Skip to content

feat(lifecycle): ship supervisor with CLI installations - #821

Open
roodboi wants to merge 117 commits into
nextfrom
feat/lifecycle-supervisor-packaging
Open

roodboi wants to merge 117 commits into
nextfrom
feat/lifecycle-supervisor-packaging

Conversation

@roodboi

@roodboi roodboi commented Nov 14, 2026 •

Copy link
Copy Markdown
Contributor

Ship the matching lifecycle supervisor beside the Compose-default CLI in stable archives, source installs, Homebrew, supported prerelease bundles and the slim image. Upgrade stages the companion before CLI publication and restores or removes it on rollback, with recorded hashes and identity checks. Rebuilding replaces the executable atomically so a running helper keeps its inode.

Depends on #802 and #811; this draft targets next and includes those unmerged prerequisites. The packaging-only diff is the 28-file slice above the opt-in branch. No lifecycle default change or release dispatch. Stable targets remain macOS arm64/x86_64 and Linux x86_64/arm64; existing prerelease support remains macOS arm64 only.

Supervisor ownership and recovery diagram

Validation before prerequisite updates: 102 focused Bun tests, 65 retained Python installer compatibility tests, Linux archive checksums and real normal/slim/local-bin installed-artifact checks, typecheck, lint, actionlint and privacy scan passed. No new Python runtime dependency is introduced. The final prerequisite merge preserves the packaging slice unchanged; exact-head CI/review are pending.

Not verified: completed full local suite (terminated without a summary), macOS runtime/signing, Linux arm64 and Docker image qualification. The existing compiler artifact checker requested unavailable sudo; no bypass was attempted, and its combined OS-isolation gate remains unqualified locally. Native macOS jobs are justified by executable signing/install behavior and the supervisor prerequisite's platform code. This draft is not ready to merge or publish.


Show it working
Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.

roodboi and others added 30 commits November 13, 2026 19:03
…or-opt-in

# Conflicts:
#	docs/reference/v5-model-coverage.md
#	scripts/lib/tla-runtime-models.ts
…or-opt-in

# Conflicts:
#	docs/lifecycle-supervisor.md
@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 9883fa0b18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 9883fa0b18

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

Ready for lead: 9883fa0

How it must merge: after #802 and then #811 land, merge next into this branch (normal merge), let CI rerun, and then merge. This head contains #811 at 88f8546, #802 at 60d737b and next at e47681e.

Since the last note: only normal, conflict-free merges of #811. They carry #802's round-5 supervisor changes (EINVAL, framed receipts with reason, 16 s stop-lock bound, receipt reread, threaded-leader liveness) and #811's fixes (add reply deadline, ETXTBSY retry, tmux socket-guard registration in both lifecycle scenarios). The packaging slice itself is unchanged; my reviewer confirmed it matches the reviewed b2f997f slice except where next interacts.

What I ran locally (Linux 6.8 x86_64): bun run build:release --skip-tests, then scripts/check-release-lifecycle-supervisor.ts (archive checksum; normal, slim and local-bin installs; exact bytes, modes, CLI/supervisor handshake, relocation, framed refusal) at 9883fa0. At the earlier propagation heads: 107 packaging and upgrade tests and 65 Python installer tests. Hosted, exact head: 32 pass, 1 skipped. computer pr review-status: CLEAR at 9883fa0.

Bot thread handled: a Codex P2 on os.rs:488 (numeric kill(-group) after the census can hit a reused process group). That is #802 code and a documented limit. The suggested per-member delivery would drop TERM for members forked after the census. I replied with that and resolved the thread. Decision for you: keep group delivery with the documented race, or switch to per-member identity-checked delivery and accept that late descendants only get the census-driven KILL. I recommend keeping it for this release and recording the trade-off on HACK-2215.

Review: the persistent Codex reviewer is CLEAN at this head. The Codex GitHub bot found no major issues and no security issues at this head.

Not verified: macOS release acceptance outside hosted CI; signing and notarization of the helper in a real release; Linux arm64 and Docker image qualification; an actual self-upgrade from a published release to one carrying the helper.

No further push to this branch after this note.

…isor

# Conflicts:
#	docs/reference/v5-model-coverage.md
#	scripts/lib/tla-runtime-models.ts
…or-opt-in

# Conflicts:
#	docs/reference/v5-model-coverage.md
@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

Ready for lead: 326268a

A conflict-free normal merge of #811 at 8ffd3c0 (which carries #802 eb47cc8 and next bf74aaf) into 9883fa0. Merge after #811.

What I ran (Linux 6.8 x86_64): tests/sync-spawn-bound.test.ts and tests/tla-runtime-models.test.ts (182 pass; scripts/check-release-lifecycle-supervisor.ts passes #857's lint); root typecheck; build, config compiler and all 8 check:native-plan-cli acceptance scripts; build:release --skip-tests plus scripts/check-release-lifecycle-supervisor.ts (checksum, normal/slim/local-bin installs, exact bytes, modes, handshake, relocation, framed refusal); 107 packaging and upgrade tests; 65 Python installer tests. computer pr review-status: CLEAR at 326268a.

Hosted CI: queued at note time (4 pass, 26 pending, 0 failed); I did not wait for the macOS jobs. The previous head 9883fa0 was 32/32 green.

Review: the persistent Codex reviewer is CLEAN at this head. The Codex GitHub bot was re-requested. The group-signal decision from my previous note (keep numeric group delivery with the documented race) is still open for you.

Not verified: unchanged from the previous note (macOS release acceptance outside CI, signing and notarization, Linux arm64 and Docker image, a real self-upgrade).

