mvp - #98554
Draft
devjiwonchoi wants to merge 10 commits into
Draft
Conversation
Contributor
Failing CI jobsCommit: 8089ea5 | About building and testing Next.js |
devjiwonchoi
added
the
ci:lightweight
devjiwonchoi
added a commit
that referenced
this pull request
Sep 11, 2026
Why? PR #98554 is iterating on upgrade tooling and does not need the full runtime, Rust, browser and deployment matrices on every draft push. How? Gate expensive jobs only for PR #98554 when it is a draft labeled ci:lightweight. Preserve build, lint, types, docs checks and Linux/Windows unit/codemod coverage. Mirror the opt-out in preview deployment selection and trigger full CI on ready_for_review. Label changes apply on the next push. TEMPORARY: remove this commit before merge. Other PRs, canary pushes and release publishing do not opt out. Workflow validation and the PR/draft/label/event truth table cover the gate and retained dependencies.
Why? PR #98554 is iterating on upgrade tooling and does not need the full runtime, Rust, browser and deployment matrices on every draft push. How? Gate expensive jobs only for PR #98554 when it is a draft labeled ci:lightweight. Preserve build, lint, types, docs checks and Linux/Windows unit/codemod coverage. Mirror the opt-out in preview deployment selection and trigger full CI on ready_for_review. Label changes apply on the next push. TEMPORARY: remove this commit before merge. Other PRs, canary pushes and release publishing do not opt out. Workflow validation and the PR/draft/label/event truth table cover the gate and retained dependencies.
Why? Migration leftovers can appear as temporary casts or unrelated log messages, which makes them easy to miss when reviewing a codemod run. How? Share the compiler-recognized error directive across migration diagnostics and mark unsafe async Request API casts with the required repair. Preserve ignore comments and avoid duplicate markers when rerunning the transform.
Why? An unattended upgrade must honor its selected scope instead of accepting unrelated dependency or optional feature changes through default prompts. How? Accept an exact compatible React pair and repeatable codemod exclusions. Preserve existing bundlers when opting out of Turbopack adoption, adding --webpack for simple scripts crossing Next.js 16 and flagging custom scripts. Validate options before migration writes and cover execution ordering.
devjiwonchoi
force-pushed
the
jiwon/agentic-security-upgrade-checkpoints
branch
2 times, most recently
from
September 11, 2026 11:30
86599fb to
ef6015a
Compare
Why? Codemods and successful builds cannot establish that async request reads, caching behavior and bundler choices survived a major upgrade. How? Add version-guide checklists and helper/caller repair guidance. Explain independent fetch and route-response caching decisions, temporary casts and verified marker exceptions, and preserving the intended bundler.
Why? Security upgrades need an exact supported target and compatible dependency choices before an agent starts changing the application. How? Add the opt-in security policy and a reusable resolver for installed app state, reviewed advisories, eligible stable releases, React compatibility and pinned codemod arguments. Validate supplied context and expose actionable network and codemod blockers. Cover target selection and failure paths with unit tests. This is library preparation: the CLI entrypoint is connected in a later commit. Use experimental.agenticAutoUpgrade for the opt-in policy. Exit before config loading or network access when the selected directory has no supported Next.js config.
Why? A major upgrade can replace the installed documentation before the agent has finished resolving contextual repairs and verifying behavior. How? Prepare a retained packet containing resolved inputs, security evidence, baseline hashes and relevant canonical guides with source provenance. Preserve guide paths and later corrections, and fall back to release-tagged docs when required. Package the preflight and migration instructions with Next.js. Guide duplicate-PR lookup, codemods, complete checklist repairs, supported checks and commit checkpoints. Test guide selection, retention and failed preparation cleanup. This prepares resources; CLI exposure follows separately. Retain the dry-run delivery limit in the context and agent instructions so migration ends at verified local commits before any push or PR.
Why? An agent already working in a Next.js app needs one command to resolve its security upgrade and receive the retained migration instructions. How? Connect next upgrade --agent to the resolver and resource preparation. Detect Codex or Claude and return the packet instructions to that same session. Print a fallback for unsupported or ordinary terminals without spawning work. Preserve the caller environment for later dev and production verification. This completes the existing-agent entrypoint. Human-terminal selection and background process management are added in the next checkpoint. Add --agent --dry-run for migration, verification and local commits without publication. Reject --dry-run without --agent instead of falling through to the legacy upgrade command.
devjiwonchoi
force-pushed
the
jiwon/agentic-security-upgrade-checkpoints
branch
from
September 11, 2026 12:15
ef6015a to
a69c850
Compare
Why? A human invoking the upgrade command should be able to delegate the migration without keeping a foreground agent session in the terminal. How? Discover installed Codex and Claude binaries, offer the CLI picker when needed, and launch native Claude background mode or detached Codex exec. Return a shared receipt with session identity, logs, stop commands and recovery guidance. Keep launch failures actionable and preserve caller models and permissions. Codex continuation requires the original writer to finish or stop; its desktop link is not live attachment. Test selection, launch errors, exit propagation and Claude receipt handling. Existing-agent handoff remains unchanged.
Why? Agent behavior needs coverage across migrations and prerequisite failures without changing the existing Next.js documentation benchmark. How? Run same-major, major-migration, existing-PR and failed-lookup fixtures through Codex/Luna and Claude/Haiku in Vercel Sandbox. Use controlled provider and security evidence, real upgrade tools, withheld behavior assertions, and retained transcripts and commit patches. The model matrix remains paused. The terminal driver still needs adaptation for background launch receipts; earlier runs do not verify that lifecycle.
Build the PR candidate and run the Codex/Luna and Claude/Haiku matrix independently of core tests. Restrict paid runs to labeled same-repository PRs and retain failure evidence.
devjiwonchoi
force-pushed
the
jiwon/agentic-security-upgrade-checkpoints
branch
from
September 11, 2026 12:36
a69c850 to
8089ea5
Compare
devjiwonchoi
added
the
ci:upgrade-evals
devjiwonchoi
had a problem deploying
to
next-upgrade-evals
September 11, 2026 12:36 — with 
GitHub Actions
Failure
GitHub Actions
Failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.