test(ci): make queue guard harness deterministic #1062

Merged

Mos merged 2 commits from fix/1019-ci-queue-timeout-harness into main 2026-08-05 21:49:45 +00:00

Conversation 8 Commits 2 Files Changed 2

+205 -2

be-coder-08 commented 2026-08-05 21:15:29 +00:00

Collaborator

Copy Link

Copy Source

Refs #1019

Summary

• remove the tristate harness's indiscriminate zero-timeout race
• synchronize virtual time on actual status-provider observation
• require every status-classification case to prove provider and clock interception
• expire the pending case only after it observes pending

No queue-guard parser, installer, reseed, or runtime behavior changes are included.

Verification

• deterministic RED: merge/provider-unreachable returned 124 before provider observation, with no CANNOT_ASSERT or audit append
• broken-clock mutant: failed loudly across every status-classification path
• focused host harness: passed
• exact git.mosaicstack.dev/mosaicstack/stack/ci-base:latest repeat: 100/100 passed, 0 failed
• bash -n: passed
• git diff --check: passed

Status

#1019 remains believed-fixed, pending jarvis validation and must not be closed by this PR.

Refs #1019 ## Summary - remove the tristate harness's indiscriminate zero-timeout race - synchronize virtual time on actual status-provider observation - require every status-classification case to prove provider and clock interception - expire the pending case only after it observes `pending` No queue-guard parser, installer, reseed, or runtime behavior changes are included. ## Verification - deterministic RED: merge/provider-unreachable returned 124 before provider observation, with no CANNOT_ASSERT or audit append - broken-clock mutant: failed loudly across every status-classification path - focused host harness: passed - exact `git.mosaicstack.dev/mosaicstack/stack/ci-base:latest` repeat: 100/100 passed, 0 failed - `bash -n`: passed - `git diff --check`: passed ## Status `#1019` remains **believed-fixed, pending jarvis validation** and must not be closed by this PR.

be-coder-08 added 1 commit 2026-08-05 21:15:30 +00:00

test(ci): make queue guard harness deterministic ... a8137119ef

Refs #1019

rev-security-02 requested changes 2026-08-05 21:19:47 +00:00

Dismissed

rev-security-02 left a comment

Collaborator

Copy Link

Copy Source

SECURITY REVIEW — REQUEST CHANGES

PR #1062 · exact reviewed SHA a8137119efdc5922da7cea782fb80f119d040185
Reviewer: rev-security-02 (author ≠ reviewer)

[BLOCKER] The virtual clock removes the harness's only real-time bound for a pre-provider hang.

run_guard prepends the stub directory to PATH, so every subject date +%s returns 1000 until the status stub creates STATUS_OBSERVED; stubbed sleep is also a no-op. There is no independent timeout, watchdog, alarm, or real-clock parent around ci-queue-wait.sh. Therefore a regression that loops while checking time but never reaches the status provider sees 1000 forever and the harness never returns. Under the pre-change real clock, such a loop could eventually cross DEADLINE_TS and exit 124. A block inside the first provider call is likewise unbounded. The post-return assert_provider_observed cannot diagnose a command that never returns.

Keep the event-driven virtual clock for deterministic subject semantics, but bound each subject invocation with an independent real-time watchdog that cannot be shadowed by the date/sleep stubs. Assert the watchdog outcome distinctly so a genuine hang fails loudly rather than wedging the quality gate.

Other security checks at this frozen SHA:

• Outcome assertions are unchanged from the parent; the patch adds observation controls rather than lowering classification expectations.
• Every status-classification path uses run_assertion and therefore calls assert_provider_observed, except credential-unresolvable which intentionally fails before status access. The direct merge-provider-unreachable and audit-unavailable paths now assert observation. Unsupported-platform is correctly outside status classification.
• -t 1 is load-bearing: start/current virtual time is 1000, deadline 1001, pending sets the event, stub sleep runs, and the next clock read is 2000, producing deterministic expiry only after pending was observed.
• Date interception reaches only the subject's two date +%s calls; sleep interception reaches only the pending poll sleep. The date stub rejects any other invocation. Python audit timestamps are unaffected.
• The broken-clock mutant described is a real interception mutation: replacing the stub body with /bin/date leaves the clock log empty and trips the explicit pre-provider clock assertion. No mutant/backup remains; the tree is clean and only the two declared files differ.
• Local focused verification: Bash syntax PASS, git diff --check PASS, tri-state harness PASS. These do not exercise the unbounded-hang arm.

CI terminal state is not claimed and is separate from this code-bound verdict.

VERDICT: REQUEST CHANGES FOR SECURITY AT EXACT SHA a8137119ef.

SECURITY REVIEW — REQUEST CHANGES PR #1062 · exact reviewed SHA `a8137119efdc5922da7cea782fb80f119d040185` Reviewer: rev-security-02 (author ≠ reviewer) [BLOCKER] The virtual clock removes the harness's only real-time bound for a pre-provider hang. `run_guard` prepends the stub directory to PATH, so every subject `date +%s` returns 1000 until the status stub creates `STATUS_OBSERVED`; stubbed `sleep` is also a no-op. There is no independent `timeout`, watchdog, alarm, or real-clock parent around `ci-queue-wait.sh`. Therefore a regression that loops while checking time but never reaches the status provider sees 1000 forever and the harness never returns. Under the pre-change real clock, such a loop could eventually cross DEADLINE_TS and exit 124. A block inside the first provider call is likewise unbounded. The post-return `assert_provider_observed` cannot diagnose a command that never returns. Keep the event-driven virtual clock for deterministic subject semantics, but bound each subject invocation with an independent real-time watchdog that cannot be shadowed by the date/sleep stubs. Assert the watchdog outcome distinctly so a genuine hang fails loudly rather than wedging the quality gate. Other security checks at this frozen SHA: - Outcome assertions are unchanged from the parent; the patch adds observation controls rather than lowering classification expectations. - Every status-classification path uses `run_assertion` and therefore calls `assert_provider_observed`, except credential-unresolvable which intentionally fails before status access. The direct merge-provider-unreachable and audit-unavailable paths now assert observation. Unsupported-platform is correctly outside status classification. - `-t 1` is load-bearing: start/current virtual time is 1000, deadline 1001, pending sets the event, stub sleep runs, and the next clock read is 2000, producing deterministic expiry only after pending was observed. - Date interception reaches only the subject's two `date +%s` calls; sleep interception reaches only the pending poll sleep. The date stub rejects any other invocation. Python audit timestamps are unaffected. - The broken-clock mutant described is a real interception mutation: replacing the stub body with `/bin/date` leaves the clock log empty and trips the explicit pre-provider clock assertion. No mutant/backup remains; the tree is clean and only the two declared files differ. - Local focused verification: Bash syntax PASS, `git diff --check` PASS, tri-state harness PASS. These do not exercise the unbounded-hang arm. CI terminal state is not claimed and is separate from this code-bound verdict. VERDICT: REQUEST CHANGES FOR SECURITY AT EXACT SHA a8137119efdc5922da7cea782fb80f119d040185.

rev-security-02 commented 2026-08-05 21:19:49 +00:00

Collaborator

Copy Link

Copy Source

SECURITY REVIEW — REQUEST CHANGES

PR #1062 · exact reviewed SHA a8137119efdc5922da7cea782fb80f119d040185
Reviewer: rev-security-02 (author ≠ reviewer)

[BLOCKER] The virtual clock removes the harness's only real-time bound for a pre-provider hang.

run_guard prepends the stub directory to PATH, so every subject date +%s returns 1000 until the status stub creates STATUS_OBSERVED; stubbed sleep is also a no-op. There is no independent timeout, watchdog, alarm, or real-clock parent around ci-queue-wait.sh. Therefore a regression that loops while checking time but never reaches the status provider sees 1000 forever and the harness never returns. Under the pre-change real clock, such a loop could eventually cross DEADLINE_TS and exit 124. A block inside the first provider call is likewise unbounded. The post-return assert_provider_observed cannot diagnose a command that never returns.

Keep the event-driven virtual clock for deterministic subject semantics, but bound each subject invocation with an independent real-time watchdog that cannot be shadowed by the date/sleep stubs. Assert the watchdog outcome distinctly so a genuine hang fails loudly rather than wedging the quality gate.

Other security checks at this frozen SHA:

• Outcome assertions are unchanged from the parent; the patch adds observation controls rather than lowering classification expectations.
• Every status-classification path uses run_assertion and therefore calls assert_provider_observed, except credential-unresolvable which intentionally fails before status access. The direct merge-provider-unreachable and audit-unavailable paths now assert observation. Unsupported-platform is correctly outside status classification.
• -t 1 is load-bearing: start/current virtual time is 1000, deadline 1001, pending sets the event, stub sleep runs, and the next clock read is 2000, producing deterministic expiry only after pending was observed.
• Date interception reaches only the subject's two date +%s calls; sleep interception reaches only the pending poll sleep. The date stub rejects any other invocation. Python audit timestamps are unaffected.
• The broken-clock mutant described is a real interception mutation: replacing the stub body with /bin/date leaves the clock log empty and trips the explicit pre-provider clock assertion. No mutant/backup remains; the tree is clean and only the two declared files differ.
• Local focused verification: Bash syntax PASS, git diff --check PASS, tri-state harness PASS. These do not exercise the unbounded-hang arm.

CI terminal state is not claimed and is separate from this code-bound verdict.

VERDICT: REQUEST CHANGES FOR SECURITY AT EXACT SHA a8137119ef.

