Roaming M1: contracts (blob store, mirror RPCs, registry) by thanostourik · Pull Request #2 · thanostourik/t3code

thanostourik · 2026-07-04T14:46:50Z

First M1 seam per .plans/21-roaming-workspace.md (contracts PR first). Also records the M1 analysis-pass deviations in the plan doc.

Contracts

WorkspaceProjectId branded id (decision D1) in baseSchemas.ts
New packages/contracts/src/roaming.ts: one blob record shape for every kind (D3) + manifest/conflict schemas, registry payload, RoamingProjectShell, peer record, mirror RPC schemas (syncManifest/fetchBlobs/pushBlobs), enrollment RPC schemas (D4 handshake), HTTP path constants
roaming:mirror auth scope (additive to the scope union)
roaming boolean in ServerSettings (default false) + patch schema
OrchestrationShellSnapshot.roamingProjects with decode-default []; roaming-project-upserted/removed shell stream variants; optional workspaceProjectId on OrchestrationProject/OrchestrationProjectShell/ProjectMetaUpdatedPayload
Internal (non-client-dispatchable) command project.roaming.enroll + minimal decider/projector/engine wiring so the union change keeps the tree green — emits project.meta-updated, rejects re-enroll under a different id

Verification

Full monorepo typecheck: no new errors (apps/mobile's 61 pre-existing dep-resolution errors match the clean-tree baseline exactly)
contracts 179, client-runtime 247, server orchestration/relay/server 263 tests pass

🤖 Generated with Claude Code

M1 analysis pass recorded in the plan doc (deviations: settings-flag home, reactor gating pattern, no server-side peer endpoint discovery, mirror RPC transport, D4 credential handshake). Contracts: - WorkspaceProjectId branded id (D1) - packages/contracts/src/roaming.ts: RoamingBlobRecord/manifest/conflict (D3), registry payload, RoamingProjectShell, peer + mirror + enrollment RPC schemas, HTTP path constants - roaming:mirror auth scope; `roaming` server setting (default off) - OrchestrationShellSnapshot.roamingProjects (decode-default []) + shell stream variants; optional workspaceProjectId on project shapes and project.meta-updated - internal command project.roaming.enroll with decider/projector/engine wiring (emits project.meta-updated; double-enroll rejected) Test literals updated for the new snapshot field. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- Contractual per-kind key derivation for the (kind, key) blob address; workspaceProjectId documented as denormalized (opus review #1, codex P1) - RoamingBlobConflict retains the full remote record so M2 resolution can show both payloads (opus review #2) - Doc notes: payload bytes authoritative for hashing; scalar-version divergence limitation (opus review #3, #4) - Plan doc: record the sharpened convention + the SQL-projection persistence gap (codex P1) slated for the server enrollment PR Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

- Serialize read-modify-write in writeLocal/applyRemote behind a semaphore: interleaved fibers could both read before either wrote, losing updates and defeating equal-version conflict detection (opus review #1) - Verify ingested contentHash against the payload before any branch — a mismatched record poisons reconciliation against every peer (opus #2) - Replace the changes Stream with subscribeChanges (PubSub.subscribe, same shape as ProviderInstanceRegistry): subscription is established on return, fixing the racy stream test (opus #3) and documenting drop semantics (#4) - Coverage: hash-mismatch rejection, concurrent same-version race, getMany across kinds with same key, conflict replacement, idempotent-apply silence (opus #5); precise error labels in writeLocal/applyRemote paths (opus #6) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* Roaming M1: roaming_blobs migration + RoamingBlobStore Migration 033 (roaming_blobs + roaming_blob_conflicts, PK (kind,key)) and a SqlClient-backed RoamingBlobStore: writeLocal (version bump, sha256 of the verbatim payload string, author environment id), applyRemote implementing the D3 reconciliation rule (higher version wins; equal version + different hash records a conflict carrying the full remote record and keeps local), manifest/get/getMany/listConflicts, and a changes stream that emits only on accepted writes. Reuses persistence error types. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * RoamingBlobStore: accepted writes clear superseded conflict rows codex review P2: a recorded equal-version conflict stayed in roaming_blob_conflicts after a later accepted write moved the key past the contested version, so listConflicts() kept surfacing it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * RoamingBlobStore: apply independent review findings - Serialize read-modify-write in writeLocal/applyRemote behind a semaphore: interleaved fibers could both read before either wrote, losing updates and defeating equal-version conflict detection (opus review #1) - Verify ingested contentHash against the payload before any branch — a mismatched record poisons reconciliation against every peer (opus #2) - Replace the changes Stream with subscribeChanges (PubSub.subscribe, same shape as ProviderInstanceRegistry): subscription is established on return, fixing the racy stream test (opus #3) and documenting drop semantics (#4) - Coverage: hash-mismatch rejection, concurrent same-version race, getMany across kinds with same key, conflict replacement, idempotent-apply silence (opus #5); precise error labels in writeLocal/applyRemote paths (opus #6) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* Roaming M1: contracts for blob store, mirror RPCs, and registry M1 analysis pass recorded in the plan doc (deviations: settings-flag home, reactor gating pattern, no server-side peer endpoint discovery, mirror RPC transport, D4 credential handshake). Contracts: - WorkspaceProjectId branded id (D1) - packages/contracts/src/roaming.ts: RoamingBlobRecord/manifest/conflict (D3), registry payload, RoamingProjectShell, peer + mirror + enrollment RPC schemas, HTTP path constants - roaming:mirror auth scope; `roaming` server setting (default off) - OrchestrationShellSnapshot.roamingProjects (decode-default []) + shell stream variants; optional workspaceProjectId on project shapes and project.meta-updated - internal command project.roaming.enroll with decider/projector/engine wiring (emits project.meta-updated; double-enroll rejected) Test literals updated for the new snapshot field. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Roaming M1 contracts: apply review findings - Contractual per-kind key derivation for the (kind, key) blob address; workspaceProjectId documented as denormalized (opus review #1, codex P1) - RoamingBlobConflict retains the full remote record so M2 resolution can show both payloads (opus review #2) - Doc notes: payload bytes authoritative for hashing; scalar-version divergence limitation (opus review #3, #4) - Plan doc: record the sharpened convention + the SQL-projection persistence gap (codex P1) slated for the server enrollment PR Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>