alkblobs/tasks/review-wave-13.md

id, name, status, depends_on, scope, risk, impact, level

id	name	status	depends_on	scope	risk	impact	level
review-wave-13	Wave 13 review — the first-consumer gate (the publish hold lifts)	completed	c1-git-object-family-impl c2-token-custody-posture c3-sqlite-busy-timeout c4-borrowed-key-overloads	moderate	low	project	review

Description

The wave-13 review gate — reads the wave's diffs against review-002's asks and the plan's wave-13 charter. On green, the publish hold lifts: C-1 and C-2 were the held-open reasons, and the crate publishes manually after the gate (CI: none, family posture — publishing runs coordinator-side).

The gate's checks:

• C-1 — ADR-018 accepted with all five decisions owned (the ops kind question, the stat semantic, the ADR-002 annotation, the namespace posture, the put shape); the family landed per the ADR (registry/derivation/put path/fleet threading); git_interop green against the git CLI; the specs (hashing-and-keys, store-api, ops-surface) consistent with the landed behavior; the one-way door's bytes exactly as ADR-018 pins them — the pre-publish window's whole point, read the encoding against the ADR line by line (the wave-1 gate's discipline, again at the door's last cheap moment).
• C-2 — ADR-019 accepted; the cap-or-posture landed per it; the attack shape on paper; the "not silence" bar met (the tokens.rs retention doc points at the decision, no stale deferral language).
• C-3/C-4 — landed as chartered (the posture contracted; the overloads small and behavior-neutral).
• review-002 stamped — frontmatter status moves open → closed with the disposition pointers (ADR-018/019, the landed tasks); the prototype branch dispositioned (delete after parity is confirmed — it is a scratch reference, not a merge).
• The full verification block green — cargo test (default), cargo test --all-features server-less and against the live pg harness, both clippy variants, cargo fmt --check, cargo doc --no-deps, the fuzz corpus-replay gate.
• Publish readiness — cargo publish --dry-run --allow-dirty green; the CHANGELOG's [0.1.0] entry current (the unpublished entry absorbs the wave — the family, the admission posture, the sqlite posture, the overloads); the README/feature tables still honest post-C-1 (the family is a new public surface).
• The plan stamp — wave 13 marked completed in docs/plans/implementation.md; AGENTS.md's status line moves to publish-ready.

Acceptance Criteria

• C-1 verified end to end (ADR-018 + landed family + specs consistent + the one-way-door line-by-line read)
• C-2 verified (ADR-019 + the landed decision + the attack shape on record)
• C-3/C-4 verified as chartered
• review-002 stamped closed with disposition pointers; the prototype branch dispositioned
• Full verification block green, including the fuzz corpus-replay gate
• cargo publish --dry-run --allow-dirty green; CHANGELOG current
• docs/plans/implementation.md wave 13 stamped completed; AGENTS.md's status line updated
• Any residue named (post-publish observations get a home, not a shrug)

References

• docs/reviews/002-first-consumer-review.md (the asks; the disposition space)
• docs/plans/implementation.md (wave 13 charter; the review-gates section)
• tasks/c1-adr-git-object-family.md; c1-git-object-family-impl.md; c2-token-custody-posture.md; c3-sqlite-busy-timeout.md; c4-borrowed-key-overloads.md
• AGENTS.md (the verification block)

Notes

The gate ran green end to end. Per-check record:

