relay bytes are unchanged. No mechanism/fix or stable failure rate is claimed. Full details/next diagnostic steps are in the separate unclaimed handoff. PHILOSOPHY.md explicitly says a flake found only in a separate wider register does not add to the change's landing bar. This justified the scoped authorized push, without claiming a clean full suite or waiving requiredCI. No rerun was used to fish for a clean result.
• Rebased on main2e9acd78, whose only change since full-run base8da0a86f was publication metadata0.0.1433→0.0.1434. Application/test trees are byte-identical. Fresh 45/45changed scenarios first-attempt pass on actual pushed21f, no histories. XML. Independent fixture/code review found no further issue; working tree clean, no source stash. Generated build outputs removed.
• Fetch/rebase immediately before push was a no-op. PR was OPEN at3fb; explicit force-with-lease pushed21f. JSON API PATCH then GET readback matched full body/head. Body starts with owner's WHY and retains honest3192/2 counts and required footer. Readback.

Final lane snapshot

At08:22UTC the PR is OPEN and unmerged at21f8625a; required bld-build is COMPLETED/SUCCESS and bld-all-tests remains IN_PROGRESS. The final PR body JSON PATCH and GET readback matched body, head and open state. No native CI XML result is counted. Required test job: https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39916724179 . Local watch stopped at08:20UTC after3708seconds, below90-minute cap and before four-hour lane limit. No GitHub job was cancelled/rerun/rerequested. ps -eo pid,args -ww after watcher exit found no process in this checkout. Only remaining work for this CI handoff is the terminal required result/native attempt audit and a final PR evidence update. The wider-failure handoff remains unresolved and unclaimed.

On pickup, re-verify the job/head and clear this handoff's blocked reason once the pending-result condition changes. Do not repeat source tests merely to obtain a green aggregate, and do not merge or enqueue. Complete this CI handoff only when its remaining verification is resolved.

Verified remote branches

git ls-remote snapshot around08:21UTC; evidence branch may advance again to preserve this final update/readback.

No deployed/published-but-unmerged work exists from this lane. Source is committed and remote; generated outputs/caches are deliberately excluded. No source stash/uncommitted work exists. Evidence remains only on WIP branches, never the PR branch.

Required verification procedure

1. Re-verify current head/state. If changed, inspect before applying old evidence. Plain build-watchman0.0.21 with --repo CodexCoder21Organization/UrlProtocol --pr 857 --interval-seconds240 is watch-only; never add --to-merged or enqueue/rerequest flags. Use a tracked hard deadline, clean up processes at exit and confirm ps -eo pid,args -ww.
2. On required success, download run39916724179 artifact test-attempt-history, parse every native <test> and <attempt-history> and report actual counts. BUG8i-ci-xml.py in evidence is prepared; verify its expected head/count first. Zero histories proves first-attempt clean. A retried success is a defect report. If failed, read full job log once and classify exact code/dependency/infrastructure failure, reproduce locally before editing, never blindly rerun CI. Do not mistake informational app state for a required check.
3. Informational kotlin-build-ci-test suite108185337066 is queued with zero dispatched runs (no execution log). Watcher recommends rerequest; that is explicitly forbidden. If it becomes red, read its output once/classify, don't rerun.
4. PATCH PR body using JSON and read back exact body/head/state, preserving WHY/footer and local3192/2 disclosure. Do not rerun the already-used push helper; its old-head lease should reject. Push evidence on WIP only and update this handoff if unfinished. Complete this CI handoff only when remaining verification is resolved; don't complete the independent wider-failure handoff.

Operational knowledge

• All lanes share one10GiB cgroup. Full suite only under flock /tmp/claude-501/complete-suite.lock scripts/test.bash --local --test . --log <xml>, with memory records; no JVM tuning, no kill-and-retry loop. Required Actions workflow itself uses local-and-remote; manual lane runs must remain local.
• GitHub REST reached0/5000 at07:34UTC; reset07:43:07. GraphQL had4923 remaining and confirmed07:36 state. No check verdict inferred during read gap. Watcher polls240s, no status polling above once/2minutes. Recorded challenge.
• Native runner emitted terminal-memory warning for stdout after a final record. Complete stack. It did not change XML result; no test failure is inferred from it. report-challenge automatically merges, forbidden here, so challenge records are on WIP evidence instead.
• PR888 worker-slot pin and PR890 keepalive changes were observed as context, not proven causes/fixes for the two wider failures: https://github.com/CodexCoder21Organization/UrlProtocol/pull/888 and https://github.com/CodexCoder21Organization/UrlProtocol/pull/890 . No dependency/publication action was taken.
• Required reading: whole TESTING.md and PHILOSOPHY.md. Use public real instances, deterministic exact-condition reproducers, one scenario/file, and preserve test strength. Current source/readmes already reviewed. Handoff README's old automatic merge instructions are superseded by current skill and lane prohibition.

Historical diagnostics retained from the earlier lane

The following is historical evidence only, not current head or CI state. Earlier generic opaque-name and mutable-JSON parser diagnoses, prior full-suite counts, and old CI observations must not be attributed to head21f. Current stream policy above supersedes the earlier concrete-provider selection described here.