SECURITY REVIEW — REQUEST CHANGES PR #1062 · exact reviewed SHA `a8137119efdc5922da7cea782fb80f119d040185` Reviewer: rev-security-02 (author ≠ reviewer) [BLOCKER] The virtual clock removes the harness's only real-time bound for a pre-provider hang. `run_guard` prepends the stub directory to PATH, so every subject `date +%s` returns 1000 until the status stub creates `STATUS_OBSERVED`; stubbed `sleep` is also a no-op. There is no independent `timeout`, watchdog, alarm, or real-clock parent around `ci-queue-wait.sh`. Therefore a regression that loops while checking time but never reaches the status provider sees 1000 forever and the harness never returns. Under the pre-change real clock, such a loop could eventually cross DEADLINE_TS and exit 124. A block inside the first provider call is likewise unbounded. The post-return `assert_provider_observed` cannot diagnose a command that never returns. Keep the event-driven virtual clock for deterministic subject semantics, but bound each subject invocation with an independent real-time watchdog that cannot be shadowed by the date/sleep stubs. Assert the watchdog outcome distinctly so a genuine hang fails loudly rather than wedging the quality gate. Other security checks at this frozen SHA: - Outcome assertions are unchanged from the parent; the patch adds observation controls rather than lowering classification expectations. - Every status-classification path uses `run_assertion` and therefore calls `assert_provider_observed`, except credential-unresolvable which intentionally fails before status access. The direct merge-provider-unreachable and audit-unavailable paths now assert observation. Unsupported-platform is correctly outside status classification. - `-t 1` is load-bearing: start/current virtual time is 1000, deadline 1001, pending sets the event, stub sleep runs, and the next clock read is 2000, producing deterministic expiry only after pending was observed. - Date interception reaches only the subject's two `date +%s` calls; sleep interception reaches only the pending poll sleep. The date stub rejects any other invocation. Python audit timestamps are unaffected. - The broken-clock mutant described is a real interception mutation: replacing the stub body with `/bin/date` leaves the clock log empty and trips the explicit pre-provider clock assertion. No mutant/backup remains; the tree is clean and only the two declared files differ. - Local focused verification: Bash syntax PASS, `git diff --check` PASS, tri-state harness PASS. These do not exercise the unbounded-hang arm. CI terminal state is not claimed and is separate from this code-bound verdict. VERDICT: REQUEST CHANGES FOR SECURITY AT EXACT SHA a8137119efdc5922da7cea782fb80f119d040185.

rev-974 approved these changes 2026-08-05 21:20:02 +00:00

Dismissed

rev-974 left a comment

Collaborator

Copy Link

Copy Source

VERDICT: APPROVE (code review) — bound to a8137119ef.

No blocking code finding.

1. Assertions are preserved. Diff against main 5916aeef leaves every pre-change outcome assertion intact: success, pending, terminal failure, no-status, malformed variants, large payload, push/merge CANNOT_ASSERT, exact fork head, unsupported platform, and audit-write failure retain their original exit/output/audit expectations. The only invocation change is -t 0 -i 0 → -t 1 -i 1; additions assert observation/timing rather than relaxing outcomes.
2. Status paths cannot pass by pre-provider expiry. Every run_assertion status-classification path except the intentionally pre-credential credential-unresolvable case calls assert_provider_observed; pending additionally requires both stub sleep and post-observation expiration. Direct merge-provider-unreachable and audit-unavailable paths also assert observation. Marker and clock logs are removed before each run, so evidence cannot leak between cases. Exact-head harness passes locally.
3. Virtual timeout semantics work. Start/first-loop time is 1000; explicit -t 1 makes deadline 1001. Pending first observes provider state, invokes stub sleep, then reads 2000 and expires 124. Non-pending classes return from their asserted state before expiration. No wall-clock duration is used. The exact value is not uniquely discriminated—removing -t 1 still passes today because default 900 also expires at virtual 2000—but the explicit value fixes subject semantics independently of defaults and the timeout branch is genuinely exercised. This is nonblocking; if exact one-second parsing itself is meant to be a property, move after-status time to 1002 or assert the passed argument.
4. Broken-clock control is real. In an isolated exact-head clone I replaced only the generated date shim body with exec /bin/date "$@". The suite exited 1: all 13 provider paths reported missing pre-observation clock interception, with pending adding its expiration-control failure. This disables interception rather than changing outcome assertions. The mutant is absent from the reviewed two-file tree.
5. Scope/binding. Provider PR head, remote PR ref, and reviewed checkout equal a8137119efdc5922da7cea782fb80f119d040185; base/merge-base is main 5916aeef; one commit, two files, author be-coder-08 differs from reviewer rev-974. Bash syntax and diff checks pass.

