Repository navigation
fix: Separate active inheritance from upload witness - #1090
Merged
Merged
Conversation
Keep the sole active version as the configuration donor for reviewed main 084ba42, and track the newest upload only as a concurrency witness. Co-authored-by: Pigbibi <Pigbibi@users.noreply.github.com>
Pigbibi
marked this pull request as ready for review
November 8, 2026 15:19
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Pigbibi
added
the
agent-approved
Cursor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
AI assistance
Cursor Grok 4.7.
What changed
For reviewed main
084ba4281cfff3304cf226ce511a2fc0a6b67b08only, the publisher now treats the sole 100% active version as the configuration donor and the newest uploaded version as a separate concurrency witness. The witness does not have to equal the active version. It is never used as an inheritanceversion_idand is rejected if the upload id matches it.Missing, invalid, or oversized list evidence still stops before upload. After upload, and again immediately before deployment, the bounded newest-first list must be the new version followed by the same witness. Active-deployment identity, module bytes, migration tag, configuration hash, and post-activation readback are unchanged. Historical reviewed main
c1b737d6e721eb9fe71a12c613fbb49d3fa51563, integrated, IBKR, resume, and legacy paths still require their existing latest/active equality. Source, tree, and asset-map pins are unchanged. No orphan is activated.How verified
Before the repair, a synthetic stable orphan (
latest != active) failed closed in the existing publisher harness:stage=inherit_baseline,checkpoint=inherit_baseline_mismatch, HTTP 200,upload_attempted=false,deploy_attempted=false,uploaded_version=null,outcome=NOT_ATTEMPTED,retry=false.After the repair:
node tests/console_deploy_safety_validation.mjs— exit 0.console_deploy_safety_validation: PASS (manual-only; 16 original write gates; exclusive preflight/deploy/restore; 2 exact Binance gates; 52 offline reader cases; 178 source cases; 29 restore cases; 19 overlay cases; 2 config cases; 257 isolated release cases; 24 schema readback cases). The new cases run in that same file and cover latest==active, stable latest!=active with inheritance still pinned to the active id, malformed/empty/oversized witness lists, ambiguous active traffic, active drift before upload, lineage drift, final pre-deploy list drift, upload id equal to the witness, and the existing module, migration-tag, and post-readback configuration failures. Historical reviewed main still rejects latest!=active.python3 scripts/check_style.py --phase 2— exit 0, 0 blocking. One pre-existing README advisory remains.No baseline failure was reclassified as passing. No Deploy or Publish workflow was dispatched. No Cloudflare call, upload, activation, Secret change, or IAM change was made.
Why
Run 42488462313 reached
inherit_baseline_mismatchbefore upload. The script already pins every inherited binding to the active version, but it also required the newest upload id to equal that active version. A stable unactivated upload violates that equality without a concurrent writer. Equating the two concepts blocked the release; activating the unactivated upload was not a safe way to satisfy the check. Its configuration safety remains NOT_PROVEN.Risk
High: protected manual release workflow. This draft does not deploy. The active service is unchanged. There is still no compare-and-swap; a race after the final list read remains possible, and an unknown write result is not retried. This change does not prove that a later upload, configuration gate, or deployment will pass. RO-M07 HOLD is unchanged: no strategy-profile sync, Meridian activation, external flow, or trading change. Official exact-head review is still required before any release use.
Zero in this job: workflow dispatch, upload, activation, Secret change, IAM change, live read, live write, merge, label, and undraft.