Repository navigation
feat(lifecycle): opt into built-in host process supervision - #811
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@codex review |
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
Security findingsAdvisory findings (1)
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b3d1ae0ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
🛡️ Codex Security Review · Automatically triggered
Here are some automated security review suggestions for this pull request.
Reviewed commit: 4b3d1ae0ce
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
…or-opt-in # Conflicts: # docs/reference/v5-model-coverage.md # scripts/lib/tla-runtime-models.ts
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b5b9860f40
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
@codex review |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…isor # Conflicts: # docs/reference/v5-model-coverage.md # scripts/lib/tla-runtime-models.ts
…or-opt-in # Conflicts: # docs/reference/v5-model-coverage.md
|
@codex review |
|
Ready for lead: 8ffd3c0 A normal merge of #802 at eb47cc8 (which carries What I ran (Linux 6.8 x86_64): Where the tests ran: locally on Linux 6.8.0. Hosted at the previous head 88f8546: Supervisor jobs on macOS 15.8.2 (arm64), macOS 15.7.9 (Intel) and Ubuntu 26.04.1; Candidate core on macOS 26.7.2; Docker e2e on Ubuntu 24.04.5 (all green). At this head, hosted CI was still queued at note time (8 pass, 22 pending, 0 failed); I did not wait for the macOS jobs. Review: the persistent Codex reviewer is CLEAN at this head (it checked the project.ts auto-merge against #797/#795 and the bounded-spawn lint). The Codex GitHub bot was re-requested. |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…on a sibling Every guard took a blocking flock on the shared lifecycle.log around each record. A guard stopped (SIGSTOP, a debugger, a hung write) while holding it stalled every sibling guard's loop in flock: no output, no exit detection, no stop handling. Captured on macOS as the 9/100 failure of expired_target_does_not_abandon_other_recovery (worker guard blocked in Lines::flush -> flock while the frozen blocked guard held the lock). Each record is now one write on the O_APPEND descriptor with no lock. The kernel places each append atomically, so whole records from different guards never interleave on a local file system; only a short write (for example a full disk) can split one. The unused flock retry helper and its unit test are removed. Regressions: held_log_lock_never_stalls_a_guard holds the log flock from outside for the whole run and requires output to reach the log and stop to answer stopped within the normal bound (fails with the old lock); concurrent_guards_append_whole_records_without_a_lock checks two guards bursting 64 KiB records leave only whole, unmixed records. Docs state the log's ordering and integrity and list every lock, who can hold it across a blocking call, and the bound. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…hort-write causes Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…or-opt-in # Conflicts: # docs/versions/v5/getting-started.md
…sor lock table Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
@codex review |
|
Ready for lead: a9bc571 Merge after #802, then merge Merge resolution: one conflict, Generated files: regenerated, with no diff: Docs: the "Locks and waits" table now lists #811's waits, verified against the code by the reviewer:
What I ran (Linux 6.8.0 x86_64):
Hosted CI: 9 pass and 21 pending at note time; I did not wait for the macOS jobs. Hosted OS coverage at the previous green head is in the earlier note: macOS 15.8.2 arm64, macOS 15.7.9 Intel, Ubuntu 26.04.1, and Ubuntu 24.04.5 for Docker e2e. Reviews: the persistent Codex reviewer is CLEAN at this head. I re-requested the Codex GitHub bot. |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…isor-opt-in # Conflicts: # .github/workflows/lifecycle-supervisor.yml # docs/lifecycle-supervisor.md # docs/lifecycle.md # docs/reference/v5-model-coverage.md # packages/lifecycle-supervisor/Cargo.toml # packages/lifecycle-supervisor/README.md # packages/lifecycle-supervisor/src/main.rs # packages/lifecycle-supervisor/src/os.rs # packages/lifecycle-supervisor/src/protocol.rs # packages/lifecycle-supervisor/src/storage.rs # packages/lifecycle-supervisor/src/supervisor.rs # packages/lifecycle-supervisor/tests/fake_caller.rs # scripts/lib/tla-runtime-models.ts
|
@codex review |
|
Ready for lead: 897cb3e A normal merge of Squash resolution: 13 conflicts, all in files #802 touched (the crate, the supervisor docs, the model registry and coverage doc, the workflow).
Generated files: I regenerated them; none changed. That covers What I ran (Linux 6.8 x86_64):
Hosted CI: 8 pass and 22 pending at note time. I did not wait for the queued macOS jobs. Review: the persistent Codex reviewer is CLEAN at this head. It verified the patch-equivalence proof and checked #860/#818 for interactions. I re-requested the Codex GitHub bot. Next: #821 follows once this lands (it merges |
|
Codex Review: Didn't find any major issues. Breezy! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security Review · Automatically triggeredSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
…econcile Brings in next at 081a526 (#811 supervisor opt-in runner, #863 candidate launcher names HACK-2251, #808 desktop Logs tab). No conflicts. The CLI reference, machine-output table and error-code reference regenerate unchanged; E_DAEMON_SERVICE kept. #863 changes which launcher printed commands name and the candidate update refusal; it does not change the executing-CLI identity, the service program checks, durability or the post-update binding, and a candidate install is still refused before any install or reconcile. #811's supervisor reads process identities through process-tree.ts and runs its own sibling binary; it does not use this PR's ps/lsof helpers, process-ancestry or the orphan sweep. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Resolve conflicts with #811: scripts/lib/tla-runtime-models.ts keeps both the autostart-start-stop and lifecycle-controller contracts; getting-started keeps both paragraphs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…nner #811's opt-in `lifecycle.runner: "supervisor"` runs its companion binary even with no hooks or processes, so a runner-only project passed admission and the login child executed the supervisor preflight. Refuse any runner other than the default "mux" at admission, before a claim or dispatch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add
lifecycle.runner: "supervisor"for Compose host lifecycle processes; omitted settings keepmux. Persistent hooks retain their order, logs keep the existing private TSV path, and down/restart follow the recorded runner.Depends on #802 and its pending native recovery/resource fixes. Packaging is a separate slice. Before hooks or ownership publication, the CLI verifies the sibling executable's permissions and exact version/capability handshake. Compiled installations ignore the executable override; source development and tests may select an explicit binary. Doctor reports its resolved path and version.
Ownership and recovery:
Default mux compatibility changes are explicit: state mutations serialize on
state.lockand publish atomically at mode 0600. Empty or unparsable JSON from older non-atomic mux writes is preserved in a timestamped sibling, explained once and treated as empty. After supervisor ownership has been published, a durable marker disables this fallback. Unsafe links/foreign ownership and semantically invalid records continue to refuse; global observers keep that project unknown and continue. Runhack downbefore downgrading or switching CLI builds, since older parsers cannot preserve supervisor ownership.Validation on Linux:
macOS arm64 and Intel jobs are intentional: native identity, Unix sockets, descriptor handling and peer credentials require real Mac execution. Workflow filters now include dependent CLI sources and every executed test; controller checks use the built release executable. Docker shard 4 runs both lifecycle scenarios under the supervisor runner.
Release intent: optional capability (
feat), with the state compatibility corrections above. No lifecycle default change, zellij removal, PTY, log rotation or support for deliberately escaping sessions in this slice.