fix(claiming): preserve inherited PR candidates - #795
Merged
Conversation
Preserve exact published candidates, including authorized pull request metadata, across blocked delivery, release, fresh-clone reconstruction, and reclaim. Validate terminal pull request identity and add end-to-end contract coverage for the inherited candidate lifecycle.
shaug
force-pushed
the
scott/issue-794-inherited-candidate
branch
from
July 30, 2026 04:49
a6bca9f to
c8fa15c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Preserve an inherited exact candidate through authorized pull-request publication, interruption, recovery, and ready-PR delivery without weakening mailbox provenance or mutation fences.
Summary
This change separates immutable candidate identity from authorized pull-request publication metadata while keeping repository, base, head, remote-ref, reachability, checkpoint ordering, and authority checks fail-closed. Each current claim now records the exact transferable predecessor receipt it inherited, and checkpoint history records the pull-request value, including explicit null, at every authorization boundary. Static reconstruction uses only that causal receipt and append-only checkpoint chronology; it does not infer provenance from timestamps or unrelated releases.
Blocked, released, reclaimed, and takeover paths preserve the complete candidate and its pull-request metadata. Same-lineage head advances retain an existing pull request only after an exact push and candidate-publication acknowledgement. Pull-request introduction or replacement requires fresh exact-head-and-ref create or update authority. Delivery may bind that metadata directly into a newly written matching retained receipt, without an intermediate candidate-publication checkpoint, while stale, reused, cross-head, cross-ref, unreceipted, and mismatched-receipt transitions remain rejected.
The complete interrupted lifecycle is covered from a pre-PR transferable candidate through authorized publication, blocked finalization, release, fresh reclaim, same-lineage advancement, a second release, inherited PR replacement, and exact ready-PR delivery from a fresh clone. Adversarial histories prove that only the explicitly bound predecessor receipt supplies inherited PR provenance, including when multiple same-lineage releases have different PR URLs and tied timestamps.
Canonical mailbox transition
The live #781 mailbox was updated once outside production code after the reviewed reader became strict. An exact old-head lease advanced origin/atelier-mailbox from 0398490 to direct child 21bc662 with exactly three insertions: the current claim now names receipt rcp_019fb015-7f52-7145-b7d5-6b49f4fb58f4, and both historical pre-mutation authorizations explicitly record a null pull-request value. Independent remote readback and a fresh clone confirmed zero reader diagnostics, while #781 remained active with the same attempt receipt and null delivery receipt. No migration reader or compatibility fallback was added.
Tickets
Fixes #794