Repository navigation
fix(supervision): stabilize grace probes and exited-group cleanup - #60
Conversation
The fake ps stub now inspects the caller's process group and logs the parent pid to a separate file when the call comes from the supervised group, so the test can tell group-scoped inspection apart from other invocations. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
The observed host test now reads the child process inspection log and checks that the child performs at most one process-group inspection before TERM, while the supervisor grace probe count is adjusted to 100. This separates the optional child probe from the supervisor's bounded TERM grace period so the assertion reflects the intended behaviour. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
The SIGKILL handling for a jailed process group now lives in a kill_jail_group helper so the ESRCH and error paths can be exercised directly. Tests cover the permission-error case, asserting cleanup succeeds once the group is gone and still fails while it is alive. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Darwin can deny signalling a process group that exited between inspection and SIGKILL, so kill_jail_group now checks whether the group still has live members before reporting the EPERM as a failure. Tests cover the empty-group case alongside the existing ESRCH handling. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Log Docker startup and container listing errors to stderr to aid diagnosis of failures in the oneshot path. The logging is marked as temporary and should be removed once the underlying issue is understood. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
The docker tests now share a write_fake_cli helper that writes the script and marks it executable, replacing the repeated permission boilerplate. Debug eprintln calls were dropped from the oneshot error paths, and a new test covers running a fixture while an inherited script writer is still open. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
The fake Docker CLI is now a symlink to a fixed launcher script that sources the generated body, so a concurrently forked process holding a writer open no longer makes the script unexecutable. The README also documents that JailLocalHost rechecks the process table when a jailed group exits before SIGKILL. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Relocate the test module declaration to the bottom of the file so the production code reads without an interruption. No behaviour change. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Reword the doc comment and inline comment on the fake CLI fixture helpers to describe publishing through an immutable launcher and confirming execution before the test starts, keeping the existing ETXTBSY retry contract. Auto-committed-on: dragonfly Co-authored-by: Medulla <medulla@tinyhumans.ai>
Tiny Sweeper reviewThis pull request stabilizes supervision cleanup in three areas. First, the jailed-process group SIGKILL is extracted into a testable kill_jail_group helper that accepts an EPERM error only after a fresh process-table probe confirms the group has no live members, keeping cleanup unacknowledged when live members remain or the probe fails. Second, the Docker test fixture is rewritten to launch through an immutable symlinked fixture script (docker-cli.sh) that sources a generated body as data, so inherited writers on the script body can no longer cause execution failures, plus a new test covering execution while a writer is open. Third, the SSH supervisor test's fake ps is refined to separate supervisor grace probes from a child's own optional group inspection, tightening the call-count assertions. The limited-mode README documents the new exited-group cleanup behavior. No reporting lane raised a blocking defect. The tests lane confirmed the helper's branches are pinned; residual unverified concerns include whether docker-cli.sh's sourcing of $0.script behaves correctly in every fake-CLI scenario, and the description lane raised unsettled compile questions about the alive closure's FnOnce bound and the symlink API call site. State: Incomplete Review snapshot
Completeness: Incomplete Features
Tests
FindingsNo active actionable findings. Could not review: crates/tinybox-host/src/limited/jailed.rs, crates/tinybox-host/src/limited/jailed_tests.rs, crates/tinybox-module/src/tinybus_module/docker_tests.rs, crates/tinybox-module/tests/fixtures/docker-cli.sh, crates/tinybox-ssh/src/host/observed_tests.rs Before merge
How this fits togetherflowchart LR
n0["failure<br/>changed"]:::changed
n1["terminate<br/>changed"]:::changed
n2["..._for_or_cancel_an_active_jailed_execution<br/>changed"]:::changed
n3["...quest_rejects_an_ambiguous_workspace_path<br/>changed"]:::changed
n4["..._grace_period_when_group_inspection_fails<br/>changed"]:::changed
n5["Result"]:::impacted
n6["io"]:::impacted
n7["output"]:::impacted
n8["Error"]:::impacted
n9["...ps_the_owned_group_after_its_wrapper_dies"]:::impacted
n0 -->|uses| n8
n1 -->|calls| n0
n1 -->|uses| n5
n1 -->|calls| n6
n2 -->|uses| n5
n2 -->|uses| n8
n3 -->|uses| n5
n3 -->|uses| n8
n4 -->|uses| n5
n4 -->|calls| n6
n4 -->|uses| n6
n4 -->|tests| n6
n4 -->|calls| n7
n4 -->|tests| n7
n5 -->|uses| n8
n6 -->|uses| n8
n7 -->|uses| n5
n7 -->|calls| n6
n7 -->|uses| n6
n7 -->|uses| n8
n9 -->|uses| n5
n9 -->|calls| n6
n9 -->|tests| n6
n9 -->|calls| n7
classDef changed fill:#0d4429,stroke:#238636,color:#e6edf3
classDef impacted fill:#161b22,stroke:#6e7681,color:#c9d1d9
classDef flagged fill:#5a1e02,stroke:#d93f0b,color:#ffffff
classDef blocking fill:#67060c,stroke:#f85149,color:#ffffff
Agent review detailscritique
security
tests
commits
description
Evidence and run details
|
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: tinysweeper/description.
$0.0098 · 621,481 in / 117,523 out · 84,736 cached (14%) · ladder/vectors-oai3, deepseek-v4.1-flash, glm-5.3-flash · 477 embedded
critique: $0.0033 · 288,470 in / 33,761 out · 23,552 cached (8%) · deepseek-v4.1-flash
security: $0.0051 · 247,851 in / 66,410 out · 56,192 cached (23%) · deepseek-v4.1-flash
tests: $0.0009 · 60,782 in / 10,346 out · 2,944 cached (5%) · deepseek-v4.1-flash
description: $0.0004 · 19,553 in / 4,889 out · 2,048 cached (10%) · deepseek-v4.1-flash
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinybox-module/src/tinybus_module/docker_tests.rs, crates/tinybox-module/tests/fixtures/docker-cli.sh, crates/tinybox-ssh/src/host/observed_tests.rs.
$0.0050 · 509,146 in / 69,298 out · 151,424 cached (30%) · ladder/vectors-oai3, deepseek-v4.1-flash, · 477 embedded
critique: $0.0028 · 214,007 in / 40,170 out · 71,680 cached (33%) · deepseek-v4.1-flash,
security: $0.0018 · 210,897 in / 25,469 out · 64,896 cached (31%) · deepseek-v4.1-flash
tests: $0.0000 · 38,435 in / 573 out · 4,480 cached (12%) · deepseek-v4.1-flash
description: $0.0001 · 33,636 in / 880 out · 10,368 cached (31%) · deepseek-v4.1-flash
There was a problem hiding this comment.
tinysweeper found nothing blocking, but could not review everything, so this is not an approval: crates/tinybox-host/src/limited/jailed.rs, crates/tinybox-host/src/limited/jailed_tests.rs, crates/tinybox-module/src/tinybus_module/docker_tests.rs, crates/tinybox-module/tests/fixtures/docker-cli.sh, crates/tinybox-ssh/src/host/observed_tests.rs.
$0.0028 · 427,009 in / 37,223 out · 96,640 cached (23%) · ladder/vectors-oai3, deepseek-v4.1-flash · 477 embedded
critique: $0.0019 · 163,950 in / 27,392 out · 54,528 cached (33%) · deepseek-v4.1-flash
security: $0.0005 · 184,713 in / 6,468 out · 33,920 cached (18%) · deepseek-v4.1-flash
tests: $0.0000 · 36,537 in / 546 out · 3,968 cached (11%) · deepseek-v4.1-flash
description: $0.0000 · 21,822 in / 566 out · 4,224 cached (19%) · deepseek-v4.1-flash
The SSH supervisor grace-period fixture combined 100 mandatory supervisor probes with an optional child probe interrupted by TERM. Count them separately while preserving the exit-status and cleanup assertions.
CI exposed two additional blockers: generated Docker executables can fail with
ETXTBSYwhen concurrent forks retain a script writer, and jailed cleanup on macOS can rejectEPERMafter the process group has already exited. Docker fixtures now use an immutable launcher that sources generated commands. Jail cleanup acceptsEPERMonly after a fresh process-table probe confirms no live members; live groups and failed probes still fail cleanup.Public APIs: None. Behavior: jailed cleanup acknowledges an already-exited process group after confirmed inspection, matching the existing local supervisor. No dependencies, release changes, or host gitlink changes.
Validation:
cargo fmt --all -- --check,cargo clippy --all-targets --all-features -- -D warnings, andcargo build --all-targets --all-featurespassed.cargo test --all-featurespassed, including doctests, on rerun. The first run hit the existing SSH TERM-escalation fixture’s 10-second timeout under host load; that test passed unchanged in isolation and in the complete rerun.Follow-up to #53; supports tinyhumansai/openhuman#7391 under tinyhumansai/openhuman#7390.