fix(control): self-heal invalid native helper pairs - #90
Conversation
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CepCzSGN8rDhJGx69N81NU
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Team Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: aa2ae22bc4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const filenameMatch = /filename\s*:\s*["']([^"']*)["']/.exec(text); | ||
| const sha256Match = /sha256\s*:\s*["']([^"']*)["']/.exec(text); |
There was a problem hiding this comment.
If build.mjs is interrupted after writing the sha256 line but before the closing object/module syntax, these regexes still extract a matching filename and digest, so validateHelperPair returns valid and every subsequent launch skips rebuilding. The runtime then fails to import that syntactically invalid module in defaultLoadProvenance, leaving the control channel unavailable until manual recovery—the partial-provisioning state this gate is intended to self-heal. Validate the complete generated module shape rather than accepting fields found anywhere in its text.
Useful? React with 👍 / 👎.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CepCzSGN8rDhJGx69N81NU
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 134b513e15
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| note(`helper/provenance pair not valid (${before.reason}); rebuilding via build.mjs.`); | ||
| try { | ||
| execFileSync(process.execPath, [buildScript], { stdio: ['ignore', 'inherit', 'inherit'] }); |
There was a problem hiding this comment.
When two supported Windows launches encounter the same missing or invalid pair, both can pass the initial check and invoke build.mjs concurrently. Those builders share and delete the same dist/control/native/obj directory and executable (build.mjs lines 133–136), so one process can remove or lock the other's compiler outputs and cause that launch to exit even if the other rebuild succeeds. Serialize provisioning with a lock and revalidate after acquiring it, or build in isolated temporary locations before publishing.
Useful? React with 👍 / 👎.
1 participant
Final coherent D062 helper-lifecycle reconstruction for PR #85.
Current exact state (authoritative)
aaa7ddc4b625ca4aa5d192585daa4ce824a72be6134b513e15a056d037cc51b794d72c1a9891a4b4(
.github/workflows/ci.yml,package.json, and the five files of the latestrepair commit below)
34122017059, head134b513…, SUCCESSLatest mechanism-repair commit (canonical provenance)
134b513e15a056d037cc51b794d72c1a9891a4b4aa2ae22bc4090195e03c39bb96b6bc50e62616d1fix(control): canonicalize helper provenance lifecycleBD63236A244AD3E538652C71EFCCAB61190708716799E49E55BDBE445DD03AF239063tools/control-owner/provenance-format.mjstools/control-owner/build.mjstools/control-owner/ensure-helper.mjstools/control-owner/ensure-helper.d.mtstests/control/launch-lifecycle.test.tsNote: the 7 cumulative PR changed files are NOT the latest repair commit's
validated five-file patch —
.github/workflows/ci.ymlandpackage.jsonwerechanged by the first reconstruction commit and are unchanged by
134b513.Finding status
Codex "Reject truncated provenance modules"
aa2ae22…134b513…: FIXEDacceptance; the exact truncated-module witness is now INVALID → rebuild/
self-heal; the real Windows supported path self-heals; fresh independent
validation passed; exact-head CI #279 SUCCESS.
intentionally not resolved or replied to in this evidence-refresh step.
Fresh independent validation (at
134b513)singleton
encodeProvenance(SHA256(helper))), proven by exhaustive truncationat every byte offset and exhaustive single-byte mutation, plus duplicate/extra/
format variants;
imports (format factored out verbatim), so LIFECYCLE_VALID ⇒ runtime-consumable;
src/control/control-store.ts,src/control/control-runtime.ts,agentbridge-win-owner.c, and the six D062files) — 0-diff;
Mechanism invariant (circuit-breaker record)
This was the final permitted predicate redesign on PR #90. No third regex /
field-extraction refinement is allowed.
One side-effect-free canonical encoder (
tools/control-owner/provenance-format.mjs)is the single producer used by both
build.mjs(publish) andensure-helper.mjs(accept). Provenance atomic publication (temp + rename) is included as defense-in-
depth only; canonical equality is the correctness mechanism. The runtime's own
import()+ hash-before-exec verification is unchanged and remains the finalsecurity authority (no trust transfer from the lifecycle gate).
If this invariant is later falsified on a supported path (a pair equal to the
canonical bytes that the unchanged runtime still rejects):
STOP — no local predicate patch — escalate to the pre-agreed JSON provenance
redesign.
History — original findings and reconstruction lineage
Supersession history:
CURRENT P2 showed its existence-only skip could accept a torn
helper/provenance pair.
aaa7ddc under the PR55/PR74 circuit-breaker.
Original CURRENT P2:
provenance existed before control-channel verification.
PR #89 CURRENT P2:
First reconstruction commit (SUPERSEDED by
134b513above):aa2ae22bc4090195e03c39bb96b6bc50e62616d1CEDC0605F0B5CED7139EC6F29DA45D96516E1A37928D313934206B57DA0D432A(24657 bytes)field-extraction; the truncated-module witness (Codex P2) motivated the
canonicalization commit
134b513.Quarantine
Authority
PR #90 remains Draft. This evidence refresh grants no Ready authority and
no merge authority. Human merge authority is preserved.
🤖 Generated with Claude Code
https://claude.ai/code/session_01CepCzSGN8rDhJGx69N81NU