네 어댑터가 각자 구현한 open/blocked/upgrade/트랜잭션 메커니즘을 커널로
모은다. 사본은 아직 이행하지 않았으므로 런타임 동작은 그대로다.
실패 분류는 커널에 넣지 않고 translate 콜백으로 주입한다. RT/MT/OP의
mapIndexedDbException과 CP의 mapBrowserDataException이 같은 에러에 다른
답을 내며, 그 차이를 통일하는 것은 별건이기 때문이다.
IndexedDbFailureCause는 translate의 입력과 호출자가 주는 admit FAIL에만
나오고 공개 반환 타입에는 나오지 않는다. 기존 커널 abortable-operation.ts는
AbortTerminalReason 3멤버를 반환 타입에 박아서 5종이 필요한 http v3가 아예
쓰지 못했는데, 그 함정을 피하기 위한 설계다. 사양 3.4의 네 호출부를 실제
코드로 써서 tsc --strict로 컴파일해 수용을 확인했다.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
각 어댑터 그룹의 공개 표면을 index.ts로 선언한다. 소비자는 아직 바꾸지
않았으므로 런타임 동작은 그대로다.
storage 배럴은 서브배럴을 재수출하지 않는다 — 제거 드릴이 indexeddb/와
opfs/만 삭제하기 때문이다. service-worker 배럴은 tsconfig.service-worker.json
에서 제외한다. 그 설정이 그룹 폴더를 통째로 WebWorker lib로 컴파일하면서
페이지 realm 파일만 빼는 구조라, 배럴이 그 파일을 다시 끌어들이면 document를
찾지 못한다. 타입 커버리지는 tsconfig.app.json이 배럴을 포함하므로 유지된다.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The inventory gate caught its own case: a new file under `src/adapters` that no
ledger row named. `assertBoundedCapacity` moved out of the telemetry adapter so
diagnostics could stop importing it across a boundary, and the kernel now has a
row of its own.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
GOV-01. The adapter inventory claimed 118/118 while the tree held 119 files, so
src/adapters/platform/abortable-operation.ts sat outside every review's
coverage without anything failing. The row is restored and
scripts/check-adapter-inventory.ts now diffs the document against
git ls-files src/adapters, so the count is an equality rather than a number
someone has to remember. The same gate pins that the Service Worker asset
generator reads the shared extension table instead of declaring its own.
GOV-02. The previous ledger closed rows as FIXED_NOT_RELEASED that the
re-review found partial. The new section is written the other way round: a row
reads FIXED only where a named adversarial test failed on the pre-fix source
and passes on the landed one, and the twelve findings this pass did not reach —
RPC-RR-01, RT-RR-01 through RT-RR-04 and TR-RR-01 through TR-RR-07 — are
recorded as NOT_STARTED with the reason each needs a lifecycle change rather
than a contained edit. None of them may be treated as closed and no capability
they cover may be promoted without its own evidence row.
The structural gate for the shared abortable-operation primitive is
deliberately not added yet: it still has zero production importers, and a gate
that fails CI for a documented, unfixed defect would report the wrong thing.
Also records the destructive test hazard found while running the suites:
scripts/lib/removal-fixture.ts and scripts/check-supply-chain-provider-fixtures.ts
symlink the real node_modules into a temp fixture root and run pnpm there, which
purges the repository's own dependencies through the symlink mid-run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Install the REST auth profile registry once at composition and make it the
single transport authority for V3. Contract composition now rejects an
unregistered authProfileId, so the executor never resolves a profile at
runtime.
The credential collaborator contributes proof headers only: Fetch credentials
come from the resolved profile, transport-owned and forbidden headers are
rejected, headers outside the profile's allowed set are rejected, and a missing
required header fails closed as AUTH_INTEGRATION_FAILURE with zero fetch calls.
The final invariant re-proves credentials mode and the exact header sets.
Demo mode satisfies the strict bearer profile with a fixed non-secret marker
instead of weakening REFERENCE_EXTERNAL_BEARER. Credential owners now receive
the operation lifetime through AuthOperationContext.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
