Repository navigation
feat: add Step Functions and Docker Lambda execution - #76
Merged
Merged
Conversation
Record the English workflow specification set, pinned service model and semantic provenance. Retain reproducible Docker relay/RIC probes with real results, error, cancellation, EOF and reconciliation evidence on native arm64 and emulated amd64. Workspace build, tests, formatting, Clippy and rustdoc pass. Independent review findings W07-W09 are fixed. Existing advisory failures remain recorded as B01 for P1; native x86/Desktop/rootless qualification and all production runtime/engine phases remain required.
Land the first P1 task1.1 foundation toward M0: stable nonnil resource IDs with snapshot preservation, immutable identity updates, duplicate-restore rejection, captured revision/ImageConfig/ephemeral storage, invoked qualifier metadata, warm-key isolation and redacted invocation diagnostics. Artifact enums, cooperative cancellation and Docker remain pending. Workspace build/test/fmt/Clippy/rustdoc pass: 1703 tests, 154 Lambda core tests and two new doctests. The native target validates six native/DryRun cases; its separately gated Squib case is not execution evidence. Independent read-only review found no in-slice defect. Existing advisory and strict-boundary-lint failures remain explicitly recorded as B01/B03, without ignores.
Advance P1 task1.1 toward M0 with closed ZIP/Image artifacts and architecture, shared archive leases, immutable image inspection metadata, bounded reference/settings validation and early source-IO preflight. Unpublished guards roll back failed/cancelled creates, revision conflicts and rejected restores. Native children retain code through exit; Squib wire compatibility is preserved. Workspace build/test/fmt/Clippy/rustdoc pass: 1752 tests, including 203 Lambda core cases; 12 doctests and six native/DryRun cases pass. Independent review findings W10-W12 are fixed. Existing audit/strict-lint debt B01/B03 remains open; actual Docker execution and cooperative invocation cancellation remain pending. The existing synchronous owned-directory Drop exception moves to crates/rustack-lambda-core/src/artifact.rs:133: last-lease destruction cannot await, operates only on the validated private directory and reports cleanup failures. No new gate ignore was added.
Share captured ExecutionRevision values and attempt IDs, expose cancellable invocation handles, and retain bounded actor-owned execution through cleanup. Native retirement reaps before settlement; Squib owners retain startup and shutdown futures, including idle Drop. Independent review W13-W15 fixed and rechecked. Workspace build, 1767 tests, Clippy, rustdoc, 26 Lambda doctests, five real Native fixture tests and native SDK checks pass. P1/M0 remains open: Docker runtime, B01 advisory remediation and B03 strict-boundary debt are still required.
Specify and implement typed environment-scoped CBOR frames with allocation preflight, validated metadata, redacted binary payloads and absolute IO deadlines. Add the host-portable runtime crate and discoverable test-lambda-runtime target; session and relay consumers remain next. Independent codec review W16 fixed/rechecked. Workspace build, 1806 tests, fmt, Clippy and rustdoc pass; 39 runtime tests, eight doctests and strict runtime boundary checks pass. New std-only proptest dev dependencies add no audit finding. The same 16 B01 baseline advisories and B03 debt remain mandatory P1 gates; no full P1/M0 completion is claimed.
Add the bounded shared RuntimeSession actor, per-attempt tickets, first-poll initialization signal, deadline/cancellation handling and joined shutdown. Retain offered events until poll receipt; reconcile receipts and attempt validity before state transitions. Independent review W17-W19 races fixed and rechecked. Workspace build, 1822 tests, fmt, Clippy and rustdoc pass; runtime 55 tests, 23 doctests and strict boundary checks pass. Native HTTP migration, relay/socket client, Docker executor and ASL remain required. B01/B03 security and strict-lint gates remain open; P1/M0 is not complete.
Replace the old pending-map API with the bounded shared adapter. Wait for first bootstrap polling, preserve handler budgets across cold start and join API/process retirement across updates, cancellation and concurrent shutdown. Enforce header/body/trailer validation and task-bound Hyper diagnostic filtering. Independent review W20-W22 fixed/rechecked. Workspace build, 1841 tests, fmt, Clippy and rustdoc pass; runtime 71 tests/34 doctests and strict boundary checks, core 212 tests/26 doctests, 11 real Native regressions and native SDK checks pass. Audit remains at the same 16 B01 baseline findings; B03 and relay/Docker/ASL work remain required before full completion.
Add the nonblocking-pipe relay executable, bounded supervised control IO, flush-confirmed messages and cancel-safe borrowed invocation results. Retain API and worker cleanup through Close, cancellation and transport failure, preserving completed IO errors during priority shutdown. Build pinned arm64/amd64 relay images through Make. Four explicit Docker qualification tests pass on arm64 VZ and amd64/QEMU with unchanged official Python RIC computation, warm reuse, failure/cancellation and pipe/process cleanup evidence. Independent review findings W23-W26 are fixed/rechecked. Workspace build/test/fmt/Clippy/rustdoc pass (1853 tests); runtime strict boundary and actual Linux entry-point Clippy pass. Existing B01 advisory and B03 core-boundary gates remain open. Host control client, Docker executor/provider integration and the ASL engine remain required by P1-P5.
…orkers Add ControlClient with causal handshake/result/cancel/close validation, cancel-safe receives and fail-closed interrupted sends. Extract retained bounded stream supervision for both client and relay, preserving terminal frames, flush receipts and completed IO failures through joined retirement. Independent review findings W27-W28 and self-found W29 are fixed and rechecked. Workspace build/test/fmt/Clippy/rustdoc pass with 1867 tests; runtime 97 tests/47 doctests and strict boundary checks pass, as does the Linux binary cross-target check. Five explicit Docker tests pass on each arm64 VZ and amd64/QEMU daemon, including the production client driving real official RIC warm computation, handler failure and busy cancellation. This completes the shared runtime contracts for the P1 Docker consumer; startup probes, deployment/environment/pool integration and B01/B03 gates remain required. No production Docker executor or full P1/M0 claim.
…ration Vendor Bollard v0.21.1 at its published source pin and study response collection, request/body timeouts, attach framing/EOF and synchronous dependency logging. Reuse generated model/query contracts while owning the narrow bounded Unix HTTP/upgrade transport in runtime spec 3.6/D19. Independent design review W30 clarifies reserved cleanup capacity and supervised stream handoff so warm connections cannot starve management. W31 source citations are corrected. Source pins, relative links and diff checks pass. This is documentation/reference-source preflight, with no production Rust/dependency changes and no new runtime acceptance claim. P1 Docker consumer and its fake-daemon/real image gates remain required, along with B01/B03 and the complete subsequent workflow implementation.
Add shared JsonLimits/validate/from_slice contracts with encoded-string scratch bounds, decoded key/string byte limits, duplicate-key rejection, container depth and aggregate member budgets. Preflight creates no Value tree and errors contain static redacted classes. Consumers choose their own key limits; Docker's profile remains 256 bytes. Independent review/recheck found no remaining in-slice defect. Core has 39 tests and four doctests, including 21 JSON cases and two 512-case properties. Workspace build/test/fmt/Clippy/rustdoc pass with 1888 tests. Make test-json-boundaries runs the core suite and strict production lints; four existing core doc-format findings are corrected without ignores. No dependency versions/packages were added. Existing 16 B01 advisories and remaining B03 Lambda/auth/model debt remain open P1 gates. Bounded Docker HTTP/stream and deployment/pool consumers remain required before production Docker or full P1/M0 acceptance.
…reams Implement typed local Unix Docker management, bounded metadata before model deserialization, strict streaming attach and retained driver supervision. Separate lifecycle waits from reserved destructive-cleanup capacity (D20/W32). Apply mandatory dependency filtering and exercise actual Bollard log call sites. Workspace build/test/fmt/Clippy/rustdoc pass with 1903 tests. Near-6MiB official RIC wire qualification and five relay regressions pass on arm64 VZ and amd64/QEMU. Independent read-only review found no remaining in-slice issue. Deployment/pool/provider consumers and B01/B03 remain required before P1/M0 completion.
…tion plans Implement read-only local resolution, retained redacted image defaults, explicit Docker argv reset semantics and restore-verified canonical fingerprints. Bind platform inspection to the addressable parent ID, retain selected manifests independently, and create with a captured platform. Validate classic-store evidence while preserving null VFS status. Pin historical Moby source for merge and compatibility guards. Independent W33-W38 findings are fixed and rechecked. Workspace build/test/fmt/Clippy/rustdoc pass with 1964 tests; Lambda core has 288 tests and 58 doctests. Both real Docker two-case suites pass on arm64 VZ and amd64/QEMU with no owned containers left. Deployment/CAS, availability leases, allowed pulls, unpacked quota proof, pool/provider integration and B01/B03 remain required before P1/M0 completion.
…ifacts Own bounded image preparation, live artifact leases and phase-aware cleanup through cancellation and supervision failure. Preserve uncertain nested Docker mutations until a commit is observed; validate selected-platform unpacked image quotas without running code. Verified 1,997 workspace tests, 321 Lambda core cases, 76 core doctests, build/fmt/Clippy/rustdoc and two actual Docker cases on each arm64 VZ and amd64 QEMU. Independent review fixes W39-W42. B01 advisories and B03 strict baseline findings remain mandatory P1 work; provider deployment, pool/executor and later workflow phases remain incomplete.
…leases Add typed readiness/update states and closed store-issued candidates. Atomically settle by resource UUID, original revision and generation; retain previous revisions during failed or pending updates. Capture live PinnedImages, validate canonical image hashes and unpacked sizes, migrate snapshot states without inventing leases, and reject unsupported image publication before mutation. Verified 2,022 workspace tests, 346 Lambda core cases and 92 core doctests; workspace build, nightly formatting, Clippy, rustdoc and Native SDK regressions pass. Independent review findings W43-W44 and self-review fixes W45-W46 are addressed, including deterministic HTTP timer tests. Strict baseline B03 and advisory B01 remain open. Retained provider deployment ownership/API wiring, Docker pool/executor and P2-P5 remain required; no M0 completion is claimed.
…dmission Reserve bounded work and mailbox capacity before Pending metadata, return atomic acceptance receipts, retain keyed settlement guards and worker joins through cancellation/root failure, and cancel stale preparations without replay. Separate overall deployment and Docker read budgets; require explicit executor image readiness. Wire provider image Create/Update and RevisionId preconditions with modeled HTTP 412 responses. Verified 2,043 workspace tests, 366 core cases, 101 core doctests, all standard Rust gates, direct Native provider regressions, actual SDK/HTTP preconditions and both two-case real Docker wire lanes. Independent W47-W50 and wire-test review fixes pass. Correct historical Native SDK labels: that target bypasses SDK/HTTP. B01 advisories, B03 strict baseline, B04 DryRun/request validation and the actual Docker pool/executor/startup plus P2-P5 remain required; M0 is not complete.
…ent decoding Close B04 with explicit code DryRun, strict deployment DTOs, borrowed inline ZIP preflight and retained blocking parser admission. Validation does not stage, fetch, tag or publish, and rejects unknown modes before dispatch. Match runtime section 2.12 and record W51-W53 review corrections. Workspace build/test/fmt/Clippy/rustdoc pass: 2072 tests, zero failed, 401 resource-gated. Core has 395 tests and 101 doctests. Actual SDK/HTTP validation and revision regressions pass; independent read-only review has no remaining B04 findings. B01 (16 advisories), B03 (65 strict baseline findings), real Docker executor/directory ownership/pulls/probes and P2-P5 remain required; full P1/M0 is not complete.
Close B03 across six production libraries. Propagate typed HMAC initialization errors through signing and verification, preserve constant-time and S3 normalization behavior, replace guarded indexing with checked patterns, and document actual method-specific failures. Match runtime section 7.1 and record D26 plus independently fixed W54-W56 review findings. Final workspace build/test/fmt/Clippy/rustdoc pass: 2074 tests, zero failed, 401 gated. The new Make target passes 659 unit tests and 165 doctests plus strict production Clippy without new ignores. Four RFC HMAC vectors and existing streaming/query tamper regressions pass; Native provider regressions pass without claiming gated Squib VM evidence. No dependency manifest/version/lock changes. B01, real Docker ownership/pool/executor/pulls/probes and P2-P5 remain required; full P1/M0 is incomplete.
Close B01 with compatible crypto/TLS/PKI/QUIC updates and ZIP 9.1.1. Remove unused SDK SigV4a selections from the regional local-client profile while retaining model versions and SigV4/HTTP/Tokio. Validate original ZIP mode/name metadata before normalization and reject collapsed raw-name duplicates. Match runtime section 7.2/D27 and independently reviewed W57-W59 corrections. Final workspace build/test/fmt/Clippy/rustdoc pass: 2083 tests, zero failed, 401 gated. Core has 404 tests and 101 doctests; the six-library boundary target has 833 passes and green strict Clippy without new ignores. All audit/deny checks pass; real regional SDK/HTTP validation and revision tests plus Native provider regressions pass. No Squib VM, production Image Invoke or full P1/M0 acceptance is claimed. Directory ownership/reconciliation, pulls, real Docker pool/executor/probes and P2-P5 remain required.
Implement runtime section 4.1 and D28 with private descriptor-relative namespace IO, permanent OS lock ownership, bounded checksummed identity publication, trusted ancestor validation and cancellation-safe worker capacity. Image scopes, allocated pins and cleanup recovery retain the actual directory capability. Independent review W60-W62 fixes are verified. Workspace 2122 tests and all standard gates pass; six-library strict boundary 874 unit/doc passes, audit and deny pass. Both real wire suites pass arm64 VZ and amd64/QEMU. The exception at docker/ownership.rs:5 permits standard-file synchronous IO only on bounded blocking workers because Tokio files have no OS advisory-lock API. P1/M0 remains open for historical-effect reconciliation, pulls, log/network/probe consumers and environment/pool executor; P2-P5 remain required.
Implement runtime section 3.7 and D29 using output-only live attach, separate bounded binary channel rings and combined 4KiB tail, retained partial reads across snapshot requests, fair mailbox/read service, early terminal socket closure and cancel-safe cached shutdown. Independent review W63-W64 corrections are verified. All 18 focused cases, 2140 workspace tests, 896 strict boundary unit/doc cases and standard build/fmt/Clippy/rustdoc gates pass. Both two-case real wire suites capture handler stdout/stderr separately from computed responses on arm64 VZ and amd64/QEMU and leave no owned resources. No new dependency or lint exception. Environment integration, historical reconciliation, pulls, network/probes, production executor and P2-P5 remain required; M0 is not closed.
Implement runtime section 4.2 and D30 with retained revision/image/directory ownership, fixed allocation identities/platforms, validated network/user/relay budgets and resource/swap/tmpfs/health/log/restart limits. Compose unique environment keys with explicit image/captured/runtime precedence and deletion markers. Scope the wire serializer before await so supervised create futures are Send. Independent W65-W67 fixes are rechecked. 54 new cases pass, workspace 2194 tests and strict boundary 959 unit/doc cases pass, and standard build/fmt/Clippy/rustdoc plus audit/deny are green. Both real two-case wire suites consume allocation plans, verify cgroups/tmpfs/privileges/env and actual empty ImageConfig execution; all five shared runtime Docker regressions pass per daemon. Native provider regressions pass without claiming the gated Squib case as VM evidence. Environment/pool lifecycle, reconciliation, pulls, network/probes, production executor and P2-P5 remain required; M0 remains open.
Implement runtime section 4.3 and D31: retain allocation budgets, immutable plans, container mutation receipts and IO cleanup above supervised environment workers. Resolve and independently recheck W68-W77, including ready-reply abandonment and worker-failure precedence. Workspace build/test/fmt/Clippy/rustdoc pass with 2,215 tests; six-library strict boundary checks pass with 991 unit/doc tests. Audit and deny pass. Owner, wire and shared-runtime Docker suites pass on arm64 VZ and amd64/QEMU, with no owned resources afterward. Warm pool/executor integration, delivery-based handler timeout, historical reconciliation, pulls/network/probes and P2-P5 remain required; M0 is not closed.
Implement runtime section 4.4 and D32: one bounded FIFO queue, canonical validated allocation identity, consumption receipts and deadlines, warm retention limits, one-at-a-time LRU eviction, and retained worker/root recovery. Resolve and independently recheck W78-W81. All standard gates pass with 2,233 workspace tests and 1,014 strict-boundary unit/doc tests. Audit and deny pass. Four actual owner/pool RIC cases pass per arm64 VZ and amd64/QEMU daemon, including warm reuse, revision/capacity isolation, FunctionError replacement and observed busy cancellation. No owned resources remain. M0 still requires exact delivery-based timeout/log attribution, real executor/provider composition, reconciliation/pulls/network/probes; P2-P5 remain required.
Implement runtime section 3.8 and D33: control protocol v2 carries validated handler budgets and correlated timeout results. Consumed poll receipts arm effective deadlines shared by HTTP metadata and session enforcement; Docker owners attach immutable captured budgets and join timeout retirement. Native preserves independent initialization and caller deadline categories. Independently reviewed W82-W84 fixes include the actual receipt/timer selection race. All standard gates pass with 2,255 workspace tests, 1,038 strict-boundary unit/doc tests and 131 timeout cases including 12 real Native fixtures. Audit and deny pass. Twelve explicit owner/pool/wire/runtime cases pass per arm64 VZ and amd64/QEMU daemon, with captured-timeout override rejection, capacity settlement and cold replacement; no owned resources remain. Invocation log attribution, real executor/provider composition, reconciliation/pulls/network/probes and P2-P5 remain required; M0 is not closed.
Implement runtime section 3.9 and D34 with opaque revocable windows, actor-retained mutation consumption receipts/deadlines, bounded independent tails and Tail/None environment integration. Resolve W85 and independently review ownership, framing, fairness and EOF behavior; document observed-stream timing limits. All standard gates pass with 2,273 workspace tests, 1,058 strict-boundary unit/doc tests and 36 log cases. Audit and deny pass. Thirteen explicit owner/pool/wire/runtime cases pass per arm64 VZ and amd64/QEMU daemon, including requested/uncaptured/silent warm calls and empty owned resources afterward. B05 initialization-error classification is recorded for the next M0 composition work. Real executor/provider response wiring, reconciliation/pulls/network/probes and P2-P5 remain required; M0 is not closed.
Classify bounded InitError consistently before and after BootstrapReady. Compose actual session, HTTP, relay, client and environment serving in four boundary regressions; a controlled known-container absence barrier proves active replies follow retirement. B05 is closed with independent review and standard plus strict boundary checks. Production Docker executor/startup and the full P1-P5 exits remain required.
Expose start, cancel-safe response waiting and independent cancel_and_wait receipts for the Docker Executor consumer. Retain settlement senders beside Retirement records above dispatch JoinSet and through worker/root recovery. D35 and runtime section 4.5 specify the contract. Nine new pool cases and seven real-image cases on each retained daemon pass; standard and strict boundary checks pass with final independent review. Production executor/startup and complete P1-P5 exits remain required.
Implement DockerExecutor over retained pool invocation settlement with trusted startup readiness injection, raw outcomes, immutable metadata, resolved versions and bounded log tails. Propagate validated HTTP LogType through provider admission; reject duplicate or malformed scalar Invoke headers. Preserve quota versus post-effect infrastructure Busy classes and resumable shutdown ownership. Ordinary pinned boto3 executes actual image deploy, publish, alias, Invoke, FunctionError, captured timeout and replacement on both retained daemons. Final standard and strict boundary gates, audit and deny pass; independent review findings W87-W91 are closed. Production CLI startup qualification and complete P1-P5 acceptance remain required.
Pin exact local user bridges by full ID and run a private probe mode from the operator-pinned runtime image through retained EnvironmentManager ownership. Validate bounded kernel observations, private cgroup namespaces and current membership, exact quotas and isolation flags; issue scope-bound proof only after retirement and final deadline checks. D37 and runtime section 4.7 specify the contract. Fifty-seven focused cases, standard workspace gates, strict boundaries and audit/deny pass. Both retained daemons pass seventeen actual probe/SDK/pool/wire/runtime cases, with final host probe rechecks and owned-resource cleanup. Independent review findings W92-W94 are closed. Historical effects, pulls, endpoint/coordinator wiring and full P1-P5 acceptance remain required.
Implement D86 Runtime HTTP bounds and independent global, default-function, memory and environment ceiling consumers. Project actual bounded WorkManager and EnvironmentCapacity ownership into existing diagnostics, and prove quotas remain charged through separate function and relay deletion barriers. Both retained P0 engines pass the frozen 53-resource functional gate. All workspace, strict boundary, Native, fixture, security and text gates pass; W271-W274 are fixed and independently rechecked. Exact owned bridges retire with zero containers/private aliases and eight selected source IDs preserved. P1/M0 is functionally qualified on native-arm64 VZ/emulated-amd64 QEMU lanes. Preserve M4 Node, immutable Image archive restore, Docker ZIP, handler SDK and callback images, IaC, native-reference/platform and full-release gates. See specs/rustack-workflows-93-review.md for the complete exit audit and scope.
Implement task 5.2a and runtime section 2.15. Distinguish saved metadata from ordinary reference preparation, inspect only the saved parent ID, verify the platform/execution fingerprint before effects, and reuse durable supervised pin admission, mutation, unpacked proof and retirement without pull fallback. Thirty-five lease controls and eighteen actual Docker consumers per retained engine pass, including serialized-metadata restore before real RIC execution. Workspace, strict boundaries, Native, audit/deny and text gates pass; independent review has no remaining finding and exact postconditions show zero remnants. Keep provider/main archive rejection until task 5.2b validates and atomically publishes the entire restored candidate. Docker ZIP, Node, handler SDK/callback, IaC, native-reference/platform and the complete M0-M4 release remain required. See specs/rustack-workflows-93-review.md for evidence and qualification scope.
Implement D88 task 5.2b: bounded borrowed export and retained validation, complete private candidates, exact local image lease and fresh-size proofs, and publication under the original startup deadline. Preserve current and previous generations on invalid metadata, failed proof or expired import. Update the English runtime/operations/verification specs and operator guide. Both native-arm64 VZ and emulated-amd64 QEMU full functional gates pass all 53 exact resources (57 Rust passes each), including ordinary save/restart, latest/published-alias computation, workflow history and bad-proof refusal. Workspace, Native, strict boundaries, rustdoc, formatting and security gates pass. Independent review fixes W275-W280 and verifies exact cleanup/source preservation evidence. No dependency or lint-policy waiver is introduced. Docker provided-runtime ZIP, Node, handler SDK/callback images, consuming project/IaC, native-reference/platform and complete M0-M4 release acceptance remain required by specs/rustack-workflows-90-impl-plan.md.
Implement D89 task 5.1a under runtime sections 6.1-6.5: typed immutable ZIP conversion with Linux ELF checks and two retained transfer-buffer slots, fixed TAR upload and bounded local-volume wire operations. Share strict path/type/tree/empty-directory-stream validation with Native staging. Add explicit cross-build/control targets and the real code-volume resource. Both retained native-arm64 VZ and emulated-amd64 QEMU full gates pass all54 exact resources (110 aggregate Rust passes each, including52 pure code controls and4 existing controls). The new resource computes42 from the ZIP through an unstarted RW loader and RO execution, requiring real ownership, modes, kernel EROFS and writable tmp. Workspace, Native, strict boundaries, formatting, rustdoc, audit/deny and text checks pass. Independent review resolves W281-W285 and verifies26 exact cleanup/source-preservation records. Ordinary Docker ZIP remains unavailable pending durable volume ownership and recovery5.1b, startup/provider/invocation5.1c and ZIP archives5.2c. Keep Node, handler SDK/IaC, reference/platform and complete M0-M4 acceptance open. English specs and operator guide document the component and tightened ZIP staging limits; earlier unclassified extra-oracle evidence is preserved.
Add explicit RSDKOWN3 provenance, a bounded canonical code journal, and monotonic historical loader and volume retirement before image pins. Enforce exact identity, non-force loader deletion, complete volume audits and current-run startup exclusion under runtime spec 6.6/D90. Qualify 72 new pure controls and both 55-resource Docker gates, with standard, strict, Native, security, text and independent evidence review. Preserve initial failed observations and reconcile actual build-export source identities. The retained producing owner and ordinary ZIP execution remain required for 5.1b/5.1c and full M4.
Own journaled staging above cancellable observers and failed workers, require exact source-pin affiliation, and retain admission and physical retirement receipts. Poison unclean runtime acquisitions to prevent overlapping producers. Complete task 5.1b against runtime section 6.7 with independent review fixes W289-W294. Verify 46 owner cases, both complete 56-resource Docker lanes, standard and strict Rust checks, Native regression, audit and deny. Exact final observations prove no owned remnants and preserve provisioned sources. Ordinary provided-runtime ZIP startup and invocation (5.1c), ZIP archives (5.2c), and remaining M4 acceptance continue.
Install immutable provided.al2023 startup, provider validation and retained code-stage/environment ownership per runtime 6.8. Publish physical retirement receipts before acceptance, fence provider commits, retain shutdown witnesses and preserve typed admission versus accepted-wire Busy origins. Qualify ordinary signed SDK/ASL, revision/alias behavior and the identical ZIP through real Linux Native children. Both final functional engines pass all63 required resources (263 Rust passes/20 summaries each); full workspace, strict, Native, security and text gates pass. Exact26-command postconditions prove zero remnants, nine actual source IDs preserved per engine and exact owned bridge retirement. Independent W295-W305 findings are fixed and recorded in review93. Task5.1 is complete. Docker ZIP archives5.2c, Node/handler SDK/IaC, server-in-container, native reference/platform and full M0-M4 acceptance remain.
Implement D93 managed original-ZIP archive profiles, raw CBOR and borrowed metadata budgets, retained private staging under the original deadline, and atomic mixed ZIP/Image candidates. Ordinary signed SDK restart and rollback resources qualify task 5.2c on both retained functional lanes. Resolve W306-W314 through independent source and evidence review. Both full gates pass all 65 exact resources with 438 Rust cases each; standard, strict, Native, security and exact zero-remnant/source-preservation checks pass. Move the existing blocking-IO lint allowance to storage.rs extract_zip_to_dir, the actual retained blocking boundary. Node, handler SDK, IaC, server-in-container and remaining reference/platform acceptance remain open.
Replace the prequalification note with completed task 5.2c evidence and explicit remaining M4 scope. Documentation-only correction; 14-file link and whitespace checks pass.
Execute the pinned official Node24 RIC through ordinary signed Rust/boto3 Lambda calls and registered ASL tasks. Qualify filesystem/context/log behavior, published-version and alias isolation after CMD updates, and named errors with fresh replacement and retained published-A warm execution. Extend Runtime HTTP with a narrow bounded X-Ray cause field and eight keepalive connections while retaining four POST body admissions. Transfer owned permits into accepted session envelopes so observer expiry cannot release queued-body capacity. Add deterministic ownership controls and a frozen 66-resource gate. Closes task 5.3a/L02 under runtime section 4.17 and D94 specifications on the retained native-arm64 VZ and emulated-amd64 QEMU functional lanes. Both full lanes pass 482 Rust cases; standard, strict, Native and security gates pass. Exact postconditions preserve ten source IDs per engine and leave zero containers, volumes or private references; only two owned empty bridges retire. Independent source and persisted-evidence reviews are clean. Handler SDK/callback images, IaC, server-in-container, reference/platform lanes and complete M4 release acceptance remain active in the implementation plan.
Bind function-only SDK credentials and canonical endpoints to the exact qualified Docker runtime, retaining pre-create liveness and isolated warm identity. Keep injected values out of revisions, diagnostics and archives. Add pinned default-provider S3/DynamoDB positive and negative consumers, bounded body cancellation and the ordinary four-feature Docker cohort. Qualify all 68 resources on both retained functional lanes, final affected Node/SDK consumers, current workspace/strict/Native/security gates, and exact zero-remnant/eleven-source/owned-bridge postconditions. Preserve reviewed test-owner deltas and all evidence. W324-W332 are fixed/rechecked. Task 5.3b/L10 closes; image callbacks, IaC/server-in-container, native reference/platform lanes and complete M0-M4 acceptance remain active.
Qualify tasks 4.3/5.3c with pinned default-provider Node SDKs, a synchronous dispatcher and independently owned Event worker, attempt-scoped gates, causal timer/retry/Stop observations and bounded confirmed-save privacy audits. Reuse the retained SDK child/server owner and make an existing Ready-expiry test causally deterministic. Both retained functional lanes pass all 70 exact resources and all nine image callback modes under the final 41-source cohort. Standard, strict, Native, dependency and text checks pass; independent review resolves four P2 and seven P3 findings. Exact postconditions preserve twelve source IDs per engine with zero remnants and retire only two owned empty bridges. IaC, server-in-container, reference/platform and final M4 acceptance remain required.
