[sstriker]

This is one more part of package 2 of PLAN.md.

The paper gives each task operation an attempt key from the caller, so a retry cannot claim two tasks or complete a task two times (Appendix A, Appendix C). The ledger had no such key. A caller that did not get the answer to claim_next and asked again got a second task.

What changes

• The memory tools claim_next and complete take attempt. A key is 1 to 64 ASCII letters, digits, dots, hyphens or underscores.
• claim_next with the same key gives the same claim, while that claim is in force. It does not give a second task. When the claim is over, the ledger refuses the key.
• complete with the same key and the same handoff gives the done task. The ledger completes the task one time, and nothing else occurs for the second call. With a different handoff, the ledger refuses the key.
• A key belongs to one session and one domain. The memory server keeps it as <session>:<key>. A different session with the same key makes its own claim. The ledger looks among claims for a claim and among completions for a completion, so one key can be used for each. A refusal names the key as the caller gave it.
• The ledger looks for the key in the transaction that makes the claim, in the domain of the claim. It gives the claim back only to a caller whose name, handling and manifest fit the task.
• The key is in the event of the claim or the completion, so a rebuild keeps it. The event of a claim now also has its generation.
• local/README.md, README.md, PLAN.md and docs/terms.md have the attempt key.

Not in this change

An attempt key for the other operations. amem task has no attempt key, because a command has no session.

Checks

make check passed with 985 tests on 09bfe14. The ledger tests ran on SQLite and on the embedded PostgreSQL.

Adversarial pass

The pass ran on 98646df, the first form. It confirmed nine findings, and 295b01a corrects them:

1. A key gave back a task above the handling of the caller, and from a different domain.
2. A second session of the same author with the same key got the claim of the first.
3. The refusal for a used key gave the id of a task that the caller could not read.
4. The ledger looked for the key before the transaction of the claim. Two callers with one key claimed two tasks.
5. SQLite looked in each domain, and PostgreSQL in one.
6. A completion asked again ran the close of the continuation chain again, with the handoff of the second call.
7. One key for a claim and for a completion of one task was refused.
8. A key had no limit on its length or its characters.
9. Three changes to the code left all tests green. Each now has a test.

A second pass ran on 295b01a. It ran its own tests and mutations on SQLite and on the embedded PostgreSQL. It confirmed no defect in behaviour. It confirmed six findings about tests and text, and 09bfe14 answers them:

1. No test held "two connections with one key make one claim". The new test two_connections_under_one_key_make_one_claim fails on PostgreSQL when the lookup does not take the domain lock.
2. No test held the lease term or the requirements term of same_claim. Each new assertion fails when its term is removed.
3. No test held "nothing more happens" for a completion asked again. The new test a_completion_asked_again_closes_no_task_up_its_chain fails when the second call runs the chain.
4. The operation prefix of the kept key had no test and no function. It is removed.
5. The refusal showed the kept key, with the session id. It now shows the key of the caller, and the MCP test compares the full message.
6. The text did not say that a key is ASCII. It now does.

The pass also named these points as plausible, without a test that shows them:

• A second call of complete could read the task before the first call ended, and then get NotHolder. complete now reads the task with the ledger locked. No test holds this.
• The key is for one domain, and the text did not say so. local/README.md now says so.
• Open: if the first call of complete stops after the ledger completed the task and before the chain closed, the second call gives the done task and the parent stays open. Before this branch, the second call got WrongState, and the parent also stayed open.
• Open: the lookup reads the events of the domain without an index on the key.

I stop at two passes.

Posted by Claude on behalf of @sstriker

🤖 Generated with Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.