Tranche G: conversation attribution — report, gates, read-switch, write-deny - #1432

Draft

ptone wants to merge 114 commits into

GoogleCloudPlatform:mainfrom

ptone:scion/tranche-g

Commits on Aug 31, 2026

feat(messaging): add `scion server attribution-report` command (G1)
Scion Agent (ca-msg-g1)
committed
0ff7b86
fix(messaging): attribution-report G1-a/b/c amendments
Scion Agent (ca-msg-g1)
committed
12d7e22
G4: DEF-58 negative gate, DEF-79 path trace test, DEF-80 divergence caveat
Scion Agent (ca-msg-g4)
committed
17abd8e
G4-d/e: document path trace coverage boundary, add sampling window caveat
Scion Agent (ca-msg-g4)
committed
731839a
fix(messaging): remove read-switch fallback, return typed 409 error (G3)
Scion Agent (ca-msg-g3)
committed
2948be2
fix(messaging): preserve channel constraint, add switch bypass counter (G3-d/e)
Scion Agent (ca-msg-g3)
committed
295bdc6
fix(messaging): prevent thread-on-projectless-agent → DM misroute (G3-f)
Scion Agent (ca-msg-g3)
committed
a25157f
fix(messaging): correct G3-f comment — threadID!="" not threadID=""
Scion Agent (ca-msg-g3)
committed
461a674
fix(messaging): G2 — make write-path conversation resolution fatal
Scion Agent (ca-msg-g2)
committed
7687880
fix(messaging): G2-f/g — add ConversationWriteDenySwitch + write-denial counters
Scion Agent (ca-msg-g2)
committed
2717deb
fix: align NotificationDispatcher struct fields for gofmt
Scion Agent (ca-msg-g2)
committed
d98d58e
fix(messaging): G2 write-deny → typed 409 conversation_not_resolved
Scion Agent (ca-msg-g2)
committed
981c12c
fix: remove duplicate ErrCodeConversationNotResolved (already in G3 base)
Scion Agent (ca-msg-g2)
committed
17376c0
fix(webchat): remove DDL-block index on conversation_id that breaks pre-existing DBs
Scion Agent (cr-dev-a)
committed
fdef77b
feat(messaging): admin API to read/set conversation migration switches

Scion Agent (ca-msg-g5)
authored and
Scion Agent (cr-dev-a)
committed
36b5a7a
fix(hub): nil-pointer panic in broker inbound fail-open path + CI lint fixes
Scion Agent (cr-dev-a)
committed
6f6228f
fix(settings): remove postgres gate on OperationalSettings init, fail-soft on error
Scion Agent (cr-dev-a)
committed
6ac1a50
fix(webchat): CreateTopic auto-generates conversation when table exists (DEF-89)
Scion Agent (cr-dev-a)
committed
ecf9abc
fix(webchat): extend DEF-89 ConversationID generation to pgWebChatStore
Scion Agent (cr-dev-a)
committed
93916ca

Commits on Sep 1, 2026

fix(messaging): add topic-lookup intercept to read-path resolver (DEF-100)
Scion Agent (cr-dev-a)
committed
85f25c1

