Repository navigation
Align artifact transfer deadlines and stall budgets #4441
Description
Current execution status — 2026-11-13
Open; separate reviewed remote and source-route components are unpublished. Ingress/proxy/ticket/disconnect completion, component integration, isolated proof and pinned exact validation remain. Local focused observations are not whole-issue readiness.
Latest detailed Current state.
Parent: #4368. Audit: DSRV-5, CMD-5, CONTR-12. Authorized by the user's acceptance of the next-ten recommendation. Source baseline: 5781ba4aa63462d7fa55b5987e5841a01c691dfc.
Problem and owner
The daemon and proxy HTTP constructors leave whole-request timing to Node defaults, install-source uses a fixed120s transfer signal, and remote upload attempts use a fixed300s timer. These limits can reject progressing transfers independently of the admitted operation. Review the current transfer/cancellation/installation owners before treating any old audit fallback claim as still present.
Owners: packages/daemon/src/server/http/http-server.ts; packages/proxy/src/daemon-proxy.ts; packages/remote/src/upload-stream.ts and upload-client.ts; packages/provision-kit/src/install-source.ts and install-source-download.ts.
Required contract and prevention design
Define the aggregate transfer/installation budget, header/connect budget and inactivity budget explicitly at the existing owners. Progress must not silently reset an aggregate deadline. A progressing transfer inside its admitted budget must not fail because of a contradictory120s/300s sublimit. A stalled, oversized, cancelled or expired transfer must terminate promptly with typed evidence and bounded cleanup. Preserve HTTP framing, ticket expiry, credential boundaries, resume offsets and the existing aggregate installation/result margins.
Use the existing caller/request deadline where available. Before implementation, record how ingress and pre-RPC uploads without that deadline obtain a finite budget and how that budget relates to upload-ticket expiry. This policy decision is required; setting all timeouts to zero, broadening retries or adding an unbounded fallback is not approved. Reuse existing deadline/progress owners rather than a new transfer framework.
Completion evidence
Real loopback client→proxy→daemon transfer tests distinguish slow progress, stalls, abort and aggregate expiry. Exercise install-source response-body consumption and request framing. Retain byte caps and prove no resumed/fallback work starts after cancellation. Use controlled clocks or transport seams rather than minutes-long sleeps. Demonstrate regression against the named base or a meaningful policy mutant. Independent review, full repository format, exact-head affected validation and CI are required. Preserve #4050. No native device or real cloud transfer is required.
Sequencing
The coordinator owns the budget decision and current overlap check before an implementation claim. This issue is not yet an AFK implementation contract. No merge, release, upload or tags are authorized.
Activity
apex-sentinel-staging commentedon Nov 11, 2026
Apex Sentinel · Issue review
Suggested label:
bugThe report describes existing fixed 120s/300s transfer timers and Node defaults causing progressing transfers to fail, which is broken behavior. It names affected files, required contract, tests, and sequencing, though it notes the issue is not yet an AFK implementation contract and needs a budget policy decision first.
Required sections
thymikee commentedon Nov 11, 2026
Decision: policy investigation ownership:
An isolated source-only Luna design task now traces the existing transfer, upload-ticket and request deadline owners. It must propose a finite aggregate/connect-header/inactivity policy, especially pre-RPC/ingress budgets without a caller deadline. This is investigation only. The coordinator records the selected policy before implementation; no source changes or public behavior decision is delegated. Tests are paused outside the single #4425 base comparison.
thymikee commentedon Nov 12, 2026
Decision: finite transfer budgets and the shared source-install envelope
Adopt this policy for #4441 under the user's active completion authorization. Baseline is eec35e9. The earlier 480-second reservation is rejected. It would leave only 90 seconds for a download. The numbers below are explicit new policy choices where they differ from current behavior.
Keep the existing RPC envelopes. A normal install has 480 seconds. An install-from-source has 600 seconds. Keep the existing 30-second result margin. Do not reserve the entire normal-install envelope before a source download. At source-install admission, enforce the earliest registered execution/result deadline through the existing request cancellation owner. The default source work budget is therefore 570 seconds from admission, including readiness, download, extraction and installation. Each phase consumes that same remaining budget. Keep the existing per-platform native installation caps; Android and the inspected Apple native installer each cap installation at 120 seconds. A native operation also observes the shared request signal, so its effective cap is the earlier native cap or remaining request deadline. Do not reset the operation deadline when download or installation starts. A request without transport metadata still gets a finite source-install execution budget from its descriptor. A standalone source-materialization call gets a 600-second aggregate at entry, combined with caller cancellation. Do not silently turn that API into an unbounded download.
