Pre-flight Checks
Bug Description
Antigravity's migration from a legacy global Engram MCP registration to plugin-only ownership can receive an error from an atomic write either before replacement or after the replacement has already reached disk. Without rereading and classifying the resulting files, the installer cannot reliably determine whether the global registration, plugin manifest, or both are active.
The migration also needs to accept zero-byte and whitespace-only configuration as an empty object while rejecting malformed, unreadable, or non-object input without mutating files.
Steps to Reproduce
- Start with an Antigravity global
mcp_config.json containing Engram and an unrelated MCP server.
- Run Engram injection while forcing
WriteFileAtomic to fail before replacement or after rename/sync for either the global config or plugin manifest.
- Optionally force the restoration write to fail.
- Inspect the global config and plugin manifest after the returned error.
- Repeat with blank, malformed, unreadable, and
null global configuration.
Expected Behavior
The injector should reread the affected path after an atomic-write error, classify the observed state, and preserve an available registration. It should either restore the exact global before-image or converge to plugin-only ownership while retaining all relevant errors.
Blank configuration should be treated as {}. Malformed, unreadable, and non-object configuration should return an error without changing the global file or activating the plugin.
Actual Behavior
A success-path-only migration cannot determine whether an atomic replacement occurred after an error. It may return with ambiguous global/plugin ownership, and blank configuration is rejected even though it is safely recoverable.
Operating System
Linux (Other)
Agent / Client
Other - Antigravity
Shell
bash
Additional Context
This is not a duplicate of #797. Issue #797 covers the successful-path core contract: exactly one plugin-owned registration, Linuxbrew and absolute command resolution, --tools=agent, and preservation of unrelated configuration.
This issue covers the separate failure-state contract for ambiguous atomic-write outcomes, rollback/roll-forward recovery, blank input, and no-mutation validation.
Pre-flight Checks
status:approvedbefore a PR can be opened.Bug Description
Antigravity's migration from a legacy global Engram MCP registration to plugin-only ownership can receive an error from an atomic write either before replacement or after the replacement has already reached disk. Without rereading and classifying the resulting files, the installer cannot reliably determine whether the global registration, plugin manifest, or both are active.
The migration also needs to accept zero-byte and whitespace-only configuration as an empty object while rejecting malformed, unreadable, or non-object input without mutating files.
Steps to Reproduce
mcp_config.jsoncontaining Engram and an unrelated MCP server.WriteFileAtomicto fail before replacement or after rename/sync for either the global config or plugin manifest.nullglobal configuration.Expected Behavior
The injector should reread the affected path after an atomic-write error, classify the observed state, and preserve an available registration. It should either restore the exact global before-image or converge to plugin-only ownership while retaining all relevant errors.
Blank configuration should be treated as
{}. Malformed, unreadable, and non-object configuration should return an error without changing the global file or activating the plugin.Actual Behavior
A success-path-only migration cannot determine whether an atomic replacement occurred after an error. It may return with ambiguous global/plugin ownership, and blank configuration is rejected even though it is safely recoverable.
Operating System
Linux (Other)
Agent / Client
Other - Antigravity
Shell
bash
Additional Context
This is not a duplicate of #797. Issue #797 covers the successful-path core contract: exactly one plugin-owned registration, Linuxbrew and absolute command resolution,
--tools=agent, and preservation of unrelated configuration.This issue covers the separate failure-state contract for ambiguous atomic-write outcomes, rollback/roll-forward recovery, blank input, and no-mutation validation.