feat(contracts): finalize cyclic topology and Contracts 1.0 closure execution - #29
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e0dfc897ea
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if (!GasSchedule.CONTRACTS_1_0_SCHEDULE.equals(gas.schedule()) | ||
| || !GasSchedule.CONTRACTS_1_0_PACKAGE_IDENTITY.equals( | ||
| gas.packageIdentity())) { |
There was a problem hiding this comment.
When a caller supplies DocumentProcessor.Builder.gasSchedule(GasSchedule.load(...)) with a manifest having the released schedule and package identity but different raw bytes (even formatting-only differences), this check accepts it and capture() falsely reports CONTRACTS_1_0_RESOURCE_SHA256 as its byte identity. The same processor then fails during closure execution because ProcessorInvocationServices.gasManifestIdentity() requires the singleton returned by GasSchedule.contracts10(). Require that exact byte-bound schedule here as well, or retain and verify the loaded manifest's actual byte digest so descriptor capture and execution agree.
Useful? React with 👍 / 👎.
| if (input.cause().kind() == ProcessingCause.Kind.EXTERNAL | ||
| && input.directDeliveries().isEmpty()) { | ||
| throw new ClosureCapabilityGapException( | ||
| "EXTERNAL_DIRECT_DELIVERY_REQUIRED", | ||
| "The first concrete engine lane requires one accepted direct delivery"); |
There was a problem hiding this comment.
When an external event has no accepted direct delivery, an empty directDeliveries sequence is a valid invocation that must produce the noncommitting NO_MATCH (or, after classification, STALE/TERMINATED) result. This guard instead converts that routine case into CAPABILITY_FAILURE before classification or status selection, so hosts cannot process unmatched external events through the closure API. Remove the accepted-delivery requirement and assemble the appropriate rollback status from the classification result.
Useful? React with 👍 / 👎.
| throw new ClosureCapabilityGapException( | ||
| "LIFECYCLE_TERMINATION_REQUIRED", | ||
| "Termination requires the lifecycle and marker batch lane"); |
There was a problem hiding this comment.
Whenever a managed Handler requests graceful termination, this continuation aborts the entire closure with CAPABILITY_FAILURE. The required behavior is to run the Document Processing Terminated lifecycle, drain already emitted events under the termination cut-off, write the terminated marker, finalize affected components, and commit the successful business transition; consequently any contract using requestTermination cannot complete through the new closure runtime.
Useful? React with 👍 / 👎.
| if (!candidate.rawChannelKey().equals(delivery.channelKey()) | ||
| || !candidate.handlerChannelKey().equals( | ||
| delivery.channelKey())) { |
There was a problem hiding this comment.
When an External Channel's HANDLER_CHANNEL_KEY selects another valid same-scope Channel, classification returns distinct raw-source and handler keys by design, but this condition rejects that valid delivery as CAPABILITY_FAILURE. Delegated/routed channel protocols therefore cannot execute in a closure even though the ordinary runtime supports them; retain the source key for checkpoint ownership and dispatch the seed through the classified handler key instead of requiring equality.
Useful? React with 👍 / 👎.
| if (!stepProcessor.classifyDocumentUpdateRoutes( | ||
| currentDocument, update).isEmpty()) { | ||
| throw new ClosureCapabilityGapException( | ||
| "INITIALIZATION_DOCUMENT_UPDATE_QUEUE_REQUIRED", | ||
| "Initialization-caused Document Update routes are outside the bounded admission lane"); |
There was a problem hiding this comment.
During ADMIT_CLOSURE, an initialization Handler may legitimately apply a patch whose Document Update matches another Handler or emit an application event; both must enter the same causal queues and drain before the initialization marker batch. This branch instead turns any matching update route into CAPABILITY_FAILURE (and onApplicationEvent similarly fails unconditionally), so ordinary initialization logic that causes follow-up work can never be admitted.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b6d3507a54
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| boolean exactTarget = ManagedOccurrenceTargetVerifier | ||
| .establishesExactTarget(value, target); | ||
| if (!exactTarget) { | ||
| throw new ClosureCapabilityGapException( | ||
| "NEW_OCCURRENCE_ADMISSION_REQUIRED", | ||
| "A changed occurrence target requires affected-closure admission"); |
There was a problem hiding this comment.
When a Handler patches an existing Process Embedded occurrence to reference a different document, establishesExactTarget is false because target is still the old bound document, so this branch returns CAPABILITY_FAILURE. Dynamic graph changes are required to expand the affected closure, admit the new exact target, initialize it if necessary, and continue the same causal queue; as written, valid contracts cannot replace an embedded target during processing.
Useful? React with 👍 / 👎.
| if (document.terminated()) { | ||
| throw new ClosureCapabilityGapException( | ||
| "TERMINATED_MEMBER_POLICY_REQUIRED", | ||
| "Terminated members require lifecycle delivery policy"); |
There was a problem hiding this comment.
When an affected closure contains any previously terminated member, this unconditional loop rejects the entire invocation before routing begins, even if a nonempty direct delivery targets a different live member. Termination is scope-local—the event-routing code below already skips terminated sources and containers—so a terminated descendant or sibling must not turn valid work for the rest of the closure into CAPABILITY_FAILURE.
Useful? React with 👍 / 👎.
| ClosureEnvironment environment = input.environment(); | ||
| if (!environment.runtimeRegistryIdentity().equals( | ||
| runtimeDescriptor.runtimeRegistryIdentity())) { | ||
| throw new IllegalArgumentException( | ||
| "Invocation runtime registry is not the configured implementation"); |
There was a problem hiding this comment.
A caller can supply arbitrary valid SHA-256 values for blueLanguageSpecificationIdentity and contractsSpecificationIdentity; invocation verification merely includes them in the hash, while this runtime-binding check never compares them with the specifications actually implemented. The closure is then executed with the released semantics and emits a commit companion claiming different specification artifacts, allowing results and receipts to be mislabeled as executions under unsupported rules.
Useful? React with 👍 / 👎.
1 participant
Summary
This PR completes the Language foundation for deterministic Contracts 1.0 cyclic managed-document processing.
Cyclic document relationships are now processed as one authenticated closure: work is ordered causally, identities are finalized deterministically, gas is metered once, and publication remains atomic.
What changed
Compatibility
The implementation preserves the frozen Contracts 1.0:
Verification
3.1.0-rc.21artifacts verifiedReview notes
The diff is intentionally large because it includes the recovered Contracts 1.0 topology implementation, normative fixtures, verification tooling, documentation, and artifact-bound evidence.