fix(devenv): build the operator CLI so the box never serves a stale binary (RIG-3342) - #925
Open
rigel-mintaka wants to merge 2 commits into
Open
fix(devenv): build the operator CLI so the box never serves a stale binary (RIG-3342)#925rigel-mintaka wants to merge 2 commits into
rigel-mintaka wants to merge 2 commits into
Conversation
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
|
Compass engineering docs preview: https://compass-rig-3342-build-opera.compass-eng-docs.pages.dev Deployed from |
…inary (RIG-3342) `devenv.nix` builds four binaries — `compass-server`, `compass-runner`, `compass-gen-cert`, `compass-mint-runner-token` — but never `./cmd/compass`. Each of those four is built by the task that immediately execs it, so their freshness is a side effect of being invoked at boot. The operator CLI is invoked later, by a human over ssh, so nothing rebuilt it: the mattfw dogfood box served an Aug 23 binary missing the `agent` and `message` verbs while `main.go` had registered all five for weeks. The drift was invisible from the CLI itself, because `--version` prints the same static "0.1.0" for a months-old build and a current one (that blind spot is RIG-3346). Add `dogfood:build-cli`, deliberately the only build-only task here — it has no `exec`, since there is nothing to run at boot; the point is to leave a current binary in the state dir. Ordered `before` the server purely to pin it into the `up` graph, with no runtime dependency on it. Verified on the box: the state-dir path held a 22,064,753-byte Aug 23 binary; running the task's build replaced it with an 18,782,067-byte current one exposing all five verbs (`agent`, `agent-config`, `message`, `secret`, `token`). Refs RIG-3342, RIG-3068 (the dogfood validation that surfaced it). Co-authored-by: Matt Wilkinson <matt@rigel.build>
…nt (RIG-3342) Review findings on the build-cli task. The `before` edge inverted a failure mode: `go build ./cmd/compass` pulls cobra, viper and the connect client, so any compile error in the operator CLI's import graph blocked compass-server from starting — and with it compass-ui and compass-runner, which chain off the server. A broken CLI took down the whole dogfood backend, which is backwards: you want the server up in order to diagnose. Switch to `after`, mirroring dogfood:mint-runner-token. That still pins the task into the `up` graph, but the edge is inert. The comment also claimed this was "the only task here with no `exec`", which is false twice over: the task does have an `exec` attribute two lines below the claim, and under the intended reading dogfood:agent-image and dogfood:clean also never exec-replace. Restate it as the narrower true claim — it is the only *binary-building* task that does not exec what it produces — and stop conflating tasks with processes (gen-cert and mint-runner-token are tasks; compass-server and compass-runner are processes). Also document the two things a reader needs and could not get from the file: that the unconditional rebuild is deliberate (a present-but-stale binary is the bug, so skip-if-present would skip exactly when the build is required), and the invocation path, since the state dir is not on PATH. Add build-cli to the two indexes that enumerate the `up` graph — the chain comment and the tasks-block platform header — which otherwise under-describe it, reproducing the same documentation drift this change exists to fix. Refs RIG-3342. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
compass/rig-3342-build-operator-cli
branch
from
September 6, 2026 05:08
3ef72be to
7e12e76
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
devenv.nixbuilds four binaries —compass-server,compass-runner,compass-gen-cert,compass-mint-runner-token— but never./cmd/compass.Each of those four is built by the task that immediately execs it, so their
freshness is a side effect of being invoked at boot. The operator CLI is
invoked later, by a human over ssh, so nothing rebuilt it: the mattfw dogfood
box served an Aug 23 binary missing the
agentandmessageverbs whilemain.gohad registered all five for weeks.The drift was invisible from the CLI itself, because
--versionprints thesame static "0.1.0" for a months-old build and a current one (that blind spot
is RIG-3346).
Add
dogfood:build-cli, deliberately the only build-only task here — it hasno
exec, since there is nothing to run at boot; the point is to leave acurrent binary in the state dir. Ordered
beforethe server purely to pin itinto the
upgraph, with no runtime dependency on it.Verified on the box: the state-dir path held a 22,064,753-byte Aug 23 binary;
running the task's build replaced it with an 18,782,067-byte current one
exposing all five verbs (
agent,agent-config,message,secret,token).Refs RIG-3342, RIG-3068 (the dogfood validation that surfaced it).
Co-authored-by: Matt Wilkinson matt@rigel.build