simplify-code-base run a7b8fa: 52 iterations of folding duplicated decisions onto single seams #96

Merged
weiwen merged 52 commits from gnhf/simplify-code-base-r-a7b8fa into main 2026-08-13 13:38:58 +08:00
Owner

Output of a long-running simplify-code-base pass (run a7b8fa, 52 iterations). Each commit is one iteration: pick a lens, find every place the codebase spells the same decision more than once, fold the copies onto one seam, and pin whatever contract turned out to have no test. Every iteration is atomic and self-contained, so this reads best commit-by-commit; it is expected to squash-merge.

65 files, +4947/-3665.

Bugs the folding surfaced

Deduplication kept turning up copies that had already drifted apart. These are the ones where the drift was live behaviour, not just noise:

  • just check had been red on main since 2026-08-13 at its very first step (cargo fmt --check), so every CI run failed and the needs: check image publish never ran (gnhf 38). The gate is now green, and widened to cover the other two languages in the tree — every tracked *.nix through nixfmt --check and every tracked *.sh through shellcheck -x, both pinned through the flake (gnhf 39).
  • Persisted schedules were orphaned on the live deployment: #90's blanket TOML sweep renamed schedules.json to schedules.toml in config.rs alone (gnhf 17).
  • An HTTP-only deployment fired no schedule at all, because the schedule timer was gated on a Telegram dispatcher it had stopped depending on (gnhf 25).
  • Scheduled send/prompt lost markdown rendering and pagination in #67 — a scheduled prompt reply over Telegram's per-message cap was rejected outright (gnhf 24).
  • The sudo credential hard link silently degraded to a copy on every spawn after 2eaf3ca: linking straight at the destination hit EEXIST (b0d13e7).
  • A missing config on the packaged deployment reported "Read-only file system" instead of the missing file, because Config::load create-if-absent ran against a deliberately read-only /etc (gnhf 23).
  • api- chat targets passed schedule creation and were then dropped at every fire — creation validated less than fire requires (gnhf 21).
  • The Rich markdown path measured the unsanitized source against Telegram's cap, so a live page whose appended closers pushed it over the limit was sent anyway (gnhf 20).
  • A sandbox-escape shape the test suite had already drifted into, closed by folding PiSpawnConfig's include_sudo_only_skills / agent_auth_path into SpawnMode itself (gnhf 10, finished in 33).
  • Four inert config knobs wired up: message_burst_debounce_ms (gnhf 1), [telegram.voice].max_duration_secs and [logging].format (gnhf 2).
  • A test-only ETXTBSY flake measured at 274/4000, closed at its write side by routing executable-script writes through a child process; the production retry loop that had been papering over it is gone (gnhf 48).

Dead code removed

Mechanisms whose last producer or caller was deleted upstream and never followed through: the scheduled-push delivery channel whose only producer #67 removed a month prior (gnhf 4), the [[pi.models]] fallback list whose entries past [0] were never read (gnhf 5), the secret_env capability-gated-secret forwarding left always-empty by #90 (gnhf 6, 47), the ChatId::TelegramDm addressing axis superseded by ADR 0023's Sender (gnhf 3), the deployment-side sandbox-account provisioning orphaned by #94's privilege-drop removal (gnhf 8, 9), and the Node/TypeScript toolchain stranded by the .sandcastle agent loop's removal (gnhf 30).

Seams introduced

state_file::{write_atomic, install_atomic}, schedule::{Verb, Selector}, control_plane::{Partition, Destination}, pi::{read_bounded_line, bwrap_command, pi_store_command}, telegram::markdown::Splitter, telegram::view::{send_page, inline_content}, session::run_ephemeral_kind, chat_id::ChatSession, main's Target/Selection clap groups, transcribe::MODEL_FILES, test_script::write_executable, and a shared tests/hitl/common.sh.

Docs

Prose that had drifted from the code it describes: extensions-as-per-user-capability and the fixed evie service account (gnhf 31), the setuid/setgid privilege drop #94 removed including three docs falsely claiming bwrap builds its namespace unprivileged (gnhf 8), and the two agent-facing triage docs pointing at the removed loop's phantom stages (gnhf 30). Touches README, CONTEXT.md, ADR 0011/0023, flake.nix, and the config template.

Verification

nix develop .#ci -c just check passes on the branch tip: 539 tests, 0 failed, exit 0. That is the whole CI gate, so this is green in CI.

