Repository navigation
fix(setup): address private runtimes by full artifact digest - #654
Conversation
Allow same-version builds to coexist in digest-addressed runtime directories and pin setup or refresh to the exact artifact. Keep full digest verification, no-clobber publication, deterministic variant retention, and readable legacy version-only directories. Hold shared leases for cooperating managed processes and require exclusive leases through artifact revalidation and deletion. Preserve stable zero-byte lease sidecars and document lifecycle bounds, noncooperating legacy limits, and platform filesystem checks. Cover variant handling and managed-process lifetime behavior through real CLI regressions. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 43f4d1e0e5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
 [Medium impact] The reviewed changes appear safe to merge; no new blocking issue was found. SummaryPrivate runtimes now use paths containing the release and full executable digest. Client registrations pin the selected build, while shared lifetime leases protect running builds from pruning.
Diagram%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Private runtime setup] --> B[Hash executable bytes]
B --> C[Publish version-and-digest path]
C --> D[Pin selected client registrations]
D --> E[Managed process takes shared lease]
F[Applied prune] --> G{Exclusive lease available?}
G -->|No| H[Retain running artifact]
G -->|Yes| I[Recheck references, digest and directory]
I --> J[Remove artifact; retain stable sidecar]
Reviews (7) · Last reviewed commit: "test(storage): preserve immutable proven..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Infer the semantic release through the shared validated runtime namespace parser. Cover legacy and digest paths, invalid artifacts, exact doctor release matching, and a real configured-client invocation. Use the standard runtime/lease.rs module layout so compiler and architecture inventory agree without gate exceptions. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Combine the bounded cache inventory already validated on main with independent runtime identity, lifetime leases, and configured doctor verification. Preserve both coverage owner entries and architecture bounds. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Include bounded structured setup stdout, stderr and status when the portable native-runtime assertion fails, so Windows CI preserves the failing verification stage rather than only its generic category. No retry, timing or production behavior changes. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Use setup's existing HOME/USERPROFILE discovery when platform known-folder APIs are unavailable, preserving the canonical configured runtime root and all artifact/lease checks. Extend the native lifecycle test with a launch lacking HOME while retaining its isolated USERPROFILE and active-prune protection. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Combine the latest storage query-plan owners and bounds with the home-discovery fix. All33selected runtime/doctor/MCP tests and product all-target/all-feature Clippy passed on this combined tree. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Include the separately reviewed cache age oracle from main before collecting new native runtime evidence. This integration changes only the existing cache integration test. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3fad6e48cf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Recognize managed ownership only after a setup home is available; a standalone executable in a version-shaped directory can still use explicit paths. Keep strict root and digest validation for managed artifacts. Exercise USERPROFILE fallback only on Windows while retaining EOF and crash lease checks on all platforms. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ec4a2e557b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Use the parsed setup marker and canonical native artifact path to recognize the installation root without rediscovering HOME or data settings. Preserve configured-root recognition for unmarked launches and all release, digest, capability and post-lock checks. Verify both native lifecycle phases without installation data variables and cover marked/unmarked ownership and invalid identities. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Bring main through PR655 and PR658 into runtime identity work while preserving runtime ownership, lifecycle tests, safety bounds and documentation. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Bring main through PR659 into the runtime artifact work before final native-platform and coverage verification. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 885b756960
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Treat a missing executable path outside the managed runtime layout as requiring no lease. Keep potentially managed paths, including Linux deleted images, fail-closed and preserve other errors and successful symlink resolution. Verify portable path cases and the real CLI after unlinking a disposable copy before main. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
LLVM can report inline test helpers in an otherwise declaration-only production file. Reuse the existing syntax-validated declaration disposition instead of requiring a production budget for such reports. Keep rejection of newly executable production logic, unknown paths and all metric floors. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
Pin historical migration JSON to LF on checkout. CRLF conversion reproduced the exact failing Windows provenance digest; a CRLF-mode Git checkout now preserves all four JSON files byte-for-byte without changing fixture identities. Assisted-by: Suika (gensokyo-skills:suika-scatter-gather-planning)
1 participant
Summary
Private runtimes previously shared one directory per semantic version, so distinct builds could collide during setup or refresh. Artifacts now use the semantic version and full BLAKE3 digest; registrations pin the selected artifact. Complete digest verification, no-clobber publication, legacy directory compatibility and deterministic version/digest/path ordering are retained.
Cooperating managed processes hold shared lifetime leases. Prune and rollback hold an exclusive lease through root, reference, digest and capability checks and deletion. Stable zero-byte sidecars preserve lock identity across pruning and reinstall. Architecture documentation records scan/lookup bounds, persistent sidecar growth and executable-byte accounting. Older noncooperating binaries remain covered by the separate #548 work.
Setup-marked native launchers recognize the canonical installed artifact independently of HOME/data environment changes. Unmarked launches still require the configured runtime root. Missing standalone images can proceed without a lease, while potentially managed missing paths fail closed, including Linux deleted images. Exact release/digest and capability checks remain required before and after shared-lock acquisition. Configured doctor checks support both legacy and digest layouts.
Integration checks also exposed test-only helpers reported by LLVM in declaration-only owners and CRLF conversion of immutable migration provenance on Windows. Coverage assessment now honors its existing syntax-validated declaration policy; new production functions and unknown paths still fail. JSON fixtures are pinned to LF without changing fixture identities or any coverage floor.
Closes #547.
Validation