Uh oh!
There was an error while loading. Please reload this page.
feat(cli): reconcile local Runtime Host generations - #3254
Conversation
f3c93a9 to
d59f548CompareGenerated-by: Codex
Generated-by: Codex
Main retired the client surface identity; the replayed generation-rejection and election tests still passed it, breaking typecheck. Generated-by: maka
d59f548 to
8a197b0Compare
Astro-Han
left a comment
There was a problem hiding this comment.
Thanks for keeping this Draft's status and convergence notes honest. I reviewed exact head 8a197b08ae50445b88ea5d671b977c821d072131 (14 files, +1294/-50).
The underlying problem is demonstrated: an older local Runtime Host can remain resident across a compatibility-epoch change, leaving a newer CLI unable to make progress. Exact observed-epoch fencing, authoritative activity diagnostics, remote/service/npx isolation, and the Restart / Wait / Cancel vocabulary are useful evidence worth preserving.
The current implementation, however, is no longer the right solution owner. It carries replacement policy through the ordinary TUI → CLI context → connectOrSpawn election path, using installation path/version/development UUID as proxy deployment identity. Current main now has durable deployment ownership, handoff, and owner-transaction seams; keeping this path would create a second lifecycle authority. By first principles, ordinary connection election should report typed compatibility facts, while the verified owner transaction performs retirement, replacement, and candidate launch.
So the correct disposition is not to repair this 1,294-line branch into a mergeable PR. Keep/migrate the exact-epoch and real-Host evidence, then delete or rewrite the branch-local replacement policy, TUI-owned retry state machine, proxy identity, fake-connector wiring tests, and roughly 754 lines of duplicate architecture drafts. #3709 should remain the single target-architecture authority.
I left the most concrete code findings inline:
- P1:
candidateGeneration/takeoverHostEpochput replacement authority in ordinaryconnectOrSpawn; - P2: Restart is offered when
connections === 0, although the Host also requires zero active operations/residencies, producing a recoverable conflict loop; - P1: the current head does not parse because
joinis imported twice.
There are additional current-head delivery failures: six new source/docs files lack ASF headers; tests still pass the retired surface field; and changed-file formatting fails. The exact head has no hosted checks and conflicts with current main. These reinforce the Draft status, but they are not a reason to preserve the obsolete architecture.
Next step: keep this Draft paused. Rebuild the smallest coherent slice behind the current owner/handoff seam, migrate only the valuable Host-kernel and released-artifact/PTTY evidence, remove duplicate architecture documents, then refresh exact-head CI and qualification. Do not simply rebase this branch and mark it Ready.
中文对照
感谢你在 Draft 正文里坦诚记录了当前状态和收敛方向。底层问题是真实的：旧版 Local Runtime Host 可能因为驻留任务跨 compatibility epoch 继续运行，导致新版 CLI 无法继续。精确 epoch fencing、Host activity 诊断、remote/service/npx 隔离，以及 Restart / Wait / Cancel 的交互词汇都值得保留。
但当前实现已经不再属于正确的 owner。它把 replacement policy 放进 TUI → CLI context → 普通 connectOrSpawn election，并使用安装路径、版本和 development UUID 近似 deployment identity。现在 main 已经有 durable owner、handoff 和 owner transaction；继续保留这条路径会形成第二套生命周期 authority。普通连接选举应只返回 typed compatibility facts，真正的 retirement、replacement 和 candidate launch 应由 verified owner transaction 完成。
因此，不建议把这 1294 行分支继续修成可合并 PR。应迁移 exact-epoch 和真实 Host 证据，然后删除或重写 branch-local replacement policy、TUI 自己维护的 retry state machine、代理 identity、只验证字段映射的 fake connector 测试，以及约 754 行重复架构草稿；#3709 保持唯一目标架构 authority。
当前 head 另外还存在重复 import、ASF header、退役测试字段和格式问题，并且与 main 冲突、没有 CI。这些都说明保持 Draft 是正确的，但不值得为了修这些表面问题继续保留旧架构。正确下一步是基于当前 owner/handoff seam 重建一个最小完整切片，只迁移有价值的 qualification 证据。
AI-assisted review notice: Codex coordinated independent review lanes; I verified the exact-head diff, current-main owner seams, reachability, and severity before publication. This does not replace the repository's required independent human approval.
| protocol: ProtocolRange; | ||
| compositionId: string; | ||
| generation?: string; | ||
| candidateGeneration?: string; |
There was a problem hiding this comment.
[P1 · category ①] This makes ordinary connection election carry replacement policy. A non-npx path, package version, or development UUID is not verified deployment ownership, yet the TUI can turn those proxy facts into a generation takeover request. Current main has a durable owner/handoff transaction that is the natural authority for retirement and successor launch. Please keep connectOrSpawn as a compatibility-fact/admission seam and move this replacement action behind the verified owner transaction; otherwise the repository retains two lifecycle authorities.
| const activity = error.conflict.handshake?.activity; | ||
| return error.conflict.kind === 'upgrade_required' | ||
| ? error.conflict.restartable | ||
| : activity !== undefined && activity.connections === 0; |
There was a problem hiding this comment.
[P2 · category ①] connections === 0 is weaker than the Host's actual takeover condition, which also requires zero active operations and residencies. A normal scheduled-task residency can therefore make the TUI offer Restart, only for the Kernel to reject it and return the user to the same prompt. This is recoverable through Wait/Cancel, so P2 is the calibrated level. The thin adapter should consume an authoritative replacement disposition rather than re-derive idleness here.
| import { join } from 'node:path'; | ||
| import { fileURLToPath } from 'node:url'; | ||
| import { deriveMakaDataRoots, resolveMakaDataRoots } from './workspace-root.js'; | ||
| import { join } from 'node:path'; |
There was a problem hiding this comment.
[P1 · category ①] This exact head imports join twice, so the CLI module fails to parse (Identifier 'join' has already been declared). The branch also retains unused imports around this edit. Please delete the duplicate/dead imports; if this code is rewritten behind the owner seam, avoid carrying this stale composition forward.
Current status
This Draft is paused as implementation and qualification evidence while #3709 and the #3228 reconciliation gates stabilize. It is not the target owner architecture and should not be marked Ready in its current form. The retained value is its generation/epoch diagnostics, Restart/Wait/Cancel UX, exact-epoch fencing, released-Host takeover adapter, and real PTY evidence. After the gates close, the implementation should be split or rewritten so replacement policy no longer lives in ordinary
connectOrSpawnelection.简体中文
本 Draft 暂停实现，用作 #3709 与 #3228 reconciliation gate 稳定前的实现和 qualification 证据。它不是目标 owner 架构，当前形态不应转为 Ready。需要保留的是 generation/epoch 诊断、Restart/Wait/Cancel UX、exact-epoch fencing、已发布 Host takeover adapter 与真实 PTY 证据。Gate 闭合后应拆分或重写实现，使 replacement policy 不再位于普通
connectOrSpawnelection 中。Convergence disposition
The branch has now been audited against the owner/transfer rules in #3709. When work resumes, it should be split or rewritten according to this inventory; the current Draft must not be merged as one lifecycle implementation.
Retain as evidence
HostEpochfencing and stale-takeover rejection;npxcontract.Migrate behind the owner/reconciler seam
connect | owner_transfer_required | wait | cancel | operator_requiredoutcomes;DeploymentIdentity; it does not decide authority;_npxdetection remains a negative provenance guard shared with managed setup, never positive owner proof.Delete or rewrite
connectOrSpawn;installationScope === 'persistent'as replacement authority;Simplification result
localGenerationRequest,candidateGeneration, and the TUI-owned retry loop currently form a parallel replacement path. Migrating the released-Host takeover mechanism behind one owner transaction lets these connection-level policy representations and the Surface state machine disappear while preserving compatibility admission and exact-epoch fencing.installationScope === 'persistent'and version/development-UUID generation are maintained only to approximate facts now owned by the durable owner record and verifiedDeploymentIdentity. The shared_npxdetector remains because managed setup and invocation policy still consume its negative provenance fact.Audit coverage
_npxguard; replace authority and identity inference简体中文
收敛处置清单
该分支已经按 #3709 的 owner/transfer 规则完成审计。恢复工作后，应依据以下清单拆分或重写；当前 Draft 不能作为一整套 lifecycle implementation 合并。
作为证据保留
HostEpoch的精确 fencing 与 stale takeover rejection；npxcontract 重写。迁移到 owner/reconciler seam 后面
connect | owner_transfer_required | wait | cancel | operator_requiredoutcome 的薄 presentation adapter；DeploymentIdentity的 input adapter，不再决定 authority；_npxdetection 保留为与 managed setup 共享的负向 provenance guard，永远不是正向 owner proof。删除或重写
connectOrSpawn中携带的 replacement-policy 字段与额外 exact-generation probe；installationScope === 'persistent'当作 replacement authority；简化审计结果
localGenerationRequest、candidateGeneration与 TUI-owned retry loop 当前形成一条平行 replacement path。把 released-Host takeover mechanism 迁移到唯一 owner transaction 后，可以删除这些 connection-level policy representation 与 Surface state machine，同时保留 compatibility admission 和 exact-epoch fencing。installationScope === 'persistent'和 version/development-UUID generation 只是近似 durable owner record 与 verifiedDeploymentIdentity应拥有的事实。共享_npxdetector 仍保留，因为 managed setup 与 invocation policy 真实消费它提供的负向 provenance fact。审计覆盖
_npxguard；替换 authority/identity inferenceSummary
Teach the local CLI/TUI to identify the installation that supplied its Runtime Host candidate and negotiate that candidate generation explicitly.
Compatible same-epoch Clients continue using the active Host even when builds differ. For a local cross-epoch conflict, TUI presents Restart, Wait, or Cancel using authoritative Host activity; Restart is fenced to the observed Host epoch. Remote profiles never receive local replacement authority, and transient
npxlaunches cannot request takeover.This is the first bounded slice of the installation lifecycle design. Artifact staging/switching, a public update command, same-epoch replacement, managed remote updates, and durable
npxownership remain out of scope.Refs #3231
Refs #3243
Refs #3244
Refs #3245
Refs #3709
Verification
@maka/core,@maka/storage,@maka/mcp,@maka/runtime,@maka/runtime-host, andmaka-agentbuilds passed.git diff --checkpassed.Not run: full repository test suite or Desktop UI tests.
Draft scope
npxcallers outside local replacement authorityAI use
Select exactly one:
Tool(s) and scope: Codex assisted with architecture analysis, implementation, documentation, tests, and local review. The human contributor will review the Draft before it is submitted for merge.
Checklist
Does this PR entail a change in behavior?