Review notes

  • No issue to close: this run was not ticket-driven.
  • Wire-format changes to review with care: control_plane's ControlRequest (gnhf 45, 49, and the flattened Target/Selection in main.rs's CLI), and the schedules.json filename restoration (gnhf 17) which affects an existing live state file.
  • Config surface changes: [[pi.models]] collapsed back to scalar pi.provider/pi.model, [pi.capability_env] and [sandbox] gone, four SessionManagerConfig path fields now required.
Output of a long-running `simplify-code-base` pass (run `a7b8fa`, 52 iterations). Each commit is one iteration: pick a lens, find every place the codebase spells the same decision more than once, fold the copies onto one seam, and pin whatever contract turned out to have no test. Every iteration is atomic and self-contained, so this reads best commit-by-commit; it is expected to squash-merge. 65 files, +4947/-3665. ## Bugs the folding surfaced Deduplication kept turning up copies that had already drifted apart. These are the ones where the drift was live behaviour, not just noise: - **`just check` had been red on `main` since 2026-08-13** at its very first step (`cargo fmt --check`), so every CI run failed and the `needs: check` image publish never ran (gnhf 38). The gate is now green, and widened to cover the other two languages in the tree — every tracked `*.nix` through `nixfmt --check` and every tracked `*.sh` through `shellcheck -x`, both pinned through the flake (gnhf 39). - **Persisted schedules were orphaned on the live deployment**: #90's blanket TOML sweep renamed `schedules.json` to `schedules.toml` in `config.rs` alone (gnhf 17). - **An HTTP-only deployment fired no schedule at all**, because the schedule timer was gated on a Telegram dispatcher it had stopped depending on (gnhf 25). - **Scheduled `send`/`prompt` lost markdown rendering and pagination** in #67 — a scheduled prompt reply over Telegram's per-message cap was rejected outright (gnhf 24). - **The sudo credential hard link silently degraded to a copy** on every spawn after `2eaf3ca`: linking straight at the destination hit `EEXIST` (`b0d13e7`). - **A missing config on the packaged deployment reported "Read-only file system"** instead of the missing file, because `Config::load` create-if-absent ran against a deliberately read-only `/etc` (gnhf 23). - **`api-` chat targets passed schedule creation and were then dropped at every fire** — creation validated less than fire requires (gnhf 21). - **The Rich markdown path measured the unsanitized source against Telegram's cap**, so a live page whose appended closers pushed it over the limit was sent anyway (gnhf 20). - **A sandbox-escape shape the test suite had already drifted into**, closed by folding `PiSpawnConfig`'s `include_sudo_only_skills` / `agent_auth_path` into `SpawnMode` itself (gnhf 10, finished in 33). - **Four inert config knobs** wired up: `message_burst_debounce_ms` (gnhf 1), `[telegram.voice].max_duration_secs` and `[logging].format` (gnhf 2). - **A test-only ETXTBSY flake** measured at 274/4000, closed at its write side by routing executable-script writes through a child process; the production retry loop that had been papering over it is gone (gnhf 48). ## Dead code removed Mechanisms whose last producer or caller was deleted upstream and never followed through: the scheduled-push delivery channel whose only producer #67 removed a month prior (gnhf 4), the `[[pi.models]]` fallback list whose entries past `[0]` were never read (gnhf 5), the `secret_env` capability-gated-secret forwarding left always-empty by #90 (gnhf 6, 47), the `ChatId::TelegramDm` addressing axis superseded by ADR 0023's `Sender` (gnhf 3), the deployment-side sandbox-account provisioning orphaned by #94's privilege-drop removal (gnhf 8, 9), and the Node/TypeScript toolchain stranded by the `.sandcastle` agent loop's removal (gnhf 30). ## Seams introduced `state_file::{write_atomic, install_atomic}`, `schedule::{Verb, Selector}`, `control_plane::{Partition, Destination}`, `pi::{read_bounded_line, bwrap_command, pi_store_command}`, `telegram::markdown::Splitter`, `telegram::view::{send_page, inline_content}`, `session::run_ephemeral_kind`, `chat_id::ChatSession`, `main`'s `Target`/`Selection` clap groups, `transcribe::MODEL_FILES`, `test_script::write_executable`, and a shared `tests/hitl/common.sh`. ## Docs Prose that had drifted from the code it describes: extensions-as-per-user-capability and the fixed `evie` service account (gnhf 31), the setuid/setgid privilege drop #94 removed including three docs falsely claiming bwrap builds its namespace unprivileged (gnhf 8), and the two agent-facing triage docs pointing at the removed loop's phantom stages (gnhf 30). Touches `README`, `CONTEXT.md`, ADR 0011/0023, `flake.nix`, and the config template. ## Verification `nix develop .#ci -c just check` passes on the branch tip: 539 tests, 0 failed, exit 0. That is the whole CI gate, so this is green in CI. ## Review notes - No issue to close: this run was not ticket-driven. - Wire-format changes to review with care: `control_plane`'s `ControlRequest` (gnhf 45, 49, and the flattened `Target`/`Selection` in main.rs's CLI), and the `schedules.json` filename restoration (gnhf 17) which affects an existing live state file. - Config surface changes: `[[pi.models]]` collapsed back to scalar `pi.provider`/`pi.model`, `[pi.capability_env]` and `[sandbox]` gone, four `SessionManagerConfig` path fields now required.
weiwen merged commit c623634b91 into main 2026-08-13 13:38:58 +08:00
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
weiwen/evie!96
No description provided.