Skip to content

Commit e59fea8

Browse files
ragnorcaaltshuler
authored andcommitted
docs: self-service upgrade message + gated cross-version test (on-demand)
The storage-format refusal now names the release line that wrote each internal-schema stamp (e.g. v3 -> 0.6.2-0.7.2) plus the exact export/init/load commands — fail-closed but self-service; the message is engine-shared so server boot-quarantine and cluster status get it free. Adds the OMNIGRAPH_OLD_BIN-gated cross-version test: mint a GENUINE v3 graph with a real omnigraph-cli 0.7.2 binary, assert the current binary refuses it with the release-named message, and the documented rebuild round-trips. Deliberately NOT wired into CI (the write_cost_s3 disposition): compiling 0.7.2 from source is a 15-25 min job and the stamp seam changes a few times a year — testing.md documents the on-demand invocation instead. Rebased onto current main across the Lance 9.0.0-beta.15 migration; validated locally against a genuine 0.7.2 binary — the v3 round-trip passes on the Lance-9 main, which also makes it a live cross-substrate read-compat check (a Lance-9 binary reading a Lance-7-written manifest to find the stamp).
1 parent 50db10f commit e59fea8

9 files changed

Lines changed: 1501 additions & 11 deletions

File tree

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
//! Cross-version upgrade: prove the CURRENT binary handles a GENUINE old-format
2+
//! (internal schema v3) graph minted by omnigraph 0.7.2 — not a v4-shaped graph
3+
//! with a rewound stamp. Two things the stamp-rewind stand-in
4+
//! (`sub_current_graph_is_refused_then_rebuilt_via_export_import`) cannot prove:
5+
//!
6+
//! 1. the open-refusal fires on the REAL on-disk v3 shape (lineage in
7+
//! `_graph_commits.lance`, lineage-free `__manifest`) and NAMES the writing
8+
//! release, and
9+
//! 2. the documented `export → init → load` rebuild round-trips the data,
10+
//! including a `Vector` column, off a genuine v3 export.
11+
//!
12+
//! Gated: requires `OMNIGRAPH_OLD_BIN` (an absolute path to a 0.7.2 `omnigraph`
13+
//! binary). Skips gracefully when unset — the same convention as the S3 and
14+
//! system-e2e gates — so the default `cargo test --workspace` stays green
15+
//! without it. CI sets it in the `crossversion_upgrade` job (see
16+
//! `docs/dev/testing.md`).
17+
18+
mod support;
19+
20+
use std::path::{Path, PathBuf};
21+
use std::process::Command;
22+
23+
use support::{HERMETIC_OPERATOR_HOME, cli, fixture, output_failure, output_success};
24+
use tempfile::tempdir;
25+
26+
/// Resolve the old (0.7.2) binary. `None` ONLY when `OMNIGRAPH_OLD_BIN` is
27+
/// unset — the legitimate skip. A var that is SET but points at a missing path
28+
/// is a misconfiguration (wrong install path / renamed binary) and must fail
29+
/// loudly, never skip vacuously: in CI the var is deliberately set so the test
30+
/// is expected to run.
31+
fn old_bin() -> Option<PathBuf> {
32+
let path = PathBuf::from(std::env::var_os("OMNIGRAPH_OLD_BIN")?);
33+
assert!(
34+
path.exists(),
35+
"OMNIGRAPH_OLD_BIN is set but does not exist: {} \
36+
(unset it to skip, or point it at a real 0.7.2 omnigraph binary)",
37+
path.display(),
38+
);
39+
Some(path)
40+
}
41+
42+
/// Run the OLD (0.7.2) binary hermetically (no developer `~/.omnigraph`).
43+
fn run_old(bin: &Path, args: &[&str]) -> std::process::Output {
44+
Command::new(bin)
45+
.env("OMNIGRAPH_HOME", HERMETIC_OPERATOR_HOME)
46+
.env_remove("OMNIGRAPH_CONFIG")
47+
.args(args)
48+
.output()
49+
.expect("spawn old omnigraph binary")
50+
}
51+
52+
fn assert_ok(label: &str, out: &std::process::Output) {
53+
assert!(
54+
out.status.success(),
55+
"old binary `{label}` failed\nstdout:\n{}\nstderr:\n{}",
56+
String::from_utf8_lossy(&out.stdout),
57+
String::from_utf8_lossy(&out.stderr),
58+
);
59+
}
60+
61+
fn nonblank_lines(bytes: &[u8]) -> usize {
62+
String::from_utf8_lossy(bytes)
63+
.lines()
64+
.filter(|l| !l.trim().is_empty())
65+
.count()
66+
}
67+
68+
#[test]
69+
fn current_binary_refuses_and_rebuilds_a_genuine_v3_graph() {
70+
let Some(old) = old_bin() else {
71+
eprintln!(
72+
"skipping cross-version upgrade test: OMNIGRAPH_OLD_BIN is not set to a 0.7.2 binary"
73+
);
74+
return;
75+
};
76+
77+
let temp = tempdir().unwrap();
78+
let old_graph = temp.path().join("old-v3.omni");
79+
// `search.pg` / `search.jsonl` are byte-identical in v0.7.2 and exercise a
80+
// `Vector(4)` column plus indexed strings — a fixture both binaries parse.
81+
let schema = fixture("search.pg");
82+
let data = fixture("search.jsonl");
83+
let og = old_graph.to_str().unwrap();
84+
85+
// 1. Mint a GENUINE v3 graph with the old binary.
86+
assert_ok(
87+
"init",
88+
&run_old(&old, &["init", "--schema", schema.to_str().unwrap(), og]),
89+
);
90+
assert_ok(
91+
"load",
92+
&run_old(
93+
&old,
94+
&["load", "--mode", "overwrite", "--data", data.to_str().unwrap(), og],
95+
),
96+
);
97+
98+
// Prove it is really v3 on disk: pre-v4 graphs carry the now-retired
99+
// `_graph_commits.lance` lineage dataset (a v4 graph has neither).
100+
assert!(
101+
old_graph.join("_graph_commits.lance").exists(),
102+
"a genuine v3 graph must have the legacy _graph_commits.lance dataset",
103+
);
104+
105+
// 2. Old binary export → JSONL.
106+
let export = run_old(&old, &["export", og]);
107+
assert_ok("export", &export);
108+
assert!(!export.stdout.is_empty(), "old export produced no rows");
109+
let v3_jsonl = temp.path().join("v3.jsonl");
110+
std::fs::write(&v3_jsonl, &export.stdout).unwrap();
111+
112+
// 3. The CURRENT binary refuses the genuine v3 graph, names the writing
113+
// release, and nudges to export — on the real on-disk shape.
114+
let refusal = output_failure(cli().arg("snapshot").arg(&old_graph));
115+
let stderr = String::from_utf8_lossy(&refusal.stderr);
116+
assert!(
117+
stderr.contains("export"),
118+
"refusal must nudge the operator to export, got: {stderr}",
119+
);
120+
assert!(
121+
stderr.contains("0.6.2 to 0.7.2"),
122+
"refusal must name the full release range that wrote this stamp (v3 → 0.6.2 to 0.7.2), \
123+
got: {stderr}",
124+
);
125+
126+
// 4. The CURRENT binary rebuilds: fresh init + load the v3 export.
127+
let new_graph = temp.path().join("new-v4.omni");
128+
output_success(cli().arg("init").arg("--schema").arg(&schema).arg(&new_graph));
129+
output_success(
130+
cli()
131+
.arg("load")
132+
.arg("--mode")
133+
.arg("overwrite")
134+
.arg("--data")
135+
.arg(&v3_jsonl)
136+
.arg(&new_graph),
137+
);
138+
139+
// 5. Round-trip fidelity: re-export with the current binary and compare.
140+
let reexport = output_success(cli().arg("export").arg(&new_graph));
141+
assert_eq!(
142+
nonblank_lines(&export.stdout),
143+
nonblank_lines(&reexport.stdout),
144+
"row count must round-trip v3 → v4",
145+
);
146+
let rebuilt = String::from_utf8_lossy(&reexport.stdout);
147+
assert!(
148+
rebuilt.contains("embedding"),
149+
"the Vector column must survive the rebuild, got: {rebuilt}",
150+
);
151+
assert!(
152+
rebuilt.contains("ml-intro"),
153+
"the rebuilt graph must preserve node data, got: {rebuilt}",
154+
);
155+
}

crates/omnigraph/src/db/manifest/migrations.rs

Lines changed: 44 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,26 @@ pub(crate) const INTERNAL_MANIFEST_SCHEMA_VERSION: u32 = 4;
7070
/// module doc).
7171
pub(crate) const MIN_SUPPORTED_INTERNAL_SCHEMA_VERSION: u32 = INTERNAL_MANIFEST_SCHEMA_VERSION;
7272

73+
/// The omnigraph release line that wrote a given internal-schema stamp. The
74+
/// open-refusal uses it to tell an operator exactly which binary to use to
75+
/// export a sub-CURRENT graph (the export side of the strand-model upgrade —
76+
/// see `docs/user/operations/upgrade.md`). Ranges are the release tags that
77+
/// stamped each version (verify with
78+
/// `git show vX.Y.Z:crates/omnigraph/src/db/manifest/migrations.rs`):
79+
/// v1 ≤ 0.3.1, v2 0.4.1–0.6.1, v3 0.6.2–0.7.2, v4 0.8.x.
80+
pub(crate) fn release_for_internal_schema_version(stamp: u32) -> &'static str {
81+
match stamp {
82+
1 => "0.3.1 or earlier",
83+
2 => "0.4.1 to 0.6.1",
84+
3 => "0.6.2 to 0.7.2",
85+
4 => "0.8.x",
86+
// Unreachable today (1–3 are mapped; ≥ CURRENT is caught by the ceiling
87+
// guard before this is consulted). Worded to read naturally after
88+
// "created by omnigraph " if a future bump ever leaves a gap.
89+
_ => "an unrecognized older release",
90+
}
91+
}
92+
7393
const INTERNAL_SCHEMA_VERSION_KEY: &str = "omnigraph:internal_schema_version";
7494

7595
/// Read the on-disk stamp from `__manifest`'s schema-level metadata.
@@ -109,10 +129,14 @@ pub(crate) fn refuse_if_stamp_unsupported(stamp: u32) -> Result<()> {
109129
if stamp < MIN_SUPPORTED_INTERNAL_SCHEMA_VERSION {
110130
return Err(OmniError::manifest(format!(
111131
"__manifest is stamped at internal schema v{stamp}, but this omnigraph reads only v{current}. \
112-
This graph was created by an older omnigraph release; rebuild it: run `omnigraph export` with \
113-
the older omnigraph binary that created it, then `omnigraph init` + `omnigraph load` with this one. \
114-
(Data, vectors, and blobs are preserved; commit history and branches are not.)",
132+
This graph was created by omnigraph {release}. Rebuild it: with an omnigraph {release} binary run \
133+
`omnigraph export <graph> > graph.jsonl`, then with this binary run \
134+
`omnigraph init --schema <schema.pg> <new-graph>` and \
135+
`omnigraph load --mode overwrite --data graph.jsonl <new-graph>`. \
136+
(Data, vectors, and blobs are preserved; commit history and branches are not.) \
137+
See docs/user/operations/upgrade.md.",
115138
current = INTERNAL_MANIFEST_SCHEMA_VERSION,
139+
release = release_for_internal_schema_version(stamp),
116140
)));
117141
}
118142
Ok(())
@@ -160,4 +184,21 @@ mod tests {
160184
"a future stamp must be refused"
161185
);
162186
}
187+
188+
/// The refusal names the release line that wrote each stamp so an operator
189+
/// knows which binary to use for the export step; unknown stamps fall back
190+
/// without panicking.
191+
#[test]
192+
fn release_names_the_writing_line_for_each_stamp() {
193+
assert_eq!(release_for_internal_schema_version(3), "0.6.2 to 0.7.2");
194+
assert_eq!(release_for_internal_schema_version(4), "0.8.x");
195+
assert_eq!(
196+
release_for_internal_schema_version(99),
197+
"an unrecognized older release"
198+
);
199+
// The sub-CURRENT refusal embeds the named release.
200+
let err = refuse_if_stamp_unsupported(3).unwrap_err().to_string();
201+
assert!(err.contains("0.6.2 to 0.7.2"), "got: {err}");
202+
assert!(err.contains("omnigraph export"), "got: {err}");
203+
}
163204
}

crates/omnigraph/src/db/manifest/tests.rs

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1826,10 +1826,16 @@ async fn sub_current_graph_is_refused_then_rebuilt_via_export_import() {
18261826
Ok(_) => panic!("a sub-CURRENT graph must be refused on open"),
18271827
Err(err) => err,
18281828
};
1829+
let msg = err.to_string();
18291830
assert!(
1830-
err.to_string().contains("export"),
1831+
msg.contains("export"),
18311832
"the refusal must nudge the operator to `omnigraph export`, got: {err}",
18321833
);
1834+
assert!(
1835+
msg.contains("0.7.2"),
1836+
"the refusal must name the release that wrote this stamp (v3 → 0.6.2 to 0.7.2) so the \
1837+
operator knows which binary to use, got: {err}",
1838+
);
18331839

18341840
// Rebuild with this binary: fresh init + load the export.
18351841
let dir_new = tempfile::tempdir().unwrap();

docs/dev/testing.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ This file is the always-on map of the test surface. **Consult it before every ta
77
| Crate | Path | Style |
88
|---|---|---|
99
| `omnigraph` (engine) | `crates/omnigraph/tests/` | Integration tests (36 files), fixture-driven, share `tests/helpers/mod.rs` |
10-
| `omnigraph-cli` | `crates/omnigraph-cli/tests/` | Per-area suites (post-modularization): `cli_cluster.rs` (cluster command surface + operator-actor cascade), `cli_cluster_e2e.rs` (spawned-binary lifecycle compositions — lost-state re-import recovery, out-of-band drift, graph-root destruction, multi-graph mixed-disposition convergence), `cli_data.rs` (load/read/change/branch/commit/export/snapshot/policy/embed/maintenance + operator format cascade), `cli_schema_config.rs` (init/config, schema plan/apply), `cli_queries.rs`, `parity_matrix.rs` (RFC-009 Phase 1: the embedded-vs-remote referee — every forked verb run against both arms with matched Cedar policy and the same actor, scrubbed-JSON + exit-code equality; divergences are pinned in its `KNOWN_DIVERGENCES` ledger, never silently repaired), `system_local.rs` (full-cycle cluster lifecycle with a spawned `--cluster` server, applied-policy enforcement over HTTP, keyed-credential auth, operator aliases), `system_remote.rs`; share `tests/support/mod.rs` (hermetic `OMNIGRAPH_HOME` by default) |
10+
| `omnigraph-cli` | `crates/omnigraph-cli/tests/` | Per-area suites (post-modularization): `cli_cluster.rs` (cluster command surface + operator-actor cascade), `cli_cluster_e2e.rs` (spawned-binary lifecycle compositions — lost-state re-import recovery, out-of-band drift, graph-root destruction, multi-graph mixed-disposition convergence), `cli_data.rs` (load/read/change/branch/commit/export/snapshot/policy/embed/maintenance + operator format cascade), `cli_schema_config.rs` (init/config, schema plan/apply), `cli_queries.rs`, `parity_matrix.rs` (RFC-009 Phase 1: the embedded-vs-remote referee — every forked verb run against both arms with matched Cedar policy and the same actor, scrubbed-JSON + exit-code equality; divergences are pinned in its `KNOWN_DIVERGENCES` ledger, never silently repaired), `system_local.rs` (full-cycle cluster lifecycle with a spawned `--cluster` server, applied-policy enforcement over HTTP, keyed-credential auth, operator aliases), `system_remote.rs`, `crossversion_upgrade.rs` (gated genuine-v3 upgrade round-trip — see "Cross-version upgrade" below); share `tests/support/mod.rs` (hermetic `OMNIGRAPH_HOME` by default) |
1111
| `omnigraph-cluster` | mostly in-source `#[cfg(test)] mod tests`; `tests/failpoints.rs` (feature-gated); `tests/s3_cluster.rs` (bucket-gated full lifecycle on object storage) | Cluster config parser, local JSON state diff, state CAS/lock handling/recovery, read-only validate/plan/status plus explicit refresh/import graph observations, config-only apply (content-addressed payload publish, disposition gating, composite-digest convergence, idempotent re-apply), catalog payload verification (status read-only, refresh drift + self-heal), failpoint crash-mid-apply / CAS-race coverage, Stage 4A graph creation (create executor, recovery sidecars + sweep rows, create crash windows), Stage 4B schema apply (migration previews in plan, schema executor, schema-apply sweep classification, schema crash windows), Stage 4C gated deletes (digest-bound approvals, delete executor + tombstones, delete sweep rows, delete crash windows), and 5A policy binding metadata (applies_to in the applied revision, binding-change diffing + convergence, pre-5A backfill), and the 5B serving-snapshot read API (converged read, refusal rows) |
1212
| `omnigraph-server` | `crates/omnigraph-server/tests/` | Per-area suites (post-modularization): `auth_policy.rs`, `data_routes.rs`, `schema_routes.rs`, `stored_queries.rs`, `multi_graph.rs` (cluster-mode boot — converged serving, policy binding wiring, boot refusals — + the concurrent branch-ops matrix), `boot_settings.rs` (mode inference, PolicySource), `s3.rs` (bucket-gated: single-graph serving + config-free `--cluster s3://` boot), `openapi.rs` (OpenAPI drift / regeneration); share `tests/support/mod.rs` |
1313
| `omnigraph-compiler` | mostly in-source `#[cfg(test)] mod tests` | Parser, type-checker, IR lowering, lint |
@@ -90,6 +90,10 @@ CI runs these S3-backed **correctness** tests against a containerized RustFS ser
9090

9191
Locally, set `OMNIGRAPH_S3_TEST_BUCKET` (and the usual `AWS_*` vars including `AWS_ENDPOINT_URL_S3` for non-AWS) before running. Without those, S3 tests skip gracefully.
9292

93+
## Cross-version upgrade (genuine v3 → current)
94+
95+
`crates/omnigraph-cli/tests/crossversion_upgrade.rs` is the empirical proof that the strict-single-version refusal works on a **real** old-format graph — not the stamp-rewind stand-in in `db/manifest/tests.rs::sub_current_graph_is_refused_then_rebuilt_via_export_import` (which only rewinds the stamp number on a v4-shaped graph). It mints a genuine internal-schema-v3 graph with an omnigraph **0.7.2** binary (real `_graph_commits.lance`, lineage-free `__manifest`), then asserts the current binary refuses it with the release-named message and that the documented `export → init → load` rebuild round-trips (row count + the `Vector` column). It is **gated on `OMNIGRAPH_OLD_BIN`** (an absolute path to a 0.7.2 `omnigraph`) and skips gracefully when unset, so the default `cargo test --workspace` stays green without it. **Deliberately NOT in CI** (same disposition as `write_cost_s3`): compiling 0.7.2 from source is a 15–25 min job, and the format-stamp seam changes a few times a year — run it on demand when touching `migrations.rs`, the loader/export surfaces, or at a release boundary. To run: `cargo install omnigraph-cli@0.7.2 --locked --root /tmp/og-old` then `OMNIGRAPH_OLD_BIN=/tmp/og-old/bin/omnigraph cargo test -p omnigraph-cli --test crossversion_upgrade`.
96+
9397
## System e2e requirements and suppression
9498

9599
The CLI system tests (`system_local.rs`) spawn the workspace-built `omnigraph` and `omnigraph-server` binaries (cargo provides paths via `CARGO_BIN_EXE_*`), bind ephemeral localhost ports, and use local-FS temp dirs — no external services, no env vars required; they run in the default `cargo test --workspace`. The comprehensive cluster lifecycle e2es (multi-server-restart flows) honor an opt-out for constrained sandboxes: set `OMNIGRAPH_SKIP_SYSTEM_E2E=1` to skip them with a logged message (the same graceful-skip pattern as the S3 gate). Cargo-native filtering also works: `cargo test --test system_local -- --skip local_cluster`.

docs/dev/versioning.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,11 @@ it cannot serve:
2727
- a stamp **above** CURRENT → refused with "upgrade omnigraph", so an old binary
2828
cannot silently misread a newer format.
2929

30+
The below-CURRENT refusal names the release line that wrote the stamp
31+
(`release_for_internal_schema_version` in `db/manifest/migrations.rs`) and prints
32+
the exact `export` / `init` / `load` commands, so the upgrade is fail-closed **and**
33+
self-service — the operator can fetch the right old binary without guessing.
34+
3035
There is no in-place migration dispatcher. The single source file
3136
`db/manifest/migrations.rs` holds only the version constant, the stamp read/write,
3237
and `refuse_if_stamp_unsupported`.

0 commit comments

Comments
 (0)