{"entries":[{"lastCommit":{"author":{"email":"codexbot.disnetdev.com@noreply.radial","name":"codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie)","when":"2026-08-02T18:58:29.000000Z"},"committer":{"email":"noreply@tangled.sh","name":"Tangled","when":"2026-08-02T19:07:53.000000Z"},"hash":"02e7f9d0b56a3c55473bebbc4dc496f86d69434f","message":"Fix foreign goal origin resolution\n\nCo-Authored-By: codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie) \n","tree":"57252f5512f1c155166df5f86b6cdcbf3841f8c7"},"mode":"0040000","name":"atproto","size":0},{"lastCommit":{"author":{"email":"claudebot.disnetdev.com@noreply.radial","name":"claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla)","when":"2026-08-02T02:14:25.000000Z"},"committer":{"email":"noreply@tangled.sh","name":"Tangled","when":"2026-08-02T18:41:35.000000Z"},"hash":"63523040993ec2cfd2b1561902a29422743161e3","message":"Honor foreign strongref versions in userinput intake\n\nAuthority over a userinput.app board now requires an exact uri#cid pin\nagainst the version this tab fetched: moderator grants against the board\nrecord, and moderator statuses and author edits against the discussion\nrecord. A superseded pin falls back to the owner alone, to `open`, or to\nthe original text, and is counted and reported on screen rather than\ndropped silently. Discussions still resolve to their board by URI, since\nthat pin carries no authority and every discussion older than the last\nboard edit legitimately names a superseded version.\n\nAdd `setFeedbackSource` and two goals imported from one discussion to\n`goldenScenario()`, so the new record type and both new index rules\n(`feedbackSources`, `goalsByOrigin`) are covered by the mandatory\npermutation fixture, with assertions for admin gating, latest-wins per\nsource, the enabled filter, and URI-keyed origin grouping.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n","tree":"1fe3fd7b85e9fa5ffc290ce6d1d44f2f36a90a3c"},"mode":"0040000","name":"core","size":0},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-08-06T11:51:47.000000-07:00"},"committer":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-08-06T12:00:24.000000-07:00"},"hash":"644f2292a33d408aca49c1ea0bb211a83a27e131","message":"daemon: prove a tangled round is whole before publishing it\n\nA tangled pull request is a patch, not a ref: each round is built with\n`git format-patch`. Handed a range containing a merge, format-patch\nomits that commit and still exits 0 with an empty stderr, so the round\nreaches the appview as a series that does not apply -- which a human\nreads as \"this pull request has conflicts\" against a branch that merges\nas a fast-forward. Nothing downstream reports the omission.\n\nThe daemon steered agents straight into it: the tangled implementation\nprompt told them to `git merge \"origin/$RADIAL_BASE_BRANCH\"`, and then\ndiscarded exactly those merges when building the round.\n\nThree changes, and the first two are halves of one rule:\n\n- The tangled prompt rebases onto the base instead of merging it in, and\n pushes with --force-with-lease because a rebase rewrites a branch a\n predecessor may already have pushed. GitHub's prompt still merges: it\n merges refs and no patch is ever built from that history.\n- #formatPatch counts the range and refuses to publish a round that is\n not whole -- no merges present, one patch emitted per commit -- naming\n the rebase as the remedy, since the agent that caused it reads the error.\n- format-patch is passed --binary, so a file git considers binary reaches\n the round with a body instead of a bodiless \"Binary files ... differ\"\n that git apply refuses for want of an index line.\n\nThat last case is not hypothetical: a text file picks up the binary\nclassification from a single NUL byte, which is invisible in an editor.\nscripts/check-no-nul.mjs now runs first in `pnpm lint` and refuses one in\nany tracked file that is not a known binary asset.\n","tree":"733d07a674e001088b0c3981f379794bf1a1b074"},"mode":"0040000","name":"daemon","size":0},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T15:56:54.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T15:56:54.000000-07:00"},"hash":"ac5a07742d578fd1aa919bc4e8510899ffe82c5e","message":"Harden claims against clock skew: leases are bounded durations (#18)\n\n* Harden claims against clock skew: leases are bounded durations\n\nA claim's lease was an instant one operator wrote and another compared\nagainst its own clock, which left three exposures. A forward clock jump\nbetween two renewals wrote a lease years out that nobody — including its\nown writer — could retract, because the store adopted a rewrite only when\n`expiresAt` moved forward, the rkey is a pure function of the request, and\nRadial deletes no records. Expiry was evaluated on the reader's clock, so\nthe lease an operator actually honoured was `leaseMs - skew`. And the\nstore's forward-only scan tie-broke on `rev`, which is observer-local.\n\nThe model now: a lease is a DURATION its writer declares, bounded by the\nprotocol, measured by each observer on its own clock.\n\n- `claim.renewedAt` (lexicon, additive and optional): when the writer\n issued this version of the lease. Renewals move it with `expiresAt`\n from one clock reading, so a forward jump changes the duration by\n nothing at all. Absent means `createdAt`, so legacy claims read as\n before and renew across the upgrade in either direction.\n- Two wire-contract constants in `@radial/core`'s `claim-lease.ts`: a\n declared lease of at most 1h, and — for a version with no `renewedAt` —\n an `expiresAt` at most 24h after its own `createdAt`. Both the fold and\n the store refuse a version outside its bound; the fold names it in\n `ignored` and the store files it as a rejected edit.\n- Store selection is a predicate over the version set (latest conforming\n expiry, ties by cid) rather than a forward-only scan. That makes a\n SHORTENING rewrite adoptable exactly when the version it replaces is out\n of contract — the repair path, which the claimant's own daemon takes\n automatically — and refused otherwise, so a live lease still cannot be\n retracted. Without it the clamp would wedge a daemon forever on a\n poisoned record it can neither delete nor shorten.\n- Liveness is the declared duration counted from `firstSeenAt`, a new\n observer-local stamp on `StoredRecord` reconciled like `rev` (minimum\n across provenances), stamped by the poller and the jetstream\n subscription, nullable in all three stores so no migration is needed.\n- `run.claims.leaseMs` above the protocol bound is refused at startup, and\n `radiald run` samples PDS `Date` headers plus future-dated records to\n warn about skew it can measure.\n\nDrills F6-F8 give each operator its own clock: a reader ten minutes fast,\na seven-day forward jump mid-lease and the poisoned record it leaves, and\nthe tie-break a slow clock wins every time — that last one asserting the\nexposure deliberately left open, since hardening it means reintroducing a\ncorroborating time source (docs/adr-claim-leases-are-durations.md §D6).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Bound every claim version by the horizon, and give claims generations\n\nReview follow-up on the clock-skew hardening.\n\nThe horizon (`expiresAt - createdAt` <= 24h) now applies to every claim\nversion, not only to those written before `renewedAt` existed. `renewedAt`\nis self-reported, so the tight lease bound alone certifies nothing about\nwhere a lease sits: a clock that steps a week forward, renews and is then\ncorrected leaves a version declaring exactly `leaseMs` a week out, in\ncontract, selected over every honest renewal after it until wall time\ncatches up — with no `ignored` entry, no rejected edit and no repair,\nwhile peers stop honouring it one lease after arrival. `createdAt` is the\nonly field on the record that corroborates `renewedAt`.\n\nThat bounds a claim's whole life to a day, and a request can stay open far\nlonger (one waiting on a human answer routinely does), so claim records are\nnow generational: the rkey hashes `requestUri#requestCid` for the first and\n`...#` after it. `ClaimManager` clamps its last renewal to\nexpire exactly at the horizon, retires the claim loudly, and re-claims\nunder the next generation through the ordinary gates. Nothing is deleted,\nno wire rule changes, and a retired claim leaves no diagnostic residue.\n\nAlso from the review:\n\n- The out-of-contract repair is hoisted above the state switch, so it fires\n on a `held` row too — the state an upgrade finds a pre-`renewedAt` clock\n jump in, where nothing else ever would (no renewal is due against a\n year-long lease, and the fold names nobody, so the loss branch is silent\n as well).\n- The `Date`-header skew warning buckets by the measured skew per origin\n instead of by the current clock, which put every tick in its own bucket\n and reprinted the warning every five seconds; the regression test drives\n an advancing clock.\n- `futureDatedAuthors` considers a claim's `renewedAt`, which is where a\n jumped clock shows, since renewal freezes `createdAt` by design.\n- `packages/lexicons/README.md` documents the version-selection rule —\n latest conforming `expiresAt`, ties by lowest cid, never by revision or\n arrival order — which is as load-bearing for interop as the constants.\n\nDrill 7 now asserts that a week-forward jump writes no lease into next\nweek at all; drill 7c covers the horizon retirement end to end. The golden\nscenario's live claims moved from a month old to half a day, which is what\nthe horizon now permits.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Retire a claim its own clock can no longer hold\n\nCloses the three findings on impl-5bufi2nhot77ohwk7sbikszx.\n\nA daemon whose clock steps forward stamps createdAt, renewedAt and\nexpiresAt from that clock, so the record it writes is IN CONTRACT — a\nlegal lease inside a legal horizon. Correct the clock and that record is\nbeyond its own writer and invisible to every recovery path: not lapsed,\nnot due for renewal, not refused by the fold (so no ignored entry and no\nrepair), and unshortenable exactly because it conforms. The row sat\n`held` forever, gating dispatch behind a claim nothing could move.\n\n`claimRetirementReason` (writer-side only, and marked as such — the fold\nmust never compare its clock to a stranger's) asks whether the clock we\nhave now could have written this record. Three answers of no: the\nhorizon has passed, it was created further into our future than one\nlease, or it conforms and expires further ahead than MAX_CLAIM_LEASE_MS.\n`ClaimManager` retires on it wherever it finds it, and the generation\nwalk asks the same question before adopting a record it collides with,\nso a re-claim cannot put the row straight back.\n\nTwo smaller ones alongside:\n\n- A retirement that lands mid-turn is covered again in the same pump: a\n request whose RUNNING turn is ours is exempt from the turn-eligibility\n gate, which otherwise left it visibly free to peers for a whole turn\n timeout with nothing on this daemon able to re-claim it.\n- The generation cap goes on the ledger row, and `selectClaimable` skips\n a row at the cap. Recording it only in the log left the row reselected\n every pump, re-walking to the same dead end through two PDS round\n trips a tick, forever.\n\nDrill 7d walks drill 7 to its normal end (NTP puts the clock back);\nunit coverage for the predicate, the mid-turn re-claim, the cap and the\nledger column. Docs: operators.md §3, design.md §6/§12, ADR D8.\n\npnpm build && pnpm -r test && pnpm lint && pnpm typecheck all pass.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Cover a turn already running, and measure retirement by our own lease\n\nThree findings on the previous turn, all in the claim manager.\n\nThe mid-turn re-claim was defeated by the capacity gate: a covering\nclaim was charged against free turn slots, and at the default\nconcurrency of 1 the running turn it covers IS the only slot. Free turn\ncapacity now binds only candidates that would start a turn; the\noutstanding budget still binds everything, and takes covering claims\nfirst.\n\n`radiald claim reset` promised to start a capped request over and\nre-walked the same sixteen permanent records instead, capping again in\nthe same pump and silently. The row now keeps its generation and raises\nits own ceiling, so the walk resumes at the first generation nothing was\nwritten at.\n\nThe writer-side retirement check measured its third case against the\nprotocol ceiling rather than the configured lease, leaving every forward\njump under an hour to sit `held` — gating dispatch — until the next\nrenewal fell due, over a request every peer had already stopped\nhonouring.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Measure retirement by the reach of our own renewals\n\nA flat minute of slack was tighter than the renewal machinery needs. A record\nleft by a forward jump of Δ repairs itself on the next renewal — due\n`Δ + renewIntervalMs` after the correction — while observers stop honouring it\none declared lease after arrival, so it is only a problem when\n`Δ > leaseMs − renewIntervalMs` (400 s at the defaults). Below that, retiring it\nbought a divergence no peer could see and cost a generation plus, since the\nretired record keeps the earlier `createdAt` and wins our own tie-break until it\nlapses, up to a lease of our own dispatch — paid every time a host steps its\nclock back a couple of minutes.\n\nSo case 3 now measures `claimRetirementReachMs(timing)` —\n`leaseMs + max(jitter, leaseMs − renewIntervalMs)`, with `CLAIM_CLOCK_SLACK_MS`\n(never more than the lease) as the floor for a configuration that renews as late\nas its lease. `claimRetirementReason` takes the writer's timing rather than a\nlone `leaseMs`; both numbers are writer-side, so nothing another operator\nevaluates moves.\n\nAnd a retirement spends its generation as it happens. The row moves to\n`generation + 1`, so the re-claim in the same pump writes there directly instead\nof colliding with the record it just judged past using and reading it back to\nre-derive the same verdict. That also makes retirement the place the generation\ncap can be reached, so the \"leaving it alone\" line is reported from there too —\n`selectClaimable` skips a row at its ceiling, so the walk would never print it.\n\nDrill 7f walks a two-minute correction: nothing retired, nothing rewritten, the\nrow still held and dispatchable, the ordinary renewal repairing the record, and\nB reading A as the holder throughout. Unit coverage for the reach at both\nboundaries and its floor, the band left to self-repair, the re-claim costing no\nread-back, and the cap reported from a retirement.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"225ec9e26ae9a28c4fcd924c40cbbc3b5f0ce08b"},"mode":"0040000","name":"ingest","size":0},{"lastCommit":{"author":{"email":"codexbot.disnetdev.com@noreply.radial","name":"codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie)","when":"2026-08-02T01:13:16.000000Z"},"committer":{"email":"noreply@tangled.sh","name":"Tangled","when":"2026-08-02T18:41:35.000000Z"},"hash":"6f2d3edde140a5e8e601c9b2d5a206a646f40c18","message":"Add human-gated userinput feedback intake\n\nCo-Authored-By: codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie) \n","tree":"40cc8e99258dfef5f010eeee275a6c45e9086c9b"},"mode":"0040000","name":"lexicons","size":0},{"lastCommit":{"author":{"email":"codexbot.disnetdev.com@noreply.radial","name":"codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie)","when":"2026-08-02T18:58:29.000000Z"},"committer":{"email":"noreply@tangled.sh","name":"Tangled","when":"2026-08-02T19:07:53.000000Z"},"hash":"02e7f9d0b56a3c55473bebbc4dc496f86d69434f","message":"Fix foreign goal origin resolution\n\nCo-Authored-By: codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie) \n","tree":"57252f5512f1c155166df5f86b6cdcbf3841f8c7"},"mode":"0040000","name":"sidecar","size":0},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-08-06T11:03:32.000000-07:00"},"committer":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-08-06T11:03:46.000000-07:00"},"hash":"f090c21421be549f0fbbfba559c51bcaefa0cf72","message":"ui: escape the NUL separators in versionKey\n\nstore.ts carried three literal NUL bytes in versionKey's template\nliteral, which made git classify the file as binary. Any patch series\ntouching it then either drops its contents or fails to apply, so a\ntangled pull request round reports a conflict against a branch that is\na strict fast-forward. Written as \\u0000 the produced string is\nbyte-identical and the file is text again.\n","tree":"b921722fba84f5ce2c25ba4b69ad6d13b1e42531"},"mode":"0040000","name":"ui","size":0}],"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-08-06T11:51:47.000000-07:00"},"committer":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-08-06T12:00:24.000000-07:00"},"hash":"644f2292a33d408aca49c1ea0bb211a83a27e131","message":"daemon: prove a tangled round is whole before publishing it\n\nA tangled pull request is a patch, not a ref: each round is built with\n`git format-patch`. Handed a range containing a merge, format-patch\nomits that commit and still exits 0 with an empty stderr, so the round\nreaches the appview as a series that does not apply -- which a human\nreads as \"this pull request has conflicts\" against a branch that merges\nas a fast-forward. Nothing downstream reports the omission.\n\nThe daemon steered agents straight into it: the tangled implementation\nprompt told them to `git merge \"origin/$RADIAL_BASE_BRANCH\"`, and then\ndiscarded exactly those merges when building the round.\n\nThree changes, and the first two are halves of one rule:\n\n- The tangled prompt rebases onto the base instead of merging it in, and\n pushes with --force-with-lease because a rebase rewrites a branch a\n predecessor may already have pushed. GitHub's prompt still merges: it\n merges refs and no patch is ever built from that history.\n- #formatPatch counts the range and refuses to publish a round that is\n not whole -- no merges present, one patch emitted per commit -- naming\n the rebase as the remedy, since the agent that caused it reads the error.\n- format-patch is passed --binary, so a file git considers binary reaches\n the round with a body instead of a bodiless \"Binary files ... differ\"\n that git apply refuses for want of an index line.\n\nThat last case is not hypothetical: a text file picks up the binary\nclassification from a single NUL byte, which is invisible in an editor.\nscripts/check-no-nul.mjs now runs first in `pnpm lint` and refuses one in\nany tracked file that is not a known binary asset.\n","tree":"733d07a674e001088b0c3981f379794bf1a1b074"}}