Repository navigation
Feature: Protect catalog generations from shell build start through disposal #145
Description
Outcome
Provide generic catalog/build lifecycle evidence in CShells so an integration can protect the exact catalog generation a candidate shell is about to use before feature construction starts, and keep that protection through failed builds, promotion, old-generation draining and actual disposal.
Existing Foundation elsa-workflows/elsa-foundation#2164 owns the consumer adoption and remaining readability window. Adopt it rather than duplicate Elsa policy. A post-commit catalog-change notification alone does not close a build that read the old snapshot before its first initializer.
Design gate
Inspect catalog commit/build synchronization and lifecycle ordering before choosing the additive API. The lease or build-start hook must establish protection before an old generation can be retired; reporting a generation only after construction is insufficient. Specify cancellation/failure cleanup, snapshot identity, callback/reentrancy behavior and release only on actual generation disposal. No Elsa schema/refusal/readability concepts in CShells; no duplicate assembly-unload work from Foundation #2362.
Acceptance
Use deterministic interleaving barriers: candidate selects old catalog, new catalog commits, every other old pin releases, candidate reaches initializer. The old release remains protected for the entire gap. Also prove failed/cancelled candidate cleanup, successful promotion, overlapping draining generations, actual disposal, and notifications without deadlock or lock-held arbitrary subscriber work. Publish exact preview identity and run Foundation #2164 proof with it. The design gate has passed and the generic primitive is delivered; the separate Foundation consumer proof below remains mandatory.
Program: elsa-workflows/elsa-foundation#2500
Project: https://github.com/orgs/elsa-workflows/projects/58
Current delivery boundary
Upstream task #147 is Done/Passed after normal PR #152 merge and actual Feedz 0.0.30-preview.162 acceptance on .NET8/9/10, including old-snapshot retention before construction and leases through completed provider teardown. Public record: #147 (comment).
The mandatory Foundation #2164 consumer/readability proof is now accepted at merged source 9f09cf8dc78efc611fd99cd90ab1fa70efe709ff; it is additional to the upstream primitive/public consumer proof above. The complete stable acceptance is recorded below.
Stable extraction/adoption acceptance — 2026-10-11
Nuplane 0.0.11 (8 packages, source 32776c18ab8263c2ed7a9112ff58a7f3bcc7ead0) and CShells 0.0.30 (10 packages including CShells.Nuplane, source 789e36cc1cec885d86a48e18b7b51437de519a39) are published and source/archive accepted. Foundation PR #2530 merged at 9f09cf8dc78efc611fd99cd90ab1fa70efe709ff from reviewed head 3a792f3e2544ddc6234732af4d9a7665933425a1: 13 stable pins, 226 reviewed locks and 6 maps.
Final source/runtime acceptance covers fresh-cache locked restore, both actual hosts and 25 archive/runtime DLL comparisons, stable consumer on .NET8/9/10, Ubuntu/Windows backend and frozen demo Acts1/2. Failed qualification38092294855 remains preserved; corrected retry38094631685 passed. Resulting-main acceptance passed CI38096084351 (28 successful jobs; fast14911/0/32, core3748/0/1, architecture431/0/0; passed/failed/skipped, overlapping counts), all provider lanes, Maps38096084105, Packages38096083949, Solution filters38096084024 and Docker38096330720. Both host images published on AMD64/ARM64. Root and independent reviews are retained; unavailable Copilot and optional Greptile are not represented as approvals.
Scoped extraction/adoption milestones M1/M2/M4 and Spec199 T014/T015, Spec201 T016, Spec202 T019 are accepted. Safe pruning #108/M3 remains a separate required later outcome under owner-approved D18; no deletion/unload or settled-readiness custom-registry policy acceptance is implied. The full #2500 goal stays open, and the shared backlog remains parked under ADR0080 D0 without new child work.
Activity
sfmskywalker commentedon Oct 8, 2026
Design gate resolved by the approved contract in child task #147. Root reserved attempted immutable descriptor identity, Begin after successful Compose/name validation before any catalog read, exact detailed snapshot callback before feature construction, reverse unwind and conservative root-registry retention through confirmed provider teardown. Unpublished candidate cleanup preserves primary errors/no extra lifecycle transitions/double disposal; lifecycle/provider failure never releases protection. Framework rooting cannot undo arbitrary participant disposal side effects and does not prove package deletion safety.
#147 is claimed in
/tmp/hosting-cshells-generation, local combined #144/#146 base352a25e, for official Spec Kit 018 and implementation. No second product implementation leaf. See the child acceptance map for deterministic interleavings, fault/GC tests and slow-teardown mutation proof. External review/CI/main/preview and Foundation #2164 adoption remain outstanding.sfmskywalker commentedon Oct 8, 2026
Local implementation complete and root-reviewed: branch
018-shell-generation-build-leases, clean worktree/tmp/hosting-cshells-generation, commit8b22edc49cef02e8879bb669c6d28da181d3a7f5. Implementation claim is released; preserve this unpublished checkout/ref for qualification.Root reviewed production, public contract/docs and failure/race tests. Independent read-only review found no concrete blocker. Worker evidence: 21 focused lease tests; 66 existing focused lifecycle tests; net8/net9/net10 build with zero warnings/errors; whitespace check. Required mutation moved release to early Disposed notification and failed the slow-provider test, then passed after restoration. Generation exhaustion is tested at the pure boundary helper, not by forcing a live slot.
