Skip to content

Propose progressive orchestration RFCs and implementation roadmap - #741

Draft
leynos wants to merge 3 commits into
mainfrom
docs/progressive-enhancement-rfcs
Draft

leynos wants to merge 3 commits into
mainfrom
docs/progressive-enhancement-rfcs

Conversation

@leynos

@leynos leynos commented Sep 19, 2026

Copy link
Copy Markdown
Owner

Summary

Add five Proposed RFCs (0021–0025) and an implementation roadmap for optional orchestration contracts:

RFC Proposal
0021 Managed states, default built-in probes, and optional external functional probes
0022 Optional typed task inputs sharing the bundle-parameter contract
0023 Artefact ownership, bounded previews, and capability-scoped cleanup
0024 Named contention classes lowered to Ninja pools
0025 Progressive enhancement and opt-in, scoped maturity policies

Add docs/roadmap-progressive-enhancement.md with phases 20 to 25, 17 steps, and 34 implementation tasks, including explicit dependencies, verification work, and Cuprum migration canaries. Link every new document from docs/contents.md without changing existing index content or renumbering existing roadmap tasks.

Preserve the shallow end

The unchanged quickstart is an explicit compatibility and release-acceptance fixture. Ordinary variables, legacy command semantics, and unannotated actions remain supported destinations, not deprecated migration stages.

Each feature must be independently usable. Adopting one state, typed input, cleanup root, or contention class must not force annotations onto neighbouring actions or aggregates. Default maturity policy is empty, with no new missing-annotation warnings. Inspection must not trigger new probes, installation, or preparation, and command text must not implicitly acquire state, ownership, or scheduling semantics.

Reuse the existing structured runner, OrthoConfig/profile/metadata machinery, bundle parameter validation, semantic-linter inventory, and Ninja scheduler. Named execution contexts remain a compatible future integration point, not an undeclared sixth prerequisite.

State and cleanup boundaries

Separate require_state (verification only), ensure_state (at most one authorized preparation on definite non-readiness), and prepare_state (explicit preparation followed by verification). Built-in presence checks do not claim package-set integrity. Preparation evidence never substitutes for a fresh mutable-state check.

Optional Nagios-style probes map exits 0/1/2/3 to ready/degraded/not-ready/unknown. Unknown results, crashes, and timeouts never authorize automatic repair. The proposal specifies operator-capped deadlines and output limits, process-tree cleanup, and explicit external-code trust without claiming a read-only or network sandbox.

Scoped cleanup begins with exact paths and explicitly owned directory trees, not unrestricted wildcard deletion. Preview and deletion share one capability boundary. State/ownership integrity leases protect cooperating invocations; invocation-local Ninja pools remain a separate concurrency mechanism, not CPU quotas or semantic ordering.

Scope

Documentation only: seven files, no runtime implementation, schema changes, CI changes, or accepted ADRs. Proposed syntax and public command extensions require acceptance and version allocation before implementation. Referencing issue #592 identifies the shared semantic-analysis owner; this PR does not complete that implementation.

Validation

  • Enumerated every remote branch for RFC filenames and for reservations claimed in content. The filename sweep alone was insufficient: PR Split the RFC 0006 accepted set into focused child RFCs (6.1.1) #697 reserves 0013–0020 in its ExecPlan without minting any 0013+ file, so only a content grep surfaces it. This set now takes 0021–0025, above Split the RFC 0006 accepted set into focused child RFCs (6.1.1) #697's ceiling.
  • 211/211 static documentation checks passed, including nine YAML examples, duplicate-key rejection, new cross-references and anchors, unique roadmap identifiers, and implementation dependency acyclicity.
  • Verified the exact quickstart example remains unchanged.
  • Removed the additive index entries locally and recovered the original docs/contents.md Git blob SHA, confirming existing index content is preserved byte-for-byte.
  • Verified uploaded Git blob hashes against the final local document bytes.

These checks do not establish Netsuke schema/compiler validity or runtime correctness for the proposed features.