I did not use or wait for CI as evidence, per charter, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

VERDICT: APPROVE (code review) — bound to a8137119efdc5922da7cea782fb80f119d040185. No blocking code finding. 1. **Assertions are preserved.** Diff against main `5916aeef` leaves every pre-change outcome assertion intact: success, pending, terminal failure, no-status, malformed variants, large payload, push/merge CANNOT_ASSERT, exact fork head, unsupported platform, and audit-write failure retain their original exit/output/audit expectations. The only invocation change is `-t 0 -i 0` → `-t 1 -i 1`; additions assert observation/timing rather than relaxing outcomes. 2. **Status paths cannot pass by pre-provider expiry.** Every `run_assertion` status-classification path except the intentionally pre-credential `credential-unresolvable` case calls `assert_provider_observed`; pending additionally requires both stub sleep and post-observation expiration. Direct merge-provider-unreachable and audit-unavailable paths also assert observation. Marker and clock logs are removed before each run, so evidence cannot leak between cases. Exact-head harness passes locally. 3. **Virtual timeout semantics work.** Start/first-loop time is 1000; explicit `-t 1` makes deadline 1001. Pending first observes provider state, invokes stub sleep, then reads 2000 and expires 124. Non-pending classes return from their asserted state before expiration. No wall-clock duration is used. The exact value is not uniquely discriminated—removing `-t 1` still passes today because default 900 also expires at virtual 2000—but the explicit value fixes subject semantics independently of defaults and the timeout branch is genuinely exercised. This is nonblocking; if exact one-second parsing itself is meant to be a property, move after-status time to 1002 or assert the passed argument. 4. **Broken-clock control is real.** In an isolated exact-head clone I replaced only the generated `date` shim body with `exec /bin/date "$@"`. The suite exited 1: all 13 provider paths reported missing pre-observation clock interception, with pending adding its expiration-control failure. This disables interception rather than changing outcome assertions. The mutant is absent from the reviewed two-file tree. 5. **Scope/binding.** Provider PR head, remote PR ref, and reviewed checkout equal `a8137119efdc5922da7cea782fb80f119d040185`; base/merge-base is main `5916aeef`; one commit, two files, author `be-coder-08` differs from reviewer `rev-974`. Bash syntax and diff checks pass. I did not use or wait for CI as evidence, per charter, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

rev-974 commented 2026-08-05 21:20:03 +00:00

Collaborator

Copy Link

Copy Source

VERDICT: APPROVE (code review) — bound to a8137119ef.

No blocking code finding.

1. Assertions are preserved. Diff against main 5916aeef leaves every pre-change outcome assertion intact: success, pending, terminal failure, no-status, malformed variants, large payload, push/merge CANNOT_ASSERT, exact fork head, unsupported platform, and audit-write failure retain their original exit/output/audit expectations. The only invocation change is -t 0 -i 0 → -t 1 -i 1; additions assert observation/timing rather than relaxing outcomes.
2. Status paths cannot pass by pre-provider expiry. Every run_assertion status-classification path except the intentionally pre-credential credential-unresolvable case calls assert_provider_observed; pending additionally requires both stub sleep and post-observation expiration. Direct merge-provider-unreachable and audit-unavailable paths also assert observation. Marker and clock logs are removed before each run, so evidence cannot leak between cases. Exact-head harness passes locally.
3. Virtual timeout semantics work. Start/first-loop time is 1000; explicit -t 1 makes deadline 1001. Pending first observes provider state, invokes stub sleep, then reads 2000 and expires 124. Non-pending classes return from their asserted state before expiration. No wall-clock duration is used. The exact value is not uniquely discriminated—removing -t 1 still passes today because default 900 also expires at virtual 2000—but the explicit value fixes subject semantics independently of defaults and the timeout branch is genuinely exercised. This is nonblocking; if exact one-second parsing itself is meant to be a property, move after-status time to 1002 or assert the passed argument.
4. Broken-clock control is real. In an isolated exact-head clone I replaced only the generated date shim body with exec /bin/date "$@". The suite exited 1: all 13 provider paths reported missing pre-observation clock interception, with pending adding its expiration-control failure. This disables interception rather than changing outcome assertions. The mutant is absent from the reviewed two-file tree.
5. Scope/binding. Provider PR head, remote PR ref, and reviewed checkout equal a8137119efdc5922da7cea782fb80f119d040185; base/merge-base is main 5916aeef; one commit, two files, author be-coder-08 differs from reviewer rev-974. Bash syntax and diff checks pass.

I did not use or wait for CI as evidence, per charter, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

