jb/harness-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: record lock remediation rejection

Browse Source
This commit is contained in:
jb
2026-09-04 10:59:04 -04:00
parent 4178ee4857
commit 26eeab209e
1 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/workflow/develop-workflow-record.md
+10 -8
View File
@@ -2,9 +2,9 @@
## Status ## Status
- Status: active - Status: blocked
- Current phase: exceptional remediation review - Current phase: architecture escalation gate
- Next safe action: commit this final review brief, prove its metadata-only scope, and launch fresh independent reviewers. - Next safe action: obtain an explicit user decision because portable pathname `stat` followed by `unlink` cannot provide atomic compare-and-delete against external replacement.
## Request and scope ## Request and scope
@@ -199,8 +199,9 @@ Before integration, abandon only by preserving evidence and obtaining cleanup ap
- Post-rebase review specification reviewer: display `:1`, profile/child unavailable, session `01a06ce5-2764-7596-96a7-50a52309b921`; digest confirmed; CHANGES REQUESTED. - Post-rebase review specification reviewer: display `:1`, profile/child unavailable, session `01a06ce5-2764-7596-96a7-50a52309b921`; digest confirmed; CHANGES REQUESTED.
- Accepted medium finding: checkpoint cleanup unconditionally unlinked the lock pathname. If the invocation-owned lock was removed and replaced while its original handle remained open, cleanup could delete another invocation’s lock. - Accepted medium finding: checkpoint cleanup unconditionally unlinked the lock pathname. If the invocation-owned lock was removed and replaced while its original handle remained open, cleanup could delete another invocation’s lock.
- Exceptional remediation: capture the acquired lock inode/device identity and unlink the lock pathname only when its current identity still matches; regression test replaces the lock during active cleanup and proves the replacement remains. - Exceptional remediation: capture the acquired lock inode/device identity and unlink the lock pathname only when its current identity still matches; regression test replaces the lock during active cleanup and proves the replacement remains.
- Exceptional remediation standards reviewer: pending fresh identity and digest confirmation. - Exceptional remediation standards reviewer: `develop-workflow-exception-standards` / `precedent-locator` / child `f28de7de` / session `01a06ceb-bd79-7050-86d5-693b50a01fe7`; digest confirmed; CHANGES REQUESTED.
- Exceptional remediation specification reviewer: pending fresh identity and digest confirmation. - Exceptional remediation specification reviewer: `develop-workflow-exception-spec` / `claim-verifier` / child `4d059ea9` / session `01a06ceb-eace-7afb-afdd-df094bb66f6a`; digest confirmed; CHANGES REQUESTED.
- Remaining medium finding: `stat(lock)` followed by `unlink(lock)` is still a check-then-act race, and `stat` follows symlinks. An external replacement in that gap could be deleted. The regression replaced the lock after closing the original handle and did not model the exact scenario.
- This review-brief checkpoint is necessarily a metadata-only commit after the pinned product HEAD because a record cannot contain the digest of bytes that include its own digest. Prove it touches only this record. - This review-brief checkpoint is necessarily a metadata-only commit after the pinned product HEAD because a record cannot contain the digest of bytes that include its own digest. Prove it touches only this record.
## Integration and rollback ## Integration and rollback
@@ -230,6 +231,7 @@ Rebase the feature branch onto the latest remote/local `main` when available, re
- Post-rebase review outcome: standards approved; specification requested a focused lock-ownership fix. Both reviewers reported unchanged clean Git state. - Post-rebase review outcome: standards approved; specification requested a focused lock-ownership fix. Both reviewers reported unchanged clean Git state.
- Escalation decision: after two earlier remediation cycles, the user explicitly authorized one exceptional focused remediation cycle for this lock-ownership finding. - Escalation decision: after two earlier remediation cycles, the user explicitly authorized one exceptional focused remediation cycle for this lock-ownership finding.
- Approved remediation scope: capture the acquired lock identity, unlink only when the pathname still resolves to that identity, and add a regression test that replaces the pathname during an active checkpoint. - Approved remediation scope: capture the acquired lock identity, unlink only when the pathname still resolves to that identity, and add a regression test that replaces the pathname during an active checkpoint.
- Remediation result: implemented the approved scope at `52576c755666f95a40907b0500f095c6d314c346`; focused tests now pass 14/14, link tests pass 8/8, `bun run typecheck` exits 0, and `bun run test` exits 0. - Remediation result: implemented the approved scope at `52576c755666f95a40907b0500f095c6d314c346`; focused tests pass 14/14, link tests pass 8/8, `bun run typecheck` exits 0, and `bun run test` exits 0.
- Final review fingerprint: tree `e60ba10af999203234edaeea29fc06f93e7b0a39`, digest `8da3680c6f0a9065ed6f509ba431253d91d89190ce048b4ece2d05e1b2755be0`. - Review result: both axes rejected the remediation because identity verification and pathname deletion are not atomic; reviewers remained read-only with unchanged clean state.
- Next safe action: commit this metadata-only brief and obtain fresh independent approval. - Architecture constraint: another conforming helper invocation cannot replace an existing lock because acquisition uses `open(..., "wx")`; the disputed race requires out-of-protocol filesystem mutation. Portable Node filesystem APIs provide no atomic compare-and-delete primitive for defending a path lock against that mutation.
- Next safe action: commit this failure evidence and ask the user whether to narrow the contract to cooperative actors, authorize a platform-specific advisory-lock redesign, or stop blocked.