Conversation
Owner
Author
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8f8b2100d8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a2a551313f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cc0001aca2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ad7a716dc3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
omry
changed the title
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a5b2707cbf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f70983e09c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This was referenced Aug 13, 2026
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
Owner
Author
|
PR-cycle state — maintained automatically. Do not edit by hand. {
"approval_evidence": {
"active_delivery_deferral_ledger_digest": "sha256:1079dd768d75f00a71355354356d2c32d4fcfc495ab76504591bea35ae78e209",
"attestation_preservation": [
{
"baseline_content_identity_sha256": "sha256:8c9105bf17f77bfbb9b697397043c7e9722151d7a6f0e9bd31101fd97ba6ea37",
"document_path": "docs/design/reploy-environments-design.md",
"document_sha256": "sha256:5f5d6c94c8d8e4d6f2df4b8d79f86e85e906c47366548011e7efe864be06d02b",
"review_content_identity_sha256": "sha256:1c5e9fad81f221c723a66bb3f1833c183b8fea24d548847f5df70a4a5b6fbd99",
"sidecar_path": "docs/design/.review/reploy-environments-design.md",
"sidecar_sha256": "sha256:9e1e662ff34ede5b052078db458e366bcb0bdb10bc1ab1a5f39f0012cf3df59e",
"target_content_identity_sha256": "sha256:4cdb3671e6ca6ecb5bfb96e6a9a45dfba2fa5cec7b1eb2aec2312fbac3938ea8"
}
],
"candidate_revision_fingerprint": "sha256:225843498a0f4be1ab27871ad84a40a18db9c41dcfd34ec6cd89b74f1ec4e524",
"current_review_messages": [],
"current_unresolved_threads": [],
"message_thread_dispositions_digest": "sha256:adb59e4cdcd0fab26abf5c066e64773dcee9aa745053dfb934f4867bf055ab37",
"required_check_conclusions": [
{
"name": "Gitar",
"status": "success"
},
{
"name": "Package build",
"status": "success"
},
{
"name": "Python tests",
"status": "success"
},
{
"name": "Recording integration",
"status": "success"
},
{
"name": "Website docs",
"status": "success"
}
],
"review_request": {
"body_digest": "sha256:312b6e9b39214135258f4d97b5abd42839ed7d6c8087694b6ac2e5056db44e6c",
"head_sha": "49109acfdf51f146692f41b05d5537d81149444d",
"id": 5395625416
},
"review_result": {
"body_digest": "sha256:47f29a5855c449f5e04415102269438cb38705ec07ce16d338086324b33b3338",
"head_sha": "49109acfdf51f146692f41b05d5537d81149444d",
"id": 5395669211,
"state": "APPROVED"
},
"schema": "awd:swe:pr-cycle-approval-evidence:v1"
},
"approval_fingerprint": "sha256:73a9ee2bd5ba09ac430a6b2dd9a40f48f148e05d29d5f37cd8a77d3c7ee25ab9",
"approved": true,
"checks": [],
"cycle_closed": true,
"deferrals": [
{
"claim": "Envoy must install and verify the same trusted locale values before launching controlled Bash.",
"disposition": "Apply and review this alignment only during PR 23's own cycle after PR 1 converges.",
"id": "R70-b-controlled-bash",
"invariant": "controlled Bash performs no application-controlled locale-database lookup before OmegaFlow takes control",
"source_comment_id": 3838945235,
"source_head": "528ca501f88919ea09bdda18154c13ae579438c9",
"source_review_id": 5002788840,
"status": "open",
"target_pr": 23,
"thread_id": "PRRT_kwDOTOFvvM6bgaRi",
"title": "Reserve the locale database before controlled Bash",
"type": "dependent-design-slice"
}
],
"delivery_deferrals": [],
"findings": [
{
"assessment": "real; the pre-Envoy bootstrap shell can consult application-controlled terminal databases before OmegaFlow code runs",
"claim": "The bootstrap shell must use a manifest-validated trusted terminal definition and must not fall through to application TERMINFO paths or $HOME/.terminfo.",
"design_blocking": true,
"fix_class": "launch-environment-trust",
"id": "R68-a-bootstrap",
"invariant": "the Reploy bootstrap shell performs no application-controlled terminal-database lookup before OmegaFlow takes control",
"resolution": "PR 1 rejects application TERM, TERMINFO, and TERMINFO_DIRS, composes fixed trusted values, and fails preparation when the manifest-validated xterm-256color entry is unavailable.",
"resolved_at_head": "86db4dc27fd7fb62254055ea78835e1bdde105ac",
"resulting_head": "86db4dc27fd7fb62254055ea78835e1bdde105ac",
"scope": "current-slice",
"severity": "P2",
"source_finding": "R68-a",
"source_pr": 1,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bb71u",
"thread_status": "resolved",
"title": "Force a trusted terminfo database before bootstrap",
"user_disposition": "approved split across PR 1 bootstrap ownership and PR 23 controlled-Bash ownership on 2026-08-23",
"verification": "The current head retains the fixed trusted TERM, TERMINFO, and TERMINFO_DIRS values and manifest-validation failure path.",
"verified_at_head": "528ca501f88919ea09bdda18154c13ae579438c9",
"where": "docs/design/reploy-environments-design.md"
},
{
"assessment": "verified non-actionable after the intentional stack split",
"claim": "PR 1 points to dependent Envoy, protocol, and implementation-plan documents that are absent from its isolated layer diff.",
"disposition": "The documents exist in dependent native-stack PRs 23, 24, and 25; PR 1 intentionally contains only the bottom environment-model slice.",
"id": "GITAR-split-scope",
