Repository navigation
[Story] Build and verify the consolidated source workspace before history import #8286
Description
Activity
- added sub-issues
on Sep 23, 2026 - added sub-issues
on Sep 24, 2026 Upstream tip refresh on 2026-09-24: Extensions main is ba8b71d (one commit past the rehearsed 33fa0bf pin; eight changed paths, including props/package versions, Dapper/WorkflowDefinitionStore code and project files). Studio main is 20ceaee (one Swedish translation commit past rehearsed 9afd3e3). Existing 95a canonical build and runtime proofs remain pinned to the earlier tips; they cannot be relabeled as current-tip proof. Open upstream PRs were refreshed and remain unmerged in the source repos, including Extensions #209/#199 and Studio #999. The actual history-bearing import should pin reviewed current tips, re-evaluate supplemental patch applicability and rerun the build/compatibility gates before merge. This task stays open.
94 remaining items
Source-tip r5 repair #8501 merged into draft import #8409 as
57358af3e2c08225cb2976f28e25cee71bf91e96(merge commit, from exact headaa522a18) after all exact-head checks passed, Greptile 5/5 and its one review thread was resolved. The r2 receipt now verifies at its reviewed integration commit; the separate r5 receipt pins the accepted Extensions807cd893Dapper delta and currentElsa.slnmembership. Locally, the r2/r5 source-tip tests passed 9/9 in normal and-Omodes and both verifiers succeeded.#8409 at
57358af3then passed every check, including import-rehearsal-tests, selector-and-plan, mapped-source-artifact-proof and full CI. Stacked #8500 was then merged on top (9e497e71); #8409 exact-head checks are rerunning. No push-triggered publisher matchesaudit/*; no package publication occurred.Review follow-up #8503 merged into draft import #8409 as
1976dd2d4781bad44f13384881e3f00605ba44f9after exact-head checks and Greptile 5/5 with resolved threads. It closes gaps from a deep review of #8500/#8501:- SourceLink 3.1.1
testskips embedded documents but still reports a pass. The Slack release gate now rejects embedded sources, and the mapped proof records its URL fetch asnot exercised(orpartial) instead of passed. - The r2 command line also runs the r5 current-HEAD check.
- The Slack artifact workflow now triggers on every module the gate imports.
All #8409 checks pass at
1976dd2d. Full CI needed a same-head rerun: attempt 1 failed with about 2,200 Razor parse errors (RZ1021/RZ1026/RZ1034/RZ9981) in unchangedsrc/studio.razorfiles across net8/net9/net10. The inputs matched the green9e497e71run: nosrc/diff, runner image ubuntu-24.04 20260920.314, and .NET SDK 10.0.401. Attempt 2 passed. This is recorded as an unexplained, nondeterministic Razor build failure, like the earlier ProtoActor code-generation flake. If it recurs, it needs a root cause before the import leaves draft. No package publication occurred.- SourceLink 3.1.1
#8504 merged into draft import #8409 as
c5dc6f4c02ad54f25db2c6812d24ff59571ade0d(merge commit) after exact-head checks, Greptile 5/5 and resolved threads.- It integrates Core
main's fix(persistence): refuse cross-tenant SaveManyAsync bulk upserts #8492 (merging24f2ed1fexactly, notmain's tip; Gate package and coverage publication behind manual opt-in #8497's publisher change is left for a separate step). - It also carries the follow-up #8505 security fix, proposed to
mainseparately. That fix closes a same-batch collation-variant tenant takeover in EFSaveManyAsyncand lets the database decide key collisions.
Verification:
- All six imported EF dependents build.
- EF unit tests 81/81; PostgreSQL ownership tests 17/17; conformance tests 9/9.
- All five source-tip verifiers pass.
Elsa.Connections.UnitTestsFailedPageRetriesBeforeAdvancingCursoris timing-flaky (1 of 3 isolated runs failed). It doesn't use the EF store and is unrelated. No package publication occurred.- It integrates Core
#8514 merged into draft import #8409 as
3bf0c34973a85fae4e84f7c64086f5c49fd657ee(merge commit). It passed exact-head checks, including import-rehearsal-tests, mapped-source-artifact-proof, selector-and-plan and validate-gates, with Greptile 5/5 and resolved threads.- Publisher gate: the import now carries
main's Gate package and coverage publication behind manual opt-in #8497 gate.packages.ymlpublication happens only on a validated manual dispatch. The validator also rejects indexedsecrets[...]lookups outside the gated jobs; that follow-up is proposed tomainin fix(scripts): reject indexed secrets access outside the gated publication jobs #8515. - Seventh receipt (r7): it pins the reviewed Gate package and coverage publication behind manual opt-in #8497 publisher bytes. r1–r6 defer to it only for
packages.ymlandupdate-wiki.yml. - CI: the integration-program CI jobs now install hash-pinned PyYAML so r7's validator run works.
