Skip to content

feat(rewrite): complete greenfield production delivery foundation - #394

Open
mira-2026 wants to merge 7 commits into
mira/greenfield-root-isolationfrom
mira/greenfield-rewrite-delivery-foundation
Open

feat(rewrite): complete greenfield production delivery foundation#394
mira-2026 wants to merge 7 commits into
mira/greenfield-root-isolationfrom
mira/greenfield-rewrite-delivery-foundation

Conversation

@mira-2026

@mira-2026 mira-2026 commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • complete the greenfield Phase 1 production foundation with executable web, worker, and database-maintenance roots
  • add deterministic browser/process/release builds, manifest-bound immutable artifacts, project-local Bun runtime/state/logs, and verified systemd unit installation
  • add leased release publication, database snapshot/migration promotion, atomic activation records, rollback, and crash recovery
  • serve manifest-verified browser assets with bounded no-follow reads, cache negotiation, CSP, and controlled SPA fallback
  • keep all mutable application state beneath <project-root>/production; only installed systemd unit copies may live outside the project tree

Behavior and regression coverage

  • readiness remains unavailable until configuration, release identity, database state, frontend assets, and runtime composition are ready
  • candidate activation treats release and database state as one recoverable pair and restores the previous pair on pre-commit failure
  • release artifacts, runtime binaries, database snapshots, activation metadata, and unit files are identity-checked and fail closed on replacement or tampering
  • production web/worker output is routed to project-local logs; no StateDirectory=/LogsDirectory= or external state root is introduced
  • disposable lifecycle coverage builds, migrates, activates, serves, logs, and shuts down the real staged artifacts

Verification

  • Frozen install: bun install --frozen-lockfile
  • Typed lint: bun run lint
  • TypeScript: bun run typecheck
  • Formatting: bun run format:check
  • Source boundaries: bun run check:boundaries
  • Generated docs: bun run docs:check
  • Database schema: bun run db:check
  • Browser build: bun run build:browser
  • Process builds: bun run build:processes
  • Full coverage suite: bun run test:coverage — 1,293 passed, 0 failed; 91.69% line coverage
  • Unit validation: systemd-analyze --user verify systemd/mira-dashboard-web.service systemd/mira-dashboard-worker.service

Risk checklist

  • No secrets, tokens, .env files, database dumps, or runtime state committed
  • Filesystem, release, database, process, and systemd trust boundaries have adversarial tests
  • Migration and activation changes include verified rollback and crash-recovery paths
  • Runtime shutdown preserves dependency order and bounded cleanup
  • Browser changes are the production shell/foundation; feature parity remains in later stacked phases

Deployment / operations

  • No deployment or restart is needed for this PR; the greenfield root is not active yet
  • Rollback is verified as an atomic release/database pair before activation commit
  • Production state remains <project-root>/production/state

Notes for reviewers

  • This is intentionally one large Phase 1 foundation PR (128 files) as requested.
  • Base is the locked exact head of feat(rewrite): isolate future root and harden database runtime #393 (c0ce6a51).
  • CodeRabbit review is not required for this PR because it exceeds 100 files; exact-head Codex review and CI remain required before the stack advances.

@mira-2026
mira-2026 requested a review from rajohan as a code owner August 7, 2026 00:22
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown

Important

Review skipped

Too many files!

This PR contains 129 files, which is 29 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 96dd1e30-b356-4c40-9305-5ca8db9ccaf4

📥 Commits

Reviewing files that changed from the base of the PR and between c0ce6a5 and f28909a.

📒 Files selected for processing (129)
  • greenfield/.oxlintrc.json
  • greenfield/README.md
  • greenfield/docs/architecture/greenfield-rewrite/implementation-plan.md
  • greenfield/docs/architecture/greenfield-rewrite/progress.md
  • greenfield/docs/architecture/greenfield-rewrite/runtime-and-delivery.md
  • greenfield/docs/development/testing-and-prs.md
  • greenfield/package.json
  • greenfield/scripts/delivery/activateProductionRelease.test.ts
  • greenfield/scripts/delivery/activateProductionRelease.ts
  • greenfield/scripts/delivery/buildAdmission.test.ts
  • greenfield/scripts/delivery/buildAdmission.ts
  • greenfield/scripts/delivery/buildBrowser.test.ts
  • greenfield/scripts/delivery/buildBrowser.ts
  • greenfield/scripts/delivery/buildCli.ts
  • greenfield/scripts/delivery/buildPaths.ts
  • greenfield/scripts/delivery/buildProcesses.test.ts
  • greenfield/scripts/delivery/buildProcesses.ts
  • greenfield/scripts/delivery/buildRelease.test.ts
  • greenfield/scripts/delivery/buildRelease.ts
  • greenfield/scripts/delivery/databaseMaintenanceProcess.ts
  • greenfield/scripts/delivery/databaseTransitionFilesystem.test.ts
  • greenfield/scripts/delivery/databaseTransitionFilesystem.ts
  • greenfield/scripts/delivery/deploymentLease.test.ts
  • greenfield/scripts/delivery/deploymentLease.ts
  • greenfield/scripts/delivery/exclusiveProcessLock.ts
  • greenfield/scripts/delivery/installProductionSystemdUnits.test.ts
  • greenfield/scripts/delivery/installProductionSystemdUnits.ts
  • greenfield/scripts/delivery/prepareProductionState.test.ts
  • greenfield/scripts/delivery/prepareProductionState.ts
  • greenfield/scripts/delivery/privateStateStageFile.ts
  • greenfield/scripts/delivery/productionActivationJournal.test.ts
  • greenfield/scripts/delivery/productionActivationJournal.ts
  • greenfield/scripts/delivery/productionActivationState.test.ts
  • greenfield/scripts/delivery/productionActivationState.ts
  • greenfield/scripts/delivery/productionDeliveryFilesystem.test.ts
  • greenfield/scripts/delivery/productionDeliveryFilesystem.ts
  • greenfield/scripts/delivery/productionReleaseActivation.test.ts
  • greenfield/scripts/delivery/productionReleaseActivation.ts
  • greenfield/scripts/delivery/productionReleasePublication.test.ts
  • greenfield/scripts/delivery/productionReleasePublication.ts
  • greenfield/scripts/delivery/productionRuntime.test.ts
  • greenfield/scripts/delivery/productionRuntime.ts
  • greenfield/scripts/delivery/productionRuntimePointers.ts
  • greenfield/scripts/delivery/productionStateFilesystem.test.ts
  • greenfield/scripts/delivery/productionStateFilesystem.ts
  • greenfield/scripts/delivery/productionSystemdUnitFilesystem.ts
  • greenfield/scripts/delivery/productionSystemdUnitPolicy.ts
  • greenfield/scripts/delivery/releaseArtifactInventory.test.ts
  • greenfield/scripts/delivery/releaseArtifactInventory.ts
  • greenfield/scripts/delivery/releaseIdentity.test.ts
  • greenfield/scripts/delivery/releaseIdentity.ts
  • greenfield/scripts/delivery/releaseStaging.ts
  • greenfield/scripts/delivery/systemctlProcess.test.ts
  • greenfield/scripts/delivery/systemctlProcess.ts
  • greenfield/scripts/delivery/systemdProductionServices.test.ts
  • greenfield/scripts/delivery/systemdProductionServices.ts
  • greenfield/scripts/frontendBuildArtifacts.ts
  • greenfield/scripts/generateDocs.ts
  • greenfield/scripts/packageIdentity.test.ts
  • greenfield/scripts/packageIdentity.ts
  • greenfield/scripts/runCoverage.test.ts
  • greenfield/scripts/runCoverage.ts
  • greenfield/scripts/sourceBoundaries/policy.test.ts
  • greenfield/scripts/sourceBoundaries/policy.ts
  • greenfield/scripts/sourceBoundaries/sourceDiscovery.ts
  • greenfield/scripts/sourceBoundaries/sourceTopologyPolicy.ts
  • greenfield/scripts/testSupport/productionDeliveryFixture.ts
  • greenfield/scripts/testSupport/rejection.ts
  • greenfield/src/app/dashboardServer.ts
  • greenfield/src/app/dashboardServerProcess.test.ts
  • greenfield/src/app/databaseMaintenance.test.ts
  • greenfield/src/app/databaseMaintenance.ts
  • greenfield/src/app/server.ts
  • greenfield/src/app/worker.test.ts
  • greenfield/src/app/worker.ts
  • greenfield/src/browser/application.test.tsx
  • greenfield/src/browser/application.tsx
  • greenfield/src/browser/bootstrap.tsx
  • greenfield/src/browser/index.css
  • greenfield/src/browser/index.html
  • greenfield/src/browser/lazyBootstrap.tsx
  • greenfield/src/browser/main.test.tsx
  • greenfield/src/browser/main.tsx
  • greenfield/src/browser/queryClient.ts
  • greenfield/src/browser/routeComponents.tsx
  • greenfield/src/browser/router.tsx
  • greenfield/src/browser/testSupport/browserTestEnvironment.ts
  • greenfield/src/browser/testSupport/browserTestPreload.ts
  • greenfield/src/server/database/migrations/applyVerifiedMigrations.ts
  • greenfield/src/server/database/migrations/loadVerifiedMigrations.test.ts
  • greenfield/src/server/database/migrations/loadVerifiedMigrations.ts
  • greenfield/src/server/database/runtime/databaseCandidateMigrationOwner.ts
  • greenfield/src/server/database/runtime/databasePolicy.ts
  • greenfield/src/server/database/runtime/databaseRuntimeOwner.ts
  • greenfield/src/server/database/runtime/databaseService.test.ts
  • greenfield/src/server/database/runtime/databaseService.ts
  • greenfield/src/server/database/runtime/databaseSnapshot.test.ts
  • greenfield/src/server/database/runtime/databaseSnapshot.ts
  • greenfield/src/server/database/runtime/databaseStartup.ts
  • greenfield/src/server/platform/configuration/processConfiguration.ts
  • greenfield/src/server/platform/configuration/webConfiguration.ts
  • greenfield/src/server/platform/configuration/workerConfiguration.test.ts
  • greenfield/src/server/platform/configuration/workerConfiguration.ts
  • greenfield/src/server/platform/filesystem/immutableReleaseFile.ts
  • greenfield/src/server/platform/filesystem/projectLayout.test.ts
  • greenfield/src/server/platform/filesystem/projectLayout.ts
  • greenfield/src/server/platform/observability/projectFileLogSink.test.ts
  • greenfield/src/server/platform/observability/projectFileLogSink.ts
  • greenfield/src/server/platform/observability/structuredLogger.test.ts
  • greenfield/src/server/platform/observability/structuredLogger.ts
  • greenfield/src/server/platform/release/runtimeRelease.test.ts
  • greenfield/src/server/platform/release/runtimeRelease.ts
  • greenfield/src/server/platform/runtime/processSignals.test.ts
  • greenfield/src/server/platform/runtime/processSignals.ts
  • greenfield/src/server/rawHttp/frontendAssets.test.ts
  • greenfield/src/server/rawHttp/frontendAssets.ts
  • greenfield/src/server/test/system/serverFoundation.test.ts
  • greenfield/src/shared/databaseMigrationManifest.ts
  • greenfield/src/shared/databaseSnapshotManifest.ts
  • greenfield/src/shared/productionActivationRecord.ts
  • greenfield/src/shared/productionActivationTransition.ts
  • greenfield/src/shared/releaseManifest.test.ts
  • greenfield/src/shared/releaseManifest.ts
  • greenfield/src/test/integration/build/frontendBuildScenario.test.ts
  • greenfield/src/test/integration/build/frontendBuildScenario.ts
  • greenfield/src/test/integration/delivery/productionReleaseLifecycle.test.ts
  • greenfield/src/worker/runtime.ts
  • greenfield/systemd/mira-dashboard-web.service
  • greenfield/systemd/mira-dashboard-worker.service

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Review on demand using usage pricing

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@mira-2026 mira-2026 changed the title mira/greenfield rewrite delivery foundation feat(rewrite): complete greenfield production delivery foundation Aug 7, 2026
@mira-2026 mira-2026 added status: needs-review Ready for human or agent review type: feature Adds user-visible functionality type: security Security, auth, secrets, or trust-boundary work area: ops Operational actions, deploys, services, backups, and health area: backend Backend API, server routes, services, and integrations area: frontend Frontend UI, client state, routing, and browser behavior area: database Database dashboard, Postgres, PgBouncer, or query views area: ci CI, test runners, workflow checks, and release gates labels Aug 7, 2026

@github-advanced-security github-advanced-security AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1715f9e533

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/scripts/delivery/systemdProductionServices.ts Outdated
Comment thread greenfield/scripts/delivery/activateProductionRelease.ts Outdated
Comment thread greenfield/scripts/delivery/systemdProductionServices.ts Outdated
@mira-2026

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8035980912

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/scripts/delivery/systemdProductionServices.ts
Comment thread greenfield/scripts/delivery/activateProductionRelease.ts
Comment thread greenfield/scripts/delivery/productionReleaseActivation.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ae7215c961

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/scripts/delivery/releaseIdentity.ts Outdated

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: df8d70d926

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment thread greenfield/scripts/delivery/databaseTransitionFilesystem.ts Outdated
Comment thread greenfield/scripts/delivery/productionActivationJournal.ts
Comment thread greenfield/scripts/delivery/productionActivationState.ts
Comment thread greenfield/scripts/delivery/productionReleaseActivation.ts
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area: backend Backend API, server routes, services, and integrations area: ci CI, test runners, workflow checks, and release gates area: database Database dashboard, Postgres, PgBouncer, or query views area: frontend Frontend UI, client state, routing, and browser behavior area: ops Operational actions, deploys, services, backups, and health status: needs-review Ready for human or agent review type: feature Adds user-visible functionality type: security Security, auth, secrets, or trust-boundary work

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants