You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(signals): Reap requests before manager exit - #14
Prevent catchable manager shutdown from abandoning killed request descendants
before the executor reaps them, including after retirement of the leader's
process-group identity.
Changes
The synchronized shutdown hook closes the fork gate, terminates the pinned
group and waits for the sole executor's reap acknowledgement. A fixed
one-second deadline fail-stops with status 125 if collection cannot finish.
Executor-side containment failures never wait for themselves.
Verification
Rootless Debian Trixie builds, make tests and make doc pass. Direct C
barriers exercise delayed and stalled descendant reaping. A real-manager
subreaper oracle checks both request kinds with SIGINT and SIGTERM,
independently of container init. The original implementation and missing
wait/deadline mutations fail the corresponding assertions. Test recovery
also covers successive adoptions and is bounded.
Compatibility and documentation
The wire format, public API and ordinary request semantics are unchanged.
Existing SIGKILL/OOM and process-group escape limitations still apply.
README, lifecycle guidance and the Unreleased changelog are updated. No
release tag or native performance claim is included.
Wait for the sole executor to acknowledge complete request reaping
before catchable shutdown exits the manager. Retain that ownership
after the leader group identity is retired, with a fixed fail-stop
bound if the executor cannot finish.
Keep executor-side fail-stop nonwaiting to avoid awaiting itself.
Do not alter the wire format, request results or ordinary spawn path.
Add delayed/stalled C reap barriers and a built-manager subreaper
oracle for both request kinds and termination signals. The original
manager and missing-wait/deadline mutations fail the new assertions.
Supply Python through the CI image, not runtime package installation.
Bound adopted-child collection in the delayed-reaping fixture and
respect OBJDIR when locating the built manager. Keep completed work
in the changelog instead of the public follow-up queue.
Enable subreaping in each forked supervisor because Linux does not
inherit that setting, even though the initialization cache is copied.
Require no adopted child after normal completion and outer recovery
only for the deliberately stalled fail-stop.
The rootless Trixie suite passes. Missing supervisor initialization
and false ECHILD after the reap barrier both fail the new assertion.
Removing that assertion makes the skipped-reap mutation pass again.
Use relative socket paths and restore the working directory
tests/check_signal_reaping.py:103
With a long TMPDIR, the fixture's absolute socket path can exceed Linux's Unix-socket address limit even though the manager binds the short manager.sock address successfully. This raises OSError: AF_UNIX path too long and fails the newly mandatory integration check. Connect relative to the fixture directory, restoring the caller's working directory on both success and failure.
Enable subreaping in the publication supervisor and wait for actual
descendant metadata before releasing its fork barrier. Reuse bounded
recovery and reject adoption at each test boundary, so one fixture
cannot contaminate the next.
The old test fails natively on ARM64. Both ARM64 and emulated AMD64
reject missing subreaper setup and skipped collection mutations;
corrected direct-core runs pass repeatedly on both. Production code
and the wire contract are unchanged.
Connect relative to the fixture directory and use contextlib.chdir
to restore the caller directory on every return and exception. The
harness is sequential, so no other cwd consumer can race this scope.
Add real-socket checks for missing, refused, successful and unexpected
error outcomes under an overlong parent path. Absolute-connect and
cwd-leak mutations fail. The Trixie suite passes, including an actual
manager run with a long TMPDIR. Production behavior is unchanged.
Addressed the long-TMPDIR note from review 5562067112 in 2ceed04. The sequential client now connects with only the socket basename inside contextlib.chdir, restoring the caller directory on both returns and exceptions.
A mandatory real-socket self-check independently proves that its absolute address exceeds the limit and checks missing, refused, successful and unexpected-error outcomes. Absolute-connect and three cwd-leak mutations fail their specific assertions. Both protocol stacks pass full rootless Trixie tests and the actual-manager shell/exec SIGINT/SIGTERM matrix with a long TMPDIR. The socket self-check also passes natively on ARM64. Only test source changed; production and wire behavior are unchanged.
PR #15 is restacked without changing its three V2 patches. Hosted checks are rerunning on both updated heads.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Prevent catchable manager shutdown from abandoning killed request descendants
before the executor reaps them, including after retirement of the leader's
process-group identity.
Changes
The synchronized shutdown hook closes the fork gate, terminates the pinned
group and waits for the sole executor's reap acknowledgement. A fixed
one-second deadline fail-stops with status 125 if collection cannot finish.
Executor-side containment failures never wait for themselves.
Verification
Rootless Debian Trixie builds,
make testsandmake docpass. Direct Cbarriers exercise delayed and stalled descendant reaping. A real-manager
subreaper oracle checks both request kinds with SIGINT and SIGTERM,
independently of container init. The original implementation and missing
wait/deadline mutations fail the corresponding assertions. Test recovery
also covers successive adoptions and is bounded.
Compatibility and documentation
The wire format, public API and ordinary request semantics are unchanged.
Existing SIGKILL/OOM and process-group escape limitations still apply.
README, lifecycle guidance and the Unreleased changelog are updated. No
release tag or native performance claim is included.
Co-Authored-By: GPT-6.1 noreply@openai.com