[Kernel][G01 G12] Repair bounded-task lifetime, recovery and original deadline enforcement #48
Labels
No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
#56 [Kernel][G12] Account for and enforce whole-task budgets across calls, tools and review
Creatidy/creatidy-kernel
#59 [Kernel][G11] Own concurrent tasks, workspaces and manual-edit reconciliation
Creatidy/creatidy-kernel
Reference
Creatidy/creatidy-kernel#48
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Goal
Owner: Kernel. Make the existing bounded-task path preserve its recorded execution envelope and reach honest terminal/recovery/cancellation dispositions without ending active work as a side effect of one CLI step. Source: shared architecture v1.0, sections 1-8, 9.2-9.4, 10-18, owner brief #46 (full file unavailable).
Why
The user is currently told to rerun while the CLI closes its owned Codex process, and a rerun can supply a fresh deadline rather than enforcing the original one. Durable intent does not by itself preserve runtime lifetime or acceptance-time authority.
Current Evidence
At
eb4f4a2956, cli.py _task:336-359 computes a new default deadline and always closes CodexStdio after one run_task invocation. task_execution.py run_task:1265-1284 stores deadline/version/source/mode but recovery checks task digest/base pin only; authorize:1348-1355 uses the incoming deadline. The docstring limits deadline to dispatch, not verification. run_task:1385-1386 reports rerun to advance; it never journals runtime.cancel. ports/application.py terminal candidate=None returns unknown before terminal failure handling. reference_live.py has a distinct bounded observation/cancellation composition; do not confuse it with this path. Findings are source-verified, not a live incident reproduction.Scope
First reconstruct a deterministic failing timeline, then repair owned-session lifetime/recovery, persisted envelope/version compatibility, terminal no-candidate disposition, explicit cancel Operation/reconciliation and decision-time deadlines. Select lifecycle from existing native behavior and the harness feasibility result, not a new supervisor by default. Keep one mutating controller and no shared IDE/session takeover.
Acceptance Criteria
Reuse
Compare reference_live's bounded observation/cancel journal and CodexStdio process-group cleanup with current native Codex/Kilo lifecycle support; retain durable core operations and identity snapshots. Verify exact native version/files/license and process semantics before adapting. Do not copy an entire runner or build a daemon without necessity evidence.
Constraints
No new task intake, gateway policy, automatic remediation, quota resets or live execution authorization. Preserve immutable persisted IDs/state, no uncertain-effect retry, closed child environment and exact-candidate evidence. Any state migration preserves old envelope bytes/unknowns and fails safely on unsupported records.
Dependencies And Priority
Immediate safety repair before live bounded tasks; not blocked on choosing every future harness. Harness control proof informs lifetime strategy; whole-task accounting and product review build on it. Process ownership changes beyond accepted trust require an explicit ADR/owner decision, not a routine blocker escalated by default.
Diagnostics And Permissions
Status must explain active/reconciling/terminal/expired/cancel-uncertain with safe next actions and no secret/runtime transcript exposure. Synthetic acceptance is mandatory. Live cancel/recovery evidence needs separately authorized inference/service access and disposable tool/effect scope; this issue registration grants none.
Links
Non-Goals
No own harness, UI supervisor or full accounting implementation; no inference or merge/deploy under the documentation mandate.
STOP_REVISE: Whole-PR Review Bound Reached
Invocation
kernel-loop-20261005T102040Z, same issue delivery and PR #69: #69. Final fresh whole-PR review ordinal 10/10 returned REQUEST_CHANGES on exact HEADcf168070830659e95813b70327e6ebb8ed52c015, base/merge base72aedfd51e357f52e90c58f1302f60bc0a92f0dd. Taskses_ef2115530ffe2PnIiOMsQgd10H. No infrastructure blocker and no approval; passing tests are not accepted whole-issue proof.Remaining Findings
src/creatidy_kernel/adapters/cli.py:381-393: ongoing advancement never consumes CodexStdio progress notifications. Unsolicited agent-message/command-output deltas accumulate across requests until the notification buffer overflows and closes the owned process. Reviewer exercised actual framing/buffering/cleanup: 512-byte limit caused third individually bounded healthy read to terminate (570 accumulated bytes); draining allowed 20 healthy reads. Production's 1,000,000-byte limit postpones, not removes, this lifetime defect; OverflowError also escapes the controlled disposition path. Required scoped remedy: bounded consume/discard of irrelevant notifications while preserving per-frame/exchange/server-request refusals, plus healthy cumulative-notification regression. No post-bound patch performed.tests/test_cli.py:272-285: actual Kernel task-lifecycle negatives for partial descendant shutdown and foreign/shared processes are absent. Direct fake-server timeout/mocked teardown and source-task bystander assertions do not prove process ownership behavior. Required scoped remedy: offline disposable/process-shaped partial-shutdown and unrelated/shared-target negatives, unproven settlement/retained workspace and durable no-duplicate cancellation/recovery. No post-bound tests added.Review History (All Consumed)
6e2d095f1c5048c5cef9b069bcedfa5048c5cef9a252915e095048c5cef90624be9fba5048c5cef9fcfbcef4375048c5cef9352d8bd6365048c5cef9e7b6eb78255048c5cef9063b64dd8c72aedfd51e4482eb4eea72aedfd51ecf1680708372aedfd51eOrdinals 2-10 followed normal remediation commits on this same PR, never amend/squash/force-push. Existing owner maintenance merge
7d3297f26383435270e0282709531abdaf60b9e3integrated PR #70's new base; it did not reset the counter. Binding inherited unchanged; each reviewer was a fresh independent context, no resumed reviewer/self-approval.Evidence And Patterns
Parent and reviewer
make checkPASS, 1010 tests + 50 subtests, full locked format/lint/types/imports/secrets/whitespace gates;make package-checkPASS. Tests executed with closed synthetic/minimumenv -i, offline locked tooling, no owner environment/secrets. Exact HEAD canonical CI #2268 failure, https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/105. Supported job-log API returned 404 for both displayed run ID and UI run index, so the CI failure cause is not claimed; no direct REST fallback or remediation beyond the bound.Recurring semantic patterns across the experiment: volatile cancellation vs durable intent; cleanup before control evidence; separate terminal/Finish facts and crash reconstruction; retrieval uncertainty mistaken for absence; original fixed selection missing before Attempt. Those were remediated with regression evidence, but final notification lifetime defect and missing ownership negatives mean acceptance is still incomplete. STOP_REVISE preserves the experiment/history, not implementation authority or an approved result.
The entire loop stops: issue and PR remain open/unmerged; clean issue-48 branch/history retained, no review 11, further patch, next queue selection, main/release/deploy or live inference. Append-only excluded ledger preserves all counts. An open PR or generic phase reentry cannot restart/reset this delivery.
Previously delivered #47/#66 remains independently approved/integrated and closed: merge
5048c5cef95e546377d5e20baeae16b99b1bd088; its separate 3-review history is retained. That bounded research reception is not product GO or live conformance.Cycle 2 Remediation: BLOCKED on canonical CI evidence
Invocation
kernel-loop-20261005T102040Zretained. Explicit owner-authorized cycle 2 remains 0/10; all ten cycle-1 reviews/STOP_REVISE/history remain preserved. Same PR #69, no replacement or history rewrite.Normal remediation commit
0ad9e1d4a2pushed and verified against MCP/local/remote; cleanissue-48-task-lifetime. Current canonical develop/base9dfa20931a; merge base72aedfd51e. Current canonical loop/rules reloaded.Changes: normal task factory validates and discards nonauthoritative progress rather than accumulating it across healthy exchanges; existing buffered-consumer default and message/exchange limits remain. Malformed notifications, unsupported server requests, oversized frames, excessive valid progress per exchange, malformed JSON and wrong response IDs still fail closed. Owned cleanup refuses shared groups and checks/escalates remaining owned descendants after leader exit; only observed group absence can establish local group settlement. No escaped/remote descendant settlement claim.
