alkgit/tasks/architecture/oq-19-wire-validations.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
architecture/oq-19-wire-validations	OQ-19 tracker — wire validations (rider 2 in-place; rider 1 is the n5 task)	completed	architecture/n5-unborn-head-rider core/w5-oq19-positive-acks core/w5-oq19-real-client-tokens	narrow	low	component	implementation	wire-validation advertisement-honesty owed-before-publish

OQ-19 tracker: implementation-phase wire validations

Tracker for OQ-19 (deferred(scope), implementation-phase — review-003 reclassified it from open): the advertised/machinery promises that lack capture-level validation over the final substrate shape. Each is a small session against real git (the OQ-02/OQ-04 capture-session shape); each gates the OQ-03 freeze (validate or retract — ADR-003's honesty rule), nothing structural. Rider 1 (the unborn-HEAD rider) is executed as the sibling task architecture/n5-unborn-head-rider; riders 2 and 3 execute as the wave-5 tasks core/w5-oq19-positive-acks and core/w5-oq19-real-client-tokens (the wave-5 decomposition record) — this task closes when all are done, hence the depends_on.

1. The unborn-HEAD rider (transport.md §ls-refs) — RESOLVED (rider 1, architecture/n5-unborn-head-rider, 2026-10-23)

• ls-refs=unborn is advertised (ADR-003's honest-advertisement list); serving an unborn HEAD's symref line was never exercised against a real client (POC-1 accepted the capability token only; the fixtures all had refs).
• Sessions: an unborn repo (registry record exists, no ref rows — trivial now that refs are rows), ls-refs round with a real client, both substrates (duplex + the stateless/http shape per POC-3's service stub); the expected line is the symref-target shape with no oid (RefLine's oid: None leg — ADR-018 §5).
• If it cannot be served correctly, drop the token from the advertisement (the honest move; ADR-003).

Rider-1 outcome — validated (the token stays), with the wire emission shape corrected by the capture. The rider executed in the wave-5 review-gate session (the decomposition booked it in-wave as this sibling task; it had not run when the gate opened — the gate executed it inline). Ground truth captured live against git 2.43.0's own server first (git daemon + an unborn bare repo): the real client sends peel/symrefs/unborn on its ls-refs round, upstream serves the oid field as the literal unborn token (unborn HEAD symref-target:refs/heads/main) — and prints nothing for it on ls-remote (a resolution shape, consumed for the default branch). Against our machine, the zero-oid line the wave-2 rows served broke a real clone — the client wants the null oid (ERR object <zero-oid> does not exist); the sessions landed with the emission corrected to the upstream literal (src/v2.rs's UNBORN_TOKEN, ADR-018's §5 amendment note, transport.md §ls-refs updated; the inbound parser accepted both shapes all along), and the rider's rows (ls-remote over the duplex door + over the stateless door + the unborn-HEAD clone) are green in tests/real_client.rs — full outcome in the n5 task's Summary.

2. common_haves over the substrate Find (ADR-014's ack seam) — RESOLVED (rider 2, core/w5-oq19-positive-acks, 2026-10-23)

• The multi-round fetch POC-X ran against the substrate-backed server produced NAK-only acknowledgments (no server-side have tracking exercised); the common_haves seam — a have recognized iff it exists in the object store and is a commit — has its machinery from POC-O/POC-X (existence over the substrate Find; is-commit via the object header) but no positive-ack capture.
• Session: a client fetch with real haves in one no-done round; the server must emit ACK <oid> per recognized have, then the done round's boundary set equals the recognized subset (ADR-014 §2).

Rider-2 outcome — validated (the machinery-side run). The positive ack path serves correctly over the doubles' Find: the capture rows landed in tests/duplex_serving.rs (a_multi_have_session_acks_each_recognized_have_and_the_done_boundary_is_the_recognized_subset) and tests/stateless_serving.rs (a_multi_have_post_acks_each_recognized_have_and_the_done_boundary_is_the_recognized_subset) drive a multi-have session on both serving substrates — one no-done round carrying two recognized commit haves plus one missing and one exists-but-not-a-commit (a blob) have emits acknowledgments + ACK <oid> per recognized have in request order (NAK absent, flush-terminated, never ready), and the follow-up done round over the same mixed have set packs exactly closure(want) − closure(recognized subset) — both commons bound the walk, the missing and the non-commit haves subtract nothing. The recognition contract (exists + is-commit, ADR-014 §5) is asserted at the seam (tests/doubles.rs: common_haves_recognizes_a_have_iff_it_exists_and_is_a_commit — non-commit objects unrecognized), at the machine level (tests/fetch_machines.rs: the NAK-only row drives the negative leg — the existing negotiation rows unmodified, still green), and at the capture level (the blob have above). Disposition: validated — the machinery promise is capture-evidenced; the advertisement keeps fetch=wait-for-done and the ack loop stays as landed (ADR-014). The substrate-odb facet of this rider (the same capture against the real Find front) re-runs in track B wave 7 before the substrate crate's freeze — the OQ entry's wording covers both runs.

