Skip to content

generate: runnable-bindings materializes pinned modules, so --check can run on a fresh checkout - #1208

Closed
antoinetoussaint-byte wants to merge 3 commits into
mainfrom
generate/runnable-bindings-materializes-pins
Closed

antoinetoussaint-byte wants to merge 3 commits into
mainfrom
generate/runnable-bindings-materializes-pins

Conversation

@antoinetoussaint-byte

@antoinetoussaint-byte antoinetoussaint-byte commented Oct 27, 2026 •

Copy link
Copy Markdown
Contributor

What

codefly generate runnable-bindings loads the workspace with common.LoadWorkspaceWithPinnedModules instead of common.LoadWorkspace — the same thing a run, a render and generate fixture-composition already do. ~6 hand-written lines.

Why

--check is the only drift check the runnable-bindings group has, and it could never run where drift is caught. On real obin-ai/platform-obin main (694ac3f4), from a fresh checkout, codefly generate runnable-bindings --env blue --check refused before reading anything:

module resolves to a pinned artifact … pinned modules are pulled by the CLI, not loadable as a local checkout

With this change it reaches regeneration and refuses with the composition's real contradiction instead:

--call-endpoint "saas/auth-gateway/hop": service saas/auth-gateway declares no endpoint hop (it declares [grpc rest workload])

— the saas pin has no hop endpoint yet, the same fact the owner saw as the render's hop/ENDPOINT … the producer declares no such endpoint refusal.

Provenance

This is the first commit of the stale-generated-output work, diagnosed and proven by the agent who owned it before the one-agent-per-repo reorganisation (handoff in the coordinator's scratchpad). It is opened here on its own, rebased onto current main, because it is a fix at the owner, independently proven, and small. The larger branch it came from (#1202) has since had unrelated publish and stop work piled onto it and is conflicting; this slice should not wait on that.

Evidence

go test ./cmd/generate/ -run 'Runnable|Decline' green; golangci-lint run ./cmd/generate/... clean.

Not in this PR

The generic refuse-stale-generated-output gate (doctor comparing committed generated groups against a fresh generation by value, not by key name; today checkRunnableBindingsGroup is green-about-a-name and skipped for --module documents). Design is written in the handoff; it follows v0.1.220.

🤖 Generated with Claude Code

Docs (same PR, from the review)

docs/commands.md: the --check flag row now says writes no binding output and that, like every command reading composed modules, it materializes a pinned module first (cache, overlay, receipt, .gitignore); generate runnable-bindings and generate fixture-composition are added to "Which commands materialize". docs/runnable.md: "a failed preparation writes nothing" narrowed the same way. The --check flag help in cmd/generate/runnable_bindings.go corrected, docs/cli-reference.md regenerated.

Relation to #1209

The code change here (1fac1a7c) is the first commit of #1209's stack. This PR stays open as the slice's docs carrier and merges after #1209: rebased onto it, the duplicate code commit drops and what remains is the docs and flag-help correction above, which #1209 does not carry (its head is the reviewed SHA and is not edited).

…eck can run on a fresh checkout

`codefly generate runnable-bindings` walks every composed module for its
derived operations, but loaded the workspace with the plain loader. On a
composition of pinned modules with no codefly.local.yaml — a CI job, or any
fresh checkout — it refused before reading anything:

  module <wiki> resolves to a pinned artifact (source "obin-ai/core-solutions",
  version "0a18964f…"); pinned modules are pulled by the CLI, not loadable as a
  local checkout

so `--check`, the one drift check this generated group has, could not be run
where drift is caught. The command now materializes pinned modules first,
exactly as `codefly run`, `deploy gitops render` and `generate
fixture-composition` do (common.LoadWorkspaceWithPinnedModules), and is free
once the workspace is materialized.

Verified on obin-ai/platform-obin main (694ac3f4), environment blue: before,
the refusal above; after, the check reaches the regeneration and refuses with
the composition's real contradiction — `--call-endpoint "saas/auth-gateway/hop":
service saas/auth-gateway declares no endpoint hop (it declares [grpc rest
workload])` — while the committed configurations/blue/runnable-bindings.env
binds 17 operations to their owners' direct in-cluster addresses, two of them
on module compute, which the composition does not compose.

First slice of making render and deploy refuse committed generated output that
no longer matches what the generator would produce; the generic check on the
readiness gate follows (see the handoff).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
antoinetoussaint-byte and others added 2 commits October 27, 2026 19:41
…ned module is not writing output

The review's finding: `docs/commands.md` promised `--check` "writes nothing",
and the loader now materializes a pinned module first — dependency cache,
overlay, receipt and `.gitignore` entries — as every command that reads
composed modules does. The promise is narrowed to what it always meant, the
binding output, in the flag table, the flag's own help (and so
`docs/cli-reference.md`, regenerated), and `docs/runnable.md`'s "a failed
preparation writes nothing"; `generate runnable-bindings` and
`generate fixture-composition` join the "Which commands materialize" list.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… list and runnable.md

e9cf1cf (#1209) already corrects the --check flag row, the flag help and
docs/cli-reference.md; this PR keeps the two items the review left to it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@antoinetoussaint-byte

Copy link
Copy Markdown
Contributor Author

Superseded by #1209, which carries this slice (1fac1a7c is the stack's first commit) and now also its two remaining docs items (docs/runnable.md preserves-the-existing-binding, docs/commands.md materialising-commands list), per the docs closure. Nothing here is lost.

antoinetoussaint-byte added a commit that referenced this pull request Oct 27, 2026
…runnable-bindings materializes pinned modules

The two narrative edits the #1208 docs closure left (codex-cli1208-e9-docs-closure):
docs/runnable.md says a failed preparation writes no binding output and
preserves the existing binding, rather than "writes nothing", since the loader
now materializes a pinned module first; docs/commands.md lists
`generate runnable-bindings` (its `--check` included) among the commands that
materialize, distinguishing cache/overlay/receipt/.gitignore writes from
binding output. No code; the --check row, flag help and docs/cli-reference.md
were already corrected in this stack.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
crisfiorini-oss pushed a commit to crisfiorini-oss/cli that referenced this pull request Oct 28, 2026
…d release publication, stamped generated clients, and runnable-bindings --check on a fresh checkout (codefly-dev#1209)

* fix(generate): runnable-bindings materializes pinned modules, so --check can run on a fresh checkout

`codefly generate runnable-bindings` walks every composed module for its
derived operations, but loaded the workspace with the plain loader. On a
composition of pinned modules with no codefly.local.yaml — a CI job, or any
fresh checkout — it refused before reading anything:

  module <wiki> resolves to a pinned artifact (source "obin-ai/core-solutions",
  version "0a18964f…"); pinned modules are pulled by the CLI, not loadable as a
  local checkout

so `--check`, the one drift check this generated group has, could not be run
where drift is caught. The command now materializes pinned modules first,
exactly as `codefly run`, `deploy gitops render` and `generate
fixture-composition` do (common.LoadWorkspaceWithPinnedModules), and is free
once the workspace is materialized.

Verified on obin-ai/platform-obin main (694ac3f4), environment blue: before,
the refusal above; after, the check reaches the regeneration and refuses with
the composition's real contradiction — `--call-endpoint "saas/auth-gateway/hop":
service saas/auth-gateway declares no endpoint hop (it declares [grpc rest
workload])` — while the committed configurations/blue/runnable-bindings.env
binds 17 operations to their owners' direct in-cluster addresses, two of them
on module compute, which the composition does not compose.

First slice of making render and deploy refuse committed generated output that
no longer matches what the generator would produce; the generic check on the
readiness gate follows (see the handoff).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(release): verify artifacts and carry generated client versions

* fix(stop): retain incompatible live process identity evidence

* fix(generators): stamp the Python project version by TOML ownership

* fix(stop): preserve registry refusals through cleanup fallbacks

* fix(stop): consume authenticated workspace provenance from Core

* fix(stop): report each preserved group once across recovery passes

* docs(generate): a failed preparation preserves the existing binding; runnable-bindings materializes pinned modules

The two narrative edits the codefly-dev#1208 docs closure left (codex-cli1208-e9-docs-closure):
docs/runnable.md says a failed preparation writes no binding output and
preserves the existing binding, rather than "writes nothing", since the loader
now materializes a pinned module first; docs/commands.md lists
`generate runnable-bindings` (its `--check` included) among the commands that
materialize, distinguishing cache/overlay/receipt/.gitignore writes from
binding output. No code; the --check row, flag help and docs/cli-reference.md
were already corrected in this stack.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Antoine Toussaint <312536060+antoinetoussaint-byte@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant