Skip to content

fix(runtime): adopt Core 0.19.10 native ownership #183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
antoinetoussaint-byte merged 5 commits into from
Oct 28, 2026
+457 −52
Merged

fix(runtime): adopt Core 0.19.10 native ownership #183

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d3dcf8e
build(deps): bump github.com/codefly-dev/core
dependabot[bot] Oct 25, 2026
8558228
Merge remote-tracking branch 'origin/main' into dependabot/go_modules…
antoinetoussaint-byte Oct 28, 2026
296d42e
fix(runtime): adopt authenticated native ownership from Core v0.19.10
antoinetoussaint-byte Oct 28, 2026
8c9a44f
test(runtime): authenticate original agent birth before owner death
antoinetoussaint-byte Oct 28, 2026
6a02740
test(runtime): wait for the retained fixture birth to finish exec
antoinetoussaint-byte Oct 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions .claude/skills/verify-changes/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,54 @@ source is the hack this repo's rules forbid.

## A skip is not a pass

### Actual native agent ownership

Core v0.19.10 supplies the authenticated-v2 native writer and identity-bound
stop/recovery APIs. This agent consumes them through its existing native runner;
already-installed binaries retain the Core they were built with.

After changing Core or the native lifecycle, build this checkout through
`codefly agent build --native-only` with a disposable OS `HOME` and
`CODEFLY_HOME`. Select the intended Core graph with `agent deps --pin` for a
published version; a source-adjacent `go.work` proves only that local source
graph and requires a packager that honours the CLI's prepared workfile.
Use an isolated source packager installation, never overwrite a shared agent.
Then qualify those exact installed bytes:

```bash
SERVICE_NEXTJS_NATIVE_AGENT_HOME=/absolute/disposable/codefly-home \
SERVICE_NEXTJS_QUALIFICATION_CLI=/absolute/reviewed/codefly \
go test -run '^TestNativeAgentOwnershipLifecycle$' -count=1 -v .
```

This opt-in gate loads the installed agent through Core's authenticated manager
and drives real Next.js applications through gRPC Load/Init/Start/Stop/restart.
It checks that Start's RPC lifetime does not own the workload, ordinary Stop
removes the registered group, and the actual writer records authenticated-v2
ownership. It kills only the exact disposable agent owner, recovers its orphan
through CLI preview/expect, and verifies an independently launched sibling's
process births remain unchanged. Core owns authentication, process inspection,
signalling and registry removal; this agent adds no recovery mechanism.
The test retains the manager's authenticated original launch identity before
workload actions, compares the current full identity before signaling, and binds
the later recovery receipt to that retained birth. Its stale-owner regression
uses a real disposable process and requires refusal without SIGKILL delivery.
That standalone fixture waits for Core's launch gate to exec the target while
retaining the original birth; missing/replaced ownership or cancellation fails
readiness, and the bounded wait cannot turn a timeout into qualification.

The test isolates OS HOME (Core's registry) from the supplied installation home.
It needs npm, Node, network access for the fixture's pinned dependencies, and a
CLI implementing the reviewed recovery contract. It bypasses sandbox/principal
policy explicitly. It does not qualify Linux when run on macOS, Docker, Nix,
full CLI composition, or a published release. Record binary/SBOM/CLI hashes and
embedded Core metadata with the result; a local manifest version is not proof
of publication. Missing opt-in inputs produce a skip, never qualification.
The ownership proof covers the tracked npm process group. Next.js 16.4.1 can
briefly start a detached telemetry flush helper even with telemetry disabled;
that helper is outside this group contract. Fixture-home deletion retries handle
its filesystem race without claiming or signalling an unrelated process.

These exclude themselves and report success:

| Test | Runs only when |
Expand Down
31 changes: 17 additions & 14 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ go 1.27.3

require (
github.com/Masterminds/semver v1.5.0
github.com/codefly-dev/core v0.19.4
github.com/codefly-dev/core v0.19.10
github.com/stretchr/testify v1.12.1
google.golang.org/grpc v1.84.0
google.golang.org/protobuf v1.36.12
Expand All @@ -19,8 +19,8 @@ require (
dario.cat/mergo v1.0.2 // indirect
github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
github.com/Masterminds/semver/v3 v3.5.0 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/ProtonMail/go-crypto v1.4.1 // indirect
github.com/Microsoft/go-winio v0.6.3-0.20251027160822-ad3df93bed29 // indirect
github.com/ProtonMail/go-crypto v1.5.2 // indirect
github.com/VividCortex/ewma v1.2.0 // indirect
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
github.com/blang/semver v3.5.1+incompatible // indirect
Expand All @@ -32,6 +32,7 @@ require (
github.com/codefly-dev/gortk v0.2.0 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/containerd/log v0.2.0 // indirect
github.com/cyphar/filepath-securejoin v0.7.0 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/dekobon/tree-sitter-groovy v0.3.0 // indirect
Expand All @@ -56,7 +57,7 @@ require (
github.com/go-openapi/jsonreference v1.0.2 // indirect
github.com/go-openapi/loads v0.25.3 // indirect
github.com/go-openapi/spec v1.0.1 // indirect
github.com/go-openapi/strfmt v0.27.2 // indirect
github.com/go-openapi/strfmt v0.27.3 // indirect
github.com/go-openapi/swag v0.29.2 // indirect
github.com/go-openapi/swag/cmdutils v0.29.2 // indirect
github.com/go-openapi/swag/conv v0.29.2 // indirect
Expand Down Expand Up @@ -85,10 +86,11 @@ require (
github.com/mattn/go-isatty v0.0.24 // indirect
github.com/mattn/go-pointer v0.0.1 // indirect
github.com/mattn/go-runewidth v0.0.28 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/patternmatcher v0.6.1 // indirect
github.com/moby/sys/sequential v0.7.0 // indirect
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/morikuni/aec v1.1.0 // indirect
github.com/oklog/ulid/v2 v2.1.2 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
Expand Down Expand Up @@ -119,22 +121,23 @@ require (
github.com/yusufpapurcu/wmi v1.2.4 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.72.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.72.0 // indirect
go.opentelemetry.io/otel v1.47.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.47.0 // indirect
go.opentelemetry.io/otel/log v1.47.0 // indirect
go.opentelemetry.io/otel/metric v1.47.0 // indirect
go.opentelemetry.io/otel/trace v1.47.0 // indirect
go.yaml.in/yaml/v2 v2.4.4 // indirect
go.yaml.in/yaml/v3 v3.0.5 // indirect
golang.org/x/crypto v0.57.0 // indirect
golang.org/x/exp v0.0.0-20260908205506-85c1c2202aba // indirect
golang.org/x/mod v0.41.0 // indirect
golang.org/x/net v0.60.0 // indirect
golang.org/x/crypto v0.58.0 // indirect
golang.org/x/exp v0.0.0-20261014143641-f0251eb4aa3e // indirect
golang.org/x/mod v0.42.0 // indirect
golang.org/x/net v0.61.0 // indirect
golang.org/x/sys v0.49.0 // indirect
golang.org/x/term v0.46.0 // indirect
golang.org/x/text v0.42.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260928230214-8a89bd6388cc // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260928230214-8a89bd6388cc // indirect
golang.org/x/term v0.47.0 // indirect
golang.org/x/text v0.43.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20261012220534-4341edf3f941 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20261005182115-fad411399dd8 // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
Expand Down
Loading
Loading