Repository navigation
ui-server: make login buckets, passkey challenges, sync locks and send order per-app #1364
Description
Part of #1343.
Context
Delivered prerequisite outputs: #1363. Their output references remain relevant, but they are no longer active blockers.
The four named stores/counters were historically module-level at fetched source 0d780605fe1ea9a281cce947b1f0074f3f3e7acc. The current published draft constructs app-owned createLoginRateLimiter (packages/ui-server/src/middleware/auth.ts:509), createPasskeyChallenges (packages/ui-server/src/middleware/passkeys.ts:128) and route-local syncingRoots (packages/ui-server/src/routes/brain.ts:33), with host-local nextSendOrder (packages/ui-server/src/ws/host.ts:266); createApp supplies app ownership (packages/ui-server/src/app.ts:661-664). These pointers describe draft #2377 at 26fc4d9e8895b05ba7b773858b363773edb3f443.
Scope
- Construct each in
createAppand pass through deps. - For
nextSendOrder, confirm in the PR whether a process-global monotonic counter is required for correctness; keep it global only with a comment saying why.
Out of scope
- Changing rate-limit thresholds or challenge expiry.
Acceptance criteria
- A test exhausts the login bucket on app A and proves app B in the same process still accepts a login, failing before the change.
- Same for a pending passkey challenge.
Verification
bun run test packages/ui-serverContract impact
None.
2026-10-09: sequenced against the other code-quality issues to avoid overlapping edits; see the epic's planned-order comment.
Updated 2026-10-12: removed completed blocker declarations, retained delivered-output context and all remaining prerequisites; readiness and existing rulings preserved.
Updated 2026-10-17: verified the four named globals against fetched source and corrected the send-order citation; scope and acceptance criteria are unchanged.
Current implementation and qualification — 2026-10-22
Draft #2377 now publishes 26fc4d9e8895b05ba7b773858b363773edb3f443 on fix/1364-per-app-state-c8f3, after merging main 7b8a755ea329bd48a11b790e916c417b6f608eee into original published head d54b10667a91d799289f16560731d669fdf943b0. The normal merge preserves both ancestors. Eight conflicts were citation-only; all eight HTTP coverage citations and their range endpoints are reconciled. Product scope remains the same six source files, six test files and server patch changeset; the complete contribution is 23 files.
The unpublished 11dc5224 candidate and its raw machine-local artifacts were unavailable on takeover. This continuation reconstructed from the published source and fresh main and supplies fresh evidence. Historical receipts remain at the 07:30 takeover handoff; none is relabelled as proof of this head. The maintainer's removal of #2403 as a blocker remains controlling. The historical failed preflight and instrumented non-reproduction remain failed / diagnostic respectively.
Fresh current-head proof:
- Focused real-app/auth/passkey/sync/follow-up/shutdown/citation batch: 238 pass, 0 fail, 2,179 assertions across 11 files.
- Strict
tsc --noEmit: pass. Claude/Pi provider-history guards: 25 pass, 0 fail, 135 assertions. - All 1,159 citations pass the anchor audit. Pending changeset package references and full changesets plan pass; the existing fixed group plans a minor release with no major bump.
- Login-map mutation: app B expected 200 / received 429; restored 1 pass / 19 assertions.
- Challenge-map mutation: app B expected 401 / received 200; restored 33 pass / 182 assertions, including app A single use.
- Sync-set mutation: app B expected 200 / received 409; restored 3 pass / 15 assertions.
- Receipt-order propagation mutation: refused follow-up runs after a later message; restored 16 pass / 50 assertions.
- Every mutation was restored byte for byte before focused proof and publication. One unnecessary native-lock admission for the restored passkey control was cancelled before Bun launched; its ordinary control produced the reported green tests. Copied fixtures do not qualify native Btrfs or loop storage.
The required current-head default bun run check:pr --base origin/main passed, exit 0, in one attempt. Mount count at entry: 91. Lint/leakage, environment docs and changeset gates passed. Fast batch: 562 pass / 0 fail / 3,760 assertions across 25 files. Affected feedback: 2,177 pass / 0 fail / 19,442 assertions across 166 files, 3,255.50 seconds. The prior cold-capture timeout case passed in 3,165.09 ms; the #2309 1440px parallel-session reload case passed in 16,061.84 ms. These fresh observations do not attribute or erase the historical failures. The 840-file full unit inventory and complete selected hosted categories remain pending; import-graph feedback misses spawned/file-read inputs. The implementation worker stops at a draft PR and local proof; the coordinator owns confirmation, complete selected hosted proof, review and merge. No readiness, closure or waiver of earlier failures is claimed. Release milestone remains 0.44.0 on issue and PR.
