Repository navigation
Conversation
Retargets the upgrade from 0.12.0 to 0.13.0, which fixes the policy-membership freeze (ModernRelay/omnigraph#882). Records the data-tier operating model decisions (automatic lock handoff in the entrypoint behind a Kubernetes Lease and a live-pod check, entrypoint-only direct apply with a read-only plan gate, a stop-window maintenance CronJob, --require-all-graphs left unset) and the consumer and migration-Job changes. Claims marked verified were run against the 0.13.0 binary on local scratch clusters; the rest cite the 0.12 discovery or upstream docs and source.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The boot sequence mishandles the post-apply lock, and coordination races remain unresolved.
5 open findings
What changed in this PR
Adds the implementation specification for upgrading Witan to OmniGraph 0.13 and storage format 14.
Changes:
- Defines lock handoff, deployment, and maintenance procedures.
- Documents consumer compatibility and migration changes.
- Establishes rollout sequencing across environments.
| File | Description |
|---|---|
docs/internals/design/omnigraph-0-13-upgrade-spec.md |
Specifies the OmniGraph 0.13 cutover and operating model. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
- D3: Lease holders fail closed on lost renewal and re-confirm the Lease before every force-unlock; Pulumi pre-creates the Lease because RBAC cannot restrict create by resourceNames. - D3: the boot sequence re-reads status after apply before releasing the new deployment lock. - D5: maintenance restore is conditional on no armed migration, using a resourceVersion-guarded PUT on deployments/scale. - D6: /readyz is also 200 for an empty applied inventory.
This was referenced Oct 8, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What are the relevant tickets?
N/A. Upstream context: ModernRelay/omnigraph#882, fixed by ModernRelay/omnigraph#878.
Description (What does it do?)
Adds the spec for moving witan's omnigraph from 0.11.0 to 0.13.0 (storage format 14): docs/internals/design/omnigraph-0-13-upgrade-spec.md.
cluster plangate, a stop-window maintenance CronJob, and--require-all-graphsleft unset.schema apply) and the migration-Job changes.Implementation details
Recreateonly orders pods during a rollout, so the entrypoint takes a Kubernetes Lease, waits until no other live pod matches the selector (Failed/Succeededpods count as gone,Unknownas live), then force-unlocks. Every unlocker takes the same Lease, because upstream's force-unlock has no conditional delete.cluster plangate. The entrypoint also refuses a plan that removes a graph not on an allow-list, because 0.13 apply deletes a removed graph's storage and history, and the ConfigMap changes before the Job runs.How can this be tested?
Docs only. prek passes on the file. Claims marked "verified" were run against the released v0.13.0 binary (linux-x86_64, sha256
0123daa64f0f2db9860284200bd71c79a22a6ad2c6f5501b6fca24cac86a7a30) on localfile://scratch clusters built frommcp/servers/witan/policy. A reviewer can re-check any of them the same way. Nothing was run against S3 or the deployed clusters.Additional Context
cluster statusfield reports an outstanding deployment, and how long a schema migration takes against the startup-probe budget.