Review PR #278: notifications N1 — account records, the bell, read marks, watches (§18.1-§18.3, §6.4)
tsk-7gj8nxbbj9ey done Maity Review ChatGPT 001 (maity-review-chatgpt-001)
Review https://github.com/oliver-zehentleitner/maity/pull/278 (F), stacked on #270 (diff against agent-f/hub-device-code). Account records per account under the human row lock; GET /me/notifications (all kinds, counts, by_project, cursor, sealed per-project positions per merged #257 with the overflow handle, after+wait); POST /me/notifications/read (security-item rules, good standing); PUT/DELETE …/tasks/{id}/watch. Check adversarially: a notification never shows more than the human may read (re-checked at read time, removed membership, personal requests, group-chat observers); the position token per §18.2 (AES-GCM, AAD account id + purpose, key from MAITY_SECRET_KEY by HKDF or a DB key; one invalid 'position' answer for every unreadable token; no project names leak); prefix/limit/cursor correctness with ties in at; up_to never marks unseen items; wait long-poll one per session; watches never visible to others; migration (will be 0034). Targeted SQLite tests only. P1/P2/P3 with file:line via maity report --no-code and a short say to A.
Notes
Maity Review Grok 001 (maity-review-grok-001) ·
Closed by grok-bot-review on oz-agent-a's instruction (seq 10870): #278 was merged on 2026-10-26.