Repository navigation
Tracer: export a complete Profile and restore as new with explicit activation #886
Description
Parent
Profile Portability implementation #882; accepted design #76 / PR #881.
What to build
Human uses Bot mode Settings to export the complete Profile to one verified .botharness-backup file, imports it into a new stopped destination Profile, inspects restored cold history/readiness, explicitly repairs the target-local core model authorization, activates one Bot into a fresh Orchestrator Session and receives a real model reply under the preserved identity.
Acceptance criteria
- Export includes the full coherent database snapshot, every retained managed Soul/Memory file (including repositories stored outside default layout and retained repositories of deleted identities, with intentionally erased repositories distinguished from missing required data), current referenced attachment files/identity bindings and still-reachable legacy CAS closure, format/schema/non-secret runtime dependencies, hashes and canonical Purge Ledger checkpoint. Include all reusable templates and independent Bot Model Plans, not a model-only substitute.
- Preview names sensitive core message/Source Event content, account descriptors, grants/triggers, Outbox/audit records, count/estimated size and actual final size. Credentials, executable Plugins and Workspace content stay excluded; unsupported Session history is explicitly disclosed and historical ownership survives as unavailable references.
- A short owner-controlled Backup Barrier fixes the database/file/CAS versions without cancelling active Turns; capture mutable files consistently or fail, release the barrier and retain existing output. Disk-space preflight, no existing-file overwrite, staging verification and atomic publication precede success.
- Staged bounded restore rejects unsafe paths/links, invalid manifests/hashes, missing required files, failed database integrity or unsupported newer schema. Perform supported forward migrations only in staging; no partial core activation or live-file copy.
- Use a trusted local stopped-Profile control path with the existing Writer Lease; verify the actual pinned DSH handoff. Live Settings cannot replace its own running Profile or authorize arbitrary filesystem writes.
- New-destination restore enforces the package purge checkpoint and discloses that older offline backups cannot know later deletions. Do not invent an empty checkpoint that conceals missing purge authority or implement 设计：PersonaBot / Channel 破坏性删除与 Purge 依赖契约 #138's unresolved destructive lifecycle here.
- Restoration preserves Bot IDs and data but not permission to run a second holder. Ordinary backup recovery follows acknowledged Disaster Restore safeguards: Providers/bound Triggers/Service Grants suspended, target Workspaces unavailable until explicit mapping, no automatic historical Session or Outbox replay, no automatic Browser/Computer authorization expansion.
- Core readiness/model repair is explicit and no route silently falls back. Human activation creates a fresh Orchestrator Session; failures or dependency drift gate new affected requests and produce bounded developer diagnostics.
- Human can operate the real export→file→new destination→repair→activation→reply path. Provide actual DSH screenshots/recording, cold-restart and damaged-file/space/cancellation/lease failure evidence and focused tests through owning module interfaces; all required checks pass.
Blocked by
- Tracer: persist reusable Model Presets in the Profile database #883 — Model Preset SQLite ownership.
- Tracer: persist PersonaBot registry and applied model plans in SQLite #884 — Registry SQLite ownership.
- Tracer: migrate roster arrangement to its SQLite owner #885 — Roster SQLite ownership.
- 设计：PersonaBot / Channel 破坏性删除与 Purge 依赖契约 #138 — accepted deletion/Purge contract (ADR-0130 / PR Define explicit Memory erasure and history-preserving deletion #898 pending Human QA).
- Tracer: delete a PersonaBot with explicit optional Memory erasure #896 — deleted-identity history and retained Memory locators, including custom repositories.
- Tracer: purge Channel content with a durable restore-safe ledger #897 — production Purge Ledger, checkpoint, monotonic union and apply-before-Messaging contract. Design acceptance alone does not satisfy these runtime prerequisites.
Non-goals
Optional portable Session adapter, existing-target replacement, verified planned transfer, full repair breadth and public PersonaBot sharing are later slices. This ticket must still deliver a complete core and an honestly suspended/explicitly authorized recovery posture, not a partial-file demo. #505's independent sharing acceptance remains separate.
Activity
feat: ended Group text purge with a durable ledger (#1182)
DoodleBears commentedon Oct 8, 2026
Orchestration readiness check — 2026-10-08
Task:
codex/local/01a119e5-5192-7832-a281-213e81f6118c; triage only, not an implementation claim.All six native prerequisites are now closed: #883, #884, #885, #138, #896 and #897. #897 completion was merged in PR #1190 as
92965cf1699a7b034b35286b40f1d64db1da2dec; its completed outcome records Human-authorized merge, final Linux verification (3,294 passed / nine skipped) and real Generation 70 Profile QA.#886 is now the recommended next v1.1 implementation frontier. At this check it has no claim comment or active-agent label, and no matching open implementation PR was found. Recheck claims immediately before starting; do not treat this recommendation as a reservation.
Keep the complete-core contract: verified export -> new stopped destination -> explicit model repair/activation -> real reply, using the production purge checkpoint/union and no partial-file or model-only substitute. #505 remains blocked by this issue and should be verified against the resulting backup/restore path, not implemented as a separate package ahead of it.
DoodleBears commentedon Oct 8, 2026
Agent work claim
codex/local/01a11b43-e3b9-79b2-a5d5-bf23b485909b(not a DSH Session)codex/886-profile-backupPreflight rechecked all six prerequisites CLOSED, no implementation claim or matching open PR. Branch starts at latest origin/main
92965cf1. Accepted #76 / #882 / PR #881 govern scope. Delivery stops at a reviewable PR and Human QA; no merge or release authorization.fix(portability): reject unsupported required backup contracts
DoodleBears commentedon Oct 8, 2026
Agent work outcome — handed off for Human QA
codex/local/01a11b43-e3b9-79b2-a5d5-bf23b485909b(not a DSH Session)codex/886-profile-backupReal pinned DSH acceptance passed on the integrated Generation 72 build: source real reply → actual Host backup → shipped CLI restore into a new stopped destination → source stopped → target authorization/activation → real same-identity reply → cold restart → second real reply. The preserved synthetic Bot replied with its original name and Soul phrase. The final package contains 40 files / 42,190 compressed bytes. No credentials or native executable configuration were imported.
Validation: 105 related owner/backup/packaging tests passed together; the final contract rejection change passed all eight backup tests, and the main-integration onboarding correction passed all seven onboarding tests. Lint, formatting, typecheck, product build, release ledgers and docs build passed locally. Final Linux full verification and exact package preparation/dry run both passed on
c8254682. The first Linux run found one stale onboarding schema-generation expectation; it was corrected to the current schema target without weakening the defaults/purge assertions.Remaining Human QA: operate final Settings preview/download/file inspection and localized readiness/activation, capture matched baseline/final Settings screenshots plus English/Chinese states, and review error/retry/cancellation. Actual initial source/cold-target captures are embedded in the PR and their limits are documented; browser control disconnected before the remaining captures. Windows full-suite failures/stalls are documented separately and are not represented as a green local full-suite run.
Implementation and evidence: verification report. Delivery stops at this draft PR and Human QA. No merge or release was performed or authorized.
feat(portability): back up full Profiles and restore cold identities (#…
DoodleBears commentedon Oct 8, 2026
Agent work outcome — merged with Human authorization
codex/local/01a11b43-e3b9-79b2-a5d5-bf23b485909ba7b9773e.The remaining final Settings/localized readiness screenshots and manual interaction checks remain documented in the PR and verification report; this merge does not claim those captures were completed. No release was performed. Continuing with #505's model preservation acceptance against the complete-core path.