Upgrade verbs: server-binary/extension/agents/skills — receipts, lock, abort paths, idempotence - #535
Conversation
… lock, JSONL receipts (#526)
…stall, version-sorted cleanup (#526)
…rite, --no-kick deferred (#526)
The panel passes doctor's record names verbatim (spec D3 — an alias map in the panel would be a fact doctor didn't say); the aliasing belongs CLI-side. agent-cards-global/-staging → agents, normalized in parseUpgradeArgs so downstream sees one vocabulary.
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
…n missing roots The server-binary verb unwrapped ctx.roots without filling defaults: on fixture paths the roots are injected; on the live CLI none were, so ctx.roots.rootRepoFork was undefined and the join crashed. Defaults are now deep-merged before use (the fix the live run surfaced).
|
Live dispatch — the honest record (parent-run, per docs/upgrade-live-dispatch.md): The full live chain ran on the mini, and the surface is now current, healthy, and verified — but the happy-path receipt this PR's proof clause asks for is not obtainable today, because the surface is no longer stale. The receipts tell the real story:
What's missing for the letter of the proof clause: an The review decision: (a) hold this PR until the next natural staleness event produces the upgraded receipt, or (b) accept the incident + no-op receipts as the live proof — arguably stronger evidence: the failure path is the one you can't fake. Tagging for a human call; CI is green-blocking regardless. |
|
Live dispatch proof: ACCEPTED (Aaron, 2026-08-23). The incident receipt (full chain executed live + the rollback machinery proven in a real launchd-race failure, #538) + the no-op/verified receipt satisfy the proof clause — the failure path is the stronger evidence. The happy-path 'upgraded' receipt lands in the receipts store naturally at the next fork merge; the watchdog will report it. |
1 participant
Closes #526.
The four upgrade chains as receipt-emitting idempotent runbooks (spec-20260823-094507 D2): pre-flight doctor gate (current→no-op, unknown→abort, stale/integrity-failure→proceed), git discipline (clean+ancestor, aborted-diverged; extension's clean-but-behind→ff-only), the full server-binary chain with opencode.prev rollback + sidecar rewrite on restore, flock-semantics lock (O_EXCL + dead-holder steal — macOS ships no flock(1)), append-only JSONL receipts, and the record-name alias (agent-cards-global→agents, CLI-side per spec D3).
Hermetic suites: 34 tests across the four verbs (idempotence stale→upgraded→no-op with enumerated digest sets; verification independence — doctor re-run vs receipt post records; abort paths; the restore path both ways). Typecheck clean; the 2 remaining failures are the proven pre-existing machine-state tests.
The live dispatch proof (review-blocking, per the issue's separability clause): the parent runs the real server-binary upgrade on the mini per docs/upgrade-live-dispatch.md and cites the appended JSONL receipt here. CI blocks hermetic only — as specced.
Part of #524.