[puretensor]

Problem and evidence

Severity: medium; high confidence. A combined edit could mutate early fields and then reject a later field. An MCP or Rust dashboard request containing a valid title and priority 6 returned an error after changing the title; local pt edit did the same with a valid title and invalid deadline. The Python sidecar also continued to pt priority after pt edit failed. Callers could reasonably retry a reported failure while the task and journal already contained partial changes.

Regression tests were run against unchanged baseline logic at a95a43b36c23b41532ee3fd7976e1185c8e9e204 (with only regression tests and version metadata added). The MCP/dashboard unchanged-title assertions failed, the corrected local CLI test using a PT-N identifier failed, and the Python HTTP test observed two subprocess calls instead of one.

Root cause and fix

The adapters composed separately committed core mutations. Introduce a shared TaskEdit operation that validates inputs and commits requested fields, recurrence metadata, labels, interactions, and one attributed task.updated event in an IMMEDIATE transaction. Local CLI, MCP, and Rust dashboard edits now use it. Keep existing single-field APIs and post-edit rescoring behavior.

The Python sidecar now returns immediately when its first CLI mutation fails.

Regression coverage

• MCP: invalid priority, invalid date, ineffective blank labels, forbidden recurring deadline clear, and a late database label failure leave fields and journal unchanged.
• Rust dashboard and local CLI: rejected later fields do not alter the title.
• Core: a successful combined edit records one event; a duplicate event key rolls back fields, labels, recurrence, interactions, and cursor. Omitted and explicitly cleared deadlines remain distinct.
• Python HTTP handler: failed edit does not invoke the following priority mutation.

The complete fixed-branch workspace suite passed 411 tests, with 49 native-feature tests, 67 dashboard Python tests, 5 script tests, and 35 Node tests also passing.

Validation

Validation on Rust 1.98.1, all exit 0:

cargo test --workspace --locked
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo build --workspace --locked
cargo test -p ptask-distill --features native-ml --locked
cargo clippy -p ptask-distill --all-targets --features native-ml --locked -- -D warnings
cargo fmt --all -- --check
cargo deny check advisories licenses sources
bash scripts/ci-version-check.sh
bash scripts/generated-artifacts.sh --check
bash scripts/ci-production-build-check.sh
actionlint
python3 -m unittest discover -s scripts/tests -v
PYTHONPATH=dashboard python3 -m unittest discover -s dashboard/tests -v
node --test dashboard/tests/face_unlock.test.mjs dashboard/tests/face_unlock_markup.test.mjs dashboard/tests/domains_markup.test.mjs
git diff --check
git diff origin/main -- . ':!Cargo.lock' | gitleaks stdin --redact --no-banner --log-level warn

Builds used a dedicated audit target directory and CPU fence; database tests used disposable stores.

Independent read-only diff review found no outstanding blockers. Remote CI is separate from these local results and will be reported by the checks on this PR.

Compatibility, residual risks, and rollout

No schema migration, dependency update, production change, or public argument change. A combined Rust edit now emits one event containing the requested fields instead of several separately committed events. Existing event consumers receive the same task.updated type; scoring remains a separate post-commit operation.

The Python sidecar still uses separate pt edit and pt priority calls for compatibility with existing binaries. A later priority failure cannot roll back an earlier successful edit. This limit is documented; the sidecar change only prevents subsequent mutation after an earlier failure. Remote CLI sync batches are outside this transaction change.

Workspace version: 3.30.8; sidecar version: 0.19.2. This PR is independent of the other audit branches and based directly on confirmed main at a95a43b. Version metadata may need reconciliation when landing multiple audit PRs; no stacking dependency is required.

No overlapping open GitHub issue/PR was found before publishing the audit branches. No deployment or merge has been performed.

Additional validation limits

Native-feature tests include existing model-dependent cases that can return early when assets are unavailable; model-loaded coverage is not claimed. Local builds were debug workspace builds, not release or cross-target builds. Dependency-policy checks passed with pre-existing yanked chacha20 0.10.0 and unused BSD-2-Clause allowance warnings. The upstream-backed chacha20 correction is isolated in PR #102, not folded into this defect branch.