No package publication occurred.
- Publisher gate: the import now carries
#8521 merged into draft import #8409 as
785013eb3e3d38284084b640a2488d81d42bfb37(merge commit). It syncsmain's #8515 (the packages gate validator also rejects indexedsecrets[...]lookups and ignores quoted literals) and #8519 (connection metadata inspection now has its own default-deny policy, closing #8406).- Conflict: the one conflict, in the validator, was resolved to
main's reviewed version exactly. - Checks: gate tests, Connections tests (90/90), source-tip verifiers r1–r7 and the legacy-asset validator pass. Greptile gave 5/5.
- CI:
select-testsneeded one re-run after the runner interrupteddotnet restorewith no error output. The same head restores and selects cleanly locally, and the base branch had passed 30/30.
The import branch is now level with
main. No publication occurred.- Conflict: the one conflict, in the validator, was resolved to
#8522 merged into draft import #8409 as
d36eeba08ee9de0cf169b5443d97129d63e15298(merge commit). It syncsmain's #8520, which hides lifecycle-managed secret generations from the name-addressed Secrets endpoints (theGET /secrets/{name}exposure spotted during #8301).- Conflict: the one conflict, in
SecretsApiStudioHttpTests.cs, kept every test from both sides. - Checks: Secrets unit 141/141, API integration 22/22, default-host 4/4, contract tests 17/17 in both modes, and source-tip r1–r7 pass. The Secrets contract workflow passed, and Greptile gave 5/5.
The import branch is now level with
main. No publication occurred.- Conflict: the one conflict, in
#8409 is ready to land at
b6baab6b95c84a5773a17bf69dbc3a1d68a673ac. It is level with Coremain, Extensions3cf50295and Studio24337549.- Full
prCI: run 36390765446 passed. 100 test assemblies: 6,541 passed, 145 skipped, 0 failed. - Artifact-only Slack proof: run 36390768442 passed, with receipts r1–r10 verified and nothing published.
- Review: all PR checks are green, Greptile gives 5/5 on this head, no review threads are open, and the merge state is CLEAN.
- Ledger: 161 of 163 rows are done. The two Dependabot rows wait on the post-landing
FEEDZ_API_KEYcheck. - Since the last update:
- source-tip receipts r8–r10 (Preserve Extensions MongoDB tenant-isolation fixes (c2618de7) in import #8526/Pin Extensions c2618de7 MongoDB source tip (r8 receipt) #8528, Preserve Studio 3.10 host branding (24337549) in import #8530/Pin Studio 24337549 host-branding source tip (r9 receipt) #8531, Preserve Extensions Dapper V3_7 migration fix (3cf50295) in import #8535/Pin Extensions 3cf50295 Dapper V3_7 source tip (r10 receipt) #8536);
- the main sync Sync main (#8487) into the history import #8527;
- tenancy-optional fixes Resolve MongoDB and Dapper stores without the multitenancy feature #8532, Tolerate hosts without multitenancy in imported actor, Kafka and scheduler features #8534 and Start a standalone MassTransit bus without the multitenancy feature #8537;
- decision records Record consolidation decisions and keep deprecated Secrets packages unpacked #8524/Close 59 retained-asset ledger rows against the recorded decisions #8525.
It must merge with a merge commit, and it waits on the maintainer's final go. No publication or cutover has occurred.
- Full
Delivered: the consolidated source workspace and history import landed on
mainthrough #8409 (merge commit8b34ab1e71c22c853e1aa340774231c80e92e677). All child tasks are closed. The evidence is in the source-tip receipts r1–r10, the retained-asset ledger (161/163; the two Dependabot rows wait on the post-landing secret check) and the final-head CI and Slack proof recorded on this issue.Reopened the parent rollup because child #8294 does not satisfy its final imported MongoDB atomicity and replica-set acceptance. Lead and independent audit. Completed history-import and other child evidence is preserved; this parent cannot remain accepted while the required child is open. #8294 is queued for correction; #8651 remains the sole active implementation Task.
- added a commit that references this issue
on Oct 7, 2026 Consolidated import story accepted on main
Main
179749636fd4ddce07b186d4fe3456a43fa91162contains the actual history-preserving import #8409, release/source catch-up #8624, and accepted promotion #8657. #8655 and #8294 now supply the final combined-source and exact-main proof gates. Each of this story's six criteria is reconciled below.- Fresh intake verified all35 advertised3.8/3.9 release refs and both Studio/Extensions main tips in Core main; latest releases remain3.9.0.114 explicit-object ancestry checks passed. The31 open source PRs retain dispositions under [Feature] F2.4: Migration of contribution/release documentation and source ownership #8216; Studio Multi targeting for .NET Core 3.1 and .NET 5 #1126 remains open upstream with its reviewed fix ported through Fix consolidated Studio edge hover tools and prove browser behavior #8656. No pending PR is silently claimed merged.
- Actual imports and the final ordinary two-parent promotion preserve original history. The promotion parents are
b38e7523… + 0da8146…; tree6ddb9a8d…exactly matches the tested/reviewed candidate. - Current integration/build gates passed. The authoritative asset ledger classifies all163 rows:113 represented in Core and50 retired from the active tree, with source provenance retained. Stale historical overview prose has an explicit [Feature] F2.4: Migration of contribution/release documentation and source ownership #8216 follow-up; it does not make classified rows pending or activate old publisher files.
- Accepted [Task] Verify imported activity descriptors and serialized workflow compatibility #8313 evidence retains supported-framework activity/serialization comparisons (134 released versus147 imported activity types,18 negative probes) and its four intentionally failing V1 GitHub identity cases under the accepted migration policy. Fresh [Task] Promote the verified consolidation checkpoint to Core main #8655 evidence adds complete declared package framework/provenance coverage, representative consumers, exact-main Mongo113/execution857/Studio263+13 browser cases, both original-artifact six-cell SQLite upgrades and broad main CI. This is not every provider, tenant, generated or customer workflow; [Task] Verify stable server and Studio packages across supported browser hosts #8643's complete package-host matrix remains a separate outcome.
- No active upstream publishers were imported. Root CI/proof/publisher policy owns the represented workflows; main publication/deployment jobs were skipped. Legacy inert provenance is not an operational publisher. Actual source-publisher cutover, deprecation, npm ownership and release remain under [Feature] F2.4: Migration of contribution/release documentation and source ownership #8216/[Feature] F3.4: Artifact provenance, release notes, and recovery procedures #8220.
- Named prerequisite gates are accepted within their recorded scope: Secrets #8275 uses rotate/re-enter into a separate Core DB/schema, not in-place legacy conversion (Models3.8.4 provenance remains unknown); #8260 proves bounded Slack independent packing/provenance/consumption on net8/9/10 without publication; [Story] Prove paired backend and Blazor Studio source development #8279's accepted source-mode paired WorkflowContexts endpoint/editor/debugger and Debug build remain their own evidence. These do not replace live publisher or full package-host acceptance.
Exact-main focused evidence and #8655's final acceptance retain immutable identities, hashes, skips and limitations. All ten native children are closed after #8655/#8294 acceptance. Closing this import story.
Parent #8214 stays open despite its native children closing: it still requires source-contribution/publisher handoff, both Studio npm identities, #8643 package-host acceptance and #8636 dependency-update/feed ownership and operational proof. #8194 remains active. No scope waiver, publication, deployment or archival is implied.
Accepted on main — 2026-10-08
Final acceptance verifies the required scope on main
179749636fd4ddce07b186d4fe3456a43fa91162. This issue is closed; earlier checkpoints below retain their historical status and limitations. Parent #8214 and program #8194 remain open for their own outcomes.Program: #8194
Parent: #8214
Outcome
As a contributor, I can build Core, Extensions and Studio from the mapped consolidated source layout while original upstream histories, package/activity identities and explicit release boundaries remain preserved.
Acceptance
Evidence
Accepted inventory #8251/#8252; history rehearsal #8268; ADR doc/adr/2026-09-23-preserve-upstream-history-during-consolidation.md; paired proofs #8281/#8285; packaging #8277/#8260.