Repository navigation
Authenticate retained review transcripts without run-wide scratch quiescence - #743
Merged
Merged
Conversation
Parent review refused a completed transcript whenever a sibling assignment still held an invocation scratch on the shared run writer, aborting correct concurrent Block runs. Authenticate the transcript's own manifest record and bytes, keep the run-wide boundary check for checkpoint, finalize and resume, and add a deterministic regression test. Validation: local exact tests 10/10, fmt, clippy, all-targets --no-run, and release build passed. Live mixed/Codex E2E NOT run for this commit (blocked: Grok auth not signed in; host worktree-creation timing; see lane R48-ENV/R48-CTL).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Parent review authenticated a completed child's retained review transcript through the run-wide
resume_binding, which requires no outstanding scratch anywhere in the run. Under Block coordination withparallelism >= 2, an unrelated sibling's open invocation scratch could abort the correct assignment
(observed once in CI as
semantic_block_claims_follow_actual_dispatch_order_with_overlap_scan_ahead).This change adds a per-record authenticated read (
ArtifactRunWriter::read_authenticated) used only byread_authenticated_review_transcript. It still verifies record identity, length and SHA-256, own-pathscratch overlap and poison, owner-private path and inode identity, and writer-lock custody before and after
the read. Checkpoint, resume and finalize keep the full-run boundary.
Tests cover sibling-scratch reads, tamper/truncation/unregistered/live-scratch refusal, own versus sibling
poison, and private-mode/symlink/lock replacement. The scheduler fixture's hang caps go from 30 s to 120 s
(test-only; the ordering handshake and final asserts are unchanged).
Validation
cargo fmt --check, clippy, all-targets--no-run, release build.(
Not signed in, owner-only login) and by pre-existing worktree-creation timing on the WSL host, both shownto be outside this change's code path.