open/repo-mailbox
1
0
Fork 0
Code Issues Releases 2 Activity

feat(engine): retire a broadcast with coord-send --retract

Browse source 
Nothing could remove a message from _broadcast/inbox/. coord-done is
directed-only and never touches the broadcast queue, so the backlog could
only grow: every new repo received the entire standing history at its first
session, including announcements that had since become false.

--retract <filename> archives the message into _broadcast/archive/, so no
future repo is served it. Three deliberate limits, all pinned by tests:

- Un-send, not recall. Repos that already received it keep it;
  _broadcast/seen/ is delivery history and is left untouched.
- Only the sender may retract (from: must match the repo identity). --from
  overrides it, as everywhere else in the engine, which makes the check an
  accident guard rather than a security boundary.
- Nothing is deleted, mirroring coord-done. Retracting twice is a no-op.

The branch runs before every send-side validation and before the stdin body
read, since a retract carries no subject and no body.

Selftest 70 -> 82 (new section 19). Also fixes two README defects the
feature exposed: the install command still named coord@ after the v0.3.0
rename, and the docs advised pruning _broadcast/inbox/ by hand, which
contradicted the rule that the script owns mailbox files.
This commit is contained in:
Kjell Tore Guttormsen 2026-07-25 15:11:47 +02:00
commit 316b8acdd2
8 changed files with 184 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

34
CHANGELOG.md
View file

@ -5,6 +5,40 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
## [0.4.0] - 2026-07-25
### Added
- **`coord-send --retract <filename>`: a broadcast can finally be retired.**
Until now nothing could remove a message from `_broadcast/inbox/`:
`coord-done` is directed-only and never touches the broadcast queue. The
backlog could therefore only grow, and every *new* repo received the entire
standing history at its first session — including announcements that had
since become false. Retract moves the message to `_broadcast/archive/`, so
no future repo is served it.
Deliberate limits, both documented and pinned by tests:
- **Un-send, not recall.** Repos that already received the broadcast keep
it; `_broadcast/seen/` is delivery history and is left untouched.
- **Only the sender may retract** (`from:` must match the repo identity).
`--from` overrides this, as it does everywhere else in the engine, which
makes the check an accident guard rather than a security boundary.
- **Nothing is deleted**, mirroring `coord-done`. Retracting twice is a
no-op (exit 0).
- Selftest grew from 70 to 82 checks (new section 19 covers retraction:
authorization, archiving, non-delivery to new repos, no collateral damage to
other broadcasts, invalid names, flag combinations, and idempotency).
### Fixed
- README's install command still said `claude plugin install
coord@ktg-plugin-marketplace` after the v0.3.0 rename.
- README told the reader to prune `_broadcast/inbox/` by hand when a notice
stopped being relevant — advice that contradicted the rule that the script
owns mailbox files. `--retract` is now the supported path.
## [0.3.0] - 2026-07-25
### Changed