Repository navigation
release/0.4: workspace key listing (#87) and unreadable public value fails closed (#88) - #89
Merged
antoinetoussaint-byte merged 5 commits intoOct 26, 2026
Conversation
Query.WorkspaceConfigurationKeys(name) and WorkspaceSecretKeys(name) return, sorted, the keys of one workspace configuration group the process received, each spelled so the per-key accessor reads it. A consumer whose group is keyed by generated names (runnable-bindings, keyed <MODULE>__<OPERATION>) can now enumerate it without reading Codefly's environment variable encoding. The listing enumerates carrier names from the snapshot and the live process environment (a file carrier under the key it carries) and keeps a key only when the ordinary per-key lookup answers it non-empty. An absent group is an empty list and an error wrapping the new ErrWorkspaceConfigurationAbsent, which the per-key accessors' absent error now wraps too (message unchanged), replacing the string match isWorkspaceValueAbsent used. An unreadable delivery fails the listing with an error that is not absence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 77a997e)
The listing imported slices, which is not on the root import allowlist, so the "no second Work Context implementation" gate, race (workcontext) and coverage were red. It now sorts with sort.Strings. WorkspaceSecretKeys also read every value in the group to decide membership, which opened every live secret file and kept its content in the file-carrier cache just to return names. The listing now matches the names the SDK already holds (the snapshot, and the live environment with a file carrier listed under the key it carries) and opens no file. A listed key whose delivery cannot be read fails where its value is read, naming its reason, instead of being dropped from the list or failing the whole listing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit 5e83bca)
…ecret namespace (r139) WorkspaceValue, ReadAuthority and Recheck read through workspaceValueLive. When the public read failed (a missing file carrier, a value delivered both inline and by file), workspaceValueLive discarded the error and returned whatever the secret namespace held under the same name. Review r139 probed this and got "secretvalue" back with a nil error. An authority read could pin, or a Recheck could pass, on a value from a delivery the host never made for that name. workspaceValueLive now goes through workspaceValueIfSetLive, which moves on to the secret namespace only when the public value is absent and returns any other failure. WorkspaceValue returns that failure as it is; ReadAuthority and Recheck wrap it under ErrAuthorityValueMissing / ErrAuthorityValueChanged with "cannot be read", so the refusal names the delivery's reason. The new test fails against the old code at the WorkspaceValue assertion. The listing doc comments now say what the code does: a live file carrier is listed by its path, so one naming an empty file is listed and then reads as absent. TestWorkspaceConfigurationKeysSeparatesAbsenceFromFailure covers that case and a value delivered both inline and by file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit a08a110)
Merged
6 tasks done
…rsions released modules pinned from compat/v0.1.65 are retracted by name (#81) The compat/v0.1.65 branch was replaced by the tag compat-v0.1.65-pins (annotations 0.2.15, robin 0.1.23 and record-store 0.2.2 pin two of its commits and must keep building). Go reads only vX.Y.Z tags as versions, so the published-tags gate now reads only those; what that tag keeps reachable is two pseudo-versions carrying the old Work Context implementation, outside the [v0.1.51, v0.1.65] retraction — retracted here by name. Co-authored-by: Antoine Toussaint <antoine.toussaint.subscription3@obin.ai> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> (cherry picked from commit e73dfc6)
5 tasks done
…on the restored retractions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This carries the workspace-key listing (#87) and the r139 security fix (#88) to the
release/0.4maintenance line (core v0.19.1), which robin pins. Each commit is applied withcherry-pick -x, with no conflicts:031db0b←77a997efeat: list the keys of one workspace configuration group (feat: list the keys of one workspace configuration group #87)1e2189c←5e83bcafix: list workspace keys from delivered names, reading no value (feat: list the keys of one workspace configuration group #87, r135)3af0d1d←a08a110fix: an unreadable public value is refused, never answered from the secret namespace (fix: an unreadable public value is refused, never answered from the secret namespace (r139) #88, r139)#88's m1 changes edit #87's code, so #87 has to come along. #88's m3 change (
workspaceValueLiveno longer falls through to the secret namespace when a public read fails) fixes a bug that also exists on this line:WorkspaceValue,ReadAuthorityandRecheckhere use the sameworkspaceValueLive. See #87 and #88 for the behaviour and the reasoning.No release or tag has been cut.
Test plan
Depends on #91 (the backport of #81, which restores the retractions v0.4.2 lost and fixes the tag-audit gate). #91 is merged into this branch at
376b82b(a merge commit, no history rewritten), so this branch's gates run on the real fix. Merge #91 first; after that, this PR's diff is only the three commits above.On this branch at
376b82b:./scripts/check-one-implementation.sh: ok (84 files)../scripts/security-posture.sh: SP-WC-05 ok.go vet ./...is clean,golangci-lint run ./...reports 0 issues, andgo mod tidyleaves go.mod and go.sum unchanged.go test -race -count=1 ./...(root) passes, includingTestEveryPublishedTagCarryingTheImplementationIsRetracted, which failed here before release/0.4: backport #81, restoring the retractions v0.4.2 lost #91.cd workcontext && go test -race -count=1 ./...passes.#90 (r144's f1–f3) follows this onto
release/0.4once it merges on main, and then v0.4.3 is cut.Fix or hack
Fix: these are backports of reviewed changes from main, with no edits.
🤖 Generated with Claude Code