116 lines
4.7 KiB
Markdown
116 lines
4.7 KiB
Markdown
|
---
|
||
|
|
model: openai/gpt-6.1-sol
|
||
|
|
service: opencode
|
||
|
|
timestamp: 2026-09-29T22:22:13Z
|
||
|
|
git_ref: 68e9c49f
|
||
|
|
scope: tests
|
||
|
|
substantive: true
|
||
|
|
raw_file: 20260929T222213Z_68e9c49f_shielded_peer.raw.md
|
||
|
|
---
|
||
|
|
|
||
|
|
## Prompt
|
||
|
|
|
||
|
|
Implementation-purpose summary, not a verbatim human prompt:
|
||
|
|
|
||
|
|
Implement only the approved shielded-child/stalled-IPC followup
|
||
|
|
in the existing `ipc_fault_regressions` worktree. Add a seventh
|
||
|
|
case with both parent context directions stalled, a child task
|
||
|
|
shielding outer cancellation, and usable subactor control IPC.
|
||
|
|
Prove readiness, received cooperative cancellation, finite budget
|
||
|
|
expiry, runtime SIGKILL and parent OS reaping. Preserve existing
|
||
|
|
six-case semantics, user-owned files, index and Git history.
|
||
|
|
|
||
|
|
## Response summary
|
||
|
|
|
||
|
|
`probe_peer()` optionally enters `trio.CancelScope(shield=True)`
|
||
|
|
before `Context.started()`. Its stdout event later observes both
|
||
|
|
`Actor._cancel_called` and cancelled outer `Context._scope` while
|
||
|
|
the inner shield remains uncancelled. No production instrumentation
|
||
|
|
is needed: `Actor.cancel()` calls `Actor.cancel_rpc_tasks()`, whose
|
||
|
|
`Actor._cancel_task()` cancels `Context._scope` and waits for RPC
|
||
|
|
completion. The inner shield prevents that completion.
|
||
|
|
|
||
|
|
`root_main()` stalls both OOB context directions, completes a
|
||
|
|
control RPC using untouched `staller_ptl`, and reports its finite
|
||
|
|
`Portal.cancel_timeout`. The external monitor sends actual SIGINT
|
||
|
|
only after both parked-operation and child-shield readiness.
|
||
|
|
The seventh case requires the child's pending-cancel observation,
|
||
|
|
runtime cancel-ack timeout and hard-reap logs, SIGKILL status and
|
||
|
|
existing parent `os.waitpid()` proof before watchdog cleanup.
|
||
|
|
|
||
|
|
## Files changed
|
||
|
|
|
||
|
|
- `examples/advanced_faults/ipc_stalls.py`: seventh mode, child
|
||
|
|
shield and evidence, control usability check, mode documentation.
|
||
|
|
- `tests/test_ipc_stalls.py`: seventh parameter, CASE explanation,
|
||
|
|
event ordering checks and mode-specific hard-reap expectations.
|
||
|
|
- This new structured provenance pair; previous records untouched.
|
||
|
|
|
||
|
|
## Verification
|
||
|
|
|
||
|
|
Interpreter:
|
||
|
|
|
||
|
|
`/home/goodboy/repos/tractor/wkts/ib_disconnect_cleanup/py313/bin/python`
|
||
|
|
|
||
|
|
Trio version: `0.34.0`. Import probe confirmed `tractor` resolves
|
||
|
|
inside `ipc_fault_regressions`. Per-process `PYTHONPATH` entries:
|
||
|
|
|
||
|
|
1. `/home/goodboy/repos/tractor/wkts/ipc_fault_regressions`
|
||
|
|
2. `/home/goodboy/repos/tractor/wkts/ib_disconnect_cleanup/py313/lib/python3.13/site-packages`
|
||
|
|
3. `/nix/store/l59n6vzkswz23y6s4pr6cmv2p4dpd5f0-python3.13-numpy-2.4.4/lib/python3.13/site-packages`
|
||
|
|
|
||
|
|
`PYTHONDONTWRITEBYTECODE=1`; no installed dependencies changed.
|
||
|
|
|
||
|
|
First run:
|
||
|
|
|
||
|
|
`python -m pytest tests/test_ipc_stalls.py -q -p no:tractor._testing._reap`
|
||
|
|
|
||
|
|
Result: **7 passed in 14.21s**, no skips or failures.
|
||
|
|
|
||
|
|
Second run, in a fresh process:
|
||
|
|
|
||
|
|
`tests/devx/test_tooling.py::test_shield_pause`
|
||
|
|
|
||
|
|
Flags: `-q -p no:tractor._testing._reap --spawn-backend=trio`.
|
||
|
|
Result: **1 passed, 1 warning in 2.65s**, no skips or failures.
|
||
|
|
The warning was `PytestAssertRewriteWarning` because the in-memory
|
||
|
|
launcher imported `tractor._testing` before `pytest.main()`.
|
||
|
|
|
||
|
|
The tooling fixture's `mk_cmd()` normally uses bare `python` and
|
||
|
|
launches an example with a default registry. An in-memory override
|
||
|
|
used the specified absolute interpreter and `runpy.run_path()`;
|
||
|
|
it bound `tractor.open_nursery` with `functools.partial` to a unique
|
||
|
|
`get_rando_addr('uds')` address and `ensure_registry=True`. No test
|
||
|
|
or example file was changed for this existing tooling invocation.
|
||
|
|
Only the tooling test's owned process handles were signalled.
|
||
|
|
|
||
|
|
`git diff --check` passed. Source lines follow the 69-column style.
|
||
|
|
|
||
|
|
## Human contributions
|
||
|
|
|
||
|
|
The human endorsed the shielded-child/stalled-IPC followup with
|
||
|
|
"right, exactly what i was thinking" and "sounds good lfg!", then
|
||
|
|
asked to "gen me a handoff for an agent there to review from your
|
||
|
|
work." Detailed implementation constraints came through internal
|
||
|
|
agent delegation; they are not verbatim human instructions.
|
||
|
|
No direct manual source edits during this interaction were observed.
|
||
|
|
Acceptance remains with the human.
|
||
|
|
|
||
|
|
Internal agent delegation text was originally mislabelled as human
|
||
|
|
instruction; corrected during review. The private original is
|
||
|
|
retained under ignored review runtime at
|
||
|
|
`.claude/review_replies/shield_review5/`.
|
||
|
|
|
||
|
|
## Proof limits
|
||
|
|
|
||
|
|
This exercises test-owned Trio task resistance to outer cancellation
|
||
|
|
with cancellable parent-side transport waits, Linux, TCP context
|
||
|
|
IPC and the Trio spawner. It does not model an uninterruptible
|
||
|
|
kernel syscall, full socket buffering, packet loss or half-open TCP.
|
||
|
|
Budget expiry is evidenced by the production cancel-ack timeout
|
||
|
|
diagnostic; no synthetic send-deadline metric is claimed for this
|
||
|
|
usable-control-channel case. Both existing and new assertions run
|
||
|
|
before failure-only external watchdog rescue.
|
||
|
|
|
||
|
|
No core runtime gap was observed. Production runtime is unchanged.
|