didericis/bot-bottle
1
0
Fork 0
Code Issues 33 Pull Requests 9 Actions Packages Releases Wiki Activity

fix: quality cleanup - authoritative backend cleanup (chunk 5/11) #525

Closed
didericis-codex wants to merge 1 commits from fix/authoritative-cleanup-revalidation into refactor/supervisor-mcp-dispatch
pull from: fix/authoritative-cleanup-revalidation
merge into: didericis:refactor/supervisor-mcp-dispatch
Conversation 0 Commits 1 Files Changed 8
+176 -43
didericis-codex commented 2026-07-26 23:01:41 -04:00
Collaborator
Copy Link
Copy Source

Stacked on #524. Fifth quality-cleanup chunk tracked by #444 and PRD 0082.

Makes cleanup previews safe to execute after operator confirmation:

  • Shared refresh flow: the backend-neutral cleanup command refreshes every plan after confirmation, so the preview is never treated as execution authority.
  • Firecracker launch/cleanup exclusion: a lifecycle lock spans run-directory creation through VMM visibility and the cleanup refresh/delete critical section.
  • Stable process identity: pidfds pin the exact process while /proc/<pid>/cmdline revalidates that it is still an orphaned Firecracker VMM before signalling.
  • Authoritative macOS discovery: container and network query failures raise EnumerationError; partial snapshots never become deletion plans.
  • Regression coverage: tests cover refreshed-plan execution, dropped stale resources, PID reuse, orphan signalling, and both macOS failure paths.

The shared behavior follows the backend rule used by gateway attachment: the common layer owns control flow and failure policy; concrete backends provide resource-specific discovery and validation primitives.

Final stack extension

  • #528 — authoritative resource identities and bounded artifact transfers.

Validation: The complete eleven-PR stack passes all 2,520 unit tests; full-repository Pyright reports 0 errors; git diff --check passes.

Refs #444.

Final stack extension

  • #530 — cleanup execution and mandatory authenticated-secret integrity.

Final stack extension

  • #531 — bounded heavy Git and cleanup operations.

Final stack extension

  • #532 — fail-closed shared database and gateway credential permissions.
Stacked on #524. Fifth quality-cleanup chunk tracked by #444 and PRD 0082. Makes cleanup previews safe to execute after operator confirmation: - **Shared refresh flow:** the backend-neutral cleanup command refreshes every plan after confirmation, so the preview is never treated as execution authority. - **Firecracker launch/cleanup exclusion:** a lifecycle lock spans run-directory creation through VMM visibility and the cleanup refresh/delete critical section. - **Stable process identity:** pidfds pin the exact process while `/proc/<pid>/cmdline` revalidates that it is still an orphaned Firecracker VMM before signalling. - **Authoritative macOS discovery:** container and network query failures raise `EnumerationError`; partial snapshots never become deletion plans. - **Regression coverage:** tests cover refreshed-plan execution, dropped stale resources, PID reuse, orphan signalling, and both macOS failure paths. The shared behavior follows the backend rule used by gateway attachment: the common layer owns control flow and failure policy; concrete backends provide resource-specific discovery and validation primitives. **Final stack extension** - #528 — authoritative resource identities and bounded artifact transfers. **Validation:** The complete eleven-PR stack passes all 2,520 unit tests; full-repository Pyright reports 0 errors; `git diff --check` passes. Refs #444. **Final stack extension** - #530 — cleanup execution and mandatory authenticated-secret integrity. **Final stack extension** - #531 — bounded heavy Git and cleanup operations. **Final stack extension** - #532 — fail-closed shared database and gateway credential permissions.
didericis force-pushed fix/authoritative-cleanup-revalidation from 01726a5c03 to 191471f03e 2026-07-26 23:39:31 -04:00 Compare
didericis-codex changed title from fix: quality cleanup - authoritative backend cleanup (chunk 5/7) to fix: quality cleanup - authoritative backend cleanup (chunk 5/8) 2026-07-26 23:41:45 -04:00
didericis force-pushed fix/authoritative-cleanup-revalidation from 191471f03e to cdb303fa25 2026-07-26 23:55:54 -04:00 Compare
didericis-codex changed title from fix: quality cleanup - authoritative backend cleanup (chunk 5/8) to fix: quality cleanup - authoritative backend cleanup (chunk 5/9) 2026-07-27 00:02:56 -04:00
didericis force-pushed fix/authoritative-cleanup-revalidation from cdb303fa25 to 3bc618c264 2026-07-27 00:17:58 -04:00 Compare
didericis-codex changed title from fix: quality cleanup - authoritative backend cleanup (chunk 5/9) to fix: quality cleanup - authoritative backend cleanup (chunk 5/10) 2026-07-27 00:25:52 -04:00
didericis added 1 commit 2026-07-27 00:46:38 -04:00
fix(cleanup): revalidate destructive backend plans
test / image-input-builds (pull_request) Failing after 13m11s
Details
test / unit (pull_request) Has started running
Details
test / coverage (pull_request) Blocked by required conditions
Details
test / integration-docker (pull_request) Blocked by required conditions
Details
tracker-policy-pr / check-pr (pull_request) Successful in 13s
Details
c7c3a79028
didericis force-pushed fix/authoritative-cleanup-revalidation from 3bc618c264 to c7c3a79028 2026-07-27 00:46:38 -04:00 Compare
didericis-codex changed title from fix: quality cleanup - authoritative backend cleanup (chunk 5/10) to fix: quality cleanup - authoritative backend cleanup (chunk 5/11) 2026-07-27 00:49:13 -04:00
didericis-codex closed this pull request 2026-07-27 01:35:35 -04:00
Some checks are pending
test / image-input-builds (pull_request) Failing after 13m11s
Details
test / unit (pull_request) Has started running
Details
test / coverage (pull_request) Blocked by required conditions
Details
test / integration-docker (pull_request) Blocked by required conditions
Details
tracker-policy-pr / check-pr (pull_request) Successful in 13s
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
Status/Needs Triage
Awaiting initial classification
No Label
Milestone
No items
No Milestone
Assignees
Clear assignees
didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: didericis/bot-bottle#525
Delete Branch "fix/authoritative-cleanup-revalidation"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?