Repository navigation
Conversation
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0cacb9a073
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Stop --recover releases the processes, databases and roles of a run whose supervisor is lost, signalling a recorded process group only while its leader's start time matches the one recorded at start. Every rstack dev refusal or failure now prints registry.rstack.error.v1 with a class (domain, usage, operational) and, for runs needing attention, the run ID and recovery facts. Operational failures exit 3. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
`rstack dev check` now renders each binding fragment with the code `start` uses and validates it with BReg's review-authority reader and Casework's context-binding checks, so a configuration a product would refuse fails before `start` provisions anything. Refusals name the plan field that produced the value. The runner no longer restates the resource and scope rules the readers own, and `check` compares the Casework status profile with the context provider's service-status profile instead of leaving it to Casework start. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
…eaks PostgreSQL's base64 encode breaks its output every 76 characters. The record read and history migration projections pass that text through unchanged, so reading an encrypted value whose envelope exceeds 57 bytes failed with source.unavailable. Row decode now drops the line breaks, which covers every projection that feeds it. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
`rstack dev` no longer refuses a BReg project with encrypted fields. `start` draws a data key for the run with BReg's key generator, owner-only in the owner-only run directory, and configures BReg's local-file key custody to read it by reference. The key never reaches output, the plan, the error envelope or the checkout, and goes with the run directory on stop, TTL expiry, a failed start and `stop --recover`. A run that needs recovery names the key file in `recovery.field_encryption_key`. Environment failures now report the operational class (exit 3): an unreachable PostgreSQL server or refused administrator session, failed provisioning, an unreadable CA file, a product process that cannot be started, and no free loopback port. The worker carries the class to the supervisor. Project and plan refusals stay domain (exit 1). The admin connection deadline is tested against a server that accepts and never answers, for the first connection and the cleanup reconnection, and the large-plan test starts through the supervisor instead of writing the worker input by hand. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
…jection Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Add "Run a project with rstack dev" under configure/: install the components, start a local TLS PostgreSQL server, adapt the licensing dev.yaml, check, start, call both products with a development token, stop, and recover a failed run. Register it in the Operations sidebar group, link it from PROJECT-DEV.md, and link it from the rstack dev command help so the generated CLI reference carries the link. The regenerated crates/registry-cli-docs/catalog.json also picks up `stop --recover` and `--database-url`, which the earlier command change had not regenerated. Closes #2641 Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
… link `rstack dev check` linked registry-casework-breg into bregctl to run Casework's context-binding reader in process, which breaks the rule that BReg tooling never depends on a Casework crate. The dependency-direction gate already refuses that closure. Casework now refuses an invalid `contextProviders` binding in its own offline check, at the member and naming the rule, through the same validation provider construction runs (including the HTTPS base URL and the delegated display exchange). `rstack dev check` renders the Casework configuration the run writes, runs `caseworkctl check --runtime-config` on it, and reports a refusal at the plan field that produced the member. A refusal it cannot attribute to the binding is reported as an operational failure rather than a pass. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
`rstack dev check` reported a refused review authority binding as "runtime configuration contains an invalid deployment binding", so a developer saw the plan field but not the rule. `check_review_authority` now returns the rule each check states (the endpoint suffixes, the profile and producer ID grammar, the absolute resource and assertion audience URIs, and the shared OAuth scope limits), never the value. The runtime keeps its existing refusal. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
… as usage A run that misses a readiness or start deadline, or whose supervisor panics, failed in the environment, so the envelope now says operational (exit 3) instead of domain. An interrupted start stays domain: the operator asked for it. A malformed run ID, --ttl value or test person name is refused from the command line alone, before any project or run state is read, so it is usage (exit 2). start now checks --ttl before loading the project, so a bad value is reported as such rather than as a missing dev.yaml. A well-formed run ID that names no run is unchanged. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
…pts and hosts remove_run_dir deletes the run's field-encryption key before it renames the run directory away, so a deletion that is interrupted leaves a .removing directory without key material for the operator to delete. ps reports start times in the host's time zone, and recovery compares them with the times a run recorded. Reading them with TZ=UTC beside LC_ALL=C keeps that comparison independent of the caller's environment. The run's key-writing refusal now names the key generator's reason, which carries no key material, instead of a fixed message. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
…changelogs The platform changelog names what rstack dev gained before its first release: stop --recover, the registry.rstack.error.v1 envelope with its three classes and exit codes, and a per-run key for projects with encrypted fields. The BReg entry for the long-envelope fix is rewrapped and names the history journal capture of reviewed migrations, which reads through the same decoder. The field-encryption flip test now seals values whose envelopes PostgreSQL wraps, so that path is covered. The PostGIS provisioning test also checks that the bbox role batch keeps the SQLSTATE of a refused statement. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
… its cause Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
An interrupt during the Casework inspection in rstack dev start or check became an unavailable inspection, so it reported the operational class. An interrupt is the operator's request and reports as domain, as an interrupted start does. Only other inspection failures become InspectionUnavailable, with their cause in the reason. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
jeremi
force-pushed
the
fix/rstack-dev-followups
branch
from
November 11, 2026 08:36
5c89596 to
06e364a
Compare
jeremi
enabled auto-merge
November 11, 2026 09:32
cargo deny refuses rustix 1.1.5: its xattr functions mark unwritten bytes as initialized when given a zero-length buffer. Only the rustix entry and its references change. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
…scope The configuration conventions check refuses an unregistered schema under products/*/schemas. The rstack error report is a command output, not a configuration format. Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups to
rstack dev(#2635, #2637) before its first release, plus a BReg read fix found on the way.rstack dev
stop RUN_ID --recoverwaits for the run’s process guards, releases its databases and roles on the original PostgreSQL cluster and maintenance database, and removes the run directory.start,status,tokenandstopuse theregistry.rstack.error.v1envelope. A failed journey exits 1 with the regular run report and leaves the run available for inspection.domain(exit 1): project, plan or run state refused.usage(exit 2): a malformed run ID,--ttlor test person name, refused from the command line alone.operational(exit 3): unreachable PostgreSQL, failed provisioning, deadlines, a supervisor panic.checkvalidates binding fragments with the products' own readers, so a configuration a product would refuse fails beforestartprovisions anything, at the plan field that produced it:registry_breg::runtime_config, now naming the rule each check states, never the value.caseworkctl check --runtime-configon the configuration the run writes. bregctl does not link a Casework crate, so the dependency-direction gate holds. Casework's offline check gains the rulecasework.runtime.invalid-context-provider.--recover.PROJECT-DEV.mdand from the command help.BReg
encode(..., 'base64')breaks lines every 76 characters. Row decode now drops the line breaks. Before this, reading an encrypted value whose envelope exceeds 57 bytes failed withsource.unavailable, through every read projection and the history journal capture of reviewed migrations. This affects released versions from v0.33.0 through v0.46.0. Tests cover each projection and the field-encryption flip migration with wrapped envelopes.42501), including the bbox role batch.Not in this PR
bregctl test's schema-test runtime cannot run a project with encrypted fields. Filed separately.rstackstays inunreviewed_binariesincli-reference.yaml, so its generated CLI reference page remains a draft until someone reviews it.Checks run locally (macOS)
cargo fmt --all --checkcommit_guard.rs,postgres_migration.rstype_complexity)project_devpostgres_field_encryptionpostgres_migrationproducts/platform/scripts/test-rstack-dev.pyagainst PostgreSQL 18npm run check--spatialwas not run: the local PostgreSQL has no PostGIS.Closes #2639
Closes #2640
Closes #2641
Closes #2642