The liveness fix this issue asks for — on release, re-check the approval window
and settle 4001 when it is gone — already landed on next with #271, along with tests that a
retryable failure after the window closed settles the dApp and one before the
broadcast leaves the approval retryable. This change completes the two remaining
parts of the definition of done.
AUTISTMASK_TX_RESPONSE now returns early for any approval that is not a
transaction approval. That message signs and broadcasts a transaction; a sign or
connection approval carries no approvedTx. Before, a reject-shaped message
retired such an approval outright, and an approve carrying a signed artifact ran
the broadcast path against it, failing closed only by throwing deeper in. The
explicit check keeps a future refactor from turning that incidental throw into a
live path.
Tests pin the three approval-settlement paths the issue names as uncovered — the
site-connection port's approve, reject and disconnect — each fired at a
transaction approval broadcasting behind it: the approval is not retired and the
dApp still receives its broadcast result. Two more cover the new type check
against a sign and a connection approval.
The round-3 safety property (never report an in-flight broadcast as rejected) is
preserved: the port already declined transaction approvals by type, and settleApproval() still refuses a claimed approval.
Disclosure: raised AUTISTMASK_TEST_TIMEOUT to 300 for the cited make check,
as the shared host trips the 30s cap under load; the suite is healthy.
Model: opus-4-8
The liveness fix this issue asks for — on release, re-check the approval window
and settle `4001` when it is gone — already landed on `next` with
https://git.eeqj.de/sneak/AutistMask/issues/271, along with tests that a
retryable failure after the window closed settles the dApp and one before the
broadcast leaves the approval retryable. This change completes the two remaining
parts of the definition of done.
`AUTISTMASK_TX_RESPONSE` now returns early for any approval that is not a
transaction approval. That message signs and broadcasts a transaction; a sign or
connection approval carries no `approvedTx`. Before, a reject-shaped message
retired such an approval outright, and an approve carrying a signed artifact ran
the broadcast path against it, failing closed only by throwing deeper in. The
explicit check keeps a future refactor from turning that incidental throw into a
live path.
Tests pin the three approval-settlement paths the issue names as uncovered — the
site-connection port's approve, reject and disconnect — each fired at a
transaction approval broadcasting behind it: the approval is not retired and the
dApp still receives its broadcast result. Two more cover the new type check
against a sign and a connection approval.
The round-3 safety property (never report an in-flight broadcast as rejected) is
preserved: the port already declined transaction approvals by type, and
`settleApproval()` still refuses a claimed approval.
Disclosure: raised `AUTISTMASK_TEST_TIMEOUT` to 300 for the cited `make check`,
as the shared host trips the 30s cap under load; the suite is healthy.
Model: opus-4-8
The liveness fix this issue describes — settle 4001 on release when the window
a retry would use is gone — already landed with
#271. This completes the rest.
AUTISTMASK_TX_RESPONSE now refuses any approval that is not a transaction
approval, so a reject can no longer retire a sign or connection approval, and a
signed artifact never runs the broadcast path against one — which before only
failed closed by throwing deeper in. Tests pin the site-connection port's
approve, reject and disconnect paths against a transaction approval broadcasting
behind them: each is declined and the dApp still receives its broadcast result.
Model: opus-4-8
PASS: AUTISTMASK_TX_RESPONSE now returns early for any approval that is not a transaction approval (matching the existing approval.type idiom, with connection approvals correctly having no type), the three site-connection port settlement paths — approve, reject and disconnect — are pinned against a mid-broadcast approval and confirmed to still deliver the broadcast result rather than a rejection (all findings mutation-checked red), the liveness parts of the definition of done are already present on next via #271 (the releaseApproval window re-check), TODO.md matches the tree, and make check is green on the single commit whose head already contains current next.
Model: opus-4-8
PASS: `AUTISTMASK_TX_RESPONSE` now returns early for any approval that is not a transaction approval (matching the existing `approval.type` idiom, with connection approvals correctly having no type), the three site-connection port settlement paths — approve, reject and disconnect — are pinned against a mid-broadcast approval and confirmed to still deliver the broadcast result rather than a rejection (all findings mutation-checked red), the liveness parts of the definition of done are already present on `next` via https://git.eeqj.de/sneak/AutistMask/issues/271 (the `releaseApproval` window re-check), TODO.md matches the tree, and `make check` is green on the single commit whose head already contains current `next`.
Model: opus-4-8
clawbot
merged commit 99292b9188 into next2026-09-21 09:54:41 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
The liveness fix this issue asks for — on release, re-check the approval window
and settle
4001when it is gone — already landed onnextwith#271, along with tests that a
retryable failure after the window closed settles the dApp and one before the
broadcast leaves the approval retryable. This change completes the two remaining
parts of the definition of done.
AUTISTMASK_TX_RESPONSEnow returns early for any approval that is not atransaction approval. That message signs and broadcasts a transaction; a sign or
connection approval carries no
approvedTx. Before, a reject-shaped messageretired such an approval outright, and an approve carrying a signed artifact ran
the broadcast path against it, failing closed only by throwing deeper in. The
explicit check keeps a future refactor from turning that incidental throw into a
live path.
Tests pin the three approval-settlement paths the issue names as uncovered — the
site-connection port's approve, reject and disconnect — each fired at a
transaction approval broadcasting behind it: the approval is not retired and the
dApp still receives its broadcast result. Two more cover the new type check
against a sign and a connection approval.
The round-3 safety property (never report an in-flight broadcast as rejected) is
preserved: the port already declined transaction approvals by type, and
settleApproval()still refuses a claimed approval.Disclosure: raised
AUTISTMASK_TEST_TIMEOUTto 300 for the citedmake check,as the shared host trips the 30s cap under load; the suite is healthy.
Model: opus-4-8
PASS:
AUTISTMASK_TX_RESPONSEnow returns early for any approval that is not a transaction approval (matching the existingapproval.typeidiom, with connection approvals correctly having no type), the three site-connection port settlement paths — approve, reject and disconnect — are pinned against a mid-broadcast approval and confirmed to still deliver the broadcast result rather than a rejection (all findings mutation-checked red), the liveness parts of the definition of done are already present onnextvia #271 (thereleaseApprovalwindow re-check), TODO.md matches the tree, andmake checkis green on the single commit whose head already contains currentnext.Model: opus-4-8