1. The generic ServiceWithdrawal/RelayWithdrawal codecs imposed a built-in peer-ID format although generic announcements and NetworkProvider promise opaque identity strings. The unchanged reviewer's real two-node opaque-provider test announced/discovered successfully and failed withdrawal on all three runner attempts at original head 196e1ee5. Generic announcement/withdrawal parity also failed all three attempts before fixing code. Native baseline XML is preserved in the evidence branch.
2. Generic codecs now preserve exactly the strings accepted by generic announcements. Known libp2p receive paths validate before application admission: Libp2pRpcProtocol.parseMessage, the package-level internal built-in provider gossip parser selected by UrlProtocol, and RelayService's shared receive parser. Validation preserves accepted base58 and canonical in-memory identities, bounded descriptive errors with the offending value, and bad-frame listener continuity. Public signatures remain compatible. README ownership behavior was updated. No dependency was changed by this lane.
3. Root review found a further public-parser issue: guarding a mutable JSONObject, then rereading it during decoding, could validate one field/type and return another. Two deterministic public-API JSONObject mutation tests failed all three baseline attempts before the correction. The parser now decodes once and validates the immutable returned withdrawal. This is a direct public parser contract test, not a claim that a remote wire mutates an object.
4. Added the unchanged opaque-provider test, a 518-identity generic parity corpus including Unicode/controls/512 KiB strings, real dedicated libp2p gossip malformed-frame checks, and the two mutation regressions. Retained the earlier RPC v1/v1.1, relay both directions, built-in identities, queue/byte bounds and listener-survival coverage. The generic format-whitelist test expectation was refuted by the opaque-provider contract; its full malformed corpus/exact error assertions now run at the public libp2p parser, with generic parity separately enforced. No timeout, iteration count or assertion was weakened.
5. Verification: all 39 changed/neighbour scenarios passed three first-attempt rounds on final rebased 3fb: 117/117, no retry histories (BUG8f-latest-round-{1,2,3}.xml). The final controls on pre-last-rebase b761057489cbbb536dbaf57090f55060395cd59d made nine scenarios fail all three attempts: generic whitelist restored, transport validation removed, and separate JSON guard/parse reads restored. Restoring exact source returned all nine to first-attempt passes. Independent review confirmed relevant withdrawal code/tests are byte-identical after the last rebase; mutation controls were not rerun after it.
6. One completed full suite ran under the machine-wide flock on b7610574, before the final upstream rebase: 3158/3158 first-attempt passes, zero retry histories, exit0, 2538 seconds. Native proof is BUG8f-before-latest-main-full.xml, with full stdout, memory JSON and summary. Shared cgroup memory started at 8,594,497,536 bytes and peaked at a sampled 10,737,377,280; oom_kill stayed1 before/after. An earlier obsolete suite was intentionally stopped before correcting the JSON parser gap; it has no verdict and was not a passing run. An extra final-head full-suite waiter was cancelled before it acquired the lock or launched any test. The lane's requested sequence was one full suite, then rebase and push; full3158 is attributed to b761, not 3fb.
7. Read-only independent test-comprehensiveness and code-review passes found no remaining issue, including the final rebase. Upstream changes at the last rebase affect RPC response writing; withdrawal validation/admission and regression tests are unchanged. Review and final verification manifests are preserved remotely.
8. Immediately before the PR push, fetched/rebased origin/main, verified the PR remained OPEN at expected196e1ee5, pushed with an explicit lease to3fb, then updated body using API PATCH and verified exact readback. No source changes remain uncommitted. No merge/enqueue or production action occurred.

• All lanes share one 10 GiB cgroup. Full suites only under flock /tmp/claude-501/complete-suite.lock scripts/test.bash --local --test . --log <xml>; record memory.current before/every few minutes. Do not tune the JVM or retry an OOM-killed suite in a loop. Targeted tests do not take this lock.
• Required Actions workflow is unchanged and uses --local-and-remote; the lane's own manual runs were local only. Watcher reported an approximately 81-minute median for recent successful test jobs. No stall is inferred merely from pending duration.
• Informational suite 108119604400 was queued with zero dispatched runs on final 3fb. Watcher suggested webhook rerequest; this lane did not do it because the brief forbids it.
• Old-head informational check https://github.com/CodexCoder21Organization/UrlProtocol/runs/120177884130 was read once. It failed before upload: createUploadSessionStructured refused at TcpServer's256-handler allowance, sessions/chunks0. This is an infrastructure submission failure, not a source test failure; why256 handlers remained occupied is unknown. Complete output/report are in evidence. Do not reread or rerun this old check.
• The full local runner logged kompile.TerminalMemoryWarningEffect for output after its final memory record, while native XML/exit still showed3158 first passes/exit0. Complete stacks and stdout are retained. The cause of the later child output remains unknown; no code-test failure is inferred. The report-challenge CLI would automatically merge, forbidden here, so the reports were saved to evidence instead.
• Earlier CI flood timeout https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39853327962 remains unclassified. Later clean controls do not prove its cause. Earlier main response-chunk failures https://github.com/CodexCoder21Organization/UrlProtocol/actions/runs/39766778628 are separate recorded history, not diagnosed by this lane.
• Read full TESTING.md and PHILOSOPHY.md before any new tests: https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/architecture/TESTING.md and https://github.com/CodexCoder21Organization/DocumentationRepository/blob/main/PHILOSOPHY.md . One scenario per file. Commits end Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>; PR body ends 🤖 Generated with [Claude Code](https://claude.com/claude-code).
• Handoff service health returned OK. Current skill uses direct handoff-cli creation, no PR or merge. The handoff README still contains obsolete automatic handoff-PR merging instructions; they are superseded by the skill and explicitly forbidden by this lane.