amadan
carlos / platform Public
| Round-1 finding | Disposition | Evidence and remaining work | |---|---|---| | 1. Incarnation check | FIXED; DECLINED-AGREE on version pinning | §8.2:538 now brackets downloads and retries, withholding query execution until check B. This addresses the reported recreation race against the identity checked by provision.go:2777 and claim.go:192. Deferring version pinning is acceptable for this fix. | | 2. Socket on stdin | FIXED | §8.3:580 explicitly sets socket stdin/stdout and journal stderr, replacing the incompatible output configuration in claimunit_template.go:19. | | 3. Progress versus completion ack | FIXED | §5.4:250 separates ack from digest-bound done. It no longer relies on the terminal-only acknowledgement semantics in apirunsfollow.go:287. | | 4. Late writes after lost | PARTLY — P2 | §5.8:365 bounds client activity, but does not establish a storage fence. S3Store.Put:787 conditions the target object only; it sends no enforceable ownership deadline. SDK retries honour cancellation, but an already-sent request can have an uncertain outcome—the existing code explicitly recognises this in apirunsfollow.go:94. Neither sixty seconds nor the additional skew allowance proves that storage cannot commit later. Fix: use storage-enforced fencing, or define lost as logical closure, reject subsequent output, and retain durable cleanup state for late objects. Test a server-side commit after client timeout, not merely a delayed client return. | | 5. Cleanup reopens election | FIXED, subject to finding 4 | §5.8:390 retains picked until both completion and the acceptance-window margin. A twenty-minute read therefore retains it beyond five minutes. Create-only election uses the existing conditional-write mechanism in store.go:794. The separate metadata-lifetime defects are new findings below. | | 6. “Showed none” after rejection | FIXED | §5.4:250 buffers and verifies before stdout. That avoids exposing the immediate writes made by today’s runner at db.go:427 and db.go:447. | | 7. Stored-ciphertext bound | PARTLY — P2 | §5.7:356 deletes acknowledged keys, but the deployment bucket has versioning enabled at deployment-buckets/main.tf:23. S3Store.Delete:970 supplies no version ID, so ciphertext remains as noncurrent versions. The configured noncurrent-expiration rule covers only GeoIP, at main.tf:35. Thus neither the physical storage bound nor the one-hour retention promise holds. Fix: design version-aware permanent reclamation, including scoped permissions and failure ordering, and test with bucket versioning enabled. S3’s deletion semantics are explicit: https://docs.aws.amazon.com/AmazonS3/latest/userguide/DeletingObjectVersions.html. | | 8. Disk reservations | PARTLY — P2 | The mutex fixes concurrent admission, but §5.7:351 permits admission after two minutes even if old workers remain active. Their stated runtime limit is twenty minutes. Existing computation stops through its context—db.go:418, check.go:57—rather than automatically when an unrelated socket closes. Fix: remove the two-minute escape; keep reservations/admission blocked until worker termination and scratch cleanup are confirmed. Specify disconnect monitoring that cancels restore/query work, and release reservations only after that cleanup. | | 9. Worker readiness | PARTLY — P2 | The real-unit probe improves on inode existence, consistent with the armed-worker precedent at movesoffline.go:254. But §7.1:451 sends probes through the same socket whose §8.3:574 limit is two connections. Two legitimate reads cause the probe to be refused, withdrawing capability until a subsequent successful probe. Fix: coordinate probes with worker slots; treat occupied slots as busy, and probe promptly when one becomes available. Add a saturated-box test. MaxConnections explicitly refuses excess connections: https://www.freedesktop.org/software/systemd/man/257/systemd.socket.html. | | 10. Incomplete snapshot evidence | PARTLY — P2 | §7.1:466 still returns DBF-1 using Complete alone. A fresh status snapshot without an edges file sets only BoxesComplete=false, at snapshot.go:182. With no other capable file, rule 1 wins before rule 3 can admit the request. Fix: give incomplete evidence precedence over both negative conclusions; require Complete && BoxesComplete before DBF-1 as well as DBF-2. Test an empty edges listing with a fresh status snapshot. | | 11. Separate store endpoints | DECLINED-AGREE | §12:808 withdraws the unsupported deployment shape. The shared endpoint is confirmed by store.go:712, endpoint.go:146, and s3compat.go:40. A platform-wide endpoint change can remain separate. | | 12. Census classifications | FIXED | §13:833 now names supported classes, both runner callers, removal rows and required rulings. These match plan14rootreads_test.go:465, line 480, and the existing runner disposition at plan14-root-reads.tsv:202. |
- P2 — Completion deletes the only durable evidence that the read ended.
Spec: §5.8:372, together with its lost and tombstone rules.
A query finishes after one minute; done deletes result.json but retains picked and the request. After a console restart, that object set is indistinguishable from an unfinished picked read. The tombstone’s “a result exists” condition is false, and the lost rule eventually manufactures a lost result for a successfully acknowledged query.
The copied run implementation avoids this ambiguity by clearing persistent execution state before deleting objects: apirunsfollow.go:335. Its sweep also reads persistent run state when deciding whether a run is lost: runsweep.go:98. This design removes that record state without replacing it.
Fix: persist completion before deleting the result—for example, a separate create-only completion marker containing the verified result digest. Have expiry, concurrency accounting and cleanup recognise it across console restarts. Test done followed immediately by restart and a sweep past the fence.
- P2 — Tombstone cleanup removes the identity needed to fetch retained results.
Once a read older than five minutes produces a result, the sweep may delete its request immediately, even though the CLI has not fetched or acknowledged the result. The request is the only specified retained object that binds the read ID to its host. Neither the stated picked fields nor the result schema carries that binding. Consequently, the follow routes cannot enforce their mandatory host check while serving the remaining result and chunks.
The existing transport checks this binding through requestOnHost, which reads the retained request: apirunsfollow.go:80. Its deletion ordering deliberately retains the request until after the result: runs/store.go:128.
Fix: retain immutable account/app/host identity until completion acknowledgement or retention cleanup has removed all deliverable objects. Either keep the request that long or introduce separate metadata, allowing SQL to be deleted earlier. Test a result produced after five minutes with a sweep before the next CLI poll.
- P2 — Applying the full db gate to follow routes hides the promised record-change result.
Spec: §9.1:660, against §8.2:525.
The spec places all five routes behind the db door’s gate order. That gate resolves the current instance and returns 404 if it was deleted, or 409 if its class changed: apidb.go:132. Therefore, after admission followed by deletion or a class change, the box can correctly publish record-changed, yet the CLI cannot fetch that result—or send cancellation/completion—through the specified gate.
Existing run-follow routes separate membership and request identity from current instance eligibility: apirunsfollow.go:35, with fallback to retained request identity when the record is gone at line 126.
Fix: restrict current-record eligibility checks to admission and box execution. Follow, ack, done and cancel should check current membership, budget and immutable job identity without requiring the original instance to remain eligible or exist.
Reviewed at 8c118ae7; static review, no runtime acceptance tests. Current flagship module references and deployment-state assertions remain unverified: GitHub retrieval failed, and the available infrastructure checkout predates this design. Referenced platform module code was inspected at both release tags.
REVISE