fix(config-profiles): synchronize shared mount working copies

Use canonical profile files and writable Git working copies so editor and container changes share one source. Require confirmation before destructive Git refreshes and overlay profile files without composite snapshots.
2026-07-22 11:23:19 +02:00
parent 0d6c1926ae
commit 2247ec47c9
14 changed files with 285 additions and 159 deletions
@@ -6,19 +6,20 @@ Git-backed Config Profile mounts are currently cloned per instance. Their conten

 ## Change

-Move Git Config Profile mounts to profile-scoped canonical host clones. Bind the already-mounted directory sources read-only into compatible instances and refresh a stable branch/ref checkout in place under a per-clone lock.
+Move Git Config Profile mounts to profile-scoped writable working copies shared by compatible instances and the profile editor. Refresh a stable branch/ref checkout in place under a per-clone lock, explicitly replacing local working-copy edits.

 ## Scope

 - Canonical clone identity: profile, normalized remote, requested ref, and credential scope.
 - In-place refresh for existing directory mounts only.
 - Explicit outcomes for live refresh, restart-required topology changes, and refresh failures.
- Read-only container Git config mounts.
+- Writable profile-scoped Git working copies shared by compatible instances and the profile editor.
+- Explicit destructive-refresh warning before local Git working-copy edits are replaced.
 - An in-progress indicator that prevents duplicate refresh requests in desktop and mobile Config Profile views.

 ## Out of scope

- Writable shared Git configuration mounts.
+- Per-instance writable Git working copies that diverge from the profile-scoped working copy.
 - Global cross-user clone sharing.
 - Live mount-topology changes, direct-file mappings, or glob match-set changes.
 - Atomic all-files revision switching for processes already reading the mount.
@@ -2,21 +2,21 @@

 ## Canonical source

-Each selected Config Profile owns canonical Git clone directories beneath:
+Each selected Config Profile owns a writable Git working copy beneath:

 ```text
 <instance-root>/config-profiles/<profile-id>/git-mounts/<identity>/repo
 ```

-`identity` is a stable hash of normalized remote URL, requested ref, and credential scope. Sources are deliberately profile-scoped; clones are never shared across users.
+`identity` is a stable hash of normalized remote URL, requested ref, and credential scope. Sources are deliberately profile-scoped; working copies are never shared across users, but are shared by compatible instances that selected the same profile.

 ## Runtime behavior

 1. Resolve Git mounts and map them to canonical sources.
 2. Acquire an exclusive lock for clone, fetch, ref resolution, and checkout.
 3. Clone into a temporary sibling, then rename on initial creation.
-4. For refresh, fetch and update the existing working tree in place.
-5. Bind directory mappings read-only. Existing containers see changed directory contents without recreation.
+4. For refresh, fetch and hard-reset the existing working tree in place, replacing local container/editor edits after an explicit warning.
+5. Bind directory mappings writable. Compatible containers and the profile editor share the same working-copy files.
 6. When profile and Git mount paths overlap, the instance-local composite source must be synchronized in place during refresh; replacing its root directory would leave a running bind mount attached to the old inode.

 ## Boundaries
@@ -24,7 +24,7 @@ Each selected Config Profile owns canonical Git clone directories beneath:
 - URL/ref/source/target/mode changes, direct-file mappings, and changed glob result sets return `restart_required`.
 - Refresh failure is reported without mutating a known-good checkout.
 - No non-Git profile content may be copied into a Git checkout; overlapping targets are rejected or reported.
- Containers must not write to shared Git mount sources.
+- A refresh warning must state that local Git working-copy edits will be replaced.
 - A browser editor that already has a file open is not a filesystem watcher; the user must reload that editor buffer after the mounted source changes.

 ## Security
@@ -1,16 +1,16 @@
 # Live Git Config Mount Refresh — Tasks

 - [x] Add canonical profile-scoped Git clone source planning and clone identity helpers.
- [x] Make Git Config Profile mounts read-only and prevent profile-content copy into Git sources.
- [x] Add lock-protected clone/fetch/ref checkout refresh that preserves a known-good checkout on failure.
- [x] Add save/refresh outcomes for live refresh, restart-required topology, and failures.
+- [x] Make Git Config Profile mounts profile-scoped writable working copies shared with compatible instances and the editor.
+- [x] Add lock-protected destructive refresh with an explicit local-edit replacement warning.
+- [x] Add save/refresh outcomes for live refresh, destructive-refresh confirmation, and failures; use file-level overlays to avoid live topology changes.
 - [x] Add an in-progress desktop/mobile indicator that disables duplicate Git-mount refresh requests.
- [ ] Synchronize affected instance-local composite mounts in place so live refresh reaches running containers.
- [ ] Add focused resolver/service/API/frontend tests.
+- [x] Replace instance-local composites with file-level canonical profile overlays, so live updates do not depend on composite synchronization.
+- [x] Add focused resolver/service/API/frontend tests.
 - [x] Run available verification and document skipped checks.

 ## Verification Notes

- Passed: frontend production build and Python compilation for changed backend modules.
- Skipped: backend pytest and Ruff are unavailable in this environment; Docker/manual live-session checks were not approved.
+- Passed: 47 targeted backend tests, Ruff, mypy, frontend API test, and frontend production build.
+- Skipped: Docker/manual multi-instance checks were explicitly declined.
 - Known tooling limitation: project-map patching fails before execution because its runtime sends an unsupported `temperature` parameter.