chore: rolling promotion dev -> main - #2702
Closed
namastex888 wants to merge 22 commits into
Closed
namastex888 wants to merge 22 commits into
namastex888 wants to merge 22 commits into
Conversation
…table shipped v5.260727.5 (run 30240023804, dispatched 2026-07-27): 40/41 jobs green (1 structural skip), 36 assets, immutable, latest/homolog/dev manifests all advanced to 5.260727.5. The two open criteria are demonstrated: production approval ran live with dispatcher != approver (prevent_self_review), and channel manifests published reviewer-free via the genie-release-bot App across v5.260726.12→v5.260727.5.
docs(wish): stable-release-security-gate DONE — first full-pipeline stable shipped
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe release gate is marked complete and all Genie manifests are synchronized to ChangesRelease, policy, and worktree hardening
Estimated code review effort: 4 (Complex) | ~60 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4d23459198
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…n of PR #2594 Adapt, not adopt: keep the two-mode concurrency contract and add the git-state freeze (shared-workspace subagents never checkout/switch/ reset/stash/rebase; only the orchestrator moves HEAD) — the invariant the recorded incident actually violated. Doctor grows a worktrees residue check with fail-closed --fix (no new commands); reviews get read-only snapshot worktrees pinned to the reviewed commit. Flip conditions recorded so the policy self-revises on evidence. Declines the unconditional mandate and defers the integration-worktree protocol behind a recorded trigger. Credits lirazsiri (isolation diagnosis, reviewer-snapshot design, GC design); #2594 closes in favor on landing. Council: 4 lenses, 2 rounds, consensus + dissent recorded 2026-07-27.
Applies the FIX-FIRST verdict from the independent plan review: H1 Simplicity Case section; H2 premise rewritten from live probe evidence (native worktree isolation EXISTS in the harness — verified by a dispatched probe agent: real linked worktree, persistent when changed, named branches, shared object store — but is not /work-ready: guard false positives, untracked nested placement, unverified in-place task-state access; flip condition (i) sharpened to those three gaps); H3 review-snapshot gets a real code surface (src/lib/review-snapshot.ts) plus the freeze carve-out for snapshot plumbing; H4 red validation gate replaced; H5 parity check added to validations (bun run check never enforced mirrors); H6 plugins/genie/references/dispatch-contract.md rule 3 in scope; H7 doctor work isolated in doctor-worktrees.ts with complexity-ceiling constraint; M1-M7 + L1 (genie.ts flag text, greppable canonical phrase, Wave-2 dependency narrowed to policy, enumeration via git worktree list --porcelain, integration-branch resolution rule, post-merge closure checklist, test naming).
H8: probe gap (b) was cross-repo contamination — the probe ran in the workspace repo; the genie repo ignores .claude/worktrees/ (since 225a56d). Deleted from Decision 1 and flip condition (i). H9: gap (c) closed by design evidence — genie-db.ts resolves the DB via git-common-dir so all linked worktrees share one genie.db (production precedent: launch panes). Flip condition (i) collapses to the one real gap: isolation-guard ergonomics. M8 (deliberate): review-snapshot goes prose-only — a helper whose only caller is its own test is the #2594 decoration pattern this wish condemns; the raw commands are natively fail-safe (worktree add --detach touches no branch; worktree remove refuses dirty). Doctor stays the janitor for crashed reviews. Immutability check moved to QA. M9 QA scoped to CI (macOS ui-bridge failure named as non-gate). M10 carve-out single-owned by policy. M11 grep -eq 4 with ':!.genie'. M12 config tier dropped (no such surface exists; present-need gate).
…+ 4 advisory residuals Final verdict SHIP after 2 fix loops. Residuals applied: issue text for the native-isolation pilot names the single remaining gap (guard ergonomics); the snapshot-immutability success criterion is owned by manual QA (prose-only group by design); Simplicity Case wording matches the helper drop; Wave 2 re-rated 3/opus-high -> 1/opus-low (docs edit — was a live mis-dispatch per the reviewer).
…ardening docs(wish): worktree-isolation-hardening — APPROVED plan (adapts #2594)
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.genie/wishes/worktree-isolation-hardening/WISH.md:
- Around line 60-62: The worktree cleanup requirements must distinguish detached
review snapshots from launch worktrees: define a snapshot-specific safety proof
allowing clean snapshots at the reviewed commit to be removed even when
unmerged, while retaining unmerged launch worktrees. Update the related doctor
--fix behavior and regression tests to verify clean unmerged snapshots are
removable and clean unmerged launch worktrees are refused.
- Around line 141-143: The snapshot naming contract in the review dispatch
documentation must avoid collisions for concurrent reviews of the same commit.
Update the documented worktree path to include a unique per-dispatch identifier
or define explicit lease/reference-counting behavior, and update teardown
accordingly; ensure the contract includes coverage for concurrent same-commit
reviews.
- Around line 118-124: The doctor --fix cleanup flow must be failure-safe across
worktree and branch deletion. In the relevant doctor cleanup implementation, add
preflight validation for both removals, then handle branch-deletion failure
after successful worktree removal with rollback or explicit partial-state
recovery and a clear refusal reason; preserve the rule that any git error
prevents claiming successful reclamation. Add a regression test covering branch
deletion failure after worktree removal.
- Around line 116-119: The worktree cleanup flow must require positive Genie
ownership proof before deleting entries, rather than relying only on paths or
branch naming. Update the worktree enumeration/classification and doctor --fix
removal logic around resolveWorktreesBase and the existing launch worktree
metadata to verify durable provenance, retain entries without valid proof as
foreign, and add coverage for a matching non-Genie worktree that is not removed.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: b67d1f36-bde6-431a-b67a-fd79d5bb9b6c
📒 Files selected for processing (1)
.genie/wishes/worktree-isolation-hardening/WISH.md
…conditions Group 'policy' of wish worktree-isolation-hardening. Keeps the two-mode contract (disjoint file ownership OR dedicated worktrees), adds the freeze: shared-workspace subagents never run checkout/switch/reset/ stash/rebase — only the orchestrator moves HEAD; repo-level mutation gets a worktree via genie launch or gets sequenced. Snapshot carve-out (worktree add/remove/prune = orchestrator plumbing) at all canonical sites. Flip conditions (i)-(iv) recorded in AGENTS.md with links to investigate issues #2705 (mechanical freeze enforcement) and #2706 (native isolation:worktree pilot — one gap left: guard ergonomics). Canonical phrase single-sourced to exactly 4 sites; paraphrase sites (dream, native-surfaces x2, genie-hacks catalog, codex-integration-map) now point instead of restating. Work-skill briefs gain a File-scope item + freeze stanza. Review: SHIP (1 MEDIUM folded in: plugin native-surfaces pointer). Co-authored-by: Liraz Siri <liraz@liraz.org>
Group 'doctor-residue' of wish worktree-isolation-hardening. genie
doctor now enumerates launch-created worktrees via git worktree list
--porcelain (identity = wish/<slug>-<group> branch AND path under the
exported resolveWorktreesBase), classifies merged+clean / unmerged /
dirty / foreign, and reports per-entry disposition + reclaimable size.
doctor --fix removes only merged+clean entries: ancestry proof AND
clean tree chained in code, branch deleted with the worktree,
idempotent, any git error refuses that entry with the reason.
Integration branch: local dev, else remote default, else refuse all.
Review found (and reproduced) a HIGH before landing: bare refnames in
the ancestry probe let a colliding tag shadow the branch and authorize
deleting unmerged work. Both probe sides now use fully-qualified refs
({name, ref} split typed so display and probe forms cannot mix), with
branch-side and integration-side tag-shadow regression tests proving
refusal. New logic lives in doctor-worktrees.ts (doctorCommand delta
minimal; complexity 41/42). 617 tests green in src/genie-commands/.
Co-authored-by: Liraz Siri <liraz@liraz.org>
…rator-torn-down Group 'review-snapshot' of wish worktree-isolation-hardening. The review skill's Dispatch section now carries the snapshot contract: provision git worktree add --detach at the exact commit under review, reviewer works read-only and the verdict cites the pinned commit, teardown via git worktree remove after the verdict. Pin by default while other groups still write in the primary checkout; uncommitted trees cannot be pinned. Prose-only by design — the commands are natively fail-safe (add --detach touches no branch; remove refuses a dirty tree). Review caught a false claim before landing: doctor does NOT janitor crashed snapshots (detached worktrees classify as foreign, never touched by --fix) — the prose now states the confirmed reality and instructs explicit removal for crash leftovers; the wish's risk row records the same. Mirror in parity; canonical-phrase grep gate held at 4. Co-authored-by: Liraz Siri <liraz@liraz.org>
Ticks the five tree-verified success criteria (criterion 6, #2594 closure, stays open for post-merge), fixes the final-gate LOW (the deliverable text still carried the disproven doctor-janitor claim the fix loop corrected everywhere else), and records the execution trail in the status header.
…ardening feat: worktree isolation hardening — git-state freeze, doctor residue GC, reviewer snapshots
…ispositioned with credit
…ardening docs(wish): worktree-isolation-hardening criterion 6 closed — #2594 dispositioned
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@plugins/genie/skills/dream/SKILL.md`:
- Line 49: Update Dream’s worker-isolation instruction in SKILL.md so it matches
the actual native delegation behavior and the shared-workspace contract: either
ensure worktrees are provisioned before dispatching workers, or remove the
mandatory dedicated branch/worktree requirement and explicitly require disjoint
file ownership with Git-state freezing. Keep the guidance consistent with the
contract defined in AGENTS.md and the work skill’s Dispatch section.
