Red on the daemon at c5cf445: fbx jobs, the refusal ladder, export containment, kill on lease loss and SIGTERM,
the minted seed, motion_job.v1, the artifact read route and rest-fbx. test_bvh_to_fbx.py runs the converter in
real Blender (VILI_BLENDER). This commit does not pass its own tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Red at 658de07 for the lease-loss bound, SIGTERM and spelling tests; the leaderless-group and later-line tests pin behaviour that already holds, for mutants.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The stub marks its first healthy answer; the stdout line it prints before ready
had been taking the lease through the log-sink gate first.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fake Idunn signer takes the lease the moment a named path exists under the
state root. Each gate in generate and startWorker now has a case that only that
gate stops, and a lease lost while the state root opens leaves the daemon up.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The fake Idunn signer can lose the lease once a job's meta.json exists, which
pins the guards in startWorker (no logs or embeddings directory, no worker).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
serve(runtime) listens first, writes the state root only once the runtime
holds it, answers Idunn's route challenge ahead of the cross-site refusal,
and fences on lease loss. --health is deleted; the pid file and /proc
reclaim move behind the hand-run runtime. Adds scripts/idunn-entry.mjs,
the kimodo and SOMA-X gitlinks, encode_texts for the child, and tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closes the survivors StrykerJS reported over the new supervisor code (61 mutants, 41 killed, 20 survived): the pid
file is removed when its worker exits and not when it spawned nothing, the restart kill is SIGKILL (a stubborn stray
and a SIGTERM-proof encoder child), the group match is the pid file's, not any marked process. killGroup loses its
unused return value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The worker's process group is killed when the worker exits for any reason, so no encoder child survives it.
A pid file in the state root names the group; the next daemon start kills a group left by a crashed
predecessor if one of its members carries this state root's embeddings directory, before serving. The
retired operator route's 404 test returns (built from parts, so the grep stays empty) and the test script
gets a per-test timeout.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Mutation triage (StrykerJS, 81 survivors on the first full run) showed worker.model was
written and never read. The new tests pin the survivors that were behaviour: the loopback
default, --host, stray flags, the models-root resolution, the SIGTERM grace, a worker that
dies while the daemon waits for its health, the POST route, and lastError after a
requested stop.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
vili-daemon.mjs spawns the Python worker itself (no shell, port 0 from the
ready line, nice 10, one child at a time, respawn after exit, group kill on
SIGTERM) with a closed environment. WSL/Docker, the Eve surfaces and deck
WebSocket, the provider advertisement, /smoke, CORS, JSON sidecars and the
pid file are deleted. POSTs with an Origin or a non-JSON body are refused
403 cross-site. cultcache-ts comes from the vendor/CultLib submodule at
b549d731; ws is dropped.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
