Complete Runtime Architecture Reset Stage C - #116
Merged
raederhans merged 6 commits intoAug 31, 2026
Conversation
Stage B could detect startup-support drift but could not materialize a verified prior result. Add a canonical local artifact cache and bind the startup-support checkpoint to exact manifest, tree, source, and builder identities while preserving the legacy rebuild path. Constraint: The cache and checkpoint parent are trusted single-writer local storage; shared, remote, and hostile-concurrent writers remain outside this contract. Rejected: Use the short scenario snapshot directory as a cache identity | it is not a full content address. Rejected: Replace checkpoint outputs before complete validation | partial recovery can destroy the last known-good files. Confidence: high Scope-risk: moderate Reversibility: clean Directive: If this cache is ever shared with untrusted or same-privilege concurrent writers, replace path-based checks with handle-relative no-follow I/O before widening the trust boundary. Tested: Python compile checks; 22 focused CAS, session, startup-support reuse, corruption, restore, and rollback tests passed; git diff --cached --check. Not-tested: full scenario rebuild, crash or power-loss recovery, Pages/dist, browser, Nightly, Release, performance, deployment. Related: candidate 44f34021284dad8523ee08cf34ec2f4032e71df8; Stage C baseline afe96bf
The transport registry exposed capability metadata without a trustworthy product-maturity projection. Add a road-only resolver that keeps workbench preview, main-map eligibility, apply support, and Pages ownership independent and fail-closed against their own evidence. Constraint: This first vertical slice covers road only; tracked dist remains retained and is regenerated by the integration owner, not by the candidate task. Rejected: Collapse all surfaces into one ready flag | independent evidence failures would erase valid facts and create false maturity. Rejected: Infer main-map or apply support from previewOnly registry metadata | those facts belong to the loaded manifest. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Add another family only with its own manifest evidence and hostile missing/mismatched carrier tests. Tested: maturity 5/5; road preview 5/5; layer-panel 6/6; transport manifest 20/20; architecture boundaries; git diff --cached --check. Not-tested: Pages/dist build, browser, Nightly, Release, performance, deployment. Related: candidate a7bb18118d39ebe03c99c0905b6afd4f111d8628; Stage C baseline afe96bf
The Stage C files previously selected the right checks but exceeded the edit budget because seconds-long direct contracts were priced and expanded like broad contract suites. Register exact content-cache and transport-maturity routes, retain three TNO lifecycle sentinels, and keep the legacy shadow derived from canonical authority. Constraint: The full TNO module remains a deeper verification route; local edit selection covers admission, recovery, and fatal rollback without changing global budgets. Rejected: Raise the repository-wide edit budget | unrelated changes would inherit the wider allowance. Rejected: Drop TNO recovery coverage | route success would no longer prove the new rollback boundary. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Keep new direct routes within measured local cost and add a combined-change-set budget regression. Tested: focused metadata and adaptive budget 3/3; shadow equality; 403-route schema; script portfolio; adaptive execution 3 commands and 20 tests; git diff --check. Not-tested: full TNO module, Pages/dist, browser, Nightly, Release, performance, deployment.
The tracked Pages artifact must remain byte-aligned with source while retirement authorization is withheld. Regenerate the retained dist mirror after the road maturity projection changed the transport capability registry. Constraint: Tracked dist remains authoritative for this release path; this commit changes only the mirrored registry and deterministic manifest size totals. Rejected: Retire tracked dist during Stage C | the required receipt identity and authorization are still unavailable. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Regenerate through the canonical Pages builder whenever the source registry changes. Tested: verify:pages-dist builder 913.73 MiB; startup shell 62/62; landing assets 10/10; showcase view 20/20; source/dist no-index diff clean; manifest records 29,223 bytes; git diff --check. Not-tested: browser, Nightly, Release, performance, deployment.
The durable task records still described undispatched Stage C lanes. Record the completed C1/C2 ownership, integrated commits, local verification evidence, Pages single-owner run, and the remaining protected-main gate. Constraint: Stage C remains ready for remote gate rather than complete until required checks pass and the merge identity is confirmed. Rejected: Mark Stage C complete from local checks alone | that would erase the protected-main acceptance criterion. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Replace the pending remote state with the exact PR and merge receipt after protected-main closeout. Tested: architecture boundary check; git diff --check. Documentation otherwise reviewed directly. Not-tested: browser, Nightly, Release, performance, deployment.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
PR fast correctly rejected the stale retained-shadow count fixture after Stage C added two direct routes. Update the expected route, command, catalog-entry, and leaf totals to the canonical 403/359/465/434 projection. Constraint: This changes only exact deterministic count expectations; no gate, route, or budget is relaxed. Rejected: Skip the portfolio contract in PR fast | that would hide canonical projection drift. Confidence: high Scope-risk: narrow Reversibility: clean Directive: Update every deterministic projection fixture whenever canonical route cardinality changes. Tested: verification script portfolio 54/54; shadow equal; 403-route schema; git diff --check. Not-tested: browser, Nightly, Release, performance, deployment.
raederhans
deleted the
codex/runtime-architecture-reset-stage-c-integration
branch
August 31, 2026 10:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ContentAddressedArtifactCache/v1and connect startup-support checkpoints to verified admit/restore identitiesLocal verification
Boundaries