Keep the DB binding and fail closed on svc.sh start rebuilds #188

Merged

weichen merged 3 commits from feature/svc-start-keep-db-binding into main

2026-10-05 02:18:07 +00:00

Author	SHA1	Message	Date
weichen	36a1b363ad	Record the sync checkpoint ci / test (pull_request) Successful in 1m52s Details	2026-10-05 02:16:28 +00:00
weichen	4215107126	Keep the DB binding and fail closed on svc.sh start rebuilds Why: the 2026-10-05 dev outage — a restart with an explicit --addr rebuilt the start args, and the rebuild branch dropped the persisted --dsn for the dev env, so the binary resolved auth=auto to off on 0.0.0.0 and the new listen guard refused to spawn; record_state then persisted the broken exec= before the health probe, so bare starts kept failing. Evidence: bash -n clean; sandbox registry with stub binaries — dbref DSN is re-derived on rebuild (priority CLI > env > dbref), the pre-flight blocks non-loopback without auth with actionable remedies, immediate-death starts leave the previous exec= intact, and DSN masking covers all start-path log lines; make test green. Impact: dev/prod agent starts keep their DB binding across explicit-arg rebuilds; failed starts no longer corrupt the registry; static/pg paths get the same persist-after-probe ordering (pg already had it); no change to deploy materialization or the binary guard semantics. Refs: backend 8eda35f (listen guard), runtime/dev history.jsonl 01:23 fail	2026-10-05 02:16:20 +00:00
weichen	ef23756fa1	Record the task card for feature-svc-start-keep-db-binding	2026-10-05 01:51:21 +00:00

Author

SHA1

Message

Date

weichen

36a1b363ad

Record the sync checkpoint

ci / test (pull_request) Successful in 1m52s

Details

2026-10-05 02:16:28 +00:00

weichen

4215107126

Keep the DB binding and fail closed on svc.sh start rebuilds

Why: the 2026-10-05 dev outage — a restart with an explicit --addr rebuilt
the start args, and the rebuild branch dropped the persisted --dsn for the
dev env, so the binary resolved auth=auto to off on 0.0.0.0 and the new
listen guard refused to spawn; record_state then persisted the broken exec=
before the health probe, so bare starts kept failing.

Evidence: bash -n clean; sandbox registry with stub binaries — dbref DSN is
re-derived on rebuild (priority CLI > env > dbref), the pre-flight blocks
non-loopback without auth with actionable remedies, immediate-death starts
leave the previous exec= intact, and DSN masking covers all start-path log
lines; make test green.

Impact: dev/prod agent starts keep their DB binding across explicit-arg
rebuilds; failed starts no longer corrupt the registry; static/pg paths get
the same persist-after-probe ordering (pg already had it); no change to
deploy materialization or the binary guard semantics.

Refs: backend 8eda35f (listen guard), runtime/dev history.jsonl 01:23 fail

2026-10-05 02:16:20 +00:00

weichen

ef23756fa1

Record the task card for feature-svc-start-keep-db-binding

2026-10-05 01:51:21 +00:00