Skip to content

build(deps): pin core at the v0.19.8 release, not a pre-squash commit of its branch - #201

Closed
antoinetoussaint-byte wants to merge 1 commit into
mainfrom
fix/pin-core-v0.19.8-release
Closed

antoinetoussaint-byte wants to merge 1 commit into
mainfrom
fix/pin-core-v0.19.8-release

Conversation

@antoinetoussaint-byte

Copy link
Copy Markdown
Contributor

What this changes

go.mod/go.sum only: core v0.19.8-0.20261027211051-bc4e15cab5b0 → v0.19.8 (tag a06da5fc). No source change.

Why

#199 landed pinning a pseudo-version of bc4e15ca, a commit on core's codex/agent-download-auth-hint branch. core#819 was squash-merged, so that commit is not reachable from core main — it is an orphaned branch SHA, and the release that carries its content is the v0.19.8 tag. v0.0.147 must ship on a release, not a commit the proxy happens to have cached.

0f9b2001 (the kern.bootsessionuuid BootID fix, core#802) is an ancestor of a06da5fc: confirmed with git merge-base --is-ancestor. v0.19.7 (557f6a3e) also carries it but lacks runners.SignalProcess, which nixpg.go:963 now uses, so v0.19.8 is the lowest release this repo builds on.

core#819's runtime-ownership change against this agent

  • dockerrun.WithServiceIdentity / the codefly.service label exist only on DockerEnvironment (container path). The native path (nixpg.go, the run's shared server) never constructs one, so the label is never read or written there. This repo does not call WithServiceIdentity; on the container path an unlabelled config meets validateContainerServiceReuse(labels, ""), which accepts a legacy (unlabelled) container and refuses only a container another agent has labelled with a different parent — a correct refusal, not a regression.
  • runners/base ownership.go/pgid.go/process_identity_darwin.go changes (signal re-verifies the birth after reading the audit-token version): the APIs this repo uses (runners.SignalProcess, process identity records) compile unchanged against the tag, and fix(runtime): preserve database claims and signal the recorded process birth #199's last commit was written against #819's branch.

Gates

  • go mod tidy clean, go.sum carries no credential.
  • go build ./..., go vet ./... ok.
  • go test ./... with CI's skip list: ok 614 s on this pin.
  • The five container-gated tests are CI's to run.

Release

Once merged, codefly publish patch from fresh main cuts v0.0.147 (0.0.146 → 0.0.147), the first release with #196 (one shared native server per run) and the clock-step-proof BootID.

🤖 Generated with Claude Code

… of its branch

#199 landed pinning core v0.19.8-0.20261027211051-bc4e15cab5b0. That commit
sits on core's codex/agent-download-auth-hint branch and is not reachable from
core main: #819 was squash-merged, so the commit the pseudo-version names is
orphaned, and the release that carries it is the v0.19.8 tag (a06da5fc). An
agent release must pin a release, so this moves the pin to the tag. No source
changes; go build and go vet pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@antoinetoussaint-byte

Copy link
Copy Markdown
Contributor Author

Superseded by #202, the codefly agent release PR for v0.0.147, which carries the same core pin (tag v0.19.8) plus the manifest bump. One PR to merge: #202.

@antoinetoussaint-byte
antoinetoussaint-byte deleted the fix/pin-core-v0.19.8-release branch October 27, 2026 23:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant