Skip to content

feat(gateway): bench non-delivering winners; 6-min image receipt timeout; v0.2.68 - #142

Merged
ralyodio merged 1 commit into
masterfrom
feat/gateway-penalty-box
Nov 8, 2026
Merged

ralyodio merged 1 commit into
masterfrom
feat/gateway-penalty-box

Conversation

@ralyodio

@ralyodio ralyodio commented Nov 8, 2026

Copy link
Copy Markdown
Collaborator

Live on dev2: an outside worker (bench 2802) won every diffusion auction over seed2 and never delivered, so callers waited out the 15-min receipt timeout and failed.

  • penalty_box: a winner that fails / goes silent / can't be fetched is benched from this gateway's auctions 30 min, doubling to 6 h, cleared by a delivered job; the job is re-auctioned to the next bidder.
  • diffusion.txt2img receipt timeout 6 min (healthy CPU worker ~2 min).
  • Tests: penalty_box unit tests.

🤖 Generated with Claude Code

… minutes; bump v0.2.68

Live: an outside worker (bench 2802) kept winning diffusion auctions over
seed2 and never sent a receipt, so every caller waited the full 15-min
receipt timeout and failed. Now a winner that fails, goes silent, or can't
be fetched from is benched from this gateway's auctions (30 min, doubling to
6 h; cleared on a delivered job) and the job is re-auctioned. Image jobs get
a 6-min receipt timeout (a healthy CPU worker needs ~2).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Nov 8, 2026

Copy link
Copy Markdown

ThreatCrush Security Scan

12 finding(s)

HIGH/CRITICAL: 1 | MEDIUM: 8 | LOW: 3

Severity Rule Location
HIGH js-ssrf-outbound-request apps/web/public/sw.js:24
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:53
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:80
MEDIUM sh-remote-script-execution scripts/dev-setup.sh:25
MEDIUM sh-eval-expansion scripts/dev-setup.sh:35
MEDIUM sh-remote-script-execution scripts/install.sh:173
MEDIUM sh-remote-script-execution scripts/install.sh:198
MEDIUM sh-remote-script-execution scripts/install.sh:316
MEDIUM sh-remote-script-execution scripts/install.sh:354
LOW py-ssrf-outbound-request examples/business-strategist-agent/chat.py:37
LOW py-ssrf-outbound-request examples/business-strategist-agent/train.py:54
LOW secret-generic-credential node/crates/c0mpute-core/src/webhook.rs:1165

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit c50c199 into master Nov 8, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant