base-layer/releasekit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

Record approved recovery remediation decisions

Browse Source
This commit is contained in:
Eric Rakestraw
2026-11-02 22:13:04 +00:00
parent 957e75524c
commit da1839c6d2
1 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
docs/roadmap/remediation.md
View File

@@ -244,10 +244,17 @@ machine/cache should not require reconstructing another invocation manually.
The existing fallback guidance for a subsequently unavailable executable does The existing fallback guidance for a subsequently unavailable executable does
not supply a working handoff for this ordinary cold-build case. not supply a working handoff for this ordinary cold-build case.
**Decision:** Prefer a module-selected Go invocation for recovery where the
consumer setup supports it. Provide an explicit, durable recovery path for
API-only consumers using temporary tool declarations. ReleaseKit owns the
handoff mechanics and supports both adoption styles. This follows the existing
tool-selection workflow and keeps routine binary lifecycle management out of
consumer code.
**Remediation:** Make the recovery invocation independent of an ephemeral **Remediation:** Make the recovery invocation independent of an ephemeral
Go-tool executable. Use a supported module-selected entry point when available, Go-tool executable using the selected module-based approach and an explicit
or otherwise provide a surviving supported entry point. Account for the API-only recovery path. Account for the maintained launcher's temporary
maintained launcher's temporary `-modfile` cleanup and its support for ordinary `-modfile` cleanup and its support for ordinary
package dependencies as well as registered tools; a bare `go tool` command package dependencies as well as registered tools; a bare `go tool` command
cannot assume every consumer has a permanent tool declaration. Keep explicit cannot assume every consumer has a permanent tool declaration. Keep explicit
record selection and distinct exit statuses. Add an assembled cold-build test record selection and distinct exit statuses. Add an assembled cold-build test
@@ -357,10 +364,13 @@ that the handoff could not be saved faithfully. Diagnostic JSON is a display
format and can use safe displays; the private record supplies actual operation format and can use safe displays; the private record supplies actual operation
inputs and must preserve their identity. inputs and must preserve their identity.
**Decision:** Use a lossless private-record representation for supported
pathname and endpoint bytes. This preserves existing publication inputs and
keeps record-loaded recovery consistent with direct typed evidence. Recording
failures remain separate from the publication outcome.
**Remediation:** Make private serialization lossless for supported evidence, **Remediation:** Make private serialization lossless for supported evidence,
using an explicit byte representation where needed. At minimum, detect values using an explicit byte representation where needed. Keep the original typed
that the selected record format cannot round-trip and return a separate
recording failure with no misleading saved handoff. Keep the original typed
evidence and publication behavior intact; avoid adding a general UTF-8 evidence and publication behavior intact; avoid adding a general UTF-8
restriction to previously valid Git publication inputs. Cover endpoint/path restriction to previously valid Git publication inputs. Cover endpoint/path
round trips and equivalent direct-versus-loaded observations, including a round trips and equivalent direct-versus-loaded observations, including a