Repository navigation
fix: discover selected-provider IaC resources - #1023
Merged
Merged
Conversation
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Discover provider-declared IaC resource types through the explicitly selected,
environment-resolved provider instead of relying only on
infra.andplatform.prefixes. This fixes custom resources disappearing from plans, apply preflight,
environment output and preserved-input fingerprints.
and executable lookup. Reject conflicting raw top-level/legacy owner names
before normalizing the same bytes; installed declarations diagnose intent but
never authorize a different selected provider. Resolve only the effective
routing/default references using existing environment semantics, while
preserving raw payload references. Damaged unrelated metadata cannot veto a
valid selected owner or canonical/application config; damaged needed metadata
and selected duplicates remain fail-closed.
and input collection. Keep public legacy helper behavior through an additive
classifier-aware helper; preserve runtime service/driver/type/identity/state
and stale-plan authority checks.
including persistence/restart/repeat, selected-provider negatives, custom input
drift and safe rejection of a real old CLI's omission-derived delete plan.
No provider-specific implementation, dependency, RPC/schema, CI/release workflow,
or private application workaround changes.
Verification
All Go commands use Go 1.26.5 and
GOWORK=offwith readonly modules.40 pass / 0 fail / 0 skip.
existing skips; all 151 tested packages pass plus 20 no-test-file packages.
Both new native test parents and their seven subtests pass without skips in
the required local acceptance run.
go vet ./...,go build ./..., actual CLI build, format/diff and existingpublic-workflow policy checks pass. Full golangci-lint 2.12.0 reports zero issues.
0 fail / 0 skip, 124.800 seconds. Lead independently executed the complete
corrected native matrix: 9 pass / 0 fail / 0 skip, package 133.240 seconds;
integration 75.74 seconds, review regressions 55.03 seconds. All 42 observed
SDK children are reaped and both automatic temporary roots are absent.
It runs PLAN ONLY on an owned mixed-state clone and proposes custom omission
deletes. Candidate rejects that exact plan before mutation, preserves Workflow
and provider state, and produces a complete replan. The old CLI never applies.
optional unconfigured old-proof skip does not count as acceptance.
The full-repository and earlier native counts above describe the production
correction snapshot before the later fixture-only CI performance fix below.
The initial new-code review found two Important defects: raw interpolated routing
was rejected before dispatch expansion, and unrelated damaged metadata vetoed
valid configs. Compiled behavioral and actual native REDs reproduced both;
fixed-test unit/native inverse failures and restored GREENs exercise the narrow
corrections. One targeted serious changed-code recheck returned SHIP-IT with no
Critical or Important findings: all 15 classes checked, fresh 134/0/0 focused
race and all 12 hashes matching. That review is closed; no cosmetic review loop.
Final hashes were checked before and after the lead native proof. Local candidate
automatic VCS metadata reflects the parent checkout under nested Git worktrees
and is not release/source attestation.
This is original Task26/PR15 of the approved 26-task/15-PR recovery plan. Immutable
released-successor asset/module/native verification and the downstream private
app's complete eight-resource no-apply render remain separate acceptance gates.
No cloud apply, deployment, enrollment or spend was performed.
Scope Manifest
PR Count: 15
Tasks: 26
Status: Locked 2026-10-04T04:48:25Z
Design,
implementation plan.
This PR implements only its original row; it does not claim completion of the
whole recovery plan or the ten overall slimming outcomes.
Doc-reconciliation: clean. Runtime launch evidence from the earlier corrected
CLI/SDK execution, not fabricated sample output:
The acceptance command uses
TASK26_BASELINE_WFCTLset to the checksum-verifiedimmutable v0.86.1 Darwin/arm64 binary. Empty or mismatched explicit selection
fails before fixture launch; optional unconfigured skip is not acceptance.
Final full-run native parents also pass (78.68s and 51.06s). All 12 recorded
builder native roots, including failed/inverse paths, are absent; no sessions
or runtime fixtures remain.
Only the providers' file-backed external resource dependency is a fixture. The
CLI, manifest lookup, public SDK, typed driver boundary and saved-plan/state
logic are real. Intentional domain-rejection controls exit nonzero and are
asserted by the tests; they are not launch failures hidden by a success label.
CI Fixture Correction
The first Linux run
37187171230failed at Go's default 10-minute packagedeadline, with
wfctlstill compressing a later conformance fixture. Both newnative parents passed in 137.69 seconds. The exact base CI had already taken
600.831 seconds, leaving no practical package margin.
Commit
5ea61d7dchanges only the native fixture environment: retain inheritedrace-reporting policy and append
atexit_sleep_ms=0, matching existing repositoryfixtures. Race builds, failure exit codes, real CLI/SDK execution, workload/state
assertions and exact process cleanup are unchanged. No timeout, workflow,
dependency or global environment changes.
The policy regression fails before the change and with the fix removed, then
passes after restoration: five cases, no skips. The required baseline-backed
native matrix passes all nine cases in 52.637 seconds; all 42 SDK children are
reaped and temporary roots removed. Full
wfctlrace-and-coverage verificationunder the DEFAULT deadline exits zero in 504.091 seconds: 3,301 completed cases,
five existing skips, no failures and 66.9% coverage. Three prompt-prefixed PASS
markers are accounted for explicitly; the unchanged deliberate nested sample
failure is separately checked by its passing fallback-error-propagation parent.
Build, vet, zero-issue lint, format/diff and both policy scripts pass.
One bounded adversarial review of this fixture-only diff found no substantive
issues, with a fresh five-case regression and unchanged hash. It is closed;
earlier resolved discovery reviews remain closed. New exact-head Linux CI
37190581128is running, not claimed accepted. Merge, immutable release andpublished native/module/downstream render proof remain separate gates.