refactor: modernize Go runtime packages - #293
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedToo many files! This PR contains 1684 files, which is 1384 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (126)
📒 Files selected for processing (1684)
You can disable this status message by setting the |
|
React Doctor found no new issues. 🎉 Reviewed by React Doctor for commit |
|
Too many files changed for review. ( |
Status
Important
This pull request is intentionally Draft. It is a portable checkpoint for the ongoing Go modernization workstream, not a merge-ready completion claim.
The branch contains a large, evidence-driven modernization and hardening pass across the Go runtime, SDK, tests, generated contracts, public documentation, the official Compozy skill, and living QA artifacts. The complete package audit has been performed, but the remaining backlog, upstream reconciliation, public QA, and one fresh final
make gate-fullstill need to be completed before this PR can leave Draft.Summary
This PR:
cmd/,internal/, andsdk/go/against the requested Go 1.21–1.26 feature set;golang-masterrules instead of relying on conclusions made under the prior skill version;skills/compozyreferences, and QA tracker changes where public behavior changed;Portable sources of truth:
Why
The runtime had accumulated several classes of risk that could not be solved safely with mechanical rewrites:
This work treats every modernization suggestion as a hypothesis. A feature is adopted only when its owning package proves the behavior. Candidates that would invent policy, weaken cancellation, retain sensitive values, change wire contracts, or distort benchmarks are explicitly rejected or deferred.
Audit coverage
The restarted audit uses Go 1.26.4 and covers:
internal/package;cmd/binaries;sdk/gomodule;Eight non-overlapping evidence slices cover the complete tree:
The audit re-evaluates all 20 requested feature families, including:
errors.AsType[T];b.Loop();omitzero;os.OpenRoot/os.Root;SplitSeq,FieldsSeq, andLines;sync.WaitGroup.Go;slices,maps,min, andmax;testing/synctest;iter.Seqand range-over-function;os.Process.WithHandleandErrNoHandle;OnceFunc,OnceValue, andOnceValues;math/rand/v2;cmp.Or;T.ArtifactDir,T.Attr, andT.Output;http.CrossOriginProtection;runtime/trace.FlightRecorder;bytes.Buffer.Peek;unique.The exact adoption/rejection evidence for each feature is in the committed backlog. Notable examples:
b.Loop()is adopted only after benchmark setup no longer depends onb.N.WaitGroup.Gois used only where admission is already excluded from racing a zero-countWait.AsType[T]is used where the typed value is consumed; predicate-only checks retainerrors.Asbecause discarding the returned error violates repository policy.os.Process.WithHandleis not applied mechanically becauseSignalandKillalready use retained handles where available.FlightRecorderis deferred to a separate policy-bearing goal because it is process-global, synchronous to export, and can contain sensitive raw traces.uniqueis rejected without heap-profile evidence because process-lifetime retention of dynamic or sensitive strings would be a regression.Major implementation areas
Runtime, lifecycle, and cleanup ownership
WaitGroup.Go,OnceFunc,OnceValue,OnceValues, andtesting/synctestcandidates replace ceremony without changing lifetime rules.SDK and transport hardening
io.Reader; HTTP callers own context cancellation and exactly one body close.Browser and HTTP security
CrossOriginProtectionalone cannot address.Filesystem capabilities and publication
os.Root-confined operations and rejects absolute paths, escaping symlinks, overwrite-through-symlink, and unsafe archive forms.Cryptographic identity allocation
crypto/randhard cut with no timestamp or pseudorandom fallback.Task durability and settlement
PR #290 preservation
PR #290's durable Loop feedback and post-commit wake semantics were inspected and preserved during rebase integration.
Local migration conflicts were resolved by renumbering local migrations without editing the PR #290 migration bytes. Task terminalization now owns GlobalDB migration
00042.Protected hashes at this checkpoint:
Existing migration bytes must remain immutable. Any future schema change must be append-only.
Provider, extension, registry, bridge, and MCP boundaries
Memory, recall, heartbeat, and knowledge refresh
SessionDB owner and physical-family hard cut
Every per-session
events.dbis now bound to:{session_id, workspace_id}owner; anddatabase_idfor that exact SQLite family.The owner is propagated through writers, readers, read-only pools, Manager queries, Observe, ledgers, demo seeders, extension fixtures, GlobalDB Watch Events, CLI, HTTP, UDS, SSE, and event consumers.
The implementation provides:
SessionDB migrations now extend through v5. Migration v5 creates one immutable 32-character lowercase hexadecimal
database_id, seeds it during fresh bootstrap or v4 upgrade, and prevents later insert/update/delete.Final PM01 review remediation
Six formal internal review rounds were performed. The operator explicitly ended the loop after round 6; this PR does not request a seventh automated Deep Review round.
All eight findings from round 6 were remediated in commit
3e35bf90:StopandRequestStopwait for Clear finalization.00042migration regression uses a canonicalShould …subtest.The committed backlog records PM01 as
Verified, while correctly keeping the post-v5 public QA replay and workstream-final gate pending.Hard cuts and compatibility posture
This repository is greenfield alpha. The PR intentionally avoids compatibility bridges:
Obsolete paths are deleted or rejected explicitly rather than supported in parallel.
Compozy Impact Audit
Native tools
The SessionDB v5, exact rollback, and Clear-finalization delta does not add or change a
compozy__*tool ID, toolset, descriptor, I/O schema, digest, risk flag, availability diagnostic, or capability gate. Session history, events, and clear keep their existing CLI, HTTP, UDS, core, and native fallback contracts.Earlier accumulated Task, notification, registry, provider, MCP, and automation changes co-ship their native descriptors and tests. These surfaces must be reconciled after rebasing onto current
main, particularly where PR #291 removed bundles in favor of extension kits.Extensibility and hooks
The final SessionDB delta introduces no new extension, hook event, capability, tool/resource, bundle, registry, Bridge SDK, MCP sidecar, or
config.tomlkey/default. Session Stop now waits for an admitted Clear finalization, but hook names, payloads, post-commit ordering, and extension capability surfaces are unchanged.The broader PR directly affects extension startup authority, resource source sessions, bridge delivery identity/lifecycle, hook completion, provider probes, MCP auth, Registry installation, marketplace classification, and public Go SDK lifecycle. Those changes include focused contract and integration evidence.
Workspace data isolation
session_db_owneris session-scoped and embeds the workspace owner.session_db_identityis scoped to one physical SessionDB family and never leaves the local SQLite database.Owner and physical identity propagate through CLI/HTTP/UDS → core/Manager → readers/writers/pools/connectors. SSE, event, cache, and watch paths cannot relabel or reuse a foreign family. Missing, foreign, same-owner-replaced, legacy, or ahead families are refused before mutation.
The wider PR also preserves workspace identity through notification cursors/deliveries, provider cache keys, Task/automation transactions, filesystem roots, events, caches, and cross-surface query paths.
Official Compozy skill
Public runtime and Task behavior is reflected in:
skills/compozy/references/runtime-operations.mdskills/compozy/references/tasks-and-orchestration.mdThe physical SessionDB
database_idand Clear manifest phase are internal recovery details and do not add a public tool, CLI path, hook, capability, bundle/resource, memory/network/task semantic, or operator configuration field.Web and documentation
The final PM01 delta does not change
web/orpackages/ui, so it requires no UI screenshot. Site database and session lifecycle docs describe fail-closed whole-family ownership and recovery without promising adoption, rebinding, repair, or a new configuration surface.Other public changes in the accumulated branch include generated OpenAPI/types, provider surfaces, Task terminalization, notification behavior, Registry/marketplace behavior, and corresponding site/skill documentation.
QA tracker
Session event owner isolation
docs/qa/scenarios/RT-session-event-owner-isolation.mdis currentlyuntestedfor the v5 delta.The earlier targeted walk passed:
events.db/WAL/SHM preservation;clean=trueand zero surviving processes.That evidence predates physical
database_id, so the next walk must repeat the public contract and add same-owner physical-family continuity/replacement without editing owner or identity rows.Historical report:
docs/qa/reports/2026-08-03-session-event-owner-isolation.mdClear conversation
docs/qa/scenarios/RT-017.mdremainsblocked-verify.Its next isolated walk must prove:
Other known QA work
RT-026remainsblocked-verifybecause the isolated lab did not have a real Daytona backend or CLI. A fake is not acceptable evidence for that clause.MS-040still needs isolated execution before the technically accepted Vault work can be marked Verified.pass.Validation completed
Focused evidence completed across the workstream includes:
-racesuites for Task, GlobalDB, SessionDB, Session, Fileutil, Daemon, HTTP/UDS, Bridge SDK, Registry, Provider, Extension, MCP, Memory, Heartbeat, Soul, and other changed owners;go veton affected owners;make codegenandmake codegen-checkfor schema/OpenAPI/generated-code owners;git diff --check.The final PM01 remediation specifically passed:
-race;00042migration/reopen regression;make go-lintwith zero issues after the local findings were fixed.Full-gate status
This Draft PR does not claim a current green
make gate-full.The retained gate status at checkpoint was:
The stale full failure came from the first escalated run before six local lint findings were fixed. Those findings were then fixed, and
make go-lintpassed with zero issues. A later full run ended without publishing a reusable full record. The operator explicitly requested that the checkpoint skip further gates and proceed to commits, backlog, Impact Audit, QA tracker, and handoff.Before this PR can leave Draft, it still needs one fresh
make gate-fullafter the final mutation and after currentmainhas been reconciled.Current upstream divergence
The branch was rebased onto main commit
d30b810aafter PR #290. Since then,origin/mainadvanced with:At Draft creation time, the branch has four commits not in
origin/main, whileorigin/mainhas three commits not in this branch.The next source-changing step must use the repository
git-rebaseworkflow and inspect #291 carefully. Bundle, extension, Registry, bridge, public docs, official skill, generated contract, and QA conflicts must preserve the intended hard cut from both branches rather than silently selecting one side.Remaining backlog before Ready for Review
The committed execution backlog currently contains:
This Draft is intentionally large because it preserves the exact checkpoint while remaining explicit about incomplete work.
Highest-value active items include:
RT-026with a real Daytona backend;DaemonClientat consumer-owned interfaces after frozen surfaces are reconciled;memory.recall.signals.metrics_enabledacross config, CLI/native, API/UDS, Web, OpenAPI, docs, tests, and QA after Recall source freeze, with no alias or migration;MS-040;deslopand final verification at true workstream completion;make gate-fullafter the final mutation;The complete row-by-row queue and evidence is in
.compozy/tasks/go-modernization/analysis/golang-master/current-backlog.md.Commit checkpoints
The portable checkpoint is anchored by:
The second commit deliberately force-adds
.compozy/tasks/go-modernization/**, which is normally ignored, so another machine and reviewer can recover the exact analysis, backlog, and continuation state.Reviewer guidance
Draft completion checklist
origin/mainand reconcile PR refactor: replace bundles with extension kits #291/fix: changelog generation #292.make gate-fulland record a current passing fingerprint.