feat: persistent runtime policy overlays and admin lifecycle #102
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "feat/runtime-policy-overlays"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Scope
Substantive runtime policy overlays: trusted local ESM policy-modules API1, persistent
policyPluginssettings, instance-wide Harness idle reservation, PolicyManager prepare/start/stop/rollback, CLI startup/tick/drained shutdown and privileged/policy-plugin status|use|reload|disable|baselineadapter. Adapter is owned in harness/plugins PR#6 (merged), pinned to immutable 519b12ffa6850d6f5b17f401c7b39027757b72eb with digest verification; no generated source edits.Required identities cannot be disabled; captured registered baselines restore without touching review findings/history/budget. Failed preparation retains previous hooks. Old-stop failure restarts previous resources. Failed cleanup or rollback quarantines affected hooks until restart, honestly reports uncertain lifecycle. New request generations supersede asynchronous preparation/old-stop, shutdown awaits activation before cleanup. Full docs include limits.
Validation
Final candidate: full570/570 tests PASS, typecheck/build/diff-check PASS. 11 focused tests cover persistence/reopen, replace/reload/remove/baseline, required protection before persistence, actual busy Harness turn deferral, malformed/start/stop failures, cleanup retry/quarantine, generation races during prepare and old stop, shutdown serialization and admin-only host registration. Three recovery regression tests also PASS.
Review transparency
Used current persistent review status/critical assessment; no independent round or budget reset. Stale recovery P1 contradicts already merged src/execution-recovery.ts scoped recoveryGrant and atomic consumption in src/execution.ts; author rechecked and reran one-claim regression. It is assessed evidence-backed false-positive for this candidate; no open P0/P1. P2 historical recovery claims also covered by current regression tests. Author inspected this changeset directly.
Limits / activation
Trusted code, not sandbox. Entry cache-busting does not unload dependencies. No factory timeout/forced termination; hung modules may need process restart. Idle boundary covers CLI-managed turns, not arbitrary direct external registry calls. Required replacement can change semantics by explicit trusted admin choice; built-in review engine remains Core. General plugins remain startup-only. Desired config persists after activation failure; repair before restart. Merge/build does NOT activate a running process; deployment/GitOps is separate. Previous Matrix acceptance and PR100/101 were not repeated.