Add Pandora Promotion Executor v1 (gated, dry-run-first, reversible) — REQUIRES HUMAN REVIEW

[besfeng23]

Checklist

• Does this PR add or modify env vars? — Yes: PANDORA_ENABLE_CONTEXT_PACK_PROMOTION (runtime flag).
• If yes, were they added to Env Broker catalog? — Yes: cataloged in env-discovery-service with safe default false; optional, never a required provider env. env:policy passes (90 keys).
• Are secrets server-only? — No secrets involved; no service-role usage anywhere in the new code (guard-tested).
• Are NEXT_PUBLIC values public-safe only? — No NEXT_PUBLIC changes.

What

The final, gated stage of the shadow-pack promotion chain: lab → preflight → request board → executor. Turns a human-approved promotion request into an actual master context-pack swap — and nothing else.

This PR must not be merged by its author. Per docs/pandora-shadow-context-pack-lab.md, the promotion path requires a separate PR (this one), explicit human review, migration/policy review, dry-run proof, and production approval. The migration is intentionally not applied; nothing can execute until review + merge + migration + dry-run + gate enablement.

Double gate

Execution refuses unless ALL hold:

1. PANDORA_ENABLE_CONTEXT_PACK_PROMOTION=true (defaults false),
2. the promotion request is approved with reviewer_decision=approved,
3. a fresh plan recomputation against live preflight/shadow/master state has zero blockers — including active master unchanged since approval (if the master moved, execution demands a new preflight + approval cycle),
4. explicit confirmation phrase "PROMOTE" ("ROLLBACK" for rollback).

What execution does (status-only, reversible)

1. Insert new memory_context_packs master (status=active) from the reviewed shadow candidate payload.
2. Archive (never delete) the previous active master(s) — preserves the one-active-master invariant.
3. Mark the request promoted; record execution row, events, and an audit_logs entry.

Rollback archives the promoted pack and restores the previous master the same way.

What it never does

No deletes anywhere; never touches memory_events, memory_items, memory_profiles, capture or pruning candidates; never crosses namespaces; server-derived identity only, client user_id rejected; no service-role clients. All enforced by the updated guard test plus 8 new unit tests (gate-off refusal, confirmation phrase, dry-run writes nothing, happy path, unapproved block, master-changed block, rollback, never-deletes).

Files

• supabase/migrations/20260716000000_pandora_promotion_executor.sql — executions/events tables with RLS; widens pandora_promotion_requests status check with 'promoted' (NOT applied)
• lib/services/pandora-promotion-execution-service.ts
• app/api/pandora/promotion-requests/[id]/execution/{route,dry-run/route}.ts, app/api/pandora/promotion-executions/{route,[id]/rollback/route}.ts
• tests/unit/pandora-promotion-execution-service.test.ts, guard test update
• docs/pandora-promotion-executor.md, roadmap update, env catalog entry

Verification

typecheck ✅ · lint ✅ (0 errors) · test 650/650 ✅ · build ✅ · env:policy ✅

Post-merge rollout (skill 07 sequence)

1. Apply migration pandora_promotion_executor. 2. Verify production READY. 3. Dry-run route on a real approved request; review output. 4. Only then set the gate true. 5. One controlled execution with confirmation phrase. 6. Post-run verification of the one-active-master invariant and audit trail. 7. Optionally turn the gate back off between promotions.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KuzYogRG6c6324Lq4N4aAC

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
memory	Ready	Preview, Comment	Jul 15, 2026 8:34pm

[coderabbitai]

Warning

Review limit reached

@besfeng23, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 50 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ca8fb44f-6716-43f6-b32b-ea84c0d5d54e

📥 Commits

Reviewing files that changed from the base of the PR and between 3eb1ea4 and eb8d28f.

📒 Files selected for processing (11)

• app/api/pandora/promotion-executions/[id]/rollback/route.ts
• app/api/pandora/promotion-executions/route.ts
• app/api/pandora/promotion-requests/[id]/execution/dry-run/route.ts
• app/api/pandora/promotion-requests/[id]/execution/route.ts
• docs/pandora-promotion-executor.md
• docs/roadmap.md
• lib/services/env-discovery-service.ts
• lib/services/pandora-promotion-execution-service.ts
• supabase/migrations/20260716000000_pandora_promotion_executor.sql
• tests/unit/pandora-operator-action-guards.test.ts
• tests/unit/pandora-promotion-execution-service.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/roadmap-analysis-emq31g

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}