Repository navigation
Five reviewed changes in one branch: FeedBarRow rename, provider-fetch lock, run-json quota supervisor, adapter lookup-index probe, synthetic numbers in comments and docs - #717
Merged
Conversation
Comments, docstrings and docs quoted real prices, real trade records and the names of third-party scripts to explain a rule. Each example now uses made-up numbers that show the same rule, and each third-party script name is replaced by a neutral label that says what the script exercises. Only comment and documentation text changes. No code, string literal, test input or expected value is touched, and every file keeps its line count so that line anchors in the docs still hold. Symbol names and test identifiers stay as they are. Four content-pinned anchors in two design pages (the engine.hpp 1031-1044 and engine_aux_security.cpp 52-62 and 52-84 comments) carry the new hash of the rewritten comment text. Sentences removed on purpose in docs/pine-adapter-kernel-notes.md because they quoted real trade dates and a third-party script name: the sentence from 42fa1d4 that begins "The text is kept verbatim so the measurement provenance", and two sentences from 6b77f06 about the records count and the three units closed together. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add a read-only reader over the Pine adapter's lookup indexes (probe_lookup_index, in a source-layer header that is not installed) and a test that pins how many keys and ids the indexes hold for four streams: cohort sides, unbound legs, legs by origin and immediate closes. Every expected count is computed from the commands the test itself issues and a named retention rule, for two input populations and several read points, including a read after a later position cycle. The reader only calls size() and iterates by const reference; the adapter change is the include and the reader, nothing else. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Brings the branch up to date with main (87 files, mostly tests and CI). The branch's own paths do not overlap with anything main changed except tests/CMakeLists.txt, which this branch does not edit. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Add docker/pf_quota_run.py, the supervisor that runs one command under the launcher-hosted run_quota ledger service and reports a trusted receipt on a descriptor the child never inherits: the ledger verdict, the wait status or signal, the kernel's out-of-memory attribution and the deadline. An absent --deadline-seconds means no expiry and no deadline kill; a present value must be a strict positive finite decimal. A refused memory.events observation is reported as a nullable oom.diagnostic and stays nonfatal. When the interpreter has no os.pidfd_open or signal.pidfd_send_signal (an old C library under a new kernel), the supervisor calls the kernel syscalls (434 and 424, the same numbers on x86_64 and aarch64) through ctypes and raises the same errors; any other architecture keeps the typed refusal. Tests: docker/run_json_quota_supervisor_test.py (129 non-root rows, run by the preflight glob with or without the native pidfd functions), docker/pf_quota_run_privileged_proof.py (176 root rows) and docker/pf_quota_policy_privileged_proof.py (47 root policy rows) run as explicit separate actions. No row has a time limit of its own. The contract is in docs/design/quota-supervisor-runtime-contract.md. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…rces that declare their own FeedBar stay unambiguous under using-directives
Brings in the reviewed commit that renames the borrowed-array row type in feed_reader.hpp so that test sources declaring their own FeedBar stay unambiguous under using-directives. No hunk of the merged commit was altered. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Brings in the reviewed commits that reproduce concurrent provider fetch races in ci_verify, serialize the fetches per source repository, and run the fetch-lock rows with the private-fixture variable cleared. No hunk of the merged commits was altered. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Brings in the reviewed commit that adds the quota supervisor, its tests and its runtime contract under docker/. No hunk of the merged commit was altered. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Brings in the reviewed commits that add a read-only probe of the adapter lookup indexes and a test that pins their populations. No hunk of the merged commits was altered. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Brings in the reviewed comment-and-documentation commit that replaces real prices and trade records in prose with synthetic numbers. Where it overlapped the plain-words cleanup that is already on main, the comment hunks were resolved by combining both edits; no code token changed. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
| handed_to_serve = True | ||
| q.serve(self.ledger, self.channel, owner) | ||
| return | ||
| except BaseException as error: |
| if owner is not None and not handed_to_serve: | ||
| try: | ||
| self.ledger.disconnect(owner) | ||
| except BaseException as error: |
| self.errors.record(error, "endpoint_disconnect") | ||
| try: | ||
| self.channel.close() | ||
| except BaseException as error: |
| "assertion_id": error.assertion_id, "expected": error.expected, "actual": error.actual, | ||
| }) | ||
| return result_files(directory, result, 1, complete=True) | ||
| except BaseException as error: |
![graphify-labs[bot]](https://avatars.githubusercontent.com/in/4356270?s=60&v=4){kind=small}
There was a problem hiding this comment.
Graphify reviewed this change.
Worth a look — the grounded gate found no coupling regressions or blocking issues, but 5 advisory finding(s) below merit a look before merge.
Not checked: tests were not run; no formal proof of the changed code.
Graphify review — findings
Adds a root-only proof harness, docker/pf_quota_policy_privileged_proof.py, that runs the full shipped quota supervisor as a subprocess and checks its receipts against registered rows: normal exit, refusal, membership, finite nofile, cleanup, launcher signals, caller deadline, crash, exec failure, refused-path diagnostics, and absent-deadline runs. It starts with a deliberate work-process crash through the same recorder, stops on the first failed control, and reports missing facilities, broken evidence or interruptions as Incomplete rather than a target failure. Scratch confinement in new_file and mkdir_new is checked by name only, so the write boundary depends on a symlink-free parent. The forked actors in workload and the launcher teardown in run are where process lifecycle can leak into the controller.
Worth a look
- new_file/mkdir_new scratch confinement is lexical only; a symlinked parent lets writes escape the scratch root —
docker/pf_quota_policy_privileged_proof.py· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
- Forked tree children can raise into the parent's stack instead of exiting —
docker/pf_quota_policy_privileged_proof.py:397· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
- Forked second actor returns/raises into the parent's code path instead of calling os._exit —
docker/pf_quota_policy_privileged_proof.py· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
- Immediate pidfd liveness check races against asynchronous death of owned descendants —
docker/pf_quota_policy_privileged_proof.py· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
- Trace path leaves Popen.returncode unset, so the finally block re-signals and waits on an already-reaped launcher —
docker/pf_quota_policy_privileged_proof.py· Escalate · medium- NOT verified (no proof, no reproducing execution) — needs human review
Review partial — this diff was larger than one review pass covers, so later files were not reviewed; some findings may be missing.
Analysis details — impact, health, verification
Impact & health
Graphify review
Impact — 12853 functions depend on the 9198 functions this change touches.
Health — this change adds coupling hotspots:
- new:
_admission()— 12 callers, 6 callees - new:
main()— 1 callers, 16 callees - new:
_exercise_outside_hello()— 2 callers, 8 callees - new:
new_file()— 5 callers, 3 callees - new:
_exercise_shared_endpoints()— 2 callers, 7 callees - new:
worker()— 1 callers, 13 callees - new:
controller()— 1 callers, 12 callees - new:
main()— 1 callers, 11 callees - …and 18 more — each is listed as a finding
Verification — 12853 functions in the blast radius were not formally verified this run (proofs are advisory here).
Gate & verification
graphify gate
PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.
Advisory (not blocking):
- verification_scope: 12535 function(s) in the blast radius were not formally verified this run
Docs that may be stale (advisory)
AGENTS.md§ REQUIRED before claiming any change is done (lines 5-45): references changed symbolsrows,stepAGENTS.md§ Test Commands (lines 66-72): references changed symbolsprepareAGENTS.md§ SOP: adding a runtime PF_API export (CI gate — recurring failure) (lines 73-97): references changed symbolsrunAGENTS.md§ Refactor workers (native-engine programme, R4 and later) (lines 105-141): references changed symbolsgit,sourcesCHANGELOG.md§ Unreleased (lines 8-135): references changed symbolsrun,stepCHANGELOG.md§ Closed-trade reads (lines 259-309): references changed symbolsrowsCHANGELOG.md§ Live ledger report-checkpoint layouts (lines 346-353): references changed symbolsrunCHANGELOG.md§ Native live report stream updates (lines 386-450): references changed symbolsrunCHANGELOG.md§ Live ledger resource control (lines 527-546): references changed symbolsrunCHANGELOG.md§ Native live report stream (lines 611-632): references changed symbolsrun
…and 10 more.
The comment cleanup rewrote comments in four frozen oracle sources (test_oracle_deferred_birth.cpp, test_oracle_frozen_size.cpp, test_oracle_reversal_later_tick.cpp, test_oracle_short_seed_percent.cpp). tests/oracle.sha256 pins those files, and its hashes exist so that the frozen oracle inputs cannot change unnoticed, even in comments. This commit restores the four files to exactly their content on main, so the existing per-file hashes and both tree hashes pass unchanged and no pin is touched. The synthetic-numbers cleanup therefore excludes the frozen oracle files. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
…mbers cleanup replaced tests/pine_input_domain_gates.json pins a window of source text around each adapter gate, and the window for the slipped/commissioned margin follow-up quantity rule began with two comment lines that the comment cleanup rewrote with synthetic numbers. This commit replaces those two comment lines in the pinned window with the lines now in the source; the code lines of the window, the rule, the old and new gate text and the other 52 windows are unchanged. Every window in the file is a substring of src/source/pine_adapter.cpp again (53 of 53; the check found 52 of 53 before this change). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
| verdict = "RED" if any(row.get("verdict") == "RED" for row in result["rows"]) else "GREEN" | ||
| result.update(state="COMPLETE", verdict=verdict) | ||
| return result_files(directory, result, 1 if verdict == "RED" else 0, complete=True) | ||
| except BaseException as error: |
This was referenced Nov 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
One branch that carries five reviewed changes together, so the strict queue lands them once with one verification run and one parity measurement. Each change keeps its own reviewed commits; the branch joins them with merge commits and alters no hunk (the one overlap, in comments and documentation, is resolved by combining both edits).
FeedBarRow(one commit). Test sources that declare their ownFeedBarstay unambiguous under using-directives; a rename infeed_reader.hppand the one test that uses the type, no behaviour change.ci_verify(three commits: the test that reproduces the concurrent-fetch race, the fix, and a fix to run the fetch-lock rows with the private-fixture variable cleared). Parallel verification workers no longer race on one source repository.docker/). Container-level, outside the engine library.Checked
tests/CMakeLists.txt): no member adds a line above it.🤖 Generated with Claude Code
🤖 Generated with Claude Code