fix: provision managed bootstrap runtime - #82
Conversation
github-actions
Bot
added
area/docs
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 55afd1bcfb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if ! "$EXPLICIT_SOURCE_DIR" && "$NON_INTERACTIVE" && ! "$SYNC_ENV" \ | ||
| && [[ -f "$SOURCE_DIR/pyproject.toml" && -f "$SOURCE_DIR/uv.lock" ]]; then | ||
| SYNC_ENV=true |
There was a problem hiding this comment.
For managed --non-interactive --yes bootstraps on a host without uv, this new block makes SYNC_ENV=true whenever the release source has pyproject.toml and uv.lock, but UV_BOOTSTRAP_POLICY is still never unless the user also passed --install-uv. The script therefore exits in ensure_uv_for_sync with uv is required... before reaching the CLI, turning the documented raw automation path into an implicit uv prerequisite; either opt into uv bootstrap for this path or keep the no-uv fallback/require --install-uv in that command.
Useful? React with 👍 / 👎.
| </p> | ||
|
|
||
| **Version:** 4.3.2<br> | ||
| **Version:** 4.3.3<br> |
There was a problem hiding this comment.
This version bump leaves README.md showing 4.3.3 at the top while the generated facts block and ls/docs/_generated/facts.json still report 4.3.2, so the public docs now present two current versions and the generated-doc provenance is stale. Regenerate the docs artifacts/facts or include the generated receipt with the bump.
AGENTS.md reference: AGENTS.md:L101-L101
Useful? React with 👍 / 👎.
| # uv metadata retain the existing dependency-free path. | ||
| if ! "$EXPLICIT_SOURCE_DIR" && "$NON_INTERACTIVE" && ! "$SYNC_ENV" \ | ||
| && [[ -f "$SOURCE_DIR/pyproject.toml" && -f "$SOURCE_DIR/uv.lock" ]]; then | ||
| SYNC_ENV=true |
There was a problem hiding this comment.
When a first managed --non-interactive --yes bootstrap has uv available and the environment needs to be created or updated, setting SYNC_ENV=true here makes sync_uv_environment run before the CLI; that helper captures uv's normal progress output and reprints it to stdout on success, so automation receives human text before the expected JSON. Route the implicit sync output to stderr or suppress it so the documented machine-readable stdout contract remains valid.
Useful? React with 👍 / 👎.
| if ! "$EXPLICIT_SOURCE_DIR" && "$NON_INTERACTIVE" && ! "$SYNC_ENV" \ | ||
| && [[ -f "$SOURCE_DIR/pyproject.toml" && -f "$SOURCE_DIR/uv.lock" ]]; then | ||
| SYNC_ENV=true |
There was a problem hiding this comment.
When ./install --non-interactive --yes is run from a cloned checkout without an explicit --directory, ensure_bootstrap_source returns on the default SOURCE_DIR=. but EXPLICIT_SOURCE_DIR is still false, so this condition also forces uv sync for local source installs. That makes dependency sync non-opt-in for a supported checkout path even though the change is intended for managed release bootstraps; gate this on BOOTSTRAPPED_SOURCE (or otherwise distinguish the default checkout case).
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 45cd9c1144
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "framework_version": "4.3.3", | ||
| "schema_version": 1, | ||
| "source_commit": "4b13df4809569858c6e723aae395fdcbfa328c75", | ||
| "source_commit": "55afd1bcfb912c6582292ecc124fcd52087aab7a", |
There was a problem hiding this comment.
Fresh evidence after the version fields were updated is that the generated artifacts now record source_commit as 55afd1bcfb912c6582292ecc124fcd52087aab7a, but that commit is not an ancestor of the reviewed 5f2d2d44 commit, so a clone containing this single change cannot reproduce or verify the generated docs from the recorded source state. Keep the version/generated-doc refresh in the normal generated sync commit, or regenerate after preserving a reachable source parent, so the provenance points at history that will ship with the PR.
AGENTS.md reference: AGENTS.md:L99-L101
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 00b050be88
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "framework_version": "4.3.3", | ||
| "schema_version": 1, | ||
| "source_commit": "4b13df4809569858c6e723aae395fdcbfa328c75", | ||
| "source_commit": "33cd17937bb626378f180f79a16fa42b4224035e", |
There was a problem hiding this comment.
Fresh evidence in this revision is that facts.json now records source_commit as 33cd17937bb626378f180f79a16fa42b4224035e, but that commit is not an ancestor of the reviewed 3120179368ae1c6ab967b40da5d9b40609571bab commit, so a checkout containing this change cannot reproduce or verify the generated docs from the recorded source state. Keep the version/generated-doc refresh in the normal release-sync/generated-doc sequence, or regenerate after squashing so the recorded source commit is reachable in the PR history.
AGENTS.md reference: AGENTS.md:L101-L101
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a44675a6dc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if "$BOOTSTRAPPED_SOURCE" && "$NON_INTERACTIVE" && ! "$SYNC_ENV" \ | ||
| && [[ -f "$SOURCE_DIR/pyproject.toml" && -f "$SOURCE_DIR/uv.lock" ]]; then | ||
| SYNC_ENV=true |
There was a problem hiding this comment.
When a raw managed --non-interactive --yes bootstrap has uv available and the release source includes pyproject.toml/uv.lock, this new branch runs uv --project "$SOURCE_DIR" sync --locked --no-dev; uv sync --help describes that as updating the project's environment, and Localsetup's dependency code expects that project env at repo_root/.venv. Because .venv is not ignored by this repo (git check-ignore .venv reports not ignored), the first bootstrap leaves the managed source checkout with untracked files, so the next bootstrap reaches refresh_bootstrap_source -> inspect_managed_bootstrap_source and aborts on git status --porcelain --untracked-files=all before it can fetch a newer release. Put the implicit environment in an ignored Localsetup-owned path or ignore .venv before enabling this sync.
Useful? React with 👍 / 👎.
Release-Type: none
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ad1144536f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if subject.startswith(VERSION_SYNC_SUBJECT_PREFIX): | ||
| return git_text(repo_root, ["rev-parse", "HEAD^"]) | ||
| parent = git_text(repo_root, ["rev-parse", "HEAD^"]) | ||
| return generated_docs_source_ref(repo_root, parent) or parent |
There was a problem hiding this comment.
When CI regenerates docs on a merge commit whose second parent is a release-sync commit and that release-sync parent itself follows a docs: refresh generated artifacts commit, this new recursion only fixes the direct-HEAD release-sync case. The merge branch still returns HEAD^2^, so provenance records the generated-docs commit as source_commit instead of the original source commit/tree; apply the same generated_docs_source_ref(...) or parent normalization to the merge release-sync parent path too.
Useful? React with 👍 / 👎.
| .localsetup/ | ||
| localsetup.lock.json | ||
| .codex/skills | ||
| .agents/state/ |
There was a problem hiding this comment.
With .agents/state/ now the private state root, force-staged files there are still not rejected because .githooks/pre-commit only matches the older private paths such as .codex/runs/* and .localsetup-maint/*. In the scenario where an agent or user accidentally runs git add -f .agents/state/..., private ledgers, caches, or run evidence can be committed despite the repo's hook contract; add .agents/state/* to the hook blocklist.
AGENTS.md reference: AGENTS.md:L135-L139
Useful? React with 👍 / 👎.
| LOCAL_DOC_EXCLUDES = { | ||
| ".git", | ||
| ".cache", | ||
| ".agents", |
There was a problem hiding this comment.
Excluding the entire .agents component means _markdown_files() now drops tracked adapter content such as .agents/skills/custom/SKILL.md before it can be classified as a skill. In repos that intentionally keep custom skills under the shared .agents/skills adapter, docs-alignment inventories and generated audit surfaces silently omit those repo-owned files; narrow this exclusion to .agents/state so only the new private ledger root is skipped.