• C-1's one-way-door line-by-line read (the wave-1 gate's discipline at the door's last cheap moment) — src/hashing.rs: registry GIT_OBJECT_SHA1 = 0x03 (20-byte digest, key total 21), GIT_OBJECT_SHA256 = 0x04 (32-byte digest, key total 33); the Algorithm members ordered after the blob members so the derived order is 0x01 < 0x02 < 0x03 < 0x04 (the sweep's range-scan mechanism intact); the preimage-identity derivation arms (plain hash of content, len inert — documented and test-pinned by git_object_derive_len_parameter_is_inert incl. the u64::MAX boundary); BlobHasher's no-preamble arms with finish pinned equal to derive; try_from_byte/digest_len extended. src/keys.rs: the physical layout documented, family keys round-trip in total order, per-member width validation ([0x03; 33]/[0x04; 21] are rejects), rejects-never-guesses unchanged (0x05/0xff the unknowns). All exactly as ADR-018 §Decision pins them.
• C-1's remainder: ADR-018 accepted with all five decisions owned (§Decisions 2-6; the rejected alternatives named in the text); ADR-002 carries the annotated exception + registry note; the specs dated (hashing-and-keys.md's derivation-family section, store-api.md's put_git_object seam + per-family stat semantic, ops-surface.md's digest-wire-form blob-family posture); the fleet threading landed as ADR §Decision 7 (two env-driven exact-count-sweep-outcome tests in src/store/fleet.rs); tests/git_interop.rs green against the real git CLI (this gate's run: 7 passed incl. the byte-exact family test, the blob-tag negative, the sha-256 sibling, and the seam-guard rejection test).
• C-2 — ADR-019 accepted; the (a)+(c) split landed (the cap at the mint boundary via OpsConfig::token_registry_max_entries / TokenRegistry::with_cap / DEFAULT_CAP, refusal-not-eviction, Error::RegistryFull as the sixth family member, the declared MINT_REFUSED wire answer naming the committed digest, no custody-taken guarantee test-pinned — both altitudes in src/ops/tokens.rs + src/ops/put.rs); the attack shape is on paper in the ADR's Context and the module/ops-surface.md docs; the tokens.rs retention-doc's stale "deferred" language is retired (the doc now points at the decision); (b) rejected on ADR-019's three-reason record. The "not silence" bar is met with room to spare — the store actively bounds the loop rather than documenting it.
• C-3 — as chartered: busy_timeout = 5000 pinned at open (src/sqlite.rs, in the durability block's execute_batch), the constant-vs-knob choice recorded with its reason (DQ-7's no-contention-at-POC-scale evidence = no knob story), the module doc carries the contention posture, and the pragma test asserts 5000 (opens_with_wal_synchronous_normal_and_busy_timeout).
• C-4 — as chartered: KeyBytes (the small Copy wrapper, [u8; 33] cap, Deref, slice-based Eq/Ord/Hash agreeing with the keys' total order), Key::key_bytes() the mint, the serving-path borrow temporaries converted, the round-trip + ordering agreement unit-tested, zero behavior change. Review-002's local.rs:899 anchor corrected in the task notes (a #[cfg(test)] helper, not a serving path).
• review-002 stamped closed — status open → closed with the disposition pointers per C-item in the frontmatter and a dated Disposition section on the body; the alkcall survey's no-impact conclusion recorded as held. The prototype branch poc-o-git-objects (f0b045c) deleted: parity confirmed (c1-impl's re-derivation, registry/derivation byte-for-byte, the CLI-validated interop green); not merged per the review's own framing; the reference material lives in ADR-018 and the landed surface.
• The full verification block (this session's actual runs): cargo test (default: 155 unit + 54 conformance + 7 git-interop + 2 readme), cargo test --all-features against the live pglo-poc harness (338 + 125 + 7 + 3 — the pg columns ran for real, not skipped), both clippy variants --all-targets -- -D warnings clean, cargo fmt --check clean, cargo doc --no-deps clean, the fuzz corpus-replay gate green (7/7).
• Publish readiness — cargo publish --dry-run --allow-dirty green (94 files packaged and verified). Two inline fixes were made in this session (the gate's "CHANGELOG current / README honest" clauses found them stale, pre-dating wave 13): the CHANGELOG's [0.1.0] entry now absorbs the wave — the git-object family, the token admission posture, the borrowed-key overloads, the sqlite contention posture, the alkcall bump — with the verified counts refreshed (218 default / 473 all-features) and the ADR-018/019 link refs added; the README's opening hash description now names the git-object family and put_git_object, the from_git_oid_hex phrasing scopes to blob oids, the sqlite engine row carries the busy_timeout posture, and the docs section says ADRs 001-019.
• The plan stamps — docs/plans/implementation.md's wave-13 row and frontmatter dated completed (the publish hold lifts); AGENTS.md's status line now publish-ready.
• Residue named: the post-publish observations' home is docs/architecture/open-questions.md's externally-owned register (OQ-07/08 — unchanged, not this wave's doing) — no new residue came out of the wave; ADR-018's re-entry door (a family-explicit wire form needs a named consumer + a new ADR) and ADR-019's (b)-rejection re-open rule are the typed future-decision doors, on record in the ADRs themselves.

Summary

Wave 13's review gate ran green and the publish hold lifts. C-1 verified end to end — the one-way door's bytes read against ADR-018 line by line and exact (registry 0x03/0x04, the preimage-identity derivation, the family's key-decode/order, the inert len), all five ADR decisions owned by the landed text and code, the fleet threading proven by exact-count tests, interop green against the real git CLI. C-2 verified — the ADR-019 decision landed as the mint-boundary cap with the typed MINT_REFUSED refusal and the attack shape on paper; "not silence" exceeded. C-3 and C-4 landed as chartered (the pinned busy_timeout contract; KeyBytes with the serving-path conversions, one review anchor corrected as a test helper). review-002 stamped closed with disposition pointers and the prototype branch deleted after parity confirmation. The full verification block green — default 155+54+7+2, --all-features against the live pg harness 338+125+7+3, both clippy variants, fmt, doc, the fuzz corpus replay — and cargo publish --dry-run --allow-dirty packaged 94 files clean. Two minor staleness issues found and fixed inline (the gate's own clauses): the CHANGELOG now absorbs wave 13 and the README describes the family honestly. The plan and AGENTS.md are stamped publish-ready; publication runs manually, coordinator-side.