fix(permissions): keep board-access reads behind confirmed writes by Chris0Jeky · Pull Request #3330 · Chris0Jeky/Taskdeck

Chris0Jeky · 2026-09-21T12:01:19Z

Closes #3328. Related residual: #3352.

Summary

Makes board-access cache writes, messaging and loading explicitly owned by the initiating read/mutation and session lifetime:

one read owner exists per board; unrelated boards remain concurrent;
confirmed grant/update/revoke advances that board's mutation generation and retires older reads;
identity/auth/demo replacement clears cached access and retires operations;
same-user token rotation preserves settled board caches and suppresses old-token settlement;
active boards without any cache entry restart under the new token with the exact board ID;
an authoritative empty array is considered settled and is not retried;
grant/update/revoke mutations are never replayed;
stable-ID grant settlement remains deduplicated.

Server authorization remains authoritative. Same-entry mutation serialization remains in stacked PR #3335.

Test-first evidence

The original suite covers read-versus-grant/update/revoke races, reverse reads, independent loading, same-user relogin, stale mutation settlement and grant deduplication. Review-regression head 6bbf8d04139bef2dca91d290b910e1c07a8e76aa ran canonical Ubuntu/Windows frontend qualification; Ubuntu JUnit recorded 7,161 tests, exactly 2 failures, 0 errors, both loaded-cache preservation cases.

Issue #3352 added test-only head d28697ede737ec42ae3e696c7a7cedcb753de347, covering token rotation while a board has no cache entry and its first read is pending. A dependency-free actual-module runner changed from one getAccess call with loading false to two calls for the same board with old settlement suppressed and the fresh result installed.

Supplemental execution does not replace hosted qualification.

Current head and remaining gates

Exact final head: 72d71c8500f534c10e8bb70c025922f9381f0103

Keep draft until this exact head passes Smart CI, Extended and the complete Required CI matrix on Ubuntu and Windows, followed by repeat independent review. Stacked PR #3335 must then be reconciled to this corrected parent and requalified.

Green CI is qualification evidence, not merge authorization.

Chris0Jeky · 2026-09-21T12:12:22Z

Fresh source-backed verification for exact head c43a5ace7f403f773153cf91a7d62e312aab1b9c:

Actual production modules, unchanged uploaded-main source: 0/12 combined integration/permission ownership schedules passed.
Actual production modules, corrected source: 12/12 passed.
All five changed TypeScript production/test files transpile under TypeScript 5.8.3 with zero diagnostics.
Smart CI Self-Test 35597759420: success.
CI Extended 35597759705 and Required CI 35597759871: queued at this checkpoint.

The permissions cases cover read→revoke/update, reverse reads, independent-board loading, same-user logout/login, old-session mutation and stale failure. The canonical suite additionally covers grant. The test-only Required run was superseded/cancelled, so no hosted canonical-red claim is made.

chatgpt-codex-connector · 2026-09-21T14:07:15Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-22T00:53:42.703346Z	`112585b`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 71a20bc8ad

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 72d71c8500

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-21T20:28:21Z

@codex review

Please review exact current head 6f88600 against base fb830ed. This is the one current-head review request after the main-base requalification. Focus on the PR's changed ownership and stale-settlement behavior, and report only merge-blocking correctness or security defects.

chatgpt-codex-connector · 2026-09-21T20:31:50Z

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 6f88600047

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-21T21:29:23Z

@codex review Please review the exact current head 9882632, including stale-mutation reconciliation after same-user token rotation and its regression test. Treat prior review threads as triaged; report only merge-blocking correctness or security defects at this exact head.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9882632580

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-21T22:03:24Z

@codex review

Chris0Jeky · 2026-09-21T22:06:55Z

@codex review

Chris0Jeky · 2026-09-21T22:15:19Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63fb0f54c0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-21T23:19:37Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c7a8eff122

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-21T23:30:43Z

@codex review

chatgpt-codex-connector · 2026-09-21T23:36:19Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 929d4127d3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-22T00:13:34Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1be3bfe203

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-22T00:39:18Z

@codex review

Please review exact current head 5b16566 against base d7a146c. The fresh P2 is fixed: stale mutation reconciliation now requires a recorded token-only rotation, so logout/re-login cannot reconcile old lifecycle state. Report only merge-blocking correctness or security defects.

