Prepare one Codespace for generated apps - #12
Merged
Conversation
Reuse the generated Rails Dev Container runtime so direct output can be developed without opening a second Codespace. Initialize downloaded applications as nested repositories so their Git-sensitive checks cannot resolve to the Drawing Board worktree.
Ignore ambient Git normalization, exclude, hook, and signing configuration while recording the downloaded Foundation. This keeps the parentless nested repository faithful to the emitted bytes and modes.
Force-stage the exact materialized files and verify their paths, bytes, and executable modes against the parentless application commit. Exercise the handoff hermetically in every Drawing Board contract run and reject parent-repository leakage before Rails setup.
Reject ignored local state instead of sweeping it into the generated application's first commit. Admit only the submitted Plan and GapSet through ignore rules, then verify the exact staged bytes and modes before installing the nested repository. Make the smoke ordering and Git-environment boundary executable so Rails setup cannot precede repository validation or mutate an ambient repository.
Keep canonical generated modes fail-closed while directing the user to a fresh compile instead of local mode repair. Exercise the rejection against a preserved 0664 file. Name the pinned Ruby requirement before the local contract harness can fail with a raw process error.
Set every fixture file to its declared mode and exercise creation under a restrictive umask. This keeps local contract failures attributable to the generated application rather than the test caller.
Keep the accepted cross-repository delivery order, ambiguity boundary, and later root-output contract beside the Drawing Board implementation that starts the shared-workspace path.
Protect credential and CLI state during the deferred root relocation, record the real cross-repository couplings, and make the non-prebuilt qualification exercise the owned smoke boundary.
Keep the future root-output packet arbitrary-repository-safe by inventorying existing Git state, preserving every exclusion, and assigning rollback ownership before implementation.
The later root transaction must validate the complete generated artifact outside the working root before changing existing paths or Git metadata.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Exact candidate
Exact-head proof
Pinned Node 24.18.0 / Ruby 4.0.5 script/check passed, including the generated-application initializer contract. The contract proves that env files, private keys, dependency/setup output, extra .firstdraft files, and symlinks stop initialization without being deleted; only the submitted Plan and GapSet may bypass generated ignore rules. It also proves that hostile ambient Git repository, worktree, index, object-store, common-directory, namespace, signing, normalization, and file-mode inputs do not alter either repository.
Two representative 168-file generated trees were initialized into clean parentless main commits under the host and pinned Node toolchains. Both retained exact tree 2ef65a1d529d707cd4630f0eaf999c556a0db519 and exactly the two required .firstdraft files.
Hosted CI run 33195608007 is green on the exact head: https://github.com/firstdraft/drawing-board/actions/runs/33195608007. Its real Dev Container job ran script/check and script/devcontainer-smoke; the initializer contract, wrapper checks, agent/container installation, and application-smoke precondition all passed. No generated application was present in that hosted checkout, so the hosted run does not claim a generated Rails runtime loop.
The predecessor candidate observed a representative generated Foundation setup, PostgreSQL readiness, and complete generated bin/ci. This amendment preserves generated bytes but narrows the first-commit boundary; the exact-head proof above is the current initialization and container evidence.
The CLI download command, design-file relocation, direct-output activation, GitHub publication, package/release work, and Service deployment remain outside this PR.
Review
Conversation-aware author review found no material issue and classified the provenance/security boundary as requiring independent adversarial review. The initial independent review produced this exact safety amendment; same-session delta closure is pending. No merge, package publication, deployment, or prebuild action is included.