Commits on Sep 2, 2026

test(messages): add byte-identity guard for FormatForDelivery (AC-9-1)
Scion Agent (cr-dev-a)
committed
40b6508
fix(settings): add Malformed flag to sectionState, log parse errors at Refresh (DEF-92)
Scion Agent (cr-dev-a)
committed
683ba14
feat(messaging): consolidate two messaging switches into one default-ON switch (Phase 9a)
Scion Agent (cr-dev-a)
committed
9e67fbd
fix(settings): detect type-mismatch at ingest, fix nil-ops GET divergence
Scion Agent (cr-dev-a)
committed
41f84ec
test(messaging): add Phase 9a upgrade-cutover integration tests
Scion Agent (cr-dev-a)
committed
45c440b
feat(messaging): add DeliveryText field and broker preference logic (Phase 9b-i)
Scion Agent (cr-dev-a)
committed
ba15295
feat(messaging): enrich ConversationResult and add shared rendering helper (Phase 9b-ii)
Scion Agent (cr-dev-a)
committed
2f8567f
feat(hub): stamp DeliveryText at all five send paths behind envelope switch (Phase 9b-iii)
Scion Agent (cr-dev-a)
committed
643a38b
fix(messaging): use cfg.surface in topic-lookup branch, fix comment justification
Scion Agent (cr-dev-a)
committed
ebdc069
fix(messaging): use real persisted identifiers, stop fabricating IDs (DEF-103)
Scion Agent (cr-dev-a)
committed
426db07
refactor(messaging): extract validateStructural, eliminate duplication
Scion Agent (cr-dev-a)
committed
6efbc45
fix(messaging): make Conversation optional, delete synthesizer (DEF-102)
Scion Agent (cr-dev-a)
committed
36f48a5
feat(messaging): add Urgent field to Message and DeliveryEnvelope (OQ-1b)
Scion Agent (cr-dev-a)
committed
969a4f3
fix(messaging): update render_delivery.go to use PersistedIdentity and pointer ConversationInfo
Scion Agent (cr-dev-a)
committed
7f12309
fix(messaging): enrich caller-supplied ConversationResult with Kind, Surface, DisplayName
Scion Agent (cr-dev-a)
committed
b350730
fix(messaging): stamp DeliveryText in handleGroupMessage agent send path
Scion Agent (cr-dev-a)
committed
30019f1
test(messaging): add Phase 9e tests for group DeliveryText and pre-resolved enrichment
Scion Agent (cr-dev-a)
committed
15707e5
fix(messaging): correct observer-copy comment to state actual disclosure
Scion Agent (cr-dev-a)
committed
07bad45
fix(messaging): map Urgent and ConversationID in NewEnvelopeToLegacy, harden round-trip test

Scion Agent (cr-dev-a)
authored and
Scion Agent (ca-msg-arch)
committed
c98a2b5
fix(messaging): stamp DeliveryText in scheduler message delivery path
Scion Agent (cr-dev-a)
committed
13a9ed7
fix(messaging): stamp DeliveryText in notification dispatch path
Scion Agent (cr-dev-a)
committed
e61a399
test(messaging): add Phase 9f tests for scheduler and notification DeliveryText
Scion Agent (cr-dev-a)
committed
e132380
fix(messaging): propagate key-derivation failure reason out of backfill (DEF-114)
Scion Agent (cr-dev-a)
committed
6a1837b
test(messaging): pin exact attributed message IDs in mixed-derivation fixture (DEF-114)
Scion Agent (cr-dev-a)
committed
9ca8a30
fix(messaging): add unclassified bucket and sum-checking invariant (DEF-114)
Scion Agent (cr-dev-a)
committed
36b5eda
feat(store): add LockDataMigrations advisory lock key (M1)

Scion Agent (cr-dev-a)
authored and
Scion Agent (ca-msg-arch)
committed
dcaf010
feat(cmd): add migration marker helpers for hub_settings (M2)

Scion Agent (cr-dev-a)
authored and
Scion Agent (ca-msg-arch)
committed
3787c46
feat(cmd): add scion server migrate-dm-keys CLI (M3)

Scion Agent (cr-dev-a)
authored and
Scion Agent (ca-msg-arch)
committed
e29aace
fix: address review fixes F1-F4 for migration markers

