Repository navigation
fix(code-graph): retain authenticated proofs across interrupted successors - #4846
ScriptedAlchemy wants to merge 25 commits into
Conversation
Reapply the six exact issue-owned source and regression blobs from #4791 at 22c534b, without that branch's draft CLI-fixture ancestors. Keep authenticated snapshots across interrupted and overlapping proofs, real one-file successor and corruption regressions, and the validated shutdown and graph-tool corrections from the prior review lane. The original history and draft prerequisite remain intact on their own branches; this single-parent commit starts at master 66963c8. Exact-head Bazel and human review remain required. Refs #4507
|
#4507 exact-head CI blocker — 2026-11-09 (no merge)Read current root AGENTS.md and recursive master tree (no nested AGENTS.md), all 19 issue comments, current master proof implementation, this six-file patch, related #4523/#4520/#4789, reviews and the actual Linux fleet logs. The branch remains at New exact-head failure: Bazel CI #18004 / Linux fleet job 129089747041 completed 182/183 Bazel targets passed; 68 actually executed. Repository gates, scope checks, benchmark harness, Clippy, Dashboard, and feature gates passed. Windows native build/type-check is still running; its native test step has not executed. macOS native is skipped. Do not cancel the Windows run just to retry; once the workflow completes, a targeted Bazel failed-job rerun or an independently executed nonzero isolated reproduction is appropriate, with the real failure investigated if it recurs. Merge hold remains pending a fully green exact-head run, independent human approving review, native sealed-proof tests where available, and reproducible real-checkout before/after one-file-edit wall time + peak RSS. No real-checkout benchmark exists in this environment, so none is claimed. Keep |
An unchanged overlapping proof replaced the shared Arc with an equivalent map, so a concurrently authenticated one-file successor lost its snapshot CAS and discarded its new fingerprints. Retain snapshot identity when no fingerprint differs and the proven key count is unchanged, without adding a full map comparison. Changed and deletion-only proofs still use the existing exact-snapshot CAS. Add real-file regressions for the unchanged-proof/successor interleaving and deletion-only pruning, including an empty result. Strengthen stale commit coverage with a genuinely new authenticated segment. Existing corruption, source-identity, extent and cancellation checks are unchanged. Refs #4507
|
Published review repair Concrete defect: an unchanged parent proof always allocated/published a replacement The one-file production repair preserves the snapshot when all recorded fingerprints equal the parent and the distinct-key count is unchanged. Genuine additions/replacements and deletion-only updates retain the existing exact-snapshot CAS. No second full map scan, source check removal, or non-Unix behavior change. Added two real-file regressions: unchanged overlap must preserve the authenticated edited segment and prune the replaced one; deletion-only/empty proofs must still remove old entries. Strengthened the existing stale-contender test with an actually new authenticated segment so it must exercise the changed-state CAS rather than the no-op branch. All previous corruption/fingerprint/cancellation/extent assertions remain. Hosted Bazel run https://github.com/ScriptedAlchemy/tracedecay/actions/runs/42719106126 (#18222) is pending. The new Rust tests have not yet executed here; local Bazel is unavailable. The preceding head's Linux retry is green but does not validate this commit. MERGE HOLD remains for exact-head nonzero validation, independent review, native tests when available, and representative wall-time/peak-RSS evidence. Sweep coordination: do not duplicate this fix or import #4796's separate |
The daemon retained a full authenticated generation map for every root ever visited, even after that root stopped being used. Keep only the most recently used 32 root snapshots; an evicted root safely rehashes when revisited. Recent successful reads refresh recency without changing the snapshot Arc or the overlapping-proof compare-and-swap. Commits remain conditional on the exact parent snapshot, so eviction cannot promote in-flight stale proof. Add a real-file multi-root regression proving the cap, LRU eviction, retained recent-source reuse and new-root source proof. No bypass of file identity, manifest extent, digest or corruption checks. Refs #4507
|
Published a source/test repair on existing #4846: Confirmed cache-retention defect: Fix: retain the 32 most-recently accessed roots, keeping the same shared immutable per-root snapshot and pointer-CAS for concurrent proofs. Reading a root refreshes recency without replacing its New nonvacuous real-file regression constructs 32 separate authenticated roots and an additional incoming root. It asserts the exact retained-root cap, fresh-hash fallback for the oldest unused root, and positive authenticated reuse for a recently read root and the incoming root. Previous same-file corruption, replacement, extent, cancellation and stale-CAS tests remain unchanged. No dependencies, workflow edits or sibling #4520/#4532 source paths. Validation: new exact-head hosted Bazel run #18286 queued; no new-head Rust test/formatter/Clippy success yet. Predecessor #18222 actually executed the store-runtime suite successfully, but cannot prove this new code. Local Bazel and the representative real-checkout workload are unavailable; no Cargo/standalone Rust commands used. Representative before/after one-file-edit wall-time/peak-RSS, native proof execution and independent approval remain unproven. Preserve merge hold and keep #4507 open. |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
The bounded root cache evicted an authenticated parent while its one-file successor was still proving, so the successful successor lost the snapshot CAS and the next edit had to rehash the whole generation. Skip entries whose authenticated snapshot is held by an in-flight proof; evict only idle roots and preserve the 32-root bound. Keep the stale-proof guard, corruption checks and cold-root reauthentication unchanged. A real-file 33-root regression makes an edited root least-recently-used while its successor is in flight, and verifies inherited and changed source stay warm, replaced source stays cold, and an idle root is evicted. Also apply the exact Bazel rustfmt layout required by current-head gates. Refs #4507
When all 32 cached roots have in-flight proofs, admitting a newly verified root evicted the only idle candidate: the new proof itself. That made the next one-file edit rehash the entire generation. Retain the newest authenticated root temporarily while older parents are pinned; reclaim excess idle roots as the final proof references drop. Keep stale-generation fencing and source identity checks intact. A 33-root real-file regression demonstrates warm source survival, transient over-cap retention and eventual return to the 32-root bound. Refs #4507
|
Published source + real-file regression repair Newly demonstrated performance correctness defect: if 32 distinct roots all have active proof references, their snapshots cannot be evicted without invalidating their successor CAS. The previously implemented strict 32-root eviction then selected the newly successful 33rd root as the only idle victim. Its freshly authenticated generation was immediately dropped, so the next one-file edit rehashed all source again. Repair: LRU trimming now preserves the most recently authenticated root while all older entries are pinned; temporary over-cap entries are bounded by outstanding active proof pins. Falsifiable regression: Exact-head hosted Bazel CI #18334 is pending. No Rust/test pass is claimed for the new head. Local checkout/Bazel and the original ~6.1k-file profiling corpus are unavailable here, so representative before/after full-pass wall-time, source-read and peak-RSS acceptance remains unproven. Existing DO NOT MERGE or close #4507 yet: exact-head nonzero Bazel/native evidence when available, independent human approval and representative same-corpus measurements remain required. This edit did not touch other owners' #4520/#4789 or #4532/#4796 paths, or protected decision-model/release work. No Cargo, force, duplicate PR, test weakening, or infrastructure change. |
The daemon can begin indexing on a filesystem edit before the explicit sync request. Starting wall time and peak-RSS observation after the source write misses work triggered by the edit. Arm both before writing. Exercise the real harness edit path with a deliberately slow write: require RSS observation before mutation, full wall-time inclusion, and correct readiness and peak-memory attribution. Preserve existing full-run fixture integration coverage. Refs #4507
|
Published issue-owned benchmark measurement fix The patch moves timer and sampler activation ahead of the source mutation and keeps stop after the observed new generation is ready; sampling is stopped in Published safely via exact expected old head |
An asynchronous daemon refresh can advance the current generation after initial indexing but before the benchmark edits source. Using the old initial-generation ID could incorrectly accept that prior refresh as the result of the edit, reporting a tiny wall time and missing peak memory. Read and require the latest current, ready generation before mutating the file; only a subsequent nonempty generation ID ends the timed pass. Preserve the sampler-before-write timing and update the observed generation. Exercise a real tracked edit against a deliberately stale index-lane ID, reject a missing pre-edit ID without modifying source, and refuse a false ready result with an absent generation until a real successor appears. Refs #4507
|
Published e4064bbcb350 on existing #4846 ( Actual measurement-correctness defect: the one-file benchmark waits for a generation different from the ID saved at initial indexing, but the daemon can complete another background refresh before the measured edit. The pre-existing generation ID then becomes stale; the old implementation could accept that unrelated already-completed refresh as the edit's result, reporting an artificially short pass and missing incremental peak RSS. A response claiming current/ready with an absent generation ID could also satisfy the old Repair: require a nonempty, current/ready generation ID immediately before mutating the tracked source, use that freshly observed ID as the baseline for the edit-to-ready wait, require a nonempty successor ID, and update the tracked generation after the measured pass. Existing timer/RSS observer still starts before the file mutation and stops after readiness, preserving the previous fix. Falsifiable tests: the existing real tracked-file slow-edit regression now supplies an obsolete initial generation and an independently newer pre-edit generation; it asserts the wait uses the newer ID, includes the deliberate edit latency, and records peak RSS. It also requires a missing pre-edit generation to refuse without changing the source or starting sync, and a missing post-edit generation to be skipped until a later valid successor arrives (two status polls). Previous full fake-daemon harness tests remain unchanged. Validation: new exact-head hosted Bazel CI #18380 pending; no current-head test result claimed. No local checkout/Bazel was available, so this is a reviewed patch awaiting execution, not a benchmark run. Representative same-corpus baseline/head one-file-edit wall time, actual source-read/hash work and peak RSS, independent human approval and applicable native proof tests remain unproven. Preserve merge hold; do not duplicate this issue PR, change protected decision-model/release lanes or weaken validation. |
A tracked source symlink can target a file outside the disposable checkout; appending to the first git ls-files result could mutate operator source. Git's quoted filenames also break whitespace splitting and abort real runs. Select only regular non-symlink files resolved within the private clone, and read NUL-delimited Git paths to retain spaces and newlines. Exercise the full fake-daemon benchmark with a committed external symlink and a spaced Rust source path. Require that only the safe path is selected and the external original remains unchanged. Preserve existing timing and RSS sampling behavior. Refs #4507
|
Published actual benchmark safety/reliability repair Concrete defect: the one-file edit benchmark appended to the first Fix: use NUL-delimited Git output, decode each pathname unchanged, and edit only a regular, non-symlink file whose resolved path remains inside the disposable clone. Preserve the existing pre-edit timer/RSS sampling, baseline generation fence, new-generation wait, and strict error handling. Falsifiable regression: a real temporary Git repository commits an external-target symlink as the first candidate plus a spaced-name Rust file. The full fake-daemon benchmark must select the safe regular file, leave the external original untouched, preserve the original checkout, and clean its temporary run. On platforms without symlink fixture support, the spaced-path control still runs. Prior source would fail this test; it either errors on the quoted path or follows an unsafe candidate. Validation boundary: hosted exact-head CI #18405 is pending. No passing new-head Python/Bazel/Rust tests or representative wall-time/peak-RSS measurements are claimed; no local checkout/Bazel was available. Independent approval and native tests when available remain required before merge. Issue/PR remain OPEN and unmerged. Separate #4520 and #4532 owners are unaffected; no Cargo, workflow change, force push, protected-model/release or production/infra action. |
Use the complete typed status result before the CLI's possibly truncated text preview. Make the existing end-to-end fake-daemon regression emit preview-only text with real readiness in structuredContent, so the former parser fails before any generation becomes ready. Refs #4507
|
Published issue-owned benchmark readiness fix Strengthened the existing real-Git/fake-daemon end-to-end benchmark regression: its successful status now deliberately returns complete freshness, generation, and memory only under Verified GitHub branch/PR both at |
Use a real Rust/Python declaration, not a comment-only edit. Require an exact-name search hit from the served generation before accepting the measurement; exclude this verification query from wall-time and RSS sampling. Snapshot indexed symbols at fake sync time and cover both positive and stale-generation negative controls. Refs #4507
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
Keep wall-time and peak-RSS sampling active until the edited symbol is served by the exact generation reported current and ready. Recheck status after search so a concurrent publication cannot validate an earlier unrelated generation. Refuse absent or mismatched search generations; continue polling within the existing deadline. Exercise missing symbols, wrong and absent search generations, then a verified successor using the actual semantic-edit harness and a frozen fake indexed snapshot. Retain all original isolation and timing checks. Refs #4507
Count completed authenticated segment reuse, whole-segment reads and hashed bytes, plus evidence range traffic, in one bounded tracing event. Capture these real daemon events during the isolated one-file edit timer and report unavailable rather than zero when instrumentation is absent. Add a real one-file successor proof telemetry assertion and executable benchmark parser controls for concurrent, absent and partial events. Retain all existing source integrity and latency assertions. Refs #4507
Reuse the shared Unix process RSS reader on macOS instead of reporting memory unavailable for the host where #4507 was originally measured. Preserve unknown readings, include method provenance, and cover a nonzero observed RSS peak and ps failure in the Bazel benchmark tests. Enable this Unix harness target for native macOS without Windows. Refs #4507
|
Published d2abc3bd38e7 (Refs #4507) with an exact-parent, non-force branch update, independently verified on PR #4846. This fixes the macOS benchmark RSS blind spot: the incident was measured on macOS, but the harness previously returned |
A daemon launcher can exit while indexing descendants still run. Reuse the shared session shutdown authority instead of returning on poll(), so a measured clone is never removed under live descendants. Add a real process-group regression with a dead leader and a live child; retain forced test teardown on the failing implementation. Refs #4507
Restore the original 100644 modes after publishing the owned-process cleanup and process-group regression; retain their exact file blobs. Refs #4507
|
Refs #4507 — source+regression repair published, not just a CI check: |
Preserve authenticated segment reuse and work counters while adopting the forward-only authenticated manifest reader, checked segment opens, and interruption handling.
Restore the executable modes the branch had regressed to 100644, and bound the negative generation test's intentional wait so the new small Bazel target finishes inside its 60s timeout. The assertion still requires the harness to exhaust its own wait and report the absent edited symbol. Refs #4507
Unchanged sealed source segments retain their authenticated proofs across interrupted and overlapping successors. Changed or replaced segments are rehashed, stale completions stay fenced, and inactive root entries are evicted without discarding in-flight proof parents. Feedback and daemon shutdown also release their owned work and clients.
The edit benchmark verifies that the edited symbol is served by the current ready generation. It measures wall time and daemon RSS across the edit, reports unavailable trace evidence explicitly, and retires its process group even when the launcher exits first. The harness scripts retain executable modes, and the negative missing-symbol test uses a short intentional wait.
Validation on this branch:
Hosted CI for the latest head must finish before merging. Representative measurements on the original roughly 6,100-file corpus and broader platform qualification remain tracked in #4507; this PR does not close that incident.
Refs #4507