fix(reliability): reconcile artifact lifecycle lock on current main by seonghobae · Pull Request #439 · ContextualWisdomLab/clearfolio

seonghobae · 2026-08-13T05:50:31Z

Objective

Replace stale #350 with the same bounded process-local artifact lifecycle serialization primitive directly on current protected main, while preserving one process-wide lock domain across dependency-injected and standalone call paths.

Fresh exact authority — 2026-09-05

protected base: main@06633a25109c62e24a7015ae04fb9f6e0a246f7e
exact head: deef32c603cf6d8745e2434a5d4243dc97b70afb
ancestry: protected base is the merge base; ahead 9 / behind 0
effective protected-base delta: exactly ArtifactLifecycleLockRegistry.java and ArtifactLifecycleLockRegistryTest.java
state: open / Ready / mergeable

The four descendants after the previously documented d7e3e6e7... carry buyer OpenAPI/license work that has since reached protected main; they therefore disappear from the current protected-base effective range. They are adopted history, not product scope added to this PR, and were not reset or rebased away.

Test-first repair evidence

The initial replacement's exact-head CI failed constructionAndNullInputsFailClosed: the registry exposed a public constructor and Spring @Component, allowing dependency injection and standalone callers to construct disjoint registries and defeat same-job mutual exclusion.

The corrected implementation has one private construction path, one process-wide fixed-memory registry, 256 lock stripes, fail-closed null handling, and unconditional lock release after action failure. The focused test keeps those invariants explicit.

Exact-head evidence

On unchanged deef32c603cf6d8745e2434a5d4243dc97b70afb:

CI 32157011333: success
Security Scan 32157011454: success
SAST Semgrep 32157011448: success
fuzz 32157011374: success
current inline review threads: zero
current submitted formal reviews: zero

The successful repository workflows are valid current-head evidence, but absence of an independent formal review means this is not merge authorization.

Scope boundary

This protects one JVM only. It is not durable or distributed fencing and does not replace object-version preconditions, transactional outbox semantics, lease generations, or cross-instance deletion coordination.

Merge gate

Keep the exact head unchanged while obtaining qualifying independent non-author review and re-reading all then-live branch-protection/governance requirements. Merge only through the normal protected path when those requirements remain satisfied. Do not self-approve, bypass, force-push, destructively rebase, or transfer evidence from another head.

coderabbitai · 2026-08-13T05:50:40Z

Important

Review available on request

🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 256aa99d-47c0-49b6-8295-ed588dd7798a

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

seonghobae · 2026-08-14T08:04:48Z

Exact-current-head review request for d7e3e6e7b54bdc70a05f18ff09338b9ab54aaeed on protected main 961f44a19c4ced87f8062b3ab9842a9a08d05235. The predecessor exact head failed its one-registry construction contract; the corrected head removes Spring component registration and public construction so all callers share one fixed-memory lock domain. CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; the PR is mergeable and has zero unresolved threads. Review read-only; do not mutate the branch or bypass independent approval.

@opencode-agent review
@cwl-noema-review review
@strix review
@coderabbitai review

coderabbitai · 2026-08-14T08:05:44Z

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== Repository identity =='
git rev-parse HEAD
git merge-base HEAD 961f44a19c4ced87f8062b3ab9842a9a08d05235
git diff --name-status 961f44a19c4ced87f8062b3ab9842a9a08d05235...HEAD

echo '== Changed Java files =='
fd -t f 'ArtifactLifecycleLockRegistry.*\.java$' .

echo '== AST outlines =='
while IFS= read -r file; do
  echo "--- $file"
  ast-grep outline "$file" --items all || true
done < <(fd -t f 'ArtifactLifecycleLockRegistry.*\.java$' .)

echo '== Exact diff =='
git diff --find-renames --find-copies --unified=80 \
  961f44a19c4ced87f8062b3ab9842a9a08d05235...HEAD -- \
  '*ArtifactLifecycleLockRegistry*.java'

echo '== Registry references =='
rg -n -C 4 --glob '*.java' \
  '\bArtifactLifecycleLockRegistry\b|\bwithLock\s*\(|\bexecute\s*\(' . || true

Length of output: 1649

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='961f44a19c4ced87f8062b3ab9842a9a08d05235'
head='d7e3e6e7b54bdc70a05f18ff09338b9ab54aaeed'
main_file='src/main/java/com/clearfolio/viewer/lifecycle/ArtifactLifecycleLockRegistry.java'
test_file='src/test/java/com/clearfolio/viewer/lifecycle/ArtifactLifecycleLockRegistryTest.java'

echo '== Production outline =='
ast-grep outline "$main_file" --items all

echo '== Test outline =='
ast-grep outline "$test_file" --items all

echo '== Exact production and test diff =='
git diff --unified=100 "$base...$head" -- "$main_file" "$test_file"

echo '== Production file =='
cat -n "$main_file"

echo '== Focused test file =='
cat -n "$test_file"

echo '== Non-test registry references =='
rg -n -C 6 --glob '*.java' --glob '!src/test/**' \
  '\bArtifactLifecycleLockRegistry\b' src

echo '== Registry method call sites =='
rg -n -C 4 --glob '*.java' \
  '\.(withLock|execute|runWithLock|lock)\s*\(' src || true

Length of output: 26314

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo '== Lifecycle and artifact-related Java files =='
fd -t f -e java . src/main | rg -i '(artifact|lifecycle|conversion|document|delete|cleanup|storage)'

echo '== Candidate operation declarations and calls =='
rg -n -i -C 5 --glob '*.java' --glob '!src/test/**' \
  '\b(delete|remove|cleanup|convert|conversion|upload|write|store|save)\w*\s*\(' src/main

echo '== Artifact byte and object-storage references =='
rg -n -i -C 5 --glob '*.java' --glob '!src/test/**' \
  '(artifact|object.?storage|blob|s3|bucket|fileSystem|filesystem|deleteObject|putObject)' src/main

echo '== Existing synchronization and lifecycle lock mechanisms =='
rg -n -C 5 --glob '*.java' --glob '!src/test/**' \
  '(synchronized\b|ReentrantLock|ReadWriteLock|Semaphore|Lock\b|mutex|lifecycle)' src/main

Length of output: 201344

🏁 Script executed:

#!/bin/bash
set -euo pipefail

service='src/main/java/com/clearfolio/viewer/service/DefaultDocumentConversionService.java'
worker='src/main/java/com/clearfolio/viewer/service/DefaultConversionWorker.java'
store='src/main/java/com/clearfolio/viewer/artifact/ArtifactStore.java'

echo '== Service outline =='
ast-grep outline "$service" --items all

echo '== Worker outline =='
ast-grep outline "$worker" --items all

echo '== Artifact store outline =='
ast-grep outline "$store" --items all

echo '== Service artifact deletion and storage contexts =='
rg -n -C 18 \
  '(deletePdf|artifactStore\.(putPdf|deletePdf)|\bdelete\s*\(|\bremove\s*\()' "$service"

echo '== Worker artifact write contexts =='
rg -n -C 18 \
  '(artifactStore\.(putPdf|deletePdf)|\bprocess\s*\(|\bconvert\w*\s*\()' "$worker"

echo '== All main-source withJobLock invocations =='
rg -n -C 4 --glob '*.java' \
  '\bwithJobLock\s*\(' src/main

Length of output: 13018

@seonghobae I found one blocking issue.

ArtifactLifecycleLockRegistry has no production caller. rg found no reference outside ArtifactLifecycleLockRegistry.java and no withJobLock(...) invocation in src/main.

DefaultDocumentConversionService.deleteJob(UUID) deletes artifact bytes at Line 240. DefaultDocumentConversionService.seedPdfPassthroughArtifact(...) writes bytes at Line 291. DefaultConversionWorker.performDefaultConversion(UUID) writes bytes at Line 281. None of these operations run inside the shared registry.

As a result, conversion and deletion can still overlap for the same job. The new lock registry is correct in isolation, but it has no runtime effect. Wrap each relevant artifact lifecycle mutation with ArtifactLifecycleLockRegistry.shared().withJobLock(jobId, ...). Add an integration test that holds conversion for one job and verifies that deletion for that job cannot enter until conversion releases the lock.

The exact head and the two-file scope match the requested base and head. The singleton construction, fixed 256-stripe storage, null handling, and finally unlock behavior are also correct.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-15T09:26:00Z

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review exact head d7e3e6e7b54bdc70a05f18ff09338b9ab54aaeed only. Exact-head CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. Verify the single process-wide striped lock domain, private construction boundary, fail-closed null handling, and unconditional release, while preserving the explicit non-distributed scope.

Review read-only; preserve independent reviewer identity. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

coderabbitai · 2026-08-15T09:26:29Z

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='961f44a19c4ced87f8062b3ab9842a9a08d05235'
head='d7e3e6e7b54bdc70a05f18ff09338b9ab54aaeed'
main_file='src/main/java/com/clearfolio/viewer/lifecycle/ArtifactLifecycleLockRegistry.java'
test_file='src/test/java/com/clearfolio/viewer/lifecycle/ArtifactLifecycleLockRegistryTest.java'

echo '== Exact commit identity =='
git rev-parse HEAD
git cat-file -e "${head}^{commit}"
git merge-base "$head" "$base"
git diff --name-status "$base...$head"

echo '== Changed-source outlines =='
ast-grep outline "$main_file" --items all
ast-grep outline "$test_file" --items all

echo '== Exact diff =='
git diff --unified=100 "$base...$head" -- "$main_file" "$test_file"

echo '== Production implementation =='
git show "${head}:${main_file}" | cat -n

echo '== Focused tests =='
git show "${head}:${test_file}" | cat -n

echo '== Production registry references and lock invocations =='
git grep -n -C 5 -E '\bArtifactLifecycleLockRegistry\b|\bwithJobLock[[:space:]]*\(' "$head" -- 'src/main/**/*.java' || true

echo '== Lifecycle mutation candidates =='
git grep -n -C 8 -E '\b(deletePdf|putPdf|deleteJob|performDefaultConversion|seedPdfPassthroughArtifact)[[:space:]]*\(' \
  "$head" -- 'src/main/**/*.java' || true

Length of output: 68208

@seonghobae I found one blocking issue on exact head d7e3e6e7b54bdc70a05f18ff09338b9ab54aaeed.

ArtifactLifecycleLockRegistry has no production caller. No source under src/main references the class or invokes withJobLock(...).

Artifact lifecycle mutations remain outside the lock domain:

DefaultConversionWorker.performDefaultConversion(UUID) writes artifacts at Line 281.
DefaultDocumentConversionService.seedPdfPassthroughArtifact(ConversionJob, MultipartFile) writes artifacts at Line 291.
DefaultDocumentConversionService.deleteJob(UUID) deletes artifacts at Line 240.

Therefore, conversion and deletion can still overlap for one job. The new registry has no production effect.

The registry implementation itself meets the requested isolated checks:

The constructor is private.
shared() returns one static process-wide registry.
The registry uses 256 fixed lock stripes.
withJobLock(...) rejects null inputs before lock selection.
The finally block releases the lock after action failure.
The documentation preserves the one-JVM, non-distributed scope.

Wrap the relevant lifecycle operations with ArtifactLifecycleLockRegistry.shared().withJobLock(jobId, ...). Add an integration test that blocks conversion for one job and verifies that deletion cannot enter until conversion releases the lock.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

seonghobae · 2026-08-15T11:30:19Z

Exact-current-head independent review request for d7e3e6e7b54bdc70a05f18ff09338b9ab54aaeed.

The two-file process-local lifecycle-lock slice is mergeable; CI, Security Scan, SAST Semgrep, and fuzz are terminal-success; unresolved inline findings are zero. The implementation exposes one private construction path and one process-wide fixed-memory registry, preventing disjoint lock domains while guaranteeing release after action failure. Protected main has advanced since construction, so any base update must regenerate all exact-head evidence.

@opencode-agent review
@coderabbitai review
@cwl-noema-review review
@strix review

Review this exact head read-only. Do not mutate the branch, synthesize author approval, weaken protection, or merge.

coderabbitai · 2026-08-15T11:30:27Z

Rate Limit Exceeded

@seonghobae have exceeded the limit for the number of chat messages per hour. Please wait 3 minutes and 33 seconds before sending another message.

opencode-agent · 2026-08-19T05:59:04Z

Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #439 at head deef32c603cf6d8745e2434a5d4243dc97b70afb. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

opencode-agent · 2026-08-19T05:59:06Z

Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #439 at head deef32c603cf6d8745e2434a5d4243dc97b70afb. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

opencode-agent · 2026-08-19T05:59:07Z

Queued @opencode-agent ; Already queued @cwl-noema-review on this exact request for PR #439 at head deef32c603cf6d8745e2434a5d4243dc97b70afb. Central exact-name Actions artifacts are the durable dispatch ledger; existing review workflows remain authoritative for the final verdict and failure evidence.

opencode-agent · 2026-08-20T03:34:14Z