Repository navigation
ci: attribute the separate-UID SDK relay child deadline failure #2315
Description
Out of scope
No increase to the existing 20-second per-turn or five-second cancellation limits, skipped native proof, weakened identity/credential/cancellation assertions or production change. #2202's non-blocking unavailable-Send ruling does not classify this different native SDK failure.
Observation
While qualifying #2172 plus the prepared #2313 fixture isolation, the complete offline separate-UID proof fails before reaching that changed fixture. The governed SDK relay child in packages/ui-backend-claude/tests/sdk-host-relay-identity.native.ts:10-15 exits143; its parent has a 25,000-ms child deadline. Its stderr contains four expected SDK tool-shadow warnings and no underlying error. The preceding 24 identity cases and 13 egress controls pass. All owned workers, records and source directories clean up. The earlier unchanged SDK cells passed both on candidate fb7d3166d and direct main dcc09e9c8; those controls do not explain this failure.
The child runs four real SDK turns, including resumed inference, host credential refresh and cancellation. Its current final JSON is emitted only after all turns complete, so this failed receipt does not identify the interrupted phase or establish why it took too long. A strict typecheck was running concurrently on the shared host; resource contention is only a hypothesis. Bun1.4.3, existing pinned native image and helper, external network disabled.
Verified cause and selected correction
A main-based diagnostic with bounded phase observations reproduces exit143/SIGTERM under the original 25-second parent deadline. Turns0/1/2 complete at 6,733/13,558/20,431ms. Turn3 reaches refresh cancellation at 22,755ms; the parent terminates it before that turn can finish under its existing limits.
A controlled comparison changes only the outer profile allowance and retains every existing inner limit/assertion. Both real separate-UID SDK profiles pass: governed finishes at29,926ms and strict at29,939ms. The final turn's cancellation/cleanup takes about4.5seconds. No per-turn 20-second limit is exhausted. The parent was applying one turn's25-second allowance to four sequential turns, rather than exposing a failing identity, refresh or cleanup assertion.
Compose the profile deadline from the existing four turns times the existing20-second turn plus5-second cancellation allowance (100seconds total). Share these constants between the child and both full-profile callers; retain25seconds for single-turn controls and the original inner limits. Give the Bun wrapper enough time to observe its owned child exit. Keep bounded phase/exit/signal observations for future failures. The audit finds the same four-turn mismatch in the shared-UID caller. No product timing or policy changes.
The comparison subsequently reaches #2313's fresh-store implementation and exposes its separate top-level mount prerequisite; it is not claimed as a passing complete native suite.
Acceptance criteria
- Retain this failed receipt and its exact source/environment identity.
- Attribute a reproduced failing deadline to an observed phase and causal condition before selecting a correction.
- Any correction has a named failing/restored control and complete native proof without weakening the existing behavioral assertions.
- Record passing controls and unresolved boundaries honestly; selected hosted proof remains required for delivery.
Verification and contract impact
Use the existing loopback-only separate-UID SDK fixture, with finite diagnostic attempts and zero owned-resource residue. No API or product-contract change selected. Found during #2172; related to #736's deterministic verification outcome, standalone by reference at its native-child limit.
2026-10-17: reproduction and phase attribution resolve the missing causal evidence. Selected the composed full-profile budget correction; complete candidate verification remains pending.
Resolved dependency: #2382 (delivered together in #2384).
Local correction and verification before hosted confirmation
Implementation: PR #2384.
2026-10-18: candidate 20028ce746ae7f0ac300a94d9731169498e1f79e, tree d5c8e524e7547762fb219673580dd4c87761700f, on branch test/2315-relay-profile-budget-n7v4, implements the scoped SDK and application-parent corrections together. Branch base is main 82a64a13a08c44f2daef425d1a9df2c10840ea8e; later main 63fde3c8fe76e754aa4524f95b23f9786f4447fe changes only browser shard measurements and is not represented as a tested combined tree.
The complete unchanged offline command now passes in 324.81 seconds on the pinned image. All 27 identity controls, 13 egress controls, 20 checkpoint-reader controls, both complete separate-UID SDK profiles, actual Btrfs manager proof, all four application phases and both prepared-consumer modes pass. Application phase receipts are controls 56,016.80 ms, fresh 38,738.48 ms, warm 46,166.67 ms and strict 34,654.66 ms. The parent allows 365,000 ms derived from four 90,000 ms phases and 5,000 ms cleanup; the containing command preserves its existing allowance plus the added sequential application/SDK allowances. Individual limits and assertions are unchanged.
Cleanup is successful in the fixture and outer driver: no owned records, source directories or workers, no mounted filesystem/backing attachment/backing file, no retained loop device, and the owned container is removed. The earlier failed application's in-fixture cleanup remains failed. Its forced container removal detached the backing but retained an empty kernel loop device; the first corrected attempt correctly refused that prerequisite. After checking the original ownership receipt, no other containers and no attachment, an exact-inode-bound removal cleaned up only that owned empty device. The recorded passing command starts from the restored prerequisite; the refusal guard is unchanged.
The original SDK 25-second mutation still fails the real nonzero-child-exit assertion after three complete turns and entry to turn 3, and is restored byte-for-byte. The original 180-second application failure remains its failing-first receipt. A phase-inventory mutation drops strict and fails the named assertion; restored selector/variant tests pass 6 tests / 115 assertions. The focused selector/collector/citation batch passes 49 tests / 151 assertions; the final citation audit passes 44 tests / 113 assertions. Strict types pass in 100.88 seconds with the repository's 4 GB Node setting. Required bun run check:pr --base origin/main passes in 228.46 seconds: all lint/metadata gates, 956 fast tests / 6,328 assertions, and 11 affected tests / 158 assertions, with no failures or skips. The comparison records origin/main 63fde3c8fe76e754aa4524f95b23f9786f4447fe and merge base 82a64a13a08c44f2daef425d1a9df2c10840ea8e. PR #2384 carries the independent correction and is being marked ready for complete selected hosted proof. No merge or #2334 resolution is claimed.
Delivered outcome
2026-10-18: delivered in #2384, squash 775eb17aab740fa759c2182f306c38fc17acbcbe on main. Ready CI run 39079730529, attempt 1, passes all 16 selected jobs. All actual checkout logs and the aggregate agree on 8f58e17b9918759c222a2761588000e3fe22c526, parents 63fde3c8fe76e754aa4524f95b23f9786f4447fe / 20028ce746ae7f0ac300a94d9731169498e1f79e, tree 9bafce7fd33a5ee8b367f25f28136845cec40112. Contract passes after the final body update. The local failing-first/mutation and corrected complete native receipts remain in the PR.
Main advanced by the independent diagram-test/capture-metadata change #2368. Its diff was inspected before merging; the older run is not claimed to cover that newer combination. The actual squash has parent b7a0885181445125d576e02f61c562d704c81099 and tree 1c76c2edc20ead25ffdec16dffa644459069e5b4, matching the precomputed combination, and is confirmed on remote main. Automatic main-push confirmation is complete; the independently verified result follows below.
Both #2315 and #2382 are closed, and their 0.44.0 milestones and the PR milestone were read back. This closes the native deadline-composition corrections, not the separate Storage product or #2334 investigation.
Automatic main-push confirmation
2026-10-18: automatic main-push CI run 39081370533, attempt 1 passes all 16 selected jobs on squash 775eb17aab740fa759c2182f306c38fc17acbcbe. Every actual job checkout, including verify, pack and the aggregate job, matches that SHA. The immutable API and local git object agree on parent b7a0885181445125d576e02f61c562d704c81099 and tree 1c76c2edc20ead25ffdec16dffa644459069e5b4. The aggregate selects all nine proof categories, reports success for each, and retains no earlier execution. This establishes the actual combined main tree separately from the earlier PR run.
The test skips are verified against that checkout: 24 deliberately disabled paid image-provider cases; four inverse empty vector placeholders while their substantive controls pass; and ten soft-keyboard cases excluded only from the fine-pointer project, with all of those cases executing in the coarse and mixed projects. No selected job is missing, cancelled or skipped. The PR and both delivered issues retain milestone 0.44.0; #2315 and #2382 remain closed. The distinct Storage investigations remain open.
Activity
schlessera commentedon Oct 17, 2026
Bounded diagnostic claim
storage-sdk-deadline-20261017-c0d4: retain the original failure, add phase/elapsed observations only in an isolated main-based diagnostic checkout, and run the original 25-second child deadline with all original native SDK assertions. This is evidence collection, not a selected production correction or an unchanged retry for a green claim.test(claude): compose deadlines for four-turn native relay profiles
schlessera commentedon Oct 17, 2026
Implemented in #2172 at
396cdfd0aa71c7a04e52c05f0c328cce1cde44a9, integrating main9d5cd00b7646ffee951c7a29a38717989f7fd868. The derived full-profile allowance covers four sequential turns; existing20-second turn and five-second cancellation limits,25-second single-turn controls, identity/credential/history/refresh assertions and owned cleanup remain intact. Both full-profile callers use the same fixture constants, and the separate-UID path retains bounded phase/exit/signal observations.The original25-second diagnostic fails with SIGTERM after three successful turns and entry into the fourth cancellation. A controlled whole-profile comparison completes both profiles around30seconds with all assertions passing. Final combined native qualification also passes, including actual Btrfs manager/private recovery, ordinary/profile and IPC substitution controls, authenticated native WebSocket success and zero owned resources. Strict types pass; focused SDK/citation proof passes50 tests/233 assertions, and the current-main observation/citation check passes50 tests/151 assertions. The required broad preflight is running on the frozen candidate; complete selected hosted and actual-main verification remain pending.
schlessera commentedon Oct 17, 2026
Bounded handoff recorded in the updated body and #2172. Current candidate
fe5faafdahas passing native/type/focused proof; broad preflight finishes6,948 pass /4 skip /1 fail after949 fast tests pass. The distinct unresolved speech bundler exit is #2334; #2202 is non-blocking and its previously affected case passes. Preserve the draft implementation and original receipts. Reconcile later main and resume complete qualification after #2334 attribution. Releasing this invocation's owned claim; no merged delivery or complete hosted proof is claimed.schlessera commentedon Oct 17, 2026
The existing SDK whole-profile timeout recurs during additional voice integration qualification on combined source
e4ee28d9aff266f31c640e9bc23c051c742a7fb7, treeb21832683705f66cd9d9cd664ed0112d518b070b(main9c52e8c020aca6d8c4dcea0a2afd1640bc1bf60bplus GPT layer). Bun1.4.3, a prepared image from the pinned native Dockerfile, external network disabled. The failing native caller and its SDK child fixture are byte-identical between the original voice CI base and current main.Unmodified run: 24 identity and 13 egress controls pass, then
sdk-host-relay-identity.native.ts:15observes exit143 under the 25-second parent allowance, with four expected SDK warnings and no underlying error. Owned records/source directories/workers all reach zero. This failed full qualification is retained.One separately labelled diagnostic follows the issue's selected four-turn allowance: only
timeout: 25_000in that native parent becomes4 * (20_000 + 5_000). No inner limits, assertions, production code or guards change. The full native driver then exits0, including both SDK profiles, managed restricted/ordinary probes, 28 relay refusals, both prepared-native modes and all cleanup checks. The test file is restored byte-for-byte (original SHA-25644e8bb08acb63d0aa98adc64657750a14c2e0d64ec9091990c683c0d5c49c8a7); tracked source is clean.This supports the existing composed-budget diagnosis. It is not a clean-source current full-suite pass, a shipped test correction, or resolution of #2315/#2334. Both raw runs, control identity/restoration receipt and owned-cleanup evidence are retained separately.
schlessera commentedon Oct 17, 2026
Resuming the authorized Storage chain and bounded blocker diagnostics under claim
storage-recheck-20261017-e8f2, using existing PR #2172 branchfeat/2059-storage-history-ui-m4p6. Reconcile current main, preserve the original #2334 failure, and obtain the missing browser-bundle child exit/signal/output observations before selecting any correction. No skipped test, weakened assertion or deadline change. The four historical SQLite skip labels are inverse empty placeholders; substantive vector cases passed, as verified against source and the retained log. Historical totals and the speech failure remain unchanged.schlessera commentedon Oct 17, 2026
2026-10-18 — Continuing claim
storage-recheck-20261017-e8f2with independent qualification of the existing scoped correction on branchtest/2315-relay-profile-budget-n7v4, based on main82a64a13a08c44f2daef425d1a9df2c10840ea8e.The four fixture files are copied byte-for-byte from Storage candidate
3c0e884a4d6b43c494469c9fdaf6ce0cb919ef6e; only the two moved source citations additionally change. There is no production or new deadline design change. The correction composes the existing four sequential 20-second turn plus five-second cancellation allowances, while single-turn controls retain 25 seconds.A real separate-UID native mutation now restores only the original 25-second whole-profile allowance, with phase observations and every assertion intact. Its result will be retained before restoration, complete native proof and required local preflight. The prepared native image is immutable
sha256:7fbb483622c14a2feee72ca90dc7be86ffc64964a3d699f4f827a9503f57d7e5, built from the repository's unchanged pinned Dockerfile; external network is disabled.This correction is independently useful and has no remaining implementation dependency. The stale blocked label is removed while its own required verification proceeds. No new PR, passing current proof, merge or #2334 resolution is claimed. The Storage feature and its separate historical bundle investigation remain open.
schlessera commentedon Oct 17, 2026
The independent native mutation fails at the original whole-profile deadline as expected, and both restored SDK profiles pass. Complete qualification then exposes the separate application-parent composition failure recorded in #2382. The updated body preserves those distinct results. Candidate
20028ce746ae7f0ac300a94d9731169498e1f79econtains both scoped corrections and is undergoing complete native/type/preflight verification.schlessera commentedon Oct 17, 2026
The corrected complete native command passes at
20028ce746ae7f0ac300a94d9731169498e1f79ein324.81seconds, including both SDK profiles, all four application phases, both prepared-consumer modes and zero owned resources. The body records exact phase timings, original failing-first/mutation evidence and the separately retained prerequisite refusal/owned empty-loop cleanup. Final citation audit passes44/113; types and required preflight continue. No merged delivery or complete hosted proof is claimed.schlessera commentedon Oct 17, 2026
Independent implementation is PR #2384 at
20028ce746ae7f0ac300a94d9731169498e1f79e. Complete native proof, strict types and mandatory local preflight pass; the updated body preserves exact source identities, original failing-first/mutation receipts and all owned cleanup. The PR requests complete selected hosted proof. Release 0.44.0 is verified on the PR and both advanced issues. No merged delivery is claimed.schlessera commentedon Oct 18, 2026
2026-10-18: delivered in #2384, squash
775eb17aab740fa759c2182f306c38fc17acbcbeon main. Ready CI run 39079730529, attempt 1, passes all 16 selected jobs. All actual checkout logs and the aggregate agree on8f58e17b9918759c222a2761588000e3fe22c526, parents63fde3c8fe76e754aa4524f95b23f9786f4447fe/20028ce746ae7f0ac300a94d9731169498e1f79e, tree9bafce7fd33a5ee8b367f25f28136845cec40112. Contract passes after the final body update. The local failing-first/mutation and corrected complete native receipts remain in the PR.Main advanced by the independent diagram-test/capture-metadata change #2368. Its diff was inspected before merging; the older run is not claimed to cover that newer combination. The actual squash has parent
b7a0885181445125d576e02f61c562d704c81099and tree1c76c2edc20ead25ffdec16dffa644459069e5b4, matching the precomputed combination, and is confirmed on remote main. Automatic main-push CI run 39081370533 has started; its outcome is recorded separately when complete.Both #2315 and #2382 are closed, and their 0.44.0 milestones and the PR milestone were read back. This closes the native deadline-composition corrections, not the separate Storage product or #2334 investigation.
schlessera commentedon Oct 18, 2026
2026-10-18: automatic main-push CI run 39081370533, attempt 1 passes all 16 selected jobs on squash
775eb17aab740fa759c2182f306c38fc17acbcbe. Every actual job checkout, including verify, pack and the aggregate job, matches that SHA. The immutable API and local git object agree on parentb7a0885181445125d576e02f61c562d704c81099and tree1c76c2edc20ead25ffdec16dffa644459069e5b4. The aggregate selects all nine proof categories, reports success for each, and retains no earlier execution. This establishes the actual combined main tree separately from the earlier PR run.The test skips are verified against that checkout: 24 deliberately disabled paid image-provider cases; four inverse empty vector placeholders while their substantive controls pass; and ten soft-keyboard cases excluded only from the fine-pointer project, with all of those cases executing in the coarse and mixed projects. No selected job is missing, cancelled or skipped. The PR and both delivered issues retain milestone 0.44.0; #2315 and #2382 remain closed. The distinct Storage investigations remain open.
CONTRACT: feat(storage): deliver owner inventory, recovery and capaci…