Promote v0.0.3 to production - #154
Merged
Merged
Conversation
…pectedly (#145) When the OpenCode subprocess dies mid-task today, the worker silently reconnects and every fact about the death vanishes with the sandbox. The worker now stands witness: a bounded ring of the subprocess's last output lines is kept while it runs, and an exit while the task is not being cancelled records a durable diagnostic run event with the exit code, signal, uptime, output tail, and a memory snapshot taken at the instant of death, plus a Sentry capture for alerting. Exit code 137 versus a panic stack versus a clean exit is the difference between "killed for memory", "OpenCode bug", and "something else" — the distinction the last two investigations could not make. Collection cost is constant per output line, certification runs only on unexpected exits, and the callback is observer-only: its failures are logged and never touch the harness lifecycle. Output lines pass through the diagnostic recorder's secret scrubbing before persisting. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…payload kind (#134) Co-authored-by: Roomote <roomote@roocode.com>
…s, retention, and classification constraints (#136) Co-authored-by: Roomote <roomote@roocode.com>
…135) Co-authored-by: Roomote <roomote@roocode.com>
…icate (#147) * [Fix] Address review findings on the diagnostic rail and death certificate Review follow-up for #140 and #145, which merged before their bot reviews were read: - Deliberate harness terminations (reconnect, restart, teardown) are no longer certified as unexpected exits: ReconnectableHarness marks the subprocess before killing it, and certification skips marked exits, which also silences the Sentry alert that fired on every routine reconnect. - The death tail no longer depends on the startup URL wait leaving its line listeners attached: dedicated readers feed the ring for the whole subprocess lifetime. - The run-events reader returns the newest events under its limit (descending query, reversed to chronological), so a busy task cannot push the diagnostics it exists to surface out of the window. - A caller-supplied details.kind can no longer override the recorder's classification. - Hash-shaped values (git SHAs, digests) keep an 8-character prefix when redacted, preserving their evidentiary value without exposing credential-length material. - The memory reading is named and documented as what it is: the sandbox observed just after the exit, by the surviving worker process — the exit code/signal remains the authoritative OOM signal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Mark expected exits only while the subprocess is alive A crash surfaces as a disconnect first, and the disconnect cleanup then kills the already-dead process; marking it there raced the exit certification and could suppress the certificate for exactly the crash the rail exists to record. The mark now applies only to a process that is still alive at kill time, so deliberate teardowns stay quiet and self-inflicted deaths stay certified. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…e runs (#150) The promote PR used head=develop, so its contents were the live develop tip: commits merged after the Version PR silently rode into a release whose changelog never mentioned them, and tag-release then tagged that drifted content. Cut a frozen release/v{version} branch at the commit that introduced the version (via scripts/release/find-version-commit.mjs) and promote that branch instead. Also stop stale queued Release runs from resurrecting outdated Version PRs (like #144): cancel superseded runs and check out the live develop tip instead of the triggering push SHA. Co-authored-by: Roomote <roomote@roomote.dev>
…linking accounts (#148) The Link GitHub account button built the authorize URL from Env.GITHUB_CLIENT_ID, which only reads process env and defaults to an empty string. Deployments that created their GitHub App through the in-product manifest flow store credentials encrypted in the environment_variables table, so the button produced client_id= and GitHub returned a 404. Resolve the client id via resolveDeploymentEnvVar like the rest of the GitHub commands, and return a clear configuration error instead of a broken URL when no client id is available. Apply the same fix to the OAuth code-to-token exchange, which read both the client id and secret from process env and would have failed the callback for the same deployments. Co-authored-by: Roomote <roomote@roocode.com>
…149) A transcript that went strange mid-task gives no hint that the harness bounced underneath it. ReconnectableHarness now records durable diagnostic events at its lifecycle transitions: unexpected disconnect, restart requests (harness-initiated and external, with their reason), successful reconnect with the attempt count, and reconnect exhaustion. Together with the exit certificate this makes a process bounce fully reconstructable from task run events. Recording is optional and observer-only: the recorder is injected by create-harness, every call is fire-and-forget, and lifecycle behavior is unchanged. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…sts (#152) * fix: unblock first release publish when no previous GitHub release exists The deployment acceptance gate resolved its upgrade baseline from releases/latest with `|| true`, so a 404 (no release yet) leaked the JSON error body into the docker image tag. The main-channel fallback pulled the pre-release main image, whose controller crashes under the current compose. Resolve the baseline safely, skip upgrade validation when there is no usable previous release (fresh-install validation still runs), and never let a non-channel/non-v* string reach docker pull. Ships as v0.0.3 via changeset so the first fully published release goes out on the fixed gate. * fix: skip upgrade validation when re-publishing a version not newer than the latest release Manual dispatch can re-publish an older version while a newer release is latest; validating baseline->candidate would then exercise a downgrade dressed up as an upgrade. Keep the upgrade leg only when the candidate is strictly newer than the resolved baseline (sort -V), and fall back to fresh-install validation otherwise. --------- Co-authored-by: Roomote <roomote@roomote.dev>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Contributor
|
No code issues found. See task This is a release-promotion PR that promotes
Merge with a merge commit as the description instructs (not squash/rebase). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promote v0.0.3
Frozen at
ddb6f567fcc1b0054f375683cd899937766c0be9— the commit where0.0.3was versioned. Commits merged todevelopafter that point ship in the next release.v0.0.3and triggers the existing GHCRv*image publish (latestchannel).release/v0.0.3branch can be deleted after this PR merges.Changelog
0.0.3 (2026-07-11)
Patch changes