fix(recovery): harden journal conformance evidence

Author: amavashev

CHANGELOG.md

@@ -24,6 +24,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Retain durable settlement records for contradictory retryable 4xx envelopes,
   and report heartbeat transport failures with their same-key retry or stop
   disposition.
+- Quarantine unsupported or structurally invalid journal records without
+  aborting replay, keep serialization failures best-effort, and report exact
+  native test evidence to the shared conformance runner.
 
 ## [0.5.1] - 2026-07-27
 

runcycles/journal.py

@@ -131,7 +131,12 @@ def to_json(self) -> str:
     @classmethod
     def from_json(cls, raw: str) -> PendingCommitRecord:
         data = json.loads(raw)
-        reservation_id = data["reservation_id"]
+        if not isinstance(data, dict):
+            raise ValueError("journal record must be a JSON object")
+        version = data.get("version")
+        if not isinstance(version, int) or isinstance(version, bool) or version != _RECORD_VERSION:
+            raise ValueError(f"unsupported journal version: {version!r}")
+        reservation_id = data.get("reservation_id")
         mode = data.get("mode", "commit")
         if not isinstance(reservation_id, str) or not reservation_id:
             raise ValueError("journal record missing reservation_id")
@@ -141,15 +146,27 @@ def from_json(cls, raw: str) -> PendingCommitRecord:
             raise ValueError("commit-mode journal record missing commit_body")
         if mode == "event" and not isinstance(data.get("event_fallback_body"), dict):
             raise ValueError("event-mode journal record missing event_fallback_body")
+        for body_key in ("commit_body", "event_fallback_body"):
+            if data.get(body_key) is not None and not isinstance(data[body_key], dict):
+                raise ValueError(f"journal record has invalid {body_key}")
+        if "base_url" in data and not isinstance(data["base_url"], str):
+            raise ValueError("journal record has invalid base_url")
+        recorded_at_raw = data.get("recorded_at_ms", 0)
+        if not isinstance(recorded_at_raw, int) or isinstance(recorded_at_raw, bool) or recorded_at_raw < 0:
+            raise ValueError("journal record has invalid recorded_at_ms")
         not_before_raw = data.get("not_before_ms")
+        if not_before_raw is not None and (
+            not isinstance(not_before_raw, int) or isinstance(not_before_raw, bool) or not_before_raw < 0
+        ):
+            raise ValueError("journal record has invalid not_before_ms")
         return cls(
             reservation_id=reservation_id,
             base_url=data.get("base_url", ""),
             mode=mode,
             commit_body=data.get("commit_body"),
             event_fallback_body=data.get("event_fallback_body"),
-            recorded_at_ms=int(data.get("recorded_at_ms", 0)),
-            not_before_ms=int(not_before_raw) if not_before_raw is not None else None,
+            recorded_at_ms=recorded_at_raw,
+            not_before_ms=not_before_raw,
         )
 
 
@@ -186,14 +203,14 @@ def record(self, entry: PendingCommitRecord) -> None:
                 tmp.write_text(entry.to_json(), encoding="utf-8")
                 _restrict_permissions(tmp, 0o600)
                 tmp.replace(target)
-            except OSError:
+            except Exception:
                 try:
                     tmp.unlink(missing_ok=True)
                 except OSError:
                     pass
                 raise
             logger.debug("Journaled pending commit: id=%s, path=%s", entry.reservation_id, target)
-        except OSError:
+        except Exception:
             logger.warning(
                 "Failed to journal pending commit (continuing without durability): id=%s",
                 entry.reservation_id,
@@ -260,9 +277,7 @@ def load_pending(self, base_url: str) -> list[PendingCommitRecord]:
                                 standard_path,
                             )
                         else:
-                            existing = PendingCommitRecord.from_json(
-                                standard_path.read_text(encoding="utf-8")
-                            )
+                            existing = PendingCommitRecord.from_json(standard_path.read_text(encoding="utf-8"))
                             if existing.reservation_id == entry.reservation_id:
                                 path.unlink(missing_ok=True)
                                 duplicate_of_standard = True

scripts/recovery_conformance_adapter.py

@@ -10,73 +10,45 @@
 
 ROOT = Path(__file__).resolve().parents[1]
 
