Repository navigation
feat(env)!: make migration resumable and cleanup explicit (HACK-2191) - #797
Conversation
…able-env-migration # Conflicts: # docs/guides/upgrade-to-v5.md
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…able-env-migration # Conflicts: # docs/reference/v5-model-coverage.md
…able-env-migration
|
@codex review |
Codex Review Summary: ❌ FailedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b4c55b3e78
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Status for lead: HACK-2191 is pushed on Implemented: read-only versioned preview, journalled/resumable apply, completed no-op, separate snapshot/delivery/live-input-gated cleanup, and guarded rollback with retained-edit recovery paths. Doctor and implicit migration keep all legacy files. The latest fixes keep a known pre-unlink refusal retryable, choose one recovery path per cleanup error, and name an unsafe journal's location without its contents. Exact-head checks: 92 focused/integration regressions pass (1,044 assertions), including all 48 migration SIGKILL boundaries and the local-network JSON test. Rebuilt compiled-preview and model-verifier tests pass: 176 tests, 2,455 assertions. Root typecheck, lint (existing warnings), privacy and build pass. The updated model exhausts 37 states and its unsafe same-run deletion control fails the intended invariant with the registered witness. Still draft: #790 is open and its snapshot module is absent from |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
CI/review checkpoint at b4c55b3: the reported The persistent read-only review reports no new findings at this exact head, with R1–R3 fixed. Its dependency/verification limits remain open. Codex's P1 about the missing production snapshot provider is accepted and answered on its thread, and will remain unresolved until #790 is integrated with a typed static import and the source/compiled provider routes and compatibility/full gates pass. PR remains draft, not Ready for lead. |
|
Shard-6 follow-up: run 43534780799 finished 115 files with 113 passing. Fixed the test in 7341b2b to assert the same E_NATIVE_COMPOSE_STATE around acquisition plus preparation, keeping every no-material/no-generation/untouched-directory assertion. No product change, weakened error-code assertion or skipped case. Reproduced 7 pass/1 fail before; full cold-home plus env-preview tests now pass 10/10 (97 assertions), lint passes. Same persistent reviewer rechecking this test-only delta. The Docker fan-in failure was the intentional draft gate (PR_DRAFT=true; Docker shards out of scope/skipped), not a failed Docker scenario. No macOS shards requested. PR stays draft pending #790, typed static binding and source/compiled provider/compatibility/full gates. |
|
Tightened the cold-home test in 060119a after independent review: symlink and unsafe-directory cases again require acquisition to succeed and the private owner's prepare step to reject. Only the non-directory file case allows the new earlier journal-admission refusal. Error code and every no-write/no-generation assertion remain. Full file passes 8/8 (65 assertions); lint passes. Same persistent reviewer rechecking this test-only delta. The successful docs deployment needs no action; #790 production integration remains the draft blocker. |
|
Exact-head review checkpoint: persistent read-only review is clean for the test delta at current head 060119a; the requested stage-specific unsafe-home assertions are restored. Local full cold-home file passes 8/8, 65 assertions. The passing-check notification on 7341b2b is for the prior head and is not full-suite evidence for the current head. #790 remains open, so production typed-static snapshot integration, provider source/compiled CLI, doctor/tracked-consent compatibility and full gates remain open. Codex P1 remains acknowledged and unresolved. PR stays draft; not Ready for lead. No further changes from the deployment/check notification. |
…able-env-migration # Conflicts: # docs/reference/v5-model-coverage.md # scripts/lib/tla-runtime-models.ts # src/lib/project-env-config.ts
roodboi
changed the title
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
The breaking env migration change ships in next.18. List what changed and what to do under a next.18 heading, and point the older Doctor-based migration section at the new commands. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review New head |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Ready for lead: 66d1cf9 Takeover of this unit (the previous owner's session ended at about 16:35 UTC). No redesign. What is on top of your accepted
What I ran at this head (pinned Bun 1.4.4, temporary HOME/TMPDIR, daemon autostart disabled)
Not verified
Ships in next.18. Not merged, and I will not push to this branch again. |
|
You have reached your Codex usage limits. You can see your limits in the Codex usage dashboard. |
|
Addendum to the ready note at |
Conflicts: - src/commands/env.ts: keep this branch's aliased migration import and next's ProjectEnvKeyState (#848). - scripts/check-native-*-plan-cli.ts: keep this branch's HOME fingerprint and refusal-activity gates; the env plan script also keeps next's setup-unavailable detached refusal (#794). The shared refusal helper now forwards the private inputs to next's assertNativePlanHome check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
Ready for lead: 5cdbd3a This is a normal merge of Conflicts resolved
What I ran at this head (Linux, pinned Bun 1.4.4,
Not verified: hosted CI at this head was still running when I posted this; macOS, the real VM, and the full root suite are not run. The release notes keep this PR's migration notes under the next.18 heading. Not merged, and I will not push to this branch again. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5cdbd3ad1e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
|
Mac pass at 5cdbd3a (local build, two real checkouts with legacy env layouts): 🤖 Generated with Claude Code |
Build the fixture's failed, unregistered up record with the production activity writer so it carries exactly the schema's nine keys and no path. It passes with the current shared helper and with the stricter key-set check proposed in #835, so merge order does not matter. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Ready for lead: 969bf07 This replaces the note at
Not merged, and I will not push to this branch again. |
