Skip to content

fix: preserve prior session profiles and bound metadata warnings - #578

Merged
pedronauck merged 1 commit into
mainfrom
fix/issue-566-session-upgrade-warnings
Sep 9, 2026
Merged

pedronauck merged 1 commit into
mainfrom
fix/issue-566-session-upgrade-warnings

Conversation

@pedronauck

@pedronauck pedronauck commented Sep 9, 2026 •

Copy link
Copy Markdown
Member

What & why

Fixes #566.

An upgrade from 0.3.0-beta.21 left valid version 4 session creation profiles unreadable: the version 5 codec required strict equality even though the only new profile field was optional ACP selections. Every list scan then logged the same failure once per session, while doctor did not inspect persisted session witnesses.

The persistence codec now explicitly supports versions 4 and 5. Version 4 cannot contain ACP selections. Historical canonical bytes, profile references, policy digests, and per-session creation digests remain intact; new runtime profiles still use version 5. This preserves catalog references and immutable managed-session witnesses rather than rehashing historical state. Unsupported versions and tampered witnesses still fail integrity validation.

Both session listing and memory scanning now aggregate unreadable metadata into one bounded warning per scan. Each scanner retains a constant-size fingerprint/backoff state. Identical failures repeat at most once every five minutes; a changed failure set is reported immediately, including changes outside the five-item sample, and a healthy scan resets backoff. This reduces repeated log output without skipping reads or claiming the reporter's CPU causality.

Doctor adds runtime.session_metadata through the existing DiagnosticItem envelope. The read-only probe checks on-disk metadata and global creation witnesses and returns checked/unreadable counts, up to five redacted bounded samples, and an omitted count. It neither repairs files nor changes warning cadence; cancellation/scan errors remain explicit probe errors.

How you verified it

Implementation and verification by Codex, GPT-6-Astra at High reasoning. Reviewed the changed diff before final validation.

  • Reproduced the old failure with a new owning regression: store: unsupported session creation profile version 4.
  • Generated synthetic historical fixtures using the actual profile/hash functions from v0.3.0-beta.21 (93a5c04c880c893a4a975accb469b9276e702b0b), not current hash functions. Metadata read/rewrite and global SQLite close/reopen preserve the original witnesses and stored bytes. Tampering and unknown future versions remain rejected.
  • Focused race-enabled store, globaldb, session, memory, doctor, and API tests passed. Twelve repeated list/scan calls produce one warning; changed failures, five-minute backoff, repair/recurrence, bounded evidence, and HTTP doctor filtering are covered in existing suites.
  • CGO_ENABLED=1 go test -race -tags=integration ./internal/store/globaldb ./internal/session -run 'TestGoalSessionCreationIdentityIntegration|TestManagerIntegrationUsesRealSQLitePerSessionDB' -count=1 passed with real SQLite.
  • Built and ran the real daemon in an isolated home on port 56656. CLI and HTTP agreed on 9 checked sessions, 8 injected unreadable metadata files, 5 samples, and 3 omitted. Removing only the injected fault fixtures restored a healthy probe. The beta.21 session remained listed; its two history events were byte-identical after a daemon restart, and its original metadata SHA-256 was unchanged. Twelve list calls over 60 seconds generated one warning summary.
  • Strict QA audit passed and targeted teardown recorded clean: true. The complete scope, commands, runtime evidence paths, and impact audit are in docs/qa/reports/2026-09-09-issue566-session-upgrade.md; RT-002 and RT-022 were updated.
  • Final local make gate passed all affected lanes on b975c49a8057b6dc5c6fe627d8431f6dd162270f, including the .json.golden fixture paths. Lint: zero warnings/errors; race-enabled tests: pass. Resource caps: GOMAXPROCS=4 COMPOZY_GO_TEST_P=1 COMPOZY_GO_LINT_CONCURRENCY=2. Unchanged package evidence was reused. The owner authorized publishing while this final local run was still finishing; it has now completed successfully.

Limits: this verifies the historical creation-profile format inside current SQLite streams, not every shape in a complete beta.21 home. Doctor does not validate every events.db; the history reader was exercised independently. No live provider spawn or benchmark was required. No claim is made to reproduce 90 MB/h or attribute CPU load. The lab also logged existing user-skill warnings unrelated to this change.

Impact

  • User state: lossless version-aware persistence decoding; no SQL shape change/migration number, no witness rewrite, no reset, and no deletion of user sessions. Migration notes explain the v4→v5 optional-field transition.
  • CLI/HTTP/UDS: operator doctor gains a probe ID and bounded evidence within its existing envelope. Existing flags and DTO shapes remain compatible. No native tool IDs or schemas change.
  • Extensibility/hooks/config: no changes to hooks, extensions, bridge/SDK contracts, credentials, or config. Dreaming defaults and gates are unchanged.
  • Isolation: original session/workspace identities stay bound to their historical hashes. Doctor remains an operator diagnostic; no agent read grants change.
  • Web/docs: existing session readers regain historical sessions; no Web component change. Troubleshooting, official Compozy runtime-operation reference, release migration notes, and QA scenarios co-ship.

  • make gate passes locally; this PR is delivered only after its required CI checks are green
  • New or changed behavior is covered by tests, or I explained above why not
  • If an agent wrote or co-wrote this, I named it above and verified the result myself

@vercel

vercel Bot commented Sep 9, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
compozy-site Ready Ready Preview Sep 9, 2026 5:09pm UTC

Request Review

@coderabbitai

coderabbitai Bot commented Sep 9, 2026 •

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 8 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: b4c9f76d-f587-4fac-a48a-3836237601d6

📥 Commits

Reviewing files that changed from the base of the PR and between 9b422f1 and b975c49.

⛔ Files ignored due to path filters (7)
  • .release-notes/restore-prior-session-witnesses.md is excluded by !**/*.md
  • docs/qa/reports/2026-09-09-issue566-session-upgrade.md is excluded by !**/*.md
  • docs/qa/scenarios/RT-002.md is excluded by !**/*.md
  • docs/qa/scenarios/RT-022.md is excluded by !**/*.md
  • internal/store/testdata/session-profile-v4/README.md is excluded by !**/*.md
  • packages/site/content/docs/operations/troubleshooting.mdx is excluded by !**/*.mdx
  • skills/compozy/references/runtime-operations.md is excluded by !**/*.md
📒 Files selected for processing (18)
  • internal/api/core/doctor_payload.go
  • internal/api/core/handlers_test.go
  • internal/doctor/doctor_test.go
  • internal/doctor/session_metadata_probe.go
  • internal/logger/failure_warnings.go
  • internal/memory/dream.go
  • internal/memory/dream_test.go
  • internal/memory/dream_workspace.go
  • internal/session/manager_types.go
  • internal/session/query.go
  • internal/session/query_health.go
  • internal/session/query_test.go
  • internal/store/globaldb/global_db_session_test.go
  • internal/store/meta_test.go
  • internal/store/session_creation_profile.go
  • internal/store/session_creation_profile_test.go
  • internal/store/testdata/session-profile-v4/meta.json.golden
  • internal/store/testdata/session-profile-v4/profile.json.golden

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@greptile-apps

greptile-apps Bot commented Sep 9, 2026

Copy link
Copy Markdown

Greptile Summary

This PR restores compatibility with version 4 persisted session-creation profiles, aggregates repeated metadata warnings with bounded evidence and backoff, and adds a read-only session-metadata doctor probe.

  • Preserves historical canonical profile bytes and creation witnesses while continuing to emit version 5 profiles for new sessions.
  • Reports unreadable metadata through bounded listing and memory-scan warnings.
  • Exposes checked and unreadable session counts through runtime.session_metadata.
  • Adds focused persistence, warning-cadence, doctor API, integration, documentation, and QA coverage.

Confidence Score: 5/5

The PR appears safe to merge, with the compatibility, diagnostic, and warning-cadence changes coherently implemented and covered.

No actionable correctness, security, or repository-rule violation remains; production wiring exposes the probe, historical version 4 identities are preserved, and bounded warnings do not alter scan behavior.

Important Files Changed

Filename Overview
internal/store/session_creation_profile.go Accepts historical version 4 profiles while rejecting version 5 ACP selections in version 4 witnesses.
internal/logger/failure_warnings.go Introduces constant-space failure sampling, deterministic fingerprints, and per-scanner warning backoff.
internal/session/query_health.go Adds a read-only scan that validates session metadata and available global creation witnesses.
internal/session/query.go Replaces per-session metadata warnings with one bounded summary per listing scan.
internal/memory/dream_workspace.go Aggregates unreadable metadata encountered during memory consolidation scans.
internal/doctor/session_metadata_probe.go Adds the runtime.session_metadata diagnostic with bounded structured evidence.
internal/api/core/doctor_payload.go Registers the new diagnostic when the production session manager exposes its health source.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Session metadata scan] --> B{Metadata readable?}
  B -- No --> C[Add bounded failure sample]
  B -- Yes --> D{Creation witness present?}
  D -- No --> E[Count checked session]
  D -- Yes --> F[Load content-addressed profile and catalog identity]
  F --> G{Witnesses match?}
  G -- No --> C
  G -- Yes --> E
  C --> H[Return failure summary]
  E --> H
  H --> I[Doctor diagnostic]
  H --> J[Fingerprint and warning backoff]
Loading

Reviews (1): Last reviewed commit: "fix: preserve prior session profiles and..." | Re-trigger Greptile

@pedronauck

Copy link
Copy Markdown
Member Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Sep 9, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review rate limited.


Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 14 seconds.

@pedronauck

Copy link
Copy Markdown
Member Author

@coderabbitai full review

@coderabbitai

coderabbitai Bot commented Sep 9, 2026 •

Copy link
Copy Markdown
Contributor
⚠️ Action not completed

Review rate limited.


Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 16 minutes.

@pedronauck

Copy link
Copy Markdown
Member Author

CI follow-up for b975c49a8057b6dc5c6fe627d8431f6dd162270f:

The complete local affected gate has now passed, including the unchanged-byte .json.golden fixtures. Greptile completed with confidence 5/5 and no actionable findings. CodeRabbit has not reviewed yet: its success status accompanies a shared-capacity rate-limit response, so it is still pending.

The only completed CI failure is Go race shard 7/8, propagated to the aggregate Verify check. TestCancelTurn/Should_let_a_concurrent_session_stop_prevent_turn_rebind returned a quiesced turn plus store: session database closed at manager_prompt_contract_test.go:2914. None of that stop/cancel implementation or test was changed here. Inspection points to the explicit session-stop finalization racing the turn-quiescence event write; the process-exit watcher already waits for pending turn cancellation, while the explicit stop path can reach finalization separately.

The unchanged owning regression passed 20 isolated repetitions with GOMAXPROCS=4 CGO_ENABLED=1 go test -race -gcflags=modernc.org/...=-d=checkptr=0 -p=1 -parallel=4 ./internal/session -run '^TestCancelTurn$/^Should_let_a_concurrent_session_stop_prevent_turn_rebind$' -count=20. This establishes intermittency, not a production fix. A diagnostic shard rerun was rejected while the workflow is still active; it will be retried after completion. No assertions were weakened, no errors were suppressed, and no unrelated lifecycle changes were folded into this compatibility PR.

@pedronauck
pedronauck merged commit 9f75406 into main Sep 9, 2026
72 of 74 checks passed
@pedronauck
pedronauck deleted the fix/issue-566-session-upgrade-warnings branch September 9, 2026 17:39
This was referenced Sep 27, 2026

This branch was successfully deployed

1 active deployment
Preview — b975c49a Deployed Sep 9, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Previous-version sessions in the store make an idle daemon log the same warning ~12x/min per session, and compozy doctor never reports it

1 participant