feat(shared-world): accept subject.source local-tree#274
Merged
Conversation
…g tree onto the shared plane) Extends the shared-world topology (sequential and concurrent) to serve the ONE shared plane from the local working copy, not only a public clone. The local-tree keystone (#265) already built provisionLocalTreeSubject and the provenance shape; this removes the clone-only gate and wires it into both engines. - lab-config: sharedWorldValidationReason + routesToShared/ConcurrentWorld accept clone OR local-tree; localTree.keep rejected on the concurrent route (would orphan the N actor desktops, same as clone.keep). - both engines pack the working tree ONCE (the ONE subject sandbox), upload + extract + provision via provisionLocalTreeSubject; the N actor desktops drive the getHost URL exactly as before (no re-pack). - provenance emits {source: local-tree, archiveSha256, commit?, dirty?} for the plane instead of the clone {repo, commit}; the clone path is byte-identical (verified). verify fails closed on a live local-tree shared-world bundle missing the archiveSha256 pin. This is the homun-only prerequisite for driving a multi-app monorepo shared world from a working copy. The multi-origin design doc is untouched (a separate downstream slice). Hostile-reviewed: SHIP (clone regression clean, pack-once verified, provenance honest, live verify-fail-closed probed); two coverage gaps the review named folded in. 914 passed, scan clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Extends the shared-world topology (sequential + concurrent) to serve the ONE shared plane from the local working copy, not only a public clone. Direct follow-up to the local-tree keystone (#265); the homun-only prerequisite for driving a multi-app monorepo shared world from a working tree.
What
shared-worldvalidation was clone-only (lab-config.ts:943); now acceptscloneORlocal-treeat parse and both engine re-enforcement layers.routesToShared/ConcurrentSharedWorldupdated.subject.localTree.keeprejected on the concurrent route (would orphan the N actor desktops, mirroringclone.keep).provisionLocalTreeSubject; the N actor desktops still drive thegetHostURL unchanged (verified: zero re-pack, zero per-actor upload).{source: local-tree, archiveSha256, commit?, dirty?}(the archive digest is the pin; a dirty tree can't be commit-pinned) instead of the clone{repo, commit}. Clone path byte-identical.verifyfails closed on a live local-tree shared-world bundle missing the pin.current.md+schemas.mdnote shared-world now accepts local-tree. The multi-origin design doc is deliberately untouched (separate downstream slice, still gated).Review
Hostile-reviewed, verdict SHIP: all five attack categories clean (clone regression byte-identical, pack-once traced, provenance honest with no host-path leak, fail-closed gate intact, DI byte-stable), with the reviewer running a live probe confirming verify flips to false when the pin is stripped. Two coverage gaps the review named are folded in (a concurrent wrong-target re-enforcement test, and a shared-world verify-fail-closed-on-missing-pin test).
Proof
pnpm check: 914 passed / 10 skipped, build OK.pnpm public-surface:scan: ok. Deterministic tests cover dry-run, GOOD live run (pack-once + upload + extract + provenance + verify ok), phase-event ordering, packing-failure fail-closed before any sandbox,localTree.keep, engine re-enforcement (missing serve / wrong target / keep), and the pin fail-closed. Clone shared-world tests unchanged and green.🤖 Generated with Claude Code