mirrors/pikasTech-unidesk
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: remove stale code queue execution gate

Browse Source
This commit is contained in:
Codex
2026-05-29 02:36:29 +00:00
parent 8b76f455ad
commit 5b01dad112
6 changed files with 6 additions and 391 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/code-queue-execution-plane-contract-test.ts
-205
View File
@@ -1,205 +0,0 @@
import {
expectedJudgeProbeBehaviorVersion,
runCodeQueueExecutionPlaneForTest,
type CodeQueueExecutionPlaneObservation,
} from "./src/code-queue-execution-plane";
import { readFileSync } from "node:fs";
type JsonRecord = Record<string, unknown>;
function assertCondition(condition: unknown, message: string, detail: JsonRecord = {}): void {
if (!condition) throw new Error(`${message}: ${JSON.stringify(detail)}`);
}
const commit = "62c613eefc84292fe1874a837685b073ac6c7295";
const otherCommit = "0c3cdb4ee06a23361ed511a2da033d67b53d16f4";
const digest = `sha256:${"1".repeat(64)}`;
const otherDigest = `sha256:${"2".repeat(64)}`;
function deployment(name: string, role: "scheduler" | "read" | "write", schedulerEnabled: "true" | "false", overrides: Partial<CodeQueueExecutionPlaneObservation["deployments"][number]> = {}): CodeQueueExecutionPlaneObservation["deployments"][number] {
return {
name,
namespace: "unidesk",
observed: true,
expectedRole: role,
expectedSchedulerEnabled: schedulerEnabled,
labels: {
app: "code-queue",
component: role === "scheduler" ? null : role,
deploymentMode: "k3sctl-managed",
instanceId: role === "scheduler" ? "D601" : `D601-${role}`,
},
annotations: {
deployRef: "origin/master:deploy.json#environments.prod.services.code-queue",
deployCommit: commit,
deployRequestedCommit: commit,
imageSource: "deploy-env-commit",
},
replicas: {
desired: role === "read" ? 2 : 1,
ready: role === "read" ? 2 : 1,
available: role === "read" ? 2 : 1,
updated: role === "read" ? 2 : 1,
},
nodeSelector: "D601",
image: "unidesk-code-queue:d601",
env: {
serviceRole: role,
schedulerEnabled,
unideskDeployCommit: commit,
unideskDeployRequestedCommit: commit,
codeQueueDeployCommit: commit,
codeQueueDeployRequestedCommit: commit,
},
repoHostPath: "/home/ubuntu/cq-deploy",
error: null,
...overrides,
};
}
function healthyObservation(overrides: Partial<CodeQueueExecutionPlaneObservation> = {}): CodeQueueExecutionPlaneObservation {
const base: CodeQueueExecutionPlaneObservation = {
checkedAt: "2026-05-24T00:00:00.000Z",
namespace: "unidesk",
kubeconfig: "/etc/rancher/k3s/k3s.yaml",
worktreePath: "/home/ubuntu/cq-deploy",
guard: {
status: "pass",
refusal: false,
refusalSignals: [],
kubeconfig: "/etc/rancher/k3s/k3s.yaml",
expectedKubeconfig: "/etc/rancher/k3s/k3s.yaml",
currentContext: "default",
apiServer: "https://127.0.0.1:6443",
nodeNames: ["d601"],
nodeCount: 1,
requiredNodeName: "d601",
requiredNodePresent: true,
commandsOk: true,
summary: "D601 native k3s guard passed with explicit KUBECONFIG.",
},
deployments: [
deployment("code-queue", "scheduler", "true"),
deployment("code-queue-read", "read", "false"),
deployment("code-queue-write", "write", "false"),
],
pods: [
{ name: "code-queue-aaa", instanceId: "D601", component: null, nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
{ name: "code-queue-read-aaa", instanceId: "D601-read", component: "read", nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
{ name: "code-queue-write-aaa", instanceId: "D601-write", component: "write", nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
],
services: [
{ name: "code-queue", observed: true, type: "ClusterIP", clusterIP: "10.43.0.1", ports: ["http:4222->http"], selector: { app: "code-queue", component: null, instanceId: "D601" }, error: null },
{ name: "code-queue-read", observed: true, type: "ClusterIP", clusterIP: "10.43.0.2", ports: ["http:4222->http"], selector: { app: "code-queue", component: "read", instanceId: null }, error: null },
{ name: "code-queue-write", observed: true, type: "ClusterIP", clusterIP: "10.43.0.3", ports: ["http:4222->http"], selector: { app: "code-queue", component: "write", instanceId: null }, error: null },
],
worktree: {
path: "/home/ubuntu/cq-deploy",
ok: true,
head: commit,
error: null,
},
residual: {
composeBackend: { ok: true, present: false, containers: [], error: null },
loopbackPort4222: { ok: true, present: false, listeners: [], error: null },
},
judgeProbe: {
ok: true,
attempted: true,
behaviorVersion: expectedJudgeProbeBehaviorVersion,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: true,
model: "minimax-m2.7",
hits: 8,
total: 8,
hitRate: 1,
serviceProxyPath: "/api/v1/namespaces/unidesk/services/code-queue/proxy/api/judge/probe",
error: null,
raw: { ok: true, behaviorVersion: expectedJudgeProbeBehaviorVersion, results: [{ id: "bounded" }] },
},
commandDiagnostics: {},
};
return { ...base, ...overrides };
}
async function checkHealthyNoDrift(): Promise<void> {
const result = await runCodeQueueExecutionPlaneForTest([], healthyObservation());
assertCondition(result.ok === true, "healthy fixture should pass", result);
assertCondition((result.summary as JsonRecord).deploymentDrift === false, "healthy fixture should not report deployment drift", result);
assertCondition((result.summary as JsonRecord).deprecatedComposeResidual === false, "healthy fixture should not report residual compose", result);
}
async function checkDeploymentDrift(): Promise<void> {
const obs = healthyObservation({
deployments: [
deployment("code-queue", "scheduler", "true", { env: { ...deployment("code-queue", "scheduler", "true").env, codeQueueDeployCommit: otherCommit } }),
deployment("code-queue-read", "read", "false"),
deployment("code-queue-write", "write", "false"),
],
pods: [
{ name: "code-queue-aaa", instanceId: "D601", component: null, nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${digest}`, digest },
{ name: "code-queue-read-aaa", instanceId: "D601-read", component: "read", nodeName: "d601", phase: "Running", ready: true, imageID: `registry/unidesk-code-queue@${otherDigest}`, digest: otherDigest },
],
judgeProbe: {
...healthyObservation().judgeProbe,
behaviorVersion: "legacy",
},
});
const result = await runCodeQueueExecutionPlaneForTest([], obs);
const drift = result.drift as JsonRecord;
assertCondition(result.ok === false, "drift fixture should fail", result);
assertCondition(drift.status === "deployment-drift", "drift status should be deployment-drift", result);
assertCondition(JSON.stringify(drift).includes("deployment-drift"), "drift signal code should be visible", result);
}
async function checkDeprecatedComposeResidual(): Promise<void> {
const result = await runCodeQueueExecutionPlaneForTest([], healthyObservation({
residual: {
composeBackend: { ok: true, present: true, containers: [{ name: "code-queue-backend", status: "Up 3 days", image: "unidesk-code-queue:old" }], error: null },
loopbackPort4222: { ok: true, present: true, listeners: [{ localAddress: "127.0.0.1:4222", process: "users:((\"bun\",pid=1,fd=12))", line: "LISTEN 0 128 127.0.0.1:4222 0.0.0.0:* users:((\"bun\",pid=1,fd=12))" }], error: null },
},
}));
const residual = result.residual as JsonRecord;
assertCondition(result.ok === false, "residual fixture should fail", result);
assertCondition(residual.status === "deprecated-compose-residual", "residual status should be explicit", result);
assertCondition(JSON.stringify(result.blockers).includes("deprecated-compose-residual"), "residual blocker code should be visible", result);
}
async function checkProgressiveDisclosure(): Promise<void> {
const compact = await runCodeQueueExecutionPlaneForTest([], healthyObservation());
assertCondition(!("details" in compact), "default output should omit details", compact);
assertCondition(!("rawObservation" in compact), "default output should omit raw observation", compact);
const full = await runCodeQueueExecutionPlaneForTest(["--full"], healthyObservation());
assertCondition("details" in full, "--full should include details", full);
assertCondition(!("rawObservation" in full), "--full should still omit raw observation", full);
const raw = await runCodeQueueExecutionPlaneForTest(["--raw"], healthyObservation());
assertCondition("details" in raw && "rawObservation" in raw, "--raw should include details and raw observation", raw);
}
async function checkLiveCollectorUsesD601TranTransport(): Promise<void> {
const source = readFileSync(new URL("./src/code-queue-execution-plane.ts", import.meta.url), "utf8");
assertCondition(source.includes('["D601:k3s", "kubectl", ...args]'), "live collector should observe k3s through D601 tran route, not local kubectl");
assertCondition(source.includes('`D601:${options.worktreePath}`'), "worktree observation should run on D601 workspace route");
assertCondition(!source.includes('runCommand(["kubectl", ...args]'), "live collector must not call local kubectl directly");
assertCondition(!source.includes('runCommand(["git", "-C", options.worktreePath'), "worktree observation must not read local filesystem");
}
async function main(): Promise<void> {
const checks = [
["code-queue:execution-plane-healthy-no-drift", checkHealthyNoDrift],
["code-queue:execution-plane-deployment-drift", checkDeploymentDrift],
["code-queue:execution-plane-deprecated-compose-residual", checkDeprecatedComposeResidual],
["code-queue:execution-plane-progressive-disclosure", checkProgressiveDisclosure],
["code-queue:execution-plane-d601-tran-transport", checkLiveCollectorUsesD601TranTransport],
] as const;
const results = [];
for (const [name, check] of checks) {
await check();
results.push({ name, ok: true });
}
process.stdout.write(`${JSON.stringify({ ok: true, results }, null, 2)}\n`);
}
if (import.meta.main) {
await main();
}
scripts/src/check.ts
-4
View File
@@ -49,7 +49,6 @@ const syntaxFiles = [
"scripts/code-queue-submit-summary-contract-test.ts",
"scripts/code-queue-cli-read-terminal-contract-test.ts",
"scripts/code-queue-gh-auth-redaction-contract-test.ts",
"scripts/code-queue-execution-plane-contract-test.ts",
"scripts/d601-recovery-guardrails-contract-test.ts",
"scripts/hwlab-cd-wrapper-contract-test.ts",
"scripts/code-queue-queues-shape-contract-test.ts",
@@ -363,7 +362,6 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
fileItem("scripts/code-queue-submit-summary-contract-test.ts"),
fileItem("scripts/code-queue-submit-routing-contract-test.ts"),
fileItem("scripts/code-queue-gh-auth-redaction-contract-test.ts"),
fileItem("scripts/code-queue-execution-plane-contract-test.ts"),
fileItem("scripts/code-queue-queues-shape-contract-test.ts"),
fileItem("scripts/code-queue-supervisor-disclosure-contract-test.ts"),
fileItem("scripts/code-queue-commander-view-contract-test.ts"),
@@ -424,7 +422,6 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
items.push(commandItem("code-queue:submit-summary-contract", ["bun", "scripts/code-queue-submit-summary-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:submit-routing-contract", ["bun", "scripts/code-queue-submit-routing-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:gh-auth-redaction-contract", ["bun", "scripts/code-queue-gh-auth-redaction-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:execution-plane-contract", ["bun", "scripts/code-queue-execution-plane-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:queues-shape-contract", ["bun", "scripts/code-queue-queues-shape-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:supervisor-disclosure-contract", ["bun", "scripts/code-queue-supervisor-disclosure-contract-test.ts"], 30_000));
items.push(commandItem("code-queue:commander-view-contract", ["bun", "scripts/code-queue-commander-view-contract-test.ts"], 30_000));
@@ -470,7 +467,6 @@ export function runChecks(config: UniDeskConfig, options: CheckOptions = default
items.push(skippedItem("code-queue:submit-summary-contract", "Code Queue submit summary contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:submit-routing-contract", "Code Queue submit routing contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:gh-auth-redaction-contract", "Code Queue GitHub auth output redaction contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:execution-plane-contract", "Code Queue execution plane drift contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:queues-shape-contract", "Code Queue queues shape contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:supervisor-disclosure-contract", "Code Queue supervisor disclosure contract is opt-in with script checks", "--scripts-typecheck or --full"));
items.push(skippedItem("code-queue:commander-view-contract", "Code Queue commander view contract is opt-in with script checks", "--scripts-typecheck or --full"));
scripts/src/code-queue-execution-plane.ts
+2 -178
View File
@@ -11,7 +11,6 @@ interface ExecutionPlaneOptions {
worktreePath: string;
full: boolean;
raw: boolean;
skipProbe: boolean;
timeoutMs: number;
}
@@ -109,21 +108,6 @@ interface ResidualObservation {
};
}
interface JudgeProbeObservation {
ok: boolean;
attempted: boolean;
behaviorVersion: string | null;
expectedBehaviorVersion: string;
configured: boolean | null;
model: string | null;
hits: number | null;
total: number | null;
hitRate: number | null;
serviceProxyPath: string | null;
error: string | null;
raw: unknown;
}
export interface CodeQueueExecutionPlaneObservation {
checkedAt: string;
namespace: string;
@@ -135,7 +119,6 @@ export interface CodeQueueExecutionPlaneObservation {
services: ServiceObservation[];
worktree: WorktreeObservation;
residual: ResidualObservation;
judgeProbe: JudgeProbeObservation;
commandDiagnostics: Record<string, unknown>;
}
@@ -154,7 +137,6 @@ interface DriftSignal {
const expectedNamespace = "unidesk";
const expectedWorktreePath = "/home/ubuntu/cq-deploy";
export const expectedJudgeProbeBehaviorVersion = "code-queue-judge-probe:v1";
const expectedDeployments = [
{ name: "code-queue", role: "scheduler" as const, schedulerEnabled: "true" },
@@ -188,7 +170,7 @@ function parsePositiveInteger(value: string | undefined, fallback: number, max:
}
function parseExecutionPlaneOptions(args: string[]): ExecutionPlaneOptions {
const knownFlags = new Set(["--full", "--raw", "--skip-probe"]);
const knownFlags = new Set(["--full", "--raw"]);
const knownValues = new Set(["--namespace", "--kubeconfig", "--worktree", "--timeout-ms"]);
for (let index = 0; index < args.length; index += 1) {
const arg = args[index] ?? "";
@@ -207,7 +189,6 @@ function parseExecutionPlaneOptions(args: string[]): ExecutionPlaneOptions {
worktreePath: optionValue(args, ["--worktree"]) ?? expectedWorktreePath,
full: raw || hasFlag(args, "--full"),
raw,
skipProbe: hasFlag(args, "--skip-probe"),
timeoutMs: parsePositiveInteger(optionValue(args, ["--timeout-ms"]), 15_000, 60_000),
};
}
@@ -456,7 +437,6 @@ function collectResidual(): ResidualObservation {
worktreePath: expectedWorktreePath,
full: false,
raw: false,
skipProbe: true,
timeoutMs: 15_000,
};
const docker = runTran(["D601", "argv", "docker", "ps", "-a", "--filter", "name=code-queue-backend", "--format", "{{.Names}}\t{{.Status}}\t{{.Image}}"], remoteOptions, 15_000);
@@ -496,100 +476,6 @@ function collectResidual(): ResidualObservation {
};
}
function parseJson(text: string): unknown {
try {
return JSON.parse(text) as unknown;
} catch {
return null;
}
}
function asRecord(value: unknown): Record<string, unknown> | null {
return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : null;
}
function stringValue(value: unknown): string | null {
return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
}
function numberValue(value: unknown): number | null {
return typeof value === "number" && Number.isFinite(value) ? value : null;
}
function collectJudgeProbe(options: ExecutionPlaneOptions): JudgeProbeObservation {
if (options.skipProbe) {
return {
ok: false,
attempted: false,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: null,
error: "--skip-probe requested",
raw: null,
};
}
const paths = [
`/api/v1/namespaces/${options.namespace}/services/code-queue/proxy/api/judge/probe`,
`/api/v1/namespaces/${options.namespace}/services/code-queue:4222/proxy/api/judge/probe`,
`/api/v1/namespaces/${options.namespace}/services/code-queue:http/proxy/api/judge/probe`,
];
for (const path of paths) {
const probe = runKubectl(["--request-timeout=15s", "get", "--raw", path], options);
if (!probe.ok) continue;
