Repository navigation
ui-server: account and security administration commits on the write worker #3002
Description
Part of epic #2850.
Context
Account and security administration commits on the app connection:
- Principals. The admin mint,
createPrincipal(packages/ui-server/src/db/principals.ts:161-197, from POST /auth/principals). Revocation:revokePrincipal:367-371,revokeAllPrincipals:379-383,revokeByCredential:391-399, frompackages/ui-server/src/middleware/principals.ts:196, logout inpackages/ui-server/src/middleware/auth.tsandpackages/ui-server/src/middleware/passkeys.ts:608. - Passkeys. The counter, credential, label and delete writes,
packages/ui-server/src/middleware/passkeys.ts:417,:547,:602,:612. - Reference grants.
packages/ui-server/src/db/reference-grants.ts:117-148. - Push subscriptions.
subscribe,unsubscribeandunbindPrincipal,packages/ui-server/src/activity/push-sender.ts:165-202(the last on every revocation,packages/ui-server/src/ws/host.ts:755). - VAPID keys. The lazy key insert,
vapid,packages/ui-server/src/activity/push-sender.ts:106-113, reached from GET /push/public-key and every delivery pass of the 20-second tick. - Account partition seed.
accountPartitionSeed,packages/ui-server/src/middleware/account-partition.ts:48-56.
#2992 moved authentication's per-request principal writes and left revocation here on purpose. A revocation must be in force for every request from the moment its route returns.
Scope
Move these writes to the write worker.
Out of scope
The request-path principal writes already moved in #2992.
Acceptance criteria
- Each moved write commits on the
ui.dbwrite worker (openSqliteWriter,packages/ui-server/src/db/write-worker.ts) atsynchronous=FULL, keeping its transaction contents and its order relative to journal, Activity and the other worker writes. - A focused test fails if a moved write runs on the app connection (
APP_CONNECTION_WRITEviawatchWriteSites,packages/ui-server/tests/helpers/write-sites.ts) or commits below FULL (SQLITE_WRITE_BELOW_FULL). Mutation receipts in the PR show each guard failing on its named assertion. - Every reader that relied on the write having committed when the call returned still sees it (awaits the write, or waits for writes submitted before it). Refusal classes are kept across the worker.
- Before/after receipts on the native pi UID 1000 cell under three
dd … conv=fsyncwriters (tests: attribute recurring one-second native hosted health timeouts #2416 method, turn wait joined): no window ≥ 250 ms afterreadyattributed to a moved writer, or a recorded reason the cell does not exercise it. - A revocation is in force for every authentication check from the moment its route answers. Either the route awaits the commit, or a read overlay applies the pending revocation from submission. A test proves no request authenticates as a revoked principal while the revocation commits behind a slow worker procedure.
- The lazy VAPID key is created at most once even when two delivery passes and the key route race for it.
Verification
bun run test packages/ui-server, bun run test ./tests, bun run check:pr --base origin/main, and the native hosted proof (scripts/prove-native-host.ts) under the fixture lock, with and without the fsync load.
Contract impact
None expected. A retyped public signature (api-report/ui-server.txt) needs the classification in docs/integration-contract/package-api.md checked first.
Activity
schlessera commentedon Oct 26, 2026
Claim
bk3002-codex-20261026: implementing the account/security administration write-worker slice onfix/3002-account-admin-offloop-044, following #2992. I will preserve FULL durability, revocation visibility, refusal/status behavior and transaction order, and hand off a draft PR with proof receipts.schlessera commentedon Oct 26, 2026
Draft implementation: #3024
Head
9b64841d58fb02d23292d1e864fbfc90bd226e97includes main64af9b5a0803f6c890c9660d180a3c46a9a00ac0. Account/security writes use the shared FULL worker; original transaction bodies/order, refusal classes and HTTP statuses are retained. Includes the patch changeset and owned citation updates; no supported public contract changes.Refreshed proof: 62 focused tests / 327 assertions; all 28 per-procedure connection/FULL mutations fail on their expected guard/assertion and are restored; tsc/lint pass; PR preflight 809 tests / 5,214 assertions; root suite 1,966 tests / 74,436 assertions; provider-history guards 31 tests / 259 assertions; every packed Bun/Node consumer probe passes. Full UI-server result: 4,168 pass, zero failures, 28,751 assertions across 351 files (2,502.89 s); exit 0.
Both complete native hosted matrices pass (433.007 s without load; 448.153 s under three fsync writers, iterations 811 / 815 / 815), including the expected negative control and all ten owned fixture cleanups. AppArmor is unavailable. The pi UID 1000 cell makes none of this group's requests after ready, so no before/after lag attribution is claimed; seed initialization precedes ready.
Current-head draft gates pass (
contract,sync,draft gates,changeset); the PR remains draft with milestone 0.44.0 on both PR and issue. Historical full-suite observations remain recorded in #3020, #3021 and #3009, with superseded partial controls explicitly excluded from passing proof.Coordinator next action: review the scoped diff/receipts, request exact-candidate hosted confirmation, and own ready status and merge. I am releasing claim
bk3002-codex-20261026; the live draft PR remains the implementation ownership record. No ready transition, integration reservation or merge was performed.schlessera commentedon Oct 26, 2026
Addendum to the draft handoff for #3024:
Main advanced during the completed proof to
da1ec5f5d8e6d050a95f542112c5eed22de694a5(#3025, #3026). These commits are not included in the qualified head above. A read-only merge assessment finds source code merges automatically and overlaps in three documentation files:docs/decisions/session-principals.md,docs/decisions/sqlite-write-worker.md, anddocs/plans/async-collaboration.md. Pending integration work is to reconcile those citations/prose with the final reference-source slice, then request qualification for that resulting candidate. No combined-tree proof for this later main is claimed.The implementation branch remains pushed and clean at
9b64841d58fb02d23292d1e864fbfc90bd226e97, with complete passing local proof against the coordinator-requested64af9b5a0base. This later integration remains pending alongside coordinator review and ready-candidate confirmation.