GodopuandClaude Opus 5
d87674679d
The important correction is an honesty one, raised independently by two reviewers. The note claimed startup recovery runs in the subscriber. It does not: nothing in production imports the gate or the recovery function, and there is no per-job opt-in path, so the flag is currently a no-op in the live loop. Phase 2b delivers a verified library and gate; wiring it in belongs to phase 3, and the note now says so and lists what wiring requires. Also records the checks that are now mandatory rather than caller-dependent, that the rollback switch disables auto-completion too, that backend keys match exactly, that bookkeeping may touch one field, that settling is conditional on the intent actually sent, and why the intent's identity travels in the payload rather than relying on the transport sequence. Fixes three stale references: task.md named the pre-move path for finalize, the loop package description still described itself as shadow-only, and a comment in mqtt_common still pointed at the engine's original location. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd
19 lines
1.0 KiB
Python
19 lines
1.0 KiB
Python
"""Loop core: the single state-transition authority and the shadow watcher.
|
|
|
|
Issue #5 phase 2a. Two things live here and they are deliberately separated:
|
|
|
|
* `lib_py.delegation.engine` decides and commits state. It is the only writer
|
|
of job status, and it lives with the other registry writers rather than here
|
|
-- see that module's docstring for why the package boundary matters under a
|
|
frozen loop.
|
|
* `watcher` observes and never decides; `policy` decides and never writes;
|
|
`shadow` runs the two together and only logs what it *would* have committed.
|
|
* `autocomplete` is the phase 2b gate: it supplies verified evidence to that
|
|
same decision and, only if every gate holds, asks the transition boundary to
|
|
commit. It is off by default and has no production caller yet.
|
|
|
|
Package rule, enforced by test: nothing here imports a `lib_py` module other
|
|
than `lib_py.delegation`. Under a frozen loop the parent package may resolve to
|
|
a different tree than a bound sibling, so a stray import silently mixes trees.
|
|
"""
|