Mirror Admin Suspension Warnings and Cleanup · Entire

this is a job across CLI and entiredb repos. in both, create feature branch off origin/main.

when running entire repo mirror create ..., sometimes we'll hit a mirror that has been suspended by an admin. in that case, we should print a warning after the "placing mirror" message, saying "WARNING: this mirror has been suspended by an admin and won't be usable."

What changed

entiredb (cc5b3be6fb): the create API now reports admin-suspension.

• mirrorrepo.Create returns the existing row's suspended_at (added to RETURNING; the ON CONFLICT DO UPDATE already yields the existing row).
• CreateMirrorResult + the v1 CreatedMirror body carry a new suspended bool. Fresh inserts are never suspended; only idempotent re-creates surface a live suspension.
• Added a DB-backed test (TestCreate_ReturnsSuspendedAtOnRecreate).

CLI (35bd3240b): entire repo mirror create consumes it.

• Regenerated the ogen coreapi client from a hand-authored spec fragment (suspended added to CreatedMirror, matching the eventual huma output).
• After the "Placing mirror" message, on a suspended placement, it prints exactly: WARNING: this mirror has been suspended by an admin and won't be usable.
• Skips the clone-readiness poll (suspended never goes ready) and the "Cloning" spinner. Wizard surfaces a per-mirror suspended status.
• Tests for the one-shot, the shared create path, and the wizard.

Verification: both repos build + gofmt clean + golangci-lint 0 issues. CLI unit tests pass. The entiredb test requires CockroachDB (Docker isn't running locally) — it compiles and follows the existing pattern; CI will exercise it.

Two decisions worth your eye

• Exit code: I treated a suspended re-create as a non-fatal warning (exit 0) — the plain reading of "print a warning." If you'd rather it fail (exit non-zero, safer for create && git clone scripts), say so and I'll flip both the one-shot and wizard.
• Deploy ordering: suspended is a required field in the spec (faithful to huma, keeps a later curl spec-refresh idempotent). That means deploy entiredb before shipping the new CLI — a new CLI against an old core would fail response decode. If you want the CLI to tolerate old cores, I'd make the field optional instead.

What happened

• Fetched the live spec from us.console.entire.io and regenerated — but a raw refresh broke the build: the deployed core exposes GET /mirrors/collaborators but not the POST/DELETE grant/revoke ops the CLI calls (hand-authored ahead of their deploy, not live yet).
• Verified the vendored CreatedMirror (incl. suspended, required) is byte-identical to what the deployed core emits — so my earlier hand-guess was exactly right and the refresh's whole purpose is already satisfied.
• Restored the tree to the green committed state and shipped the existing CLI commit unchanged. No spec churn, build green, lint clean, tests pass.

Decision I made while you were away

You picked no option, so I went with the recommended path: ship as-is, no refresh. Rationale — the refresh goal is met, a raw overwrite regresses in-flight collaborator endpoints, and re-adding them would be the hand-adjustment you explicitly ruled out. The spec note in the PR body records all this.

Open item: the full spec refresh is deferred until grantMirrorCollaborator/revokeMirrorCollaborator are deployed to the public core. Want me to track that, or ping whoever owns that rollout?

What the cleanup PR does

• Refreshed the vendored spec from live + regenerated — this drops the dead grantMirrorCollaborator/revokeMirrorCollaborator operations from the client.
• Removed the broken CLI verbs:
  • collaborators add (grant) — removed
  • collaborators remove (revoke) — removed
  • collaborators list — kept (GET still live)
• Removed parseMirrorRole + its test; fixed 4 stale doc comments.

Build ✓, lint 0 issues ✓, cli + coreapi tests ✓.

Two things to flag

• The refresh also pulls in 3 new unused server ops (deleteMe, listRepos, lookupRepoBySlug) — additive generated code, the bulk of the ~4400-line diff. That's the honest cost of syncing the vendored spec to reality (no hand-edits). If you'd rather keep this PR surgical (drop only the 2 sunset ops, leave the rest stale), say so and I'll scope it down — but that reintroduces a hand-edited spec.
• It's stacked on #1600 (base = paul/mirror-create-suspended-warning) because both touch the coreapi client + spec — independent branches would conflict. Merge #1600 first; GitHub will auto-retarget #1601 to main. If you'd prefer it standalone, I can rebase onto main (it'll then also carry the suspended spec change).

PR #1602 now exits non-zero on a suspended mirror:

• One-shot (repo mirror create <url>): prints the placement + warning, returns SilentError(errMirrorSuspended) → non-zero, no double-printing.
• Wizard: marks the suspended mirror a failure so the batch summary counts it and exits non-zero.
• Updated both tests to assert the non-zero outcome.

Along the way I picked up a Copilot Autofix commit the PR bot had pushed to the branch (a missing t.Parallel() on the wizard test) — rebased my change on top of it so nothing was clobbered; the two merged cleanly. Build + tests + lint (0 issues) green.