feat(cli): add atomic launch receipts - #895
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4f9ae3e454
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if launchNonce != "" { | ||
| receipt, err := lookupLaunchReceipt(env.client, env.repo.ID, branch, launchNonce) | ||
| if err != nil { | ||
| return emitError(cmd, 1, fmt.Sprintf("look up launch receipt: %v", err)) | ||
| } | ||
| if receipt != nil { | ||
| if receipt.HeadSHA != headSHA || receipt.SubmittedHeadSHA != headSHA || receipt.IntentDigest != digestLaunchIntent(intent) { |
There was a problem hiding this comment.
When a nonce is already bound and another push has since advanced the gate branch, a caller whose local checkout remains at the old head takes this lookup shortcut, emits the old receipt, and drives its run without invoking start_fresh_run or checking the gate. This defeats strict mode's branch/head drift guarantee; route existing bindings through daemon-side gate validation before accepting the receipt.
Useful? React with 👍 / 👎.
| gateHead, err := git.Run(ctx, gateDir, "rev-parse", "refs/heads/"+branch+"^{commit}") | ||
| if err != nil { | ||
| return "", fmt.Errorf("resolve gate head: %w", err) | ||
| } | ||
| if gateHead != headSHA { | ||
| return "", fmt.Errorf("launch context drift: gate branch %q is at %s, not requested %s", branch, gateHead, headSHA) |
There was a problem hiding this comment.
If another Git push updates this branch after rev-parse succeeds but before the nonce-bound row is inserted, the daemon issues a created receipt for a head the gate no longer names. The in-process branch mutex does not participate in Git's receive/ref transaction, so concurrent pushes can cross this check; creation needs a Git-level compare-and-swap or another validation synchronized with the ref update.
Useful? React with 👍 / 👎.
| MethodShutdown = "shutdown" | ||
| MethodPushReceived = "push_received" | ||
| MethodStartFreshRun = "start_fresh_run" | ||
| MethodGetLaunchReceipt = "get_launch_receipt" |
There was a problem hiding this comment.
get_launch_receipt is a read-only polling method, but it was not added to readOnlyMethod in internal/ipc/server.go, so every successful lookup is logged at INFO. The new wait loop calls it every 150 ms for up to five seconds, producing roughly 34 lifecycle-log entries per delayed launch instead of the required DEBUG-only read logging.
Useful? React with 👍 / 👎.
Confidence Score: 5/5The PR appears safe to merge. No blocking failure remains; both previously reported compilation issues are fixed at the current HEAD. Reviews (5): Last reviewed commit: "revert: retain only changelog correction" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
Speaking as Kun's firstmate: Thanks for this — it correctly targets ready-for-pr #804 with opt-in Blocking: Guard failed because this PR hand-edits Non-blocking notes: Codex P2 ( contract-class: opt-in. VISION R1–R7 look aligned for the opted-in path. Not merging until CHANGELOG is removed and CI is green. Waiting on you. |
|
Speaking as Kun's firstmate: Thanks for the follow-up. Tip is now Please restore Fork CI on this tip was approved ( |
2 participants
Closes #804.
Adds strict
axi run --launch-noncemode: a daemon-owned, repository/branch-lock-protected nonce binding, a pre-drive machine-readable receipt, exact persisted-intent SHA-256 digest, immutable full head bindings, and created/reused disposition. Same nonce retries converge; different nonces never reattach a same-head run. The post-receive and no-op fallback paths use the same receipt contract.Keeps ordinary reattachment and NULL-nonce historical rows compatible. Raw intent is excluded from receipts, telemetry, and generic status. Includes storage, daemon/IPC, CLI transport, focused race/context/persistence tests, contract docs, release note, and fork retirement procedure.
Does not adopt PR #871 custody changes.