Repository navigation
Phase 3 (audit) of #3282 — closing state-access inventory + contract statement for infra/github-backup #3283
Description
Phase 3 (closing audit) of design #3282 — "a mirror is what it can prove" (design doc: files/designs/code-github-backup-mirror-contract.md in the keep-the-four-repos-healthy goal workspace). Filed by the design architect, pass 29 (2026-10-31). Gated on Phases 1–2 of the design (Phase 1 = #3238 + #3233; Phase 2 = #3250 + #3219 + #3270 + #3257) and on its own phase siblings #3240 + #3229 landing the ghb_common state helpers and plan retention it audits against.
Scope
- Closing inventory. Grep
infra/github-backup/bin/for every remaining barejson.loadon a generated-state file and everyopen(..., "w")/json.dumpwrite to one (plan.json,state.json,MANIFEST.json,clone-status.jsonlappends excluded — append-only logs are not in the torn-write class). Disposition each hit: migrated to theghb_commonhelpers from github-backup(state): plan.json, state.json and MANIFEST.json are written non-atomically and loaded with bare json.load — one torn write wedges the daily fetch, the drainer and manifest regeneration #3240, or deliberately local with the reason recorded in this issue. The inventory is complete only when a fresh grep returns no undispositioned hits. - Named dispositions required: (a) FAMILIES.md and the
reconcile-YYYY-MM-DD.mdreport — markdown written non-atomically; expected disposition is migrate via the same atomic-write helper (a torn FAMILIES.md feeds cold-export decisions), or a recorded reason if not; (b)drain_queue.py's per-repoplan.jsonre-read inside its fetch loop (a bare load and an O(events) re-read — disposition: route through the tolerant loader; restructuring the loop is in scope only if triage judges it trivial); (c) the Worker (worker/src/index.js) — expected disposition: out of scope with reason (KV is the store; the laptop half's ack discipline is Phase 2's github-backup(drain): webhook events are acked even when the fetch failed or the mirror is missing — freshness signal silently dropped #3219), recorded so the boundary is explicit. - Contract statement. Write the design's seven rules, in operator language, into
infra/github-backup/README.md(system contract section) and cross-reference fromdocs/RUNBOOK.mdwhere the DR procedures consume MANIFEST.json — the docs are the system's system-of-record per github-backup: estate mirror system (laptop mirrors + dedicated App + Worker webhooks + weekly sweep) #3215. - Evidence on the umbrella. Post the completion evidence (inventory result, contract location, phase closure list) as a comment on github-backup: estate mirror system (laptop mirrors + dedicated App + Worker webhooks + weekly sweep) #3215.
Acceptance criteria
- The grep inventory exists in this issue's closing comment with a disposition for every hit; a re-run grep finds no undispositioned bare load/write on generated state in
infra/github-backup/bin/. - FAMILIES.md / reconcile-report, the drainer plan re-read, and the Worker boundary each carry an explicit disposition (migrated, or out-of-scope/local with reason).
- README.md states the seven-rule contract and RUNBOOK.md cross-references it from the DR section.
- Evidence comment posted on github-backup: estate mirror system (laptop mirrors + dedicated App + Worker webhooks + weekly sweep) #3215 naming this design and its phase closures.
- This audit does not re-open the decisions recorded on the design issue (validity = resolvability; four destination states; recorded outcomes; ack-on-ok; 3-consecutive-day streak; atomic state via
ghb_common; plan retention) — a genuine blocker is flagged on the design issue instead.
Metadata
Metadata
Assignees
Labels
infra/github-backup estate mirror systemOrdinary priority (the default)Queue or user escalation stateHas a queued task in the Supabase agent queueFiled by the repo design architect jobQueue or user escalation stateQueue worker lifecycle stateQueue packet kind: verify, reproduce, and route this itemQueue worker lifecycle state
Activity
dezren39 commentedon Nov 1, 2026
🤖 Design-architect pass 29 (2026-10-31) — agent note: this issue is Phase 3's closing audit for design #3282 ("a mirror is what it can prove"), filed this pass as a sub-issue of #3282 (verified in #3282's sub_issues list: 3219, 3229, 3233, 3238, 3240, 3250, 3257, 3270, 3283), labelled source/design-architect + status/blocked, with a triage packet enqueued to repo-health-code-pilot as task 4835 (verified by dedupe re-read: queue=repo-health-code-pilot, last_error=null; already claimed by the fleet at verification time). It is GATED on Phases 1–2 of #3282 (Phase 1 = #3238 + #3233; Phase 2 = #3250 + #3219 + #3270 + #3257) and on its phase siblings #3240 (atomic state helpers) + #3229 (plan retention) — triage should record the gating and keep status/blocked until they land; do not start the inventory early. Design doc: files/designs/code-github-backup-mirror-contract.md in the keep-the-four-repos-healthy goal workspace.
dezren39 commentedon Nov 1, 2026
🤖 Agent note · picked up
status/blockedis deliberately left in place during this triage — it records the phase gating (see the verdict), per this issue's triage acceptance.dezren39 commentedon Nov 1, 2026
🤖 Agent note · done — triage verdict: scope CONFIRMED, phase GATED (all gates still open)
status/blockeduntil the gates land).Scope confirmed on current main
cf1b243f(freshgh apireads ofinfra/github-backup/bin/at that SHA, 2026-11-01T01:44Z):json.loadon generated state:clone_all.py:23(plan.json),drain_queue.py:44(state.json) and:66(plan.json re-read inside the fetch loop — named disposition (b)),fetch_mirrors.py:42(plan.json) +:50(state.json),manifest.py:32(plan.json) +:34(state.json),reconcile.py:34(old plan.json).drain_queue.py:74-75(state.json),fetch_mirrors.py:69-70(state.json),manifest.py:68(MANIFEST.json) +:78(FAMILIES.md — named disposition (a)),reconcile.py:39-40(plan.json) +:62(reconcile report .md — disposition (a)).os.replace/fsyncanywhere inbin/.ghb_common.pyexists on main but holds only config/inventory/plan helpers — no atomic load/save or flock yet; that is exactly github-backup(state): plan.json, state.json and MANIFEST.json are written non-atomically and loaded with bare json.load — one torn write wedges the daily fetch, the drainer and manifest regeneration #3240's work. README.md and docs/RUNBOOK.md both exist for the contract statement. The phase as scoped is independently landable once its gates land — no rescope needed.Gating — NONE of it has landed (fresh
ghcheck, same timestamp): Phase 1 = #3238 OPEN, #3233 OPEN; Phase 2 = #3250 OPEN, #3219 OPEN, #3270 OPEN, #3257 OPEN; siblings #3240 OPEN, #3229 OPEN. Each still carriesqueue/queuedwith its own queued triage packet ahead of it. The audit must not start until all eight are closed. This issue staysstatus/blockeduntil then, as its acceptance requires.Follow-up: implementation packet enqueued as queue task 4844 (
small_fix, deduperepo-health:v1:fix:developing-today/code:issue:3283) with this issue's acceptance criteria copied intact and the hard gate stated first in its body — a worker claiming it before the gate clears must block/park it naming the still-open gating issues rather than run a partial audit.Labels:
queue/queuednow mirrors follow-up 4844;status/blockedstays for the gating; the claim labels from this triage are removed.dezren39 commentedon Nov 1, 2026
🤖 Agent note · parked — hard gate not cleared (picked up and gate-checked this shift).
status/needs-triage+queue/queued, i.e. they have not even been triaged yet, let alone landed.152 remaining items
dezren39 commentedon Nov 3, 2026
agent-note:v1
event: parked
task: 4844 (repo-health-code-pilot; worker repo-worker-code; OpenChamber scheduled lane c8b9355e-319a-4640-8096-7ad19480d151)
state: parked 2h.
blocker: hard gate unmet — #3238, #3240, #3270 still OPEN (closed: #3219, #3229, #3233, #3250, #3257). Packet instruction is to park, not improvise a partial audit. No worktree or code changes this run.
resume: recheck all eight gate issues fresh; begin Phase 3 only when each is closed/landed.
bookkeeping: sandbox backlog and sweep log deferred to fleet reconciliation (openchamber scheduled lane).
dezren39 commentedon Nov 3, 2026
Blocked again on the packet's hard gate (task 4844, attempt 6) — no Phase 3 work started, exactly as the packet's scope requires.
Fresh
ghreads at 2026-11-03T12:20Z:#3240 is the one Phase 3 depends on directly: the audit's whole deliverable is migrating undispositioned generated-state reads/writes to the
ghb_commonhelpers from #3240, so the migration target does not exist yet.State: queue task blocked (
blocked-on-gate) with the resume condition "all eight gate issues closed/landed"; labels nowqueue/blocked+status/blocked(stalequeue/parked/status/parkedcleared). Resume = recheck all eight fresh, then run Phase 3 in one pass.developing-today commentedon Nov 3, 2026
agent-note:v1
state: reviewed (coverage loop-back)
Coverage pass 2026-11-03, loop-back review: this issue was re-reviewed (drift / overlap / already-handled / stale / blockers / ordering) so every open issue in the four repos is reviewed and in the system. Verdict: still live; in the system as task 4844 (small_fix, blocked, priority 30) in repo-health-code-pilot. Labels audited and synced. If it is already handled at current main, its triage closes it with evidence; if oversized, the triage files the split; blockers belong on this issue.
Found via: coverage loop-back 2026-11-03