In `@src/genie-commands/doctor-worktrees.test.ts`:
- Around line 372-396: Update the runDoctor helper to capture process.exitCode
before its finally block restores the prior value, and return or otherwise
expose that captured code alongside the output. In the wiring tests that
exercise launch-worktree residue, assert the captured exit code is 0 alongside
the existing detail assertions, preserving the helper’s restoration behavior.
In `@src/genie-commands/doctor-worktrees.ts`:
- Around line 402-411: Update removeLaunchWorktree and its
cleanupLaunchWorktrees caller to re-verify the worktree branch’s ancestry
immediately before branch deletion, using the scanned IntegrationBranch.ref or a
re-resolved equivalent and the same fully qualified --is-ancestor probe. If the
probe fails or is inconclusive, retain the branch and return the existing
keep-branch error instead of running branch -D.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: ace78630-7f51-4e57-9804-4f9d51341dec
⛔ Files ignored due to path filters (1)
AGENTS.mdis excluded by!*.md
📒 Files selected for processing (25)
.claude-plugin/marketplace.json.genie/wishes/worktree-isolation-hardening/WISH.mdpackage.jsonplugins/genie/.claude-plugin/plugin.jsonplugins/genie/.codex-plugin/plugin.jsonplugins/genie/package.jsonplugins/genie/references/codex-integration-map.mdplugins/genie/references/dispatch-contract.mdplugins/genie/references/native-surfaces.mdplugins/genie/skills/dream/SKILL.mdplugins/genie/skills/genie-hacks/references/catalog.mdplugins/genie/skills/review/SKILL.mdplugins/genie/skills/work/SKILL.mdplugins/genie/skills/work/references/native-surfaces.mdplugins/hermes-genie/plugin.yamlskills/dream/SKILL.mdskills/genie-hacks/references/catalog.mdskills/review/SKILL.mdskills/work/SKILL.mdskills/work/references/native-surfaces.mdsrc/genie-commands/doctor-worktrees.test.tssrc/genie-commands/doctor-worktrees.tssrc/genie-commands/doctor.tssrc/genie.tssrc/term-commands/launch.ts
…onstration Codex P2 on PR #2702 caught the closure commit leaving the wish internally contradictory: the G2 acceptance criterion, the QA criterion, two Review Results closure sentences, and INDEX's pr-2545 line still said no live two-maintainer run had been captured / stable promotion remained BLOCKED. All five sites now record the evidence: stable run 30240023804 (v5.260727.5) — automagik-genie dispatched, independent maintainer approved (prevent_self_review), 36 immutable assets, all three manifests advanced; credential half landed as the genie-release-bot App (#2643/#2644).
…econcile docs(wish): reconcile stable-gate record with the live demonstration (Codex P2 on #2702)
…t code CodeRabbit on the #2702 promotion caught the residual TOCTOU the group review had classed acceptable: the ancestry proof authorizing the forced branch delete ran only at scan time, so a commit landing on a launch branch between cleanup's scan and 'branch -D' would be orphaned (the tree stays clean, so 'worktree remove' cannot object). removeLaunchWorktree now re-runs the fully-qualified is-ancestor probe immediately before removal and refuses on any non-zero result; once the worktree is removed the branch can gain no commits (git refuses a second same-branch checkout), so the re-proof closes the whole window. cleanup re-resolves the integration branch fail-closed and the fn is exported for a direct-layer regression test (the outer API re-scans on entry, making the inner window unreachable from public-API tests — proven while writing the test). Also (CodeRabbit trivial): the doctor wiring tests now capture and assert process.exitCode === 0, locking in that launch-worktree residue is warn-only. 618 tests green in src/genie-commands/.
fix(doctor): re-prove ancestry at removal time (CodeRabbit Major on #2702)
Contributor
|
Closing and recreating this promotion authored by automagik-genie, so the maintainer can act as the independent approver instead of authoring their own promotion (same identity split the release process already uses everywhere else). All four bot findings were dispositioned before the swap: the Codex P2 record contradiction is fixed on dev (#2709 — the stable-gate wish now records the live run 30240023804 at all five previously-contradicting sites); CodeRabbit's TOCTOU Major and exit-code Trivial are fixed on dev (#2710 — ancestry re-proof at removal time + warn-only exit-code assertions); the provenance Major is dispositioned as accepted-risk with recorded mitigations (merged+clean proofs bound the blast radius to a re-creatable checkout; gitignored-content loss is disclosed in output; --fix is operator-invoked) and flagged as future hardening alongside #2706. The replacement PR therefore carries strictly more than this one. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolling Promotion PR
Auto-maintained rolling promotion PR from
devtomain.Process:
ready-to-mergeadded when all checks passSummary by CodeRabbit
--fixcleanup for accumulatedgenie launchworktrees.doctor-worktreesbehavior and--fixsafety guarantees.