From d61189d26cfa130299fa916062b487a4706f85ad Mon Sep 17 00:00:00 2001 From: pseudo Date: Mon, 31 Aug 2026 16:12:38 -0600 Subject: [PATCH 1/3] chore(porch): 272 PR #305 merged --- codev/projects/272-the-sidebar-tree-needs-every-w/status.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/codev/projects/272-the-sidebar-tree-needs-every-w/status.yaml b/codev/projects/272-the-sidebar-tree-needs-every-w/status.yaml index 0c1fd6de0..6775c8284 100644 --- a/codev/projects/272-the-sidebar-tree-needs-every-w/status.yaml +++ b/codev/projects/272-the-sidebar-tree-needs-every-w/status.yaml @@ -122,10 +122,12 @@ iteration: 1 build_complete: false history: [] started_at: '2026-08-31T16:47:04.075Z' -updated_at: '2026-08-31T22:12:22.730Z' +updated_at: '2026-08-31T22:12:38.466Z' pr_history: - phase: review pr_number: 305 branch: builder/pir-272 created_at: '2026-08-31T22:05:41.124Z' + merged: true + merged_at: '2026-08-31T22:12:38.465Z' pr_ready_for_human: false From 872d4eb28afe97247a11c67bbd8a3ec94726ab11 Mon Sep 17 00:00:00 2001 From: pseudo Date: Mon, 31 Aug 2026 16:14:41 -0600 Subject: [PATCH 2/3] docs(review): correct the token claim in the merged #272 review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The review shipped saying a pairing-issued one-time token is spent on the first sweep tick before anyone spawns, and that an unbounded desktop seed is therefore effectively mandatory. That is wrong. The architect verified against a live server that the token is durable and re-exchangeable — nothing is burned. The real cost is smaller and different: each exchange mints a SESSION, so the sweep accumulates one per server every 30s. A leak, not a spent credential, and it wants a different fix — reuse the access token across ticks rather than provisioning another kind of credential. Tracked in #306. Corrected in place with the wrong version named rather than quietly rewritten, because it was merged and someone may have read it. A merged review is what gets grepped in six months. The underlying mistake is worth stating: I propagated a constraint documented in a comment on ThreadBackendConfig.bootstrapToken as though it were a measurement. It was not, and the live check disagreed with it. Refs #272, #306. --- .../272-the-sidebar-tree-needs-every-w.md | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/codev/reviews/272-the-sidebar-tree-needs-every-w.md b/codev/reviews/272-the-sidebar-tree-needs-every-w.md index afcbd0f23..637963830 100644 --- a/codev/reviews/272-the-sidebar-tree-needs-every-w.md +++ b/codev/reviews/272-the-sidebar-tree-needs-every-w.md @@ -139,15 +139,23 @@ Claude raised four non-blocking items: written — acknowledged, not fixed here.** The sweeper is interval plumbing over `reconcileWorkspaceProjects`, which is covered; the untested part is `start`/`stop`/overlap behaviour. Worth a follow-up rather than widening this PR. -3. **The sweep re-exchanges the bootstrap token every 30s per server — real, and a behaviour - change worth knowing.** A pairing-issued one-time token is now spent on the first tick, before - anyone spawns. The constraint is pre-documented on `ThreadBackendConfig.bootstrapToken`, but this - makes an unbounded desktop seed effectively mandatory for any workspace carrying a `threads` - config. Not changed here because caching a credential across processes is a storage decision. +3. **The sweep re-exchanges the bootstrap token every 30s per server — real, but not for the + reason first recorded here. Corrected.** This originally said a pairing-issued one-time token is + spent on the first tick before anyone spawns, and that an unbounded desktop seed is therefore + effectively mandatory. **That is wrong.** The architect verified against a live server that the + token is durable and re-exchangeable: nothing is burned. The real cost is smaller and different — + each exchange mints a **session**, so the sweep accumulates one per server every 30s and they + pile up. That is a leak, not a spent credential, and it wants a different fix: reuse the access + token across ticks, rather than provisioning a different kind of credential. Tracked in **#306**. + + Left visible rather than silently rewritten, because the wrong version was merged and someone + may have read it. The lesson underneath is the one this repo already keeps: a constraint + documented in a comment (`ThreadBackendConfig.bootstrapToken`) is not a measurement, and I + propagated it as though it were. 4. **A down server logs a WARN every 30s, ~2,880 lines/day — real.** Logging on state change is the - fix; deferred as a follow-up rather than folded in. + fix; deferred as a follow-up rather than folded in. Tracked in **#307**. -Items 2-4 need issues; I did not open them because that call is the architect's. +Items 2-4 are filed: **#308** (untested sweeper lifecycle), **#306**, **#307**. ## How to Test Locally From 8d521feecb05f85abe2c8ac1a7d04f81799e3f19 Mon Sep 17 00:00:00 2001 From: pseudo Date: Mon, 31 Aug 2026 16:15:14 -0600 Subject: [PATCH 3/3] Revert "docs(review): correct the token claim in the merged #272 review" This reverts commit 872d4eb28afe97247a11c67bbd8a3ec94726ab11. --- .../272-the-sidebar-tree-needs-every-w.md | 22 ++++++------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/codev/reviews/272-the-sidebar-tree-needs-every-w.md b/codev/reviews/272-the-sidebar-tree-needs-every-w.md index 637963830..afcbd0f23 100644 --- a/codev/reviews/272-the-sidebar-tree-needs-every-w.md +++ b/codev/reviews/272-the-sidebar-tree-needs-every-w.md @@ -139,23 +139,15 @@ Claude raised four non-blocking items: written — acknowledged, not fixed here.** The sweeper is interval plumbing over `reconcileWorkspaceProjects`, which is covered; the untested part is `start`/`stop`/overlap behaviour. Worth a follow-up rather than widening this PR. -3. **The sweep re-exchanges the bootstrap token every 30s per server — real, but not for the - reason first recorded here. Corrected.** This originally said a pairing-issued one-time token is - spent on the first tick before anyone spawns, and that an unbounded desktop seed is therefore - effectively mandatory. **That is wrong.** The architect verified against a live server that the - token is durable and re-exchangeable: nothing is burned. The real cost is smaller and different — - each exchange mints a **session**, so the sweep accumulates one per server every 30s and they - pile up. That is a leak, not a spent credential, and it wants a different fix: reuse the access - token across ticks, rather than provisioning a different kind of credential. Tracked in **#306**. - - Left visible rather than silently rewritten, because the wrong version was merged and someone - may have read it. The lesson underneath is the one this repo already keeps: a constraint - documented in a comment (`ThreadBackendConfig.bootstrapToken`) is not a measurement, and I - propagated it as though it were. +3. **The sweep re-exchanges the bootstrap token every 30s per server — real, and a behaviour + change worth knowing.** A pairing-issued one-time token is now spent on the first tick, before + anyone spawns. The constraint is pre-documented on `ThreadBackendConfig.bootstrapToken`, but this + makes an unbounded desktop seed effectively mandatory for any workspace carrying a `threads` + config. Not changed here because caching a credential across processes is a storage decision. 4. **A down server logs a WARN every 30s, ~2,880 lines/day — real.** Logging on state change is the - fix; deferred as a follow-up rather than folded in. Tracked in **#307**. + fix; deferred as a follow-up rather than folded in. -Items 2-4 are filed: **#308** (untested sweeper lifecycle), **#306**, **#307**. +Items 2-4 need issues; I did not open them because that call is the architect's. ## How to Test Locally