feat(blaze): prune checkpoint history - #2474
Conversation
github-actions
Bot
added
component:blaze
5804993 to
88921b2
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 88921b2483
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
88921b2 to
91a138e
Compare
|
@codex review Prune with tightened BadRequest handling for uncommitted protected identifiers. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 91a138e20b
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
91a138e to
06bd020
Compare
|
@codex review Prune now reports post-tombstone cleanup failures as PruneOutcome::PartialCleanup and the manager marks the sandbox RecoveryRequired. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 06bd020fdc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
06bd020 to
9af5bdd
Compare
|
@codex Review |
|
@codex review Prune now classifies every post-rename uncertainty as PruneOutcome::PartialCleanup and rejects prune on a RecoveryRequired sandbox with HTTP 409. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9af5bdd952
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
9af5bdd to
9fcfb42
Compare
|
@codex review sweep_candidate now classifies every per-candidate outcome (Removed / Retained / RemovedWithRetainedScratch) so a partial success is never reported as a plain HTTP 500, and owner-publication failures clean up scratch or force RecoveryRequired. |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9fcfb424fb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
9fcfb42 to
0035d1d
Compare
|
@codex review Adds |
|
@qoder review |
![qoderai[bot]](https://avatars.githubusercontent.com/in/1396158?s=60&v=4){kind=small}
There was a problem hiding this comment.
[P1] RecoveryRequired 状态下的 prune 调用需要显式拒绝；[P1] protected 列表的去重与文档约束可以减少误用与开销；[P2] tombstone 名称解析错误时的错误信息可以更具体，便于恢复与运维。
🤖 Generated by Qoder • View workflow run
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0035d1de7e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
0035d1d to
18eb9c9
Compare
|
@qoder review |
|
@codex review Adds cancellation-safe checkpoint history pruning: the detached supervisor now owns deletion, lifecycle finalization, and the per-sandbox operation lock until completion. |
|
Codex Review: Didn't find any major issues. Keep it up! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
@qoder review |
There was a problem hiding this comment.
[P1] prune 请求体错误时的错误信息与文档略有偏差；[P2] 文档中对成功清理不留 tombstone 的语义可以更明确；[P2] RecoveryRequired 状态下复用 409 拒绝的行为可以在用户指南中补充说明。
🤖 Generated by Qoder • View workflow run
|
Update for current head |
18eb9c9 to
04edc25
Compare
|
@codex review Enforces the documented prune request shape, covers empty and repeated protected identifiers, and makes HTTP 200, 400, and 409 cleanup boundaries explicit. |
04edc25 to
669b045
Compare
|
@codex review Adds safe checkpoint-history pruning, rejects invalid request shapes before recording work, and keeps cleanup recoverable across interruption or client cancellation. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 04edc25abc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review Moves explicit empty-list coverage into an independent test, restores the pre-existing no-mutation assertion, and passes the exact-head hosted Blaze test. |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
@qoder review |
There was a problem hiding this comment.
[P1] prune 请求体错误信息与文档措辞略有偏差，建议在 API 错误文本中区分非对象请求体与字段级错误，并与 runtime 文档示例保持一致；[P2] RecoveryRequired 状态下 prune 统一返回 409 的行为在 README 路由列表中可以补一处显式说明，方便只读路由表的使用者；[P2] prune tombstone 命名校验遇到格式错误时的处理路径在设计文档中可补充一条简短运维提示，帮助识别需要人工介入的残留目录。
🤖 Generated by Qoder • View workflow run
Users can now prune checkpoint branches that are unreachable from the current HEAD. Explicitly protected checkpoints keep their complete parent lineages. Each removal uses an atomic tombstone, and prune intent is persisted before mutation. Partial or uncertain cleanup enters recovery rather than reporting success. Pruning is limited to running sandboxes. Recovery removes the complete checkpoint namespace. Assisted-by: Codex:GPT-5 Signed-off-by: Weisson <Weisson@linux.alibaba.com>
669b045 to
36b8d14
Compare
|
@codex review Clarifies prune error diagnostics, states non-running HTTP 409 behavior in the endpoint tables, and documents safe handling of malformed cleanup-directory names. |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
@qoder review |
1 participant
Why
Blaze can capture and list checkpoints, but it has no supported way to reclaim
the storage held by history branches that are no longer reachable from the
current checkpoint. Operators need a bounded deletion operation that preserves
every checkpoint still required by the active history or explicitly selected
for retention.
What changed
POST /v1/sandboxes/{id}/checkpoints/prune. The request body is optional;when present, it may contain only a
protectedarray of committed checkpointidentifiers. An empty array protects only the current HEAD lineage, and
duplicate identifiers have the same effect as one occurrence. Malformed JSON,
non-object bodies, unknown fields, and invalid field types return HTTP 400
before the operation is recorded. The response reports the removed count and
identifiers.
explicitly protected checkpoint also preserves its complete ancestor chain.
Malformed or uncommitted protected identifiers return HTTP 400 before any
deletion.
Other lifecycle states return HTTP 409.
checkpoint is atomically renamed to a unique temporary directory before its
complete version-2 payload tree is recursively removed.
the per-sandbox operation lock. If the client disconnects, pruning finishes
before a queued destroy or another sandbox operation can start.
an unprovable rename result changes the sandbox to
RecoveryRequiredandretains the operation record. Destroy or startup reconciliation then removes
the sandbox-owned runtime and complete checkpoint namespace; interrupted
pruning is not resumed. HTTP 200 is returned only after every tombstone made
by the request is removed and the checkpoint namespace is synchronized;
another prune request in
RecoveryRequiredreturns HTTP 409 without changingthe catalog.
failure behavior, and rollback boundary in the English and Chinese Blaze
README, runtime guide, and lifecycle design document.
No
/v1/instancescompatibility route is added.Related issue
Refs #2469. This PR delivers the usable pruning endpoint and fail-closed
recovery boundary. The broader issue remains open because retrying or resuming
an interrupted prune is not implemented here.
User / Agent impact
Operators and agents can reclaim storage held by unreachable checkpoint
branches without destroying a running sandbox. The new route is user-visible;
the current and explicitly protected histories remain available after a
successful request.
Risk and compatibility
The change adds one destructive HTTP operation over daemon-owned checkpoint
directories. Existing checkpoint catalogs remain readable, and no new record
is written until prune is called. Directory identity checks, no-replace rename,
and sandbox-scoped descriptors prevent the operation from replacing or walking
outside the owned checkpoint tree.
The persisted lifecycle format gains the
pruneoperation value. An olderbinary must not be started while a prune operation or
.prune.*temporarydirectory remains.
Validation
Exact submitted head:
36b8d14f50fdaecd25fb60f6618cf8af59395cd1..github/commitlint.config.json: passed with 0 errors and 0 warnings.git diff --check upstream/main..HEAD: passed.the complete Blaze workspace test job: passed.
addressed and reported no issue requiring modification.
non-object and malformed request bodies, empty and repeated protected lists,
recovering-state rejection, successful pruning, interruption, and client
cancellation.
checks, and the all-feature warning-free Rust documentation build passed
locally on the exact submitted head.
Focused coverage included in this PR exercises successful removal through the
HTTP route, preservation of current and protected history, request validation,
state rejection, nested version-2 payload removal, operation-record recovery,
interruption after the atomic rename, and client cancellation while deletion is
blocked. The cancellation test verifies that destroy waits for the detached
prune supervisor and that both operations converge in order.
Documentation and rollback
The English and Chinese Blaze README, runtime guide, and lifecycle design
document describe the public API and its failure behavior. The changelog is not
changed because repository policy records daily features in the release version
bump PR.
Before rolling back, stop Blaze and confirm that no sandbox has an active
pruneoperation and no checkpoint namespace contains a.prune.*temporarydirectory. Then revert the feature commit and restart the previous binary.