open/repo-mailbox
1
0
Fork 0
Code Issues Releases Activity

fix(inbox): replace the broadcast watermark with a per-repo seen set

Browse source 
The single high-water mark assumed broadcast filenames within one
second were written in sort order; a later broadcast with a lexically
smaller uniq part sorted below an already-advanced watermark and was
silently never delivered to repos that had read the first (review §2).
_broadcast/seen/<repo> now records one delivered filename per line and
delivery is membership-based, removing the ordering assumption. Four
regression checks added first (the ordering check failed against the
watermark), selftest 48/48.

Upgrade note: a legacy single-line watermark file is read as a one-entry
seen set, so pre-existing broadcasts older than the watermark may be
re-delivered once.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HBbjgS5A55RVavoyjJC4FX
This commit is contained in:
Kjell Tore Guttormsen 2026-07-24 01:41:14 +02:00
commit b9bec85a80
2 changed files with 30 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

18
scripts/coord-selftest.sh
View file

@ -126,7 +126,23 @@ printf '%s' "$vout" | grep -q 'IKKE-KLARERT'; check "header frames content as un
bout="$("$INBOX" --repo bc-victim)"
[ "$(printf '%s\n' "$bout" | grep -c '^--- broadcast: forged')" -eq 0 ]; check "broadcast body cannot forge a broadcast separator" $?
# 10. Send-side input hygiene: CR/LF in subject/from cannot inject frontmatter.
# 10. Broadcast delivery must not depend on name order within a second: a
# broadcast written after another but sorting lexically below it (same
# timestamp prefix, smaller uniq part) must still be delivered.
mkdir -p "$CLAUDE_COORD_DIR/_broadcast/inbox"
printf -- '---\nfrom: x\nto: broadcast\nsubject: first\ndate: d\n---\nFIRST-BC\n' \
> "$CLAUDE_COORD_DIR/_broadcast/inbox/20990101T000000Z-500-from-x.md"
o1="$("$INBOX" --repo order-victim)"
printf '%s' "$o1" | grep -q 'FIRST-BC'; check "same-second pair: first broadcast delivered" $?
printf -- '---\nfrom: y\nto: broadcast\nsubject: second\ndate: d\n---\nSECOND-BC\n' \
> "$CLAUDE_COORD_DIR/_broadcast/inbox/20990101T000000Z-100-from-y.md"
o2="$("$INBOX" --repo order-victim)"
printf '%s' "$o2" | grep -q 'SECOND-BC'; check "same-second broadcast sorting below a seen one is still delivered" $?
[ "$(printf '%s' "$o2" | grep -c 'FIRST-BC')" -eq 0 ]; check "already-seen broadcast not re-delivered alongside it" $?
o3="$("$INBOX" --repo order-victim)"
[ -z "$o3" ]; check "nothing re-delivered once both are seen" $?
# 11. Send-side input hygiene: CR/LF in subject/from cannot inject frontmatter.
"$SEND" --to hygiene --from $'bad\nfrom' --subject $'legit\nfrom: attacker\n---\nINJECTED' \
--message "clean body" >/dev/null
hf="$(ls "$CLAUDE_COORD_DIR"/hygiene/inbox/*.md 2>/dev/null | head -1)"