codex: make pinned releases recoverable and faster - #71
Open
ttaylorr-oai wants to merge 4 commits into
Open
Conversation
ttaylorr-oai
changed the title
ttaylorr-oai
added
kind:controller
ttaylorr-oai
marked this pull request as ready for review
August 24, 2026 23:20
ttaylorr-oai
added
codex:needs-review
ttaylorr-oai
force-pushed
the
ttaylorr/codex-pr-state-labels
branch
from
August 24, 2026 23:40
94c6f81 to
86f1c8f
Compare
dreynaud-oai
previously approved these changes
Aug 24, 2026
ttaylorr-oai
force-pushed
the
ttaylorr/codex-release-resume
branch
from
August 24, 2026 23:41
f9f7139 to
ef93e3b
Compare
A failed local release leaves a complete immutable candidate, but a rebuild starts over against current master. That repeats the expensive rewrite and can turn a recoverable staging or promotion failure into a new conflict. Stable and unstable staging also run serially, and the publisher repeats full candidate verification after CI. Teach Meta/rebuild --resume to reload only a protected codex-refresh session. Hash the frozen files before staging, then recheck those hashes and live inputs before promotion instead of rebuilding or replaying the whole candidate. Reuse an exact existing staging ref and start both lane pushes before waiting, so their CI runs overlap. Record phase timings in the local session and print the same phases for remote publication. Keep the consumed one-shot recovery test self-contained by embedding its reviewed manifest; current meta correctly no longer carries that file. Test the real local path by rolling the fixture back to its pre-promotion state and publishing the same retained session without another preparation clone. Also check exact staging reuse and that both lane pushes precede either wait.
When the reviewed unstable merge graph overlaps changes made while rebuilding stable on current master, the controller currently stops before leaving a recoverable state. Restacking that graph by hand is slow and advances reviewed source refs only because the generated base moved. Run the topology-preserving rebase in an isolated shared clone and retain its state. Train rerere from the published graph, let resolve/continue resume either the stable or unstable graph, and import only the completed objects. Source refs remain immutable. Verify a one-to-one commit mapping and unchanged parent topology before freezing the ordinary pinned recovery session. Exercise the dual-lane overlap, conflict resolution, and unchanged remote refs end to end.
The state reconciler scans topics by their release lane and controller changes by a direct meta base. A controller PR stacked on another controller branch therefore receives no classification, even though it is part of the same release-controller stack. Record open controller heads rooted at meta, then walk open PRs whose base is one of those heads. Reuse the ordinary controller-state rules at each depth so every stacked change receives exactly one role, build, and lifecycle state. Exercise a three-PR controller stack in the complete-inventory test. The duplicate guard still rejects a PR returned through more than one route.
ttaylorr-oai
force-pushed
the
ttaylorr/codex-release-resume
branch
from
August 24, 2026 23:52
ef93e3b to
a905475
Compare
ttaylorr-oai
changed the base branch from
ttaylorr/codex-pr-state-labels
to
meta
August 24, 2026 23:52
ttaylorr-oai
dismissed
dreynaud-oai’s stale review
August 24, 2026 23:52
The base branch was changed.
When `git rebase --continue` applies one rerere resolution and immediately reaches another conflict that rerere also stages, Git exits nonzero while the rebase has advanced and no unmerged entries remain. The controller treats that state as an internal failure instead of continuing the supported recovery. Record REBASE_HEAD before each continuation. Retry only when the rebase is still active, no paths are unmerged, and REBASE_HEAD advanced to a different commit. An unchanged failure still stops rather than looping. Extend the rerere fixture to reconstruct two sequential conflicting commits, proving that both resolutions and commit boundaries survive.
ttaylorr-oai
force-pushed
the
ttaylorr/codex-release-resume
branch
from
August 24, 2026 23:53
a905475 to
d13d61a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A failed local release leaves a complete immutable candidate, but rebuilding
starts over against current
master. That repeats the expensive rewrite andcan turn a recoverable staging or promotion failure into a new conflict.
Overlapping changes in a pinned merge graph also used to require manually
restacking reviewed topic refs, which needlessly invalidated their approvals.
Stable and unstable staging then ran serially, and the publisher repeated full
candidate verification after CI.
Changes
topology-aware rebase. Train rerere from the published graph and let
resolve/continueresume the exact stopped graph without moving sourcerefs.
freezing the ordinary pinned recovery session.
REBASE_HEADadvanced;unchanged failures still stop rather than looping.
Meta/rebuild --resume <session>for a protected, already-preparedrelease session. Hash frozen inputs before staging and revalidate them and
live inputs before promotion without rebuilding on a newer
master.before either wait, so lane CI runs overlap.
checks, and record phase timings in the retained session.
one role, build, and lifecycle state.
Validation
sh -nandgit diff --check.t9905-codex-branch.shcases 50, 101, 103-124, and 132 pass,covering consecutive rerere resolutions, stable and unstable merge DAGs,
pinned-plan admission, immutable source refs, overlap recovery, conflict
resolution, recovery freezing, dual-lane bootstrapping, and complete PR
inventory.
resolvepreserves the private graph,continuefinishes it, andpublish-topicsfreezes a normal recovery session while remote refs remainunchanged.
exactly one classification.
motivated this path. Its topology-preserving result built successfully and
passed all 405 unit tests plus the targeted status and fsmonitor suites that
can run on macOS.
Dependency
Depends on #36 and #42. The PR is based on #36's branch so its review diff is
limited to release recovery, latency, and complete stack classification.