From da1839c6d21a22354207f1d775847f2071ff4cab Mon Sep 17 00:00:00 2001 From: Eric Rakestraw Date: Mon, 2 Nov 2026 22:13:04 +0000 Subject: [PATCH] Record approved recovery remediation decisions --- docs/roadmap/remediation.md | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md index 505069b..7951407 100644 --- a/docs/roadmap/remediation.md +++ b/docs/roadmap/remediation.md @@ -244,10 +244,17 @@ machine/cache should not require reconstructing another invocation manually. The existing fallback guidance for a subsequently unavailable executable does not supply a working handoff for this ordinary cold-build case. +**Decision:** Prefer a module-selected Go invocation for recovery where the +consumer setup supports it. Provide an explicit, durable recovery path for +API-only consumers using temporary tool declarations. ReleaseKit owns the +handoff mechanics and supports both adoption styles. This follows the existing +tool-selection workflow and keeps routine binary lifecycle management out of +consumer code. + **Remediation:** Make the recovery invocation independent of an ephemeral -Go-tool executable. Use a supported module-selected entry point when available, -or otherwise provide a surviving supported entry point. Account for the -maintained launcher's temporary `-modfile` cleanup and its support for ordinary +Go-tool executable using the selected module-based approach and an explicit +API-only recovery path. Account for the maintained launcher's temporary +`-modfile` cleanup and its support for ordinary package dependencies as well as registered tools; a bare `go tool` command cannot assume every consumer has a permanent tool declaration. Keep explicit record selection and distinct exit statuses. Add an assembled cold-build test @@ -357,10 +364,13 @@ that the handoff could not be saved faithfully. Diagnostic JSON is a display format and can use safe displays; the private record supplies actual operation inputs and must preserve their identity. +**Decision:** Use a lossless private-record representation for supported +pathname and endpoint bytes. This preserves existing publication inputs and +keeps record-loaded recovery consistent with direct typed evidence. Recording +failures remain separate from the publication outcome. + **Remediation:** Make private serialization lossless for supported evidence, -using an explicit byte representation where needed. At minimum, detect values -that the selected record format cannot round-trip and return a separate -recording failure with no misleading saved handoff. Keep the original typed +using an explicit byte representation where needed. Keep the original typed evidence and publication behavior intact; avoid adding a general UTF-8 restriction to previously valid Git publication inputs. Cover endpoint/path round trips and equivalent direct-versus-loaded observations, including a