Conversation
…table ReplicaFence::advance() normalizes to Postgres timestamptz resolution (timestamp_micros), but fence_starts_closed_and_opens_on_advance compared against Utc::now() (nanoseconds on Linux): verified_through() == Some(ts) mixed resolutions, and covers(ts) compared nanos ts against the micros fence so the inclusive-boundary assertion failed. Compare at the fence's resolution. Production behavior unchanged. Signed-off-by: Sooly Kobayashi <yloos@protonmail.com>
s00ly
force-pushed
the
test/db-replica-fence-micros
branch
from
July 21, 2026 19:49
f3b99a5 to
e73869e
Compare
tucktuck101
pushed a commit
to tucktuck101/buzz
that referenced
this pull request
Sep 17, 2026
`cargo-deny check` fails on the Security CI job:
error[vulnerability]: TLS 1.3 handshake messages incorrectly accepted
across encryption level boundaries
Advisory: https://rustsec.org/advisories/RUSTSEC-2026-0285
advisories FAILED, bans ok, licenses ok, sources ok
Lockfile only -- no Cargo.toml change, no source change. `cargo update -p rustls
--precise 0.23.45` also carries rustls-webpki 0.103.13 -> 0.103.15 and
aws-lc-sys 0.41.0 -> 0.45.0, both required by that rustls version.
A SYNC, NOT A DECISION. Upstream block/buzz is already on rustls 0.23.45; this
fork was on 0.23.42. The version is pinned to match upstream rather than taking
what `cargo update` offered on its own (0.23.43), so the lockfiles converge
instead of drifting further apart. Same shape as block#2277.
WHY IT WENT UNNOTICED
The Security job sits behind the `rust` paths filter and is `skipping` on almost
every PR -- verified on block#2283, block#2276, block#2269 and block#2264. It fired on block#2270 only
incidentally: that PR regenerates
launchpad/crates/knowledge/generated/corpus.json, and `launchpad/crates/**` is
in the filter. A Rust security audit therefore runs when, and only when,
somebody edits documentation in the right place.
Second repo-wide failure in two days found by accident on a documentation PR
rather than by the safety net; the first was the MinIO outage (block#2266).
VERIFICATION
cargo-deny check exit 0; advisories ok, bans ok,
licenses ok, sources ok
(was: advisories FAILED)
cargo check --workspace --all-targets exit 0, no errors, 3m05s
cargo test --workspace --lib 993 passed, 2 failed
cargo test -p buzz-core --lib 262 passed, 0 failed
TWO TESTS FAIL, AND BOTH FAIL IDENTICALLY WITHOUT THIS CHANGE. Each was re-run
in the same worktree against origin/launchpad's lockfile (rustls 0.23.42,
aws-lc-sys 0.41.0) and failed the same way, so neither is caused by the bump:
buzz-relay api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo
HTTP 504 != 200
git-sign-nostr tests::test_parse_envelope_rejects_invalid_oa_pubkey
assertion failed: result.is_err()
The second was checked with particular care: aws-lc-sys is a cryptographic
library and that test asserts a pubkey is REJECTED, so a bump quietly making it
accepted is exactly the regression worth catching. It fails on the baseline too.
A third, buzz-acp `claude_named_adapter_wire_lifecycle_records_prompt_and_cost`,
failed once and passed on re-run: flaky, not deterministic.
None of the three has an issue yet. They are pre-existing and out of scope here,
but they mean the workspace suite is NOT green as it stands -- stated plainly
rather than buried, because this change is not why.
A further six buzz-relay media tests failed until the database had migrations
applied (`relation "communities" does not exist`); all 35 pass once migrated.
Environmental, not a code fault.
NOT VERIFIED: no TLS handshake was exercised end to end and no integration suite
was run. This changes no code, but "compiles and unit-tests pass" is not "the
relay still negotiates TLS correctly" -- the full Rust matrix in CI is what
establishes that.
Closes block#2284
Signed-off-by: test <test@example.com>
tucktuck101
added a commit
to tucktuck101/buzz
that referenced
this pull request
Sep 17, 2026
… agree on "repo" Two Blockers from the second review round on block#2269. The savepoint in transition.py closed the path that was demonstrated, but not the class. build_composition hands one connection to every collaborator, and each of the three stores in rqa/github/store.py ends its write with an unconditional connection.commit(). decide() leaves the decision entry and the escalation close uncommitted on purpose; resume()'s first action is a live GitHub read, so the first successful exchange committed work that was meant to be provisional. A later validation failure then had nothing to undo: the escalation was durably closed, the job stuck at escalated, and the retry refused ALREADY_CLOSED. The composition root now hands those three stores a connection view whose commit() is inert, rather than stripping the commits from store.py, which would change behaviour for every standalone caller of that module. Their rows become durable when the transaction's owner commits -- tick.py after every admitted repository, main.py at the end of each command. rollback() through the view raises: a collaborator discarding the owner's transaction is the same defect in the other direction, and silence there would hide it. Second: onboard took a checkout path while tick --repo took an owner/repo slug, and both resolved through config_path(), so a repository onboarded one way was refused at admission the other. onboard now requires the same slug tick does, still guarded by is_dir() so no phantom .rqa/ tree is ever created. The one layout under which the two agree -- checkouts at <cwd>/<owner>/<repo> -- is now stated in OPERATORS.md rather than left implicit, along with the invocation neither operator document previously showed. SKILL.md now says plainly that rqa is pre-cutover and that its decision surface is disjoint from scripts/human_cli.py. Tests: the suite was structurally blind to the commit defect because every decide()/resume() test substitutes a fake github that never reaches a store. Three tests now drive the real Transport over the real Sqlite stores; two of them fail against the pre-fix wiring. The onboard contract change is pinned by its non-slug case, which the pre-fix code accepts. Signed-off-by: tucktuck101 <pc2fct5rd8@privaterelay.appleid.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: tucktuck101 <jeffreytaylorrobertson@gmail.com>
tucktuck101
pushed a commit
to tucktuck101/buzz
that referenced
this pull request
Sep 17, 2026
…on-surface feat(rqa): escalation and the operator command surface — rqa/escalation, rqa/cli (block#2186)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
replica_fence::tests::fence_starts_closed_and_opens_on_advancefails onhosts whose wall clock returns nanoseconds (e.g. Linux):
verified_through()returns the fence at Postgres timestamptz resolution(
advance()storestimestamp_micros()), but the test asserted equalitywith
Utc::now()(nanos) — mismatch on any sub-microsecond reading.covers(ts)compared nanostsagainst the micros fence, sotswasstrictly past the fence and the "boundary is inclusive" assertion failed.
Production behavior is unchanged — micros normalization is correct for
Postgres. The test compared across resolutions.
Fix
Compare at the fence's resolution via
DateTime::from_timestamp_micros(ts.timestamp_micros()).Testing
cargo test -p buzz-db --lib: 81/82 → 82/82 on Linux.cargo clippy -p buzz-db --all-targets -- -D warnings,cargo fmt --check: clean.