From 0edcbab22087d6d8851c4f7b66d1f565a10e1a89 Mon Sep 17 00:00:00 2001 From: wshallwshall Date: Mon, 10 Aug 2026 19:10:38 -0500 Subject: [PATCH] backlog: close the demand-gate triage -- #172 declined, #156 deferral confirmed The last two rows. With these, EVERY demand-gate item in the ledger has been ruled: nothing in that class is now waiting on a decision nobody has made. #172 DECLINED, and the distinction is the point: the CODEC shipped and what is declined is AUTO-EXTRACTION ON THE CONNECTOR. All six functions are exported from the top-level package, so a Handler compresses or extracts in one line and binary rides the store through the ADR 0028 carriage. The connector's gzip-only limit is defended at three layers, and they are deliberate -- a gzip is one stream, a zip is an ARCHIVE. Auto-extracting would put the ingest path in charge of deciding which member is the message, on a partner file this project treats as untrusted, with traversal entries and decompression bombs to adjudicate. Two details establish the split was DESIGNED and not merely unfinished, and both were checked rather than assumed: the decompress functions take a max_output_bytes BOMB CEILING, and zip_compress takes a mapping of NAME to bytes -- so an outbound zip needs an entry name only the feed author can choose. A connector could not supply either. Left open, this item invites someone to remove three guards to "finish" it, and what they would switch on is automatic extraction of partner archives at the front door. #156 deferral confirmed. Its trigger names an observation nobody can make yet -- operators reporting flapping the existing throttle does not damp -- which cannot fire from analysis, only from watching real alerts. Building a deadband now means choosing two threshold constants with no traffic to choose them from. A CORRECTION TO THE RECORD, made because the instrument was mine. I previously reported #156 as cited by ASVS cell 3.7.3. It is not: 3.7.3 is external-link interstitials and same-origin assertions. My cross-reference matched a bare "#156" inside that cell's text rather than a citation. Re-run against a "BACKLOG #N" token, ZERO cells cite #156 or #172. A pattern that matches digits is not a citation index -- the same blindness this ledger keeps finding in other people's greps, found in mine. Ledger: live 244, open 184, closed-in-live 60, archive 236, namespace 480 conserved. Status check run with --backlog against this tree, not the ambient one. --- docs/BACKLOG.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/BACKLOG.md b/docs/BACKLOG.md index ae204751..dc6207e1 100644 --- a/docs/BACKLOG.md +++ b/docs/BACKLOG.md @@ -2027,7 +2027,7 @@ lane; demand-gated on a first enterprise Windows/AD deployment. ## 156. Alert hysteresis (separate fire/clear thresholds) -> 🔢 **Re-scored 2026-08-03 → DEMAND-GATE.** Value **2/10** · Difficulty **3/10** · _fill-in_. Anti-flap refinement the shipped `realert_seconds` / per-rule `cooldown_seconds` throttle already damps (`messagefoundry/config/settings.py:2678`, `:2823`), with single-sided `min_depth`/`min_oldest_seconds` matching confirmed at `messagefoundry/pipeline/alert_sinks.py:617-623`; two new AlertRule fields plus clear-edge state in the sink, no store or migration. +> 🔢 **Re-scored 2026-08-03 → DEMAND-GATE.** Value **2/10** · Difficulty **3/10** · _fill-in_. Anti-flap refinement the shipped `realert_seconds` / per-rule `cooldown_seconds` throttle already damps (`messagefoundry/config/settings.py:2678`, `:2823`), with single-sided `min_depth`/`min_oldest_seconds` matching confirmed at `messagefoundry/pipeline/alert_sinks.py:617-623`; two new AlertRule fields plus clear-edge state in the sink, no store or migration. **Reviewed 2026-08-10 -- deferral stands, and this is the cleanest deferral in the set.** Its trigger names an observation nobody can make yet: *operators reporting flapping the flat realert/cooldown throttle does not damp*. That cannot fire from analysis, only from watching real alerts misbehave. The covering mechanism (`realert_seconds` + per-rule `cooldown_seconds`) is genuine rather than a fig leaf, and building a deadband now means choosing two threshold constants with no traffic to choose them from -- the shape of change that gets tuned once in anger and never revisited. > **On-trigger / demand-gate.** Numbered for tracking only — build when the trigger below fires (“demand-gate, don’t schedule”). @@ -2204,8 +2204,8 @@ lane; demand-gated on a first enterprise Windows/AD deployment. ## 172. Gzip/zip compression codec + file-connector option -> 🔢 **Re-scored 2026-08-03 → DEMAND-GATE.** Value **5/10** · Difficulty **3/10** · _fill-in_. File-feed parity breadth with a clean code-first workaround: the reusable codec shipped including `zip_compress`/`zip_decompress` (`messagefoundry/parsing/compression.py:40-48`), so a zip-delivering partner is served by a Handler call today. What remains is connector-level — widening `_SUPPORTED_COMPRESSION` (`messagefoundry/transports/file.py:88`), which forces an archive-member-to-message decision, plus REMOTEFILE, which has zero compression to extend. -> **On-trigger / demand-gate.** Numbered for tracking only — build when the trigger below fires (“demand-gate, don’t schedule”). +> ⛔ **DECLINED 2026-08-10 -- the remainder is a DECISION, not a gap. The codec SHIPPED; what is declined is auto-extraction on the CONNECTOR.** All six functions (`gzip_compress`/`_decompress`, `zip_compress`/`_decompress`, `deflate_*`) are exported from the TOP-LEVEL `messagefoundry` package, so a Handler compresses or extracts in one line, and binary rides the store via the ADR 0028 `mfb64:v1:` carriage. The connector's `gzip`-only restriction is defended at THREE layers -- the wiring `Literal['gzip'] | None`, `_SUPPORTED_COMPRESSION`, and a validator that raises on `'zip'` -- and those are deliberate: **a gzip is one stream, a zip is an ARCHIVE.** Auto-extracting would make the ingest path decide which member is the message, on a partner-supplied file this project treats as untrusted, with traversal entries and decompression bombs to adjudicate. Two details show the split was designed rather than unfinished: the decompress functions take a `max_output_bytes` BOMB CEILING, and `zip_compress` takes a mapping of NAME to bytes, so an outbound zip needs an entry name only the feed author can choose. **Carried open, this invites someone to remove three guards to 'finish' the item -- and what they would switch on is automatic extraction of partner archives at the front door.** +> **No longer demand-gated -- declined by design. Zip is a Handler job, deliberately.** > **AMENDED 2026-07-28 — the codec is BUILT; the connector covers gzip only.** Adversarial verification refuted a full close. **BUILT:** the pure three-algorithm compression codec (`messagefoundry/parsing/compression.py`, Handler-callable) and the File connector's gzip/gunzip option ([ADR 0123](adr/0123-compression-codec-gzip-zip-deflate-file-connector-compress-decompress-option.md)). >