Scion Agent (cr-dev-a)
authored and
Scion Agent (ca-msg-arch)
committed
23a2a11
fix(backfill): surface DeriveFailures, HazardAEmailCount, and write failures to operator (DEF-119/DEF-120)
Scion Agent (ca-mig-2)
committed
567be89
fix(backfill): structural error classification — close the resolveGroup gap
Scion Agent (ca-mig-2)
committed
2912048
feat(cmd): add boot-time DM key migration hook (M4)
Scion Agent (cr-dev-a)
committed
8f3836a
fix(cmd): make AC-2b test non-tautological (M4 review fix)
Scion Agent (cr-dev-a)
committed
e8e4cc3
feat(cmd): add boot-time message backfill with per-project markers (M5)
Scion Agent (cr-dev-a)
committed
4da916c
fix(cmd): add panic containment to boot data migrations (M5 review fix)
Scion Agent (cr-dev-a)
committed
f667e2e
feat(cmd): split residual attribution report into reachable/unreachable buckets (M6)
Scion Agent (cr-dev-a)
committed
1bbb0be
test(cmd): add steady-state reachable WARN gate (M6 review fix)
Scion Agent (cr-dev-a)
committed
d10ba2a
refactor(messaging): rename stepMergeOrRekeyEmptyRef to stepSkipEmptyRef and delete dead counters (M8, DEF-113)
Scion Agent (cr-dev-a)
committed
a666c74
test(cmd): add DEF-112 consistency gate for reachable-count invariant (M7)
Scion Agent (cr-dev-a)
committed
b0990a3
test(store): add source-scan guard for ListProjects unconditional filters (M7, DEF-112)
Scion Agent (cr-dev-a)
committed
f1ce7ee
Merge commit 'f1ce7ee42846a8955d9f0c3abe8a075516f45fd5' into HEAD
arch
committed
cbd4f8b
feat(cmd): add third residual bucket for permanently unattributable messages (M9)
Scion Agent (cr-dev-a)
committed
edad66d
fix(cmd): rework M9 residual report per orchestrator review (A-H)
Scion Agent (cr-dev-a)
committed
c02ad42
fix(cmd): discharge Gate C with real-log identity gate (item C rework)
Scion Agent (cr-dev-a)
committed
5ca3e40
fix(cmd): reset total_residuals accumulator on fresh pass (M9a)
Scion Agent (cr-dev-a)
committed
bc30057
fix(cmd): promote pre-M9 mid-pass markers to fresh pass (M9a follow-up)
Scion Agent (cr-dev-a)
committed
98543da
test(messaging): add adversarial fixture-class tests F-1..F-9 for DM key migration repair path
Scion Agent (cr-dev-a)
committed
97c3462
fix(messaging): DEF-126 cardinality guard and exact user resolution
Scion Agent (cr-dev-a)
committed
116db40
fix(messaging): DEF-126 review fixes — ADDR_AMBIGUOUS, error classification
Scion Agent (cr-dev-a)
committed
f250ea2
merge: DEF-126 exact user resolution (scion/ca-msg-fix1)
Scion Agent (ca-msg-arch)
committed
43be4ba
fix(hub,messaging): DEF-127/127a/128a/128b read-path and fallback fixes
Scion Agent (cr-dev-a)
committed
bda4cbf
fix(hub): DEF-128b defects — fail-closed guard, authz denial log, unconditional participant filter
Scion Agent (cr-dev-a)
committed
037268b
test(hub): add mutation-catching tests for DEF-128b MUT-A and MUT-B
Scion Agent (cr-dev-a)
committed
c4f216d
refactor(hub): extract resolveSenderUserID and resolvePhase5Conversation
Scion Agent (cr-dev-a)
committed
07d816d
fix(hub): hoist conversation resolution above delivery-envelope render
Scion Agent (cr-dev-a)
committed
bb82204
test(hub): DEF-135 acceptance tests for conversation envelope hoist
Scion Agent (cr-dev-a)
committed
91c5d91
docs: DEF-135 tranche-g note for envelope hoist drift
Scion Agent (cr-dev-a)
committed
15498d7
fix(hub): DEF-135 rework — F2 validate effectiveConv, F3 nil broadcasts
Scion Agent (cr-dev-a)
committed
ea8040e
test(hub): DEF-135 rework — extend AC-3, clean AC-5, cover F2/F3
Scion Agent (cr-dev-a)
committed
8ae02b5
docs: DEF-135 rework — add broadcast envelope drift and Phase 11 tripwire
Scion Agent (cr-dev-a)
committed
f91ea41
merge: ca-msg-fix2 — DEF-127/127a/128a/128b read-path and fallback fixes
Scion Agent (ca-msg-arch)
committed
8f65e46
merge: ca-msg-fix3 — DEF-135 conversation id in the delivery envelope
Scion Agent (ca-msg-arch)
committed
0cff20a

Commits on Sep 3, 2026

fix(messaging): DEF-139 — expose tautological routing-key comparison and surface independent consistency check
Scion Agent (cr-dev-a)
committed
e497a30
test(hub): DEF-139 — structural guard against re-discarding CheckConversationConsistency return
Scion Agent (cr-dev-a)
committed
222775e
merge: ca-msg-d139 — DEF-139 divergence detector made capable of failing
Scion Agent (ca-msg-arch)
committed
f7687e2
fix(hub,cmd): DEF-138 — explicit conversation routing on the outbound agent message path
Scion Agent (cr-dev-a)
committed
ee75cc4
fix(hub): DEF-138 review — explicit-routing divergence outcome, remove double divergence log
Scion Agent (cr-dev-a)
committed
3edf96d
fix(hub): DEF-138 — surface explicit_routes on admin divergence board
Scion Agent (cr-dev-a)
committed
a026a3b
merge: ca-msg-d138 — DEF-138 explicit conversation routing
Scion Agent (ca-msg-arch)
committed
c316b08
fix(messaging): DEF-140 — thread conversations stamped with originating channel surface
Scion Agent (cr-dev-a)
committed
6fc8204
fix(messaging): DEF-140 — validate channel→surface at boundary, harden test double
Scion Agent (cr-dev-a)
committed
63d20e2
fix(messaging): DEF-140 — cross-check validSurfaces against ent enum, nil-guard logger
Scion Agent (cr-dev-a)
committed
77cc53e
fix(messaging): DEF-140 — replace hand-listed enum with source-scanning cross-check
Scion Agent (cr-dev-a)
committed
94fc5ee
merge: ca-msg-d140 — DEF-140 stamp conversation surface from originating channel
Scion Agent (ca-msg-arch)
committed
eb59ea9

Commits on Sep 4, 2026

fix(messaging): DEF-141 — distinguish caller assertion from hub derivation in routing provenance
Scion Agent (ca-msg-d141)
committed
cc5047f
fix(messaging): DEF-141 P6 — json:"-" tag prevents ConversationAsserted binding from any JSON source
Scion Agent (ca-msg-d141)
committed
7672a12
fix(messaging): DEF-142 P1 — resolveThread fails closed on ambiguous display names
Scion Agent (ca-msg-d141)
committed
d8d4dbc
fix(messaging): DEF-142 P1 fix — deterministic IDs in cross-page ambiguity test
Scion Agent (ca-msg-d141)
committed
b51f1b7
feat(messaging): DEF-142 P2/P3 — add ConversationRef to send path, wire through handler
Scion Agent (ca-msg-d141)
committed
64938d7
fix(messaging): DEF-142 AC-3 + AC-6 — collapse disclosure errors, test resolve-or-create auth
Scion Agent (ca-msg-d141)
committed
6977ced
fix(messaging): DEF-142 AC-3 — invert disclosure switch to allowlist
Scion Agent (ca-msg-d141)
committed
98eeb6b
fix(messaging): DEF-142 P5 — delete ResolveConversation, CLI uses conversation_ref
Scion Agent (ca-msg-d141)
committed
b4f7316
fix(messaging): DEF-142 AC-3 rework — extract disclosableResolutionReason
Scion Agent (ca-msg-d141)
committed
a9bdd63
test(hub): DEF-142 P6 AC-7 — real mux integration test for conversation_ref
Scion Agent (ca-msg-d141)
committed
270269c
test(hub): DEF-142 G1 — strengthen provenance test with competing project_id
Scion Agent (ca-msg-d141)
committed
8795a70

Commits on Sep 5, 2026

merge: main (2ac554cb0) into tranche-g
Scion Agent (ca-msg-arch)
committed
b4d78c0
style: gofmt 14 files to restore `make fmt-check`
Scion Agent (ca-msg-arch)
committed
42b4e6a
fix(hub): rename createProjectMembersGroupAndPolicy call sites after merge
Scion Agent (ca-msg-arch)
committed
a29d75f

Commits on Sep 7, 2026

fix(hub): allow conv:<uuid> and #thread refs without explicit recipient (DEF-152)
Scion Agent (ca-msg-convref)
committed
ffe96f0
test(hub): add mutation-killing tests for DEF-152 addressee derivation
Scion Agent (ca-msg-convref)
committed
6e061e7
feat: remove --broadcast and --all flags from scion message
Scion Agent (ca-msg-bcast)
committed
a18ca34
fix: make broadcast/all refusal mode-aware for agent context
Scion Agent (ca-msg-bcast)
committed
92799a9
test: pin broadcast exclusion from agent-mode allowlist
Scion Agent (ca-msg-bcast)
committed
6f6dbe9
Merge scion/ca-msg-bcast: remove --broadcast/--all from 'scion message'
Scion Agent (ca-msg-arch)
committed
ef12efe