Ben Stull
492 lines
28 KiB
Markdown
492 lines
28 KiB
Markdown
---
|
||
status: graduated
|
||
---
|
||
# Solution Design: Cross-Rung Git-Native Persistence Format + Gitea Round-Trip (F5)
|
||
|
||
| | |
|
||
| --- | --- |
|
||
| **Author(s)** | Ben Stull (with Claude) |
|
||
| **Reviewers / approvers** | Ben Stull |
|
||
| **Status** | `draft` |
|
||
| **Version** | v0.1.0 |
|
||
| **Source artifacts** | Epic `benstull/vscode-cowriting-plugin#1` · Feature `#14` (F5) · Parent specs: `coauthoring-inner-loop.md` (§9 OPEN→F5: "the inner-loop shape, not yet the cross-rung contract"), `coauthoring-attribution.md` (§9 OPEN→F5), `coauthoring-propose-accept.md` (§9 OPEN→F5) · Ladder lineage: `ben.stull/rfc-app#48` (the three rungs) and `ben.stull/rfc-app#46` (the Gitea-substrate rung: "continuity of substrate — no migration cliff") · F4 shipped: `#12` (PR #13, session 0012) |
|
||
|
||
**Change log**
|
||
|
||
| Date | Version | Change | By |
|
||
| --- | --- | --- | --- |
|
||
| 2026-06-10 | v0.1.0 | Initial draft — brainstorming session 0014 | Ben Stull + Claude |
|
||
|
||
---
|
||
|
||
## 1. Business Context
|
||
|
||
### 1.1 Executive Summary
|
||
|
||
F5 graduates the `.threads/` sidecar from "the editor's private shape" into the
|
||
**cross-rung contract**: a published, versioned, machine-validatable format any
|
||
rung of the ladder (editor → Gitea substrate → rfc-app) can read and write
|
||
without re-homing. It adds the three things a second writer needs — a
|
||
**contract** (prose + JSON Schema, with compatibility rules including
|
||
unknown-field preservation), a **cross-rung identity** extension on
|
||
`Provenance` (git's own email model, plus `onBehalfOf` for agents), and a
|
||
**deterministic merge** (`mergeArtifacts`) — and **proves the round-trip**: a
|
||
record written in the editor is modified out-of-editor by a Gitea-rung stand-in
|
||
and renders correctly on pull. Everything is additive; `schemaVersion` stays 1.
|
||
|
||
### 1.2 Background
|
||
|
||
Epic #1's outcome statement promises the record is "portable up to the Gitea
|
||
rung later **without re-homing**", and rfc-app#46 names the strategic prize:
|
||
**continuity of substrate — no migration cliff** ("git is truth; the surfaces
|
||
are clients"). Every prior design deferred the contract to exactly this
|
||
session: F2 called its format "the inner-loop shape, not yet the cross-rung
|
||
contract"; F3 and F4 each routed "may re-home `attributions[]` /
|
||
`proposals[]`" here. Meanwhile the shipped format was *built* for this moment
|
||
— plain pretty JSON, stable key order, trailing newline, state-not-history
|
||
sections, shared `anchors` — all chosen in F2 for mergeability. Issue #14
|
||
carried six design forks to this session; all six are resolved here (§6.7,
|
||
§9). One shipped fact forces real work: `serializeArtifact` rebuilds a
|
||
canonical object from **known fields only**, so today's writer would silently
|
||
destroy another rung's data on rewrite — the forward-compatibility gap F5
|
||
closes (INV-15).
|
||
|
||
### 1.3 Business Actors / Roles
|
||
|
||
- **Coauthor (human / machine)** — as in F2–F4; unchanged in-editor.
|
||
- **The second writer** — new: a teammate's editor on another clone, or a
|
||
Gitea-rung surface appending to the same record per the contract.
|
||
- **The downstream rungs** — the Gitea substrate (rfc-app#46) and rfc-app:
|
||
consumers of the contract this Feature publishes.
|
||
|
||
### 1.4 Problem Statement
|
||
|
||
Portability has never been exercised. There is no published contract, no
|
||
compatibility/versioning rules for readers that aren't this codebase, no
|
||
forge-resolvable identity (`Provenance.id` is a local `$USER`), no defined
|
||
behavior when a second writer touches the record, and a writer that drops
|
||
fields it doesn't recognize. Until F5, "git is truth; the surfaces are
|
||
clients" is an assertion, not a property.
|
||
|
||
### 1.5 Pain Points
|
||
|
||
- Clone the repo on a second machine and the record *probably* works — nothing
|
||
guarantees it, and any other tool that rewrites the sidecar loses data.
|
||
- No rung can validate a sidecar without reading this extension's TypeScript.
|
||
- `kind:"human", id:"benstull"` means nothing to a forge; agents don't record
|
||
who they acted for.
|
||
- Two writers = undefined behavior; git will textually conflict pretty JSON
|
||
and nothing documents the semantic resolution.
|
||
|
||
### 1.6 Targeted Business Outcomes
|
||
|
||
A contract any rung can implement against; identity a forge can resolve; a
|
||
merge story a human (or tool) can execute deterministically; and a
|
||
demonstrated out-of-editor round-trip — converting the epic's portability
|
||
promise into a tested property and unblocking the rfc-app#46 substrate
|
||
brainstorming with a concrete input.
|
||
|
||
### 1.7 Scope (business)
|
||
|
||
**In scope:** the cross-rung contract (prose, normative) + JSON Schema +
|
||
rung-neutral validator; unknown-field preservation in the writer; the
|
||
`Provenance` identity extension (`email`, `agent.onBehalfOf`); newer-major
|
||
fail-safe (read-only) behavior; `mergeArtifacts` (deterministic union-by-id,
|
||
documented + unit-tested); the Gitea-rung stand-in writer script + round-trip
|
||
host E2E; byte-fidelity tests.
|
||
|
||
**Out of scope (deferred, not forgotten):** the Gitea-side substrate
|
||
primitives themselves (rfc-app#46's build — discussions UI, LLM participants,
|
||
native proposal layers); any rfc-app work; a sync daemon/server (git push/pull
|
||
IS the transport); a git merge *driver* installation (the pure function is the
|
||
semantics; wiring it into `.gitattributes` is a later convenience); file
|
||
rename/move tracking; `ratifiedBy` / multi-party provenance (team-rung
|
||
concern); rejected-proposal history trails.
|
||
|
||
### 1.8 Assumptions · Constraints · Dependencies
|
||
|
||
- **Parent:** Epic #1 (F5 is its final decomposition item; the three
|
||
acceptance pillars shipped in F2 #4, F3 #6, F4 #12). **Blocked by:** #12
|
||
(shipped). **Feeds:** the rfc-app#46 brainstorming and the rfc-app rung.
|
||
- **Established format facts** (the contract ratifies what shipped):
|
||
per-document `.threads/<path>.json`; shared `anchors` + `Fingerprint`
|
||
(text/before/after/lineHint, INV-3); `Provenance` (`human|agent`);
|
||
`threads[]` / `attributions[]` (state, not history) / pending-only
|
||
`proposals[]` (INV-13); `SCHEMA_VERSION = 1`; stable key order + trailing
|
||
newline (INV-2). The extension stops being the assumed sole writer.
|
||
- All changes are **additive** — existing sidecars remain valid v1 documents
|
||
unmodified; the serializer's optional-field-omission pattern (F4 precedent)
|
||
carries the new fields.
|
||
- No new auth/credential surface; no server.
|
||
|
||
### 1.9 Business Use Cases
|
||
|
||
- **BUC-1** A coauthor clones the repo on another machine (or a teammate
|
||
does) and the full record — threads, attribution, pending proposals —
|
||
arrives intact and keeps working.
|
||
- **BUC-2** A Gitea-rung surface (today: the stand-in; tomorrow: rfc-app#46's
|
||
primitives) appends a thread reply per the contract; on pull, the reply
|
||
appears in the editor's comment thread.
|
||
- **BUC-3** Two writers diverge; the documented merge yields one record with
|
||
no silent data loss, and anything genuinely conflicting is surfaced.
