Self-hosted SCHEMA_VERSION bump destroys the live pipeline's own runner.db mid-drive

jared commented

2026-08-21 19:14:08 +00:00

Owner

Context

Single-epoch recreation (db.rb) wipes .sdlc/runner.db whenever the binary's SCHEMA_VERSION differs from the DB's. In the #467 self-hosted drive, the worked ticket bumped the version and the pipeline destroyed its own state at the next runner call; the stale plugin-cache binary then re-wiped in the other direction on every SubagentStart hook fire. Two implementations lost (O6, docs/os-sdlc-rebuild/poodr-map-first-drive.md). Fix needs design: exempt the DB backing an active implementation, or refuse-with-message instead of silent recreate.

Skeptic verdict: CREATE — data-loss defect, hard floor, needs its own design decision.

Origin

Trigger: #467 drive, observation O6 (2026-08-21).
Improvised this session: dispatched all remaining agents first, then replayed the runner chain Bash-only so no hook could fire mid-drive.
Chain: lost pipeline state ← silent DB recreate on version mismatch ← single-epoch design (ADR-0129) meeting a self-hosted schema-changing ticket.
Root candidate: this ticket.

## Context Single-epoch recreation (db.rb) wipes .sdlc/runner.db whenever the binary's SCHEMA_VERSION differs from the DB's. In the #467 self-hosted drive, the worked ticket bumped the version and the pipeline destroyed its own state at the next runner call; the stale plugin-cache binary then re-wiped in the other direction on every SubagentStart hook fire. Two implementations lost (O6, docs/os-sdlc-rebuild/poodr-map-first-drive.md). Fix needs design: exempt the DB backing an active implementation, or refuse-with-message instead of silent recreate. Skeptic verdict: CREATE — data-loss defect, hard floor, needs its own design decision. ## Origin - Trigger: #467 drive, observation O6 (2026-08-21). - Improvised this session: dispatched all remaining agents first, then replayed the runner chain Bash-only so no hook could fire mid-drive. - Chain: lost pipeline state ← silent DB recreate on version mismatch ← single-epoch design (ADR-0129) meeting a self-hosted schema-changing ticket. - Root candidate: this ticket.

jared added the

plugin/os-sdlc

label

2026-08-21 19:14:08 +00:00

jared referenced this issue

2026-08-21 19:14:23 +00:00

POODR map T9: supervised end-to-end drive of the POODR map #467

jared referenced this issue

2026-08-21 19:18:46 +00:00

POODR implementation map — build wayfinder #458

jared referenced this issue

2026-08-21 20:15:16 +00:00

POODR implementation map — build wayfinder #458

jared referenced this issue

2026-08-22 22:43:08 +00:00

Evidence CLI silently ignores unknown Thor options like --path instead of erroring #484

jared commented

2026-08-26 22:26:09 +00:00

Author

Owner

Work started on branch 473-474-guards. Agreed design: keep the automatic schema wipe, but refuse (StaleSchemaError) when the DB holds an implementation with no terminal stamp; old file archives to pipeline.db.stale on every wipe. Amends ADR-0129 (ADR to follow).

jared commented

2026-08-26 22:46:22 +00:00

Author

Owner

Resolution

Done: Db.connect keeps the automatic wipe but refuses with StaleSchemaError when the stale file holds an implementation row with no terminal stamp (shared Lifecycle.active?, row-wise so pre-18 schemas are safe); every permitted wipe archives the old file to pipeline.db.stale instead of File.delete. TDD, Codex-reviewed design.

Evidence: Commit dc1fa24, merged 2d4babe on main; ADR-0155 amends ADR-0129; tests in tests/runner/db_migration_test.rb incl. all four terminal stamps, refusal message versions, refused-wipe integrity, and a hand-built v17 fixture without escalated_at; full suite 1218 runs 0 failures; plugin cache refreshed.

Follow-ups: none — Codex-suggested process-wide lock rejected as speculative hardening (archive rename removes the destructive race half), recorded in ADR-0155 alternatives

## Resolution **Done:** Db.connect keeps the automatic wipe but refuses with StaleSchemaError when the stale file holds an implementation row with no terminal stamp (shared Lifecycle.active?, row-wise so pre-18 schemas are safe); every permitted wipe archives the old file to pipeline.db.stale instead of File.delete. TDD, Codex-reviewed design. **Evidence:** Commit dc1fa24, merged 2d4babe on main; ADR-0155 amends ADR-0129; tests in tests/runner/db_migration_test.rb incl. all four terminal stamps, refusal message versions, refused-wipe integrity, and a hand-built v17 fixture without escalated_at; full suite 1218 runs 0 failures; plugin cache refreshed. **Follow-ups:** none — Codex-suggested process-wide lock rejected as speculative hardening (archive rename removes the destructive race half), recorded in ADR-0155 alternatives

jared closed this issue

2026-08-26 22:46:22 +00:00

jared referenced this issue from a commit

2026-08-27 01:09:07 +00:00

#473: refuse schema wipe when an implementation is in flight

jared referenced this issue

2026-08-27 01:16:34 +00:00

Declare FKs on the remaining plain-Integer references (handoffs.created_by, dispatches.received_handoff_id/created_handoff_id) #471