Skip to content

Fix 0.49.0 release validation gaps - #2819

Merged
steipete merged 4 commits into
mainfrom
steipete/0-49-0-release-validation-1b2518
Aug 9, 2026
Merged

Fix 0.49.0 release validation gaps#2819
steipete merged 4 commits into
mainfrom
steipete/0-49-0-release-validation-1b2518

Conversation

@steipete

@steipete steipete commented Aug 9, 2026

Copy link
Copy Markdown
Owner

Summary

  • repair the SQLite StoreStress harness after the authoritative-cost field rename
  • correct the 0.49.0 changelog and release checklist, then complete the 0.49.1 build 115 closeout bump
  • replace the quota-sensitive Homebrew tap watcher with exact-run polling, bounded rate-limit handling, and immutable formula/cask content proof

Why

0.49.0 published successfully, but release validation found three follow-up defects: the standalone stress harness no longer compiled, the release notes/checklist were stale, and the Release CLI workflow reported failure after all assets and the Homebrew update succeeded because gh run watch hit the shared GitHub API limit.

The Settings foreground regression found during live validation was fixed separately in #2818.

Proof

  • make check
  • make test — 832 selections across 70 groups
  • Scripts/test_wait_for_homebrew_tap_update.sh
  • StoreStress release build and crash/read/descriptor proof
  • plugin engine A/B: 76 tests per engine
  • autoreview clean for each commit group
  • no release, tag, appcast, or package publication performed by this PR

@clawsweeper

clawsweeper Bot commented Aug 9, 2026

Copy link
Copy Markdown

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Aug 9, 2026
@clawsweeper

clawsweeper Bot commented Aug 9, 2026

Copy link
Copy Markdown

Codex review: found issues before merge. Reviewed August 9, 2026, 1:45 PM ET / 17:45 UTC.

ClawSweeper review

What this changes

The PR repairs StoreStress, release documentation and version metadata, and the Homebrew tap update wait used by the release workflow.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⚠️ Ready for maintainer review - 5 items remain

Keep this owner-authored PR open: the prior release-closeout blocker remains, and the new portable automation fixture has a concrete PATH dependency gap.

Priority: P2
Reviewed head: b4ed1eac74fa17747039da2d57ff55b50fdbba40

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) The PR presents substantial validation intent, but two concrete release-validation blockers remain.
Proof confidence 🦐 gold shrimp (3/6) Not applicable: This maintainer-authored release-validation PR is not subject to the external-contributor real-behavior proof gate.
Patch quality 🦐 gold shrimp (3/6) 2 actionable review findings remain.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: This maintainer-authored release-validation PR is not subject to the external-contributor real-behavior proof gate.
Evidence reviewed 4 items Unresolved release closeout: The PR sets version 0.49.1 build 115, while the corresponding top changelog section remains marked Unreleased; the updated release guide says the release command fails fast in that state.
Portable fixture dependency: The fixture narrows PATH to its mocks plus system directories but does not mock jq; the production helper requires jq before it runs any scenario.
Feature provenance: Blame attributes the release wait invocation and the fixture’s PATH setup to the Homebrew-wait hardening commit.
Findings 2 actionable findings [P1] Finalize the 0.49.1 changelog before the closeout bump
[P2] Keep jq available for the tap-wait fixture
Security None None.

How this fits together

CodexBar’s release workflow dispatches a Homebrew tap update after publishing a CLI release. The new helper polls that workflow and verifies the tap’s formula and cask before reporting success.

flowchart LR
A[Release event] --> B[Release workflow]
B --> C[Homebrew tap dispatch]
C --> D[Wait helper]
D --> E[Workflow polling]
E --> F[Formula and cask proof]
F --> G[Release result]
Loading

Before merge

  • Finalize the 0.49.1 changelog before the closeout bump (P1) - version.env moves the release to 0.49.1 build 115, but the top changelog section is still Unreleased. The updated release guide says that Scripts/release.sh fails fast in that state, so this cannot complete the stated closeout until the heading is dated. This remains unresolved from the prior review cycle.
  • Keep jq available for the tap-wait fixture (P2) - The fixture constrains PATH to its mocks plus /usr/bin:/bin, but does not provide jq; the helper requires it before any scenario runs. A macOS setup with jq only in a Homebrew prefix therefore fails the new portable check at preflight. Add a focused jq mock or preserve a validated jq path.
  • Resolve merge risk (P1) - Running the intended 0.49.1 closeout still fails its documented changelog preflight until the top section is dated.
  • Resolve merge risk (P1) - On systems where jq is available only through a Homebrew prefix, the added portable check exits at tool preflight rather than exercising any polling scenario.
  • Complete next step (P2) - The mechanical fixture repair is clear, but the version and changelog closeout requires the release owner to decide release timing.

Findings

  • [P1] Finalize the 0.49.1 changelog before the closeout bump — version.env:1-2
  • [P2] Keep jq available for the tap-wait fixture — Scripts/test_wait_for_homebrew_tap_update.sh:159
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Release automation surface 1 workflow changed, 2 shell scripts added, 1 new lint gate The patch changes how release completion is determined and adds its test to routine checks.
Patch size 507 added, 36 removed across 8 files Most changes implement the new polling and fixture path, making its executable validation material.

Merge-risk options

Maintainer options:

  1. Complete and validate the release path (recommended)
    Date the 0.49.1 changelog section at release time and make the fixture provide or retain jq before rerunning the focused fixture and make check.
  2. Split the release bump from the automation repair
    Land only the independently validated automation fix and prepare version metadata and release notes in the actual release change.

Technical review

Best possible solution:

Date the 0.49.1 changelog section when the release is ready, make the fixture self-contained with respect to jq, and then validate the release-check path on the PR head.

Do we have a high-confidence way to reproduce the issue?

Yes—source establishes both paths: the documented release preflight rejects an Unreleased top section, and the fixture’s restricted PATH omits an unmocked required tool.

Is this the best way to solve the issue?

No—the proposed release-wait architecture may be sound, but the closeout metadata and portable fixture need the two targeted repairs before this is a complete solution.

Full review comments:

  • [P1] Finalize the 0.49.1 changelog before the closeout bump — version.env:1-2
    version.env moves the release to 0.49.1 build 115, but the top changelog section is still Unreleased. The updated release guide says that Scripts/release.sh fails fast in that state, so this cannot complete the stated closeout until the heading is dated. This remains unresolved from the prior review cycle.
    Confidence: 0.99
  • [P2] Keep jq available for the tap-wait fixture — Scripts/test_wait_for_homebrew_tap_update.sh:159
    The fixture constrains PATH to its mocks plus /usr/bin:/bin, but does not provide jq; the helper requires it before any scenario runs. A macOS setup with jq only in a Homebrew prefix therefore fails the new portable check at preflight. Add a focused jq mock or preserve a validated jq path.
    Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against b20dc2374085.

Labels

Label justifications:

  • P2: The defects affect release-validation automation and are bounded, without affecting ordinary CodexBar runtime.
  • merge-risk: 🚨 automation: The PR changes release workflow completion behavior and adds a portable validation gate that currently depends on an unprovided tool.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This maintainer-authored release-validation PR is not subject to the external-contributor real-behavior proof gate.

Evidence

What I checked:

  • Unresolved release closeout: The PR sets version 0.49.1 build 115, while the corresponding top changelog section remains marked Unreleased; the updated release guide says the release command fails fast in that state. (CHANGELOG.md:3, b4ed1eac74fa)
  • Portable fixture dependency: The fixture narrows PATH to its mocks plus system directories but does not mock jq; the production helper requires jq before it runs any scenario. (Scripts/test_wait_for_homebrew_tap_update.sh:159, 34a0e0e46644)
  • Feature provenance: Blame attributes the release wait invocation and the fixture’s PATH setup to the Homebrew-wait hardening commit. (.github/workflows/release-cli.yml:503, 34a0e0e46644)
  • Current-main and release check: The PR head is not contained by a local release tag or current main; the supplied repository state identifies v0.49.0 as the latest release. (version.env:1, b4ed1eac74fa)

Likely related people:

  • steipete: The repository identifies steipete as OWNER and attributes the release workflow, helper, fixture, documentation, and version commits to this account. (role: feature owner and recent area contributor; confidence: high; commits: 34a0e0e46644, b4ed1eac74fa; files: .github/workflows/release-cli.yml, Scripts/wait_for_homebrew_tap_update.sh, Scripts/test_wait_for_homebrew_tap_update.sh)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Date the top changelog section when preparing the 0.49.1 release.
  • Make the test fixture self-contained for jq and rerun its focused check plus make check.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)
  • reviewed 2026-08-09T17:37:36.716Z sha b4ed1ea :: needs changes before merge. :: [P1] Finalize the 0.49.1 changelog before this version bump

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4ed1eac74

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

local state_dir="$tmp_dir/state-${scenario}"
local output_file="$tmp_dir/${scenario}.log"
mkdir -p "$state_dir"
PATH="$mock_bin:/usr/bin:/bin" \

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep jq available for the tap wait fixture

On macOS when make check runs this new fixture, PATH is narrowed to $mock_bin:/usr/bin:/bin; the wait script immediately does command -v jq, but the fixture does not provide a jq mock and Homebrew-installed jq lives under /opt/homebrew/bin or /usr/local/bin, not these paths. That makes the newly added portable check fail with Missing required tool: jq before any scenarios run; either keep the caller PATH or stub jq in the fixture.

Useful? React with 👍 / 👎.

@steipete
steipete merged commit 98c7196 into main Aug 9, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. P2 Normal priority bug or improvement with limited blast radius. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant