Repository navigation
audit: 12 bug fixes, three decided behaviour changes, cleanups across every module - #486
Merged
Merged
Conversation
… drop restating comments
…den is rebuilt resolveGolden fell back to the template store whenever the pool golden was momentarily empty (first build, image change, reload), so claims on a pooled key cloned a tenant's promoted image.
During shutdown eng.Close refuses new commands with ErrStopping; counting those as clone failures could reach the streak and delete a healthy golden's stamp, so the next start rebuilt it from a cold boot.
…he node A candidate that read the claim and then dropped the reply (timeout, reset, 502/504 edge) may have committed it; trying the next candidate or the origin claimed a second sandbox the caller never saw, billed until its TTL. Only a dial failure, a redirect, or a sandboxd refusal moves on.
…n holds it Only the idle timer and a new dial dropped a reader, so a tenant that kept one reader connection open across a wake or release kept an uncounted, unbilled warm VM running its own guest disk. The reap tick now drops every reader whose claim no longer sleeps on the source it serves.
ClaimCheckpoint took the unguessable id as the capability, while list and delete already scoped to the caller's tenant; a tenant holding another tenant's checkpoint id could branch its memory and disk.
…nswers 404 takeBack found the row taken and dropped the claim, but handOffForRoom treated that ErrUnknownSandbox as a failure: the wake answered 429, armed the quiet period and missed wake_handoffs_total.
Every hand-off presents the claim's bearer token to an address learned from gossip; checkpoint_peer_heal and live moves already require an encrypted mesh for the same reason.
…n contract A bridge tap survives vm hibernate and restore of the same VM (contract B11); the refusal holds because restore resumes the guest inside the call, before sandboxd can re-lock (B10).
…ptures under publishCheckpoint read TunOff before exportSource took sb.Transition, so a SetTun enable landing in between captured a guest with tun0 up into a checkpoint whose branches start with tun off.
pumpStdin treated any read error from Cmd.Stdin as EOF, so a reader that failed mid-stream truncated the command's input and Run reported success, unlike os/exec.
A tagged 404 runs Lookup, and a released sandbox answers 404 everywhere, so a blackholed peer held the caller for the transport dial timeout when its ctx had no deadline.
The server was spawned in silkd's group and killed by pid, so a reaped, stopped or TTL-expired server orphaned its own children (cargo check, proc-macro-srv, tsserver); exec and session already group-kill.
lifecycle left an archived claim behind on any failure, which made the next run see Archived=1 at once; coldproof and demo leaked a claim to its TTL on an exec error.
…side ClientOption
…ause conn.go already states
…emplate delete query
…benchmarks once The architecture diagram and lane summary live in docs/index.md.
…dirty-marker wording Token model stays in sandboxd-api.md, the 429 causes get one Admission refusals section, the reader wire behavior and operator view split between the API and deploy pages, the systemd unit is linked rather than copied, and the archive_failover plaintext-env fact stays in security.md and the deploy table. The dirty-marker text now describes what UnmountVolume and DetachVolume check; the usage node note says a rename lands the journal again.
…fixture claim, silkdtest path
…red node_info server
…p with a sentinel ARP
…ytes and WaitStacks through storetest, fold peer round-trip tests
…by the failure-retry test
…clone path, manifest env for the missing-manifest test
…essors for fake engine state
…ts in the egress tests
…minism test of a pure function
…drop the host-dependent self-address test
…ts, subtests per table row, one table for the preview failure statuses
…unting sandbox for keep-alive, git plumbing asserts the guest request
…stack dump lazily
… stays on the wire The SDK test pins that an explicit empty add/remove list is sent; omitempty dropped it.
… an owner moves DialPort, Lsp.Request, OpenPty, Watch, Logs, Attach and WriteFile only rebound and failed once, while the Python SDK re-sends them; the move tag is raised at the dial or upgrade reply, before any frame, so a re-send is safe. Run with Stdin and Push still fail once: they stream the caller's reader.
…g it A SIGKILLed shell cannot pass SIGHUP to its jobs, so a background job started in an abandoned web terminal kept running; ssh delivers the hang-up. The shell now gets SIGHUP and SIGKILL only after a 2 s grace, and the master keeps draining after the client is gone because a session leader exits only once its tty output drains.
openpty opened /dev/ptmx without O_CLOEXEC and set it with fcntl afterwards, so an exec forked on another connection in between inherited the pair and kept the pty alive after the shell exited. posix_openpt and the slave open now pass O_CLOEXEC; a unit test asserts both fds on Linux and macOS.
…test's drain loop
CMGS
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Whole-repo static audit of main 1a48e2b. Every source, test, doc and infra file was read in full, across 8 logic lanes, 7 style/simplify/LOC batches, docs-vs-code and infra. No hardware or E2E runs in this round.
Bugs fixed (each with a regression test that fails without the fix)
pool: retire a reader whose claim woke or left…ClaimCheckpointtook the id as the capability; a tenant holding another tenant's checkpoint id could branch it. Now scoped like list and delete (docs updated).pool: a tenant branches only its own tenant's checkpointsresolveGoldenfell back to a promoted template while a configured pool's golden was rebuilt, cloning a tenant image for a pooled key.pool: never serve a pooled key from a promoted template…ErrStoppingduring shutdown counted as a clone failure and could delete a healthy golden's stamp.pool: a clone cut off by engine shutdown never counts…pool: record a checkpoint's tun state under the transition lock…pool: a wake hand-off whose peer adopted…archive_failoverhands claim tokens to gossip-learned addresses but did not requiremesh.cluster_key(heal and moves already do).config: archive_failover requires mesh.cluster_keysdk: never resend a redirected claim…Runtreated a stdin read error as EOF;Lookupprobes were unbounded.silkd: kill a language server by its process groupopenptyset close-on-exec after opening, so a concurrent fork could inherit the pair. NowO_CLOEXECfrom birth.silkd: open a pty with close-on-exec set from birthe2e: release the claim on every driver error pathBehaviour changes decided in this round
DialPort,Lsp.Request,OpenPty,Watch,Logs,Attach,WriteFile) re-send after an owner move, like the Python SDK.RunwithStdinandPushstill fail once.Cleanups
Simplify / LOC-justify / comment / layout items across pool, server, store, egress, outbound, tunnet, engine, metastore, SDKs, mcp, e2e, silkd, boot/init and the Python packages. Examples:
CAS.One/CAS.Allreplace the per-package PG row plumbing;openRelay;harness.Poll;Client.close()in Python;Numbers (1a48e2b..HEAD)
Comment lines: Go/Rust 43 added, 70 removed; Python 0 added, 1 removed.
Checks run
make go-lint:0 issues.×10 (5 modules × linux/darwin).asl: no rule findings. The 4 advisory forwarders (replaceArchive,skipIdle,refillGated,isZero) are kept because each names a predicate or flag combination.go test -race -count=1 ./...passes in every module. The PG-gated packages were also run against a real PostgreSQL in one worker pass.-D warningsand tests pass on macOS (178) and in arust:1.99.1linux/arm64 container (180). boot/init: 15 on macOS, 17 on Linux.sdk/pythonhas 292 passing. Adapters: 10 + 15 passing on 3.12.Coverage
Known items kept without code
/ownerlookups are not rate-limited. Each request costs one PG point lookup, and a limit would throttle lookups during failover.engine.Removekeeps returning not-found; a test pins that contract.TestS3BackendContractRealEndpointdoes not run in CI (no S3 service); it is a hardware-round item.