Repository navigation
Stage qualified upstream upgrades and offer explicit rollback #377
Description
Draft 06: Stage qualified upstream upgrades and offer explicit rollback
Parent
#369; #371 Owner: ecochran76 / primary coordinator. Priority: P1. Status: READY; approved breakdown.
What to build
The operator sees available upstream releases and stages an identifiable tested upgrade with one command while current sessions keep running.
Acceptance criteria
- Check upstream releases automatically with visible lag/status and official provenance; no automatic activation.
- One workflow applies versioned minimal patches, builds a complete package and qualifies native capabilities through installed public boundaries.
- Patch/build/test failure leaves active selection untouched and exposes the exact failing stage.
- Explicit activation and compatible rollback use supported native ownership/update mechanisms and preserve conversation/accounting state.
- Detect irreversible store incompatibility before activation; retain a compatible recovery route or hold.
- Manage bounded rebuildable caches separately; archive selected inactive payloads to a verified HDD with checksums and restore validation.
Blocked by
Delivery boundary
Source changes plus installed disposable-fixture behavior for this outcome. Production effects and genuine account acceptance remain separately identified; never close on source tests alone.
Activity
ecochran76 commentedon Oct 28, 2026
Source and isolated installed-fixture delivery accepted on codex-profiles integration branch feat/account-build-workflow, current commit6fec3d7. Digest-pinned source fetching, patch/build qualification staging, explicit private selection/rollback, archive/cache controls and bounded update checks; actual retained complete native package fixture and unchanged tenant state.
Full implementation integration suite102 tests passed. Qualification uses synthetic credentials and loopback-only fixtures; it is not live real-account refresh/OAuth acceptance. No production launcher, shared daemon, governor or resource allocation changed. Source and installed-fixture acceptance are distinct from main merge/release/deployment. Parent #369 and specification #371 remain open. Original real-account regression #372 and unsupported/qualified cross-account continuity boundaries #376 remain open. One combined Standards/Spec review and one bounded TDD findings pass follow these scoped closures, as requested.
Canonical execution evidence: Codex Wake plan0179 ledger, codex-profiles branch, and the dedicated user-scoped profile-implementation receipts (no credentials or transcripts published).
ecochran76 commentedon Oct 28, 2026
The single final review found two P1s, so this ticket was reopened rather than preserving a premature closure. Both now pass red/green public regressions and corrected installed qualification: contained real-source LICENSE -> COPYING links stage with retained provenance, and upgrade selection is scoped to the validated tenant with schema compatibility rechecked at launch. Alice/schema5 activation never selects Bob/schema6; a later schema6 in Alice also holds before backend startup. Active archive checks include tenant-qualified selections. The duplicate capability predicate now has one owner.
Final installed development wheel SHA256 c90421584cdc6cd8219fde164e22ded6443fe5b353e798b90dabae67c3cecff3 passed seven WSL groups and13 installed upgrade tests; all nine current runtime modules match. Both Python3.11/3.12 local full suites pass106 tests. Source PR: https://github.com/ecochran76/codex-profiles/pull/1. This accepts source and isolated installed-fixture delivery, not production activation or real-account refresh. Known #372/#376 concerns remain open. Exactly one broad review and one coordinated TDD findings pass were performed.