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: 326268af84

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 326268af84

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

roodboi and others added 6 commits November 15, 2026 06:38
…on a sibling

Every guard took a blocking flock on the shared lifecycle.log around each
record. A guard stopped (SIGSTOP, a debugger, a hung write) while holding
it stalled every sibling guard's loop in flock: no output, no exit
detection, no stop handling. Captured on macOS as the 9/100 failure of
expired_target_does_not_abandon_other_recovery (worker guard blocked in
Lines::flush -> flock while the frozen blocked guard held the lock).

Each record is now one write on the O_APPEND descriptor with no lock. The
kernel places each append atomically, so whole records from different
guards never interleave on a local file system; only a short write (for
example a full disk) can split one. The unused flock retry helper and its
unit test are removed.

Regressions: held_log_lock_never_stalls_a_guard holds the log flock from
outside for the whole run and requires output to reach the log and stop
to answer stopped within the normal bound (fails with the old lock);
concurrent_guards_append_whole_records_without_a_lock checks two guards
bursting 64 KiB records leave only whole, unmixed records. Docs state the
log's ordering and integrity and list every lock, who can hold it across
a blocking call, and the bound.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…hort-write causes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…or-opt-in

# Conflicts:
#	docs/versions/v5/getting-started.md
…sor lock table

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

Ready for lead: d9250a1

Merge after #811. This head is a conflict-free normal merge of #811 a9bc571 (which carries #802 b2b8d53 and next 345dc0d) into 326268a.

Generated files: regenerated, with no diff (CLI reference, machine-output reference, agent plugins). #821 adds no --json command. Its hidden --internal-lifecycle-supervisor-handshake argument is not a public machine-output command, and the contract test passes.

What I ran (Linux 6.8 x86_64):

  • Machine-output contract, sync-spawn-bound and tla-runtime-models tests: 269 pass, including the bounded-spawn lint over scripts/check-release-lifecycle-supervisor.ts.
  • Typecheck.
  • Build, config compiler and all 8 acceptance scripts.
  • build:release --skip-tests and scripts/check-release-lifecycle-supervisor.ts: pass.
  • 107 packaging and upgrade tests.
  • 65 Python installer tests.
  • computer pr review-status: CLEAR at d9250a1.

Hosted CI: 6 pass and 24 pending at note time; I did not wait for the macOS jobs.

Reviews: the persistent Codex reviewer is CLEAN at this head. I re-requested the Codex GitHub bot.

Still open for you: keep numeric group delivery with the documented race (my recommendation), or switch to per-member delivery.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: d9250a1e6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: d9250a1e6a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

…isor-opt-in

# Conflicts:
#	.github/workflows/lifecycle-supervisor.yml
#	docs/lifecycle-supervisor.md
#	docs/lifecycle.md
#	docs/reference/v5-model-coverage.md
#	packages/lifecycle-supervisor/Cargo.toml
#	packages/lifecycle-supervisor/README.md
#	packages/lifecycle-supervisor/src/main.rs
#	packages/lifecycle-supervisor/src/os.rs
#	packages/lifecycle-supervisor/src/protocol.rs
#	packages/lifecycle-supervisor/src/storage.rs
#	packages/lifecycle-supervisor/src/supervisor.rs
#	packages/lifecycle-supervisor/tests/fake_caller.rs
#	scripts/lib/tla-runtime-models.ts
@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

Ready for lead: 016946d

Merge after #811, then merge next here again (after #811 is squashed, the same squash resolution applies as on #811). This head is a conflict-free normal merge of #811 897cb3e (which carries next 34b5053: #802 squashed, #860, #818) into d9250a1.

Generated files: I regenerated the CLI reference, machine-output reference and agent plugins; none changed.

What I ran (Linux 6.8 x86_64):

  • Tests: tests/machine-output-contract.test.ts, tests/sync-spawn-bound.test.ts, tests/tla-runtime-models.test.ts and feat(update): report available updates read-only for any install kind (HACK-2218 R14) #860's tests/update-observe.test.ts: 283 pass.
  • Typecheck; build, config compiler and all 8 acceptance scripts.
  • build:release --skip-tests and scripts/check-release-lifecycle-supervisor.ts pass.
  • 107 packaging and upgrade tests; 65 Python installer tests.
  • computer pr review-status: Result: CLEAR at 016946d: no unresolv.

Hosted CI: at note time 3 pass 3 pending . I did not wait for the macOS jobs.

Review: the persistent Codex reviewer is CLEAN at this head. It checked #860 against #821: update observation reports version availability, not companion compatibility, and staged validation independently refuses a missing or mismatched companion before publication. I re-requested the Codex GitHub bot.

Still open for you: the group-signal decision (my recommendation: keep numeric group delivery with the documented race for this release). It is also listed in the follow-up PR.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 016946dcf5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 016946dcf5

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

…isor-packaging

# Conflicts:
#	src/lib/lifecycle-supervisor.ts
@roodboi

roodboi commented Nov 15, 2026

Copy link
Copy Markdown
Contributor Author

Ready for lead: f15b3f5

A normal merge of next at 081a526 (#811 squashed, #863, #808) into 016946d, the head you verified. No other change.

Squash resolution: one conflict, src/lib/lifecycle-supervisor.ts. git diff 897cb3e14 origin/next -- <file> is empty (next holds #811's last head there), so it resolves to #821's side.

Proof the tree is the verified one: diff <(git diff 897cb3e14 016946dcf) <(git diff origin/next f15b3f558), ignoring index lines, is empty. So git diff origin/next f15b3f558 contains exactly #821's own changes, 34 files with +820/−47, and nothing from #811, #863 or #808.

Checks: typecheck, and tests/machine-output-contract.test.ts, tests/sync-spawn-bound.test.ts and tests/tla-runtime-models.test.ts (269 pass). The persistent Codex reviewer is CLEAN on the merge commit. I did not wait for hosted jobs.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants