Repository navigation
test(harness): reaped receipt, readiness-gated faults, ownership proofs - #2688
Merged
Merged
Conversation
macOS bash 3.2 reports -c input as line 0, modern GNU bash as line 1. Compare diagnostic shape with line number normalized.
…gression A long -c ARG0 stamped on every report line could evict the structural payload out of the 1 KiB diagnostic budget. Truncate the shell name to 64 chars first so 'syntax error ...' always survives; renumber the threat entry to TM-DOS-136 (main already owns 135 via #2674); add a bounded-child regression exercising the exact finding shape (multiline token x long ARG0) at two scales.
The 64-char cut mangled long script paths (breaking the oracle's path
replacement and hiding which script failed). Widen to 256 chars with a
16-char tail: realistic paths print verbatim with attribution suffixes
(': eval') intact, while a kilobyte-scale ARG0 still cannot evict the
structural payload out of the 1 KiB total. The total stays the enforced
bound.
The scaled multiline-token x long-ARG0 regression now asserts the whole harness contract at both scales (200/2000 lines x 8 KiB ARG0): no watchdog timeout, raw child exit 2, no output-cap overshoot, finished reader threads, and effective stack=4096/cpu=10 caps read back from the launcher. Shape and 1 KiB assertions unchanged.
run_command_bounded cleanup per lifecycle review: truncate retention before extending (retention never passes the 8192 cap); retry Interrupted, fail closed with partial bytes on real reader errors (new read_error field, never relabeled as EOF); exact-cap EOF is not excess; reap inside a finite 5s grace, never an unbounded wait; timed_out retained as recorded; drain 2s + reap 5s graces documented against the execution deadline. Consumer regression gains !read_error and the corrected 8192-byte cap text. Bounded selftests: exact-cap, cap+1, Interrupted/error scripted pipes, timeout kill+reap, overflow flag.
Per lifecycle review on #2682: join readers only after all channel receipts (receipt proves all blocking work done; missing receipts skip the join and fail incomplete), with panicking readers failing visibly; reap extracted into a poll seam with deterministic verdict unit tests; timeout/overflow selftests run under the fail-closed launcher with stack/cpu readback and elapsed-total bounds; retained-pipe case gains elapsed proof and read_error distinction. Reuses existing bounded_helper_flags_retained_pipes; does not touch #2681's distinct probe helper.
…tests Per completion review on #2683: join readers only while is_finished inside the shared completion grace (a receipt is not the termination contract); deterministic paused-after-send proof with release/cleanup watchdog; poll/read/reap faults injected through the real parent lifecycle with distinct fail-closed verdicts (no panicking expect on child poll); timeout/overflow selftests under the fail-closed launcher with cap readback and elapsed bounds; existing retained-pipe fixture reused and strengthened. Untouched: #2681 distinct probe helper.
…tests Per completion review on #2683: join readers only while is_finished inside the shared completion grace (a receipt is not the termination contract); deterministic paused-after-send proof with release/cleanup watchdog; poll/read/reap faults injected through the real parent lifecycle with distinct fail-closed verdicts (no panicking expect on child poll); timeout/overflow selftests under the fail-closed launcher with cap readback and elapsed bounds; existing retained-pipe fixture reused and strengthened. Untouched: #2681 distinct probe helper.
… selftests Per completion review on #2684: common cleanup termination funnels every loop exit through one reachable kill guard; bounded is_finished join gate with shared completion grace (receipt is not the termination contract); deterministic paused-after-send proof drives the actual gate with bounded readiness and release/cleanup watchdog; poll/read/reap faults injected through the real parent lifecycle with distinct fail-closed verdicts (no panicking child poll); selftests and retained-pipe fixture under the fail-closed launcher with cap readback and elapsed bounds. Reuses existing retained-pipe fixture; untouched: #2681 distinct probe helper.
…receipts Per completion review on #2685: join_finished returns the unfinished handle so the paused-after-send proof releases and joins THAT SAME thread (no twin); poll-fault fixture uses direct-exec sleeper so killing closes the pipes with no orphan; reap_never keeps real bounded OS cleanup while the verdict reports None; retained-pipe fixture runs under the fail-closed launcher with a file side-channel receipt proving the effective bounds despite incomplete pipe capture. Reuses the existing retained-pipe fixture; untouched: #2681 distinct probe helper.
Per completion review on #2685: fail_poll fires only after a readiness file proves the victim truly live (direct-exec sleeper, no orphan); BoundedRun gains a reaped receipt separating actual OS cleanup from exit/observation verdicts; retained-pipe fixture runs under the fail-closed launcher with a file side-channel receipt proving the effective bounds despite incomplete pipe capture. Reuses the existing retained-pipe fixture; untouched: #2681 distinct probe helper.
