Add canonical canvas edits, identity migration and idempotent resource/AI operations #19

Merged

Zayden-Jung merged 49 commits from codex/headless-canvas-v1 into main 2026-11-11 14:53:34 +00:00

Conversation 0 Commits 49 Files Changed 40

+5537 -200

codex-bot commented 2026-11-07 14:06:05 +00:00

Collaborator

Copy Link

Copy Source

Problem and behavior

The snapshot canvas writer cannot safely express cross-canvas ownership edits, recover an unknown write, or preserve operation identity across an explicit legacy migration. This change adds a normalized canonical model and incremental protocol 2 alongside the explicitly retained legacy path.

Changes

• Persist project/canvas/element identity, incarnations, ownership and tombstones; explicitly migrate legacy identities under source-version, permission and active-run guards. GET does not migrate. Migrated projects reject legacy snapshot writes.
• Apply conditional cross-canvas changes in one PostgreSQL transaction with participant versions, logical operation coverage and queryable idempotent receipts. Exact retries return the original result; changed bytes under the same key are rejected.
• Add resource identity/upload receipts, authorized resource adoption, and canonical AI admission/query/cancel/apply lifecycle with narrow-field conflict handling and stable action identities.
• Retain nonzero canonical frame rotation through owner changes and projection so nested canvas dissolution preserves world geometry. Legacy snapshot restrictions remain.
• Pin the real Endoleap consumer to dcbbdad25de7c3b1d6bee317df6074da2c0642eb (product implementation 15ee917); later frontend work adds only tests/docs.

Validation

Existing ces-control CI #1186 and PR CI #1187 both completed all seven steps successfully for 506f778ac3. They run Go checks/build, isolated database migration/integration, the actual authenticated HTTP/PostgreSQL Node consumer and HTTP smoke checks. No local backend build or Docker was used.

Direct cases include concurrent identical migration/edit requests with one version advance, competing owner/edge moves with one winner, late migration cancellation after writes begin with whole-transaction rollback, lost document/upload/admission/apply responses with original-key recovery, resource authorization, deep copy with a parent-owned incoming edge, and nested dissolve/lost ACK/undo-redo. Consumer report flags are all true; generation executes exactly three times, while the queued cancelled run never executes.

Final frontend checks: 822 Node tests, TypeScript, webpack/Turbopack actual pages (51 each), hooks (10), browser storage (57), actual proxy (6), both migration entries (5 each), and 270-file unpacked SDK/Worker/type/peer/doc checks pass. Per-requirement T01–T36 assertions and limitations are in Endoleap headless/FINAL_ACCEPTANCE.md; service evidence is in headless/SERVICE_ACCEPTANCE.md.

Limits and merge status

The worker fixture supplies deterministic generation output through the actual worker protocol; external paid generation, billing, real CLI authentication and production background-loop behavior are not claimed. Browser fault tests and the real HTTP/DB consumer are separate evidence layers; this is not every operation/crash/browser combination. Cross-client permanent asset GC and full CRDT collaboration remain out of scope.

Both branches were checked against current main; merge-tree reports no conflict and the head commit status is success. This PR is ready for review and waits for the user to merge manually. Nothing here is merged or deployed by the bot.

## Problem and behavior The snapshot canvas writer cannot safely express cross-canvas ownership edits, recover an unknown write, or preserve operation identity across an explicit legacy migration. This change adds a normalized canonical model and incremental protocol 2 alongside the explicitly retained legacy path. ## Changes - Persist project/canvas/element identity, incarnations, ownership and tombstones; explicitly migrate legacy identities under source-version, permission and active-run guards. GET does not migrate. Migrated projects reject legacy snapshot writes. - Apply conditional cross-canvas changes in one PostgreSQL transaction with participant versions, logical operation coverage and queryable idempotent receipts. Exact retries return the original result; changed bytes under the same key are rejected. - Add resource identity/upload receipts, authorized resource adoption, and canonical AI admission/query/cancel/apply lifecycle with narrow-field conflict handling and stable action identities. - Retain nonzero canonical frame rotation through owner changes and projection so nested canvas dissolution preserves world geometry. Legacy snapshot restrictions remain. - Pin the real Endoleap consumer to dcbbdad25de7c3b1d6bee317df6074da2c0642eb (product implementation 15ee917); later frontend work adds only tests/docs. ## Validation Existing ces-control CI #1186 and PR CI #1187 both completed all seven steps successfully for 506f778ac33d47fbd6f38412995a10218d59fe0a. They run Go checks/build, isolated database migration/integration, the actual authenticated HTTP/PostgreSQL Node consumer and HTTP smoke checks. No local backend build or Docker was used. Direct cases include concurrent identical migration/edit requests with one version advance, competing owner/edge moves with one winner, late migration cancellation after writes begin with whole-transaction rollback, lost document/upload/admission/apply responses with original-key recovery, resource authorization, deep copy with a parent-owned incoming edge, and nested dissolve/lost ACK/undo-redo. Consumer report flags are all true; generation executes exactly three times, while the queued cancelled run never executes. Final frontend checks: 822 Node tests, TypeScript, webpack/Turbopack actual pages (51 each), hooks (10), browser storage (57), actual proxy (6), both migration entries (5 each), and 270-file unpacked SDK/Worker/type/peer/doc checks pass. Per-requirement T01–T36 assertions and limitations are in Endoleap headless/FINAL_ACCEPTANCE.md; service evidence is in headless/SERVICE_ACCEPTANCE.md. ## Limits and merge status The worker fixture supplies deterministic generation output through the actual worker protocol; external paid generation, billing, real CLI authentication and production background-loop behavior are not claimed. Browser fault tests and the real HTTP/DB consumer are separate evidence layers; this is not every operation/crash/browser combination. Cross-client permanent asset GC and full CRDT collaboration remain out of scope. Both branches were checked against current main; merge-tree reports no conflict and the head commit status is success. This PR is ready for review and waits for the user to merge manually. Nothing here is merged or deployed by the bot.

codex-bot added 1 commit 2026-11-07 14:06:06 +00:00

Stage atomic canvas operation batches and durable receipts 19884b2a90

codex-bot added 1 commit 2026-11-07 14:26:11 +00:00

Add canonical canvas rows, stable identity migration and model operations b85e8bd2ca

codex-bot added 1 commit 2026-11-07 14:34:46 +00:00

Fix canonical archive writes and retain scoped lifecycle evidence 12458e10dc

codex-bot added 1 commit 2026-11-07 14:40:44 +00:00

Verify canonical partition restoration and frontend protocol fixture b7499e3815

codex-bot added 1 commit 2026-11-07 14:47:21 +00:00

Embed protocol fixture for isolated integration test binaries 4a89137e38

codex-bot added 1 commit 2026-11-07 14:52:36 +00:00

Preserve opaque JSON keys independently of field write guards bf8763e0de

codex-bot changed title from WIP: Implement headless canvas operations and identity migration to WIP: Add canonical headless canvas state and incremental synchronization 2026-11-07 14:58:25 +00:00

codex-bot added 1 commit 2026-11-07 15:18:25 +00:00

Preserve staged resource identities and expose upload receipts 0d7fc4dbe5

codex-bot added 1 commit 2026-11-07 16:23:04 +00:00

Apply canonical AI outputs through scoped identity-checked changes fa76773efc

codex-bot added 1 commit 2026-11-07 16:28:17 +00:00

Bind canonical AI admission to the project version vector 00ff738705

codex-bot added 1 commit 2026-11-07 16:53:15 +00:00

Persist queryable AI action outcomes and zero-effect rejection receipts f12c4ad8bd

codex-bot added 1 commit 2026-11-07 17:04:38 +00:00

Verify AI replan and cancellation completion boundaries cdf48f1691

codex-bot added 1 commit 2026-11-07 17:16:33 +00:00

Resolve canonical AI targets at their current canvas owner 56b6181598

codex-bot added 1 commit 2026-11-07 17:16:56 +00:00

Remove dependent connections in moved-target deletion fixture 2d4aefbdc0

codex-bot added 1 commit 2026-11-07 17:20:11 +00:00

Preserve relocation context for conflicted AI outputs c9bb38454d

codex-bot added 1 commit 2026-11-07 17:24:58 +00:00

Verify current-owner permissions before moved AI execution d6690c3764

codex-bot added 1 commit 2026-11-07 18:52:32 +00:00

Verify atomic scaled-container unit metadata and inverse writes 24b27dcac4

codex-bot added 1 commit 2026-11-07 18:54:36 +00:00

Avoid duplicate geometry fixture variable in scaled-move coverage 31258b995f

codex-bot added 1 commit 2026-11-07 20:28:18 +00:00

test(canvas): verify ordered batch receipts and rollback ca90b3fea3

codex-bot added 1 commit 2026-11-07 20:36:48 +00:00

test(canvas): verify compacted logical coverage and lifecycle records fb1bf4ab85

codex-bot added 1 commit 2026-11-07 20:50:14 +00:00

test(canvas): restore a lifetime canceled before its first request ff88865e91

codex-bot added 1 commit 2026-11-08 18:01:49 +00:00

Stream negotiated canonical model reads with snapshot framing e38254821a

codex-bot added 1 commit 2026-11-08 18:25:24 +00:00

ci: allow cold Go toolchain setup in backend checks 789edcc61b

codex-bot added 1 commit 2026-11-08 19:36:39 +00:00

Declare snapshot-bound direct canvas membership counts in model streams ad6ab30b5f

codex-bot added 1 commit 2026-11-08 20:11:29 +00:00

Bind all canvas element identities to their snapshot owners 9cf6e4cedf

codex-bot added 1 commit 2026-11-09 05:45:45 +00:00

Run pinned Endoleap headless runtime against real HTTP and PostgreSQL in CI 6d1a5b5c83

codex-bot added 1 commit 2026-11-09 05:50:54 +00:00

Pin corrected Foundry HTTP consumer transport d6e877712a

codex-bot added 1 commit 2026-11-09 06:05:24 +00:00

Pin live partial-scope import and deep-copy integration coverage ee04a6372b

codex-bot added 1 commit 2026-11-09 06:37:33 +00:00

Verify scoped image upload and lost receipt recovery with the live headless client 7d7408a0ec

codex-bot added 1 commit 2026-11-09 06:43:30 +00:00

Pin upload Created-response fault injection coverage 6a0a2e1912

codex-bot added 1 commit 2026-11-09 07:47:22 +00:00

Expose permission-checked immutable asset metadata for shared depot adoption 6b07c19728

codex-bot added 1 commit 2026-11-09 07:50:02 +00:00

Avoid ambiguous asset metadata and operation receipt routes be2014cc31

codex-bot added 1 commit 2026-11-09 07:55:24 +00:00

Pin real asset metadata and original byte verification client cc2ca05cd4

codex-bot added 1 commit 2026-11-09 08:12:41 +00:00

Preserve private asset metadata headers and verify cross-project adoption efa916060a

codex-bot added 1 commit 2026-11-09 08:36:25 +00:00

Verify asset permission revocation and immutable adoption rejection receipts 95812c3a96

codex-bot added 1 commit 2026-11-11 06:25:28 +00:00

Verify current headless client through the remote HTTP integration runner 28ca98a506

codex-bot added 1 commit 2026-11-11 07:13:19 +00:00

Verify runtime AI coordination against real HTTP and database state 6131fb5d7b

codex-bot added 1 commit 2026-11-11 07:29:06 +00:00

ci(canvas): expose AI admission recovery diagnostics da6a5f8207

codex-bot added 1 commit 2026-11-11 07:35:08 +00:00

ci(canvas): pin AI protocol header trace c8f3940d26

codex-bot added 1 commit 2026-11-11 07:42:29 +00:00

ci(canvas): verify headless AI v2 negotiation fix 121ce7496c

codex-bot added 1 commit 2026-11-11 07:50:50 +00:00

ci(canvas): exercise controlled HTTP run polling daec39ead4

codex-bot added 1 commit 2026-11-11 07:56:02 +00:00

ci(canvas): verify cancellation cursor drain in real client 8395baa24f

codex-bot added 1 commit 2026-11-11 08:04:49 +00:00

ci(canvas): verify host asset display and original generated bytes ca01ea3ea1

codex-bot added 1 commit 2026-11-11 08:10:01 +00:00

ci(canvas): verify managed result copy with durable source files 1605b5a9d6

codex-bot added 1 commit 2026-11-11 08:29:42 +00:00

test(canvas): verify canonical concurrency and late migration rollback cc3068ace3

codex-bot added 1 commit 2026-11-11 08:35:37 +00:00

test(canvas): cover migration admission guards with valid legacy edges d00388504c

codex-bot added 1 commit 2026-11-11 09:11:19 +00:00

ci(canvas): verify durable migration coordination with the actual client 3268c57bc6

codex-bot added 1 commit 2026-11-11 10:07:13 +00:00

ci(canvas): verify the browser migration delivery revision 5db2bf3c98

codex-bot added 1 commit 2026-11-11 10:43:19 +00:00

ci(canvas): verify owning-canvas dissolution and receipt recovery 36d69133b8

codex-bot added 1 commit 2026-11-11 10:54:01 +00:00

fix(canvas): retain canonical frame rotation across owner changes 506f778ac3

codex-bot changed title from WIP: Add canonical headless canvas state and incremental synchronization to Add canonical canvas edits, identity migration and idempotent resource/AI operations 2026-11-11 11:26:48 +00:00

Zayden-Jung merged commit 30829eeb86 into main 2026-11-11 14:53:34 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

codex-bot Zayden-Jung

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Zayden-Jung/foundry-core#19