feat(engine): Neon branch-per-attempt disposable DB fork for AMS attempts#8205
Merged
Conversation
…mpts Adds createAttemptDbFork/discardAttemptDbFork (packages/loopover-engine/src/ miner/attempt-db-fork.ts), mirroring worktree-pool.ts's per-attempt code- checkout isolation one level deeper: each attempt gets its own Neon branch forked off the operator's already-provisioned tenant branch, discarded on attempt conclusion, never merged back into the parent. Self-host scope only, per #7858's ratified scope note -- a bare containerized Node.js process connects to the forked branch over the plain Postgres wire protocol, no Cloudflare Hyperdrive binding used or required (Hyperdrive is an optional, Workers-runtime-specific pooling layer; Neon branches are independently connectable regardless). The hosted path has its own separate, unrelated blocker (#8202) before any DB credential can reach a running hosted container at all. Standalone module only in this PR -- inert and unreachable until wired into attempt-cli.ts's live runAttempt pipeline, which is deliberately left as a small, separately-reviewable follow-up given how production-critical that 700-line function already is.
4 tasks
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
loopover-ui | ad40c4c | Commit Preview URL Branch Preview URL |
Jul 23 2026, 12:12 PM |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8205 +/- ##
=======================================
Coverage 92.09% 92.09%
=======================================
Files 774 775 +1
Lines 78209 78275 +66
Branches 23637 23654 +17
=======================================
+ Hits 72028 72090 +62
Misses 5062 5062
- Partials 1119 1123 +4
Flags with carried forward coverage won't be shown. Click here to find out more.
|
6 tasks
JSONbored
added a commit
that referenced
this pull request
Jul 23, 2026
…#8206) * feat(miner): wire the Neon branch-per-attempt DB fork into runAttempt Completes #7858's self-host scope: createAttemptDbFork/discardAttemptDbFork (#8205) are now called from runAttempt's real lifecycle, mirroring the worktree allocator's own acquire/finally-release shape exactly. Config-gated via LOOPOVER_MINER_NEON_API_KEY/_PROJECT_ID/_PARENT_BRANCH_ID (attempt-db-fork-config.ts) -- an operator who hasn't configured all three sees zero behavior change, proven by running the existing 84-test miner-attempt-cli.test.ts suite unmodified alongside the new tests. Fork creation failure aborts the attempt rather than proceeding without isolation, since this feature exists specifically so the coding agent's writes never reach the tenant's real database -- silently continuing on a fork failure would defeat that safety property. Discard failure is captured to Sentry but never blocks the rest of cleanup (same discipline this file already applies to its kill-switch ledger append). Boundary explicitly not crossed here: the resulting connection string is not threaded into the coding agent's own subprocess environment (CODING_AGENT_ENV_ALLOWLIST in cli-subprocess-driver.ts). That's a separate, security-relevant interface change to the driver/spawn layer -- widening what reaches the untrusted, attacker-content-processing subprocess -- and deserves its own focused review rather than a bolt-on here. * fix(docs): document the Neon fork env vars in miner DEPLOYMENT.md npm run test:miner-deployment-docs-audit failed CI: LOOPOVER_MINER_NEON_API_KEY/ _PROJECT_ID/_PARENT_BRANCH_ID (attempt-db-fork-config.ts) were read but undocumented.
This was referenced Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of #7858. Adds
createAttemptDbFork/discardAttemptDbFork(packages/loopover-engine/src/miner/attempt-db-fork.ts), mirroringworktree-pool.ts's per-attempt code-checkout isolation one level deeper: each attempt gets its own Neon branch forked off the operator's already-provisioned tenant branch, discarded on attempt conclusion, never merged back into the parent (a hard requirement #7649 ratified explicitly, not a default that happens to be convenient here).Self-host scope only, per #7858's own scope note. A bare containerized Node.js process connects to the forked branch over the plain Postgres wire protocol — no Cloudflare Hyperdrive binding used or required. Investigated this directly: Hyperdrive is an optional, Workers-runtime-specific connection-pooling layer; Neon branches are independently connectable via a standard
postgres://string regardless of whether one exists (confirmed against Neon's own docs). The hosted path has its own separate, unrelated blocker (#8202 — no mechanism exists yet to deliver any secret into a running hosted container) before this could reach a hostedAmsTenantContainerat all.Standalone module only in this PR — inert and unreachable until wired into
attempt-cli.ts's liverunAttemptpipeline. Deliberately left as a small, separately-reviewable follow-up given how production-critical that ~700-line function already is (it's the real, live coding-agent execution path — "the first point in this epic where a real coding agent actually runs," per its own header comment). This PR carries zero behavior risk to any existing path since nothing calls the new module yet.Mirrors
control-plane/src/neon-database-driver.ts's already-reviewed Neon API conventions (auth, operation polling, branch-name collision-guard) rather than reinventing them. Same honesty caveat that file states applies here: no live Neon account/credentials exist anywhere in this repo, so this is verified against Neon's own documented API shape and a strict mocked-fetchtest suite, not a live integration test.Scope note on the deliverables' isolation claims: "two concurrent attempts don't see each other's writes" and "a destructive query never reaches the primary" are Neon's own platform guarantees for branch isolation, not something this module's code could break or verify without live infra — this PR's tests instead verify the part that is this module's responsibility: each attempt is correctly scoped to its own distinct branch, forked from the right parent, discarded at the right time.
Test plan
npm run typecheckclean (repo-wide)test/unit/attempt-db-fork.test.ts— 100% statement/branch/function/line coverage (scoped coverage run), covering fresh create, idempotent re-create, every documented error path, operation polling (including multi-poll and timeout), the real-default poll-interval fallback, and a Neon branchNameFor's 63-char truncation has no collision guard — two long, prefix-similar tenant names could resolve to the same branch #8026-style collision regression for long/prefix-similar attempt idsnpm run build --workspace @loopover/enginecleannpm run engine-parity:drift-checkclean