You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+4Lines changed: 4 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,6 +6,10 @@ All notable changes to this project are documented here. The format follows [Kee
6
6
7
7
## [Unreleased]
8
8
9
+
### Fixed
10
+
11
+
-`inactive-by-config` now has a constrained `--reactivate` path. When the manifest and managed Markdown remain healthy and only the top-level `model_instructions_file` is missing, preview/confirm restores that field into the current live `config.toml` after a timestamped backup. Deploy stays blocked; Markdown, hooks, and the manifest are not rewritten. The GUI Manage page exposes the same preview-gated action, and Dashboard/Deploy point inactive-by-config users there instead of a full deploy (#36).
@@ -74,7 +74,7 @@ Before opening a bug report, search existing issues and use the bug form. Includ
74
74
-`python3 codex-instruct.py --version`, the Release tag, and commit SHA;
75
75
- operating system, Python version, and Codex CLI version;
76
76
- minimal reproduction steps, expected behavior, and actual behavior;
77
-
- redacted `--status` / `--dry-run` output and whether deploy, recover, restore-hooks, or uninstall is involved. If a durable journal exists, report only its transaction ID and node types, not complete content.
77
+
- redacted `--status` / `--dry-run` output and whether deploy, recover, restore-hooks, uninstall, or reactivate is involved. If a durable journal exists, report only its transaction ID and node types, not complete content.
78
78
79
79
Remove tokens, cookies, usernames, private paths, complete configuration, and prompt-bank responses from public content. Report vulnerabilities privately through [SECURITY.md](SECURITY.md).
80
80
@@ -90,4 +90,4 @@ For a contribution:
90
90
91
91
The current full suite contains 400+ tests. Do not remove tests, narrow measured source, or lower the combined 81% branch-coverage gate to make CI pass. Release verification requires a complete, non-shallow checkout with all tags. Candidate builds must pass a full `--source-commit` that exactly matches HEAD and must verify the same tag on every configured remote with non-interactive access and a finite timeout. An unreachable or authentication-gated remote, or any disagreement with the local tag/candidate commit, must fail closed. If `v$VERSION` already exists at another commit, the builder must refuse without generating same-version assets. A formal build must omit that option and require the version tag to exist at HEAD. Release changes must verify reproducible ZIP, tar.gz, standalone-script, sealed `codex-keysmith-scenarios-v<VERSION>.bundle`, and `SHA256SUMS` assets with complete content and consistent versions. Recovery publication for an immutable tag must not rewrite the tag or reuse an older run; it must start from `main` with the full tag-object and peeled-commit SHAs, make every blocking and publish job check out that tag in the same run, and address the draft by numeric Release ID.
92
92
93
-
A pull request must describe the reason, user-visible impact, file-write and recovery boundary, verification evidence, and documentation/CHANGELOG impact. Windows fresh deployment is open under `EXPLICIT_BETA`; related changes must preserve the beta warning on preview and execution without emitting it from status, recover, uninstall, or restore-hooks. The native P0 backend and blocking recovery/lifecycle CI are not a formal support badge or an unbounded compatibility claim. P1 still requires per-phase hard interruption, path aliases, long paths, localized profiles, and cleanup double-fault evidence, while the P2 formal-support boundary remains open. Live prompt-bank calls are not a PR gate; never add API credentials or paid calls to a pull request.
93
+
A pull request must describe the reason, user-visible impact, file-write and recovery boundary, verification evidence, and documentation/CHANGELOG impact. Windows fresh deployment is open under `EXPLICIT_BETA`; related changes must preserve the beta warning on preview and execution without emitting it from status, recover, uninstall, restore-hooks, or reactivate. The native P0 backend and blocking recovery/lifecycle CI are not a formal support badge or an unbounded compatibility claim. P1 still requires per-phase hard interruption, path aliases, long paths, localized profiles, and cleanup double-fault evidence, while the P2 formal-support boundary remains open. Live prompt-bank calls are not a PR gate; never add API credentials or paid calls to a pull request.
Copy file name to clipboardExpand all lines: README.en.md
+3-1Lines changed: 3 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -85,9 +85,11 @@ The commands below use the Release single file. For a source checkout, replace t
85
85
python3 codex-instruct-vX.Y.Z.py --codex-dir ~/.codex --restore-hooks --lang en
86
86
python3 codex-instruct-vX.Y.Z.py --codex-dir ~/.codex --uninstall --lang en
87
87
python3 codex-instruct-vX.Y.Z.py --codex-dir ~/.codex --uninstall --yes --lang en
88
+
python3 codex-instruct-vX.Y.Z.py --codex-dir ~/.codex --reactivate --lang en
89
+
python3 codex-instruct-vX.Y.Z.py --codex-dir ~/.codex --reactivate --yes --lang en
88
90
```
89
91
90
-
Each uninstall peels one layer. For an interrupted transaction, run `--status`, preview with `--recover`, then add `--yes`. Do not delete journals, backups, or the manifest by hand.
92
+
Each uninstall peels one layer. If `--status` reports `inactive-by-config`, use `--reactivate` to restore only the missing top-level `model_instructions_file`. Do not edit `config.toml` by hand or run a full deploy just to put the field back. For an interrupted transaction, run `--status`, preview with `--recover`, then add `--yes`. Do not delete journals, backups, or the manifest by hand.
@@ -88,6 +89,7 @@ Code rollback and user-configuration recovery are separate operations:
88
89
-**Interrupted-transaction recovery:** after status detects a durable journal, preview with `--recover`, then run `--recover --yes` to restore every deploy or uninstall participant selected by the journal `operation`. Do not edit `journal.json` or remove snapshots to force progress.
89
90
-**User-configuration uninstall:** preview with `--uninstall`, then run `--uninstall --yes` to undo the newest manifest-owned MD/config layer. Only actually isolated hooks and archived legacy content belong to that layer. Uninstall publishes a durable journal before its first mutation; after a hard interruption, use `--recover` to restore the pre-uninstall state. Repeat `--uninstall` only to remove an earlier layer.
90
91
-**Hooks-only restore:**`--restore-hooks` restores `hooks.json.disabled` as `hooks.json`; it does not uninstall Markdown or edit config.
92
+
-**Missing config-reference restore:** when status is `inactive-by-config` and the manifest/Markdown are healthy, preview with `--reactivate`, then run `--reactivate --yes` to restore only the top-level `model_instructions_file` into the current live `config.toml`. It backs up the current config and does not rewrite the managed prompt, hooks, or manifest. Do not hand-edit `config.toml` to bypass ownership checks.
91
93
-**Ownership conflict:** manifest, managed-node, or required-backup drift fails closed. Do not edit the manifest or overwrite conflicting files to force progress. Copy the complete configuration directory first and include only redacted fingerprints and a minimal reproduction in the private report.
92
94
93
95
Journal, intent, manifest-companion, deployment-manifest, and cleanup-marker data is consistency evidence against accidental drift and ordinary races, not keyed cryptographic authentication. Coordinated same-user edits to multiple evidence files or a random cleanup claim are outside the provable mutual-exclusion boundary. The narrow hard-interruption windows between journal `mkdir` and first-intent publication, and between per-step `mkdtemp` and durable residue registration, also fail closed for manual inspection rather than authorizing deletion by prefix.
0 commit comments