feat(daemon): fence lifecycle operations by durable identity - #1123
Open
sethkarten wants to merge 16 commits into
Open
feat(daemon): fence lifecycle operations by durable identity#1123sethkarten wants to merge 16 commits into
sethkarten wants to merge 16 commits into
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d6ec958. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stack
perf/b00b-production-gate)821a180763e2fd20b6134fe8e661e5308f6b4af09d9cf28d51490ef06efba738c3fff788463acdffWhat this delivers
passivatedas the only processless durable descriptor shape and preserves the legacy host ABI, public daemon schema, C00 metadata-only reads, and default recursion-depth policy.No client-side concurrency limiter, admission queue, hidden batching, synthetic 429, credentialed provider request, or public protocol/schema revision is introduced.
Automated-review remediation
All prior Cursor and Macroscope findings, including the follow-up journal/restore/launch findings and the later signal-finalization finding, are fixed at this exact head. Independent component reviews approve the registry, supervisor, journal, duplicate-restore, and failed-launch repairs; integrated audits approve both review waves.
Exact validation
Isolated Linux lane
c01-821a180763e2on the reserved CPU runner, pinned imagesha256:0f66…4c4d70d:tsgo --noEmit: passEvidence
4bbc562ba0704c3b08fbbdd32c46391176bd1ea6d7f7da7afaac8db91c85ec5f690225cae1c955794834edb651251ec8768ba406836145a565f1ab4ca795ab47coordination/REMOTE_C01_FINAL_VALIDATION.md(program workspace)Human review is intentionally deferred until the full dependency-ordered stack is visible. Automated review/CI findings on this PR will still be monitored and resolved now.
Note
High Risk
Touches daemon supervisor process signaling, crash recovery journaling, and RLM subagent lifecycle across restarts and selector reuse—errors could strand workers, mis-route recovery, or let stale callbacks affect the wrong incarnation.
Overview
Fences daemon and RLM lifecycle work with durable identities so a late callback from incarnation A cannot mutate, signal, or recover state owned by B.
Worker descriptors move from flat
pidfields to a nestedprocesspair plus a per-launchgeneration. The supervisor quarantines ambiguous legacy on-disk records (no wake, signal, or rewrite), migrates promotable legacy PIDs only after a verified start ID, and persists processless rows only forpassivatedlifecycle. Worker connect, frames, forwards, and shutdown signals are gated on generation and exact process identity; failed launches are retried only after verified cleanup.RLM children get an immutable
assignmentIdper run. Parent session, runtime host, and daemon registry paths key tombstones, deletions, hydration, passivation, and event forwarding on(childId, assignmentId), with an opt-inassignmentIdentityFencedhost ABI for embedded compatibility.Worker recovery switches to journal v2 records keyed by
operationId+ generation`, with per-operation begin/end tokens for prompts, steer, follow-up, restored actions (validated before token allocation), session close, and turn/tool checkpoints—so crash recovery stays busy until the real terminal edge for that exact operation.Session action restore is split into validate vs restore, returns admitted action IDs, and exposes
unfinishedActionIdsfor recovery settlement.daemon-psskips descriptors without a nested process when force-stopping workers.Reviewed by Cursor Bugbot for commit 821a180. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Fence daemon worker lifecycle operations by durable assignment and generation identity
generationUUID per daemon worker incarnation, minted at launch and threaded through the startup gate, descriptors, passivation, and recovery journal so that stale callbacks from a previous worker process cannot mutate current state.assignmentIdto subagent runtime lifecycle operations acrossAgentSession,AgentSessionRuntime, andAgentDaemon, keying all child session maps, tombstones, and deletion records by(childId, assignmentId)to prevent cross-incarnation interference.WorkerRecoveryJournalto a v2 record format that includesoperationIdandgenerationfor fencing, with atomic file replacement and platform-aware parent-directory fsync for durability.processidentity, canonical generation UUID) on every persist.pid/processStartIddescriptor fields are deprecated and stripped on write; legacy journal v1 records are preserved read-only but no new v1 records are written.Macroscope summarized 821a180.