AGENTS.md reference: AGENTS.md:L109-L111
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 67e6b1f0ff
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "source_dirty": false, | ||
| "source_provenance_hash": "46851918572cedc423d1e07d16323b3a00d9003d1717cecdbfadd309c4eb225f", | ||
| "source_root_id": "1ec606400e7e094b4fc26def99af4021f85c43dc713dd72c7cd03de15ff04634", | ||
| "source_commit": "d17cc96b93dbe17cb2016d67f307e29b1df3bdee", |
There was a problem hiding this comment.
Fresh evidence in this commit is that the regenerated facts now record source_commit as d17cc96b93dbe17cb2016d67f307e29b1df3bdee, but git merge-base --is-ancestor d17cc96b93dbe17cb2016d67f307e29b1df3bdee 21d9e1f05e45fca2f066e7ba68c0e076433350be fails, so a checkout containing this PR cannot reproduce or verify the generated docs from the recorded source state. Regenerate the generated/version artifacts after preserving a reachable source parent for this branch so the publish-surface provenance points at history that ships with the PR.
AGENTS.md reference: AGENTS.md:L83-L83
Useful? React with 👍 / 👎.
|
|
||
| ## Location and identity | ||
|
|
||
| Create every new controller ledger at `.agents/state/<task-slug>/ledger.md`. The controller assigns `<task-slug>` once for the Git-bound objective as `<YYYYMMDD-HHMMSS>-<git-short-sha>-<objective-slug>` and every participating agent and tool reuses that exact directory. Task-local evidence, reviews, handoffs, and transient state may live beside `ledger.md`; no agent- or client-specific run root is created. |
There was a problem hiding this comment.
This new location says controller ledgers live in .agents/state/<task-slug>/ledger.md, but the preceding allocation contract still resolves through the client-state registry, and the Codex repo state entry in ls/config/clients.yaml remains .codex/state. In Codex/controller workflows that either sends newly allocated ledgers to the historical client-specific root or forces agents to bypass the sidecar/verification contract described here; update the registry/allocator to return .agents/state for this shared ledger root, or remove the allocation-contract claim.
AGENTS.md reference: AGENTS.md:L125-L127
Useful? React with 👍 / 👎.
| @@ -1 +1 @@ | |||
| 4.3.2 | |||
| 4.3.8 | |||
There was a problem hiding this comment.
For this review range, the base version is 4.3.2 and the only non-release-sync commit is fix: provision managed bootstrap runtime, so the repository's patch-default release policy would target 4.3.3, not 4.3.8. Shipping the direct version surfaces at 4.3.8 skips five patch versions and will publish/tag the wrong release from this PR; rerun the version sync from the reviewed base history instead of carrying over a version from another line of history.
AGENTS.md reference: AGENTS.md:L83-L83
Useful? React with 👍 / 👎.
1 participant
Problem
A managed non-interactive release bootstrap can refresh the managed source before the bare system Python invokes the CLI. On hosts without Localsetup's mandatory Python modules, that invocation fails before package materialization with a dependency-ledger validation error.
Change
pyproject.tomlanduv.lock.--sync-envremains opt-in.--install-uvremediation; the default path neither downloads nor executes uv.uv run, explicit-source no-implicit-sync, and absent-uv no-network behavior.Validation
UV_CACHE_DIR="$PWD/.localsetup-maint/state/uv-cache" uv run --locked pytest ls/tests/test_install_flow_root_installer_bootstrap_a.py -q— 9 passedbash -n installgit diff --checkReview limitation
Native research-subagent spawning was unavailable because this OMP session has task recursion depth
0; no research subagent executed. The controller performed bounded inspection of installer/dependency paths and tests. A stateless review-only completion found no concrete remaining regression, test, security, or reliability finding; it is not a subagent review.