Repository navigation
fix(controller): avoid duplicate removal and refresh Debian base - #155
Conversation
Bumps debian from `a29215f` to `62bd423`. --- updated-dependencies: - dependency-name: debian dependency-version: 13.7-slim dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
|
@codex review Please review exact SOURCE |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Nickfost
changed the title
a29215f to 62bd423 in /controller
A complete validation run exposed a controller cleanup race. A job completion can remove its container while Docker still owes the DELETE response. The exit watcher then sees the exact container ID is absent but issues another DELETE because runner tracking remains until completion finishes. This caused the unchanged late-event regression to observe two removals.
The exit watcher now records confirmed absence without another removal. Containers that still exist keep the same non-forced removal and error retries. Completion tracking, listener acknowledgment/replay behavior, ownership checks, capacity and deadlines remain unchanged. A deterministic regression holds the completion response until the watcher finishes its absence check. All inherited lifecycle test bodies remain byte-identical.
This PR also retains the reviewed controller runtime Debian update from
sha256:a29215f6a35e51e22adffa17f89e9d2ef06214e64a2bad10d765c46aea49f11ftosha256:62bd423aeee912639ca8ee681c2b762cb3e25137e0a92b20be455898a9f034ad, matching the runner selection accepted in #152. Registry index, Linux amd64/arm64 manifest and config bytes were verified. Selected configs were created on 2026-10-20, replacing 2026-10-05 configs. The mutable tag now resolves to a differentf6b08b09digest; it is not adopted. Registry metadata supplies no package-level compatibility, latest-image or specific CVE-fix claim.Final source identities:
024f6736704758fd565a782dfefbaa7cd4e18a31331621a78bef774ef24cf9d494a0753d156ea762bf8a6b4fe5ba10e2b18450f9326d0fe30cbf8b88994bba074b93ed8b57ead3c4846a5aed630bd560. The prior ordinary merge and all existing history are retained.Against BASE, the five changed paths are
controller/Dockerfile,controller/scaler.go,controller/lifecycle_test.go,docs/CONTROLLER-DESIGN.mdanddocs/MANAGED-IMAGES.md. All workflow, validator, executor, capability, template, runner, module, Go compiler and other inputs match BASE. The Dockerfile still changes only the runtime Debian digest.Validation evidence:
994bba0failed after seven stages passed, during the eighth stage's APT-cache controller image build. The complete official artifact, all eight stage hashes, Actions logs and worker diagnostics were exported and retained outside Git. It remains failed evidence.994bba0reproducedTestLateEventsAfterRestartDoNotDiscardTheRestOfTheSDKBatchwith two removals. This identifies a controller race rather than an APT installation error.go vetand module verification passed using the pinned Go 1.27.3 compiler withGOTOOLCHAIN=local. Tested source bytes match this commit.The old source review is historical evidence only. Independent review completed without findings on full SOURCE
024f6736704758fd565a782dfefbaa7cd4e18a31at 2026-11-01T17:32:57.374515Z, as recorded in the current-head dashboard. The complete supervised required run on this SOURCE passed all eight stages, with no expected or actual test skips. The execution owner retains the existing isolated-native producer, export/hash verification, cleanup and eligible protected merge. Cursor/Bugbot is unavailable and supplies no approval. No required workflow or test has been weakened, and no complete new-source result is claimed by the focused checks above.Documentation impact:
docs/CONTROLLER-DESIGN.mdexplains exact-ID absence and the retained completion/error behavior.docs/MANAGED-IMAGES.mdrecords the reviewed controller base and historical selection. This internal controller correction and base refresh do not change schema, desired state, initializer, validation, capability, setup, examples or operator contracts, so no standalone-template follow-up is needed. Image publication, runtime/template/private pin promotion and live-host acceptance remain separate.The admitted native run 41332485945, attempt 1 on the corrected SOURCE and unchanged BASE, completed successfully on 2026-11-01 at 21:20:59Z. Both jobs and all eight full-suite stages passed, including the image builds that exposed the original race. The complete nine-file artifact
13100638919and all eight stage hashes were independently verified. Artifact ZIP SHA256 is3b5f3f3987ce639b5186d734dafa9346410f6edee2b9b13d7b63dd36fd899f13. Complete Actions logs and 12 indexed worker diagnostic/operator files were also exported and hash verified outside Git. The worker's temporary result copy had already been removed by normal runner cleanup, so no independent comparison against those worker bytes is claimed.Final cleanup and worker admission passed at 21:25:55Z. Temporary registrations, credentials and the privilege grant are gone; executor689 is restored; no validation processes, cgroups or containers remain. Protected review images and the operator key are preserved. The workflow is disabled and its temporary selector absent. The existing validator, workflow and outer deadlines remained unchanged. Independent current-head review, the required GitHub Actions result, evidence export and cleanup are complete. Eligible normal protected merge is the remaining source gate. Runtime pins, publication and live-host storage/retention acceptance remain separate.