Skip to content

fix(recovery): persist direct download completion proof - #135

Merged
lamemustafa merged 6 commits into
masterfrom
tapish-codex/fix-successful-download-checkpoint-cleanup
Aug 5, 2026
Merged

fix(recovery): persist direct download completion proof#135
lamemustafa merged 6 commits into
masterfrom
tapish-codex/fix-successful-download-checkpoint-cleanup

Conversation

@lamemustafa

@lamemustafa lamemustafa commented Aug 5, 2026

Copy link
Copy Markdown
Owner

Summary

Make single-period GST return downloads durable across repeated downloads and extension reloads. This recovery lane now covers GSTR-3B PDF/JSON, GSTR-1 PDF/Excel, and GSTR-2B JSON without weakening exact download proof.

Root Cause / Decision Record

  • Terminal browser downloads could complete while their exact proof was rejected or lived only in session storage. The canonical summary then correctly retained the checkpoint, but later actions were unnecessarily blocked.
  • The fix carries only target-bound, non-empty exact browser-download evidence through the existing diagnostic contract. For page-generated single artifacts it reuses the existing strictly parsed local downloadAttempt contract, persists opaque intent before browser creation, persists the exact ID after creation, and removes it only after canonical completion.
  • This is the smallest safe fix: no browser-wide download scan, inferred filename match, portal data, new permission, or new storage schema is introduced. Full-year acquisition remains out of scope.

Scope

  • Runtime: exact target-bound PDF/JSON/Excel completion proof; GSTR-1 readiness-signal persistence; GSTR-2B JSON proof; reload-safe single-artifact correlation; explicit legacy proof-expired recovery UX.
  • Tests: direct capture, durable signal, target review, summary ordering, matching cleanup, and same-scope replacement regressions.
  • Docs/governance: no portal fact or public claim changed.
  • Explicitly out of scope: full-year flows, async download orchestration beyond target-bound recovery, portal selector changes, permissions, and public/store copy.

Pack Workflow Preflight

  • pnpm workflow:preflight was run before editing/push.
  • This PR was opened from a Pack branch, not master.
  • I checked current Pack AGENTS guidance.
  • PR body keeps the required Pack privacy/review/verification checklist visible.

Sanchika Adoption Gate

  • This PR does not consume @sanchika/* packages or copied Sanchika guidance.
  • This PR does not import ../sanchika, sanchika/packages/*/src, or parent source paths.

Privacy And Data-Flow Impact

  • No new browser permissions or host permissions.
  • No new network calls, analytics, telemetry, ads, or session replay.
  • No credential, OTP, CAPTCHA, cookie, token, GST file, or taxpayer-data capture.
  • Persisted recovery data is limited to opaque action ID, scoped selection, canonical timestamp, and exact browser download ID; no filename, path, URL, portal HTML, or taxpayer identifier.
  • Public copy and privacy declarations do not change.

Sensitive Surface Review

  • Current tab / portal target binding is preserved.
  • Download completion remains evidence-backed and fail-closed.
  • Ambiguous side-effect delivery cannot be reported as confirmed success.
  • Canonical completion persists before matching local/session checkpoint removal.
  • Real taxpayer data, local paths, raw URLs/referrers, and portal HTML are absent from the diff.

Chrome Web Store Impact

  • This PR does not expand beyond the existing Chrome Web Store V0 listing.
  • Full fiscal year remains source-build alpha and is not part of the Chrome Web Store V0 listing.
  • No store copy, README status, or privacy copy changed.
  • CI ZIP creation and provenance remain release evidence, not store-submission sign-off.
  • PR title uses Conventional Commits.

Verification

  • pnpm exec prettier --check .
  • pnpm exec eslint . --max-warnings 0
  • pnpm exec tsc --noEmit
  • Focused recovery regression suites passed locally (latest: 225 tests in 4 files).
  • pnpm exec vitest run passed in current-head Pack CI; local full suite remains blocked only by the missing pinned Chromium asset in two store-image tests.
  • pnpm exec wxt build
  • node scripts/verify-extension-package.mjs .output/chrome-mv3
  • git diff --check
  • Current-head Pack CI, review findings gate, CodeQL, title check, and GitGuardian passed.
  • Strict current-head Codex review is pending; required before readiness.

Artifact Evidence

  • CI run: current-head Pack CI Verify extension — passed.
  • ZIP artifact: generated and verified by Pack CI; this is not a release PR.
  • Clean head SHA: dc4349c987ed76832e15878716732312f65a1ed5.

PR Review Follow-Up

  • GitHub Actions completed successfully for the current head.
  • Current-head Codex/bot review comments inspected — awaiting review.
  • No inline review threads exist at this update.
  • No commits were pushed after the required current-head review.
  • Full-year acquisition is explicitly deferred to roadmap scope, not a follow-up hidden in this PR.
Thread/comment Disposition Commit or evidence
No current-head review yet accepted follow-up with named blocker Await chatgpt-codex-connector review for dc4349c

Screenshots

No visual redesign. Authenticated portal QA was completed separately; no live evidence is included.

DCO

  • Commits do not include Signed-off-by: trailers.

@lamemustafa
lamemustafa marked this pull request as ready for review August 5, 2026 13:02
@lamemustafa

Copy link
Copy Markdown
Owner Author

@codex review

@lamemustafa
lamemustafa merged commit 52c66d8 into master Aug 5, 2026
11 checks passed
@lamemustafa
lamemustafa deleted the tapish-codex/fix-successful-download-checkpoint-cleanup branch August 5, 2026 13:08

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dc4349c987

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +36 to +37
if (returnType === "GSTR-2B" && artifactType === "JSON") {
return endpointClass === "gstr2b-main-world-json-captured-download";

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Map GSTR-2B JSON retries to the new endpoint class

With this stricter compatibility branch, GSTR-2B JSON is only valid with gstr2b-main-world-json-captured-download, but the exact-ID retry path still rebuilds captured single-artifact diagnostics through withFiledReturnsDownloadDiagnostic(), whose GSTR-2B captured branch emits gstr2b-portal-blob-captured-download. If the worker stops after a standalone GSTR-2B JSON download ID is saved but before the summary persists, reconcileFiledReturnsTargetDownload() observes the completed ID and then persistCanonicalSinglePeriodCompletion() drops the reconstructed flow step as non-canonical, leaving the target in review instead of completing. Keep the runtime endpoint mapping in the same canonical rule as this predicate.

AGENTS.md reference: AGENTS.md:L41-L47

Useful? React with 👍 / 👎.

Comment on lines +527 to +528
if (!(await persistSingleArtifactRecoveryDownloadId(scope, downloadId, deps))) {
throw new Error("single-artifact download ID checkpoint failed");

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Persist the durable download ID before the session write can abort

If the storage.session write immediately above fails after chrome.downloads.download() returned an ID, this later durable write is never reached; downloadAcquiredArtifact() reports checkpoint-failed and the durable target review remains at the intent phase with no downloadId. After an extension reload or browser restart clears the session checkpoint, Pack can no longer reconcile the completed browser item even though the exact ID was available. Record the local target-review ID before depending on the session write outcome.

AGENTS.md reference: AGENTS.md:L117-L118

Useful? React with 👍 / 👎.

Comment on lines +235 to +238
flowStep: directCapturedArtifactFlowStep({
artifactType,
downloadId: delivery.downloadId,
requestId,

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Persist GSTR-3B direct download IDs durably

This GSTR-3B success path now reports completion from delivery.downloadId, but both GSTR-3B direct branches still save that ID only in storage.session and never create the storage.local target-review attempt used by the new single-artifact recovery path below. If the service worker stops after the browser download finishes but before the summary is persisted, an extension reload/browser restart clears the only checkpoint; the next start has no retained review or exact ID to reconcile and can repeat a completed GSTR-3B PDF/JSON download. Persist the same durable target-review intent and download ID for these direct branches before relying on the session checkpoint.

AGENTS.md reference: AGENTS.md:L117-L118

Useful? React with 👍 / 👎.

// download needs this exact-ID checkpoint for recovery.
const tracksBrowserDownload = !deps.stageCapturedDownloads;
if (tracksBrowserDownload) {
if (!(await persistSingleArtifactRecoveryIntent(scope, artifactType, requestId, deps))) {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Clear stale intents when acquisition never starts a download

Persisting this target-review intent before acquisition means failures that happen before any browser download is created (for example a GSTR-2B JSON fetch/preflight failure or a portal-blob scope mismatch) leave a durable download-intent-persisted review behind, while the finally path only clears the session checkpoint when retainCheckpointForRecovery is false. The next start then stops on that stale review and asks the user to cancel or manually review a download that Pack already determined did not need recovery. Clear the matching target review whenever the non-retained failure path clears the acquisition checkpoint.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant