Repository navigation
feat: prepare the shared 1.0 compatibility cut - #2461
Conversation
Settle the shared wire and authoring names before 1.0 so adopters take one breaking change instead of a series of them. Applies the cut to current main as one commit and regenerates every derived output. Keep the ctl envelope status a string on every report: bregctl timer status now carries the timer state in its own timer member. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Registry Record v1 is edited in place so clients keep their v1 profile checks. entityTypeIdentifier becomes recordTypeIdentifier in the shared schema, context, profile, fixtures and clients, and the migration descriptor names a Record type with recordTypeId and kind record-type. The changelogs carry a BREAKING line for each break in this branch, the removedKeys row and operator docs follow revokedKeyIds, and the Proposal recovery docs follow package-changed. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
99fee0a to
2a7942c
Compare
Every ctl report now goes through the shared envelope, which always writes version and diagnostics, so the listing's exact expectation has to name them. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
The Rust client refuses a mutation record with a data member outside the record shape, so the mock must answer as the runtime does. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Move the LTS pin to 48.0.8 for RUSTSEC-2026-0422, RUSTSEC-2026-0423 and RUSTSEC-2026-0424. The pin is exact, so the manifest moves with the lockfile, and the handler SDK workspace moves with it because its admission crate builds the platform executor by path. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
The stability rule tells clients to ignore response members they do not recognize, so a Problem member a later deployment adds no longer refuses the answer. The extra value is not retained. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
The Rust client ignores a Problem member it does not recognize, as the stability rule requires, so the binding no longer sees a protocol failure. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f2f4179164
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| let valid_until = input | ||
| .source_valid_until | ||
| .map(emitted_instant) | ||
| .transpose()? | ||
| .map_or(local_valid_until, |source| source.min(local_valid_until)); |
There was a problem hiding this comment.
This changes the signed assertion’s lifetime by propagating verified source deadlines through acquisition and capping issuance, but the commit supplies no explicit security review notes for that boundary change. The only updated SECURITY-REVIEW-NOTES.md section concerns BReg row-boundary refusals; the Evidence changelog and invariant/test mappings describe behavior and coverage rather than record the required review. Root AGENTS.md explicitly requires review notes for changes to “assertion evaluation or signing.” Record the reviewed threat, enforcement points, and verification limitations for the new lifetime propagation before merging.
AGENTS.md reference: AGENTS.md:L352-L354
Useful? React with 👍 / 👎.
Prepare the shared 1.0 compatibility changes across BReg, Evidence, public clients and operator tooling in one integration PR.
The integrated changes cover:
403 write.outside-boundary. Hidden or absent Patch targets, stale conditions, Actions and Proposals retain their concealed412refusals.versionand expose the numeric statistical release asreleaseVersion; instance-claim status reports carry the complete domain object underinstanceClaim. HTTP release headers and human output retain their existing behavior.This branch is rebased on current main: the compatibility cut, the Registry Record rename, and fixes from CI. Those fixes also move Wasmtime to 48.0.8 for RUSTSEC-2026-0422, RUSTSEC-2026-0423 and RUSTSEC-2026-0424, and bring the Coordinator client tests in line with the shared Problem document, which ignores members a client does not recognize. Registry Record v1 is edited in place:
entityTypeIdentifierbecomesrecordTypeIdentifierin the schema, context, profile, fixtures and clients, with no v2 identifier, so clients keep their v1 profile checks and 1.0 freezes this shape. The published v1 context must be republished with the release, because its digest changes. The migration descriptor now names a Record type (recordTypeId, kindrecord-type).bregctl timer statuskeepsstatusa string and carries the timer state in atimermember. Each breaking change has a BREAKING line in the owning product's CHANGELOG.This PR is ready to merge on its own, and it does not finish the 1.0 cut. Follow-up work: tolerant response decoding in the remaining BReg client types, the final format-version and migration-baseline cut, a live Transit signing check, remaining documentation, and the migration notes. Release readiness and release-candidate first-run verification remain separate requirements.
Full CI passed on the final head (70 passed, 6 skipped), including the BReg PostgreSQL lanes and the native client bindings.
Verified on the rebased head:
cargo check --workspace --all-targets --locked, fmt, clippy with-D warningson the changed crates,registry-record,registry-breglibrary and integration targets,registry-bregctl(925),registry-coordinator(639 passed, 2 ignored),registry-breg-client(320),registry-stack-client(8), the generated-output and schema gates with generators run twice for a clean tree,catalog.jsonreproduced, the stale-vocabulary and evidence-anchor gates, anddocs/sitenpm test(938) andnpm run check. Not verified locally: every PostgreSQL suite, the Node.js and Python binding tests,test_receiver, and the runtime file ownership commands in the Compose docs on a Linux host. CI must cover these.Earlier results, from the head before the rebase:
The statistics regression failed against the old producer and passed after the projection fix. It checks publication and withdrawal, all retained header members, omission behavior, binary identity and human output. The instance-claim writer regression also failed before the producer correction and passed afterward. The generated source-export example was reproduced twice with identical bytes. An earlier full BRegctl library run had one recovery-test failure that did not reproduce in isolation or the later full rerun; that test was unchanged. The full PostgreSQL backup/restore journey still requires the current-head CI run.
Earlier integration checks passed for native clients, the serial rstack suite, and the complete documentation script suite (938 tests) and production docs build. These focused and earlier results do not establish complete validation of the final integration head. Full protected CI, executable tutorial journeys and the final published-candidate journeys are still required.