feat(ingest): self-origin notification suppression seam and predicate (RIG-3326) - #1177
Merged
Merged
Conversation
… (RIG-3326) Adds the IdentityResolver seam and the suppression predicate at the notify-router fan-out, per the frozen self-delegate-suppression record. An event's actor handle is resolved once per route; each subscriber's handle is resolved through the seam and memoized by account id. A dispatch is skipped only on a positive owner-qualified match — both owners and both agents non-empty and equal. The owner leg is load-bearing: an agent handle is unique only per owner, so a bare-handle match would false-suppress a genuine cross-agent notification between two owners' agents both named the same thing. Every ambiguous state delivers: human commenter, either side unqualified, no ownership row at the coordinate, a store fault (logged at warn), or a nil resolver. CHECKS and UPDATE carry no actor and never suppress; their tests build an event that DOES carry a matching actor, so the arm rather than the fixture is what keeps the dispatch. The STATE arm resolves a zero handle and delivers: its actor rides a forge_state_transitions memo that is not reachable through this two-method seam, which is the record's documented interim. Subscription scope is projected out of both subscriber queries and threaded to the router so the cursor advance can stay artifact-scoped. Co-authored-by: Matt Wilkinson <matt@rigel.build>
|
😎 This pull request was merged. |
rigel-mintaka
marked this pull request as ready for review
September 12, 2026 20:54
|
Compass engineering docs preview: https://compass-forge-rig-3326-t1-su.compass-eng-docs.pages.dev Deployed from |
… the fixture (RIG-3326) The STATE interim-open test passed because its event carried no actor at all, so STATE resolved a zero handle through any arm. Routing STATE through the author row - the proxy the record forbids, because it would eat an agent's notification that a human closed its issue - left the test green. The STATE event now carries a matching Compass commenter and a matching author row, so delivering holds only if STATE reached the no-actor arm. Both misroutes now fail it. The two resolver-fault tests had the same shape: the fake returned a zero handle alongside its error, so a caller that used the value instead of failing open still delivered. The fake now returns a populated handle with the error and the account fixture matches the subscriber, so using it suppresses and the tests catch it. Adds the missing AuthorHandle fault case - the record requires a store fault there to log and deliver, and only the HandleForAccount side was covered. Drops the stateEvent helper, now unused. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
added this pull request to stack #1186
September 12, 2026 22:20
mattwilkinsonn
approved these changes
Sep 12, 2026
|
This pull request was merged into |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of a stack containing 2 PRs:
mainAdds the IdentityResolver seam and the suppression predicate at the
notify-router fan-out, per the frozen self-delegate-suppression record.
An event's actor handle is resolved once per route; each subscriber's
handle is resolved through the seam and memoized by account id. A
dispatch is skipped only on a positive owner-qualified match — both
owners and both agents non-empty and equal. The owner leg is
load-bearing: an agent handle is unique only per owner, so a bare-handle
match would false-suppress a genuine cross-agent notification between
two owners' agents both named the same thing.
Every ambiguous state delivers: human commenter, either side
unqualified, no ownership row at the coordinate, a store fault (logged
at warn), or a nil resolver. CHECKS and UPDATE carry no actor and never
suppress; their tests build an event that DOES carry a matching actor,
so the arm rather than the fixture is what keeps the dispatch.
The STATE arm resolves a zero handle and delivers: its actor rides a
forge_state_transitions memo that is not reachable through this
two-method seam, which is the record's documented interim.
Subscription scope is projected out of both subscriber queries and
threaded to the router so the cursor advance can stay artifact-scoped.
Co-authored-by: Matt Wilkinson matt@rigel.build