Report actionable runtime bootstrap failures - #216
Conversation
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.99
The patch breaks fresh PowerShell installation, permits PowerShell hydration to mutate repository state, and emits recovery commands that cannot restore older pinned releases or enforce the pinned digest. Model-level verification is not required before merge; targeted Windows, historical-installer, and digest-skew regression tests should establish the fixes.
Findings without inline diff anchors
[P1] Do not route PowerShell hydration through installation.update
Invariant: hydration may restore host runtime storage but must not mutate repository/controller state. If the exact runtime already exists—for example, the launcher was deleted while the store remains—BOATSTACK_MODE=hydrate reaches this else and invokes installation.update; that transition can commit a new revision and receipt even when the runtime identity is unchanged. Its refusal is also ignored by the new exit-status condition, after which the script reports success. This behavior is introduced because hydrate was added as a mode without receiving its own no-kernel-action branch. The smallest regression should prepopulate an exact runtime, run PowerShell hydrate, and assert byte-for-byte unchanged repository state, pin, journal, and receipts with no update invocation.
Confidence: 0.98
Location: install.ps1:113-120 (RIGHT)
|
Addressed the unanchored hydration finding in c21e242. PowerShell now enters the kernel update branch only when mode is explicitly |
There was a problem hiding this comment.
Codex automated review
Verdict: patch is incorrect
Confidence: 0.98
The new recovery path can install an unbound runtime, deterministically fail in detached repositories, and change another repository’s shared launcher. Model-level verification is recommended before merge, especially for hydrate retry/partial-failure behavior and cross-repository launcher isolation.
Findings without inline diff anchors
[P2] Allow exact hydration from detached checkouts
Invariant: a prescribed runtime recovery must not inherit repository-mutation preconditions it does not need. In a detached checkout with a valid pin and missing runtime, Boatstack prescribes hydrate, but the installer deterministically rejects it at symbolic-ref; state remains unchanged and the same recovery is prescribed again. Hydrate newly reaches this pre-existing install-only branch check even though it never uses the branch or mutates repository state. Add a detached-repository test using a checksum-bound local binary and assert hydration succeeds without repository changes; cover install.ps1 likewise.
Confidence: 0.98
Location: install.sh:21-24 (RIGHT)
[P1] Do not replace an existing shared launcher with the recovered runtime
Invariant: hydrating repo A’s pinned runtime must not change repo B’s shared bootstrap implementation. Hydrating an older exact runtime falls through to these lines and overwrites the host-wide launcher with that old binary; another repository then loses the current bootstrap protocol—for example, an actual v0.7.142 launcher emits only the old untyped missing-runtime error instead of this patch’s structured recovery diagnostic. The new test misses this because its “old” helper is current source with a different version string. Add a regression using an actual older release and assert an existing current launcher and repo B’s diagnostics remain unchanged; only create a launcher when none exists. The PowerShell path has the same issue.
Confidence: 0.97
Location: install.sh:143-145 (RIGHT)
| case "$mode" in | ||
| install|update) ;; | ||
| *) echo "Boatstack supports BOATSTACK_MODE=install or update" >&2; exit 2 ;; | ||
| install|update|hydrate) ;; |
There was a problem hiding this comment.
[P1] Require exact identity evidence for hydrate mode
Invariant: hydration must be bound to an exact pinned version and digest before changing host state. BOATSTACK_MODE=hydrate with no version or expected digest defaults to mutable latest, installs that artifact and overwrites the launcher, while the repository’s pinned runtime remains absent; the next command therefore reports the same blocker after an unrelated host mutation. This is introduced by admitting hydrate without validating its required variables. Add a test asserting hydrate without an explicit non-latest version and expected SHA-256 fails before download or filesystem mutation; apply the same correction to install.ps1.
Confidence: 0.99
| if arguments[index] == "--format" && index+1 < len(arguments) { | ||
| return arguments[index+1] == "json" | ||
| } | ||
| if strings.TrimPrefix(arguments[index], "--format=") != arguments[index] { | ||
| return strings.TrimPrefix(arguments[index], "--format=") == "json" |
There was a problem hiding this comment.
[P3] Honor the final format flag in bootstrap rendering
Invariant: pre-runtime diagnostics must use the same CLI format semantics as normal execution. Go’s flag parser accepts repeated flags and the last value wins, but next --format=text --format=json returns on the first occurrence here and emits text rather than JSON (with the inverse mismatch for the opposite order). This parser is new in the patch and can break wrappers that append an override. Add a rendering test for both repeated-flag orders and select the final format occurrence.
Confidence: 0.96
1 participant
Summary
Boundary conformance
Boundary: repository launcher to the pinned runtime.
The launcher dispatches only the exact validated runtime. Missing, malformed, non-regular, or checksum-mismatched runtime state fails before Flow or managed-state mutation. Installer hydration requires explicit user approval and writes only the immutable host runtime store and launcher.
Verification
python3 .github/scripts/run_go_tests.py(345 tests)go vet ./...go build ./...npm run test:flow-sdkpython3 -m unittest discover -s .github/tests -p 'test_*.py'(39 tests; 1 expected failure)python3 .github/scripts/release_notes.py preflight --repo . --base-branch mainrundelegationRelease note:
release-notes/2026-08-14-runtime-bootstrap-errors.md