Give remote artifact preparation one 600-second aggregate, beginning before packaging or hashing and ending after the last upload/finalize needed for that preparation. The standalone uploadArtifact API gets the same finite aggregate at entry. An enclosing preparation/caller/lease deadline always wins. All attempts, redirects, offset resumes, legacy fallback, response consumption and finalize share the original aggregate. No retry starts after cancellation or expiry. Wire the signal into packaging children, hashing pipelines, upload pipelines and response readers. Abort and join owned work before cleanup; do not race and abandon it. This preparation budget precedes the RPC envelope, matching the existing lifecycle: a default remote normal install can spend at most 600 seconds preparing plus its existing 480-second RPC envelope; source install can spend at most 600 preparing plus its existing 600-second RPC envelope, excluding daemon startup. This is an explicit finite phase composition, not a claim that preparation already consumed the RPC envelope.
For these artifact/source transfer paths, use a 30-second connection ceiling, a 30-second response-header wait, and a 120-second body-byte inactivity ceiling. For an upload, start the response-header wait after the outgoing request body finishes; do not charge a progressing upload body against a 30-second header timer. For a bodyless download request, the header wait follows connection establishment. Use backpressure-aware body progress; unrelated headers, keepalive traffic or timer callbacks are not body progress. Redirects and resume attempts may start fresh phase timers but never a fresh aggregate. Remove the contradictory fixed 120-second source-transfer and per-attempt 300-second upload ceilings. The earlier aggregate/caller deadline remains authoritative. Preserve an explicitly configured proxy upstream timeout as an independent operator cap; the current option is absent by default, not an implicit 30-second whole-transfer cap. Leave the dedicated health probe policy unchanged.
Make Node ingress limits explicit at daemon and proxy constructors: 30 seconds for request headers and 600 seconds for receiving a request body, instead of relying on Node defaults. For upload transfer handling, start an independent 600-second aggregate at the request callback and enforce 120-second body inactivity. The incoming header phase has its separate ceiling. These limits do not impose a new 600-second cap on unrelated RPC handler execution or replace command deadlines. For artifact transfer forwarding, including Fetch embedding without a Node socket, impose a finite 600-second transfer aggregate and the same phase/progress policy. Propagate client disconnect and expiry through the existing request/stream owners. Abort a response body as well as the request when the downstream disappears.
Keep resumable upload cleanup as a five-minute idle lifetime, not a five-minute absolute ticket expiry. Refresh it on actual received body-byte progress and after a successful appended chunk. Never refresh a transfer aggregate. A transfer may progress for more than five minutes only while both its aggregate and the ticket's refreshed idle lifetime remain valid. On inactivity or aggregate expiry, destroy the owned active streams and await existing rollback. A recoverable interrupted chunk returns to its prior verified offset. If rollback fails, invalidate the ticket. Legacy-upload failures remove their owned temporary directory. A later independently requested lifecycle may resume a still-live ticket under a new aggregate; an expired lifecycle itself may not resume or fall back. Keep authorization, tenant confinement, framing, byte caps, hashes, offsets and finalization semantics unchanged.
Preserve typed caller cancellation. Produce typed timeout evidence from the owner of the expired aggregate or phase. Include the phase and effective budget without branching on error text. A timeout must not become a retryable transport error or be mislabeled caller cancellation. Keep existing cleanup and result-margin behavior. Do not add a transfer framework, cache, unbounded fallback or new retry policy.
Source trace: daemon-client/index.ts:94-160 computes the RPC timeout, then connects and prepares artifacts before sendDaemonRequest. daemon-client-transport.ts:453-466 starts its monotonic RPC deadline at transport send. timeout-policy.ts:11-14,94-128 defines 480/600-second envelopes and the 30-second margin. daemon-command-registry.ts:49-54 derives the result deadline. HTTP http-server.ts:492-497 and socket transport.ts:91-94 register it. request-router.ts:230-234 applies descriptor execution deadlines. host-kit/internal/request-cancel.ts:221-258 owns deadline cancellation; its effective cutoff must also honor an earlier registered result deadline. server/platform-request-scope.ts:12-16 obtains that same request signal. platform-android/runtime.ts:452-456 passes it into deployment/runtime.ts:59-64, then the composition executor and install-artifact.ts:22-28 pass it to provision-kit materialization. The Apple deployment/executor path does the same. Native Android deployment/native.ts:8,25 and Apple core/config.ts:11 cap installation at 120 seconds. No 480-second native installer reservation exists in these owners.
Source/body trace: provision-kit/install-source.ts:120-144 currently adds a fixed 120-second signal. install-source-download.ts:31-53 passes the signal through approved URL/redirect acquisition, but its writeResponse pipeline currently lacks the explicit signal. The installed Undici 7.30.1 api-request.js:62-70 destroys an already-created response body on abort; that source inspection is not runtime proof. Add the explicit pipeline cancellation and real post-header body-abort test. remote/upload-client.ts:62-112 starts preparation before its current per-request signals; upload-client-artifact.ts packaging/hash paths need cancellation. upload-stream.ts:173-205 owns the old 300-second timer and pipeline. Proxy upstreamSignal uses the caller signal by default and only adds a timeout when the operator configures one.
Disconnect/cleanup trace: proxy/node-http.ts converts premature request/response close to the forwarded signal. Upload HTTP dispatch directly passes IncomingMessage into resumable receive, rather than using RPC lifetime registration. resumable-upload-transfer.ts:35-58 pipelines the real request to the file and rolls back to oldSize on failure; rollback failure invalidates the entry. resumable-upload.ts:183-209 owns idle expiry, active-receive destruction and queued directory cleanup. server/upload.ts removes its owned legacy temporary directory on failure. Preserve these owners and verify them through real loopback disconnects; RPC disconnect tests alone are insufficient.
Illustrative policy timelines, not measurements: a 1 MiB source arriving in 2 seconds followed by a 20-second install remains well inside the existing envelope. A source that takes 330 seconds while delivering body bytes at least every 120 seconds, followed by a 120-second native install and 20 seconds of other work, consumes 470 of 570 seconds and can succeed; the old fixed download limit would fail it at 120 seconds. A 570-second work deadline still stops a continuously progressing download that leaves no installation time. A remote upload that needs 420 seconds with steady progress can complete inside its 600-second preparation aggregate, while a 120-second body stall or the 600-second absolute cutoff ends it. These choices do not promise success for every large or arbitrarily slow artifact.
Implementation is staged by owner. First implement and author tests for remote preparation/upload aggregation and cancellation. Then implement source-install deadline/body propagation and explicit ingress/ticket inactivity behavior, with the shared policy values kept at their existing domain owners. Source workers must not modify proxy-origin work owned by #4434 concurrently. Before publication, use controlled clocks and real loopback client→proxy→daemon tests for progress beyond the old fixed limits, stalled headers/body, expiry despite progress, caller abort after response headers, two-hop disconnect, rollback/cleanup, ticket-idle refresh and no post-expiry fallback. Retain byte/framing/hash/redirect tests. Demonstrate old behavior or a meaningful policy mutant, perform independent review, and run exact-head validation with #4050 unchanged. No native device or cloud allocation is required. No merge, release or tags are authorized.
thymikee commentedon Nov 13, 2026
Current state: The remote-only #4441 slice is committed and unpublished at f2eefda7da67a0c02b04e3729d17da3b1a9ad0d7 on base80075b6412dfa94fd765a36407270e21adce8981. The preserved preparation aggregate patch replayed unchanged. Pinned setup/build, typecheck, full format, diff/lint and143focused tests passed; no exact affected gate or whole-issue readiness is claimed.
Independent source review found early-response cleanup/join and connection-phase ownership issues. The core findings are accepted for correction. The enclosing600-second aggregate still bounds the early-response case, so the report’s indefinite-hang wording is not adopted. Separately, the transform progress hook fires before a chunk reaches ClientRequest, so it cannot prove a socket has connected or made transport progress. A dependent OpenCode Apex medium task now corrects request/socket/body lifecycle and strengthens completed-transfer, early-response and typed-expiry proof. No publication until corrected source is reviewed and validated.
The adopted finite policy is unchanged. Source-install cancellation, Node/proxy ingress and forwarding, ticket idle refresh, real two-hop disconnect/rollback proof, isolated regression proof and exact-head validation remain outstanding. #4050 stays selected. No timeout widening, blind CI retry, merge, release or tags.
thymikee commentedon Nov 13, 2026
Decision: source-install deadline enforcement owner: Enforce the already adopted 570000ms source work budget through the existing descriptor/request-router path. Give both install-from-source and install_source one source-install timeout policy with600000ms client envelope and570000ms daemonDeadlineMs, derived from the existing30000ms result margin. The current withRequestDeadline owner must honor any earlier registered execution/result deadline, including refusing task entry when it is already expired. Do not arm every command’s result deadline globally or change unrelated command policies.
The standalone materialization600000ms aggregate and incoming caller cancellation must be checked before publishing a completed source, even when owned work ignored an abort or resolved after its cutoff. Retain the existing platform native-install caps and request cancellation propagation. This selects the existing source-install descriptor boundary as the narrow enforcement mechanism; it does not change the finite budgets adopted in #4441 (comment). The real source-install request path, response-body cleanup, mutation and exact-head proof remain required before readiness. No global deadline framework, timeout widening, fallback, merge, release or tags.
thymikee commentedon Nov 13, 2026
Current state: Two local components have bounded independent source reviews with no concrete findings. They remain separate unpublished commit chains and do not complete this issue.
fb7fbb8eee1cc4863256b1c38b32481b82900e7f. The review found the early-response abort/join and connection/body-phase corrections addressed within the remote slice. The worker reports 155 focused tests and targeted mutation detection. These supplied results are not an exact affected-gate pass.d73159597a2e3a23b9b8db107437629a733dc8ef. Saved logs report 27 focused and 292 provider tests passing, plus typecheck/lint/layering. They used pnpm 11.25.0, so pinned 11.17.0 and exact-head validation remain required. The small optional-cause annotation correction is accepted. The worker's scope and shared-stash violations remain recorded; its candidate is clean, and the foreign stash entry was retained.Remaining: daemon/proxy ingress bounds, finite forwarding and downstream-disconnect propagation, ticket-idle refresh on body progress, rollback/cleanup, reconciliation of the deferred artifact-download path with the adopted policy, integration of the components, isolated regression/mutation evidence and exact validation. Preserve the adopted 600-second aggregates, phase ceilings, 570-second source work deadline and result margin. Progress must not reset aggregate deadlines.
No PR or whole-issue readiness is claimed. Historical failed receipts and unproven timeout causes remain. No broad retries, timeout widening, test deletion, merge, release or tags.
thymikee commentedon Nov 13, 2026
Current state: The preserved remote and source-install components are mechanically integrated at 5bad71760a5a2f41cd5198362c9ed5a5628ae478 on fresh main ddbfc85. Both ranges are patch-equal by git range-diff; the checkout is clean. Original components fb7fbb8eee and d73159597a and their evidence are preserved. This new head has not been validated.
The next source-only slice refreshes the existing five-minute ticket idle lifetime during actual accepted body progress. The current code already refreshes after successful appended chunks. Node ingress, handler aggregates/body inactivity, proxy forwarding/disconnect, download phase coverage and full rollback/proof/exact validation remain separate obligations. External #4511 still overlaps deferred artifact-download work and is not maintained by this coordinator. The Apple4516 comparison owns local execution; source work does not run tests concurrently. No whole-policy completion or readiness claim.
thymikee commentedon Nov 13, 2026
Current state: Ticket-idle review corrections are committed at29164a5cc593432414d3cc345aa1fdff93bf8784 on the integrated remote/source chain. Independent source review found no production regression and identified a proof gap. The coordinator corrected it: a stalled receive must remain pending before the refreshed expiry, then reject at the deadline with typed RESOURCE_EXPIRED evidence. The test no longer claims unasserted rollback. The empty-request case is retained as a closest-negative baseline control. The progress test now stays within the adopted ten-minute ingress envelope.
Pinned focused tests passed12/12, typecheck, full formatting and diff-check passed. My first typed assertion overconstrained an additional hint and failed two cases; that test predicate was corrected and the failed log preserved. This is focused feedback, not an integrated exact gate or real socket proof. Next source-only slice makes daemon/proxy Node ingress limits explicit. Transfer aggregates, body inactivity, forwarding/disconnect, legacy cleanup, deferred download reconciliation and complete policy/regression/exact proof remain open.
thymikee commentedon Nov 13, 2026
Current state: The Node ingress slice and its small review fixes are integrated into the remote/source/ticket candidate at3f88e9dee341031284b1a74629bd7ec229ae396b. Pinned format/build,24focused Node constructor tests,typecheck and diff-check passed. The daemon constant is private; the public proxyHTTPS options remain and have an embedding example. Tests assert constructed settings/public options, not live timeout expiry. Node periodic enforcement is not claimed as an exact wall-clock disconnect.
The ticket slice separately passed12focused tests after the proof correction. No integrated exact gate or complete policy proof is claimed. Next source-only work adds the daemon streaming-upload600saggregate/120sbody-idle and disconnect/cleanup behavior at existing owners. Proxy forwarding/Fetch observability, download phase coverage, deferred artifact-download/#4511 reconciliation, real loopback and full regression/exact validation remain open. Reinstall's proof/gate worker alone owns local execution.
thymikee commentedon Nov 13, 2026
Current state: The partial upload-lifetime review found a real error-precedence defect and premature idle timing while queued. Root corrected them directly at7bfce3773370e46c61917827de549a0637f26559. Typed rollback/finalize-cleanup/ticket-expiry errors are preserved; raw stream errors still map to the lifetime abort cause. Idle begins at the admitted pipeline, after the per-ticket queue. Three focused precedence cases passed. Typecheck initially found an authored unused import; after removing it,pinned typecheck/full format/diff-check passed. The failed typecheck log is kept.
This is not full validation: optional-lifetime mode, six-case I/O/resource cleanup, real HTTP route proof, extraction cancellation, JSON-body idle and end-to-end phase classification remain open. The review's claim that legacy fallback gets a fresh600s client budget is false for this integrated code: one outer preparation signal is passed through direct,resume,finalize and legacy. Keep the explicit Node receipt limit and independent handler aggregate; adopted policy requires both.
The proxy design confirmed Fetch visibility limits but is not adopted. A60s composite does not establish30sheaders after actual outgoing completion; consumed-body EOF can precede transport finish. A follow-up design must identify a supported transport owner and preserve the finite caps. No generic framework,private global hook,unbounded fallback or timeout weakening is authorized.
thymikee commentedon Nov 13, 2026
Current state: Independent source-only review of the proposed default node:http(s) proxy adapter returned refine, then adopt. Before code, correct lifecycle listener registration and cleanup, preserve typed abort reasons, retain incomplete-upload308 without following redirects, preserve early responses without cancelling the client's successful incoming body, and keep the existing Request boundary/null-body status rules. Watchdog ownership, demand-pausing and runtime environment/Bun behavior need verification. Custom opaque transports cannot be falsely claimed joined after abort.
The finite custom-transport/runtime/status decisions remain to be recorded. This design review is not a source implementation or whole-issue clearance. The current partial source candidate remains7bfce3773370e46c61917827de549a0637f26559, with daemon-lifetime proof/mandatory-owner cleanup, proxy implementation, end-to-end discrimination and exact validation still open. The adopted budgets are unchanged; no weaker fallback, fresh aggregate, new retry or arbitrary timeout was introduced.
thymikee commentedon Nov 14, 2026
Decision: finite proxy transfer transport and observable error contract:
Under the active completion authorization, adopt a proxy-owned node:http(s) default adapter for POST /upload, /upload/preflight, /upload/finalize, PUT /upload/direct/* and GET /artifacts*. Keep /rpc, health and diagnostics on their existing Fetch path. Preserve 30-second connect, 30-second headers after actual outgoing finish and connection establishment, 120-second body inactivity, and the non-refreshing 600-second forwarding aggregate. Caller cancellation and an explicitly configured operator cap still win. No retry, new aggregate after expiry, or Fetch fallback is added.
