Conversation
cc3aee4 to
aad5b7d
Compare
|
Exact-head delivery status for
This head will not be merged until an authenticated exact-head approval updates the verdict to — |
Exact-head delivery status — PR #4603Head: Reproduction (mutation proof, on this head)Reverting only the Validation evidence (local, head aad5b7d)
Current CI (fresh, exact head)
HoldAwaiting a fresh authorized non-author exact-head review at Residual scope (follow-up, not this PR): — |
…eckpoints The auto-checkpoint classifier protects `.gjc/_session-*/` but not `.gjc/state/`. A worker CLI session writes its runtime state (for example .gjc/state/sdk/<session-id>.json) into its provisioned worktree's .gjc tree; on the next monitor cycle those files are classified as eligible work and committed as `gjc(team): auto-checkpoint ...`, then merged into the leader repo's default branch — polluting main with runtime artifacts. Extend PROTECTED_WORKER_CHECKPOINT_PREFIXES with `.gjc/state/` so worker runtime state is never checkpointed or merged. Add a unit test asserting the classifier treats .gjc/state files as protected (fails without the fix).
…rget assertion The worker-runtime-state e2e guard asserted absence at the session-scoped teamStateRoot path while the pollution path deposits root-level state at the leader's `.gjc/state/team/runtime.json`; pre-fix that assertion was provably blind to this exact defect. Assert the actual merge-target path and that no protected runtime-root path appears in leader status. Also pin the prefix matcher boundaries (bare `.gjc/state` protected; `.gjc/state-*` siblings eligible), relocate the test beside the other classification tests, and record the fix under [Unreleased]. Lore-id: pr-4603-state-protection Constraint: preserve Veritas-7's substantive commit attribution Constraint: no new protected prefixes beyond .gjc/state/ Confidence: high Scope-risk: narrow Reversibility: straightforward Tested: bun test team-runtime.test.ts -t "protects worker runtime state"; -t "checkpoint classification excludes" Not-tested: full stalled-worker continuation suite (pre-existing native-addon env failure on clean dev)
aad5b7d to
5b3c540
Compare
Exact-head delivery status — PR #4603 (reconstructed onto live dev)Superseded: prior head Current delivery: head Three-dot binary diff SHA-256 (7265a61...5b3c540): Validation on head 5b3c540 (local)
Fresh CI on exact head 5b3c540
HoldZero reviews exist at this head. Awaiting a fresh authorized non-author exact-head review at — |
…oes not ship Cherry-picking Yeachan-Heo#4648 hit a CHANGELOG conflict whose union resolution also pulled in the neighbouring `gjc team` worker-runtime-state bullet from Yeachan-Heo#4603. That commit is deliberately excluded from the 0.14.1 pick set, so the bullet advertised a fix the release does not contain. Lore-id: 4c1f9a02 Constraint: Unreleased bullets must describe exactly the approved pick set Confidence: high Scope-risk: narrow Reversibility: trivial Tested: re-audited every Unreleased bullet against branch commit provenance
Brings the 0.14.2 release commits — version bumps to 0.14.2, the released [0.14.2] changelog sections, the pi-natives version sentinel, lockfiles, and plugin metadata — back onto dev. Conflict resolution: every source conflict took dev's side. The 0.14.2 payload is a manifest-filtered subset of dev's own commits (patch-only, explicitly excluding the team -> autoresearch cutover) plus one external crash-relay commit (c1428d9, from origin/owner/issue-4715-crash-relay-gaps, not on dev); dev already holds the same underlying changes plus later evolution (crash-relay trust-boundary hardening past #4658/#4698/#4679, sdk-broker liveness past #4704/#4705, session/notify fixes, ralplan worktree-root work past #4699). packages/coding-agent/src/gjc-runtime/team-runtime.ts and its test were removed on dev by the team->autoresearch cutover; the 0.14.2 branch's fix to that file (#4603) is moot post-cutover and the deletion was honored. Release metadata (version numbers, CHANGELOG [0.14.2] sections, native version sentinel, plugin/marketplace version+description, Telegram daemon generation manifest) took main's side. Fixed a duplicate getTrustedAgentFile/isProjectEnvDeclaration definition in packages/utils/src/dirs.ts left over from the merge: main's older standalone Object.hasOwn(parseEnvFile(...)) implementation and dev's newer DirResolver-routed implementation both landed without a real conflict (git treated the two independent insertions as compatible additions); removed main's stale copy, kept dev's. Known pre-existing issue, unrelated to this merge (reproduces identically on pristine origin/dev @ 5f5a1c1): the "a checkout .env HOME declaration cannot redirect trusted relay state" test in packages/coding-agent/test/crash-upstream-relay.test.ts and the "$credentialEnv > preserves inherited credentials when a hostile project HOME overlays the runtime HOME" test in packages/utils/test/env.test.ts both hang/time out (~5s) rather than completing. All 55 other tests in crash-upstream-relay.test.ts pass. Verified via a separate pristine origin/dev worktree with a fresh install/native build — not introduced by this merge.
…eckpoints (Yeachan-Heo#4603) * fix(team): exclude worker runtime state under .gjc/state from auto-checkpoints The auto-checkpoint classifier protects `.gjc/_session-*/` but not `.gjc/state/`. A worker CLI session writes its runtime state (for example .gjc/state/sdk/<session-id>.json) into its provisioned worktree's .gjc tree; on the next monitor cycle those files are classified as eligible work and committed as `gjc(team): auto-checkpoint ...`, then merged into the leader repo's default branch — polluting main with runtime artifacts. Extend PROTECTED_WORKER_CHECKPOINT_PREFIXES with `.gjc/state/` so worker runtime state is never checkpointed or merged. Add a unit test asserting the classifier treats .gjc/state files as protected (fails without the fix). * test(team): pin .gjc/state matcher boundaries and fix leader merge-target assertion The worker-runtime-state e2e guard asserted absence at the session-scoped teamStateRoot path while the pollution path deposits root-level state at the leader's `.gjc/state/team/runtime.json`; pre-fix that assertion was provably blind to this exact defect. Assert the actual merge-target path and that no protected runtime-root path appears in leader status. Also pin the prefix matcher boundaries (bare `.gjc/state` protected; `.gjc/state-*` siblings eligible), relocate the test beside the other classification tests, and record the fix under [Unreleased]. Lore-id: pr-4603-state-protection Constraint: preserve Veritas-7's substantive commit attribution Constraint: no new protected prefixes beyond .gjc/state/ Confidence: high Scope-risk: narrow Reversibility: straightforward Tested: bun test team-runtime.test.ts -t "protects worker runtime state"; -t "checkpoint classification excludes" Not-tested: full stalled-worker continuation suite (pre-existing native-addon env failure on clean dev) --------- Co-authored-by: Veritas-7 <koreacmc.kr@gmail.com> Co-authored-by: Yeachan Heo <yeachan.heo@gmail.com>
3 participants
What
gjc teamworker auto-checkpoints no longer commit and merge root-level worker runtime state (.gjc/state/**, e.g. SDK broker endpoints like.gjc/state/sdk/<session-id>.jsonand settings migration markers) into the leader repo's default branch.packages/coding-agent/src/gjc-runtime/team-runtime.ts:PROTECTED_WORKER_CHECKPOINT_PREFIXESnow covers both GJC runtime roots —.gjc/_session-*/and.gjc/state/— with the stale single-root comment replaced by the two-root invariant. User-owned.gjc/content (config.yml,agents/,skills/) stays eligible: worker edits there are reviewable work.packages/coding-agent/test/gjc-runtime/team-runtime.test.ts: the worker-runtime-state guard is relocated beside the other classification tests and extended with matcher-boundary cases (bare.gjc/stateprotected;.gjc/state-deep/x.md,.gjc/statement.txteligible). The pre-existing e2e guard now asserts absence at the actual leader merge-target path.gjc/state/team/runtime.jsoninstead of the unrelated session-scopedteamStateRoot(...)path (the old assertion was provably blind to this exact defect), plus a no-protected-paths-in-leader-status check.packages/coding-agent/CHANGELOG.md:[Unreleased]entry.Why
Observed in the field: running
gjc teamin a git repository, the leader's default branch gained auto-checkpoint commits containing worker session runtime state files (.gjc/state/sdk/...). The classifier only excluded.gjc/_session-*/; a worker CLI session writes root-level runtime state into its provisioned worktree, and on the next monitor cycleautoCommitDirtyWorkercommits those files asgjc(team): auto-checkpoint ..., thenintegrateGjcWorkerCommitsmerges them into the leader branch.Rebased onto current
dev(7265a61) by maintainer fix-forward; original substantive commit preserved with author attribution (Veritas-7), amendment commit by maintainer. The previously submitted head cc3aee4 was based onmainand its PR-contract CI could not compute the base...head diff; this head is a descendant ofdev, which the exact-head contract requires.Testing
Reproduction (mutation proof, on this head): reverting only the
PROTECTED_WORKER_CHECKPOINT_PREFIXESline makesbun test packages/coding-agent/test/gjc-runtime/team-runtime.test.ts -t "protects worker runtime state"fail (classification includes.gjc/state/sdk/runtime.jsonas eligible); with the fix it passes (5 expect calls). Transcript:artifacts/ralplan-4603/mutation-prefix-fail.txt.Validation on head 5b3c540 (base 7265a61):
bun test packages/coding-agent/test/gjc-runtime/team-runtime.test.ts -t "protects worker runtime state"→ 1 passbun test ... -t "checkpoint classification excludes"→ 1 passbun test ... -t "memory guard wiring"→ 4 passbun test ... -t "native gjc team runtime"→ 78 pass, 0 failbun --cwd=packages/coding-agent run check→ green (biome + tsc -p tsconfig.json --noEmit)bun scripts/verify-gjc-state-writers.ts --fail→ "0 write site(s) outside the sanctioned writer / known allowlist"bun scripts/changelog-history-guard.ts→ "no released sections removed";bun test scripts/changelog-history-guard.test.ts→ 12 passgit diff --check 7265a61c8e...HEAD→ cleand91985db82751f3f2a248ffee91c729499719da8131175803c5e32629433124dKnown unrelated pre-existing local-env failure: "stalled worker continuation protocol > dispatches continuation through psmux" fails identically on clean dev 7265a61 checkout in this environment (native addon load), not caused by this diff.
GJC verdict
devbun checkpasses (coding-agent package check: biome + tsc green)—
[repo owner's gaebal-gajae (clawdbot) 🦞]