From b8c76fd0d955e4d540e9caf2b73a2abbf784dc14 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Fri, 7 Aug 2026 19:55:32 +0100 Subject: [PATCH] Seal bounded worker runtime failures --- .../src/bin/epiphany-openai-runtime.rs | 34 +++++++++----- notes/fresh-workspace-handoff.md | 44 ++++++++++++------ state/ledgers.msgpack | Bin 557386 -> 557964 bytes state/map.yaml | 10 ++-- 4 files changed, 57 insertions(+), 31 deletions(-) diff --git a/epiphany-openai-runtime/src/bin/epiphany-openai-runtime.rs b/epiphany-openai-runtime/src/bin/epiphany-openai-runtime.rs index 38846497..1d67833b 100644 --- a/epiphany-openai-runtime/src/bin/epiphany-openai-runtime.rs +++ b/epiphany-openai-runtime/src/bin/epiphany-openai-runtime.rs @@ -155,7 +155,9 @@ async fn main() -> Result<()> { ) .await { - Ok(result) => result?, + Ok(result) => { + seal_worker_runtime_result(&timeout_store, &timeout_job_id, result)? + } Err(_) => { let summary = format!("Worker runtime timed out after {seconds} seconds."); let result = fail_worker_and_openai_jobs( @@ -176,14 +178,11 @@ async fn main() -> Result<()> { } } } else { - match run_worker_options(options).await { - Ok(summary) => summary, - Err(err) => fail_worker_for_runtime_error( - &timeout_store, - &timeout_job_id, - err.to_string(), - )?, - } + seal_worker_runtime_result( + &timeout_store, + &timeout_job_id, + run_worker_options(options).await, + )? }; timeout_guard.store(true, Ordering::SeqCst); print_json(&summary)?; @@ -614,6 +613,17 @@ fn fail_worker_for_runtime_error( })) } +fn seal_worker_runtime_result( + store_path: &Path, + job_id: &str, + result: Result, +) -> Result { + match result { + Ok(summary) => Ok(summary), + Err(error) => fail_worker_for_runtime_error(store_path, job_id, error.to_string()), + } +} + fn fail_worker_job_with_retry( store_path: &Path, job_id: &str, @@ -1047,7 +1057,7 @@ mod tests { } #[test] - fn runtime_error_seals_outer_worker_job() -> Result<()> { + fn bounded_runtime_error_seals_outer_worker_job() -> Result<()> { let temp = tempdir()?; let store = temp.path().join("runtime.msgpack"); open_runtime_spine_heartbeat_job( @@ -1108,10 +1118,10 @@ mod tests { }, )?; - let status = fail_worker_for_runtime_error( + let status = seal_worker_runtime_result( &store, "worker-job-runtime-error", - "tool adapter exploded".to_string(), + Err(anyhow!("tool adapter exploded")), )?; assert_eq!(status["status"], "runtime-error"); diff --git a/notes/fresh-workspace-handoff.md b/notes/fresh-workspace-handoff.md index 0d8eca96..b470d161 100644 --- a/notes/fresh-workspace-handoff.md +++ b/notes/fresh-workspace-handoff.md @@ -1,6 +1,6 @@ # Fresh Workspace Handoff -## Current authority — 2026-08-07 v27 contract boundary +## Current authority — 2026-08-07 v28 Continuity fault The active branch is `codex/epiphany-shakedown-live`. Exact pushed commit `17d4ae47ca6faa1613707010d19261a75a6b74ee` is authenticated and published as @@ -25,28 +25,44 @@ only `epiphany-mvp-coordinator.rs`. It created an active frontier recommending Hands. Self therefore emitted ready route `repo-frontier-route-2a6f1480b9fa431e26dee6db5290b3b234d7bbb541947737d08dcb2e9f0cb48e`. -This is not the required adopted-plan proof. Generic user proposals may -legitimately recommend Hands; only autonomous Imagination-origin proposals are -structurally restricted to an unadopted Imagination frontier. v27 therefore -proved generic proposal-to-Hands routing and the no-plan Hands gate, not native -Modeling-to-Imagination-to-Mind or the repaired adopted-plan identity. Preserve -v27 as evidence. Do not execute its Hands command as if it proved the requested -chain. +v27 remains the generic proposal contract boundary. Fresh v28 lives at +`F:\Projects\.epiphany-runtime\shakedown\live-20260807-v28`. It cold-started +through the packaged repository-body surface, with physically separate local +Verse and release stores. Resident Self started only after receiving the raw +Bifrost trust-anchor format expected by feedback ingress. + +Proposal `shakedown-v28-live-model-admission-r1` launched Modeling job +`8b35ea3f-55dc-4dd2-8c4a-420b5da374e3`; Mind accepted its first result as +`accept-modeling-result-worker-8b35ea3f-55dc-4dd2-8c4a-420b5da374e3`. Self +selected canonical Imagination and launched job +`b34d21de-6788-4935-8910-75275c257444`, PID `11132`. + +PID `11132` exited without a typed result. Repeated coordinator passes continue +to project `imaginationRunning`. The source cause is in +`epiphany-openai-runtime/src/bin/epiphany-openai-runtime.rs`: with +`--max-runtime-seconds` present, `Ok(result) => result?` propagated ordinary +worker errors out of the process without calling `fail_worker_for_runtime_error`. +The unbounded branch already sealed the same error correctly. + +The local cut routes bounded and unbounded completion through +`seal_worker_runtime_result`. Success remains success; every ordinary error +writes the typed failed outer worker and inner OpenAI job before exit. All six +model-runtime tests and all fourteen coordinator tests pass. v28 is sealed +failure evidence; do not repair its runtime state manually. ## Next action -Cold-start a clean generation using the autonomous Imagination-origin proposal -crossing rather than generic intake. Without overrides, prove: +Commit and push the terminalization cut, then package and publish that exact +commit. Cold-start a clean generation. Without overrides, prove: -1. Self derives proposal-bound Modeling and the admission contract requires a - canonical unadopted Imagination frontier. +1. Self derives proposal-bound Modeling and canonical Imagination. 2. Self selects and launches canonical Imagination. 3. Dedicated Mind adopts the typed candidate. 4. Hands intent exactly echoes route id, candidate digest, and plan action. 5. RepoFrontierHandsAuthority binds route, model, plan, intent, review, grant, and sorted scope. -6. Execute the bounded Continuity crash/restart/closure proof and capture Soul - evidence rather than treating the gate as completion. +6. Deliberately fail one bounded worker and prove typed terminal failure, + restart, and Soul-verifiable closure rather than a permanent running state. Do not add a global rule forcing generic user proposals through Imagination; that would destroy their valid direct Hands/Eyes semantics to repair a test diff --git a/state/ledgers.msgpack b/state/ledgers.msgpack index 34a6cd5f5e7af6d8ea78a5a5021fd48c1d8a3cd8..1e693d8dc0a147a70424a3dc9df1d2374b6669cd 100644 GIT binary patch delta 611 zcmYjOON-P%5H|6(;7vrtQ?VlGp+g>>Np=MVABR1NqJrRMsC3s%+R1dsPBP+0d_Zo0d^N7b*x-492*pRReA(sVycUj00?bEv-D@ZNad z&G#GsXybbh{eITroWpsC3l0~*ZTy|D@2-6O9*6OWg*gke7g4_7^Bn(}dDqweAanDIhPBlrWjFG?jvJDPxukj*Q1)kxEQ5P6?oPrPygvIu3!_ zXeF?MgE>x>##R|Ua1{xcaU_Y2vOH&eFG<%d--|+)rE!*uIL$ccuvBenx)#iWtW}bl z0A3n9BMVOt9zqmFNeuK>^>&w~st9bSTQzq(%~5H0t^Vmg>$G-J0(fpZD+rWsY7&E^ ziRtuOLR%6P?kHWMV`9s#R$L^A_13lOscF&hxG LZ=cG result?`, bypassing the failure commit used by the unbounded branch. The local cut gives both branches one terminalization primitive; all 6 model-runtime tests and all 14 coordinator tests pass. v28 is sealed Continuity failure evidence until the fixed commit is packaged and replayed. Persona consequence, Continuity recovery/closure, retention, long-duration pacing, and Linux/Yggdrasil cognition remain open. operational_state: - local_worktree: clean_exact_17d4ae47 + local_worktree: bounded_worker_runtime_terminalization_repair operator_wireguard: restored yggdrasil: canonical_small_public_crossing_body starfire: temporary_epiphany_cognition_body @@ -52,8 +52,8 @@ current_status: bifrost_feedback_crossing: authenticated_transport_only yggdrasil_epiphany_services: absent resident_physiology: heartbeat_and_self_running - unresolved_authority: Exact 17d4ae47 contains the test-proven adopted-plan Hands binding repair, but v27 exercised the generic user-proposal contract and therefore created a direct no-plan Hands route. The live package has not yet proved route-to-adopted-plan-to-intent-to-review-to-grant identity. A clean generation must enter through the autonomous Imagination-origin proposal crossing, whose admission contract makes the required Imagination and Mind stages structurally unavoidable, then execute the bounded Continuity proof. Persona consequence, retention, long-duration behavior, and Linux/Yggdrasil cognition remain open. - next_action: Preserve v27 as generic proposal-to-Hands evidence. Cold-start a clean generation through the autonomous Imagination-origin proposal path and prove native proposal Modeling, canonical Imagination, dedicated Mind adoption, and exact adopted-plan Hands authority without overrides. Then execute the Continuity crash/restart/closure plan and capture Soul evidence. + unresolved_authority: Exact 17d4ae47 still has not proved adopted-plan Hands identity live. v28 reached native Imagination but exposed a stronger prerequisite: bounded worker errors could exit without terminalizing their runtime jobs, leaving Self in an endless wait. The owner-aligned repair is test-proven but unpublished. Persona consequence, restart/closure, retention, long-duration behavior, and Linux/Yggdrasil cognition remain open. + next_action: Commit, push, package, and publish the bounded worker terminalization repair. Preserve v28 as failure evidence. Cold-start a clean generation, replay Modeling-to-Imagination-to-Mind without overrides, prove exact adopted-plan Hands authority, then kill one bounded worker path deliberately and prove typed failure, restart, and Soul-verifiable closure. active_subgoals: - Prove Persona, Self, Eyes, Modeling, Imagination, Hands, Soul, Mind, Continuity, and nervous-system behavior individually. @@ -70,7 +70,7 @@ organ_readiness: hands: proven for bounded consequences; native patch, command, commit, push, and typed receipts bind reviewed path ceilings to exact changed-path subsets. soul: proven for the current bounded consequence; the exact 2dd25341 release launched Soul, produced an accepted pass verdict grounded in focused and full-library receipts, and routed verdict incorporation. mind: partial; RepoModel admission, thread-state admission, gateway review, state commit, first-valid verdict incorporation, and dedicated frontier-plan adoption are live; broader stale or overstated frontier correction remains open. - continuity: partial; heartbeat and resident Self survive sequential cycles, while restart, crash, reboot, closure, and retention remain open. + continuity: partial; heartbeat and resident Self survive sequential cycles. v28 proved an ordinary bounded worker error could leave a runtime job falsely running after process death; the owner-local terminalization repair passes focused tests but still needs packaged crash/restart/closure proof. nervous_system: partial; detached scheduling, runtime jobs, typed feedback, ordinary Windows coverage-store identity, and operator projection work; long-duration pressure and resource plateau remain open. Exact release packaging took about seventeen minutes and observed more than 3 GiB compiler working set, so Yggdrasil is not a release forge at its current 1.9 GiB RAM. forbidden_actions: