Repository navigation
Harden Codex recovery and stabilize recovery tests - #902
Merged
Merged
Conversation
…tinue # Conflicts: # src/components/TerminalView.tsx # src/lib/test-harness.ts # test/e2e-browser/helpers/test-harness.ts # test/unit/client/components/TerminalView.lifecycle.test.tsx
danshapiro
added a commit
that referenced
this pull request
Nov 5, 2026
Scenario 8 resolution: keep the gated-contract rewrite (the active resume gate answers the typed SESSION_MISSING refusal) and adopt main's deflake assertions — the pane-identity buffer lookup (getPaneTerminalBuffer) with the exactly-one-notice poll and the dead-dialog absence. The duplicate DEAD_SESSION_BUFFER_NOTICE declaration (both sides added the same constant) deduplicated to the documented one.
danshapiro
added a commit
that referenced
this pull request
Nov 6, 2026
Reconciles this branch's send-driven codex recovery (gc1p B1), grant-time settings composition (A1), and typed redacted open-failure diagnostics (C) with #902's native-readiness receipt architecture and hardened Codex recovery, which landed on main while this branch was in review. Design of the union: - ActorError keeps the field-name payload variant (this branch) alongside #902's typed fact variants (NativeProfileMismatch/NativeSessionIdentity- Mismatch/NativeReadinessRecoveryFailed); #902's fieldless raise sites now carry the honest empty field set via the identity_mismatch constructor. - map_fresh_agent_open_error maps every variant into the closed wire diagnostic, deriving only mismatched field NAMES from #902's structured facts (native_profile_mismatch_names); profile_mismatched_fields is retired (superseded by #902's NativeProfileFieldMatches); the readiness provider-start failure stays an open failure (FreshAgentOpenFailed code, unclassified subtype) per #902's pinned expectations. - RuntimeError/ClientError carry both additive diagnostics (fresh_agent_open_failure + fresh_agent_send_diagnostic), both with the skip-when-absent wire attribute. - The managed-send refusal path keeps #902's HostedSendOutcome Accepted/Refused/Ambiguous model with this branch's typed closed-enum refusal codes riding the Refused arm (send_refusal_code), including the explicit UnknownSoul arm (a registry pre-admission refusal has no delivery ambiguity). - The FreshAgentPrepareNative handler runs #902's launch-aware receipt transaction first; when the transaction cannot apply to the send- recoverable codex class (dead native, intact durable actor), the handler answers this branch's honest no-identity verdict instead of aborting — an authorized recovery that CAN run keeps the full transaction. The supervisor's codex readiness arm passes the launch+fence (bound via bind_native_identity_launch). - Grant-time composition stays this branch's rule (the folded recovery profile governs; the stored spec fills only ungoverned fields) with #902's codex cwd exception folded into the ungoverned branch (the resume cwd is store-selection evidence); apply_fresh_agent_resume_profile delegates to the one composition rule; the two contract tests were reconciled to the merged rule (an opencode first-ever resume carries no committed native identity; a first-ever codex resume keeps the launch cwd). - The observer classification and edge-triggered event (this branch) are untouched; #902's readiness machinery composes around them. The process-global FAKE_CODEX_APP_SERVER_BEHAVIOR channel gained a dedicated behavior lock (boots hold it across set-and-exec; this branch's mid-body mutator holds it across its body) so a fixture boot can never exec with another test's behavior. - The parity crash case adopts #902's host-pause scenario (the kata's literal whole-host-loss incident, now recovered through the receipt architecture) with this branch's archived-byte immutability re-hash and archive diagnostics in the retained incidents; the live-host send-recoverable scenario remains covered by the supervisor/session-host classification, admission, send-guard, and (b)-side-reach unit tests, with a parity-level live-host case recorded as a follow-up. - The wjwa readiness wait keeps the production verb (no sleeps), adapted to the launch-aware signature; #902's 10ms poll loop is not reintroduced. Verified on the merged tree: agent-runtime 177/0, supervisor 584/0/20 at --test-threads=8, session-host bin 382/0/3 at --test-threads=8, the full installed parity crash case green, and the managed-runtime-v1 feature lane compiling.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Codex recovery could fail after its saved native session disappeared, while recovery and browser tests could time out on stale fixtures or observe the wrong terminal. This change recovers only after confirming the exact missing session, preserves the replacement identity across restarts, and makes the affected tests wait for and verify the intended state.
The change also preserves session names through lifecycle retries, handles upgrades from existing schema layouts, and bounds supervisor dispatch stack use. On platforms where the old process tree cannot be verified as stopped, recovery fails closed.
Validation on commit
102a0ef4:pnpm run checkpassed: four cloud client shards, local server integration, source-runtime, Rust workspace, provider recovery, and Electron tests.102a0ef4, with retries disabled; their original intermittent failures remain unexplained.0be1731bounds the session-host grant stack after a GitHub runner overflow. Its full session-host suite and a 1 MiB stack regression passed; the normal pre-push gate passed.