Actual framed
run_taskregression replaces the boolean-survivor fixture: thirty healthy advances of one original turn, a real SIGTERM-resistant forked descendant, exact durable cancellation target, live descendant before SIGKILL, only owned-group signals, concurrent independent bystander survives, workspace retained, descendants remain durablyunproven, closed-transport recovery does not reinterrupt/start or accept/deliver. Separate real shared-group refusal and teardown tests retained.Validation in closed synthetic environment and existing locked tooling:
make check: PASS, 1020 tests + 50 subtests, format/lint/basedpyright/import boundary/secret scan/whitespace passed.make package-check: PASS, reproducible wheel/sdist and isolated installed CLI replay/export.make audit: PASS, no known vulnerabilities.tests/test_codex_stdio.py tests/test_task_execution.py tests/test_cli.py: 114 passed.git diff --check: PASS; complete accumulated PR source/docs/tests delta inspected.Canonical CI is not passing. Historical run #2268 (UI105,
cf168070...) and new exact-head run #2317 (UI108) both report failure; new run: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/108 . Commit-status resources independently confirmci / check (pull_request)failure but expose only duration, not step/error. Available MCP jobs/logs APIs require Forgejo v16+, while this host was independently diagnosed as 15.0.8; supported jobs calls return 404. A materially different artifacts read also returns 404. Current browser UI redirects to/user/login, as do prior public readers. Available MCP resources have commit statuses but no compatible log reader.Precise missing capability: authenticated read-only Forgejo-v15 Actions job logs, or a compatible supported connector, for failing runs 105/108. Product/test versus infrastructure cause remains unknown. Local green checks are not substituted for canonical CI, and no blind rerun/check weakening or credential/state inspection occurred. Owner-required validation evidence is incomplete, so no cycle-2 whole-PR review was dispatched; first remains ordinal 1/10 after the prerequisite is resolved. No approval, merge, issue closure, new selection, live inference or broader authority.
Resumed the same invocation/cycle 2 under the owner's 2026-10-06 continuation; earlier premature BLOCKED and all review history remain recorded. Fresh canonical PR HEAD
0ad9e1d4a23394a8c66ec6b3eb09e41d8c78d4b3, develop9dfa20931a46931d1e97d1f0efddcf2692afb7a7; cycle 2 remains 0/10.Owner-authorized isolation exception: one detached validation-only worktree at
/tmp/kilo/kernel48-integration-20261006T0653Zwill construct ordinary current-develop + PR-HEAD merge content without changing/pushing the published branch. Closed synthetic HOME/temp/cache, current workflow uv 0.9.30/Python 3.12, locked sync,.ci-sqlite-storage, check/package-check/audit. The primary remains sole mutator. Existing owner worktrees untouched. Results and exact merge/tree objects will be recorded, followed by fresh whole-PR cycle-2 review. Canonical CI failures are not waived or claimed passing.Resumed Cycle 2: Exact-HEAD Approval, Canonical CI Gate BLOCKED
Same invocation
kernel-loop-20261005T102040Z, issue #48, PR #69, branchissue-48-task-lifetime. Prior premature BLOCKED was corrected through current-base reproduction and independent review; no history/counter reset or new cycle.Current HEAD:
d183007881ccaf83cc5b5f3c53a8478915e5bcbaCurrent canonical develop and merge base:
9dfa20931a46931d1e97d1f0efddcf2692afb7a7Current tree:
3575bc016afd21fc9e834ded98e588e4a2b12c84Historical merge base
72aedfd51e357f52e90c58f1302f60bc0a92f0ddand original cycle-20ad9e1d...preserved; original HEAD remains ancestor. Fresh MCP/Git final checks match; both normal and authorized detached checkouts clean. Issue/PR remain open and PR targets develop.Current-Base CI Reproduction
Owner-authorized single detached worktree constructed conflict-free ordinary validation-only merge
fa271df8734a6244c9dd11c3cb0557a97d3ac8b8, tree2dd86e3bb5591369808b6a2dca7d4c241f7450b0, parents original current develop +0ad9e1d...; that validation-only commit was not published. Fresh synthetic HOME/temp/cache, uv0.9.30, Python3.12.3 then uv-managed3.12.12, actual.ci-sqlite-storagepath, locked sync and check/package/audit passed. Ordinary merged688b7c...incorporated current develop into the SAME published PR branch without rewriting history, with exactly that tested tree; therefore subsequent canonical runs received explicit current-base content.Additional runner-style shallow, detached depth-one exact-HEAD reproduction on
932d39a...used disposable Ubuntu24.04/non-root Docker with init, uv0.9.30/managedPython3.12.12, action-shaped venv/PATH/cache, locked sync, owned native storage and no host/private credential mounts. All gates passed (1028 tests + 57 subtests). Container and owned image/volume were cleaned. This is a controlled execution reproduction, not an attestation of the actual Forgejo runner.Normal Scoped Remediation
932d39a...: expiry/cancellation now permits original already-claimed PR effect read-only reconciliation, not new dispatch. Known-reference crash crossed the deadline/cancellation and was first reproduced failing; unchanged deadline/acceptance, no duplicate push/start and no unclaimed dispatch now tested. Dispatch permission rechecked before claim/apply.856b905...: pinned setup-uv public download explicitly gets emptygithub-token, not the automatic Forgejo token. Exact pinned source proves the default token forwarding. Synthetic public artifact probes returned anonymous200 versus deliberately invalid authorization401; no real credential was used. Versions, locks, steps and gates remain unchanged. This verifies a compatibility/privacy defect, not the hidden canonical failed step.3807efe...: exact-handle failed/interrupted terminality is persisted without inventing missing model resolution. Identity stays unknown and candidate acceptance blocked; receipt-only replay survives terminal-publication crash without another native read/start. Native and typed regressions first reproduced the defect.d183007...: a fresh invalid/expired deadline is rejected before durable initialization; the same control path then accepts corrected explicit/default input. Existing original expired-task reconciliation remains allowed. Four cases first reproduced orphaned-database creation.Preserved Independent Review History
Cycle 1 remains 10/10 with its STOP_REVISE evidence immutable. Cycle 2 is 6/10:
0ad9e1d...d688b7c...932d39a...856b905...3807efe...d183007...Review 6 native foreground result
ses_eef8f8e9cffepKbIOag547qF3Rindependently reviewed the COMPLETE 16-file accumulated PR and all six acceptance criteria, exact public protocol/license/action pins, and reran full gates. Fresh independent equivalent read-only execution preserved the full reviewer contract/inherited binding; parent froze both checkouts throughout each review. No parent self-review substituted.Final Validation And Remaining External Evidence
Current exact-head isolated action-shaped
uv sync --locked,make check,make package-check,make audit: PASS, 1038 tests + 57 subtests. Independent reviewer likewise passed check/package/audit (1038 + 57). Normal-checkout full gates also passed. No findings remain at exact current HEAD/base.Canonical exact-head run #2322 / UI113 remains FAILURE, confirmed again by MCP run and commit-status resource:
ci / check (pull_request), duration1m14s. https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/113 . Earlier changed-content runs #2318/#2319/#2320/#2321 also failed. Their actual failing step/cause remains unavailable: supported v16 job API returns404 on independently verified Forgejo15.0.8; public readers/UI require sign-in; status resources provide no error. Pinned workflow machinery research, materially different runtime/content/environment reproductions and identified repairs did not establish that hidden cause. No platform pass or attribution to infrastructure/product is invented.Legitimate terminal BLOCKED: required canonical CI remains failed after exact current-base validation and complete independent approval. The remaining missing external evidence is authenticated supported Actions job/runner diagnostics or repaired canonical execution allowing targeted diagnosis and gate verification. This is not stopping solely because a log API is missing and is not an owner architecture/merge-permission question. No evidenced content remedy remains; blind reruns, empty commits, extra unchanged reviews, security/access expansion and check weakening are not used.
No merge attempt/force/auto-merge, issue closure, next SELECT, live inference, main/release/deploy or broader credential access. Native approval is preserved but cannot replace the failed canonical gate. The single detached exact-head locked validation worktree is retained for bounded reentry; all counters/history remain append-only.
COMPLETE: Merged And Integrated Acceptance Verified
Same invocation
kernel-loop-20261005T102040Z, PR #69. Canonical merge to develop only succeeded through the supported MCPstyle=merge, no force/auto-merge or history rewrite.Approved HEAD
8b995c1d88df0fe10b320bfcdf632053adba5e42; approved base9dfa20931a46931d1e97d1f0efddcf2692afb7a7. Merge commitcb4afda2f1, parents exactly that base + HEAD, tree8e424f94bbequal byte-for-byte to the independently reviewed tree. Both ancestry checks passed; fresh PR metadata confirms merged/closed. Normal checkout safely returned to clean current develop.The actual runner failure was diagnosed by the owner: a test patched the shared
time.sleep, intercepting CPython subprocess timeout polling before admission.88d4d80...fixes test isolation only, replacingcli.timewith a local real-clock/control-sleep proxy. It asserts the original task is executing at the synthetic polling interrupt and delegates actual Popen.wait with unchanged global sleep. All 21 CLI cases, including startup/RPC signal semantics, passed; affected[5-True]passed 20/20 consecutive executions with no added sleeps/retry/timing assumptions. Canonical CI #2327 then succeeded.Fresh cycle-2 review 7 subsequently found a separate real decision-time defect, deterministically reproduced at turn, verification command, acceptance and PR dispatch (four failures before fix).
8b995c1...performs cancellation polling before sampling authority clocks, preserving original deadline/cancellation state. Four negatives pass; no late turn, verification command, satisfaction or PR effect. This is accepted #48 AC2/5 remediation, not altered cancellation semantics to satisfy the CI test.Cycle 1 remains preserved 10/10; cycle 2 9/10 consumed. Ordinal7 REQUEST_CHANGES repaired; ordinal8 COMMENT infrastructure final-ref connectivity failure (not a defect/approval) consumed; changed explicitly scoped HTTPS resolver/HTTP1.1 operational path diagnosed/preflighted without credentials/TLS/configuration weakening; fresh independent ordinal9
ses_eee17a736ffetc736kbXpR93Irreturned APPROVE, findings [] for the complete 16-file current HEAD/base. Independent first/final Git and MCP refs, exact clean objects, public immutable source/license and all six acceptance criteria verified. No parent self-review substituted.Integrated acceptance mapping:
Validation on exact merged develop:
uv sync --locked,make check,make package-check,make audit,git diff --checkPASS, 1042 tests + 57 subtests. Parent action-shaped Python3.12.12 and independent review gates likewise passed. Required exact-head PR CI #2328 SUCCESS, and integrated develop push CI #2331 SUCCESS: https://forgejo.creatidy.com/Creatidy/creatidy-kernel/actions/runs/116 . Previous failed runs and all ledger evidence remain historical, not relabeled passing.All six repository/synthetic acceptance criteria verified integrated; issue closure follows this evidence. No live inference/backend proof, detached survival, hostile isolation, product GO, main, release, deploy or broad credential access authorized/claimed. Fresh SELECT continues under the same invocation only after closure verification.