feat(lifecycle): integrate tenant-safe administration and durable artifact cleanup - #283
Conversation
|
Warning Review limit reached
Next review available in: 14 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (24)
Comment |
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
I will not approve the PR or claim passing verification until the exact-head checks and required repository protections provide evidence.
|
052130c to
bac871a
Compare
|
@coderabbitai review @opencode-agent @cwl-noema-review Please independently review exact current head |
|
I will verify the specified Slice C behavior, test coverage, inherited isolation and replay invariants, and dependency/workflow/release boundaries. I will not approve the PR or report passing protection evidence unless the exact-head checks and all required protections are complete.
|
|
@coderabbitai @opencode-agent @cwl-noema-review Please perform a fresh formal review of exact clean head |
seonghobae
changed the title
|
Closing unmerged as superseded. The exact durable-cleanup worker, receipt foundation, tenant-safe administrator ancestry, tests, and documentation are now fast-forward integrated into PR #268 exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base='3396c03a458294175006efd0c9cea35d6911d55c'
head='bac871ab0f5c89237e7afdd9ad7f0cc7132a644f'
echo '== exact revisions =='
git rev-parse "$base" "$head"
echo '== ancestry / commit count =='
git merge-base "$base" "$head"
git rev-list --count "${base}..${head}"
echo '== changed files =='
git diff --name-status "$base" "$head"
echo '== stat =='
git diff --stat "$base" "$head"
echo '== Java symbols in changed Java files =='
git diff --name-only "$base" "$head" -- '*.java' | while IFS= read -r f; do
echo "--- $f"
ast-grep outline "$f" --items all --view compact || true
done
echo '== changed non-Java text files (first 220 lines each) =='
git diff --name-only "$base" "$head" -- ':!*.java' | while IFS= read -r f; do
echo "--- $f"
sed -n '1,220p' "$f"
doneLength of output: 44097 🏁 Script executed: #!/bin/bash
set -euo pipefail
files=(
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionCoordinator.java
src/main/java/com/clearfolio/viewer/artifact/LifecycleFencedArtifactStore.java
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactLifecycleLockRegistry.java
src/main/java/com/clearfolio/viewer/service/DurableDocumentDeletionService.java
src/main/java/com/clearfolio/viewer/controller/AdminController.java
src/main/java/com/clearfolio/viewer/config/ArtifactStoreConfig.java
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionMetrics.java
src/main/java/com/clearfolio/viewer/ClearfolioViewerApplication.java
)
for f in "${files[@]}"; do
echo "===== OUTLINE: $f ====="
ast-grep outline "$f" --items all --view signatures || true
echo "===== SOURCE: $f ====="
cat -n "$f"
doneLength of output: 56560 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Receipt, repository, and artifact symbols =='
rg -n -C 3 --type java \
'(interface\s+ArtifactDeletionReceiptStore|class\s+.*ArtifactDeletion.*Receipt|record\s+ArtifactDeletionReceipt|interface\s+ConversionJobRepository|class\s+.*ConversionJob.*Repository|interface\s+ArtifactStore|class\s+(FileSystemArtifactStore|InMemoryArtifactStore)|ArtifactDeletionReceiptStore\s+\w+\s*\()' \
src/main/java
echo '== Relevant coordinator tests: method map =='
for f in \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionCoordinatorTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionCoordinatorCoverageTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionGlobalRetryTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionRecoveryBoundTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactLifecycleSerializationTest.java \
src/test/java/com/clearfolio/viewer/artifact/LifecycleFencedArtifactStoreTest.java \
src/test/java/com/clearfolio/viewer/controller/AdminControllerTest.java \
src/test/java/com/clearfolio/viewer/service/DurableDocumentDeletionServiceTest.java; do
echo "--- $f"
ast-grep outline "$f" --items all --view signatures || true
done
echo '== Coordinator diff with context =='
git diff --unified=80 3396c03a458294175006efd0c9cea35d6911d55c bac871ab0f5c89237e7afdd9ad7f0cc7132a644f -- \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionCoordinator.java \
src/main/java/com/clearfolio/viewer/artifact/LifecycleFencedArtifactStore.java \
src/main/java/com/clearfolio/viewer/config/ArtifactStoreConfig.java \
src/main/java/com/clearfolio/viewer/controller/AdminController.javaLength of output: 50753 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '== Receipt and repository contracts/implementations =='
for f in \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceiptStore.java \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionReceipt.java \
src/main/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionLedger.java \
src/main/java/com/clearfolio/viewer/repository/ConversionJobRepository.java \
src/main/java/com/clearfolio/viewer/repository/InMemoryConversionJobRepository.java \
src/main/java/com/clearfolio/viewer/artifact/ArtifactStore.java; do
echo "--- $f"
cat -n "$f"
done
echo '== All new lifecycle test methods and relevant assertions =='
for f in \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionCoordinatorTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionCoordinatorCoverageTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionGlobalRetryTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactDeletionRecoveryBoundTest.java \
src/test/java/com/clearfolio/viewer/lifecycle/ArtifactLifecycleSerializationTest.java \
src/test/java/com/clearfolio/viewer/artifact/LifecycleFencedArtifactStoreTest.java; do
echo "--- $f"
rg -n -C 12 \
'(void\s+\w+\s*\(|ABSENT_ARTIFACT_CHECKSUM|absence|absent|checksum|mismatch|deletePdf|putPdf|retryPendingWork|resumeReceipt|pendingReceipts)' \
"$f"
done
echo '== Other ArtifactStore injection and direct construction sites =='
rg -n -C 4 --type java \
'(new\s+(InMemoryArtifactStore|FileSystemArtifactStore|LifecycleFencedArtifactStore)\s*\(|ArtifactStore\s+\w+|\.putPdf\s*\(|\.deletePdf\s*\()' \
src/main/java src/test/javaLength of output: 202238
I confirmed the one-commit relationship and 24-file scope. I found no dependency, workflow, packaging, release, or deployment drift. Actionable finding
The reviewed source implements the receipt-first tombstone flow, controlled failure states, bounded recovery selection, tenant and global repeat handling, bounded-elastic DELETE execution, same-process lifecycle locking, and post-receipt write rejection. I did not approve this Draft PR. I did not infer the unavailable CI, Security Scan, SAST, Strix, Maven/JaCoCo/Javadoc, or independent-approval evidence.
|
1 participant
Objective
Part of #263, Slice C. Integrate durable artifact cleanup on exact receipt foundation v2. This Draft connects authorized deletion to receipt-first metadata tombstoning, exact-digest cleanup, restart and scheduled recovery, repeat-request idempotency, WebFlux-safe blocking isolation, and a conversion/deletion generation fence. Slice D truthful HTTP status, signed-link revocation, and accessible viewer state remain out of scope.
Exact clean stack
Exact current head is
bac871ab0f5c89237e7afdd9ad7f0cc7132a644fon exact foundation #282 head3396c03a458294175006efd0c9cea35d6911d55c.Fresh comparison reports:
The foundation's strict replay hardening is inherited through clean ancestry rather than copied into this worker slice. Predecessor #279 and pre-reconstruction #283 checks, reviews, comments, and SHAs are not counted.
Bounded implementation
ArtifactDeletionCoordinatorpersists intent before metadata tombstoning, validates exact SHA-256 or the documented absence sentinel, records controlled read/delete/mismatch failures, and replays bounded incomplete work at startup and fixed delay.LifecycleFencedArtifactStorerejects everyputPdfafter a durable receipt exists. An in-flight publication that wins first is snapshotted and deleted; a later publication fails closed.Mono.fromCallable(...).subscribeOn(Schedulers.boundedElastic()), outside the WebFlux event loop.DurableDocumentDeletionServicedelegates every non-deletion method to the existing conversion service and routes deletion through the durable coordinator.docs/operations/artifact-deletion-cleanup.mdrecords privacy-safe signals, alert thresholds, investigation, restart, rollback, multi-instance fencing, and release-evidence boundaries.Deterministic verification contract
Tests cover receipt-before-mutation ordering; tenant concealment and repeated DELETE idempotency; read, delete, checksum, and absence paths; restart replay and configured recovery bounds; global retry after metadata tombstoning; write-after-receipt rejection; in-flight publication/deletion serialization; per-job lock exclusion with started-task latches; bounded-elastic DELETE execution; service delegation; filesystem restart persistence and in-memory volatility; low-cardinality aggregate evidence; SHA-256 provider absence; and defensive construction paths.
Exact-head acceptance state
For exact current head
bac871ab0f5c89237e7afdd9ad7f0cc7132a644f:31103589281completed successfully across all required targets;PR #279 was closed unmerged as superseded; none of its evidence is transferred. Keep this PR Draft. Parent order remains #270 → reconciled #268 → #282 → this clean Slice C. Do not resolve #268's upstream incomplete-cleanup finding or claim product-level physical deletion completion until the entire stack is reconciled onto protected
mainand passes every exact-head protection. Do not weaken tests, infer approval from status-only evidence, bypass protections, or publish a release.