starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-24 00:04:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(orchestration): record migrated authority fencing

Browse Source
This commit is contained in:
Brennan Benson
2026-08-27 17:25:50 -07:00
parent fed8727f48
commit b78f65b655
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/reliability-gates.jsonc
+5 -3
View File
@@ -11891,7 +11891,7 @@
"providers": ["local", "daemon", "ssh", "wsl", "remote-runtime"],
"coveredPlatforms": ["macos"],
"coveredProviders": ["local", "daemon", "ssh"],
"coverageNotes": "A deterministic isolated runtime/SQLite/RPC harness covers Run and Dispatch ownership, exact handle and remint-stable pane recipients, fixed Delivery replay and acknowledgment, restart, concurrent pollers, filtered waiters, and built-CLI parity with direct DB state. Schema v28 durably records every coordinator handle through SQLite triggers, backfills current handles on open, recreates routing triggers after old table rebuilds, and atomically canonicalizes coordinator-addressed inserts to run:<id>. Schema v31 adds coordinator process incarnation, execution-host scope, and an authority revision; tests refuse live and unverifiable replacement, preserve generation and pending Delivery identity for the same process after handle/pane remint, permit only owning-host-proven exit takeover, fence a stale concurrent takeover observation, and clear stale authority when an older runtime changes only v30 binding columns. A 125-row oracle and 151-row reconciliation suite cover paged old-handle backlogs, commit-without-notify recovery, duplicate Dispatch owners, cancellation, and lifecycle fencing. Federation tests use real databases, dropped acknowledgments, restart/reconnect, and protocol v1/v2 peers; duplicate read rows do not wake again. Daemon and SSH pointer settlement is deterministic, with SSH bounded at 60 seconds beyond the 20-second mux health window. RPC changes are additive optional response fields; no stream opcode changed. Live headed/headless paired-runtime, physical SSH, WSL, Linux, and Windows acceptance remain gaps.",
"coverageNotes": "A deterministic isolated runtime/SQLite/RPC harness covers Run and Dispatch ownership, exact handle and remint-stable pane recipients, fixed Delivery replay and acknowledgment, restart, concurrent pollers, filtered waiters, and built-CLI parity with direct DB state. Schema v28 durably records every coordinator handle through SQLite triggers, backfills current handles on open, recreates routing triggers after old table rebuilds, and atomically canonicalizes coordinator-addressed inserts to run:<id>. Schema v31 adds coordinator process incarnation, execution-host scope, and an authority revision; tests refuse live and unverifiable replacement, require runtime-attested restored-process continuity before backfilling a migrated revision -1 row, fence attestation loss during that bind, preserve generation and pending Delivery identity for the same process after handle/pane remint, permit only owning-host-proven exit takeover, fence a stale concurrent takeover observation, and clear stale authority when an older runtime changes only v30 binding columns. A 125-row oracle and 151-row reconciliation suite cover paged old-handle backlogs, commit-without-notify recovery, duplicate Dispatch owners, cancellation, and lifecycle fencing. Federation tests use real databases, dropped acknowledgments, restart/reconnect, and protocol v1/v2 peers; duplicate read rows do not wake again. Daemon and SSH pointer settlement is deterministic, with SSH bounded at 60 seconds beyond the 20-second mux health window. RPC changes are additive optional response fields; no stream opcode changed. Live headed/headless paired-runtime, physical SSH, WSL, Linux, and Windows acceptance remain gaps.",
"motivatingLinks": [
"https://linear.app/stably/issue/STA-5729",
"https://linear.app/stably/issue/STA-4325",
@@ -11952,6 +11952,8 @@
"assertions": [
"a live incumbent rejects a distinct coordinator with no effects",
"refuses replacement when a migrated incumbent is not provably exited",
"does not grant a migrated binding to a replacement incarnation on the same handle",
"backfills an exact migrated handle only from restored process authority and fences mid-bind attestation loss",
"backfills a migrated binding when a reminted handle resolves to the same process",
"same-process handle and pane remint preserves Run authority",
"does not grant Run authority to a replacement process in the same pane",
@@ -12113,7 +12115,7 @@
"command": "pnpm exec vitest run --config config/vitest.config.ts src/main/runtime/orchestration/run-coordinator-authority-migration.test.ts src/main/runtime/orchestration/orchestration-run-delivery-db.test.ts src/main/runtime/orca-runtime-process-incarnation-liveness.test.ts src/main/runtime/rpc/methods/orchestration-runs.test.ts src/cli/handlers/orchestration-run-cli.test.ts src/main/ipc/pty-controller-process-inventory.test.ts src/cli/handlers/orchestration-gate-cli.test.ts src/main/runtime/rpc/methods/orchestration-gates.test.ts src/main/runtime/rpc/methods/orchestration-gate-run-authorization.test.ts",
"result": "passed",
"durationSeconds": 5.42,
"summary": "The focused Run-authority gate passed 91/91 across schema migration and mixed-version writes, Delivery fencing, owning-host liveness and deadlines, coordinator lifecycle, and CLI recovery inspection. Seven new authority regressions first failed deterministically before their fixes; the broader orchestration, RPC, and CLI suite then passed 1,129/1,129."
"summary": "The final focused Run-authority gate passed 95/95 across schema migration and mixed-version writes, restored-process attestation and race fencing, Delivery fencing, owning-host liveness and deadlines, coordinator lifecycle, and CLI recovery inspection. Nine authority regressions failed deterministically before their fixes; the broader orchestration, RPC, and CLI suite passed 2,405 tests with one skipped."
},
{
"date": "2026-08-13",
@@ -12162,7 +12164,7 @@
},
"redGreenEvidence": {
"status": "complete",
"evidence": "The byte-identical five-test STA-4325 oracle (SHA-256 76a2d672d27e04e5b1db2f52df3b303468bdf006be7cfd003bf443618a856c35) failed 5/5 on reported v1.4.180 commit 0b62333cf179 and latest origin/main 9bb8836bb6, then passed 5/5 on its final candidate. For STA-5729, seven added regressions failed before implementation: same-pane process replacement mutated, an incarnation-less live coordinator was reported exited, an unbound migrated Run was stranded, a concurrent binding waiter was not cancelled, explicit headless Run inspection failed, and targeted-local plus aggregate-local provider inventory dropped caller deadlines; all seven passed after the authority, liveness, waiter, CLI, and deadline fixes, followed by the 1,129-test orchestration suite. Live topology coverage remains a separate promotion gap."
"evidence": "The byte-identical five-test STA-4325 oracle (SHA-256 76a2d672d27e04e5b1db2f52df3b303468bdf006be7cfd003bf443618a856c35) failed 5/5 on reported v1.4.180 commit 0b62333cf179 and latest origin/main 9bb8836bb6, then passed 5/5 on its final candidate. For STA-5729, nine added regressions failed before implementation: same-pane process replacement mutated, an incarnation-less live coordinator was reported exited, an unbound migrated Run was stranded, a concurrent binding waiter was not cancelled, explicit headless Run inspection failed, targeted-local plus aggregate-local provider inventory dropped caller deadlines, and a migrated exact-handle row accepted replacement or stale restored authority; all nine passed after the authority, liveness, waiter, CLI, deadline, provenance, and revalidation fixes, followed by the 2,405-test orchestration suite with one skip. Live topology coverage remains a separate promotion gap."
},
"performanceBudget": {
"required": true,