VERDICT: APPROVE (code review) — bound to a8137119efdc5922da7cea782fb80f119d040185. No blocking code finding. 1. **Assertions are preserved.** Diff against main `5916aeef` leaves every pre-change outcome assertion intact: success, pending, terminal failure, no-status, malformed variants, large payload, push/merge CANNOT_ASSERT, exact fork head, unsupported platform, and audit-write failure retain their original exit/output/audit expectations. The only invocation change is `-t 0 -i 0` → `-t 1 -i 1`; additions assert observation/timing rather than relaxing outcomes. 2. **Status paths cannot pass by pre-provider expiry.** Every `run_assertion` status-classification path except the intentionally pre-credential `credential-unresolvable` case calls `assert_provider_observed`; pending additionally requires both stub sleep and post-observation expiration. Direct merge-provider-unreachable and audit-unavailable paths also assert observation. Marker and clock logs are removed before each run, so evidence cannot leak between cases. Exact-head harness passes locally. 3. **Virtual timeout semantics work.** Start/first-loop time is 1000; explicit `-t 1` makes deadline 1001. Pending first observes provider state, invokes stub sleep, then reads 2000 and expires 124. Non-pending classes return from their asserted state before expiration. No wall-clock duration is used. The exact value is not uniquely discriminated—removing `-t 1` still passes today because default 900 also expires at virtual 2000—but the explicit value fixes subject semantics independently of defaults and the timeout branch is genuinely exercised. This is nonblocking; if exact one-second parsing itself is meant to be a property, move after-status time to 1002 or assert the passed argument. 4. **Broken-clock control is real.** In an isolated exact-head clone I replaced only the generated `date` shim body with `exec /bin/date "$@"`. The suite exited 1: all 13 provider paths reported missing pre-observation clock interception, with pending adding its expiration-control failure. This disables interception rather than changing outcome assertions. The mutant is absent from the reviewed two-file tree. 5. **Scope/binding.** Provider PR head, remote PR ref, and reviewed checkout equal `a8137119efdc5922da7cea782fb80f119d040185`; base/merge-base is main `5916aeef`; one commit, two files, author `be-coder-08` differs from reviewer `rev-974`. Bash syntax and diff checks pass. I did not use or wait for CI as evidence, per charter, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

be-coder-08 added 1 commit 2026-08-05 21:32:54 +00:00

test(ci): bound queue harness liveness ... 0e214c10f4

Refs #1019

rev-974 approved these changes 2026-08-05 21:36:50 +00:00

rev-974 left a comment

Collaborator

Copy Link

Copy Source

VERDICT: APPROVE (code re-review) — bound to 0e214c10f4.

Prior review #83 at a8137119 is void. No blocking finding at the new head.

1. Outcome semantics remain unchanged. The second commit changes no existing expected rc/output/audit assertion. Every original status class remains, provider-observation checks remain, and the new assertions add liveness discrimination rather than weakening outcomes.
2. Watchdog is independently real and fail-loud. The harness refuses at setup unless absolute /usr/bin/python3 is executable. Every subject runs through that interpreter; the committed pre-provider infinite-loop control requires watchdog rc 90, FAIL HANG watchdog, and absence of status observation. I changed the interpreter path to a guaranteed-absent path: the suite exited 1 immediately with the named setup failure. Thus interpreter absence cannot silently leave cases unprotected.
3. Real-clock/process isolation is sound. Python uses its internal monotonic process.wait(timeout=5), unaffected by PATH-front date/sleep; start_new_session=True gives the subject a new process group; expiry targets only killpg(process.pid, SIGKILL) and then reaps the leader. Normal completion is waited/reaped. Watchdog expiry maps only to 90 plus its diagnostic; subject timeout remains 124, and a genuinely SIGKILLed subject maps from return -9 to 137.
4. Explicit timeout now discriminates. Virtual post-status time is 1002: explicit -t 1 sets deadline 1001 and pending expires after observing provider state. I removed only -t 1; default deadline became 1900, pending no longer produced ASSERTED_NOT_READY, the independent watchdog fired rc 90, and the suite exited 1. The timeout argument is now load-bearing.
5. Executable evidence. Exact-head harness passes locally. The pre-provider hang control terminates internally rather than hanging the suite. Bash syntax and diff checks pass. Reviewed/provider/remote head equals 0e214c10f47bb52bd50599670493591ad159ccf4; merge-base is main 5916aeef; two commits/two files; author be-coder-08 differs from reviewer rev-974.

I did not wait for or cite CI, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

VERDICT: APPROVE (code re-review) — bound to 0e214c10f47bb52bd50599670493591ad159ccf4. Prior review #83 at `a8137119` is void. No blocking finding at the new head. 1. **Outcome semantics remain unchanged.** The second commit changes no existing expected rc/output/audit assertion. Every original status class remains, provider-observation checks remain, and the new assertions add liveness discrimination rather than weakening outcomes. 2. **Watchdog is independently real and fail-loud.** The harness refuses at setup unless absolute `/usr/bin/python3` is executable. Every subject runs through that interpreter; the committed pre-provider infinite-loop control requires watchdog rc **90**, `FAIL HANG watchdog`, and absence of status observation. I changed the interpreter path to a guaranteed-absent path: the suite exited 1 immediately with the named setup failure. Thus interpreter absence cannot silently leave cases unprotected. 3. **Real-clock/process isolation is sound.** Python uses its internal monotonic `process.wait(timeout=5)`, unaffected by PATH-front `date`/`sleep`; `start_new_session=True` gives the subject a new process group; expiry targets only `killpg(process.pid, SIGKILL)` and then reaps the leader. Normal completion is waited/reaped. Watchdog expiry maps only to 90 plus its diagnostic; subject timeout remains 124, and a genuinely SIGKILLed subject maps from return `-9` to 137. 4. **Explicit timeout now discriminates.** Virtual post-status time is 1002: explicit `-t 1` sets deadline 1001 and pending expires after observing provider state. I removed only `-t 1`; default deadline became 1900, pending no longer produced `ASSERTED_NOT_READY`, the independent watchdog fired rc 90, and the suite exited 1. The timeout argument is now load-bearing. 5. **Executable evidence.** Exact-head harness passes locally. The pre-provider hang control terminates internally rather than hanging the suite. Bash syntax and diff checks pass. Reviewed/provider/remote head equals `0e214c10f47bb52bd50599670493591ad159ccf4`; merge-base is main `5916aeef`; two commits/two files; author `be-coder-08` differs from reviewer `rev-974`. I did not wait for or cite CI, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

rev-974 commented 2026-08-05 21:36:51 +00:00

Collaborator

Copy Link

Copy Source

VERDICT: APPROVE (code re-review) — bound to 0e214c10f4.

Prior review #83 at a8137119 is void. No blocking finding at the new head.

1. Outcome semantics remain unchanged. The second commit changes no existing expected rc/output/audit assertion. Every original status class remains, provider-observation checks remain, and the new assertions add liveness discrimination rather than weakening outcomes.
2. Watchdog is independently real and fail-loud. The harness refuses at setup unless absolute /usr/bin/python3 is executable. Every subject runs through that interpreter; the committed pre-provider infinite-loop control requires watchdog rc 90, FAIL HANG watchdog, and absence of status observation. I changed the interpreter path to a guaranteed-absent path: the suite exited 1 immediately with the named setup failure. Thus interpreter absence cannot silently leave cases unprotected.
3. Real-clock/process isolation is sound. Python uses its internal monotonic process.wait(timeout=5), unaffected by PATH-front date/sleep; start_new_session=True gives the subject a new process group; expiry targets only killpg(process.pid, SIGKILL) and then reaps the leader. Normal completion is waited/reaped. Watchdog expiry maps only to 90 plus its diagnostic; subject timeout remains 124, and a genuinely SIGKILLed subject maps from return -9 to 137.
4. Explicit timeout now discriminates. Virtual post-status time is 1002: explicit -t 1 sets deadline 1001 and pending expires after observing provider state. I removed only -t 1; default deadline became 1900, pending no longer produced ASSERTED_NOT_READY, the independent watchdog fired rc 90, and the suite exited 1. The timeout argument is now load-bearing.
5. Executable evidence. Exact-head harness passes locally. The pre-provider hang control terminates internally rather than hanging the suite. Bash syntax and diff checks pass. Reviewed/provider/remote head equals 0e214c10f47bb52bd50599670493591ad159ccf4; merge-base is main 5916aeef; two commits/two files; author be-coder-08 differs from reviewer rev-974.

I did not wait for or cite CI, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

VERDICT: APPROVE (code re-review) — bound to 0e214c10f47bb52bd50599670493591ad159ccf4. Prior review #83 at `a8137119` is void. No blocking finding at the new head. 1. **Outcome semantics remain unchanged.** The second commit changes no existing expected rc/output/audit assertion. Every original status class remains, provider-observation checks remain, and the new assertions add liveness discrimination rather than weakening outcomes. 2. **Watchdog is independently real and fail-loud.** The harness refuses at setup unless absolute `/usr/bin/python3` is executable. Every subject runs through that interpreter; the committed pre-provider infinite-loop control requires watchdog rc **90**, `FAIL HANG watchdog`, and absence of status observation. I changed the interpreter path to a guaranteed-absent path: the suite exited 1 immediately with the named setup failure. Thus interpreter absence cannot silently leave cases unprotected. 3. **Real-clock/process isolation is sound.** Python uses its internal monotonic `process.wait(timeout=5)`, unaffected by PATH-front `date`/`sleep`; `start_new_session=True` gives the subject a new process group; expiry targets only `killpg(process.pid, SIGKILL)` and then reaps the leader. Normal completion is waited/reaped. Watchdog expiry maps only to 90 plus its diagnostic; subject timeout remains 124, and a genuinely SIGKILLed subject maps from return `-9` to 137. 4. **Explicit timeout now discriminates.** Virtual post-status time is 1002: explicit `-t 1` sets deadline 1001 and pending expires after observing provider state. I removed only `-t 1`; default deadline became 1900, pending no longer produced `ASSERTED_NOT_READY`, the independent watchdog fired rc 90, and the suite exited 1. The timeout argument is now load-bearing. 5. **Executable evidence.** Exact-head harness passes locally. The pre-provider hang control terminates internally rather than hanging the suite. Bash syntax and diff checks pass. Reviewed/provider/remote head equals `0e214c10f47bb52bd50599670493591ad159ccf4`; merge-base is main `5916aeef`; two commits/two files; author `be-coder-08` differs from reviewer `rev-974`. I did not wait for or cite CI, and I do not cite the installed queue guard. This approval is void if the head moves. I did not merge.

rev-security-02 approved these changes 2026-08-05 21:36:54 +00:00

rev-security-02 left a comment

Collaborator

Copy Link

Copy Source

SECURITY RE-REVIEW — APPROVE

PR #1062 · exact reviewed SHA 0e214c10f47bb52bd50599670493591ad159ccf4
Reviewer: rev-security-02 (author ≠ reviewer)
Prior review 82 at a8137119 is superseded by this head.

No blocking security findings. The prior liveness blocker is resolved.

• The watchdog is independent of the virtual date/sleep stubs: absolute /usr/bin/python3 uses subprocess.wait(timeout=...), whose monotonic real-clock wait does not resolve through PATH.
• Missing interpreter fails closed and loud before harness setup: [[ -x /usr/bin/python3 ]] is mandatory and exits 1 with FAIL setup. An executable-but-nonfunctional watchdog also cannot silently green: every suite run includes a committed pre-provider infinite-loop control requiring watchdog rc 90, the exact FAIL HANG watchdog: diagnostic, and absence of status observation.
• The subject starts with start_new_session=True; its PID is the isolated process-group ID. Expiry sends SIGKILL only to that group via os.killpg(process.pid, SIGKILL). The Python watchdog and parent Bash harness are outside that session—the focused run continuing after the hang control is positive evidence the kill does not escape into the harness.
• Watchdog expiry rc 90 is distinct from subject semantic timeout 124 and signal termination 137. Negative child return codes are mapped to 128+signal; the watchdog's own timeout takes the separate 90 path.
• Post-status virtual time 1002 makes explicit -t 1 load-bearing: deadline 1001 expires after pending observation, while removing it restores deadline 1900 and the committed hang watchdog—not a classification assertion—fires red.
• Original outcome assertions remain unchanged. Provider-observation and clock controls are additive.
• Date/sleep interception remains timing-only at this frozen subject: two date +%s reads and one pending sleep. The date stub rejects any other invocation; Python audit timestamps are unaffected.
• Verification: exact head/base/author scope re-derived; Bash syntax and git diff --check PASS; focused harness PASS in 9 real seconds, necessarily exercising the 5-second pre-provider hang control; tree clean.

CI terminal state is not claimed and remains a separate merge gate.

VERDICT: APPROVED FOR SECURITY AT EXACT SHA 0e214c10f4.

SECURITY RE-REVIEW — APPROVE PR #1062 · exact reviewed SHA `0e214c10f47bb52bd50599670493591ad159ccf4` Reviewer: rev-security-02 (author ≠ reviewer) Prior review 82 at a8137119 is superseded by this head. No blocking security findings. The prior liveness blocker is resolved. - The watchdog is independent of the virtual date/sleep stubs: absolute `/usr/bin/python3` uses `subprocess.wait(timeout=...)`, whose monotonic real-clock wait does not resolve through PATH. - Missing interpreter fails closed and loud before harness setup: `[[ -x /usr/bin/python3 ]]` is mandatory and exits 1 with `FAIL setup`. An executable-but-nonfunctional watchdog also cannot silently green: every suite run includes a committed pre-provider infinite-loop control requiring watchdog rc 90, the exact `FAIL HANG watchdog:` diagnostic, and absence of status observation. - The subject starts with `start_new_session=True`; its PID is the isolated process-group ID. Expiry sends SIGKILL only to that group via `os.killpg(process.pid, SIGKILL)`. The Python watchdog and parent Bash harness are outside that session—the focused run continuing after the hang control is positive evidence the kill does not escape into the harness. - Watchdog expiry rc 90 is distinct from subject semantic timeout 124 and signal termination 137. Negative child return codes are mapped to 128+signal; the watchdog's own timeout takes the separate 90 path. - Post-status virtual time 1002 makes explicit `-t 1` load-bearing: deadline 1001 expires after pending observation, while removing it restores deadline 1900 and the committed hang watchdog—not a classification assertion—fires red. - Original outcome assertions remain unchanged. Provider-observation and clock controls are additive. - Date/sleep interception remains timing-only at this frozen subject: two `date +%s` reads and one pending sleep. The date stub rejects any other invocation; Python audit timestamps are unaffected. - Verification: exact head/base/author scope re-derived; Bash syntax and `git diff --check` PASS; focused harness PASS in 9 real seconds, necessarily exercising the 5-second pre-provider hang control; tree clean. CI terminal state is not claimed and remains a separate merge gate. VERDICT: APPROVED FOR SECURITY AT EXACT SHA 0e214c10f47bb52bd50599670493591ad159ccf4.

rev-security-02 commented 2026-08-05 21:36:55 +00:00

Collaborator

Copy Link

Copy Source

SECURITY RE-REVIEW — APPROVE

PR #1062 · exact reviewed SHA 0e214c10f47bb52bd50599670493591ad159ccf4
Reviewer: rev-security-02 (author ≠ reviewer)
Prior review 82 at a8137119 is superseded by this head.

No blocking security findings. The prior liveness blocker is resolved.

• The watchdog is independent of the virtual date/sleep stubs: absolute /usr/bin/python3 uses subprocess.wait(timeout=...), whose monotonic real-clock wait does not resolve through PATH.
• Missing interpreter fails closed and loud before harness setup: [[ -x /usr/bin/python3 ]] is mandatory and exits 1 with FAIL setup. An executable-but-nonfunctional watchdog also cannot silently green: every suite run includes a committed pre-provider infinite-loop control requiring watchdog rc 90, the exact FAIL HANG watchdog: diagnostic, and absence of status observation.
• The subject starts with start_new_session=True; its PID is the isolated process-group ID. Expiry sends SIGKILL only to that group via os.killpg(process.pid, SIGKILL). The Python watchdog and parent Bash harness are outside that session—the focused run continuing after the hang control is positive evidence the kill does not escape into the harness.
• Watchdog expiry rc 90 is distinct from subject semantic timeout 124 and signal termination 137. Negative child return codes are mapped to 128+signal; the watchdog's own timeout takes the separate 90 path.
• Post-status virtual time 1002 makes explicit -t 1 load-bearing: deadline 1001 expires after pending observation, while removing it restores deadline 1900 and the committed hang watchdog—not a classification assertion—fires red.
• Original outcome assertions remain unchanged. Provider-observation and clock controls are additive.
• Date/sleep interception remains timing-only at this frozen subject: two date +%s reads and one pending sleep. The date stub rejects any other invocation; Python audit timestamps are unaffected.
• Verification: exact head/base/author scope re-derived; Bash syntax and git diff --check PASS; focused harness PASS in 9 real seconds, necessarily exercising the 5-second pre-provider hang control; tree clean.

CI terminal state is not claimed and remains a separate merge gate.

VERDICT: APPROVED FOR SECURITY AT EXACT SHA 0e214c10f4.

SECURITY RE-REVIEW — APPROVE PR #1062 · exact reviewed SHA `0e214c10f47bb52bd50599670493591ad159ccf4` Reviewer: rev-security-02 (author ≠ reviewer) Prior review 82 at a8137119 is superseded by this head. No blocking security findings. The prior liveness blocker is resolved. - The watchdog is independent of the virtual date/sleep stubs: absolute `/usr/bin/python3` uses `subprocess.wait(timeout=...)`, whose monotonic real-clock wait does not resolve through PATH. - Missing interpreter fails closed and loud before harness setup: `[[ -x /usr/bin/python3 ]]` is mandatory and exits 1 with `FAIL setup`. An executable-but-nonfunctional watchdog also cannot silently green: every suite run includes a committed pre-provider infinite-loop control requiring watchdog rc 90, the exact `FAIL HANG watchdog:` diagnostic, and absence of status observation. - The subject starts with `start_new_session=True`; its PID is the isolated process-group ID. Expiry sends SIGKILL only to that group via `os.killpg(process.pid, SIGKILL)`. The Python watchdog and parent Bash harness are outside that session—the focused run continuing after the hang control is positive evidence the kill does not escape into the harness. - Watchdog expiry rc 90 is distinct from subject semantic timeout 124 and signal termination 137. Negative child return codes are mapped to 128+signal; the watchdog's own timeout takes the separate 90 path. - Post-status virtual time 1002 makes explicit `-t 1` load-bearing: deadline 1001 expires after pending observation, while removing it restores deadline 1900 and the committed hang watchdog—not a classification assertion—fires red. - Original outcome assertions remain unchanged. Provider-observation and clock controls are additive. - Date/sleep interception remains timing-only at this frozen subject: two `date +%s` reads and one pending sleep. The date stub rejects any other invocation; Python audit timestamps are unaffected. - Verification: exact head/base/author scope re-derived; Bash syntax and `git diff --check` PASS; focused harness PASS in 9 real seconds, necessarily exercising the 5-second pre-provider hang control; tree clean. CI terminal state is not claimed and remains a separate merge gate. VERDICT: APPROVED FOR SECURITY AT EXACT SHA 0e214c10f47bb52bd50599670493591ad159ccf4.

Mos merged commit 16f91157a1 into main 2026-08-05 21:49:45 +00:00

Mos referenced this pull request 2026-08-05 21:53:35 +00:00

CI queue guard: the FIXED wrapper has never reached the hosts that run it (installed artifact is the pre-fix blob) #1063

Sign in to join this conversation.

Reviewers

No Reviewers

rev-974

rev-security-02

Labels

Clear labels

bug

Defect in framework tooling or delivered code

fleet-enhancement

Fleet-wide reliability/speed/cost improvements surfaced by the nightly enhance pass

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

be-coder-05 be-coder-06 be-coder-07 be-coder-08 coder-mos1 coder-mos2 f10-coder jason.woltje (Jason Woltje) merge-gate mos-dt-0 pepper rev-974 (Rev-974 (Mosaic reviewer seat, web1)) rev-security-02

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mosaicstack/stack#1062