Repository navigation
feat(runtime): one control endpoint per runtime store, one driver per workspace - #6924
Merged
Hmbown merged 5 commits intoOct 14, 2026
Conversation
… one workspace having two drivers
A client that selected its own runtime store still looked for an owner on the
one shared socket, so two clients of the same user on one machine refused each
other ("authenticated Runtime owner belongs to another selected store"). Each
store now derives its own control endpoint from its canonical store root, while
the default store keeps the well-known path — so discovery, doctor and
single-engine setups are unchanged.
The same gap exists one level down: a per-workspace store, a per-session store
and the user-level default store can all point at one working tree. A workspace
now has a single drive lease, held for the engine's lifetime, so a second
driver is refused with the recorded holder's facts (pid, client, store, age)
instead of two engines writing the same tree. Watch-only observers never take
it and stay unlimited.
… design The design behind the change above: one owner per runtime boundary, the control endpoint derived from the same inputs that select the store, and one drive holder per workspace. Phases 2-4 and the open questions are marked as such.
gaord
force-pushed
the
feat/runtime-store-sockets-and-workspace-lease
branch
from
October 9, 2026 02:21
9514a9b to
cb5a1a4
Compare
Hmbown
approved these changes
Oct 9, 2026
Hmbown
left a comment
Hmbown
left a comment
Collaborator
There was a problem hiding this comment.
this is wonderful - thank you so much
Contributor
Author
|
hopefully let all clients work in harmony. Closed by mistake? @Hmbown |
Collaborator
Yes complete mistake |
This was referenced Oct 14, 2026
…ace leases Preserve both original @gaord commits and source branch. Keep owner/store/profile/bootstrap/auth/worker guards; kernel contention never authorizes inode replacement. Counted handles and asynchronous cleanup retain the lease; PrivateDirectory protects selected paths and identities. Windows creation success returns validated RW/noDELETE handle while failure cleanup keeps exact DELETE authority. RuntimeAPI/state-namespace/Unix-derived endpoint limits remain explicit; original9lease/6selector/4socket tests retained. Actual local frozenECD+V3 evidence:42testsrun42passed15284skipped; appserver19testsrun19passed158skipped; registry1passed0failed1filtered; productionCLI andscopedClippyPASS. ActualUnixmanual4PASS/0FAIL,9authGETs,5ownedprocessesreaped,networkNOT_MEASURED/noinference. V2config12/0 andnpm1312/0/7web unchanged exceptcfgtesthelper; originalsource/failures retained. ClippypostcheckEAGAIN recovered with source guard andcached0.80sactual0; initialstale-binary/manualPython failures are artifact-only, preserved. Localproof coversmatched10fullfiles andsameownedhunks in4forkbaselinevariants; it is NOT thiswholeownforktree/newWindows/fullnative/distproof. Fresh exact ownhead hostedCI/review required beforemerge. No newagenttestfunction/comment, no tag/publication/deletion. Refs codewhale-hq#6924. Refs codewhale-hq#6968.
Collaborator
|
Thank you @gaord for separating Runtime stores from workspace driver ownership, and for preserving tests for simultaneous owners and stale recovery. Your original commits are now carried by the own-PR merge with the lease-lifetime and contended-inode repairs. Exact own-head macOS19,057/0/33, Ubuntu19,054/0/34 and Windows18,310 passed(one existing browser-launcher leak)/0failed/27skipped, named Windows owner recovery and actual Clippy/ratchets passed. Four real Unix store/workspace process journeys also passed at their earlier recorded source boundary. Your source branch is retained. This carries the Runtime-API/Unix-endpoint work toward0.10.2; resulting combined-main CI, installed/native-client and final release package acceptance remain separate, and0.10.2 has not shipped. |
added 2 commits
October 13, 2026 21:31
Use exec sleep30 in the existingUnix fixture so the observedPID owns the sleeper directly; preserve start-token/holder assertions andkill+waitcleanup. Old36d Ubuntu19051passed(1leaky)/0failed/34skipped exposed a targetedfixtureLEAK; no leakedPIDtrace orproductiondefectclaim. Actual frozenmacOS: Summary1test run:1passed,15325skipped; zeroFAIL/LEAK. All15hashes stable, other14sourcepaths unchanged. Unchanged priornpm1312/0/7webreusedatrecordedboundary. Newown-headLinux/fullCI stillrequired; cfgUnixfixturedoesnotrunWindows. No newtestfunction/comment/productionchange. Refs codewhale-hq#6924
Retain original human history, both lease/socket/bootstrap/strict-directory guards and current project-trust route/tests/docs. Resolve only the shared RuntimeAPI feature summary and generated source SHA with existing deriveFeatures. Actual scoped registry2passed/0failed; npm101+19+413+7Node plus772Vitest=1312passed/0failed/7skipped. V5stale-source-SHAwebfailure preserved; existinggeneratorrepair thenV6web/fmtPASS. Passingunchangedchecks notrerun. Independent staticparentpreservation reviewPASS; newfullown-headCI/Windows stillrequired. Prior targetedUnixfixtureLEAKand1testMacPASS/sourcecleanupfix preserved. Refs codewhale-hq#6573 Refs codewhale-hq#6915
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@gaord’s contribution gives Runtime API instances per-store Unix control sockets and a kernel-held workspace lease. The repaired branch preserves both original contributor commits and tests. The held kernel lock remains authoritative; a stale PID/receipt cannot authorize deleting a contended inode. The lease is acquired before permanent coordination registration and retained through asynchronous cleanup. Protected directory/leaf admission and Windows creation-handle normalization remain strict.
Current head is 0c8a2afc, a history-preserving merge of the verified fixture repair and main947f670f. Its two feature-row conflicts are resolved so both project trust and the socket/lease feature remain. Generated data comes from the existing generator, including the source hash. CI38513770879 is running on this actual new head; whole-fork native qualification is pending.
The previous36d Ubuntu suite completed19,051 passed(one leaky)/0failed/34skipped. Eight lease cases passed; the existing live-holder fixture was LEAK. Its shell could leave a separate sleeper holding test pipes. The existing command now uses
exec sleep 30; every identity/start-token assertion and kill/wait is retained. This is a source-supported cleanup diagnosis, not a traced leaked PID or production defect. The exact local macOS check ran one existing test:1passed/0failed/noLEAK,15,325 outside the filter. The fixture is Unix-only and gives no Windows fixture result.Scoped local canonical proof: TUI42/0, app-server19/0 and prior registry1/0; four actual Unix process journeys4/0 using the corrected fresh CLI binary. Separate stores/workspaces become Ready with distinct sockets; a third store cannot own the same workspace; SIGINT permits a successor using the same inode; SIGKILL permits same-store reentry. All five owned children were reaped. No provider inference command was requested; traffic was not measured. Signal exit does not prove ordinary Drop or child-protocol cleanup. Original failed privacy-fixture, wrong-binary and runner-name-shadowing attempts remain preserved and excluded.
The feature reconciliation passed two existing registry tests, npm1,312passed/0failed/7skipped, web and fmt with frozen source unchanged. The intermediate stale-generated-hash web failure is preserved and was corrected by the existing generator; passing registry/npm checks were reused for unchanged source. Prior config12/0 and production CLI/CI-flags Clippy retain their original source boundaries. This is scoped local proof, not a clean new-head distribution. No new agent-written test function or code comment was added.
Scope: ownership applies to Runtime API instances, not every CLI/TUI process. Per-store sockets are Unix-only; Windows retains loopback transport. Native app, final packages and actual oldest-Windows acceptance remain separate. 0.10.2 is an unreleased candidate, and this PR is not merged yet.
Refs #6573
Refs #6915