Repository navigation
Run the dependency update wave and harden cascade - #5
Merged
Merged
Conversation
The repository was renamed on GitHub to `SpineEventEngine/delivery`, so the submodule's name, path, and URL now follow it. The `cascade` script, the dependency graph, the README, and the rollout docs use the new name. The Maven artifact is still `spine-delivery-server`, so the registry probe marker is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`prep` pulls the consumer's base branch, which moves the recorded `config` pointer but not its checkout, so the tree looked dirty and `prep` stopped. A repository whose `config` submodule was never initialized passed for one that does not consume `config` and silently skipped the pull. `prep` now runs `git submodule update --init -- config` right after branching. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Cascade waves run clean builds routinely; the owner approved moving the rule from "ask" to "allow". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`cascade graph` saw local objects only as `Obj.member` or `io.spine.dependency.local.Obj.member`. Build scripts that load the Compiler through `config`'s accessors — `classpath(spineCompiler.pluginLib)` in `core-jvm` and `jdbc-storage` — therefore had no `compiler` edge, so waves never re-pinned the Compiler there. Those repos then built against the published Compiler and its transitive tool-base artifacts, which bundle an older Protobuf runtime. The derivation now treats `spineCompiler.member` and `coreJvmCompiler.member` like their objects (references in `force(...)` still create no edge), and `id(<accessor>.pluginId)` as a plugin application. The regenerated graph gains `compiler -> core-jvm` and `compiler -> jdbc-storage`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Address the documentation review: name the accessors that have a `pluginId` form, say what the false `prep` error is, and quote `delivery` as a name. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🔵 Needs a closer look
The wave remains active, and merging must wait for wave closure and final human review.
0 open findings
What changed in this PR
Supports the SDK-wide dependency refresh wave and hardens summit’s cascade orchestration.
Changes:
- Renames
delivery-servertodeliveryacross submodule configuration and documentation. - Initializes
configat its recorded commit and recognizes compiler accessor aliases in dependency discovery. - Records wave progress and allows
./gradlew cleanwithout a permission prompt.
| File | Description |
|---|---|
| README.md | Updates the delivery repository name and link. |
| docs/rollout/rebuild.md | Updates the delivery publishing prerequisite. |
| docs/dependency-graph.md | Renames delivery and adds compiler dependency edges. |
| cascade | Hardens config preparation and compiler dependency discovery. |
| .gitmodules | Renames the delivery submodule and URL. |
| .claude/settings.json | Allows Gradle clean without prompting. |
| .agents/tasks/toolbase-split-migration.md | Updates the delivery reference. |
| .agents/tasks/cascade.md | Updates delivery references in task documentation. |
| .agents/tasks/cascade-refresh-a0cbbbf.md | Records wave progress and decisions. |
| .agents/tasks/cascade-refresh-a0cbbbf.json | Records machine-readable wave state. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2108d3b59a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
alexander-yevsyukov
changed the title
cascade-refresh-a0cbbbf wave and harden cascadecascade
The alias scan's `grep` exits 1 when a repository references no `spineCompiler`/`coreJvmCompiler`, and `pipefail` turned that into a failed `objs` assignment. It only went unnoticed because `derive_scoped` runs inside command substitutions, where `errexit` is not inherited. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`cascade` took the registry serving a repo's marker artifact as proof of a complete publish. A `publish.yml` run that fails midway has already uploaded some modules: compiler `.072` reached the registry without `compiler-testlib`, `cascade` marked it `published-remote`, and `validation` shipped into a CI that could not resolve the missing module. `publish_verdict` now reads the conclusion of the `publish.yml` run for the merge commit of the repo's wave PR. A failed run yields the new state `publish-failed` (with the run linked in `status` and a `FIX-PUBLISH` action), a running one stays `merged`, and `ship` refuses an upstream whose publish failed. Without a recorded PR or run, the registry remains the evidence. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A repo counted as published as soon as the registry served its wave target version. When the base branch takes the same version first, that copy is the base branch's build, not the wave's: core-jvm `.571` merged on master while the wave's `.571` was still unshipped, so `status` showed it published and downstream repos would have shipped against it. `cascade` now requires the wave's own PR to have merged. Otherwise the state is `collision`, and `next` asks to `REBUMP` the repo. `ship` refuses such an upstream, and also an upstream whose target moved past the recorded pin while the old pin stays public. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Name the repo whose wave PR must merge, document exit 3 from the upstream gate, and align the `FIX-PUBLISH` and `REBUMP` re-pin instructions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`./cascade refresh <repo>` on a `publish-failed` repository now starts it over from the base branch (the wave branch has merged), so `prep` pulls `config` again and bumps past the partly published version. `ship` and `derive_state` look for the wave branch's open PR, not any PR from that branch name, which would find the merged one. `prep` reads its earlier pull commit through a here-string: under `pipefail`, `git log | grep -q` could read the SIGPIPE `git log` takes as "not pulled" and pull `config` a second time. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub dropped the push event of the time `.252` merge, so no workflow started for the merge commit, and the wave read the repository as `merged` forever. Ten minutes after a merge without a `publish.yml` run, `publish_verdict` now reports a failure, which routes the repository to `FIX-PUBLISH` and lets `./cascade refresh` re-ship it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The push event of the time `.252` merge arrived 17 minutes late, during a GitHub incident, so its Publish run did start and succeed; ten minutes was too short to tell a dropped event from a delayed one. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two `cascade` runs at once (the driver's `next` and a manual one) shared `<manifest>.tmp`: one truncated the other's output, and an empty manifest was moved into place, which `next` then read as a finished wave (CLOSE). `mset` now writes through a private temp file and never moves an empty result into place, and `next` and `close` refuse a manifest that lists no repos. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Without the mapping, `close` skipped `DokkaTools.kt` and left `config` pinning `2.0.0-SNAPSHOT.10` after the wave published `.12`, and the floor gate could not tell which repo a `DokkaTools` pin belongs to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`close --ship` still opened the closing PR as ready, so the organization's ruleset requested a Copilot review before CI had run, as `ship` already avoids. Mark it ready once all its checks pass. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
config#818 (merged as `fcd68830`) records the version vector the wave published; the log ends with the events since 2026-10-21. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
alexander-yevsyukov
enabled auto-merge
October 23, 2026 15:04
alexander-yevsyukov
disabled auto-merge
October 23, 2026 15:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The summit side of the dependency-refresh wave, which propagates the external dependency refresh in
config(Protobuf 4.36.2, KSP 2.3.12, Jackson, H2 2.5, SPDX SBOM publishing, …) to every SDK repository. It started ascascade-refresh-a0cbbbfand restarted ascascade-refresh-604420conceconfigcapped Kotlin at the version embedded in the Gradle in use (Gradle 9.8.2, Kotlin 2.4.10).This PR stays open while the wave runs: the
cascadescript keeps committing the wave state (Update cascade state) to this branch until the closingconfigPR. Please don't merge it before the wave closes.Changes
delivery-serversubmodule todelivery. The repository is nowSpineEventEngine/delivery, so the submodule's name, path, and URL follow it.cascade, the dependency graph, the README, and the rollout docs use the new name. The Maven artifact is stillspine-delivery-server, so the registry probe is unchanged.cascade prepchecksconfigout at the recorded commit before./config/pull.git pullmoved the recorded pointer without the checkout, so the tree looked dirty andprepstopped. An uninitializedconfig(as indelivery) was mistaken for a repo that does not consumeconfigand silently skipped the pull.cascade graphcountsconfig's accessor aliases.classpath(spineCompiler.pluginLib)incore-jvmandjdbc-storagecreated nocompileredge, so the wave never re-pinned the Compiler there; both repos then built against the published Compiler and its transitive tool-base artifacts, which bundle the old Protobuf runtime. The regenerated graph gainscompiler -> core-jvmandcompiler -> jdbc-storage.cascadedetects partial publishes. A repo counted aspublished-remoteas soon as the registry served its marker artifact, but apublish.ymlrun that fails midway has already uploaded some modules (compiler.072reached the registry withoutcompiler-testlib).cascadenow also checks the publish run for the merge commit: a failure yieldspublish-failedwith aFIX-PUBLISHaction, andshiprefuses such an upstream. A merged repo whose publish failed before uploading anything (validation.465hit HTTP 429) is nowmergedorpublish-failedtoo, instead of reading as unprepared and asking forprepagain.cascadedetects version collisions with the base branch. The registry serving a repo's wave version proved nothing when the base branch had taken the same version first: core-jvm.571merged onmasterwhile the wave's.571was unshipped, so the wave showed core-jvm as published, and downstream repos would have shipped againstmaster's build.cascadenow also requires the wave's own PR to have merged; otherwise the state iscollisionwith aREBUMPaction, andshiprefuses such an upstream — or one whose version moved past the recorded pin../gradlew cleanwithout a permission prompt in.claude/settings.json(owner's request). The604420csettings template lists it underaskagain, which takes precedence overallow, so the owner still has to drop thataskentry.config@604420c. Thea0cbbbfmanifest is archived under.agents/tasks/archive/; the new wave state lives in.agents/tasks/cascade-refresh-604420c.{json,md}and is archived when the wave closes. Summit itself pulledconfig@604420c, keeping the summit-only allow entries that the settings template overwrite dropped.Wave so far
The
a0cbbbfwave published base-libraries.461, reflect.202, logging.426, testlib.215, dokka-tools.11, tool-base.426, ProtoTap0.17.3, compiler.074, and validation.465before the restart. The restarted wave re-ships every repository withconfig@604420c; the unshipped repositories carry their earlier wave branches forward, and core-jvm-compiler#119 was closed in favour of the new branch.BuildSpeedis parked (verify-only).Checks
Summit has no build.
bash -n cascade, shellcheck (no new warnings overmaster), and./cascade graph --checkpass;review-docsapproved the prose.🤖 Generated with Claude Code