Repository navigation
feat: record-preserving Scientist runtime upgrades - #76
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Independent Scientist instances can record exact local Scientist/Brain revisions, validate a candidate pair against current configuration, and switch or roll back without replacing user records. A check/render launcher uses the selected pair, so the pins control execution rather than merely documenting it.
Closes #75.
Scripts Changed
scripts/instance_runtime.py: preview/apply initialization, upgrade and rollback; pinned check/render launcher; atomic manifest updates and protected-path drift checks.tests/test_instance_runtime.py: revision, compatibility, record preservation, stale-input, failed-write and recovery coverage, including real owner validators in local Git clones.docs/instance-upgrades.md,STARTER.md: registration, candidate review, protected paths and manual recovery.Validation
release validation incomplete: no rehearsal for current source. Development only; no release.Behavior and limits
Only a private runtime manifest is intentionally written. Rollback validates current configuration and retains newer user records; it can recover from a broken current checkout. The previous pair must still be available and compatible. No fetch/pull/reset, environment installation, schema migration, owner-organ upgrade or hosted deployment occurs.
Protected paths are explicit; the profile directory and canonical map are always included. Git metadata is excluded and symlinks/special files are refused. Fingerprints detect drift but are not a sandbox or backup: validation executes trusted candidate Python, and unexpected record changes require manual inspection rather than automatic restoration. Checkouts, interpreter/environment and the launcher must be retained for reproducible recovery.
Tier: judge — merge mode: human /prm.