Root rebuilt and ran the complete combined CShells.Tests at the exact final commit: 696 passed, zero failed/skipped, Debug/net10. TRX:
/tmp/hosting-cshells-147-root-results/cshells-147-root.trx. Includes locally combined ownership/catalog prerequisites. Root GC review verified the retention test participant holds only WeakReference and the failed lease survives while Shell/provider collect. Machine load was high; no timing/performance conclusion is claimed.Task #147 and Feature #145 move to In Review. No push/PR, exact-head external CI/review, merge/main, preview release or Foundation adoption has happened. Git/session preference remains pending. No milestone is Done. CShells #148 becomes the only implementation leaf under startup Feature #143; it preserves routing visibility while waiting for activation settlement. Root retains integration/QA, Luna High delegate fallback.
sfmskywalker commentedon Oct 8, 2026
Upstream primitive delivery and public-preview qualification complete. PR #152 merged normally at
0f25bbac71a713cf93af728086ecc7b6517be24bwith source tree exactly equal to reviewed heade463910. Owner Packages run37795690347 passed Release build/test/pack (721 library +31 E2E; zero warnings/errors) and published all nine0.0.30-preview.162packages to Feedz. Root independently verified all nine pipeline/public archive pairs, nuspec versions/source, framework assets and family dependencies.The standalone public Feedz PackageReference consumer passed six generation-lease groups on actual .NET8.0.10/9.0.9/10.0.8: ordered Begin/exact snapshot before construction, old selected snapshot retained after newer commit and other old pins dropping, old/new generation overlap, lease held through blocked provider teardown despite public Disposed state, Begin failure reverse unwind/original error, and snapshot failure reverse unwind/skipped later callbacks. Root recomputed cache/public SHA256 and NuGet SHA512, verified restore source, and compared each actually loaded library to its published archive DLL. No project/assembly substitution. Evidence:
cshells-published-preview-162/andcshells-published-generation-consumer/evidence/20261008T145410Z-AP3utR/root-qualification-verification.json.Current-head external review used the explicitly recorded Program Lead fallback (#152 comment6062500873): all five prior Greptile findings fixed/replied/resolved; root and independent exact-head source reviews had no material finding. Greptile has no fresh score and is not marked passed or approved; Copilot quota was unavailable.
Close #147 for the delivered generic upstream primitive and this preview acceptance. Foundation #2164 consumer/readability proof remains mandatory and unfulfilled, tracked by parent Feature #145 and final qualification #2509; Feature #145 stays open. This preserves the separate adoption requirement and avoids making downstream settlement/runner delivery depend on final adoption that itself needs those primitives. No final release, adapter, actual pruning, Foundation runtime adoption or program completion is claimed. #148 can now be integrated against actual main as the sole next implementation leaf.
sfmskywalker commentedon Oct 8, 2026
Project reconciliation after #147 acceptance and #148 merge: Feature #145 remains open/In Progress with verification Pending specifically for the mandatory Foundation #2164 consumer proof (tracked under final #2509). Its generic upstream primitive is delivered; it is no longer a review assignment. Task #149 has no PR and remains buffered behind #148 public-package acceptance, so its stale In Review/Review Required fields are being corrected to Backlog/Not Ready/Pending. The isolated runner readiness and acceptance-harness preparation do not constitute active product delivery or publication. #148 remains the sole active leaf and owns publication recovery PR #154.
sfmskywalker commentedon Oct 8, 2026
Foundation consumer preparation has started: Foundation #2164 claim and exact scope, organization branch
2339-package-generation-readability, isolated managed worktree. Specification and independent source design review are underway.The native Foundation #2164 prerequisite now names completed CShells tasks #146/#147. Waiting for this coordinating Feature #145 to close would prevent its own required consumer proof. Closed adapter Feature #142 similarly depends on delivered task #147 rather than the outstanding downstream proof. No acceptance criterion was dropped: Feature #145 remains open until final released-family Foundation qualification.
Preview-backed preparation uses the public
.166/.99APIs in a private preflight copy. Final stable pins/locks, actual-host qualification, and acceptance remain outstanding; no premature merge or Done claim. Observer/provider adoption and physical unloading retain their separate Foundation owners.sfmskywalker commentedon Oct 8, 2026
Foundation #2164 prepared consumer source is now published on its organization branch at c021fa591. Public preparation evidence: complete affected readability suite110/110, zero failed/skipped, against actual public CShells .166 / Nuplane .99 in an isolated private copy; four causal product mutations compiled/failed and restored tests passed; exact source/loaded-DLL identity verified. Root and independent pinned review found no product blocker, and the test cleanup finding is fixed/re-reviewed.
This validates the prepared readability consumer of the delivered lease/catalog APIs. It is not stable actual-Foundation-host acceptance: central Foundation pins/locks are unchanged, the source branch is not merged, and T016 remains pending. Feature #145 and Foundation #2164/#2509 stay OPEN. Coordinating Feature closure cannot gate the stable packages its final proof must consume; the separate safe-pruning release requirement remains intact. D15 applies: no Copilot request or Greptile wait, independent self-review/root QA and required automated/behavioral gates.
sfmskywalker commentedon Oct 11, 2026
Scoped extraction/adoption acceptance is complete at Foundation PR #2530 merge9f09cf8dc78efc611fd99cd90ab1fa70efe709ff, using released Nuplane0.0.11 / CShells0.0.30. Final resulting-main evidence and root/independent review passed; stable consumer, actual hosts, backend, demo and release/archive proof are linked in the updated body. This implementation claim is released. Project58 moves to Done / Verification Passed, with agent assignment cleared. Canonical documentation closeout is PR #2627 (separate docs-only CI). M3/#108 safe pruning and full #2500 remain open under D18; no production deployment/store deletion or settled-readiness follow-up is accepted by this closure.