chatgpt-codex-connector · 2026-09-22T00:42:55Z

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 5b16566b73

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Chris0Jeky · 2026-09-22T00:49:14Z

@codex review

Please review exact current head 112585b against base e09f10f after the #3349 merge and rebase. permission proof is 41/41 and typecheck passes. Report only merge-blocking correctness or security defects.

chatgpt-codex-connector · 2026-09-22T00:53:41Z

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 112585b722

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-project-automation Bot added this to Taskdeck Execution Sep 21, 2026

github-project-automation Bot moved this to Pending in Taskdeck Execution Sep 21, 2026

This was referenced Sep 21, 2026

Board-access mutations can commit and settle out of user-intent order #3333

Open

fix(permissions): serialize same-entry mutations #3335

Draft

Chris0Jeky marked this pull request as ready for review September 21, 2026 14:07

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread frontend/taskdeck-web/src/store/permissionsStore.ts

Chris0Jeky marked this pull request as draft September 21, 2026 14:13

Chris0Jeky mentioned this pull request Sep 21, 2026

Same-user token refresh can strand empty first-load store surfaces #3352

Open

Chris0Jeky marked this pull request as ready for review September 21, 2026 18:53

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread frontend/taskdeck-web/src/store/permissionsStore.ts Outdated

Chris0Jeky force-pushed the audit/3328-permission-read-ownership branch 2 times, most recently from 1b69685 to 6f88600 Compare September 21, 2026 20:16

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread frontend/taskdeck-web/src/store/permissionsStore.ts Outdated

Chris0Jeky force-pushed the audit/3328-permission-read-ownership branch from 3447837 to c9abfd0 Compare September 21, 2026 22:06

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread frontend/taskdeck-web/src/store/permissionsStore.ts

Comment thread frontend/taskdeck-web/src/store/permissionsStore.ts

Comment thread frontend/taskdeck-web/src/store/permissionsStore.ts

Chris0Jeky force-pushed the audit/3328-permission-read-ownership branch from c7a8eff to 929d412 Compare September 21, 2026 23:24

chatgpt-codex-connector Bot reviewed Sep 21, 2026

View reviewed changes

Comment thread docs/analysis/2026-09-21-permission-read-ownership.md

Chris0Jeky force-pushed the audit/3328-permission-read-ownership branch from 929d412 to 1be3bfe Compare September 22, 2026 00:06

chatgpt-codex-connector Bot reviewed Sep 22, 2026

View reviewed changes

Comment thread frontend/taskdeck-web/src/store/permissionsStore.ts

Chris0Jeky and others added 17 commits September 22, 2026 01:46

test(permissions): reproduce read and session races

f963ae5

fix(permissions): bind access state to reads and sessions

457c259

fix(permissions): deduplicate grant settlement by stable id

72c1de9

test(permissions): pin grant settlement deduplication

ed3ffbc

test(permissions): invalidate operations on token rotation

421122b

fix(permissions): invalidate ownership on token rotation

fa4ee41

test(permissions): preserve access cache across token refresh

3b275ee

fix(permissions): preserve access cache across token refresh

e00f5d6

docs(permissions): preserve access cache on token refresh

5a86d81

test(permissions): retry unresolved access read after token refresh

2676cce

fix(permissions): retry unresolved reads after token refresh

1bfe9b7

docs(permissions): record unresolved-read retry contract

eb70563

fix(permissions): reconcile stale mutations after refresh

dc66fd7

fix(permissions): reconcile stale mutations after active reads

00a9bf0

fix(permissions): retry reconciliation after token rotation

a6fd963

fix: retry cached permissions after token refresh

0f9cad1

Separate token refresh from re-login ownership

112585b

Chris0Jeky force-pushed the audit/3328-permission-read-ownership branch from 5b16566 to 112585b Compare September 22, 2026 00:46

Conversation

Chris0Jeky commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test-first evidence

Current head and remaining gates

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 21, 2026

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Chris0Jeky commented Sep 21, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 21, 2026

Uh oh!

Chris0Jeky commented Sep 22, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Chris0Jeky commented Sep 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 22, 2026

Uh oh!

Chris0Jeky commented Sep 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 22, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Chris0Jeky commented Sep 21, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 21, 2026 •

edited

Loading