feat(drafts): add revision-approved scheduled starts and bounded multi-editor collaboration #44
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Scope and source
Priority: P1. Gap coverage: GAP-025, GAP-026. Derived from GAP_1791945837.md, reviewed code commit
f8dbe93df953a78b17cb3304b717dcf84c4cd517. Currente476a68da09645c2308cbf47b90211fcaffcb7afadds only the report, so implementation findings remain applicable. Report evidence is local reproduction/source inspection unless explicitly proposed; no production exploit or current live-readiness claim.Coverage and sequencing: gap backlog tracker. Workstream 09. Dependencies: 03, 04, 05, 07, 08.
Current codebase
Drafts/comments and proposer-only section amendments exist; opening requires a short-lived committee signature. No start-mode/date, durable worker, editor membership or reschedule/cancel actions exist. Existing skill forbids auto-open and permits proposer-only amendments, so scheduling and collaboration require explicit documented extensions, not an implicit bypass.
Why this implementation is needed
The requested experience needs feedback and collaborative edits until actual voting starts, plus a reliable future start time that preserves the feasibility approval gate.
Relevant files
frontend/src/pages/VoteNewPage.tsxfrontend/src/pages/VoteDetailPage.tsxfrontend/src/components/proposal/ProposalSectionFields.tsxfrontend/src/services/operatorVoting.tsfrontend/src/utils/votingPayload.tsoperator-voting/src/payload.rsoperator-voting/src/api.rsoperator-voting/src/db.rsledger/migrations/20260830000002_draft_lifecycle.sqldocs/GOVERNANCE_RESEARCH.mddocs/OPERATOR_VOTING.mddocs/FRONTEND.mdskills/AGENTS_DRAFT_REVIEW.mdRecommended solution
Use the conservative existing-policy interpretation: default as_soon_as_approved and custom scheduled UTC time at/after approval. Record the decision in doctrine/docs/skill; literal author-controlled opening stays out of scope. Sign full start intent/revision and persist durable committee approval while its signature is valid, instead of replaying an expired open request later. Any content/title/schedule/editor change increments revision and invalidates approval; continue editable drafts until actual opening. Add owner-controlled bounded chain/address editor membership with signed add/remove (and explicit invitation acceptance semantics), initially section-edit-only. Contributors cannot provide independent review; invitations cannot grant committee or owner powers. A DB-backed scheduler claims due work across replicas, revalidates roles/blacklist/revision/approval and fresh dual-chain state, then atomically freezes once. Add signed reschedule/cancel, finite future horizon, retry/delay states and reminder hooks; freeze at actual start, expose requested/actual UTC and local time, never backdate.
Constraints and guardrails
Preserve standalone offchain advisory voting, no new smart contracts or archive-node dependency, BSC as a core electorate, raw 18-decimal integer balances and separate Terra/BSC address identities. Keep Legal fail-closed transactional UI and the proven DEX Terra/Bridge EVM connectors; no browser BSC balance RPC, seed/key prompt or embedded admin/model credential. API must retain a restricted role separate from the ledger writer. Freeze at actual opening, never at draft creation or a client-supplied height. Agents own design, implementation, review and evidence under repository guidance; do not shift approvals/tests to the human or invent PASS evidence.
Acceptance criteria
Both start modes and shared editing work equally for Terra/BSC. Edits/revocation invalidate approval and are checked at commit; no changes succeed after actual open. Due proposals without valid current approval/fresh ledgers remain draft/delayed. Scheduler restart/duplicate delivery never double-opens. UI explains timezone, approval, reapproval and delayed actual freeze; preserves Legal gating.
Test plan: supported paths, failure paths and concurrency
Default/custom mode, future/past/invalid dates and DST/timezones; owner/editor/noneditor/revoked and both chains. Invite acceptance/removal/replay, simultaneous edits, scheduled edit/open race, reschedule/cancel and contributor-analysis independence. Due time before approval; approval revoked/blacklisted/rotated; one/both chains stale; two workers; crash before/after claim/freeze and missed-start recovery. Browser forms plus full signed DB lifecycle and migration tests.
Test plan: attack, hack and abuse vectors
Self-granted membership/committee, cross-proposal/chain editor signatures, revoked editor with old signed action, stale approved revision, replayed cancellation/reschedule, forged client clock/heights, scheduler claim floods and short-lived authorization misuse. Assert contributor aliases are not falsely claimed to prove distinct humans.
Verification and completion criteria
Attach recorded default/lock/delay/permission semantics, signed payload vectors, two-worker/restart evidence and Terra/BSC browser/API acceptance results. Dependencies 03/05/07/08 must be verified before enabling scheduled opening; update skill prohibition only for explicitly approved durable scheduling semantics.
Record commit and pinned toolchain, commands/results and sanitized artifacts. Relevant Rust changes require
cargo test --workspace --libplus isolated Postgres integration (explicit guarded LEDGER_TEST_DATABASE_URL); frontend changes requirenpm testand production build plus relevant browser cases. Run secret scanning for new fixtures/config. Exercise fresh/upgrade migrations when schema/grants change; report skipped/live-only checks explicitly.