Adopt the source-cited November14 transport plan with these binding corrections and finite choices:
Explicit migration on DEFAULT TRANSFER routes: Location redirects are not followed; Fetch-injected default request headers are not sent; patched global fetch or an undici global dispatcher no longer intercepts that hop. Embedders needing that transport behavior supply upstreamFetch and own its documented phase guarantees. Environment routing follows node:http(s)'s global agent; no parity claim is made before proof. Document these changes with the owning proxy API, preserving TLS verification, authentication, tenant confinement, URL restrictions and framing.
Start only source sliceA: the single phase owner/move and narrow suspend/observer work, reusing the preserved candidate. No proxy adapter or daemon expansion in that task. Apple4442 retains the sole test slot; new tests are authored-unrun. The proposed A/B/C names are source boundaries, not proven independent PR layers: the watchdog exists only in unpublished4441 remote changes. Before publication, include and validate each required baseline/dependency using gh-stack, preserve a self-contained tested layer, and respect gross-diff limits. Do not split detecting tests away merely to shrink an implementation PR. Split source by independently enforceable contracts, not by hiding proof.
Proxy implementation follows review of sliceA and this adopted contract. Daemon gaps and downloads retain separate owners; external4511/4505 are dependencies/overlap only and are never maintained. Required evidence includes real-loopback308, early401/413, close/drain races, two-hop disconnect/rollback, ignored custom signals, backpressure, aggregate despite progress, late opaque settlement, Node/Bun/environment routing, wire/closure checks and meaningful mutants. Source reading is not runtime proof. Preserve4050, historical failed receipts and unproven causes. No merge, release or tags.
thymikee commentedon Nov 14, 2026
Current state: Under adopted Decision #4441 (comment), the source phase-owner slice is committed in a local gh-stack. Trunk is d78be6c. Lower t3/audit4441/remote-budgets at f1e7532d8e8d561b7f8e8e3fc741f39f713bf418 reuses the preserved three remote commits with equal range-diff;12files,+2011/-147,requiring independent coherent-size review. Upper t3/audit4441/phase-owner at5bec449d1a315aed82c1f1033954f431ac43989a has9files,+516/-241 and depends on that unpublished lower layer. The integrated7bfce377 candidate is untouched.
The watchdog/tests move to host-kit/transport, with suspend and a shared outgoing phase observer. Eight existing tests are retained and11new tests are authored,ALL UNRUN. The finish-event timing is not proven equivalent to the previous pipeline continuation until real-loopback evidence. Only diff-check passed. Dependencies are absent:format,depgraph,build,typecheck,lint,layering,lazy-closure,loopback,mutations and exact gates remain pending.
A separate Claude reviewer now assesses the full lower and upper ranges, design/size/dependencies and proof quality. No proxy adapter or daemon expansion was coded. Apple4442 keeps the sole local execution slot. Nothing is pushed or published; no merge,release,tags or readiness claim.
thymikee commentedon Nov 14, 2026
Current state: Apple4442 b80056b passed its exact gate and all four production mutants were caught with67/67restored controls. Evidence remains attributed to b800. Independent source review found no correctness defect but two Low hygiene issues, now root-fixed at600d51dc49c06b44c3e66e098cff3629fee72b71: remove test-only probe injection, answer the real listing in tests, and correct redundant/fixture assertions. Pinned format/lint/typecheck and77tests across6files pass. A new Claude worker owns the sole execution slot for600d mutation controls and one exact gate. Native,CI and publication remain open; prior review input omissions are disclosed.
Transfer4441 source review found a real completed-hop timer leak that could replace a resumed hop's retryable failure with the old timeout. The coordinator fixed lower watchdog retirement at6089d90d905071810c1b4ab4e5c89d7aabc7258c, restacked, and retired the upper observer at43abdfa8020b19290dd1dd5174c00274868b29f9. Misleading budget prose is corrected. The finite low-level wrapper stays until its fixture proof migrates to the outer lifecycle owner. Phase expiry remains intentionally terminal under adopted policy; ordinary transport resets retain their retry. These transfer changes are unformatted/unvalidated and still need real-loopback detection,wire/closure checks and exact receipts. Nothing is published.
Android4426 at0e98de50 remains authored-unrun and queued. Seven implementation scopes remain:#4442,#4426,#4441,#4448,#4519,#4520,#4518; the last remains reproduce-first/blocked on external4511. Historical failed receipts,#4512 and API36causes stay as recorded. No merge,release,tags,delegate polling or new timer.