#223: dedup window for the read trail #279

fable-5 · 2026-07-31T12:25:52+02:00

fable-5 commented

2026-07-31 12:25:52 +02:00

One event per (session, page, channel) within an aligned readTrail.dedupWindowMinutes window (default 5). Unique (dedup_key, window_bucket) collapses concurrent duplicates race-free; a skipped duplicate is not a gap (only real failures abort the read). Rows carry windowSeconds so the evidence states it represents a window. Load evidence: 30 collab-token renewals in one window = one event (test), bounding a live session at ~12 events/hour/page. Docs: ADR 0023, security documentation 60 (what the trail can/cannot prove), hardening-guide line for the new setting. Stacked on #222. Refs #223

fable-5 added 2 commits 2026-07-31 12:25:52 +02:00

#222 : read-access trail for classified pages

CI / Lint, typecheck, test (pull_request) Successful in 6m25s

Details

CI / Build container images (pull_request) Successful in 2m58s

Details

CI / Auth e2e pack (pull_request) Successful in 8m35s

Details

CI / Import/export fidelity gate (pull_request) Successful in 1m7s

Details

CD / Deploy to Test (push) Blocked by required conditions

Details

CD / Smoke tests against Test (push) Blocked by required conditions

Details

CD / Promote to Int (push) Blocked by required conditions

Details

CI / Auth e2e pack (push) Blocked by required conditions

Details

CI / Import/export fidelity gate (push) Blocked by required conditions

Details

CI / Build container images (push) Blocked by required conditions

Details

CI / Lint, typecheck, test (push) Has been cancelled

Details

CD / Build and push images (push) Has been cancelled

Details

05a979bac3

Instrument every full-content read channel for pages with
classification = vs_nfd (ADR 0023, variant A): SPA state fetch and read
rendering, public JSON content, no-JS shell, expanded embeds, public API
GET (incl. the MCP read_page path and write echoes), attachment download
under the #212 effective classification, all export shapes (markdown,
pond ZIP, account data export, queued docx/odt/pdf at enqueue), and
collab-token issuance as the api-side proxy for the WS join.

Events land in the new read_events table (no FKs — evidence survives
page purges and hard user deletions) with actor, session key
(session:/token:/job:/anon), page, pond, channel and the classification
at read time. Recording failures are NOT swallowed: a failed write
aborts the read (hard failure, the deliberate contrast to AuditService —
decision recorded in ADR 0023 and security.md §Logging, together with
the recorded residuals: content fragments and feeds).

One e2e test per channel proves both the event and its absence for
unclassified pages, plus the hard-failure semantics.

Refs #222.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

#223 : dedup window for the read trail

CI / Lint, typecheck, test (pull_request) Successful in 6m29s

Details

CI / Auth e2e pack (pull_request) Failing after 5s

Details

CI / Import/export fidelity gate (pull_request) Has been skipped

Details

CI / Build container images (pull_request) Successful in 2m55s

Details

fd4fd60c99

One event per (session, page, channel) within an aligned window of
readTrail.dedupWindowMinutes (default 5): buckets are
floor(epoch / windowSeconds), and a unique (dedup_key, window_bucket)
pair collapses concurrent duplicates race-free at insert time — the
first access in a window is always recorded, a later duplicate lands on
the unique violation and is skipped quietly (a skipped duplicate is not
a gap; only real write failures still abort the read). Each row carries
windowSeconds, so the evidence states it represents a window, never a
request count.

Reconnects within a window stay one event; a new session records again
even for the same user; channels never collapse into each other; the
page-less attachment key uses the documented `-` placeholder. Load
evidence: 30 collab-token renewals inside one window produce exactly one
event (test), bounding a live editing session at ~12 events/hour/page.

Window semantics documented in ADR 0023, the VS-NfD security
documentation (#228) and as a hardening-guide line for the new setting
(care rule: same PR).

Refs #223.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 commented

2026-07-31 12:53:58 +02:00

Contained in the fast-forward merge of PR #281 (runs 591/596 green; this PR own runs 592/593 failed only on runner infrastructure: docker address-pool exhaustion, since cleaned up). Commits are on main - closed like #268/#275.

fable-5 closed this pull request

2026-07-31 12:53:58 +02:00

fable-5 referenced this pull request

2026-07-31 12:59:07 +02:00

[VS-NfD] Add a dedup window so Yjs sync does not flood the trail #223