Skip to content

B4: retain deployment identity authority and guard destructive transitions - #262

Open
omry wants to merge 1 commit into
pr260from
pr262
Open

B4: retain deployment identity authority and guard destructive transitions#262
omry wants to merge 1 commit into
pr260from
pr262

Conversation

@omry

@omry omry commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Persist optional identity mapping authority in the existing deployment state under its operation lock. Bind the stable owner and selected directory, compare mapping and generation observations, and preserve mappings through ordinary state writers and retained uninstall staging.

Reject copied authority, mapped installation adoption, unsupported payload execution and destructive replacement or removal before recovery and effects, including missing-target service-name recovery. Keep runtime admission and safe ID release in their later slices.

Validation: full local Go, Python/package, Docker CLI smoke, release and docs checks passed. Two local review rounds resolved one recovery guard omission; fresh independent full review is clean. Guard-removal mutation controls fail as expected.

@omry
omry changed the base branch from main to pr260 October 20, 2026 20:18
@omry
omry added this pull request to stack #238 October 20, 2026 20:19
@omry

omry commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:60e3bdab79b8e83cbef3d64431b52894a42973943e66d0c56cb1413095eb6d77",
    "evidence": {
      "attestations": [
        {
          "baseline_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "closure_identity": "sha256:0eaaf0db73c39fd558a56215c2e59ba4249cab5e8e00fb8ca9aba738aa7b2f04",
          "document_identity": "sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3",
          "sidecar_identity": "sha256:910ae8592f9403854e0c50729d98debd2191e6eee0485737e794b5943f41fd96"
        },
        {
          "baseline_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "closure_identity": "sha256:0eaaf0db73c39fd558a56215c2e59ba4249cab5e8e00fb8ca9aba738aa7b2f04",
          "document_identity": "sha256:c8ca7d8f385155803a90f41ebb4a8adfc47a5cdd07e7d2a38220751dda6cf1d3",
          "sidecar_identity": "sha256:924d3f1f4fb4456c599058b4211f40761550a7339ec45a758a3aad6b56d9c817"
        },
        {
          "closure_identity": "sha256:0eaaf0db73c39fd558a56215c2e59ba4249cab5e8e00fb8ca9aba738aa7b2f04",
          "document_identity": "sha256:5ae48f5e53cefe5f5486b78467f607b47d63c2b693be7ac5d570d4eacdc5050a",
          "sidecar_identity": "sha256:3cffe0cc33f4d844e020bd417a724ad0a1b03f9598b00e0934cd6ce39a8a9c6f"
        }
      ],
      "candidate_revision_fingerprint": "sha256:60e3bdab79b8e83cbef3d64431b52894a42973943e66d0c56cb1413095eb6d77",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 119004820649
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118999908081
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 118999917328
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118999917568
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118999917667
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118999917556
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118999917636
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118999917578
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118999917438
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:d7b1888b27e1d0f2dc9bd260272c82b7abaed3f33571ce80bdc153edae9d2146",
      "finding_dispositions_digest": "sha256:09ea72738afac472f4a7a80b20cd28b836e37578c47af3f9fd5a73361a173d7e",
      "operation_identity": "sha256:8601dd03f518ce35e5dcbd67b26972c726b4f24e57cfa09da18ea93edcb94ba3",
      "review_request": {
        "body_digest": "sha256:9d4924cd1a958e6c3f24cc8886f1dcfaf81e94b284815ccb9876c93af40b6cf1",
        "id": 6314387458
      },
      "review_result": {
        "body_digest": "sha256:136c322f3c0ef7cf0247c883b55604d08a80424207d8ba8beb31d938d57b5842",
        "id": 6314432936
      }
    },
    "evidence_fingerprint": "sha256:761454f628b564943606c08bee44f40015764c255fc577d4b5764dd423c59062",
    "head_sha": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
    "operation_identity": "sha256:8601dd03f518ce35e5dcbd67b26972c726b4f24e57cfa09da18ea93edcb94ba3",
    "review_request_id": 6314387458,
    "review_result_id": 6314432936,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:60e3bdab79b8e83cbef3d64431b52894a42973943e66d0c56cb1413095eb6d77",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "Bash native evidence checks",
      "run_id": 119004820649
    },
    {
      "conclusion": "SUCCESS",
      "name": "Gitar",
      "run_id": 118999908081
    },
    {
      "conclusion": "SUCCESS",
      "name": "Linux CI checks",
      "run_id": 118999917328
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-amd64)",
      "run_id": 118999917568
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (darwin-arm64)",
      "run_id": 118999917667
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-amd64)",
      "run_id": 118999917556
    },
    {
      "conclusion": "SUCCESS",
      "name": "Target smoke (linux-arm64)",
      "run_id": 118999917636
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-amd64)",
      "run_id": 118999917578
    },
    {
      "conclusion": "SUCCESS",
      "name": "Windows host smoke (windows-arm64)",
      "run_id": 118999917438
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "Bash native evidence checks",
          "run_id": 119004820649,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/119004820649"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118999908081,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/118999908081"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 118999917328,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/118999917328"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118999917568,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/118999917568"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118999917667,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/118999917667"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118999917556,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/118999917556"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118999917636,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/118999917636"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118999917578,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/118999917578"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118999917438,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39532029426/job/118999917438"
        }
      ],
      "head_sha": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "id": "sha256:4556fae366137dde8ea2e589f5ac93fd3b308f4e9ceb400030326ed349aeee9f",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "success"
    },
    {
      "checks": [
        {
          "name": "Bash native evidence checks",
          "reason": "missing",
          "status": "pending"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118866212010,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/118866212010"
        },
        {
          "name": "Linux CI checks",
          "run_id": 118863091014,
          "run_status": "in_progress",
          "status": "pending",
          "url": "https://github.com/omry/reploy/actions/runs/39490787428/job/118863091014"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118863091388,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39490787428/job/118863091388"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118863091248,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39490787428/job/118863091248"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118863091501,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39490787428/job/118863091501"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118863092594,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39490787428/job/118863092594"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118863091342,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/39490787428/job/118863091342"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118863091366,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/39490787428/job/118863091366"
        }
      ],
      "head_sha": "5934f59711cf541c4c71889697338aa471a8789a",
      "id": "sha256:511aada6e0abb416bfde5bd6d276e9b35305354f2bbf1667fd235614d621bd33",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "failure"
    },
    {
      "checks": [
        {
          "conclusion": "SKIPPED",
          "name": "Bash native evidence checks",
          "run_id": 118984934891,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118984934891"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Gitar",
          "run_id": 118981433353,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/runs/118981433353"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Linux CI checks",
          "run_id": 118979864056,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118979864056"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-amd64)",
          "run_id": 118979864332,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118979864332"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (darwin-arm64)",
          "run_id": 118979864679,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118979864679"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-amd64)",
          "run_id": 118979864320,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118979864320"
        },
        {
          "conclusion": "SUCCESS",
          "name": "Target smoke (linux-arm64)",
          "run_id": 118979864419,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118979864419"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-amd64)",
          "run_id": 118979864276,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118979864276"
        },
        {
          "conclusion": "FAILURE",
          "name": "Windows host smoke (windows-arm64)",
          "run_id": 118979864295,
          "run_status": "completed",
          "status": "failure",
          "url": "https://github.com/omry/reploy/actions/runs/39525750624/job/118979864295"
        }
      ],
      "head_sha": "6d0327f482036df83acf37863a19f4032afaa5e4",
      "id": "sha256:ff7c57192cc96f559590a0c17e9054712a5faae40e8e8ea5e25a9274519de37c",
      "required_checks": [
        "Bash native evidence checks",
        "Gitar",
        "Linux CI checks",
        "Target smoke (darwin-amd64)",
        "Target smoke (darwin-arm64)",
        "Target smoke (linux-amd64)",
        "Target smoke (linux-arm64)",
        "Windows host smoke (windows-amd64)",
        "Windows host smoke (windows-arm64)"
      ],
      "status": "failure"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:d7b1888b27e1d0f2dc9bd260272c82b7abaed3f33571ce80bdc153edae9d2146",
  "delivery_deferrals": [
    {
      "disposition": "future-enhancement",
      "evidence": [
        "https://github.com/omry/reploy/pull/262#discussion_r4334688476",
        "temp/reviews/multi-identity-composition-replan-20261016/future-installation-log-decision.md"
      ],
      "id": "B4-INSTALLATION-RECOVERY-LOG-FUTURE",
      "scope": "Separate future design; not a B4/B5 requirement or an approved central registry implementation.",
      "status": "deferred",
      "summary": "Consider separate per-user and system installation inventory/recovery logs for listing, management and loss of deployment directories."
    },
    {
      "disposition": "separate-production-follow-up",
      "evidence": [
        "temp/reviews/multi-identity-b4-windows-hardlink-permissions.md",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-corrected-windows-amd64-job.log",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/windows-go12512-metadata-and-remove-source.txt",
        "https://learn.microsoft.com/en-ca/windows/win32/fileio/hard-links-and-junctions"
      ],
      "id": "B4-WINDOWS-STORE-READONLY-FOLLOWUP",
      "rationale": "Keep this probable existing production issue explicit. The current B4 correction fixes metadata observation and retains mode assertions; it does not repair read-only publication. Confirm via handle metadata and deliver a separately reviewed bounded fix.",
      "scope": "Existing Windows provider-store publication/cleanup; outside B4 identity-retention implementation.",
      "status": "deferred",
      "summary": "Windows provider-store temporary-hardlink cleanup may clear the retained object read-only attribute."
    }
  ],
  "findings": [
    {
      "disposition": "fixed",
      "evidence": [
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-windows-amd64-job.log",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-windows-arm64-job.log",
        "internal/dockerdeploy/provider_uninstall_pending_remove.go:326",
        "internal/deploy/operation_directory_isolation_windows.go:34",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-corrected-windows-amd64-job.log",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-correction-apply-result.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-corrected-current-local-review.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round02-proposed-observer-fix-plan.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round03-required-checks.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round03-complete-local-validation-proof.json"
      ],
      "id": "B4-CI-WIN-1",
      "invariant": "Ordinary unmapped pending removal must still work; mapped or unknown authority must reject before effects.",
      "proposed_paths": [
        "internal/dockerdeploy/provider_uninstall_pending_remove.go",
        "internal/dockerdeploy/provider_uninstall_pending_remove_test.go"
      ],
      "recommended_follow_up": "Correct Windows handle lifetime using existing checked primitives; keep the retained-identity guard.",
      "severity": "high",
      "source": "exact-head Windows amd64/arm64 CI",
      "status": "resolved",
      "summary": "Finalizer keeps new operation/state-root handles open during .reploy move; Windows rejects ordinary uninstall finalization with Access is denied."
    },
    {
      "disposition": "fixed",
      "evidence": [
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-windows-amd64-job.log",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-windows-arm64-job.log",
        "internal/dockerdeploy/identity_mapping_retention_test.go:79",
        "internal/dockerdeploy/identity_mapping_guard_test.go:77",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-corrected-windows-amd64-job.log",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-correction-apply-result.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round01-corrected-current-local-review.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round02-proposed-observer-fix-plan.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round03-required-checks.json",
        "/home/omry/.local/state/awd/runs/run_5264d4q69yfwmwbtsnrnw1b58z/evidence/caller-recovery/pr262-8f410c2b70fe7308e61ad7622568277d548514ab28139ca4b18e99bd73cb12d8/round03-complete-local-validation-proof.json"
      ],
      "id": "B4-CI-WIN-2",
      "invariant": "Rejected operations must preserve authority/data/metadata; do not weaken assertions without proof.",
      "proposed_paths": [
        "internal/dockerdeploy/identity_mapping_retention_test.go",
        "internal/dockerdeploy/identity_mapping_guard_test.go"
      ],
      "recommended_follow_up": "Retain bounded per-path before/after diagnostics, identify actual mutation or observation cause, then fix while preserving content/owner/mode/data checks.",
      "severity": "medium",
      "source": "exact-head Windows amd64/arm64 CI",
      "status": "resolved",
      "summary": "Retained-state rejection tests report filesystem snapshot differences on Windows; exact changed paths and fields are not yet diagnosed."
    },
    {
      "disposition": "future-enhancement",
      "evidence": [
        "https://github.com/omry/reploy/pull/262#discussion_r4332512729",
        "internal/dockerdeploy/provider_uninstall_recovery.go:168",
        "internal/dockerdeploy/provider_install_systemd.go:83",
        "internal/deploy/identity_mapping_state_file.go:109",
        "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md:153",
        "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md:430",
        "/tmp/reploy-b4-missing-directory-recovery-decision.md"
      ],
      "id": 4332512729,
      "invariant": "Preserve retained mapping authority before destructive effects while keeping ordinary absent-state recovery behavior unchanged.",
      "rationale": "The maintainer deferred central installation recovery logs; current mapped installation creation and execution remain blocked. Preserve ordinary missing-directory cleanup and all surviving retained-state guards. No underlying deletion recovery fix is claimed.",
      "recommended_follow_up": "Align the boundary between preserving existing service-only recovery and requiring durable mapping classification before mapped installation support. No fix or rejection has been claimed.",
      "rejection_evidence": [
        "https://github.com/omry/reploy/pull/262#discussion_r4334688476"
      ],
      "severity": "high",
      "source": "https://github.com/omry/reploy/pull/262#discussion_r4332512729",
      "status": "non-actionable",
      "summary": "Service-name recovery with no retained directory cannot distinguish a deleted mapped installation from an ordinary deleted installation.",
      "thread_id": "PRRT_kwDOTFQCkM6umruL"
    }
  ],
  "pr": {
    "base_ref": "pr260",
    "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
    "body_digest": "sha256:ac970ae380b0e12a086ff22bef3045c63637df9c2bb3f14ae2b6582a27d3bb0b",
    "diff_digest": "sha256:c0981dfb9f774ba5632592e5179f77b0dfacfcd8b03381cc548f7aba0665d127",
    "head_ref": "pr262",
    "head_sha": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
    "pr": 262,
    "repository": "omry/reploy",
    "scope_authority": [
      {
        "digest": "sha256:7a1e2cb93f4520c6fffee4a59c75752ced2122d80b5a6449f486bc041772028d",
        "path": "docs/MULTI_IDENTITY_IMPLEMENTATION_PLAN.md"
      },
      {
        "digest": "sha256:6a488c15200d8d9cf56286855c2480cea4f78141f74584b2914ee23327174f16",
        "path": "docs/MULTI_IDENTITY_SECURITY_CONTRACT.md"
      },
      {
        "digest": "sha256:ebe0056f710b463b04662bf97917d26f3a8fafc5864b75079bf7077e2c91bdae",
        "path": "tools/conformance/multiidentity/READINESS.md"
      }
    ],
    "title_digest": "sha256:0a081b53157a2d56a998db4aa352e0c6905b596349c0be4d007703c9e0eeacd9"
  },
  "record_version": 12,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-20T20:18:03Z",
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:11fc872e6826a0fa42e23a228882fbb043022491fd52758d773bfd332c1eb860",
      "created_at": "2026-10-20T20:28:34Z",
      "head_sha": "5934f59711cf541c4c71889697338aa471a8789a",
      "id": 6300768292,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-20T20:18:03Z",
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:c767e7705820e127ee35ced5ae4ea2b3a50416b6c0b1bce7024f7a30022da460",
      "created_at": "2026-10-21T01:28:11Z",
      "head_sha": "6d0327f482036df83acf37863a19f4032afaa5e4",
      "id": 6305737140,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-20T20:18:03Z",
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:9d4924cd1a958e6c3f24cc8886f1dcfaf81e94b284815ccb9876c93af40b6cf1",
      "created_at": "2026-10-21T02:44:02Z",
      "head_sha": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "id": 6306707267,
      "kind": "regular-review"
    },
    {
      "base_established_at": "2026-10-20T20:18:03Z",
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:9d4924cd1a958e6c3f24cc8886f1dcfaf81e94b284815ccb9876c93af40b6cf1",
      "created_at": "2026-10-21T11:05:05Z",
      "head_sha": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "id": 6314387458,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:f3c8586a3b7ce95fad187690885b6a5c3bfd9d75ae68cda63e0c23075ffed724",
      "commit_id": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "id": 5594348613,
      "inline_message_ids": [
        4332512729
      ],
      "request_comment_id": 6306707267,
      "result_kind": "findings",
      "status": "result",
      "submitted_at": "2026-10-21T02:46:42Z",
      "unresolved_thread_ids": [
        "PRRT_kwDOTFQCkM6umruL"
      ]
    },
    {
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:78ce35ab003feb453be02ff8c986fc29bcc9689bfd515656ae1f23e5589824f0",
      "commit_id": "5934f59711cf541c4c71889697338aa471a8789a",
      "id": 6300831805,
      "inline_message_ids": [],
      "request_comment_id": 6300768292,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-20T20:31:48Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:ef1924e9ab23d9aa04c45c4e780790439c640ebead58cda3ab8fcc1cb656a0b6",
      "commit_id": "6d0327f482036df83acf37863a19f4032afaa5e4",
      "id": 6305783787,
      "inline_message_ids": [],
      "request_comment_id": 6305737140,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-21T01:31:53Z",
      "unresolved_thread_ids": []
    },
    {
      "base_ref": "pr260",
      "base_sha": "ba972bc696053a70fad71c66657ae59a31689dd6",
      "body_digest": "sha256:136c322f3c0ef7cf0247c883b55604d08a80424207d8ba8beb31d938d57b5842",
      "commit_id": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "id": 6314432936,
      "inline_message_ids": [],
      "request_comment_id": 6314387458,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-21T11:07:35Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:60e3bdab79b8e83cbef3d64431b52894a42973943e66d0c56cb1413095eb6d77",
  "rounds": [
    {
      "applied_fix_paths": [
        "internal/dockerdeploy/identity_mapping_retention_test.go",
        "internal/dockerdeploy/provider_uninstall_pending_remove.go"
      ],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:7c5ccd03114a0bc6c8fdce8235cb84a4659ff8bd740f7f0beaca808ab35e2fc0",
      "finding_ids": [
        "B4-CI-WIN-1",
        "B4-CI-WIN-2"
      ],
      "invariants": [
        "Retained identity presence, malformed or foreign authority rejects destruction before effects.",
        "Ordinary unmapped installed pending cleanup remains available on every host platform.",
        "Rejected operations preserve all retained file contents and metadata."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "internal/dockerdeploy/identity_mapping_retention_test.go",
        "internal/dockerdeploy/provider_uninstall_pending_remove.go"
      ],
      "resulting_head": "6d0327f482036df83acf37863a19f4032afaa5e4",
      "review_observation_id": null,
      "review_request_id": 6300768292,
      "review_result_id": 6300831805,
      "reviewed_head": "5934f59711cf541c4c71889697338aa471a8789a",
      "root_cause": "Windows cannot move pending .reploy while the new finalizer holds file/root handles. The bounded correction closes them only after ordinary installed authority validation, and preserves all mapping guards. A separate Windows snapshot difference remains undiagnosed; strict assertions now report bounded per-path metadata/hash differences. No claim that diagnostics fix that issue.",
      "round": 1,
      "unresolved_current_slice_findings": 2,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [
        "internal/dockerdeploy/identity_mapping_guard_test.go",
        "internal/dockerdeploy/identity_mapping_retention_test.go"
      ],
      "disposition_changes": [
        "B4-CI-WIN-1"
      ],
      "effective_diff_digest": "sha256:c0981dfb9f774ba5632592e5179f77b0dfacfcd8b03381cc548f7aba0665d127",
      "finding_ids": [
        "B4-CI-WIN-1",
        "B4-CI-WIN-2"
      ],
      "invariants": [
        "Retained identity guards reject before destructive or workload effects.",
        "Ordinary pending finalization remains available on Windows.",
        "Snapshot comparison uses actual mode/owner/time/content and still detects genuine mode changes."
      ],
      "outcome": "corrected-head-needs-review",
      "proposed_fix_paths": [
        "internal/dockerdeploy/identity_mapping_guard_test.go",
        "internal/dockerdeploy/identity_mapping_retention_test.go"
      ],
      "resulting_head": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "review_observation_id": null,
      "review_request_id": 6305737140,
      "review_result_id": 6305783787,
      "reviewed_head": "6d0327f482036df83acf37863a19f4032afaa5e4",
      "root_cause": "Windows confirmed the prior handle-lifetime correction. The remaining failures compared stale NTFS hardlink directory attributes before a read with refreshed attributes afterward. The corrected observer uses actual File.Stat metadata and reads bytes through the same handle, retaining every exact field and locked-file check. Repeated-observation and real-mode-change controls pass locally. This is a test observation truth fix; the separate probable Windows store read-only publication issue remains explicitly deferred. Current fresh Windows/review approval is still required.",
      "round": 2,
      "unresolved_current_slice_findings": 1,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [
        4332512729
      ],
      "effective_diff_digest": "sha256:c0981dfb9f774ba5632592e5179f77b0dfacfcd8b03381cc548f7aba0665d127",
      "finding_ids": [
        4332512729
      ],
      "invariants": [
        "Retained identity authority inhibits destructive effects; existing tombstone/control checks remain unchanged.",
        "Ordinary missing-directory service cleanup remains available and does not allocate/release host IDs, change ownership or remove persistent volumes.",
        "Mapped installation creation/publication and mapped payload execution remain blocked until their reviewed later adapters."
      ],
      "outcome": "same-head-needs-retry",
      "proposed_fix_paths": [],
      "resulting_head": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "review_observation_id": null,
      "review_request_id": 6306707267,
      "review_result_id": 5594348613,
      "reviewed_head": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "root_cause": "The finding concerns loss of all deployment-local metadata after manual directory deletion. The maintainer deferred a central installation recovery log as a future enhancement outside B4/B5. The exact review thread now contains the verified owner response and is resolved. The finding is durably non-actionable for this slice with original diagnostics retained and separate rejection_evidence. No source fix is claimed; close this finding-bearing round and request a fresh regular review at the unchanged head before approval.",
      "round": 3,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    },
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:c0981dfb9f774ba5632592e5179f77b0dfacfcd8b03381cc548f7aba0665d127",
      "finding_ids": [],
      "invariants": [
        "Retained identity authority inhibits destructive effects; existing tombstone/control checks remain unchanged.",
        "Ordinary missing-directory service cleanup remains available and does not allocate/release host IDs, change ownership or remove persistent volumes.",
        "Mapped installation creation/publication and mapped payload execution remain blocked until their reviewed later adapters."
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "review_observation_id": null,
      "review_request_id": 6314387458,
      "review_result_id": 6314432936,
      "reviewed_head": "faa6a81690b1f06d8c988d8460f9ac76cd3e6ecc",
      "root_cause": "Fresh regular Codex review at exact unchanged FAA is clean after the prior finding was explicitly classified non-actionable by the maintainer. Every selected current-head CI check is successful and fresh complete local validation passed. No further code correction is required. Existing retained-state guards and mapped-installation/runtime inhibition are unchanged. The general installation recovery log and Windows store read-only issue remain explicit separate deferrals.",
      "round": 4,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 20, 2026 20:26
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-21T11:07:36.301049Z faa6a81 Manual request
🔒 Security Review ✅ Completed 2026-10-20T20:30:15.124325Z 5934f59 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 20, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review 5934f59

