feat(worker): secondmate role plumbing, child bounds, and release gate (R2/R3 PR 1) - #262
Merged
Merged
Conversation
…e (R2/R3 PR 1) The R2/R3 correction begins here, per R2R3-DESIGN.md: the blanket 'workers never run secondmates' refusal becomes an explicit bound on child compute, landed controller-first and inert (no spawn lane routes to it yet). - verify_request accepts role author|secondmate. Depth one by construction: a secondmate compartment is requested only by the primary, so a secondmate owns author crewmates and never another secondmate or nested team. A secondmate-owned author request must name its parent generation; parent fields are refused anywhere else. - Child bounds live in command_request under the ONE lock that inserts, the same atomicity ensure_unique_bindings relies on: FM_SECONDMATE_CHILD_MAX (default 4, max 8) concurrent children, FM_SECONDMATE_CHILD_TOTAL (default 16, max 32) lifetime children counted on the parent worker record, and parent-liveness (children admit only while the parent's entry is assigned). FM_AZURE_SECONDMATE_MAX (default 2, max 4) bounds concurrent compartments. - command_release refuses, atomically under the lock with the whole queue in hand, releasing a parent with active children. - The worker record and every minted action carry role; expected_tags and the Azure provider's action_tags branch on it, so a compartment VM carries agent-capacity one-home-scoped-secondmate and child-launcher absent instead of lying that it is a one-task crewmate. General-worker tags byte-unchanged. Every bound is pinned with its exact refusal string in a new unit driving the real wrapper against the fixture provider, plus an author-request golden asserting no compartment field leaks into ordinary items.
…ondmate lane, pair the parent fields The review caught a design defect both proposals and the judge missed: a LOCAL secondmate home requests its own cloud crewmates today with owner_kind=secondmate and NO parent (the documented docs/azure-workers.md lane, minted verbatim by fm-spawn.sh from the home marker), and the blanket parent requirement hard-refused that argv, including idempotent re-requests of pre-upgrade entries. The parent pair now marks a COMPARTMENT child specifically: present means compartment child (bounds armed), absent means the existing local-secondmate lane, byte-unchanged and now pinned by an idempotent re-request test. A lone half of the pair refuses for every caller shape (the review's identity-poisoning bypass). enforce_child_bounds fails closed on a missing or mismatched parent worker record instead of silently skipping the lifetime bound. Three generation-dimension gaps get red-path coverage: a released compartment holds its cap slot while releasing and frees it at complete; a hand-planted cross-generation child does not block this generation's release; a child re-request with a changed parent generation refuses as a different identity. docs/azure-workers.md's request sentence now names both roles. Also deflaked the concurrency barrier: FIFO release only frees readers already blocked, so release is an existence poll.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
First PR of the judged R2/R3 design (R2R3-DESIGN.md in the owner's evidence folder): the blanket 'workers never run secondmates' refusal starts becoming an explicit bound on child compute. Controller-only and inert - no spawn lane routes to role=secondmate yet; ordinary author requests are byte-unchanged (golden-tested).
Verification
19 units green; new unit secondmate_role_bounds drives the REAL wrapper against the fixture provider and pins every advertised refusal by its exact string: depth-1, missing parent, parent-fields-elsewhere, unassigned parent, compartment cap, fan-out cap (fifth child), lifetime total (with the freed-slot-still-refuses case), release-with-live-children (a full digest-exact proof that then succeeds once children quiesce), post-release parent-liveness, plus the author-item key-set golden.
Seven mutations, each red against the committed tree: depth-1 dropped; fan-out cap dropped; lifetime total dropped; parent-liveness dropped; release children gate dropped; compartment cap dropped; the expected_tags role branch dropped (caught by the exactness machinery refusing the compartment as assigned).
bin/fm-lint.sh and fm-behavior-shards.sh --check 8 clean.