Numbering

RFC 0013–0020 are reserved by the 6.1.1 child-RFC split plan (PR #697) for the Ansible stdlib
filter RFCs, which put an earlier draft of this set in collision at 0013–0017. The set was
therefore renumbered to 0021–0025, clearing #697's ceiling so the two can land in either
order. The renumber is a pure number substitution: each file is byte-identical to its
predecessor once the digits are normalised back.

Repository gates

All deterministic gates were run on the rebased head cdbe3cc7 and pass:

Gate Result Evidence
make check-fmt pass /tmp/check-fmt-netsuke-docs_progressive-enhancement-rfcs.out
make lint pass /tmp/lint-netsuke-docs_progressive-enhancement-rfcs.out
make typecheck pass /tmp/typecheck-netsuke-docs_progressive-enhancement-rfcs.out
make test pass /tmp/test-netsuke-docs_progressive-enhancement-rfcs.out
make markdownlint pass /tmp/markdownlint-netsuke-docs_progressive-enhancement-rfcs.out
make nixie pass /tmp/nixie-netsuke-docs_progressive-enhancement-rfcs.out

make test ran 3218 nextest tests (0 failed, 5 skipped) plus doctests. make lint ran cargo doc,
Clippy, both Whitaker packages, Ruff, Pylint, the df12 house lints, ambrleaks, interrogate,
yamllint and actionlint with zero warnings. make fmt was run and is committed.

None of the gates contains a Mermaid fence; make nixie passing means the repository's other
diagrams validated, not that these documents are diagram-checked.

The static checks above still do not establish Netsuke schema/compiler validity or runtime
correctness for the proposed features: the RFCs propose syntax the compiler does not yet accept.

Summary by Sourcery

Document an optional orchestration roadmap that adds progressive contracts while preserving Netsuke’s existing shallow-end workflows.

New Features:

  • Add five proposed RFCs covering managed states and probes, optional typed inputs, artefact ownership and scoped cleanup, named contention classes, and progressive-enhancement maturity policies.
  • Add a progressive-enhancement implementation roadmap covering phases 20–25, dependencies, verification activities, and migration canaries.

Enhancements:

  • Define compatibility boundaries that preserve the existing quickstart, legacy commands, ordinary variables, and independent adoption of each proposed contract.
  • Document integration with existing runner, profile, metadata, semantic-linter, resource-lease, and Ninja scheduling infrastructure without introducing runtime implementation.

Documentation:

  • Link the new RFCs and roadmap from the documentation contents index while preserving existing index content.

Tests:

  • Add static documentation validation covering examples, cross-references, anchors, roadmap identifiers, and dependency consistency.

Chores:

  • Reserve and use RFC identifiers 0021–0025 for the proposed documents.

References

@coderabbitai

coderabbitai Bot commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

Comment @coderabbitai help to get the list of available commands.

@sourcery-ai

sourcery-ai Bot commented Sep 19, 2026

Copy link
Copy Markdown
Contributor

Reviewer's Guide

This documentation-only PR proposes RFCs 0013–0017 for optional states, typed inputs, owned cleanup, Ninja-backed contention, and maturity policies, then lays out a dependency-driven phases 20–25 implementation roadmap with extensive verification and Cuprum migration canaries while preserving the existing shallow-end workflow.

Flow diagram for optional feature adoption

flowchart TD
    Start[Existing unannotated manifest] --> Choose{Adopt an optional contract?}
    Choose -->|No| Legacy[Keep legacy commands, vars, scheduling, and clean semantics]
    Choose -->|Typed input| Inputs[Validate selected task inputs]
    Choose -->|Contention class| Pool[Lower selected edges to a Ninja pool]
    Choose -->|Managed state| State[Verify or explicitly prepare state]
    Choose -->|Owned artefact| Cleanup[Preview and delete declared paths]
    Inputs --> Result[Feature works without neighbouring annotations]
    Pool --> Result
    State --> Result
    Cleanup --> Result
    Result --> Policy{Optional scoped maturity policy?}
    Policy -->|No| Default[Empty default policy; no missing-annotation warnings]
    Policy -->|Yes| Check[Semantic-linter coverage check]
    Check --> Outcome[Warn or fail only selected subjects]
Loading

