Add repository-owned Control Program flows - #210
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.97
The new Flow boundary has concrete entry-admission, resolver/apply, repository-isolation, and partial-commit defects. Model-level verification is recommended before merge, particularly to check whether repository-added guards, targets, and priorities can create additional prerequisite shadowing or recovery cycles.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The patch introduces executable-source authority bypasses, weakens trusted objective constraints, permits Flow input substitution, and lacks source/projection freshness guarantees. Model-level verification is recommended before merge: after these defects are fixed, verify whether any accepted repository-selected transition subset or priority ordering can leave a reachable nonterminal state without a marked-target or recovery path.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The new Flow boundary permits repository-controlled frontend execution and has concrete projection freshness, crash-recovery, and artifact-discovery failures. Model-level verification is recommended after these fixes, focused on whether every repository-selected effectful transition retains reachable recovery and whether custom priority choices can create blocking nonterminal states.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The patch introduces actionable domain-isolation, program-identity, input-binding, and filesystem-boundary defects. Model-level verification is recommended before merge, particularly to determine whether repository-selected priority changes can shadow prerequisite or recovery transitions and create zero-progress states.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The patch introduces concrete authority-isolation, freshness, resolver/apply, and valid-program projection failures. Model-level verification is recommended before merge, particularly to check whether repository-selected transition subsets or priorities can shadow required prerequisite or recovery transitions.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The new Flow path contains a deterministic bootstrap deadlock, admits artifacts that production later refuses, and can report successful publication of an already-stale projection. Model-level verification is recommended before merge: verify that repository-selected transition subsets and priorities cannot shadow prerequisites or leave newly reachable nonterminal states without progress or recovery.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.97
The patch introduces objective-context substitution, a cross-process projection race that can publish mismatched artifacts, and invalid/injectable generated skill frontmatter. Questions for model-level verification: can repository-selected transition subsets or priorities pass runtime validation while making a declared marked target unreachable? Model-level verification is recommended before merge.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The patch admits unusable Flow entries and can silently overwrite repository-owned skill files. Model-level verification is recommended after these fixes to check whether configurable transition subsets, guards, priorities, and recovery selections can create unreachable targets or shadow required recovery paths.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.97
The patch introduces one deterministic resolve-to-apply dead end and one mixed-version CLI identity break. Model-level verification is recommended before merge for the new repository-defined transition subsets and priorities: can any accepted entry become nonterminal with no selectable transition, and can a repository priority shadow a required prerequisite or recovery step?
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.97
The patch introduces actionable authority, freshness, recovery-closure, and identity-renaming defects. Model-level verification is recommended before merge, particularly to ask whether every permitted trusted-step subset retains prerequisite and recovery closure without introducing blocking nonterminal states.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.97
The new Flow binding permits plan-byte substitution, compilation can publish a deterministically stale self-referential artifact, and both new strict loaders accept oversized trailing data. Model-level verification is recommended before merge, particularly to check whether repository-selected transition subsets or priorities can create newly blocking nonterminal states and whether every selected effect retains reachable recovery.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The new Flow surface has concrete run-continuity, input-freshness, and host-projection integrity failures. Model-level verification is recommended after fixing them, especially to confirm that selectable Flow subsets and priority changes retain prerequisite and recovery reachability.
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The patch introduces one production Flow liveness failure and one clean-checkout compilation failure. Model-level verification is recommended after fixing them, particularly to check whether any repository-selected transition subset or priority can create additional nonterminal blocking states.
| managed := filepath.Join(repository, ".boatstack", "plans", options.deliveryID+".source") | ||
| if _, err := os.Lstat(managed); err == nil { | ||
| resolved, resolveErr := resolveRegularRepositoryFile(repository, managed, "active run plan") | ||
| return resolved, options.deliveryID, resolveErr |
There was a problem hiding this comment.
[P1] Preserve the inbox bytes that define an active run
Invariant: an active Flow run must continue resolving the exact entry-input bytes used to derive its run ID. With managed plan A already present and inbox plan B selected, the initial next --flow ... --entry ... derives run B; the next targeted resolution with that run ID unconditionally switches to managed A, recomputes a different ID, and returns FLOW_RUN_MISMATCH. This patch introduces the switch from entry input to managed output, blocking the generated Flow path whenever a new inbox plan is intended to amend an existing plan. The smallest regression test creates managed A plus inbox B, binds an initial run, then rebinds plan.amend with that run and verifies it still resolves B without changing the run ID.
Confidence: 0.98
| func ownedProjectionChanges(repository, sourceRelative, artifactPath string, next map[string]string) ([]boatstackruntime.ProjectionRemoval, string, map[string]string, boatstackruntime.FlowProjectionOwnershipSnapshot, error) { | ||
| ownership, err := boatstackruntime.LoadFlowProjectionOwnership(repository, sourceRelative) | ||
| if err != nil || !ownership.Exists() { | ||
| return nil, "", map[string]string{}, ownership, err | ||
| } |
There was a problem hiding this comment.
[P2] Provide a portable ownership bootstrap for committed projections
Invariant: committed Flow artifacts must remain regenerable from a clean checkout while unrelated user-owned files remain protected. After cloning a repository containing committed source, artifact, and generated skills, the machine-local ownership record is absent; if the developer edits the source before compiling, ownedProjectionChanges supplies no prior artifact or skill hashes, so the existing compiler-produced artifact differs from the new output and ApplyOwnedFlowProjection rejects it as unauthorized. This new machine-local-only ownership scheme therefore makes the documented edit-then-compile workflow fail in every fresh clone or worktree unless users first perform an undocumented unchanged compile. A regression test should copy a checked Flow projection into a fresh Git worktree without ownership metadata, edit its source, compile, and assert that exact prior compiler outputs are replaceable while an unrelated skill remains untouched.
Confidence: 0.97
1 participant
Summary
control-program/v1IR and TypeScript authoring frontendVerification
npm run build:flow-sdkpython3 .github/scripts/run_go_tests.pypython3 -m unittest discover -s .github/tests -p "test_*.py" -vgo vet ./...go test -race ./kernel ./internal/softwaredelivery/effects