Env migration and Doctor's migration used the literal namespace "project" when the config has no name, so an unnamed legacy project could migrate without its stored secrets, or import another project's values from that namespace. Use the same effective name as the env commands that stored them: the configured name, else the checkout directory, as a slug. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Ready for lead: 06522fc This replaces the note at
What I ran at this head (Linux, pinned Bun 1.4.4,
Not verified: hosted CI at this head was still running when I posted this; macOS, the real VM and the full root suite are not run. Not merged, and I will not push to this branch again. |
|
You have reached your Codex usage limits. You can see your limits in the Codex usage dashboard. |
…migration `env migrate --json` (#797) is an envelope without `data.schema`; `usage --json --by-service` (#852) is a schema-tagged variant, so its schema id moves into MACHINE_SCHEMAS. Flag variants whose base command keeps another shape now get their own reference row instead of a hard-coded list. The outputs this branch migrates first shipped in 5.0.0-next.17, so the reference page no longer calls them unpublished and the next.18 release notes describe the change for scripts. BREAKING CHANGE: version, activity, projects --observe, global status --observe and global install|trust --plan JSON move into the {ok,data:{schema}} / {ok:false,error} envelope. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
**Update (Nov 15): breaking for next.17.** 5.0.0-next.17 shipped from a tree without this PR, so `version --json`, `activity --json`, `projects --json --observe`, `global status --json --observe` and `global install|trust --plan --json` are now published in their older shapes. This PR moves them into the envelope, so the title is marked `!` and the next.18 release notes describe the migration for scripts. The desktop core parser in this PR requires the new contract, so it cannot read a next.17 CLI's `version --json`. Since then the inventory also covers `env migrate --json` (#797, envelope without a schema id) and `usage --json --by-service` (#852, `hack.usage.by-service.v1`). The unpublished HACK-2218 JSON commands used incompatible top-level shapes. Version, observe-only projects/global status, and administrator install/trust plans now return `{ok:true,data:{schema,...}}`; Activity gains its missing `hack.activity.v1` schema. Failures return a stable `E_*` error envelope and nonzero status. Published plain `projects --json` keeps its existing shape. Refused and incomplete plans retain recovery evidence in `error.detail.plan`. Desktop core consumes the version envelope and provides a strict schema parser for the migrated contracts. Shared generated fixtures test both CLI and desktop boundaries. The new [Machine-readable output reference](docs/reference/machine-readable-output.md) inventories every canonical JSON command, distinguishes legacy/streaming shapes, and is checked against the command definitions. The native-env-plan acceptance harness allows the lifecycle activity audit file while retaining its no-registry/no-runtime-state checks.  Validation: focused CLI/contract, administrator-plan, activity, observation, generation and reference tests pass; root typecheck/check/privacy, documentation checks and CLI build pass; desktop core has 79 passing tests. Contract tests check the shared usage-error boundary for all 80 canonical JSON commands and actual success boundaries for migrated variants and prune. macOS administrator tests are skipped on Linux. No live engine/native provider or Mac application state-tool validation is claimed; the lead will verify real Mac state. Desktop schema parsing requires the new CLI contract; released CLIs do not yet provide it. HACK-2238. Based on `next`; no app tab branches or desktop appendix rows changed. --------- Co-authored-by: Kit <344842+roodboi@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Env migration can now be previewed, resumed after interruption and rolled back. Migration keeps every legacy input; cleanup requires a separate later command. HACK-2191, part of HACK-2188; planned after next.17.
hack env migrate --jsonis read-only. Its documented version-1 contract reports file actions, canonical paths, key names and tracked status.--applyuses the production snapshot library and a private per-file journal. Retry resumes unfinished publications; completed work is a no-op.status: recovery_required,composeRepair: unavailableand no file actions. Doctor reports and skips it; explicit apply still refuses. Current layers remain usable.--cleanup --applyrequires a successful full-project run, intact original snapshot, fresh value delivery, writer-locked receipts and the live-input guard before each deletion. Byte-identical permission tightening is allowed; changed content and wider access refuse.Verification covers preview/apply parity, sentinel privacy, 54 real SIGKILL boundaries, production source and compiled CLI, Doctor/tracked consent, historical v4 upgrades, backup damage, permission drift and round-trip rollback. The maintained model explores 74 states; same-run cleanup and stale-startup-proof controls fail their intended invariants. Build, typecheck, lint/privacy and docs checks pass at recorded checkpoints. Exact-head counts, CI, full-suite and review results are in the latest verification/readiness comment; no full-suite pass is implied here.
Normal merges include the snapshot library and next
23fe08f0. The same persistent Opus reviewer is active again. All findings are fixed or explicitly answered/resolved; exact-head settlement remains required.Hosted platform classification for changed tests: macOS-only
doctor-fix-noninteractive,env-migration-journal,env-migration-provider,env-migration-safety,env-migration-tracked-consent,env-set-local-contract,legacy-env-cleanup(alltests/*.test.ts).v4-upgraderuns in both pools. Preview CLI, missing-project errors and cold-home wiring run on Linux. No manual macOS workflow dispatch; automatic CI selects its tiers.Limits: cooperative locks and per-file publication do not cover unsynchronized writers or prove filesystem durability. No macOS/native runtime or cleanup SIGKILL qualification is claimed. The protocol and upgrade guide document storage custody, interruption residue, recovery and older-binary limits.