Updated 2026-10-22: replaced the unavailable unpublished-source status with the newly published merge and fresh behavioral receipts; the two acceptance tests are checked only from actual failing mutations and restored controls. Local preflight passed; complete selected hosted qualification remains pending.
Activity
schlessera commentedon Oct 17, 2026
2026-10-17 priority reconciliation: raised to
priority: p1as a required open child of P1 epic brain-kit#1343. This applies the maintainer's blocker-priority ruling recorded in AGENTS.md and the request to align P1 epic subissues. Required unfinished children block their epic's outcome. Existing ownership, scope, readiness, dependencies and release commitments remain unchanged.schlessera commentedon Oct 17, 2026
Claiming #1364 for per-app mutable state isolation. Claim token:
p1-1364-20261017-c8f3. Intended branch:fix/1364-per-app-state-c8f3. Will verify real two-app authentication and passkey isolation, audit sync locks and send ordering, and preserve existing security limits.schlessera commentedon Oct 17, 2026
2026-10-17 readiness/source reconciliation: verified all four globals at fetched main
0d780605fe1ea9a281cce947b1f0074f3f3e7acc; corrected the send-order pointer in the body from the stale line 607 to line 872. #1363 remains delivered by #1430. No scope or acceptance ruling changed.Keyless failing-first evidence on that base: the new real
createApptwo-app test expected app B's correct-password login to return 200 after app A exhausted its bucket, but received 429. The pending-challenge route test expected app B to reject app A's challenge with 401, but received 200. After app-owned store wiring, focused authentication checks passed (129 tests); sync/queue checks passed (29 tests). Process-wide password/passkey CPU reservation ceilings remain intact. Send-order comparisons only concern one host's session queues, so receipt ordering can be host-owned.The complete local ui-server attempt is retained as failed/incomplete: a declaration emit exceeded its unchanged 30-second deadline, then shared temporary-storage quota exhaustion produced EDQUOT and SQLite write errors. The run was stopped after these environmental failures. A concurrent typecheck was SIGKILLed without TypeScript diagnostics; sequential diagnosis/verification is continuing. None of these receipts is being reported as green.
schlessera commentedon Oct 17, 2026
Resuming campaign claim
p1-1364-20261017-c8f3on branchfix/1364-per-app-state-c8f3. The cancelled implementation worker has transferred custody to this continuation; this preserves the original claim identity. Fresh issue/comments and branch PR inspection show no competing owner. Existing failed/incomplete receipts remain failed; preserved mutations have been checked against their implementation backups and are restored. Continuing scoped offline proof and current-candidate verification.schlessera commentedon Oct 18, 2026
2026-10-18 verification handoff for claim
p1-1364-20261017-c8f3: scoped implementation is preserved in draft #2377, headd54b10667a91d799289f16560731d669fdf943b0/ base775eb17aab740fa759c2182f306c38fc17acbcbe. Current preflight is failed (548 fast pass; affected 2,133 pass / one Pi index failure). Strict types pass. The one isolated diagnostic pass did not capture the original indexError or diagnose the failure and is not a replacement full receipt. #2403 records the concrete missing attribution and required resumption proof; it blocks this issue at the same P1 priority and 0.44.0 milestone. All deliberate mutations/instrumentation are restored; no hosted qualification, merge or closure is claimed. Releasing this invocation’s uncontested assignment for a documented terminal handoff; branch and PR remain preserved.schlessera commentedon Oct 21, 2026
2026-10-21 (maintainer-approved triage, 2026-10-21): dropped
Blocked by #2403. That attribution is a single local partial-index observation in the leaked-mount period, with no hosted occurrence, and recurrences now self-report via #2426. It is now an ordinary p2 item. This issue proceeds on its own required proof.schlessera commentedon Oct 22, 2026
Session takeover handoff — 2026-10-22
This session has ended; all workers, proof processes and workspace leases are drained. Its coordination hold on #1364 / draft #2377 is released for takeover after fresh issue/comment/claim checks. No other owner's custody is transferred. Issue scope, assignment state and milestone remain unchanged; the work is incomplete.
The clean unpublished branch is
fix/1364-root-source-b17-r1, head11dc522445f7239484162e976466b2c85bad447c, tree7b220f2e61e922f58b656de3b69d3a6aeb9892db, retained at/var/tmp/source1364-20261022-r1/checkout. Its ordered parents are3be6d7ac68eb7c9e767862210aa2055cc362b8beand original remoted54b10667a91d799289f16560731d669fdf943b0; original remote and frozen baseb17e349b7c8ff0f69c4cade3a953c86008d3ede8are ancestors. The PR remote is unchanged. Use the full contribution in/var/tmp/source1364-20261022-r2/contribution.patch; do not reconstruct it from the stale remote or force-push.Completed proof: 205 focused passes / 2,070 assertions; strict types; all four intended login/challenge/sync/receipt-order mutation failures followed by exact restoration and green. The required default preflight remains failed/incomplete: 562 fast passes / 3,760 assertions, then the cold unassigned-capture sign-out case exceeded its unchanged 30-second deadline. Closed-browser errors followed timeout cleanup. One phase-instrumented whole-file diagnostic passed 65 cases / 535 assertions, with all 74 phase records complete; it did not identify the historical stalled await. The source was restored exactly. Published evidence.
Takeover receipts:
/var/tmp/proof1364-20261022-r1/result.txt: focused/types/actual plan./var/tmp/mutation1364-20261022-r1/result.txt: all four red/restored controls and the failed original preflight./var/tmp/investigate1364-firstfailure-20261022-r1/report.txt: source/wait map and evidence limits./var/tmp/diagnostic1364-association-20261022-r1/result.txt: instrumented NONREPRO, exact restoration and drain./var/tmp/public1364-body-publication-20261022-r1/handoff.txt: verified current issue/PR body publication.Next action: resolve or obtain a qualified disposition of the recorded first failure before a justified new current-candidate qualification attempt. The maintainer's removal of #2403 remains controlling, but does not waive this separate failed preflight. Do not repeat unchanged runs, raise deadlines or expand diagnostic infrastructure. Reassess any new base before integration; preserve the frozen receipts. All selected hosted categories, matching-head merge and automatic-main verification remain outstanding. Last audited main
b17e349was green for its selected scope only, not this candidate. #2284 remains stopped.Local takeover index:
/var/tmp/release044-session-handoff-final-6czoa6tr/HANDOFF.json. If these machine-local artifacts are unavailable, recover the original source/receipts or requalify; comment summaries are not substitute raw proof.schlessera commentedon Oct 22, 2026
Resuming #1364 and draft #2377 from the published head under claim
release044-1364-resume-20261022-r1, branchfix/1364-per-app-state-c8f3. The 2026-10-22 takeover released the previous claim. I will merge current main, reconstruct the missing citation reconciliation, repeat the four scoped mutations, and run one current-candidate preflight. Historical failed receipts remain failed; a recurring infrastructure timeout will be retained and reported. This continuation stops at a draft PR and local proof; candidate confirmation and merge remain with the coordinator.schlessera commentedon Oct 22, 2026
Draft implementation handoff for claim
release044-1364-resume-20261022-r1: #2377 now publishes26fc4d9e8895b05ba7b773858b363773edb3f443onfix/1364-per-app-state-c8f3, after normally merging main7b8a755ea329bd48a11b790e916c417b6f608eee. The original published head is preserved as an ancestor; all citation conflicts and HTTP coverage ranges are reconciled.One current-head
bun run check:pr --base origin/maincompleted with exit 0: 562 fast passes / 3,760 assertions, then 2,177 affected passes / 19,442 assertions across 166 files, with zero failures. Focused proof passed 238 tests / 2,179 assertions, strict types passed, and Claude/Pi history guards passed 25 tests / 135 assertions. All four intended login/challenge/sync/order mutations failed at their expected behavioral assertions, were restored byte for byte, and have passing whole-file controls recorded in the PR. The historical association timeout and parallel-session reload case both passed in this attempt; their earlier failed receipts remain historical and unattributed.At the final current-head inspection, changeset, contract and draft gates passed. Heavy categories are intentionally skipped by draft cadence, so complete selected hosted proof remains pending. PR and issue retain 0.44.0. The worktree is clean; this invocation's assignment has been removed and its claim is released. No new follow-up issue or unresolved implementation question was found.
The PR remains draft with
Refs #1364. No ready transition or integration confirm/acquire/merge command was performed. Coordinator next action: review this published head and request complete selected hosted candidate proof against the verified current base before any merge. This worker stops at the authorized draft-and-local-proof boundary.schlessera commentedon Oct 22, 2026
Closing as completed (2026-10-22). Delivered by #2377, squash
dca0e3476154348ec1f7576b5d3f2d225faa949c.createAppnow constructs the login buckets, passkey challenges and sync admission set. Each WebSocket host owns receipt ordering. Order is compared only within one host's session queues, so no process-globalnextSendOrderis needed. Password and passkey CPU verification reservations stay process-wide on purpose.sendOrder: the prompt-order assertion fails. Restored: 16 pass / 50 assertions.bun run check:pr --base origin/mainpassed, exit 0, on head26fc4d9eagainst base7b8a755e. Fast batch: 562 pass. Affected feedback: 2,177 pass. Typecheck, citation audit and provider-history guards also passed.dca0e347, concluded success. It includes the full unit inventory that the local preflight left pending. The next main run (aa8c896) failed in offline-launcher and private-repository doc-scan unit tests, which this change does not touch.Milestone 0.44.0 is unchanged.