const raw = parseJson(probe.stdout);
const record = asRecord(raw);
if (record === null) {
return {
ok: false,
attempted: true,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: path,
error: "judge probe returned non-JSON response",
raw: probe.stdout.slice(0, 2000),
};
}
return {
ok: record.ok === true,
attempted: true,
behaviorVersion: stringValue(record.behaviorVersion ?? asRecord(record.behavior)?.version ?? record.version),
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: typeof record.configured === "boolean" ? record.configured : null,
model: stringValue(record.model),
hits: numberValue(record.hits),
total: numberValue(record.total),
hitRate: numberValue(record.hitRate),
serviceProxyPath: path,
error: record.ok === true ? null : stringValue(record.error) ?? "judge probe returned ok=false",
raw,
};
}
return {
ok: false,
attempted: true,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: null,
error: "judge probe could not be read through Kubernetes API service proxy",
raw: null,
};
}
function digestFromText(value: string | null): string | null {
if (value === null) return null;
const match = value.match(/sha256:[0-9a-f]{64}/iu);
@@ -613,20 +499,6 @@ class LiveExecutionPlaneCollector implements ExecutionPlaneCollector {
services: [],
worktree,
residual,
judgeProbe: {
ok: false,
attempted: false,
behaviorVersion: null,
expectedBehaviorVersion: expectedJudgeProbeBehaviorVersion,
configured: null,
model: null,
hits: null,
total: null,
hitRate: null,
serviceProxyPath: null,
error: "D601 k3s guard did not pass; runtime probe skipped",
raw: null,
},
commandDiagnostics: { guard: diagnostics },
};
}
@@ -641,7 +513,6 @@ class LiveExecutionPlaneCollector implements ExecutionPlaneCollector {
services: collectServices(options),
worktree,
residual,
judgeProbe: collectJudgeProbe(options),
commandDiagnostics: { guard: diagnostics },
};
}
@@ -800,34 +671,6 @@ function driftSignals(observation: CodeQueueExecutionPlaneObservation): DriftSig
});
}
if (!observation.judgeProbe.attempted) {
signals.push({
code: "deployment-drift",
severity: "warning",
field: "judgeProbe.behaviorVersion",
message: "/api/judge/probe behavior version was not checked",
expected: expectedJudgeProbeBehaviorVersion,
observed: observation.judgeProbe.error,
});
} else if (observation.judgeProbe.behaviorVersion !== expectedJudgeProbeBehaviorVersion) {
signals.push({
code: "deployment-drift",
severity: "blocker",
field: "judgeProbe.behaviorVersion",
message: "/api/judge/probe behavior version does not match the repo contract",
expected: expectedJudgeProbeBehaviorVersion,
observed: observation.judgeProbe.behaviorVersion,
});
} else if (!observation.judgeProbe.ok) {
signals.push({
code: "deployment-drift",
severity: "blocker",
field: "judgeProbe.ok",
message: "/api/judge/probe returned a non-ready result",
expected: true,
observed: observation.judgeProbe.error,
});
}
return signals;
}
@@ -881,23 +724,6 @@ function compactDeployment(deployment: DeploymentObservation): Record<string, un
};
}
function compactJudgeProbe(probe: JudgeProbeObservation, full: boolean): Record<string, unknown> {
return {
ok: probe.ok,
attempted: probe.attempted,
behaviorVersion: probe.behaviorVersion,
expectedBehaviorVersion: probe.expectedBehaviorVersion,
configured: probe.configured,
model: probe.model,
hits: probe.hits,
total: probe.total,
hitRate: probe.hitRate,
serviceProxyPath: probe.serviceProxyPath,
error: probe.error,
...(full ? { raw: probe.raw } : {}),
};
}
function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, options: ExecutionPlaneOptions): Record<string, unknown> {
const formalSignals = observation.deployments.flatMap(deploymentFormalSignals);
const deploymentDriftSignals = driftSignals(observation);
@@ -939,7 +765,6 @@ function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, op
artifactDigest: uniqueDigests.length === 1 ? uniqueDigests[0] : null,
deploymentCommit: uniqueCommits.length === 1 ? uniqueCommits[0] : null,
mountedWorktreeHead: observation.worktree.head,
judgeProbeBehaviorVersion: observation.judgeProbe.behaviorVersion,
},
guard: {
status: observation.guard.status,
@@ -959,7 +784,7 @@ function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, op
signalCount: deploymentDriftSignals.length,
signals: deploymentDriftSignals.slice(0, options.full ? undefined : 5),
omittedSignals: options.full ? 0 : Math.max(0, deploymentDriftSignals.length - 5),
comparedFields: ["deployment env/annotation commit", "artifact digest", "mounted worktree HEAD", "/api/judge/probe behaviorVersion"],
comparedFields: ["deployment env/annotation commit", "artifact digest", "mounted worktree HEAD"],
},
residual: {
status: deprecatedResidualSignals.some((signal) => signal.code === "deprecated-compose-residual") ? "deprecated-compose-residual" : "none",
@@ -968,7 +793,6 @@ function evaluateObservation(observation: CodeQueueExecutionPlaneObservation, op
containers: observation.residual.composeBackend.containers,
listeners: observation.residual.loopbackPort4222.listeners,
},
judgeProbe: compactJudgeProbe(observation.judgeProbe, options.full),
blockers,
warnings,
commands: {
scripts/src/help.ts
+2 -2
View File
@@ -66,7 +66,7 @@ export function rootHelp(): unknown {
{ command: "codex prompt-lint [prompt|--prompt-file path|--prompt-stdin]", description: "Dry-run lint a runner prompt for DEV test class read-only/live-read/live-mutating authorization without echoing prompt text or touching live services." },
{ command: "codex submit [prompt] [--prompt-file path|--prompt-stdin] [--queue queueId] [--provider-id id] [--cwd path] [--model model] [--execution-mode mode] [--max-attempts N] [--reference-task-id id] [--dry-run]", description: "Submit a Code Queue task through backend-core -> code-queue proxy; --dry-run shows the structured request, routing recommendation, and prompt live-authorization lint while real success only confirms the write and task id." },
{ command: "codex skills-sync --dry-run [--full]", description: "Inspect the controlled runner skills hostPath lifecycle contract without copying files, restarting services, reading secrets, or mutating live runner paths." },
{ command: "codex execution-plane [--full|--raw]", description: "Read-only D601 native k3s Code Queue execution-plane drift inspection; compares formal deployments, deprecated Compose residuals, commit markers, pod digest, mounted worktree HEAD, and judge probe behavior version." },
{ command: "codex execution-plane [--full|--raw]", description: "Read-only D601 native k3s Code Queue execution-plane inspection; compares formal deployments, deprecated Compose residuals, commit markers, pod digest, and mounted worktree HEAD." },
{ command: "codex pr-preflight [--remote] [--push-dry-run --push-dry-run-ref refs/heads/probe/<name>] [--pr-create-dry-run --pr-create-dry-run-head <head>] [--issue N] [--full|--raw]", description: "Read-only PR admission check with compact commander output by default; use --full or --raw to expand the full runtime preflight, tool, and observation payload." },
{ command: "codex task <taskId> [--detail] [--trace --tail|--from-start|--after-seq N|--before-seq N --limit N] [--full]", description: "Fetch the bounded review view by default; --detail is still capped, while --full/trace/output explicitly expand evidence." },
{ command: "codex tasks [--view commander|supervisor|full] [--queue id] [--status status[,status]] [--unread|--unread-only] [--limit N] [--before-id id]", description: "Show Code Queue task state with progressive disclosure; --view commander is the recommended bounded host-commander loop, supervisor keeps compact sections, and full returns detailed rows." },
@@ -432,7 +432,7 @@ function codexHelp(): unknown {
mutation: false,
kubeconfig: "/etc/rancher/k3s/k3s.yaml",
namespace: "unidesk",
defaultPolicy: "compact drift/residual summary; deployments, pods, services and probe detail require --full, raw sanitized observations require --raw",
defaultPolicy: "compact drift/residual summary; deployments, pods and services require --full, raw sanitized observations require --raw",
blockers: ["deployment-drift", "deprecated-compose-residual", "d601-k3s-guard-blocked"],
},
examples: {