-OBSERVATIONS = {
-    "CR-CORE-001": (["commit", "commit_same_key"], [
-        "settlement_occurs_at_most_once", "retry_uses_original_idempotency_key"]),
-    "CR-CORE-002": (["commit", "event_same_key"], [
-        "event_carries_original_subject_action_actual", "settlement_occurs_at_most_once"]),
-    "CR-CORE-003": (["extend", "extend_same_key", "commit"], [
-        "heartbeat_failure_reports_reservation_and_disposition",
-        "guarded_action_continues_under_warn_policy", "final_settlement_is_attempted"]),
-    "CR-CORE-004": (["commit", "commit_same_key"], [
-        "only_schema_valid_expected_status_is_terminal_success",
-        "ambiguous_success_retains_original_idempotency_key"]),
-    "CR-DURABLE-001": (["commit", "commit_same_key_after_restart"], [
-        "journal_write_precedes_first_settlement_request",
-        "unresolved_record_survives_restart", "successful_replay_removes_record",
-        "settlement_occurs_at_most_once"]),
-    "CR-DURABLE-002": (["commit_same_key_after_restart", "event_same_key_after_restart"], [
-        "event_mode_is_persisted_before_event_attempt", "successful_event_removes_record",
-        "settlement_occurs_at_most_once"]),
-    "CR-DURABLE-003": (["commit", "commit_same_key_after_retry_after"], [
-        "no_retry_before_persisted_not_before", "successful_replay_removes_record"]),
-    "CR-DURABLE-004": (["commit_same_key_after_restart"], [
-        "new_tenant_credential_finds_record", "old_api_key_is_not_stored"]),
-    "CR-DURABLE-005": ([], [
-        "corrupt_record_is_quarantined", "other_valid_records_still_replay",
-        "corruption_is_reported"]),
-    "CR-DURABLE-006": (["concurrent_commit_same_key"], [
-        "settlement_occurs_at_most_once", "terminal_record_is_removed"]),
-    "CR-DURABLE-007": ([
-        "commit_first_identifier", "commit_second_identifier",
-        "commit_first_identifier_same_key_after_restart",
-        "commit_second_identifier_same_key_after_restart",
-    ], [
-        "standard_filename_is_sha256_of_exact_utf8_identifier",
-        "distinct_identifiers_never_share_a_journal_file",
-        "matching_legacy_record_migrates_without_deleting_collision",
-        "both_settlements_occur_at_most_once",
-    ]),
-    "CR-BOUNDARY-001": ([], [
-        "sdk_does_not_claim_ledger_convergence", "application_checkpoint_is_required"]),
-}
-
 TESTS = {
-    "CR-CORE-001": "tests/test_retry.py::TestCommitRetryEngine::test_retries_until_success",
-    "CR-CORE-002": "tests/test_journal.py::TestLifecycleEventFallbackWiring::test_expired_commit_schedules_event",
-    "CR-CORE-003": "tests/test_lifecycle.py::TestSyncLifecycleExecution::test_heartbeat_exception_does_not_crash",
+    "CR-CORE-001": ("tests/test_retry.py::TestCommitRetryEngine::test_retries_until_success",),
+    "CR-CORE-002": ("tests/test_journal.py::TestLifecycleEventFallbackWiring::test_expired_commit_schedules_event",),
+    "CR-CORE-003": ("tests/test_lifecycle.py::TestSyncLifecycleExecution::test_heartbeat_exception_does_not_crash",),
     "CR-CORE-004": (
         "tests/test_journal.py::TestLifecycleEventFallbackWiring::"
-        "test_protocol_invalid_2xx_is_ambiguous_and_keeps_same_key"
+        "test_protocol_invalid_2xx_is_ambiguous_and_keeps_same_key",
     ),
     "CR-DURABLE-001": (
         "tests/test_journal.py::TestLifecycleEventFallbackWiring::"
-        "test_journal_write_precedes_first_commit_and_success_discards"
+        "test_journal_write_precedes_first_commit_and_success_discards",
+        "tests/test_journal.py::TestSyncReplay::test_replays_pending_commit_on_set_client",
+        "tests/test_retry.py::TestCommitRetryEngine::test_retries_until_success",
     ),
     "CR-DURABLE-002": (
-        "tests/test_journal.py::TestSyncEngineDurability::"
-        "test_expired_then_event_transient_continues_in_event_mode"
+        "tests/test_journal.py::TestSyncEngineDurability::test_expired_then_event_transient_continues_in_event_mode",
+        "tests/test_journal.py::TestSyncReplay::test_replays_event_mode_entry",
+    ),
+    "CR-DURABLE-003": (
+        "tests/test_journal.py::TestRateLimitedRetry::test_429_commit_is_transient_and_honors_retry_after",
+        "tests/test_journal.py::TestRateLimitedRetry::test_replay_restores_future_retry_after_floor",
+        "tests/test_journal.py::TestRateLimitedRetry::test_429_then_success_discards_journal",
     ),
-    "CR-DURABLE-003": "tests/test_journal.py::TestRateLimitedRetry::test_replay_restores_future_retry_after_floor",
     "CR-DURABLE-004": (
-        "tests/test_journal.py::TestAuthFailureRetention::test_replay_survives_api_key_rotation_with_tenant"
+        "tests/test_journal.py::TestAuthFailureRetention::test_replay_survives_api_key_rotation_with_tenant",
+    ),
+    "CR-DURABLE-005": (
+        "tests/test_journal.py::TestCommitJournal::"
+        "test_corrupt_and_unsupported_records_are_quarantined_without_blocking_valid",
+    ),
+    "CR-DURABLE-006": (
+        "tests/test_journal.py::TestSyncReplay::test_concurrent_replay_workers_reuse_one_key_and_remove_record",
     ),
-    "CR-DURABLE-005": "tests/test_journal.py::TestCommitJournal::test_corrupt_file_renamed_and_skipped",
-    "CR-DURABLE-006": "tests/test_journal.py::TestSyncReplay::test_replay_happens_once_per_directory",
     "CR-DURABLE-007": (
-        "tests/test_journal.py::TestCommitJournal::test_colliding_legacy_ids_are_distinct_and_migrate_safely"
+        "tests/test_journal.py::TestCommitJournal::test_colliding_legacy_ids_are_distinct_and_migrate_safely",
+    ),
+    "CR-BOUNDARY-001": (
+        "tests/test_lifecycle.py::TestSyncLifecycleExecution::test_missing_actual_surfaces_without_settlement",
     ),
-    "CR-BOUNDARY-001": "tests/test_lifecycle.py::TestEvaluateActual::test_no_fallback_raises",
 }
 
 
@@ -94,7 +66,7 @@ def main() -> int:
         return 2
 
     completed = subprocess.run(
-        [sys.executable, "-m", "pytest", "-q", TESTS[scenario_id]],
+        [sys.executable, "-m", "pytest", "-q", *TESTS[scenario_id]],
         cwd=ROOT,
         text=True,
         capture_output=True,
@@ -104,14 +76,15 @@ def main() -> int:
         print(completed.stdout, file=sys.stderr, end="")
     if completed.stderr:
         print(completed.stderr, file=sys.stderr, end="")
-    requests, assertions = OBSERVATIONS[scenario_id]
-    json.dump({
-        "scenario_id": scenario_id,
-        "passed": completed.returncode == 0,
-        "observed_requests": requests,
-        "assertions": assertions,
-        "diagnostic": f"native pytest exit code {completed.returncode}",
-    }, sys.stdout)
+    json.dump(
+        {
+            "scenario_id": scenario_id,
+            "passed": completed.returncode == 0,
+            "native_tests": list(TESTS[scenario_id]),
+            "diagnostic": f"native pytest exit code {completed.returncode}",
+        },
+        sys.stdout,
+    )
     return 0