Conversation
ADR 0007 measures the update path as it stands, names where the complexity comes from, and proposes a two-slot self-update of the existing release tarball with a launcher that falls back on a failed trial. Docker becomes a plain image without a sidecar, the Pi image drops the Docker engine, and betas go weekly. Status: proposed. self-update.md gets a pointer and keeps describing what ships. Tracks #1308. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The brand check flags the old product name in active copy. The ADR only needs to say that the alias goes, not spell it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Adds a Versions section: the binary line returns to 0.x at v0.131.0, the reset rides the cutover so no epoch rule is needed, major bumps go, and a minor needs the owner's approval. Records how 1.0.0 to 3.0.0 came from removal changesets, and that the stable channel is a major behind beta (#1313). Tracks #1314. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
miravoss26
left a comment
miravoss26
left a comment
There was a problem hiding this comment.
ADR 0007 (status: proposed) + a 3-line pointer in self-update.md. Docs-only, no changeset needed (CI confirms: changeset-check passed as auto-exempt, all code-touching jobs skipped, docs/hygiene checks green).
Correctness: does what it says — adds the ADR, doesn't touch any code path, self-update.md still describes what actually ships today and just points forward to the proposal. The measurements table, the "what is lost" / alternatives-considered sections and the explicit evidence-required-before-acceptance list make this an honest proposal, not a fait accompli merged as docs.
Security: nothing to screen — no code, no secrets, no new deps or network surface.
Safe to merge from my read (docs-only, CI green). The actual call here is an architecture decision for a human owner, not something my review settles — this is just confirming the PR is what it claims to be.
|
While you are one it, it would be great if we could also upgrade the bug report template here on github for the actually ways we ship ftw in: |
3 participants
Problem
The update path is ~6 000 lines of Go plus ~4 300 of tests, ~2 000 of CI and ~2 100 of scripts, of which ~2 800 lines are one-time transition code. It took 73 of the last 867 commits, produced 20 betas between 7 and 18 September, and has 10 open issues. Almost none of it is what keeps a box safe. It is delivery mechanics that follow from Docker being the way in. Details and the measurements are in #1308.
Proposal
ADR 0007, status proposed. Core downloads its next release tarball (which every release already publishes, with a sha256), verifies it, unpacks it into a slot, and a small launcher runs it as a trial. The new Core commits itself after readiness or the launcher falls back. Rollback is the same swap in reverse. No process holds the Docker socket, the Pi image drops the Docker engine, Docker becomes a plain image with the button off, and betas go weekly.
The rollback point (state.db + config, the #1302 form), the readiness gate and immutable tags stay in every step.
docs/self-update.mdgets a three-line pointer to the ADR and keeps describing what ships today.Versions
The ADR also decides the version scheme, tracked in #1314: the binary line returns to 0.x, starting at v0.131.0 where the 0.x counter stopped, with no major bumps and minors approved by the owner. The reset costs nothing because it rides the same reinstall. The stable channel defect (#1313, stable resolves to v2.3.2 while beta is at 3.5.x) is independent and should land first.
How to assess it
Docs only. No changeset needed (allowlisted path). No hardware evidence is claimed; this is a proposal per CONTRIBUTING.
Closes nothing. Tracks #1308 and #1314.
🤖 Generated with Claude Code