"scope": "non-actionable",
"source": "gitar-bot",
"source_comment_id": 3837661933,
"source_review_id": 5001620651,
"status": "verified-non-actionable",
"thread_id": "PRRT_kwDOTOFvvM6bdCGO",
"thread_status": "resolved",
"title": "Dependent design documents are absent from the isolated PR 1 diff",
"verified_at_head": "528ca501f88919ea09bdda18154c13ae579438c9",
"where": "docs/design/reploy-environments-design.md:17-22"
},
{
"assessment": "real; rejecting explicit INPUTRC still lets Readline load $HOME/.inputrc",
"claim": "Application-controlled Readline configuration can rewrite or prematurely submit the typed Envoy bootstrap command before OmegaFlow takes control.",
"design_blocking": true,
"fix_class": "launch-environment-trust",
"id": "R69-a",
"invariant": "neither bootstrap nor controlled Bash loads application-controlled Readline configuration before OmegaFlow takes control",
"proposed_fix_classification": "current-slice truth fix; no public schema or wire-protocol change",
"resolution": "PR 1 reserves INPUTRC=/omegaflow-runtime/etc/inputrc, requires a manifest-validated empty read-only file, and fails preparation instead of falling back to $HOME/.inputrc.",
"resulting_head": "528ca501f88919ea09bdda18154c13ae579438c9",
"scope": "current-slice",
"severity": "P2",
"source": "codex",
"source_comment_id": 3838871478,
"source_head": "86db4dc27fd7fb62254055ea78835e1bdde105ac",
"source_review_id": 5002722112,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bgNwr",
"thread_status": "resolved",
"title": "Pin Readline configuration away from application HOME",
"where": "docs/design/reploy-environments-design.md:569-572"
},
{
"assessment": "real for PR 1's pre-Envoy bootstrap; the controlled-Bash half belongs to dependent PR 23",
"claim": "The pre-Envoy bootstrap must not load application-controlled locale data before OmegaFlow takes control.",
"design_blocking": true,
"fix_class": "launch-environment-trust",
"id": "R70-a",
"invariant": "the Reploy bootstrap shell performs no application-controlled locale-database lookup before OmegaFlow takes control",
"proposed_fix": "Reject application LANG, LANGUAGE, LOCPATH, and every LC_* name; reserve LC_ALL=C.UTF-8, LANG=C.UTF-8, and LOCPATH=/omegaflow-runtime/lib/locale; require the complete selected locale tree to be regular-file-only, manifest-validated, readable, and on the non-shadowable read-only runtime mount.",
"proposed_fix_classification": "PR 1 current-slice truth fix; no dependent-document, public-schema, or wire-protocol change",
"resolution": "PR 1 rejects application LANG, LANGUAGE, LOCPATH, and every LC_* name; reserves LC_ALL=C.UTF-8, LANG=C.UTF-8, and LOCPATH=/omegaflow-runtime/lib/locale; and requires a complete regular-file-only, readable, digest-matching locale manifest on the non-shadowable read-only runtime mount.",
"resulting_head": "a69dab9157f989da6ceeaab3bdbc75bc2ce67d3b",
"scope": "current-slice",
"scope_split": "The same source review identifies a controlled-Bash obligation owned by PR 23 and recorded separately as R70-b-controlled-bash.",
"severity": "P2",
"source": "codex",
"source_comment_id": 3838945235,
"source_head": "528ca501f88919ea09bdda18154c13ae579438c9",
"source_review_id": 5002788840,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bgaRi",
"thread_status": "resolved",
"title": "Reserve the locale database before launching Bash",
"where": "docs/design/reploy-environments-design.md:563-565"
},
{
"assessment": "real; validating only the application environment mapping misses forbidden launch variables inherited from the selected workload image",
"claim": "The effective workload launch environment must not inherit application-image variables that can alter or prevent the pre-Envoy bootstrap before OmegaFlow takes control.",
"design_blocking": true,
"fix_class": "launch-environment-trust",
"id": "R71",
"invariant": "the prepared workload launch environment contains no forbidden exact-name or forbidden-prefix variable from either blueprint configuration or image inheritance before reserved values are applied",
"proposed_fix": "Validate the prepared deployment's effective workload environment, including image-config inheritance, against the same forbidden exact names and prefixes before applying and validating the reserved launch values.",
"proposed_fix_classification": "PR 1 current-slice truth fix; no dependent-document, public-schema, or wire-protocol change",
"resolution": "PR 1 now requires the complete image-plus-application effective pre-reservation environment to be materialized and inspected after image selection, rejects every forbidden exact name and prefix there, then rematerializes and validates the final reserved environment fail-closed.",
"resulting_head": "a69dab9157f989da6ceeaab3bdbc75bc2ce67d3b",
"scope": "current-slice",
"severity": "P2",
"source": "codex",
"source_comment_id": 3839087895,
"source_head": "815935f524d45fe5009a0db53d47fe8f846bfd9e",
"source_review_id": 5002915569,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bgyaz",
"thread_status": "resolved",
"title": "Validate variables inherited from the workload image",
"where": "docs/design/reploy-environments-design.md:559-560"
},
{
"assessment": "real rollout-contract gap; the accepted host workload default is retained, but the design must prevent the Reploy-backed production cutover until the default host path has Envoy parity",