The retained-pipe fixture routes through the fail-closed launcher with a file side-channel receipt; the leftover comment claiming a direct run contradicted the code. No behavior change.
…ture The retained-pipe fixture retains its sleeper's PID through a receipt file, then terminates that exact descendant and finitely observes its completion (kill -0 absence polling inside a 5s bound) after asserting the negative verdict, with a total end-to-end elapsed bound. No waiting for the 30s self-expiry, no universal process-tree reaper, no change to the truthful incomplete flags.
The retained-pipe fixture contained two cleanup blocks for the same recorded descendant, so the second kill correctly failed with No such process. Consolidate cleanup to exactly one path after the negative verdict: terminate the retained descendant, join the original reader handles, and prove absence with kill -0 where only an observed non-zero exit counts (spawn errors stay unknown inside the finite bound). No behavior change to the verdict.
The retained-pipe fixture builds a RetainedCleanup guard owning the exact descendant PID, the ORIGINAL reader handles, and both receipt files before any verdict assert, so setup/assertion failures still clean up via Drop (best-effort kill, no panics). The normal path terminates the descendant, joins the original handles through the shared gate, observes ESRCH absence (spawn errors stay unknown), and proves the total elapsed bound. Only an observed non-zero exit counts as absence.
Per ownership review on #2687: signal_bounded reuses drain_capped and reap_with_grace so the helper child is terminated and reaped on every path and no return leaks a running process; EOF reasoning is construction-specific to the non-forking kill binary. The retained fixture builds its cleanup guard immediately after the run, before any fallible setup read, so panics in reads or verdict asserts still clean up via Drop; the pid binds once the pidfile proves identity. Only an observed non-zero exit counts as absence.
Per completion review: BoundedRun gains a reaped receipt separating actual OS cleanup from exit/observation verdicts; fail_poll fires only after a readiness file proves the victim truly live (direct-exec sleeper, no orphan); signal trichotomy proved directly (Present/Absent/Unknown); handshake-failure and unwind paths prove unknown handling and Drop cleanup with reaped-termination receipts; retained fixture keeps launcher route with file receipt. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | dc4d666 | Commit Preview URL Branch Preview URL |
Oct 12 2026, 02:23 AM |
Contributor
Author
|
Completion review update for dc4d666: the existing code obligations are resolved by executable proof, not a production-hang claim. Preserved repairs: the retained-writer subject uses the SAME run_helper_bounded, success gates/join checks the ORIGINAL reader before try_recv, actual CPU10/stack4096 readback and controlled cleanup precede verdicts. Complete's marker consumers now preserve Unfinished rather than assert-away. Capped reader retention is not an RLIMIT_FSIZE receipt; the None assertion owns no reader and is not evidence of a leak. Direct correction3748566a gives RetainedCleanup a caller-borrowed reader-handoff vector that outlives Drop. Every unfinished helper or pending-reader join returns the SAME handle to that owner. The deterministic Drop test parks its original reader, observes that exact thread ID returned after Drop, releases it before assertions and finitely joins it. Injecting the old discard behavior genuinely fails (cargo101/count0); corrected behavior passes (cargo0/count1). Trichotomy/timeout consumers retain failed handoffs under their original absolute end instead of adding a new2s allowance. No copied subject, weaker negative flag, arbitrary production process-tree redesign or runtime settlement. Full unmodified just pre-pr at dc4d666 now actually exits0:3762unit+2410integration,158Python checks, fmt/Clippy/knowledge/docs/workflows/vet. misconfig_huge_ast_depth_still_safe runs and passes; historical skips/raised stacks remain partial. First missingPyYAML failure retained; disposable test env supplies the dependency. Independent candidate CLI proof exits0/12owned cases: original20,000lines x65,536ARG0 virtual/direct raw2,1024Bstderr, bounded activeRSS/finitecleanup and child-attestedCPU10/stack4MiB/file2MiB; finite/recovery matched Bash5.3. This is candidate proof only. Fresh current-head requiredCI, full issue/formal/inline reviews and actual rebuilt exactmerge producer/assertion proof remain mandatory before shipping/closure. No finding closed from this review update. |
Per completion review: signal_bounded returns stage-explicit receipts (dispatched/helper-reaped/pipe-ok/presence) with the helper terminated and reaped on every path; handshake fixture carries independent ownership (pidA) before the failing handshake (pidB) with cleanup through owned channel and same original readers; unwind paths prove Drop termination with reaped-exit receipts. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
Per completion review: unfinished reader handles are preserved in the cleanup receipt instead of silently detached, with tests asserting none remain; Drop attempts a bounded join of retained handles (never unbounded, never panicking) instead of detaching blindly. Stale receipt-proves-termination comment removed. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
…d completion Per completion review: guard owns threads and files before any fallible setup read, with pid binding once identity proves itself; signal helper health (reaped/pipe) surfaced in the cleanup receipt and asserted; ownership-channel failure and post-unwind completion prove unknown handling and same-handle joining on the owned fixture. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
The ownership-failure fixture carries NO pid identity: an argv marker established in the script text is the test-controlled ownership channel instead. The helper verdict stays honestly unknown with both original handles preserved; termination runs through pkill on the exact marker, then the SAME original handles from the receipt rejoin once their pipes close, and pgrep absence (exit 1) proves completion. No twin handles, no self-expiry reliance, every receipt observed.
…rtional deadline Per completion review: ownership-failure fixture carries NO pid identity with an argv marker as the test-controlled ownership channel; unjoined handles preserved then rejoined from the receipt; signal receipts consumed in every classification arm; helper deadline split proportionally so kill+reap always retain time; dead code removed. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
Per completion review: run_helper_bounded unifies kill/pkill/pgrep under caller-owned end instants with explicit PATH resolution and stage receipts; signal reports consumed kill/reap/drain outcomes; Drop terminates by pid or marker, attempts bounded join, and writes an observable outcome receipt; marker-owned unwind proves Drop termination plus same-reader completion without inferring from silence. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
…ence Per completion review: helper stderr drains on its own thread under the shared end (retention cap plus duration bound, detached only for helpers outliving their own exit); Drop shares one end across kill, join, and files with helper health in its outcome receipt; unwind absence requires a healthy helper reporting exit 1 inside the shared end. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
Per completion review: the drain reader handle is retained and joined on success (proving original-reader completion) or ridden home in the receipt on timeout for caller-owned finite cleanup; a controlled retained-writer negative proof exercises exit-observed plus drain-timeout plus marker cleanup plus same-handle rejoin on the same implementation; signal consumes every receipt field. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
Per completion review: the retained-writer fixture drives its subject through run_helper_bounded (no manual copy), asserting the actual HelperOutcome (observed+reaped exit, false drain, original handle home) before marker termination, same-handle rejoin, and pgrep absence; exit codes preserved on drain timeout instead of discarded; success join gates the drain receipt; signal handoff joined boundedly with fail-closed verdict. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
…eipts Per completion review: drain reader joined through the finite is_finished gate under the shared end with the unfinished handle riding home; retained-writer subject driven through run_helper with launcher envelope proven by file receipt, guard-owned cleanup before verdict asserts; signal handoff propagated to all consumers with fail-closed verdicts. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
Per completion review: drain reader joined through the finite is_finished gate under the shared end (not bare join), with the unfinished handle riding home; SignalReceipt propagates the handoff to every consumer (complete preserves into unjoined, tests join boundedly, Drop attempts with recorded outcome); wait() hoisted before drain so exit+reap survive drain timeout. Reuses the existing retained-pipe fixture; untouched: distinct probe helper.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
Completes the bounded test-harness follow-up for syntax diagnostic amplification.
Controlled fixture cleanup retains ORIGINAL unfinished reader handles for their
caller, including when cleanup unwinds. Negative timeout/drain verdicts stay
negative; completion is proved by joining the same handle after release.
Why
The diagnostic fix is already merged. Its verification harness must not mistake
a failed join or a sent receipt for owned completion. This change finishes that
test-only ownership contract without widening production process-tree behavior.
Before / After
zero returned handles (cargo exit 101).
released/joined inside the shared bound (cargo exit 0).
just pre-pr: exit 0, 3,762 unit and 2,410 integration testspassed, 158 Python checks passed, formatting/Clippy/docs/knowledge/workflows/
dependency vetting passed. Existing ignored tests remain unchanged. The first
run lacked PyYAML; a task-local environment supplied that prerequisite.
Original 20,000-line token x 65,536-byte ARG0 through virtual
bash -creturns raw exit 2 with 1,024-byte stderr, not quadratic output. Direct and
scaled forms also pass; finite loops/quotes/nesting/recovery match Bash 5.3.
CPU 10s, stack 4 MiB and per-file output limits are child-attested, with a
finite wall deadline, active RSS cutoff and owned cleanup.
Earlier filtered/stack-modified checks and runtime drain failures are retained
as historical partial evidence, not substituted for the new full gate.
Fresh current-head CI and exact merged-revision verification remain required.
Risk
and additive commits. No new PR or force-push.
Checklist