feat(sharing): reconcile recipient policy access by kunickiaj · Pull Request #1344 · kunickiaj/codemem

kunickiaj · 2026-07-22T10:06:51Z

Description

Promotes recipient policy to per-Project desired-state authority through persisted, idempotent, fail-closed reconciliation.

derives exact effective devices only from active direct Identity and Team relationships
blocks malformed, orphaned, pending, merged, ambiguous, or unsupported state before grants
adds schema-v13 per-Project authority, generation-step journal, leases, stable parity evidence, and deny overlays
validates exactly one managed exact-Project scope and mapping before reconciliation
preflights every affected device, applies deny overlays, revokes before grants, refreshes authorization, and requires a second stable parity pass before cutover
adds deterministic coordinator grant/revoke effect receipts with atomic SQLite/D1 replay and conflict handling
prevents stale cached memberships and legacy share retries from restoring removed access
runs bounded reconciliation after existing share maintenance and exposes safe status with truthful delivered-copy warnings

Type of Change

🚀 Feature (new functionality)
🐛 Bug fix (fixes an issue)
📚 Documentation (docs-only change)
🔧 Maintenance (refactor, chore, CI, etc.)
🧪 Testing (test-only changes)

Testing

Relevant checks pass locally (pnpm run tsc, pnpm run lint, pnpm run test)
Added/updated tests for changes
Manually verified changes work as expected

Additional validation:

2,965 tests passed; 3 existing todos
Cloudflare Worker Node and integration suites passed
565 focused reconciliation, authorization, coordinator, viewer, and maintenance tests passed
Snyk scan: 0 high-severity issues
independent security/correctness review: no remaining medium-or-higher findings
independent complexity/maintainability review: no remaining medium-or-higher blockers

Checklist

Code follows project style (pnpm run lint passes for touched files)
Self-review completed
Documentation impact reviewed; approved ADR, design, and implementation plan already describe this slice
No new warnings introduced

kunickiaj · 2026-07-22T10:07:14Z

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6dd2e4e9c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b3847ce6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b3847ce6d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 65b4dab058

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a44f1ec90d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68a37675b0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-22T21:25:18Z

+					deviceId,
+				});
 				const membership = await dependencies.grantMembership({
+					effectId,


Use operation-scoped effect IDs for share grants

When a later share operation grants the same managed Project scope to the same device after the previous membership was revoked, this now sends the persisted space_grant effect ID to the coordinator. Those IDs are created from the boundary/device/epoch only in packages/core/src/share-operation.ts:123, so the coordinator's new global effect receipt table replays the old active grant receipt instead of mutating the currently revoked membership; provisioning can then continue while the recipient still has no access. Include the share operation (or another grant-instance nonce) in the coordinator effect ID while keeping retries for the same step stable.

Useful? React with 👍 / 👎.

kunickiaj · 2026-07-22T21:25:54Z

Merge activity

Jul 22, 9:25 PM UTC: A user started a stack merge that includes this pull request via Graphite.
Jul 22, 9:58 PM UTC: Graphite couldn't merge this pull request because a downstack PR fix(sharing): preserve inviter policy during acceptance #1345 failed to merge.
Jul 22, 10:21 PM UTC: @kunickiaj merged this pull request with Graphite.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8d8c306d3d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-22T22:24:36Z

-			actorId: opts.actorId ?? null,
-		});
+		try {
+			return await store.grantScopeMembership({


Restore active-group validation for local grants

When this action uses the local coordinator store (for example the CLI with --db-path or no remoteUrl), it now calls store.grantScopeMembership directly instead of localScopeForGroup, so archived or missing groups are no longer rejected before mutating membership; the store only checks that the scope is active and the device is enrolled. Fresh evidence beyond the earlier API concern is that the HTTP API path now calls findAdminScope, but this local action path still bypasses requireLocalActiveGroup, allowing codemem coordinator grant-scope-member to grant access inside an archived group.

Useful? React with 👍 / 👎.

kunickiaj mentioned this pull request Jul 22, 2026

feat(sharing): add recipient onboarding journeys #1343

Merged

12 tasks

kunickiaj marked this pull request as ready for review July 22, 2026 10:07

chatgpt-codex-connector Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread packages/viewer-server/src/routes/sync.ts Outdated

kunickiaj changed the base branch from 07-22-feat_sharing_add_recipient_onboarding_journeys to graphite-base/1344 July 22, 2026 18:17

kunickiaj force-pushed the graphite-base/1344 branch from 6d44616 to f904594 Compare July 22, 2026 18:17

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from 6dd2e4e to 6b3847c Compare July 22, 2026 18:17

This was referenced Jul 22, 2026

fix(sharing): preserve inviter policy during acceptance #1345

Merged

feat(sharing): promote Devices navigation and proof #1346

Merged

chatgpt-codex-connector Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread packages/viewer-server/src/routes/sync.ts Outdated

chatgpt-codex-connector Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread packages/viewer-server/src/routes/sync.ts Outdated

kunickiaj force-pushed the graphite-base/1344 branch from f904594 to 287f691 Compare July 22, 2026 18:29

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from 6b3847c to 038dc07 Compare July 22, 2026 18:29

kunickiaj changed the base branch from graphite-base/1344 to 07-22-fix_sharing_preserve_inviter_policy_on_acceptance July 22, 2026 18:30

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from 038dc07 to 65b4dab Compare July 22, 2026 19:37

kunickiaj force-pushed the 07-22-fix_sharing_preserve_inviter_policy_on_acceptance branch from 287f691 to 20d70c6 Compare July 22, 2026 19:37

chatgpt-codex-connector Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread packages/core/src/recipient-policy-reconciler.ts Outdated

Comment thread packages/viewer-server/src/routes/sync.ts

Comment thread packages/core/src/recipient-policy-reconciler.ts Outdated

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from 65b4dab to a44f1ec Compare July 22, 2026 19:55

kunickiaj force-pushed the 07-22-fix_sharing_preserve_inviter_policy_on_acceptance branch from 20d70c6 to 12809f0 Compare July 22, 2026 19:55

chatgpt-codex-connector Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread packages/core/src/coordinator-api.ts

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from a44f1ec to 68a3767 Compare July 22, 2026 21:17

kunickiaj force-pushed the 07-22-fix_sharing_preserve_inviter_policy_on_acceptance branch from 12809f0 to 1498df3 Compare July 22, 2026 21:17

chatgpt-codex-connector Bot reviewed Jul 22, 2026

View reviewed changes

kunickiaj changed the base branch from 07-22-fix_sharing_preserve_inviter_policy_on_acceptance to graphite-base/1344 July 22, 2026 21:55

kunickiaj force-pushed the graphite-base/1344 branch from 1498df3 to 40c8009 Compare July 22, 2026 22:13

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from 68a3767 to 2d1f551 Compare July 22, 2026 22:13

kunickiaj changed the base branch from graphite-base/1344 to 07-22-fix_sharing_preserve_inviter_policy_on_acceptance July 22, 2026 22:13

kunickiaj changed the base branch from 07-22-fix_sharing_preserve_inviter_policy_on_acceptance to graphite-base/1344 July 22, 2026 22:17

kunickiaj force-pushed the graphite-base/1344 branch from 40c8009 to 0137d0d Compare July 22, 2026 22:17

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from 2d1f551 to 2f7db5e Compare July 22, 2026 22:17

graphite-app Bot changed the base branch from graphite-base/1344 to main July 22, 2026 22:17

feat(sharing): reconcile recipient policy access

8d8c306

kunickiaj force-pushed the 07-22-feat_sharing_reconcile_recipient_policy_access branch from 2f7db5e to 8d8c306 Compare July 22, 2026 22:17

kunickiaj merged commit 5606499 into main Jul 22, 2026
11 checks passed

kunickiaj deleted the 07-22-feat_sharing_reconcile_recipient_policy_access branch July 22, 2026 22:21

chatgpt-codex-connector Bot reviewed Jul 22, 2026

View reviewed changes

Conversation

kunickiaj commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of Change

Testing

Checklist

Uh oh!

kunickiaj commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

kunickiaj commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge activity

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

kunickiaj commented Jul 22, 2026 •

edited

Loading

kunickiaj commented Jul 22, 2026 •

edited

Loading

kunickiaj commented Jul 22, 2026 •

edited

Loading