3. Real-client fetch grammar riders (added by the wave-2 gate) — RESOLVED (rider 3, core/w5-oq19-real-client-tokens, 2026-10-23)

• The negotiation machine fail-closes on argument tokens the honest advertisement does not declare — including include-tag, which real clones send (git-protocol.md §fetch argument inventory). The fail-closed choice is the interim posture (core/w2-negotiation's recorded note); a real-clone session against the landed machine validates the decline is survivable end-to-end, and decides accept-and-honor-by-omission (the thin-pack/no-progress shape) versus honest retraction for any token real clients actually send.
• Same session: session-id= and any other capability lines a modern client sends on command=fetch pre-lines — the machine accepts only agent=/object-format= today.

Rider-3 outcomes (executed as core/w5-oq19-real-client-tokens; rows in src/fetch.rs's unit tests, tests/fetch_machines.rs, and the real-client sessions tests/real_client.rs — real git 2.43.0 against the landed machine over both substrate doors; flagged for the wave-5 gate to confirm or correct):

• include-tag — accept-and-honor-by-omission (the thin-pack/no-progress shape; the accepted set grew by one). The decision basis: the token is un-gated in the real V2 client's send path (transport.c v2.43.0: args.include_tag = data->options.followtags; builtin/fetch.c sets the option to 1 for every ordinary configured fetch — the pre-lines carry no include-tag capability, the V2 fetch= feature list has no slot to advertise or retract it, so a decline could not inform a conforming client) — captured live: an ordinary real git fetch sends include-tag in its negotiation round, and the pre-decision fail-closed decline broke the session (fatal: remote error: fetch: unexpected argument "include-tag"). What the token requests (annotated tag objects riding the pack) degrades gracefully to what we serve — the tag ref tips are wanted directly on clone (captured) and git's own tag backfill re-fetches tag refs when the pack omits them (backfill_tags, builtin/fetch.c) — so the absence changes nothing fatally, and the pack is the want closure as generated (no tag synthesis; ADR-004): honor by omission, the pack bytes identical with and without the token (the fetch_machines.rs row).
• session-id= — honest retraction; the decline stays (fail closed). The decision basis: git's V2 client sends the pre-line only when the server advertises the session-id capability (fetch-pack.c v2.43.0: advertise_sid && server_supports_v2("session-id") — captured live: with transfer.advertiseSid=true the real client sends session-id= only against an advertisement that declares it) — this advertisement never declares it, so the decline is unreachable by a conforming client; the token's semantics (session identity correlation) is server-side telemetry we do not serve, and accept-and-ignore would be advertising what we don't serve (convention 9's invariant, ADR-003). The row pins the explicit session-id= pre-line as a session error (src/fetch.rs unit tests).
• The rest of the modern-client inventory — captured live (git 2.43.0 over the git:// and smart-http door shapes, both substrates): the capability pre-lines a real client sends are exactly agent= and object-format= (both served); the tokenized argument grammar is exactly thin-pack/no-progress/ofs-delta/wants/haves/ done (+ include-tag per the configured-fetch sessions above). shallow/filter/server-option were not observed in any session (git's own client gates them on the advertisement's fetch= features — the machine keeps declining them fail-closed as unimplemented surface, and the advertisement honestly omits them).

Resolution note

OQ-19 closed at the wave-5 review gate (2026-10-23) — all three riders served/dispositioned (rider 1: validated, emission shape corrected to the upstream literal; rider 2: validated machinery-side, the wave-7 substrate facet stands booked; rider 3: include-tag accepted + honored-by-omission, session-id honestly retracted). OQ-03 core-side freeze inventory settled at the gate; the substrate-odb facet of rider 2 remains booked on wave 7 per the OQ entry's both-runs wording.