"claim": "The first explicitly isolated Reploy milestone must not make the incomplete host-backed Reploy path the execution path for default recordings.",
"design_blocking": true,
"fix_class": "delivery-rollout-gate",
"id": "R72",
"invariant": "default recordings retain a supported execution path throughout migration; isolated Reploy proof is explicit until host-workload Envoy parity authorizes production cutover",
"proposed_fix": "Keep workload_backend=host as the product default, require the isolated milestone to select reploy explicitly, retain the existing host path before cutover, and prohibit enabling the Reploy-backed production path for default recordings until host-workload parity passes.",
"proposed_fix_classification": "PR 1 current-slice truth fix to the rollout contract; no default-value, dependent-document, public-schema, or wire-protocol change",
"resolution": "PR 1 now distinguishes the post-cutover host default from migration behavior: omitted production configuration stays on the existing FIFO-backed host path, the terminal-only isolated milestone selects Reploy explicitly through a bounded non-production entry point, and the Reploy-backed default path remains disabled until separately reviewed host-Envoy parity and cutover pass.",
"resulting_head": "96e45fb0c335cb2d4a9abbeb60cc721318a08e08",
"scope": "current-slice",
"severity": "P1",
"source": "codex",
"source_comment_id": 3839162433,
"source_head": "a69dab9157f989da6ceeaab3bdbc75bc2ce67d3b",
"source_review_id": 5002982414,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bg_FA",
"thread_status": "resolved",
"title": "Gate the default workload path until host parity",
"where": "docs/design/reploy-environments-design.md:52-55"
},
{
"assessment": "real; eager typed-default normalization erases the distinction required by the pre-cutover routing contract",
"claim": "Pre-cutover routing must distinguish omitted workload_backend from an explicit host selection.",
"design_blocking": true,
"fix_class": "migration-routing-provenance",
"id": "R73",
"invariant": "until host-Envoy cutover, omitted workload placement selects the legacy FIFO path while explicit host fails capability validation and explicit reploy selects the isolated milestone",
"proposed_fix": "Keep workload_backend input presence distinct through pre-cutover capability routing: omission is represented internally as absent, while only user configuration or a CLI override counts as explicit. Route absent to FIFO, explicit host to the targeted unsupported-host error, and explicit reploy to the isolated milestone; normalize absence to host only after routing. Do not add a public value or serialize the presence bit into Reploy blueprints.",
"proposed_fix_classification": "current-slice truth fix; internal composition provenance only, with no public schema value or Reploy contract change",
"resolution": "PR 1 now preserves whether workload_backend was omitted through pre-cutover capability routing: omission selects the legacy FIFO path, explicit host fails with the targeted unsupported-host error, and explicit reploy selects the isolated milestone. Absence normalizes to host only after routing, without a new public value or Reploy blueprint field.",
"resulting_head": "bb5eb68b41af8f09816bfa37404d61a5fb5d81cc",
"scope": "current-slice",
"severity": "P1",
"source": "codex",
"source_comment_id": 3840532771,
"source_head": "7663452cbb69d25f93ef293f35a3eec19cba1e8f",
"source_review_id": 5004356422,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bkky9",
"thread_status": "resolved",
"title": "Preserve whether the host backend was explicitly selected",
"where": "docs/design/reploy-environments-design.md:65-69"
},
{
"assessment": "real current-slice inconsistency; implementations could write and read refresh candidates from different roots when recording_dir is external",
"claim": "The refresh section names project-root/.omegaflow/generated while the directory layout and studio.data_dir place generated state under the recording directory.",
"design_blocking": false,
"fix_class": "refresh-candidate-path-consistency",
"id": "R74",
"invariant": "blueprint refresh candidates have one canonical path derived from the configured studio.data_dir for both in-project and external recording directories",
"proposed_fix": "Define the refresh candidate beneath the configured studio.data_dir, using <studio.data_dir>/generated/reploy/app/<name>.yaml. State explicitly that an external recording directory therefore keeps generated candidates under its .omegaflow data directory, not under the project-root .omegaflow.",
"proposed_fix_classification": "current-slice design truth fix restoring the existing recording data-directory contract; no new public configuration or delivery deferral",
"resolution": "PR 1 now defines refresh candidates only beneath the configured studio.data_dir at <studio.data_dir>/generated/reploy/app/<name>.yaml and explicitly resolves sibling recording directories beneath their own nested .omegaflow data directory.",
"resolved_at_head": "d909ef2490ef20171cd0495abcaf27e195240d78",
"resulting_head": "d909ef2490ef20171cd0495abcaf27e195240d78",
"scope": "current-slice",
"severity": "P2",
"source": "codex",
"source_comment_id": 3840667242,
"source_head": "bb5eb68b41af8f09816bfa37404d61a5fb5d81cc",
"source_review_id": 5004498953,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bk7bo",
"thread_status": "resolved",
"title": "Choose one refresh-candidate directory",
"verification": "Focused path and ownership assertions, repository documentation checks, and the clean round-4 deep design review all passed on the resulting bytes.",
"verified_at_head": "d909ef2490ef20171cd0495abcaf27e195240d78",
"where": "docs/design/reploy-environments-design.md:895"
},
{
"assessment": "real current-slice launch-environment gap; inherited Bash mail hooks can execute or block before OmegaFlow takes control",
"claim": "An interactive Bash used as /bin/sh can expand MAILPATH notifications or obey MAILCHECK before accepting the typed Envoy command.",
"delivery_deferral": false,
"design_blocking": true,
"fix_class": "launch-environment-trust",
"id": "R75",
"invariant": "the Reploy bootstrap shell performs no application-controlled hook, expansion, or command before OmegaFlow takes control",
"proposed_fix": "Add MAIL, MAILCHECK, and MAILPATH to the existing effective-environment denylist; state that bootstrap performs no application-selected mail notification hook before OmegaFlow takes control; and add matching hostile-mail-hook acceptance coverage.",
"proposed_fix_classification": "current-slice",
"proposed_fix_footprint": [
"docs/design/reploy-environments-design.md effective environment denylist",
"controlled-session bootstrap trust statement",
"launch-environment acceptance coverage"
],
"resolution": "PR 1 now rejects MAIL, MAILCHECK, and MAILPATH from the complete image-plus-application effective environment before bootstrap, states that the controlled-session bootstrap processes no application-selected mailbox path or mail notification hook, and requires hostile mail-hook acceptance coverage.",
"resolved_at_head": "8b47c0880e643de992e94981b66d3ac8e944143a",
"resulting_head": "8b47c0880e643de992e94981b66d3ac8e944143a",
"scope": "current-slice",
"severity": "P2",
"source": "codex",
"source_comment_id": 3841638073,
"source_head": "d909ef2490ef20171cd0495abcaf27e195240d78",
"source_review_id": 5005691847,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bnfKA",
"thread_status": "resolved",
"title": "Reject Bash mail hooks before bootstrap",
"verification": "Focused denylist, trust-statement, operation-source, and terminal-only acceptance assertions passed; schema_docs and release_notes passed; deep-design-review round 5 attests the final document bytes clean.",
"verified_at_head": "8b47c0880e643de992e94981b66d3ac8e944143a",
"where": "docs/design/reploy-environments-design.md:594-598"
},
{
"assessment": "real current-slice inconsistency; a supported custom data_dir inside a Git workspace can remain tracked despite the design invariant that generated state is ignored",
"claim": "Bootstrap hard-codes an ignore rule for <recording_dir>/.omegaflow even though generated runs and refresh candidates belong to the configured studio.data_dir.",
"delivery_deferral": false,
"design_blocking": true,
"fix_class": "configured-data-directory-ignore",
"id": "R76",
"invariant": "every configured generated-state directory inside a Git workspace is ignored without overwriting existing ignore rules",
"proposed_fix": "Define <recording_dir>/.omegaflow as the default rather than mandatory data_dir. Resolve studio.data_dir, and when it lies inside a Git worktree, preserve or add one root-anchored ignore rule for its path in that worktree root's .gitignore. Add no rule outside a worktree and fail bootstrap when data_dir equals a worktree root.",
"proposed_fix_classification": "current-slice truth fix restoring the existing generated-state ownership invariant; no new public configuration, subsystem, dependency, or delivery deferral",
"proposed_fix_footprint": [
"recording-directory terminology",
"configured data-directory ignore algorithm",
"bootstrap procedure",
"bootstrap acceptance coverage"
],
"resolution": "The design now requires bootstrap to derive the generated-state ignore target from the configured studio.data_dir, validate the containing worktree, preserve existing ignore bytes and mode, and verify the final effective-ignore result.",
"resolved_at_head": "9e1babecdc306a99c05eec4d1cfa55115bd72f01",
"resulting_head": "9e1babecdc306a99c05eec4d1cfa55115bd72f01",
"scope": "current-slice",
"severity": "P2",
"source": "codex",
"source_comment_id": 3842271788,
"source_head": "8b47c0880e643de992e94981b66d3ac8e944143a",
"source_review_id": 5006451195,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bpIoa",
"thread_status": "resolved",
"title": "Ignore the configured data directory",
"verification": "Independent deep-design-review round 7 was clean on the resulting document bytes; the refreshed existing sidecar matches those bytes; focused documentation checks and the complete CI suite passed; and the GitHub review thread was resolved after the successor head was published.",
"verified_at_head": "9e1babecdc306a99c05eec4d1cfa55115bd72f01",
"where": "docs/design/reploy-environments-design.md:791-794"
},
{
"assessment": "real current-slice design overclaim; atomic replacement and the OmegaFlow lock do not implement filesystem-wide compare-and-swap",
"claim": "The design says a bounded reread-and-retry prevents lost updates, but the worktree-scoped lock coordinates only OmegaFlow writers and leaves a final check-to-rename race with non-cooperating external editors.",
"delivery_deferral": false,
"design_blocking": true,
"fix_class": "narrow-external-writer-concurrency-guarantee",
"id": "R77",
"invariant": "the design states only concurrency guarantees that its specified coordination and publication mechanism can enforce",
"resolution": "The design now limits lost-update protection to cooperating OmegaFlow processes, retains bounded retry for changes detected before replacement, states the unavoidable final race with non-cooperating external writers, and forbids rollback that could overwrite a later edit.",
"resolved_at_head": "1668f55ab7521d5aa59f8f727eac3af6c72329fb",
"resulting_head": "1668f55ab7521d5aa59f8f727eac3af6c72329fb",
"scope": "current-slice",
"severity": "P2",
"source": "codex",
"source_comment_id": 3843083612,
"source_head": "9e1babecdc306a99c05eec4d1cfa55115bd72f01",
"source_review_id": 5007369349,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6brQub",
"thread_status": "resolved",
"title": "Do not overclaim protection from external .gitignore writers",
"verification": "Canonical deep-design-review round 8 was clean on the resulting bytes; the helper-owned sidecar matches those bytes and unchanged reviewed baselines; focused documentation checks and the complete 998-test CI suite passed; the published PR bytes match the attested hash; and the GitHub review thread is resolved.",
"verified_at_head": "1668f55ab7521d5aa59f8f727eac3af6c72329fb",
"where": "docs/design/reploy-environments-design.md:824-825"
},
{
"assessment": "real current-slice correctness gap; operation cleanup intentionally does not stop permitted setup services, while the design promises deterministic produced-output evidence",
"claim": "A setup service outside the operation process tree can mutate an allowed produced file or directory while Envoy hashes it, so the recorded digest may not represent one stable tree state.",
"delivery_deferral": false,
"design_blocking": true,
"fix_class": "produced-path-snapshot-stability",
"id": "R78",
"invariant": "produced-output evidence is derived from one stable workload-tree state, or inspection detects concurrent mutation and fails without recording a digest",
"proposed_fix": "Require bounded descriptor-relative inspection to compare a complete sorted tree snapshot before and after hashing, validate each opened regular file before and after reading, and fail the operation inspection if any identity, kind, size, timestamp, directory entry, or read length changes. Add a hostile concurrent-writer acceptance case.",
"proposed_fix_classification": "current-slice truth fix using the existing inspection-failure path; no public schema, wire-protocol concept, subsystem, or delivery deferral",
"proposed_fix_footprint": [
"workload-side file and produced-output inspection contract",
"terminal-only concurrent-produced-path acceptance coverage"
],
"resolution": "The design now requires produced-output inspection to establish one stable source state even though setup services remain outside operation cleanup. Observed mutation, or inability to establish stability, fails through the typed inspection path without an accepted digest or evidence record.",
"resolved_at_head": "49109acfdf51f146692f41b05d5537d81149444d",
"resulting_head": "49109acfdf51f146692f41b05d5537d81149444d",
"scope": "current-slice",
"severity": "P2",
"source": "codex",
"source_comment_id": 3843416678,
"source_head": "1668f55ab7521d5aa59f8f727eac3af6c72329fb",
"source_review_id": 5007746263,
"status": "resolved",
"thread_id": "PRRT_kwDOTOFvvM6bsJGI",
"thread_status": "resolved",
"title": "Reject produced-path mutation during hashing",
"verification": "Canonical deep-design-review round 9 was clean on the resulting bytes; the helper-owned sidecar matches those bytes and all four unchanged reviewed baselines; focused documentation checks and the complete 998-test CI suite passed; the published PR bytes match the attested hash; and the GitHub review thread is resolved.",
"verified_at_head": "49109acfdf51f146692f41b05d5537d81149444d",
"where": "docs/design/reploy-environments-design.md:522-530"
}
],
"pr": {
"base_ref": "main",
"base_sha": "88bacd3dc497a39060105d3698f10911ff4d0ec9",
"body_digest": "sha256:d13a4e45fa233f9191127b45cfe6d4c3b52089fe5d02c62c75ceac95bb20b8df",
"diff_digest": "sha256:36714b05d4dd0adb674d78b7cbe9bac1dc0ac12ac5d9bcf619677e98b2fe4f4c",
"head_ref": "pr1",
"head_sha": "49109acfdf51f146692f41b05d5537d81149444d",
"pr": 1,
"repository": "omry/omegaflow",
"scope_authority": [
{
"digest": "sha256:5f5d6c94c8d8e4d6f2df4b8d79f86e85e906c47366548011e7efe864be06d02b",
"path": "docs/design/reploy-environments-design.md"
}
],
"title_digest": "sha256:b543aa47f282694cd34d5008aa68c81418c99a05c0aed07f7110f0c82450bfc1"
},
"record_version": 44,
"review_request": {
"created_at": "2026-08-24T13:07:24Z",
"head_sha": "49109acfdf51f146692f41b05d5537d81149444d",
"id": 5395625416
},
"review_result": {
"body_digest": "sha256:47f29a5855c449f5e04415102269438cb38705ec07ce16d338086324b33b3338",
"head_sha": "49109acfdf51f146692f41b05d5537d81149444d",
"id": 5395669211,
"state": "APPROVED",
"submitted_at": "2026-08-24T13:11:04Z"
},
"revision_fingerprint": "sha256:225843498a0f4be1ab27871ad84a40a18db9c41dcfd34ec6cd89b74f1ec4e524",
"rounds": [
{
"checks": [
"focused launch-environment predicates",
"nox schema_docs release_notes",
"current-slice fix review"
],
"finding_ids": [
"R69-a"
],
"outcome": "findings",
"resulting_head": "528ca501f88919ea09bdda18154c13ae579438c9",
"review_request_id": 5386766359,
"review_result_id": 5002722112,
"reviewed_head": "86db4dc27fd7fb62254055ea78835e1bdde105ac",
"round": 1
},
{
"checks": [
"focused launch-environment predicates",
"nox schema_docs release_notes",
"current-slice fix review"
],
"finding_ids": [
"R70-a"
],
"outcome": "findings",
"resulting_head": "815935f524d45fe5009a0db53d47fe8f846bfd9e",
"review_request_id": 5386911660,
"review_result_id": 5002788840,
"reviewed_head": "528ca501f88919ea09bdda18154c13ae579438c9",
"round": 2
},
{
"checks": [
"focused launch-environment predicates",
"nox schema_docs release_notes",
"current-slice fix review"
],
"finding_ids": [
"R71"
],
"outcome": "findings",
"resulting_head": "a69dab9157f989da6ceeaab3bdbc75bc2ce67d3b",
"review_request_id": 5387222335,
"review_result_id": 5002915569,
"reviewed_head": "815935f524d45fe5009a0db53d47fe8f846bfd9e",
"round": 3
},
{
"checks": [
"focused rollout-contract predicates",
"nox schema_docs release_notes",
"current-slice fix review"
],
"finding_ids": [
"R72"
],
"outcome": "findings",
"resulting_head": "96e45fb0c335cb2d4a9abbeb60cc721318a08e08",
"review_request_id": 5387509979,
"review_result_id": 5002982414,
"reviewed_head": "a69dab9157f989da6ceeaab3bdbc75bc2ce67d3b",
"round": 4
},
{
"checks": [
"focused rollout-contract predicates",
"nox schema_docs release_notes",
"current-slice fix review"
],
"finding_ids": [],
"outcome": "clean",
"resulting_head": "96e45fb0c335cb2d4a9abbeb60cc721318a08e08",
"review_request_id": 5387632453,
"review_result_id": 5387644812,
"reviewed_head": "96e45fb0c335cb2d4a9abbeb60cc721318a08e08",
"round": 5
},
{
"checks": [
"focused omission-provenance predicates (16 mutation checks)",
"nox schema_docs release_notes",
"deep-design-review attestation refresh",
"current-slice fix review"
],
"finding_ids": [
"R73"
],
"outcome": "findings",
"resulting_head": "bb5eb68b41af8f09816bfa37404d61a5fb5d81cc",
"review_request_id": 5390386530,
"review_result_id": 5004356422,
"reviewed_head": "7663452cbb69d25f93ef293f35a3eec19cba1e8f",
"round": 6
},
{
"applied_fix_footprint": [
"canonicalized refresh output beneath studio.data_dir",
"required bootstrap to ignore nested recording .omegaflow state while preserving existing rules",
"refreshed the clean helper-owned design attestation"
],
"checks": [
"focused design ownership/path assertions",
"nox schema_docs release_notes",
"deep-design-review round 4 clean",
"current-slice diff review"
],
"disposition_changes": [
{
"finding_id": "R74",
"from": "open",
"to": "resolved"
}
],
"effective_diff_digest": "sha256:adfc8174dcd7f0dc31b9fe1a528fe0aaf7093e1ef74c4d4eef1f618cfb9cdc8c",
"finding_ids": [
"R74"
],
"outcome": "findings",
"proposed_fix_footprint": [
"docs/design/reploy-environments-design.md refresh candidate path",
"recording-state ownership and bootstrap ignore rule",
"docs/design/.review/reploy-environments-design.md attestation"
],
"resulting_head": "d909ef2490ef20171cd0495abcaf27e195240d78",
"review_request_id": 5390640274,
"review_result_id": 5004498953,
"reviewed_head": "bb5eb68b41af8f09816bfa37404d61a5fb5d81cc",
"root_cause": "The refresh section hard-coded the project-root .omegaflow directory while the storage model made studio.data_dir recording-directory-owned; the ownership terminology also failed to separate tracked project configuration from generated recording state.",
"round": 7
},
{
"applied_fix_footprint": "docs/design/reploy-environments-design.md plus its pre-existing helper-owned sidecar; 2 files, +24/-22",
"checks": [
"focused MAIL, MAILCHECK, and MAILPATH contract assertions",
"nox schema_docs release_notes",
"deep-design-review round 5 clean",
"current-slice design and sidecar diff review"
],
"disposition_changes": [
{
"finding_id": "R75",
"from": "open",
"to": "resolved"
}
],
"effective_diff_digest": "sha256:85f9bd4f79a0ee4e35d63e72f0fc7e8694b33724b784a05f7e5a89069f80cd01",
"finding_ids": [
"R75"
],
"outcome": "findings",
"proposed_fix_footprint": [
"effective launch-environment denylist",
"controlled-session bootstrap trust statement",
"terminal-only hostile mail-hook acceptance coverage"
],
"resulting_head": "8b47c0880e643de992e94981b66d3ac8e944143a",
"review_request_id": 5392286502,
"review_result_id": 5005691847,
"reviewed_head": "d909ef2490ef20171cd0495abcaf27e195240d78",
"root_cause": "The effective-environment denylist covered other Bash pre-bootstrap controls but omitted Bash mail-check variables that can expand a notification hook before the typed Envoy command is accepted.",
"round": 8,
"workflow_mistakes": "Two malformed read-only focused assertions, one unsupported read-only sl diff option, and one rejected sl amend --to/--logfile combination exited without changing files, history, or GitHub state; supported checks and the owning-commit amend then completed successfully."
},
{
"applied_fix_footprint": [
"specified configuration-derived generated-state ignore targeting",
"specified Git and Git-compatible Sapling worktree and ignore behavior",
"specified safe atomic ignore-file update and final verification",
"refreshed the pre-existing clean design-review attestation"
],
"checks": [
"deep-design-review round 7 clean",
"review sidecar digest matches current design bytes",
"nox schema_docs release_notes",
"nox ci (998 tests plus documentation checks)",
"GitHub review thread resolved on the published successor head"
],
"disposition_changes": [
{
"finding_id": "R76",
"from": "open",
"to": "resolved"
}
],
"effective_diff_digest": "sha256:a1e1e62fe048707dffdc20ce539d1b5f552fa241cb068916a3f93982acc5da3c",
"finding_ids": [
"R76"
],
"outcome": "findings",
"proposed_fix_footprint": [
"docs/design/reploy-environments-design.md bootstrap and ignore contract",
"docs/design/.review/reploy-environments-design.md existing review attestation"
],
"resulting_head": "9e1babecdc306a99c05eec4d1cfa55115bd72f01",
"review_request_id": 5393350714,
"review_result_id": 5006451195,
"reviewed_head": "8b47c0880e643de992e94981b66d3ac8e944143a",
"root_cause": "The bootstrap rule named one conventional recording directory instead of deriving the ignored generated-state directory from the supported studio.data_dir setting.",
"round": 9
},
{
"applied_fix_footprint": [
"limited lost-update protection to cooperating OmegaFlow writers",
"retained bounded retry for detected pre-replacement changes",
"stated the final non-cooperating external-writer race and no-rollback rule",
"refreshed only the existing helper-owned design sidecar",
"updated PR 1 descriptions and synchronized the existing nine-PR native stack"
],
"checks": [
"deep-design-review round 8 clean",
"review sidecar digest matches current design bytes and reviewed baselines",
"nox schema_docs release_notes",
"nox ci: 998 passed plus documentation checks",
"published PR 1 design hash matches the attested target hash",
"all nine existing PR heads and native stack 26 metadata verified exact",
"GitHub external-writer review thread resolved"
],
"disposition_changes": [
{
"finding_id": "R77",
"from": "open",
"to": "resolved"
}
],
"effective_diff_digest": "sha256:3988336b57b1a8ed79b67175a0421f2c279186a942ff4889a6145f0ae0fe692a",
"finding_ids": [
"R77"
],
"outcome": "findings",
"proposed_fix_footprint": [
"docs/design/reploy-environments-design.md ignore transaction and validation boundary",
"docs/design/.review/reploy-environments-design.md existing clean attestation",
"PR 1 owning-commit and pull-request descriptions"
],
"resulting_head": "1668f55ab7521d5aa59f8f727eac3af6c72329fb",
"review_request_id": 5394580704,
"review_result_id": 5007369349,
"reviewed_head": "9e1babecdc306a99c05eec4d1cfa55115bd72f01",
"root_cause": "The prior text treated a cooperative worktree lock plus a pre-replacement comparison as if it provided filesystem-wide compare-and-swap against non-cooperating external writers.",
"round": 10
},
{
"applied_fix_footprint": [
"required one stable source state for each selected produced path or tree",
"failed closed on observed mutation or inability to establish stability",
"left concrete race detection and failure-code mapping to protocol v1 in PR 23",
"added the concurrent setup-service mutation acceptance case",
"refreshed only the existing helper-owned design sidecar",
"updated PR 1 descriptions and synchronized the existing nine-PR native stack"
],
"checks": [
"deep-design-review round 9 clean",
"review sidecar digest matches current design bytes and four reviewed baselines",
"nox schema_docs release_notes",
"nox ci: 998 passed plus documentation checks",
"published PR 1 design hash matches the attested target hash",
"all nine existing PR heads and native stack 26 metadata verified exact",
"GitHub produced-path mutation review thread resolved"
],
"disposition_changes": [
{
"finding_id": "R78",
"from": "open",
"to": "resolved"
}
],
"effective_diff_digest": "sha256:36714b05d4dd0adb674d78b7cbe9bac1dc0ac12ac5d9bcf619677e98b2fe4f4c",
"finding_ids": [
"R78"
],
"outcome": "findings",
"proposed_fix_footprint": [
"docs/design/reploy-environments-design.md produced-output inspection invariant",
"docs/design/reploy-environments-design.md hostile concurrent-writer acceptance case",
"docs/design/.review/reploy-environments-design.md existing clean attestation",
"PR 1 owning-commit and pull-request descriptions"
],
"resulting_head": "49109acfdf51f146692f41b05d5537d81149444d",
"review_request_id": 5395117625,
"review_result_id": 5007746263,
"reviewed_head": "1668f55ab7521d5aa59f8f727eac3af6c72329fb",
"root_cause": "Operation cleanup excludes permitted environment-setup services, so the prior design allowed a selected file or directory to change while its digest was computed without requiring detection of that unstable source state.",
"round": 11
},
{
"checks": [
"attributable exact-head regular review approved",
"zero inline review messages",
"zero unresolved review threads"
],
"convergence": {
"new_fix_footprint": [],
"same_invariant_recurred": false,
"status": "clean",
"unresolved_current_slice_findings": [],
"unresolved_design_blockers": []
},
"effective_diff_digest": "sha256:36714b05d4dd0adb674d78b7cbe9bac1dc0ac12ac5d9bcf619677e98b2fe4f4c",
"finding_ids": [],
"outcome": "clean",
"resulting_head": "49109acfdf51f146692f41b05d5537d81149444d",
"review_request_id": 5395625416,
"review_result_id": 5395669211,
"reviewed_head": "49109acfdf51f146692f41b05d5537d81149444d",
"round": 12
}
],
"schema": "awd:swe:pr-cycle-state",
"version": 1
} |
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 86db4dc27f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 528ca501f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 815935f524
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a69dab9157
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7663452cbb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bb5eb68b41
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d909ef2490
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b47c0880e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e1babecdc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Owner
Author
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1668f55ab7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Specify the Reploy-backed recording environment model, including placement, blueprints, lifecycle, artifact boundaries, bootstrap, failure handling, and security. Distinguish tracked project-root .omegaflow configuration from generated recording state under studio.data_dir. Define portable repository-owned ignore behavior for Git and Git-compatible Sapling worktrees, including tracked-state rejection, innermost-worktree selection, literal rules, safe atomic .gitignore updates for cooperating OmegaFlow writers, bounded retry for detected changes, an explicit non-cooperating external-writer boundary, and final effective-ignore verification. Specify that application- and image-inherited Bash mail-notification controls are rejected before bootstrap, with matching hostile-hook acceptance coverage. Require produced-output inspection to establish one stable source state even though environment-setup services remain outside operation cleanup. Fail closed with no accepted digest or evidence record if a selected path changes during inspection or its stability cannot be established. Leave the concrete race-detection algorithm and failure-code mapping to protocol v1. Record the clean design-review attestation for the final document bytes.
Code Review ✅ Approved 1 resolved / 1 findingsDefines the OmegaFlow Reploy-backed recording environment documentation, including controller blueprints, fail-closed shell-launch contracts, and ignore-file management. No issues found. ✅ 1 resolved✅ Quality: Design defers authority to Envoy/impl-plan docs deleted in this PR
OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source |
Owner
Author
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Define the OmegaFlow Reploy-backed recording environment model, including controller and workload placement, toolchain and workload blueprints, lifecycle, artifact boundaries, bootstrap, failure handling, and security.
Specify a fail-closed shell-launch contract: application-configured and image-inherited launch controls are rejected from the effective environment, history is disabled, and Readline, terminal-database, and C.UTF-8 locale inputs come only from manifest-validated read-only runtime data. Bash mail-notification controls are rejected before bootstrap can process an application-selected mailbox path or notification hook.
Clarify rollout sequencing: host workload remains the long-term default, but default recordings stay FIFO-backed until separately reviewed host-Envoy parity and cutover; the terminal-only isolated milestone explicitly selects Reploy.
This is the bottom design slice. It depends on the reviewed Reploy blueprint and controlled-session contracts. Terminal-control details belong to the dependent Envoy design slice.
Preserve omitted-versus-explicit workload placement through pre-cutover capability routing: omitted configuration stays on FIFO, explicit host fails, and explicit Reploy selects the isolated milestone. Normalize omission to host only after routing, without adding a public backend value.
Distinguish the tracked project-root
.omegaflowconfiguration from generated recording state understudio.data_dir. For data inside a supported Git or Git-compatible Sapling worktree, bootstrap must reject already tracked state, select the innermost enclosing worktree, establish a portable repository-owned ignore rule, update the worktree-root.gitignorethrough a literal, symlink-safe atomic transaction that serializes cooperating OmegaFlow writers and retries detected pre-replacement changes, explicitly make no lost-update guarantee for non-cooperating external writers, and verify the final effective-ignore result. Data outside recognized worktrees requires no ignore-file mutation. Refresh candidates remain beneathstudio.data_dir.Require produced-output inspection to establish one stable source state even though environment-setup services remain outside operation cleanup. Any selected-path mutation observed during inspection, or inability to establish stability on the backing filesystem, fails closed with no accepted digest or evidence record. Protocol v1 owns the concrete race-detection algorithm and failure-code mapping.
The final design bytes have a clean hash-bound review attestation. Documentation only; implementation remains in later slices.