fix(drivers): preserve installed runtime metadata format - #1115
Conversation
…ix/installed-driver-policy-format
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_8c469e5f-e0e7-4129-a386-10e06ef4f77d) |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d139a2fb65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if err == nil && retained.RepositoryFormat != "" && retained.RepositoryFormat != repositoryFormat(repo) { | ||
| return state.DriverRepoInstall{}, errors.New("retained driver metadata format cannot change") |
There was a problem hiding this comment.
On an upgraded database every existing install has an empty RepositoryFormat, so this condition allows a retained Sourceful artifact to be reinstalled through a repository ID that has been repurposed as a direct-manifest source. When the version/hash/filename are unchanged, the install row is relabeled ftw.manifest/v1 while its existing sourceful-package.envelope.json remains; RuntimePolicy then rejects that combination, and handleDeviceRepositoryInstall cannot recover because the upsert records the same install path as its predecessor. Treat the retained envelope or a verified backfill as format evidence before accepting this reinstall, otherwise the driver can remain stopped rather than reaching its autonomous default.
AGENTS.md reference: AGENTS.md:L36-L36
Useful? React with 👍 / 👎.
1 participant
An installed Sourceful control-v2 package could start as a legacy driver after its repository was removed or its package envelope disappeared. With control unselected, Core returned no runtime policy and treated the missing legacy default function as success. This also affected inactive retained files and packages incompatible with the current host.
Record the verified repository format with each installation and preserve it through restart, rollback and reactivation. Check that format before selecting a metadata parser. Sourceful packages require their verified policy even when site control is disabled; missing trust, missing metadata and source/format changes stop startup before Lua. A failed trust check leaves device state unconfirmed.
Older install rows start with an unknown format. Backfill only after rechecking signed metadata against the resolved trust source, recorded origin and exact artifact. A local envelope can forbid legacy fallback but cannot grant trust. An older install with no usable metadata requires the repository to be restored or the driver to be reinstalled. Recorded direct-manifest installs retain their existing legacy startup path.
Validation: make verify and the full driverrepo, drivers and state race suites pass. Real signed-package/SQLite/Registry tests verify v2 startup and explicit default through host-observed Modbus write/readback with no site opt-in. Tests cover removed or repurposed sources, missing/corrupt envelopes, incompatible hosts, inactive retained paths, old database upgrade, unsigned/wrong-signer cache, backfill after restart and attempted reclassification before file writes. The new rejection tests fail with the previous RuntimePolicy overlaid. Modbus uses an in-process test adapter; physical hardware validation remains with the next beta.
Addresses the late finding in #1112 (comment). The downgrade also reproduces before #1110. The only overlap with older planning PRs is a separate additive column in the shared state migration; their tables and forecast code remain outside this change.
Note
High Risk
Changes managed-driver trust, runtime policy, and Modbus default-mode startup paths—security-sensitive control infrastructure where misclassification could allow unintended device writes or silent policy bypass.
Overview
Fixes a case where a Sourceful control-v2 install could fall back to legacy v1 behavior (including treating a missing default as success) when the repository was removed, the package envelope was gone, or site control was not enabled.
The PR persists
repository_formaton each managed install (SQLite migration + install/activate rules that block format reclassification) and uses that format when resolvingRuntimePolicy. Sourceful artifacts now always require a verified package envelope and v2 policy for startup defaults, even without site opt-in; trust/source/format mismatches and inactive retained paths fail before Lua loads. Older rows with an empty format are backfilled only after re-verifying signed cache metadata against the recorded origin and artifact; legacy direct-manifest installs keep their prior offline behavior only when explicitly recorded and no Sourceful envelope is present.Extensive driverrepo/state tests cover restart/backfill, repository removal, corrupt caches, and installer reclassification guards.
Reviewed by Cursor Bugbot for commit d139a2f. Bugbot is set up for automated code reviews on this repo. Configure here.