Deterministic QA gates, dry-run fixes, and graph-quality repairs#1230
Merged
Conversation
…ission Two changes to the index coordinator, developed together and validated as one state: Determinism seams. A cancel racing a worker start was only observable on a loaded runner; now the interleaving is forced by construction: a test hold parks every job thread before its first pre-start cancel check, and a background-initialize completion counter turns sleep-then-assert negatives into positive-signal waits. The cancel-before-worker-start case is pinned by a dedicated test; three auto-index admission tests now wait for the admission tail instead of sleeping through it. Queued admission. An explicit index_repository request that hits the physical job limit used to surface a raw busy error. The request thread already blocks for the whole index, so it now queues: a cancellable, shutdown-aware wait-and-resubscribe loop replaces the error path, with a wait counter as the parked-state observable. The programmatic coordinator API keeps its non-blocking busy answer for callers with their own retry policy (watcher, auto-index). The job-limit test asserts the new contract: parked without a second worker start, admitted and completed once the occupying job finishes. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The Windows build-dir DACL stamp resets inherited ACEs before granting, verifies itself out loud, and re-stamps at the serial-tail boundary — the arm image ships explicit ACEs that survived a grant-only stamp and turned the whole suite red. Stamp verification failures now fail the run instead of warning. A suite that exits 0 without printing its summary line is counted as a failure rather than silently passing. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The fuzz harness swallowed the target's exit status through '|| true', so a SIGSEGV counted as a pass; the status now propagates (a planted crash yields 139) and payloads derive from a logged, replayable seed, with a missing python3 failing the gate instead of generating zero mutations. The Windows guard runner classified unknown exit codes as skips; the contract is now explicit (0 green, 1 red, 2 precondition-skip, anything else a failure) and an all-skip run fails as verifying nothing. The smoke suite gains crash-class detection on the phase-9b tolerance paths and phase 11 kill handling (rc >= 128 or a missing jsonrpc banner fails), a free-port pick plus readiness poll for the UI phase, and a phase-15b failure that actually exits nonzero. The soak reader resynchronizes on late JSON-RPC responses by draining to the matching id, and the analysis fails when fewer than 60 percent of snapshot attempts produced rows — a vacuous analysis previously passed. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…n proof The build system now stamps CBM_SANITIZED_BUILD for any non-empty SANITIZE, so timing budgets key off build-system truth instead of compiler-specific __SANITIZE_ADDRESS__ probes that miss trap-UBSan and TSan; the two bench suites use it. The httpd interrupt test proved 'the interrupt worked' with a wall-clock bound, which is a lottery under sanitizers. A send-deadline test hook pins the deadline out of reach so the join itself is the causality proof, and the stop watchdog becomes a true ten-second hang detector. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
A directory with more immediate subdirectories than the fixed 512-frame walk stack made the whole discovery walk hard-fail with files=0 and a misleading 'check repo_path' hint — dotnet/runtime carries 855 sibling dirs in one JIT regression folder and could not be indexed at all. The stack now grows geometrically from the same initial capacity; the parent frame is a popped copy, so growth cannot dangle it. Covered by a 600-dir fanout reproduction. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
…rides The parallel per-file resolve hardcoded INHERITS for every base-class relation while the sequential semantic pass made the Interface split, so any corpus large enough for the parallel path had its explicit implements demoted: elasticsearch carried 11,179 INHERITS edges pointing at Interface nodes and 3 IMPLEMENTS. Both venues now share one decision keyed off the target node's label — the graph truth the edge attaches to. OVERRIDE edges existed only for Go's implicit interface satisfaction. A serial full-graph tail run by both pipelines now matches class methods against explicit bases by name and emits Method-to-Method OVERRIDE edges for the explicit languages, with Go excluded to avoid double cover. The venue parity fixture gains a Java interface/implements/extends trio — IMPLEMENTS parity used to compare 0 == 0 and guarded nothing — plus an exact-count test so the parity can never go vacuous again. At scale: elasticsearch IMPLEMENTS 3 to 11,182 and OVERRIDE 0 to 49,695, TypeScript 0 to 4,496 and 594, dotnet/runtime 0 to 12,953 and 45,667, with INHERITS plus IMPLEMENTS sums conserved exactly. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
DeusData
enabled auto-merge
July 23, 2026 15:37
… hash Resolves the two open Pinned-Dependencies code-scanning alerts (and one sibling the scanner had not flagged yet): - ubuntu:noble in Dockerfile and Dockerfile.lint is pinned to its multi-arch manifest-list digest (verified against the registry and the scanner's remediation digest, which match). - mstorsjo/llvm-mingw drops the floating :latest and pins the current digest the same way. - The MSYS2 zlib sysroot package in Dockerfile.mingw is verified against a pinned sha256 before extraction instead of piping the download straight into tar. Dockerfile.alpine was already pinned; both rebuilt images (test, lint) verified building with the new digests. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
The parity harness drives the pipeline passes with a bare ctx and never ran the production teardown, so the return-type table pass_calls builds leaked — latent until the fixture gained typed Java methods, and visible only under Linux LeakSanitizer. Both runners now free it exactly the way pipeline.c does. Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes out the two remaining dry-run reds and hardens the QA pipeline so gates cannot pass vacuously, plus three product repairs surfaced by the release bench.
Dry-run reds (root-caused, pinned by construction)
Gate integrity
Product repairs (bench-surfaced, reproduce-first)
Validation
Mac full suite 6779/0; Windows VM targeted suites 166/0; Linux container leg green (one known worktree-gitdir harness artifact); TSan ×3 on the daemon queue; lint clean; 9-language bench with no wall-time regressions and node counts byte-identical.