Pin Pulumi v3.273.0 source and document independent plugin process groups, cancellation and retained drains. Define D97 around a managed tool Lambda and real business Lambda, pinned CLI/provider artifacts, actual lifecycle and unsupported-profile checks, distinct encrypted-state audit stages, preview-safe gates and active-plugin Stop ownership. Independent design review resolves W344 and W345. Sixteen-file text/link checks pass. This documentation/reference checkpoint adds no runtime implementation or actual IaC acceptance; task 5.3d and the complete M0-M4 goal remain active.
Land task 5.3d with pinned CLI/core 3.273.0 and AWS provider 7.52.1 inside the managed Image Lambda owner. Independently verify the actual 18-command lifecycle, encrypted/current/removed backend states, fresh business computations, explicit unsupported updates and active-plugin Stop with preservation of the business environment. Add the scoped empty ListStateMachineVersions read required by the real provider, retaining explicit rejection of publication and version/alias mutations. Both final functional lanes pass all 72 exact resources and both focused IaC resources under the same 78-file source seal. Standard, strict, Native, security and text gates pass. Independently reviewed postconditions prove zero remnants, preservation of 13 source IDs per engine and removal of only the two exact owned empty bridges. W344-W364 are fixed and rechecked; specs/rustack-workflows-93-review.md records provenance and failed history. Server-in-container, native-x86/reference performance, Desktop/rootless and complete task 5.4/M4 release qualification remain required. No push.
Polish task 5.3e topology, explicit socket/DNS/volume identities, retained CLI/SDK ownership, actual positive and negative oracles, physical shutdown and final qualification gates before code. Independent review closes W365; design-only text checks pass. Implementation and all actual D98 acceptance remain required.
Land task 5.3e with the actual Linux CLI fixture, explicit daemon-side socket and group, owned data volume, separate internal DNS gateway and loopback SDK origin. Verify real signed SDK results, nested ASL, startup rejection and joined production shutdown without changing the existing Runner or relaxing isolation. Both retained functional lanes pass all 74 exact resources and 535 Rust cases, plus both focused consumers, standard/strict/Native/security/text gates and exact fourteen-source/zero-remnant postconditions under one 103-source seal. Independent source, evidence and documentation reviews close W365-W370 and W376-W377. Default release packaging W371-W375, native-x86/reference/Desktop/rootless, remaining performance/load and complete M4 acceptance remain required. No image publication or push performed.
Polish task 5.4a before implementation: actual root-Dockerfile workflow profile, preserved source defaults and security patch, bounded Action input/process/readiness ownership, public volume configuration and release-container resources. Independent design reviews close W378-W380. W373 promotion and required platform/performance/full-M4 acceptance remain open; no image or executable change has run at this design checkpoint.
Complete task 5.4a/D99 with the actual Step Functions-enabled root images, shared Release server owner, verified filesystem/static ELF artifacts, bounded Action inputs/processes and independent exact resource controls. Preserve source feature defaults and the existing Rust Runner. Fix all 23 in-scope findings and retain failed development evidence. Both sealed-source full76/focused2 lanes, standard/strict/Native/security gates and independent reviews pass. Exact postconditions preserve15 source IDs per engine, leave zero runtime remnants and remove only two owned empty bridges. Record final evidence and operations in the English specs and guide. Record the user's D100 waiver of further Linux x86_64 validation without changing historical QEMU evidence or architecture support. W373 promotion, required arm64/reference/Desktop/rootless, remaining performance/load and full M4 remain open. No publication or push.
Implement D101 verification section 5.2 with locked GNU arm64 SDK/CLI artifacts, direct guest execution, bounded process and metadata ownership, exact inventories, raw measurements, and explicit VM provenance. Remove the performance fixture's unnecessary Native bootstrap dependency. Add Make provisioning/build/measurement targets and thirteen independent controls. Both exact Linux resources, all thirteen host gates, source/artifact checks, readonly resource postconditions and independent reviews pass. Resolve W397-W402 and retain prior captures. Dedicated-reference qualification, image performance/load, Desktop/rootless, W373 and full M4 remain open; D100's waiver of further Linux x86_64 validation remains in force.
Implement D102 and verification 5.3: actual warm/cold Image Lambda measurements, causal log-flood timeout cycles, initialization diagnostics, live Tokio task accounting, bounded Linux owners, immutable image transport and canonical pre-build source retention. Keep English specs and raw qualification/incident evidence aligned. Validation passes: host15, default4224/feature4365, strict1971, Native3078, ARM79 exact resources (565 Rust passes/33 summaries), wrapped Linux3, image21/Linux14 controls, Action26, audit/deny and48 exact final postconditions. Both task bridges are removed with zero runtime remnants and all original source IDs restored/preserved. Record the unproven pre-final flood failure and exact cache-history repair without claiming complete M4. Dedicated-reference, Desktop/rootless, remaining load/correctness and W373 release promotion remain required.
Implement D103 bootstrap ownership, signed version-matched packages, effective delegation and mapped socket attestation. Retain failed owners and add bounded root systemd jobs, fresh-only setup resumption and read-only recovery. Validated 25 offline controls, actual rootless installation and final/repeat attestation, TERM-ignoring root-job retirement, source preservation and text checks with independent review. Full rootless kernel/resource/performance qualification and M4 remain pending; no Rust execution behavior changed.
Complete rootless execution, portable downward CPU limits, inspected socket-free data helpers, restart/archive/recovery/composite consumers, and initialization-owned flood channels. Separate immutable release candidate creation, qualification, evidence packing and explicit promotion. Normalize RIC executable modes independently of the build umask. Frozen source 83b25711eadbd18016687c6ee7af01118e5bb87528aa269ea143a416da123af9 passes all 15 Rust gates, 245 Python controls, complete Native/Action and 83 rootless resources. Independent code/evidence review is clean; original failures and scoped cleanup receipts are retained in the execution ledger. The current rootful rerun is blocked before dispatch by unowned containers and the reshape-lambda-cargo volume. Desktop and dedicated ARM reference qualification remain required; D100 waives further x86 execution. Full M4 and publication remain open; no remote CI or registry push was performed.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Run pinned upstream pytest bodies and AWS snapshots against owned Rustack servers and six real Python RIC images. Preserve exact inventories, bounded fixture/process ownership, unchanged baselines and failure evidence. Correct observed history, role capture, INLINE aliases, optimized Payload, function-error Cause, timeout fields and integer-zero semantics. Independent reviews W438-W446 and current-source verification pass: 15 Rust gates, 3121 Native tests, 26 Action controls and 13 adapter controls. Original pure 88/91 and Docker 30/32 remain explicitly nonzero: three formal ASL profile differences and two static service-Cause differences are retained. Strict compatibility acceptance and complete M4 release qualification remain open. See the LocalStack study and spec61 for evidence and exact limits.
Close the five original LocalStack snapshot differences: recursively format map/list values, accept ordinary literal braces, parse empty JSON text as null, and report scoped missing Lambda targets with fresh local service request IDs. Preserve byte/work/depth bounds, redaction and owned cancellation/cleanup. D114 updates the English specs and observed-behavior contract. The original 91 pure and 32 Docker nodes all pass with unchanged expectations and masks. All 15 Rust gates, 3231 Native passes, 26 Action controls and 13 adapter controls pass under one frozen source, with independent code/evidence review and joined resource cleanup. Historical failed cohorts remain intact; broader M4 release qualification is still separate.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Other projects need to test real Lambda handlers and state machines against Rustack through ordinary AWS SDKs. This adds an owned ASL execution engine and Docker Lambda runtime, so workflows execute deployed function code and expose actual results and history.
The change includes:
.sync/.sync:2, and.waitForTaskTokencallbacks with heartbeat handling.Step Functions is feature-gated; Docker execution requires explicit operator configuration. Unsupported ASL and integrations are rejected according to the documented compatibility profile.
The pinned LocalStack compatibility lane executes original pytest bodies and AWS
snapshots against an owned Rustack process and six real Python RIC images.
D114 closes all five previously observed differences: collection Format,
ordinary literal braces, empty JSON parsing and qualified missing-Lambda Cause
text. Existing byte/work/depth limits, redaction and cleanup ownership remain.
D114 compatibility-cohort validation (
63ef18b):Lambda. Original test bodies, expected snapshots and assertion masks are
unchanged; no selected node is removed, skipped or xfailed.
formatting, Clippy, rustdoc, strict boundaries, audit and deny.
and 13 adapter integrity controls pass; all recorded command owners join.
original assertions, source/binary/image/report hashes and successful physical
cleanup. Test containers, volumes and private aliases are absent; images and
evidence are retained, and foreign resources are preserved.
The D114 evidence ledger
records the frozen source, actual commands/results, immutable handler packaging,
raw report hashes, prior failed cohorts and independent review. The English
compatibility contract
and workflow guide document observed behavior and reproduction targets.
This qualifies the selected original inventory with its existing upstream field
exclusions. It does not establish full AWS parity, the entire LocalStack suite,
fresh live AWS observations, managed Python ZIP packaging or ECR lifecycle APIs.
Missing-service request IDs are local integration identities; successful
invocation metadata retains actual provider IDs.
Earlier complete rootful/rootless ARM 83/83 matrices remain qualification
of their recorded source cohort, not a current-source full-matrix rerun. Their
original records remain in the consumer ledger.
Docker Desktop, a dedicated physical ARM reference and a complete same-commit
release bundle/final M4 acceptance remain open. D100 waives further Linux x86_64
execution. Release publication and merge remain pending.
CI follow-up (
c234d30):[0,0,2,3], matching D113 and the observed AWS history. All event, ID, payload and pagination assertions remain.make fmt-check, consumed by the recorded Rust gate, checks both formatters.149b5213ad568eb151cd8896f1f9214ec70b2d04c2ea9e6e6e21f165529afa63.The original123-node compatibility results above retain their D114 source binding; this CI follow-up does not rebind historical image/platform receipts.