|
||
|
||
---
|
||
|
||
## 2. Solution Proposal
|
||
|
||
Publish the **contract** in two halves: a normative prose document
|
||
(`coauthoring-sidecar-contract.md`, a standing spec in the content repo) and a
|
||
**JSON Schema** (`schemas/coauthoring-sidecar.schema.json`, code-resident in
|
||
the plugin repo next to the reference implementation, wired into the unit
|
||
suite and runnable by any rung via a small validator script). Extend
|
||
`Provenance` additively with git's own identity model — `email` on humans,
|
||
`agent.onBehalfOf {id, email?}` on agents — and make the writer
|
||
**round-trip-safe**: unknown fields are preserved on rewrite (serialized after
|
||
known keys, sorted), and a sidecar with a newer major `schemaVersion` is
|
||
read-only (fail-safe). Ship the merge semantics as a pure, vscode-free
|
||
`mergeArtifacts(ours, theirs)`: sections union by `id`, thread messages union
|
||
by `id` ordered by `createdAt` (the forge-appends-a-reply case merges cleanly
|
||
by construction), same-id divergence resolved by `updatedAt` where present
|
||
else a deterministic tie-break — and every such resolution **surfaced** in the
|
||
result, never silent. Prove the loop with a Gitea-rung **stand-in writer**
|
||
(`scripts/crossrung-reply.mjs`: validate → append a reply → stable-serialize)
|
||
driven by host E2E through the existing external-change machinery.
|
||
|
||
---
|
||
|
||
## 3. Product Personas
|
||
|
||
- **PP-1 Inner-loop coauthor** — unchanged in-editor experience; gains
|
||
second-machine/teammate safety.
|
||
- **PP-3 Rung implementer** — new: the developer building the Gitea-substrate
|
||
or rfc-app surface against the contract (today impersonated by the stand-in
|
||
script and the validator).
|
||
|
||
## 4. Product Use Cases
|
||
|
||
- **PUC-1 (fidelity)** A sidecar written by the editor survives
|
||
serialize → git → reload byte-stable, and survives a *conforming foreign
|
||
writer's* rewrite with all fields intact (including ones that writer doesn't
|
||
know).
|
||
- **PUC-2 (out-of-editor reply)** The stand-in appends a thread reply per the
|
||
contract → the editor (on external change / pull) renders the new message in
|
||
the right thread at the right anchor.
|
||
- **PUC-3 (merge)** Two divergent copies merge via `mergeArtifacts`: disjoint
|
||
changes union; the reply-append case is clean; same-id divergence resolves
|
||
deterministically and is reported.
|
||
- **PUC-4 (fail-safe)** The editor encounters a sidecar with a newer major
|
||
`schemaVersion`: it surfaces a warning and does not write — never destroys
|
||
what it can't fully read.
|
||
- **PUC-5 (validation)** Any rung validates any sidecar against the schema
|
||
(`scripts/validate-sidecar.mjs <file>` or any standard JSON Schema
|
||
validator); the plugin's unit suite validates its own outputs.
|
||
|
||
## 5. UX Layout
|
||
|
||
No new UI surface (Claude Code, not Claude Design — same §5 call as F3/F4).
|
||
Out-of-editor replies render through the **existing** F2 thread machinery
|
||
(external-change → re-render). The only new user-visible element is a warning
|
||
notification + read-only behavior on a newer-major sidecar (PUC-4), reusing
|
||
the established notification patterns. The contract, schema, validator, and
|
||
merge function are developer-facing artifacts.
|
||
|
||
---
|
||
|
||
## 6. Technical Design
|
||
|
||
### 6.1 Invariants
|
||
|
||
Parent invariants INV-1..INV-13 carry over unchanged. F5 adds:
|
||
|
||
- **INV-14 (contract-canonical):** the contract document is the format's
|
||
source of truth. Format changes land in the contract first, then in code —
|
||
documentation-leads-automation (handbook §4.1) applied to the format. The
|
||
JSON Schema and the TypeScript model conform to it; on disagreement the
|
||
contract wins.
|
||
- **INV-15 (round-trip preservation):** a conforming writer **preserves
|
||
fields it does not recognize** when rewriting a sidecar. No rung's writer
|
||
may destroy another rung's data. (Unknown keys serialize after known keys,
|
||
sorted lexicographically, so output stays deterministic — INV-2.)
|
||
- **INV-16 (versioning):** within a major `schemaVersion`, changes are
|
||
**additive-only** (new optional fields); readers ignore unknown optionals.
|
||
A reader encountering a **newer major** version goes **fail-safe
|
||
read-only**: render what it understands, write nothing. Breaking changes
|
||
bump the major and are recorded in the contract's changelog.
|
||
- **INV-17 (merge honesty):** merging is deterministic union-by-id per the
|
||
contract's documented rules; any same-id divergence is resolved by those
|
||
rules **and surfaced to the caller** — never silently guessed (INV-1's
|
||
spirit at the artifact level).
|
||
|
||
### 6.2 High-level architecture
|
||
|
||
Four small units — two artifacts, two vscode-free modules — plus a serializer
|
||
change and one fail-safe check; controllers and the editor UX are otherwise
|
||
untouched:
|
||
|
||
- **The contract** (`vscode-cowriting-plugin-content`:
|
||
`specs/coauthoring-sidecar-contract.md`) — normative prose: every section
|
||
and field, its semantics and invariants, the identity model, the
|
||
compatibility rules (INV-15/16), and the merge rules (INV-17), with a
|
||
changelog. Status-stamped and graduated like a spec; versioned with the
|
||
schema.
|
||
- **The schema + validator** (plugin repo:
|
||
`schemas/coauthoring-sidecar.schema.json` + `scripts/validate-sidecar.mjs`,
|
||
`ajv` as a devDependency) — machine-checkable conformance; wired into the
|
||
vitest suite (every serialized fixture validates) and runnable standalone
|
||
by any rung.
|
||
- **`model.ts` extensions** — `Provenance` gains optional `email` (human and
|
||
agent alike); the agent payload gains optional
|
||
`onBehalfOf: { id: string; email?: string }` (the operator the machine
|
||
acted for — rfc-app#46 §6.5's `On-behalf-of:` made data). The serializer
|
||
gains **unknown-field preservation** (INV-15) for the artifact root and
|
||
every record type. `currentAuthor()` starts populating `email` from the
|
||
workspace git config when available.
|
||
- **`mergeArtifacts`** (new vscode-free `src/mergeArtifacts.ts`) —
|
||
`mergeArtifacts(ours, theirs): { merged, conflicts }`: anchors map union;
|
||
threads/attributions/proposals union by `id`; thread `messages` union by
|
||
`id` ordered by (`createdAt`, `id`); same-id record divergence → newer
|
||
`updatedAt` wins where the type has one, else the lexicographically larger
|
||
canonical serialization (deterministic), and the id is reported in
|
||
`conflicts`. Refuses (throws) on differing majors (INV-16).
|
||
- **Fail-safe check** — `CoauthorStore.load` surfaces the artifact's
|
||
`schemaVersion`; controllers (via one shared helper) treat a newer major as
|
||
read-only: render best-effort, skip every `store.update` path, warn once
|
||
(PUC-4).
|
||
- **Stand-in writer** (`scripts/crossrung-reply.mjs`) — the Gitea-rung
|
||
impersonator: read sidecar → validate → append a `Message` to a named
|
||
thread (new `id`, `createdAt`, author with `email`) → stable-serialize →
|
||
validate again. Doubles as executable documentation of "how a foreign
|
||
writer behaves."
|
||
|
||
```mermaid
|
||
flowchart LR
|
||
subgraph editor rung
|
||
ext["extension writers\n(Thread/Attribution/Proposal controllers)"] --> ser["serializeArtifact\n+ unknown-field preservation (INV-15)"]
|
||
end
|
||
ser --> sc[".threads/<doc>.json\n(canonical carrier)"]
|
||
sc <--> git["git push / pull\n(the transport)"]
|
||
git <--> forge["Gitea rung\n(today: crossrung-reply.mjs stand-in)"]
|
||
contract["contract doc (content repo)\n+ JSON Schema (plugin repo)"] -. governs (INV-14) .-> ser
|
||
contract -. governs .-> forge
|
||
sc --> merge["mergeArtifacts\n(union-by-id, surfaced conflicts, INV-17)"]
|
||
sc --> guard{"schemaVersion major\n> known?"}
|
||
guard -- yes --> ro["read-only + warn (INV-16)"]
|
||
guard -- no --> render["existing render/re-anchor paths\n(F2/F3/F4, unchanged)"]
|
||
```
|
||
|
||
### 6.3 Data model & ownership
|
||
|
||
Additive only — `schemaVersion` stays **1**; every existing sidecar is already
|
||
a valid v1 document:
|
||
|
||
```jsonc
|
||
// Provenance — human (new optional identity)
|
||
{ "kind": "human", "id": "benstull", "email": "ben@wiggleverse.org" }
|
||
|
||
// Provenance — agent (new optional on-behalf-of)
|
||
{ "kind": "agent", "id": "claude",
|
||
"agent": { "sdk": "@cline/sdk", "model": "sonnet", "sessionId": "run_…",
|
||
"onBehalfOf": { "id": "benstull", "email": "ben@wiggleverse.org" } } }
|
||
```
|
||
|
||
- **Identity is git's model:** `email` is the cross-rung join key (forges
|
||
already map email → account); `id` remains the display/short name. No
|
||
signatures in v1 (provenance, not authentication — the git history is the
|
||
integrity layer).
|
||
- **Ownership changes:** the extension is no longer the assumed sole writer.
|
||
Any conforming writer may append/modify per the contract; the
|
||
self-write-suppression machinery is untouched (foreign writes *should*
|
||
arrive as external changes and re-render — that is the F2 path).
|
||
- **Unknown fields:** preserved on rewrite at every level (artifact root,
|
||
anchor, thread, message, attribution, proposal), serialized after known
|
||
keys, sorted (INV-15, INV-2).
|
||
|
||
### 6.4 Interfaces & contracts
|
||
|
||
- **Contract doc** — normative; field tables per section + invariants +
|
||
compatibility (INV-15/16) + merge rules (INV-17) + changelog. The F2/F3/F4
|
||
spec §6.3s are its inputs; it supersedes them as the format reference
|
||
(INV-14).
|
||
- **Schema/validator** — `validate-sidecar.mjs <file>` exits 0/1 with
|
||
per-error paths; vitest helper `expectValidSidecar(artifact)` used by the
|
||
model/store/merge suites.
|
||
- **`mergeArtifacts(ours: Artifact, theirs: Artifact): { merged: Artifact;
|
||
conflicts: string[] }`** — pure, vscode-free, documented as *the* reference
|
||
implementation of the contract's merge rules. Not yet wired into any UI;
|
||
rungs and humans invoke it (a `.gitattributes` merge driver is a later
|
||
convenience, §1.7).
|
||
- **`CoauthorStore.load`** — unchanged signature; a shared
|
||
`isNewerMajor(artifact)` helper gates every write path (controllers skip
|
||
`update`, warn once per doc).
|
||
- **`scripts/crossrung-reply.mjs <sidecar> <threadId> <body> [--author-id
|
||
--author-email]`** — the stand-in; validates before and after its write.
|
||
|
||
### 6.5 Per–Product-Use-Case design
|
||
|
||
- **PUC-1 (fidelity):** unit tests pin byte-stable serialize→parse→serialize;
|
||
a "foreign writer" test parses a fixture containing unknown fields (root +
|
||
per-record), rewrites via `serializeArtifact`, and asserts the unknowns
|
||
survive in sorted-after-known position (INV-15).
|
||
- **PUC-2 (out-of-editor reply):** host E2E — create a thread in the editor
|
||
(F2 path) → save → run the stand-in against the sidecar (append reply) →
|
||
trigger the external-change path (the F2/F3/F4
|
||
`externalWriteAndReload`/watcher pattern) → assert the thread renders the
|
||
new message at the re-resolved anchor. No LLM; no real network — the
|
||
stand-in is a local process, exactly what a forge's write looks like to git.
|
||
- **PUC-3 (merge):** unit tests of the documented cases: reply-append vs.
|
||
disjoint editor edit (clean union, no conflicts); both sides append to the
|
||
same thread (messages interleave by `createdAt`, no conflicts); same
|
||
attribution id with divergent extents (newer `updatedAt` wins, id
|
||
reported); divergent same-id proposals (deterministic tie-break, id
|
||
reported); differing majors → throws.
|
||
- **PUC-4 (fail-safe):** unit: a v2 fixture loads, `isNewerMajor` true; host
|
||
E2E: open a doc whose sidecar says `schemaVersion: 2` → warning surfaced,
|
||
edits/saves do NOT rewrite the sidecar (file bytes unchanged).
|
||
- **PUC-5 (validation):** the schema validates all shipped fixtures + every
|
||
serialized artifact in the unit suite; the validator script exits non-zero
|
||
on a deliberately broken fixture.
|
||
|
||
### 6.6 Non-functional requirements & cross-cutting concerns
|
||
|
||
All additions are O(artifact) pure functions; no runtime dependencies added to
|
||
the extension bundle (`ajv` is dev/scripts-only). Unknown-field preservation
|
||
slightly grows the serializer but keeps determinism (INV-2). Identity adds
|
||
PII-class data (emails) to a repo-committed file — acceptable: it is exactly
|
||
what git commits already record; the contract notes it so adopters know.
|
||
Fail-safe read-only can mean reduced function on version skew — by design
|
||
(INV-16); the warning names the version. No secrets, no server, no new auth.
|
||
|
||
### 6.7 Key decisions & alternatives considered
|
||
|
||
| Decision | Chosen | Alternatives rejected |
|
||
| --- | --- | --- |
|
||
| Substrate carrier (fork a) | `.threads/` sidecar stays the canonical cross-rung carrier | git notes (no default push/fetch — breaks "travels with ordinary git"; forges don't render notes; bind to commits while the record is document-scoped); commit trailers (only fit commit-shaped data); a forge reads/renders/diffs JSON files natively — the F2 decision gets *stronger* cross-rung |
|
||
| Contract form + home (fork b) | Prose contract = standing spec in the **content repo**; JSON Schema + validator = **plugin repo** (code-resident by the reference implementation, like the engineering repo's central-schema discipline applied at app scope) | schema in the content repo (test suite would read cross-repo; drifts from the model it validates); engineering `schemas/` now (org-central before a second rung exists — graduate it there when the Gitea rung lands, noted §9); prose-only (not machine-checkable); schema-only (semantics/invariants don't fit JSON Schema) |
|
||
| Cross-rung identity (fork c) | Optional `email` on `Provenance` + optional `agent.onBehalfOf {id, email?}` — git's own identity model; forges map email→account | forge usernames (couples the record to one forge — the ladder spans surfaces); signed identities (authentication, not provenance; git history is the integrity layer; YAGNI v1); a global actor registry (a server by the back door) |
|
||
| Merge semantics (fork d) | Pure 2-way `mergeArtifacts`: union-by-id; messages ordered by createdAt; updatedAt-else-deterministic tie-break; conflicts surfaced (INV-17) | 3-way with base (git gives no cheap base for sidecars in conflict resolution; union-by-id with fresh uuids makes 2-way sufficient at this scale); whole-file last-writer (silently loses the other side); mandated git merge driver (installation burden; the pure function IS the semantics — driver is later sugar) |
|
||
| Round-trip proof shape (fork e) | Local stand-in writer script (validate → append reply → stable-serialize) + the existing external-change E2E path; byte-stability covers transport | real Gitea API round-trip in CI (infra for nothing — git moves bytes verbatim; the forge's *write* behavior is exactly the stand-in); building any Gitea-side primitive now (rfc-app#46's tracker, not this Feature) |
|
||
| Versioning (fork f) | Everything additive → `schemaVersion` stays 1; INV-16 rules (ignore unknown optionals; preserve unknown fields; newer-major → read-only) | bump to 2 (nothing breaks — a bump would force every reader to handle two majors for no gain); no formal rules (the status quo — exactly the gap F5 closes) |
|
||
| Writer forward-compat | **Preserve unknown fields** on rewrite (INV-15), sorted after known keys | drop unknowns (today's behavior — a conforming v1.1 writer would destroy a v1.2 rung's data); refuse to write on unknowns (turns every additive change into a flag day) |
|
||
|
||
### 6.8 Testing strategy
|
||
|
||
- **Unit (vitest, vscode-free):** schema validation of every serialized
|
||
artifact (PUC-5); byte-stability + unknown-field preservation round-trips
|
||
(PUC-1); identity serialization (email/onBehalfOf present/absent — F4's
|
||
optional-omission pattern); `mergeArtifacts` documented cases incl. the
|
||
conflict reports and the differing-major throw (PUC-3); `isNewerMajor` +
|
||
v2-fixture load (PUC-4).