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 20, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🚀

Reviewed commit: 5934f59711

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry

omry commented Oct 21, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review 6d0327f

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 21, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 6d0327f482

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry
B4: retain deployment identity authority and guard destructive transi…
faa6a81 
…tions

Persist optional identity mapping authority in the existing deployment state under its operation lock. Bind the stable owner and selected directory, compare mapping and generation observations, and preserve mappings through ordinary state writers and retained uninstall staging.

Reject copied authority, mapped installation adoption, unsupported payload execution and destructive replacement or removal before recovery and effects, including missing-target service-name recovery. Keep runtime admission and safe ID release in their later slices.

Validation: full local Go, Python/package, Docker CLI smoke, release and docs checks passed. Two local review rounds resolved one recovery guard omission; fresh independent full review is clean. Guard-removal mutation controls fail as expected.
@gitar-bot

gitar-bot Bot commented Oct 21, 2026

Copy link
Copy Markdown
Code Review ✅ Approved

🔴 High risk · Retained UID/GID authority and uninstall/replacement guards alter destructive-operation authorization; a bypass could discard mappings still protecting host IDs.

Persists optional identity mapping authority in the existing deployment state under its operation lock, binding the stable owner and selected directory and guarding destructive replacement and removal paths. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

For more verification details, comment gitar display:verbose.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply Compact 
gitar auto-apply:on         

gitar display:verbose

Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source

@omry

omry commented Oct 21, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review faa6a81

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 21, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: faa6a81690

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread internal/dockerdeploy/provider_uninstall_recovery.go
@omry

omry commented Oct 21, 2026

Copy link
Copy Markdown
Owner Author

@codex, regular review faa6a81

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 21, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: faa6a81690

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved PR reviewed and approved label Oct 21, 2026
@omry omry mentioned this pull request Oct 21, 2026
Open

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments

Assignees

No one assigned

Labels

approved PR reviewed and approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry