idunn rollback: flip a static release back to the previous one #3

Merged

eureka merged 2 commits from eureka-self/static-rollback into main

2026-11-13 17:06:31 +00:00

eureka commented

2026-11-13 17:06:27 +00:00

Owner

Follow-ups idunn-deploy-provenance:follow_up:chat-mind-20261113T125202436Z-t35 and chat-s6737-6737; cut_spec idunn-deploy-provenance:cut_spec:cut-static-release-rollback.r1. Second half of Cut A (forward half is #2, 9f15cee1).

idunn rollback <target>: one verb, one new brake-gated transaction that flips current back to the previous release, copying the plan and sealed release from the transaction that flipped it (no source, no build). The previous release is the newest Admitted static flip (control + history) checked against the observed link; a rollback of a rollback flips forward again. The carry is re-applied from the site file at rollback time (a missing file fails before the link moves). Typed refusals leave current untouched: no previous release, current not at the newest flip, previous directory gone or drifted, bindings differ. verify_installed runs at intake and again at Starting. Command::Up gained a kind (deviation from the spec's separate variant; Soul checked callers and encodings). CommandKind::Rollback is stored in v5 records with no schema change, so an Idunn at 9f15cee or earlier cannot decode them (forward-only).

Tests: 10 rollback tests; full lib suite 565 passed / 107 failed, the 107 being root-only tests failing identically on base. Soul: accepted 01b6016 with findings; fixed in 7ba27c3 (Starting-time verify test shown to fail with the check removed, cross-binding refusal, docs); other Lows documented (wall-clock ordering, no cancel).

Not verified: real root install of a rollback target, a real two-release history on a live store, a rollback whose own flip never completed beyond the post-rename fault test. Deploy nothing.

🤖 Generated with Claude Code

Follow-ups `idunn-deploy-provenance:follow_up:chat-mind-20261113T125202436Z-t35` and `chat-s6737-6737`; cut_spec `idunn-deploy-provenance:cut_spec:cut-static-release-rollback.r1`. Second half of Cut A (forward half is #2, 9f15cee1). `idunn rollback <target>`: one verb, one new brake-gated transaction that flips `current` back to the previous release, copying the plan and sealed release from the transaction that flipped it (no source, no build). The previous release is the newest Admitted static flip (control + history) checked against the observed link; a rollback of a rollback flips forward again. The carry is re-applied from the site file at rollback time (a missing file fails before the link moves). Typed refusals leave `current` untouched: no previous release, current not at the newest flip, previous directory gone or drifted, bindings differ. `verify_installed` runs at intake and again at Starting. `Command::Up` gained a `kind` (deviation from the spec's separate variant; Soul checked callers and encodings). `CommandKind::Rollback` is stored in v5 records with no schema change, so an Idunn at 9f15cee or earlier cannot decode them (forward-only). Tests: 10 rollback tests; full lib suite 565 passed / 107 failed, the 107 being root-only tests failing identically on base. Soul: accepted 01b6016 with findings; fixed in 7ba27c3 (Starting-time verify test shown to fail with the check removed, cross-binding refusal, docs); other Lows documented (wall-clock ordering, no cancel). Not verified: real root install of a rollback target, a real two-release history on a live store, a rollback whose own flip never completed beyond the post-rename fault test. Deploy nothing. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

eureka added 2 commits

2026-11-13 17:06:27 +00:00

Idunn: idunn rollback <target>, a brake-gated transaction flipping to the previous static release 01b6016193

CommandKind::Rollback (command ids rollback-*). The daemon freezes the command
into one transaction built like from_continuity: plan, sealed release and
installed release copied from the transaction that flipped the previous release;
no source, no build, source cleanup SkippedContinuity, no admitted generation.
It reaches the deployment brake and advance_static unchanged. The previous
release is derived from the newest Admitted static flip (control.cc + history.cc)
and the observed link, and refused as a rejected transaction when there is no
completed release, no previous release, current is not the newest flip, the
previous directory is gone, or an artifact digest drifted (new port method
verify_installed, also checked before any flip intent). Rollback counts as a
deploy for the busy and live-per-target checks. CLI: idunn rollback via
parse_up(kind); commit_deployment_command and submit take the kind.

Tests: control_plane::tests::static_rollback_ (7) and parse_rollback (1).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Idunn: rollback drift after freezing, cross-binding refusal, and docs 7ba27c362e

Tests: a previous release that drifts after the rollback was frozen ends
FailedBeforeFencing at the Starting-time verify with current untouched (fails if
that verify is removed); rollback_source refuses a previous release deployed
under another release root or current link. Docs: CommandKind::Rollback needs no
schema change but an Idunn at 9f15cee or earlier cannot decode it (forward-only);
flipped_at ordering and the observed-link check; a rollback cannot be cancelled.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

eureka merged commit 114803c63b into main

2026-11-13 17:06:31 +00:00

eureka referenced this pull request from a commit

2026-11-13 17:06:32 +00:00

Merge pull request 'idunn rollback: flip a static release back to the previous one' (#3) from eureka-self/static-rollback into main

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

GameCult/Idunn!3

No description provided.

Rows
Columns