|
||
- **Host E2E (`@vscode/test-electron`, F2–F4 pattern, no LLM):** the
|
||
round-trip — editor-created thread → save → stand-in appends a reply →
|
||
external-change → new message renders in the thread at the re-resolved
|
||
anchor (PUC-2); newer-major sidecar → warning + no rewrite on save (PUC-4).
|
||
- **Scripted checks:** `validate-sidecar.mjs` against good + broken fixtures;
|
||
the stand-in's own before/after validation. No manual smoke needed — F5 has
|
||
no LLM leg.
|
||
|
||
### 6.9 Failure modes, rollback & flags
|
||
|
||
A non-conforming foreign write → schema validation pinpoints it; the editor's
|
||
existing resolve-or-orphan ladder already handles semantic damage (anchors
|
||
that no longer resolve orphan, never guess). Version skew → INV-16 read-only,
|
||
recoverable by upgrading the older rung. Merge conflicts → surfaced ids +
|
||
documented rules; worst case the file is plain JSON a human resolves (the F2
|
||
stance, now with rules). Email absence (no git config) → fields omitted,
|
||
everything still valid (additive). No feature flag: additive schema + a
|
||
contract doc; old extensions keep working against new sidecars (they drop
|
||
unknown fields — which is precisely why INV-15 ships *now*, before any second
|
||
writer exists).
|
||
|
||
---
|
||
|
||
## 7. Delivery Plan
|
||
|
||
### 7.1 Approach / strategy
|
||
|
||
One planning-and-executing session (F5 = #14), plan written just-in-time from
|
||
this spec, per the F2–F4 precedent.
|
||
|
||
### 7.2 Slicing plan
|
||
|
||
- **SLICE-1** The contract: `coauthoring-sidecar-contract.md` (content repo,
|
||
normative, with changelog) + `schemas/coauthoring-sidecar.schema.json` +
|
||
`scripts/validate-sidecar.mjs` (+ ajv devDependency), schema wired into the
|
||
unit suite (every serialized fixture validates).
|
||
- **SLICE-2** Writer conformance: unknown-field preservation in
|
||
`serializeArtifact` (INV-15) + `Provenance` identity extension
|
||
(`email`, `agent.onBehalfOf`) + `currentAuthor()` email population +
|
||
newer-major fail-safe (`isNewerMajor` gating all `store.update` paths,
|
||
PUC-4 warning) — with compat tests (existing sidecars load/serialize
|
||
unchanged).
|
||
- **SLICE-3** `mergeArtifacts` + unit tests of every documented merge case
|
||
(INV-17).
|
||
- **SLICE-4** The stand-in (`scripts/crossrung-reply.mjs`) + host E2E
|
||
round-trip (PUC-2) + newer-major E2E (PUC-4).
|
||
- **SLICE-5** Docs: README cross-rung section; plugin-repo pointers to the
|
||
contract; full gate.
|
||
|
||
E2E are first-class plan tasks (handbook §9 / §4; this app's required tier is
|
||
host E2E — a VS Code extension, no browser surface, no deploy stage — the
|
||
F2–F4 precedent).
|
||
|
||
### 7.3 Rollout / launch plan
|
||
|
||
Still non-shippable (no marketplace publish). "Done" = issue #14 acceptance
|
||
met: contract + schema published, unit + host E2E green (round-trip, merge,
|
||
fail-safe, preservation all exercised). No manual smoke — no LLM leg.
|
||
|
||
### 7.4 Risks & mitigations
|
||
|
||
| Risk | Mitigation |
|
||
| --- | --- |
|
||
| Contract drifts from code | INV-14 (contract first) + the schema runs in the unit suite — drift fails CI |
|
||
| Unknown-field preservation breaks byte-stability | deterministic placement rule (after known keys, sorted) + round-trip tests |
|
||
| Merge rules too naive for real concurrency | scale honesty: union-by-id + fresh uuids makes overlap rare at inner-loop scale; conflicts are surfaced, file stays human-resolvable; revisit with the team rung |
|
||
| Email-as-identity is wrong for some forge | it is git's own join key and the lowest common denominator; forge-specific ids can be added additively later (INV-16) |
|
||
| Premature contract (Gitea rung may want changes) | everything additive + a changelog + the rfc-app#46 brainstorming consumes this as INPUT — cheaper to amend a contract than to reverse-engineer an implementation |
|
||
| Read-only fail-safe surprises a user on version skew | warning names the version and the action; recoverable by upgrading; tested in E2E |
|
||
|
||
---
|
||
|
||
## 8. Traceability matrix
|
||
|
||
| Requirement (issue #14 acceptance) | Use case | Design | Slice |
|
||
| --- | --- | --- | --- |
|
||
| Contract document with compatibility rules | PUC-5 | §6.2, INV-14/15/16 | SLICE-1 |
|
||
| Identity crosses rungs (Provenance) | PUC-2 | §6.3, fork (c) | SLICE-2 |
|
||
| Round-trip proven, no re-homing | PUC-1/2 | stand-in + INV-15, §6.5 | SLICE-2/4 |
|
||
| Concurrent-writer story defined and exercised | PUC-3 | `mergeArtifacts`, INV-17 | SLICE-3 |
|
||
| Validation runnable outside the extension | PUC-5 | schema + validator | SLICE-1 |
|
||
| Unit + host E2E coverage | — | §6.8 | SLICE-1–4 |
|
||
|
||
## 9. Open Questions & Decisions log
|
||
|
||
- **RESOLVED (this session — the six forks routed by #14):** (a) carrier =
|
||
the sidecar, ratified cross-rung; (b) contract = prose (content repo
|
||
standing spec) + JSON Schema (plugin repo, code-resident); (c) identity =
|
||
`email` + `agent.onBehalfOf`, git's model; (d) merge = pure 2-way
|
||
union-by-id with surfaced conflicts (INV-17); (e) proof = local stand-in
|
||
writer + external-change E2E + byte-stability; (f) versioning = additive,
|
||
`schemaVersion` stays 1, INV-16 rules (incl. writer unknown-field
|
||
preservation, INV-15).
|
||
- **OPEN → Gitea rung (rfc-app#46):** graduate the schema to the engineering
|
||
central `schemas/` when a second rung actually implements the contract;
|
||
whether the substrate wants a `.gitattributes` merge driver shipped;
|
||
forge-specific identity fields beyond email.
|
||
- **OPEN → later:** `ratifiedBy` / multi-party provenance (team rung); file
|
||
rename/move tracking (path is still the key); rejected-proposal history
|
||
trails; signed provenance if integrity-beyond-git is ever required.
|
||
|
||
## 10. Glossary & References
|
||
|
||
- **Cross-rung contract** — the published format definition all ladder
|
||
surfaces implement against. **Foreign/conforming writer** — any non-editor
|
||
process writing a sidecar per the contract. **Stand-in** — the local script
|
||
impersonating the Gitea rung's write behavior. **Fail-safe read-only** —
|
||
INV-16's posture on newer-major sidecars: render, never write.
|
||
- Epic #1 · Feature #14 (F5) · F2 #4 · F3 #6 · F4 #12 (PR #13) · parent specs
|
||
`coauthoring-inner-loop.md` / `coauthoring-attribution.md` /
|
||
`coauthoring-propose-accept.md` · rfc-app#48 (ladder) · rfc-app#46
|
||
(substrate rung) · `wiggleverse/engineering#19` (adjacent metadata
|
||
discussion).
|