Repository navigation
release: ship Taskflow 1.0.0 with verified Control Plane - #142
Merged
Merged
Conversation
Freeze S2-close + S3-minimum as the next npm beta increment. Stop at Draft PR + exact-SHA CI; no Ready/merge/tag/npm in this slice.
The winner of the user singleton now listens on the UDS endpoint (chmod 0o600); losers attach over the socket, do an online hello, receive the winner's fencing epoch on the wire, and route control.probe through the attached client. protocolMajor mismatches are rejected on the wire, winner death leaves a stale socket that the next process unlinks and re-listens, and renewLease() runs on an unref'd timer while the winner holds the lease. Lock-layer labels are no longer presented as attach. Process-level A2/A2b tests live in a Unix-only test entry (skipped on win32; not part of the 3-OS process-supervisor job).
Implement the S3-minimum ledger: header, commit-seq, journal, store-self projections, exclusive writer lock, and hardened UUID/wx/fsync/rename. ControlHost.start() opens projectStorePath before dispatch (winner/standalone only). Acceptance A3–A6 covered by unit + process-level SIGKILL tests. P14 ADR Status stays Proposed; only the S3 engine implementation gate is noted.
Align publishable versions and pins to 0.3.0-beta.2. Rewrite the control package description and README banners so wire contracts stay PROPOSED, taskflow-control stays off the ten-package face (tag next), and #137/#95 are not claimed. ControlHost read-only store RPCs already landed with S3; MCP status tool deferred to avoid a hard dep on an unpublished package.
beta.2 candidate (rc/0.3.0-beta.2 @ bee8586) exact-SHA CI GREEN (run 32144803693, 10/10 jobs) recorded as candidate evidence only, not a release. L5 PASS for published v0.3.0-beta.1 (tag 561cfd3, publish run 31621938101); v0.3.0-beta.2 NOT tagged/published. L6 stays FAIL. L4 live-Codex E2E @ 4524d2d marked historical (beta.1-era, not beta.2 evidence). Docs-only; no public copy (RELEASE.md does not reference the scoreboard). refs plan 8.1 / A9
Pass the persisted owning run ID through imperative and event-kernel runner options, then export it as PI_SUBAGENT_RUN_ID. Preserve direct-call behavior and downstream-owned environment variables. Add regression coverage for all agent-call families and nested flows. Fixes #172.
Combine reviewed dependency and Actions updates, align CodeQL and Fumadocs peers, harden immutable action pin validation, and verify both Pi SDK peer versions. Keep scanner severity and score gates and require completed Cisco deep scanning instead of accepting missing coverage.
Fail closed after ambiguous persistence failures, publish complete writer ownership atomically, serialize stale reclamation, drain coalesced RPC frames, and roll back startup resources. Add I/O, parser, startup, and real multi-process regression coverage. Resolve main conflicts while preserving the planned beta.2 version set, main hotfixes, and existing Draft/Proposed boundaries. No release, merge-to-main, tag, or publish action.
…ions-20260930' into release/taskflow-1.0
…lease/taskflow-1.0
heggria
changed the title
heggria
marked this pull request as ready for review
October 2, 2026 08:36
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 008f403595
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
heggria
marked this pull request as draft
October 2, 2026 14:39
The 26 isolated clients each have a 2s watchdog, but shared a 15s aggregate deadline. Node 22 CI can exhaust that deadline solely from cumulative process startup under load. Allow 60s for the matrix while retaining each client's watchdog and all protocol assertions. Verified a 700ms per-client startup delay cancels the old test at 15s and passes the updated matrix in 28.6s. A deliberately stalled client still fails at the 2s watchdog. Node 22 full suite and Node 24 UDS regressions pass; no transport implementation changes.
heggria
changed the title
heggria
added a commit
that referenced
this pull request
Oct 7, 2026
Fixes #172. Pass persisted owning run identity through imperative and event-kernel runner options and expose PI_SUBAGENT_RUN_ID to isolated Pi children. Preserve direct callers, parent environment, and other host adapters. Expose complete scanner diagnostics and normalize documentation ellipses that caused reproducible Cisco Unicode-rule false positives on main. Keep scanner versions, rules, deep-scan coverage, and high/80 gates. Validated final head f609491: all 10 CI jobs and Plugin Security Scan passed (81/100, zero high/critical). Independent of release PR #142.
added 6 commits
October 7, 2026 22:14
added 6 commits
October 8, 2026 10:16
Provision explicit operator authority and expose audited CLI/MCP mutations. Preserve singleton epochs through graceful restart and validate legacy coordinator evidence before migration. Bundle control in the existing public MCP package and verify fresh installed default-auto execution. Retain lifecycle recovery while restricting ambient Pi MCP/resource tools, and reconcile release scope documentation.
heggria
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 086185ba9e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
364
to
366
| this.#singleton = "none"; | ||
| this.#holderId = undefined; | ||
| this.#fencingEpoch = 0; |
There was a problem hiding this comment.
When an auto-mode CLI for project B starts while project A already owns the user singleton, this early return leaves B known only to the attaching process; the winner never mounts B. The subsequent auth.challenge is routed to the winner with B's project ID, where ProjectRegistry.resolve() rejects it as unmounted, so ordinary concurrent use across independently launched projects fails unless the original owner was explicitly started with every project root. Add an authenticated mount-registration path, or otherwise make the winner mount and verify the attaching project's store before forwarding its RPCs.
Useful? React with 👍 / 👎.
This was referenced Oct 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Taskflow 1.0.0 release candidate. The owner authorized complete closure through publication on 2026-10-08. Implementation baseline:
472bb98ded6c47813c8610fefb74c13f0127cdbb; the current head also reconciles release documentation. Final-head CI/security and verified main/tag/registry gates remain required.Taskflow 1.0 keeps the accepted Control Plane and closes the remaining operator and public delivery gaps. Fresh users can install the existing public
taskflow-mcp-corecarrier and run its bundledtaskflow-controlbinary in default auto mode; the release still contains exactly ten public packages. The sourcetaskflow-controlworkspace remains private.The implementation includes authenticated multi-project admission, durable command replay and artifacts, approval edits and restart readmission, terminal Receipts, registry lifecycle, bounded UDS clients, coordinated capacity, CLI/MCP and the local WebUI. Release and specification documents now map these implemented paths to their tests instead of retaining the old scaffold-only remaining-work table.
The follow-up adds an explicitly provisioned operator credential and live policy, audited capacity change and acknowledged force release through CLI/optional MCP tools. Ordinary credentials retain their previous grants. Project reservation rows remain scoped; force release marks operator-overridden accounting without claiming side effects stopped or fabricating a Receipt. A reproduced crash-recovery → graceful-restart fencing failure is fixed by durable monotonic epochs; upgrades without the new epoch file validate the complete legacy coordinator evidence before migration, and corrupt evidence remains unchanged on refusal.
Pi compatibility selectively incorporates Draft #181 head
063282bc41ab233ca2d50f7dde8f0d88e86b31e8while retaining the existing lifecycle, usage, checkpoint and recovery implementation. Actual Pi 1.0.4 showed thatread,codemodecould reach native MCP resources despite a server-tool-only exclusion; the filter now excludes ambient resource tools while preserving explicit selectors. Actual SDK 1.0.0 and 1.0.4 acceptance is recorded separately.Local validation for this exact candidate: Node 22.23.3/24.21.0 each passed 2,945 source tests and 576 public installed control/core tests; typecheck and the actual Chrome edit → TE → Receipt → isolation → revocation flow passed. Both runtimes verified ten deterministic public packages, 27 explicit imports, 87 wildcard exports and eight bins, including fresh default-auto control execution. Actual installed Pi 1.0.0 passed 17 lifecycle + two crash/restart checks per runtime; separately installed Pi 1.0.4 passed 28 compatibility + 17 lifecycle + two crash/restart checks per runtime. Before/after archive, build and installed bytes agree. The installed control harness excludes intact source-scanner-containing store.test.ts (25 cases); both complete source suites cover it. Exact commands, dependency versions and hashes are in the scope-close handoff. The preceding remote candidate
ca247acpassed CI 12/12 and Plugin Security Scan 87, but those greens do not certify this new combined head. Current-head CI/security must pass before merge. The owner authorizes merge and publication after all required gates; npm publishing and GitHub Release creation use the existing tag workflow with owner/provenance/source/integrity checks. No release is claimed before that workflow and registry verification finish.Retained boundaries: Unix UDS support; Windows pipes remain non-GA. Resolve-only containment and admission-time revocation are not an OS sandbox. Ambiguous execution retains capacity unless explicitly overridden; arbitrary in-flight recovery, invisible unmanaged legacy writers, live vault/service providers and all host/TUI combinations are not claimed by these tests.
Final dated candidate:
086185ba9e684b2652a00eca833ca943336334df. Production dependency audit is now zero after focused website Next16.3.8/Sharp0.35.5/source-map-js1.2.2 patches; all non-website importers and Pi pins remain unchanged. The synthetic singleton process-token scanner finding now uses a runtime UUID with unchanged assertions; no scanner gates changed.Current installed Pi1.0.4 PTY/TUI: 9/9. Live installed Codex0.160.0 and ClaudeCode2.1.293 executor checks passed. Native Pi live model authentication returned403 because the available provider channel supports official ClaudeCode only; OpenCode/Grok/Hermes executables were unavailable. These remain explicit environment coverage gaps, not live passes. Actual installed Pi CLI/TUI/protocol coverage uses labeled deterministic providers. The release proceeds under the documented available-host coverage boundary and the owner's full publication authorization; it does not claim every host/provider environment.