From 008d2ba9c8a7930339f2729d9e827e9488508afe Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Sat, 17 Oct 2026 04:55:32 +0000 Subject: [PATCH] Clarify when sequence identities are validated --- docs/roadmap/remediation.md | 27 +++++++++++++++++++++++++-- lifecycle.go | 3 ++- 2 files changed, 27 insertions(+), 3 deletions(-) diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md index 80f7282..fd2e77f 100644 --- a/docs/roadmap/remediation.md +++ b/docs/roadmap/remediation.md @@ -1,6 +1,7 @@ # Sequence Composition Review Remediation -Status: open. Reviewed implementation `2051177..0858af1` +Status: complete; all nine findings addressed in separate validated commits. +Reviewed implementation `2051177..0858af1` (`0858af1029d07d93a5aa2e4f26cbec61fcfb3a51`) against the [feature roadmap](sequence-composition.md), [implementation plan](implementation.md), and accepted [ADR 0014](../adr/0014-sequence-placement-and-composition.md). @@ -299,7 +300,11 @@ The recently added malformed-registered-record regression must continue to pass. ## 9. Correct the public identity-validation phase statement — P3 -- [ ] Documentation corrected. +- [x] Documentation corrected. + +Completion: the public declaration distinguishes registration preflight from +input identity validation during strict composition, matching the existing +configuration contract. The final everyday check and full race suite passed. **Owner:** `Definition.SequenceCompositions` comment in [lifecycle.go](../../lifecycle.go), line 20. @@ -328,3 +333,21 @@ using disposable in-memory filesystems in a temporary Go program outside the repository. The scaling finding is based on the inspected loops and lookup implementation, not host timing. No production code, tests, dependencies, release machinery, or downstream repositories were modified during this review. + +## Remediation validation + +All nine findings have completion evidence above. Final validation passed with +Go `go1.26.9 linux/amd64`: + +- `GOTOOLCHAIN=local ./scripts/check.sh` +- `GOTOOLCHAIN=local GOPROXY=off go test -race ./...` +- Local documentation-link and whitespace checks. + +The original external public-API reproductions were rerun against the completed +changes: consumed sensitive evidence is redacted, helper events are chronological +and source-specific, replacements explain removals, parsed/indexed version rules +agree, imported main-version claims fail, NoSource stays absent, and item conflict +paths identify the correct records. Static review and the wide-collection +regression verify the targeted lookup changes without adding performance +thresholds. No dependencies, public controls, release gates, or downstream +repositories were changed by remediation. diff --git a/lifecycle.go b/lifecycle.go index 042fec8..4bded67 100644 --- a/lifecycle.go +++ b/lifecycle.go @@ -17,7 +17,8 @@ type Definition[T any] struct { Secret func(Path) bool // SequenceCompositions registers mapping paths whose sequence contributions // strictly append distinct records by the selected literal identity field. - // Repeated identities and conflicting registrations fail option validation. + // Invalid or conflicting registrations fail option validation. Repeated input + // identities fail strict composition after source and helper processing. // Registration paths are copied when a load begins; definitions are read-only // after being shared. SequenceCompositions []SequenceComposition