File-Level Changes

Change Details Files
Adds five proposed orchestration RFCs that define independently adoptable contracts while preserving legacy command behavior and keeping advanced features opt-in.
  • Defines managed states, built-in and external probes, readiness outcomes, preparation authorization, leases, and durable evidence.
  • Defines optional typed task inputs reusing bundle-parameter validation, explicit source precedence, provenance, and redaction.
  • Defines exact-path artefact ownership, bounded previews, capability-scoped deletion, and cleanup safety rules.
  • Defines named contention classes lowered to Ninja pools with invocation-only scope and no second scheduler.
  • Defines progressive-enhancement requirements and scoped, trust-aware maturity policies with an empty default policy.
docs/rfcs/0013-managed-states-and-probes.md
docs/rfcs/0014-typed-task-inputs.md
docs/rfcs/0015-artefact-ownership-and-scoped-cleanup.md
docs/rfcs/0016-named-contention-classes.md
docs/rfcs/0017-progressive-enhancement-and-maturity-policies.md
Adds a phased implementation roadmap that sequences the proposed contracts through shared infrastructure, verification, migration canaries, and compatibility gates.
  • Adds phases 20–25 containing 17 steps and 34 implementation tasks with explicit dependencies.
  • Maps ownership to existing runner, profile, metadata, linter, plan-codec, lease, and Ninja mechanisms.
  • Includes unit, property, subprocess, filesystem, replay, and Cuprum canary verification requirements.
  • Separates proposed public syntax and version allocation from implementation and acceptance.
docs/roadmap-progressive-enhancement.md
Extends documentation navigation with links to the new roadmap and RFCs without renumbering or altering existing index content.
  • Adds the roadmap entry and RFC reference links plus their definitions.
  • Preserves existing index material byte-for-byte outside the additive entries.
docs/contents.md

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

codescene-access[bot]

This comment was marked as outdated.

leynos and others added 2 commits September 19, 2026 13:17
Add five proposed RFCs for managed states and functional probes,
optional typed task inputs, owned artefacts and cleanup, named
contention classes, and opt-in maturity policies.

Add roadmap phases 20 to 25 with explicit dependencies and acceptance
tasks, preserving the unchanged quickstart and independently usable
enhancements.
Run the canonical `make fmt` over the seven new documents so they
match the repository Markdown conventions: prose re-wrapped to 80
columns and tables padded to mdtablefix-canonical form. No wording
changed.

`mdtablefix --wrap` moved the `#592` issue reference to the start of
a line, where CommonMark parses `#592` as an ATX level-1 heading, so
markdownlint reported MD022 and MD025 against the roadmap. The
committed text carried the same latent mis-parse; only the rewrapping
made it visible. Backtick the reference, matching the existing
convention for issue identifiers in `docs/`.

Co-Authored-By: Claude Code <noreply@anthropic.com>
@leynos
leynos force-pushed the docs/progressive-enhancement-rfcs branch from 8cf987b to cdbe3cc Compare September 19, 2026 11:46
codescene-access[bot]

This comment was marked as outdated.

@leynos

leynos commented Sep 19, 2026

Copy link
Copy Markdown
Owner Author

@coderabbitai Please investigate the cause of the following issue using codegraph exploration and research, identify a fix and provide an AI coding agent prompt for the fix:

        FAIL [   0.108s] (1073/2891) netsuke-build stdlib::network::redirect::error_tests::protocol_failures_are_classified_from_a_live_response
  stdout ───

    running 1 test
    test stdlib::network::redirect::error_tests::protocol_failures_are_classified_from_a_live_response ... FAILED

    failures:

    failures:
        stdlib::network::redirect::error_tests::protocol_failures_are_classified_from_a_live_response

    test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 1306 filtered out; finished in 0.09s
    
  stderr ───
    Error: a malformed status line should surface as a protocol error, got io: An established connection was aborted by the software in your host machine. (os error 10053)

    Stack backtrace:
       0: std::backtrace_rs::backtrace::win64::trace
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\..\..\backtrace\src\backtrace\win64.rs:85
       1: std::backtrace_rs::backtrace::trace_unsynchronized
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\..\..\backtrace\src\backtrace\mod.rs:66
       2: std::backtrace::Backtrace::create
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\backtrace.rs:331
       3: std::backtrace::Backtrace::capture
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\backtrace.rs:296
       4: <anyhow::Error>::msg::<alloc::string::String>
       5: anyhow::__private::format_err
       6: <core::alloc::layout::Layout>::from_size_alignment_unchecked::precondition_check
       7: netsuke::stdlib::network::redirect::error_tests::every_ureq_failure_maps_to_a_closed_category
       8: netsuke::stdlib::network::redirect::error_tests::protocol_failures_are_classified_from_a_live_response::{closure#0}
       9: <netsuke::stdlib::network::redirect::error_tests::protocol_failures_are_classified_from_a_live_response::{closure#0} as core::ops::function::FnOnce<()>>::call_once
      10: core::ops::function::FnOnce::call_once
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\core\src\ops\function.rs:250
      11: test::__rust_begin_short_backtrace<enum2$<core::result::Result<tuple$<>,alloc::string::String> >,enum2$<core::result::Result<tuple$<>,alloc::string::String> > (*)()>
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\test\src\lib.rs:733
      12: test::run_test_in_process
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\test\src\lib.rs:756
      13: test::run_test::closure$0
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\test\src\lib.rs:677
      14: test::run_test::closure$1
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\test\src\lib.rs:707
      15: std::sys::backtrace::__rust_begin_short_backtrace<test::run_test::closure_env$1,tuple$<> >
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\sys\backtrace.rs:166
      16: std::thread::lifecycle::spawn_unchecked::closure$1::closure$0
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\thread\lifecycle.rs:70
      17: core::panic::unwind_safe::impl$25::call_once
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\core\src\panic\unwind_safe.rs:275
      18: std::panicking::catch_unwind::do_call
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\panicking.rs:574
      19: std::panicking::catch_unwind
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\panicking.rs:542
      20: std::panic::catch_unwind
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\panic.rs:359
      21: std::thread::lifecycle::spawn_unchecked::closure$1
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\thread\lifecycle.rs:68
      22: core::ops::function::FnOnce::call_once<std::thread::lifecycle::spawn_unchecked::closure_env$1<test::run_test::closure_env$1,tuple$<> >,tuple$<> >
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\core\src\ops\function.rs:250
      23: std::sys::thread::windows::impl$0::new::thread_start
                 at /rustc/c54751567b19c4ceb08b0412d83529c2568cba8b/library\std\src\sys\thread\windows.rs:58
      24: BaseThreadInitThunk
      25: RtlUserThreadStart

  Cancelling due to test failure: 3 tests still running
        PASS [   0.071s] (1074/2891) netsuke-build stdlib::network::redirect::tests::every_rejection_diagnostic_is_snapshotted
        PASS [   4.067s] (1075/2891) netsuke-build stdlib::network::observability_tests::refused_redirect_logs_its_bounded_failure_category
        PASS [   8.091s] (1076/2891) netsuke-build stdlib::network::observability_tests::fetch_records_bounded_policy_decisions
────────────
     Summary [  23.482s] 1076/2891 tests run: 1075 passed, 1 failed, 2 skipped
        FAIL [   0.108s] (1073/2891) netsuke-build stdlib::network::redirect::error_tests::protocol_failures_are_classified_from_a_live_response
warning: 1815/2891 tests were not run due to test failure (run with --no-fail-fast to run all tests, or run with --max-fail)
error: test run failed
make: *** [Makefile:204: test-nextest] Error 100

Seek a systemic fix rather than tactical. Ask yourself, can this happen again or happen elsewhere? If so, think about a long term fix of the underlying issue.

@coderabbitai

This comment was marked as resolved.

RFC 0013 to 0020 are reserved by the 6.1.1 child-RFC split plan
(PR #697) for the Ansible stdlib filter RFCs, which puts this set in
collision at 0013 to 0017. Nothing above RFC 0012 is merged, and the
style guide forbids renumbering after publication, so resolve the
overlap now by moving this set above #697's ceiling.

Rename the five files and update every reference in the two documents
that cite them. The change is a pure number substitution: each file is
byte-identical to its predecessor once the digits are normalised back.

Gates: make fmt (no-op), check-fmt, markdownlint and nixie all pass.

Co-Authored-By: Claude Code <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant