fix: harden destructive cleanup and run finalization - #2
Merged
Conversation
Run the existing test suite and shell syntax checks on Ubuntu with Node 20 using immutable official action pins and read-only repository permissions. Add a dependency-free manifest validator and focused coverage for TOML parsing, version parity, local entrypoint containment, existence, and executable bits.
Update the active-run fixture to reference the real temporary repository now that preflight validates physical repository identity. This keeps the legacy fan-out refusal test exercising the repository-scoped live-manifest scan instead of failing during fixture identity resolution.
Route every detached harvest-worktree cleanup through one fail-closed verifier that binds repository, run, slot, canonical generation path, HEAD, registration, journal ownership, and recursive ignored inventory. Resolve the exact live manifest across workspace aliases under the repository lock and quarantine unresolved foreign legacy archives without blocking unrelated repositories.\n\nMake Abort propagate post-removal bookkeeping failures and require the exact completed archive, fsync one-use approval directories, replace the Python TOML validator with zero-dependency Node, document scripted cleanup, and add parity regressions across every removal and failure path.
This reverts commit 3e87e1e.
Make explicit plugin repository context authoritative and require every workspace-named legacy hint to match the exact live generation selected under the repository lock. Conflicting context now fails before Harvest, Status, or Abort can mutate either repository.\n\nDefer terminal slot archival while a detached harvest journal remains, retain exact cleanup approvals across Abort retries, and suppress approval objects for empty inventories. Add cross-repository zero-removal and ignored-harvest retry regressions, plus document the fail-closed and retry contracts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
18fcc7b2958ff6001831d7986ab8f2e3dfe7b7baSafety boundary
The controls provide cooperative same-user integrity, not an OS authorization boundary. A filesystem writer can still race after the immediate recheck enters an external Git/Herdr operation.