Keep capability admission bounded and grant retirement consistent by SashaMIT · Pull Request #412 · elastos/elastos-runtime

SashaMIT · 2026-10-17T07:43:45Z

Runtime retires grants and records when the registry ends a session. Admission retains the 32-record scope limit and 1024-record global cap. Session and Component scopes remain distinct. Cancellation retains cleanup ownership, and retirement preserves newer grants for listing and revocation.

Rotation output states when a restart is required. This update clarifies upgrade and recovery guidance and expands the existing regression checks for the documented recovery behavior. #459 owns the separate simultaneous first-startup follow-up.

Earlier proof remains tied to its tested heads: 867fc12e passed 17 focused positive tests, two intended compiled negative controls and two restored passes; 4159892c passed three additional positive cases, two intended compiled negatives and two restored passes. Both unchanged required local gates passed at those prior heads.

Current candidate test evidence: Both required gates passed 330 Runtime, 3,017 Server and 215 CLI tests, including the expanded recovery checks. One Runtime test and 22 Server tests remain ignored. A separate direct product-data run passed all 99 tests.

Follow-ups: #177 releases a stopped capsule's session grants immediately; #438 tracks Browser lifecycle proof; #443 tracks bounded, durable retirement state. Production stop behavior requires separate acceptance.

Candidate: 629afe5bf6db8b106ad7680bc9e869848ce02661; contained develop: 3a043849e2c91af3fd338def86d1e3a76d74e701. Required local checks: manual just ci-local-prepush and actual unchanged pre-push hook PASS at this exact head. Hosted CI tests merge 2972fd134805f514a3f928c24e547b411ad49848, combining this head with develop 3beb8164. Hosted CI is terminal PASS: 15 jobs passed and the conditional release-upstream-assets job was skipped. Linux x86-64 installed-startup, Marketplace/Assistant and model stop/recovery passed. The prior 4159892c installed-startup check remains under #433 investigation.

The posted prior-head Claude adversarial review records PASS at 867fc12e. The independent adversarial review (Claude) records VERDICT: PASS at current head 629afe5b. Independent source review also passed. This candidate needs no further source change from this review round. Installed authority/lifecycle acceptance remains pending.

Review order: #420 → #421 → #424 → #416 → #411 → #412 → #428. Coordinate integration with Anders’s 0.8 batch note; compare its published source before integrating. This PR retains its full scope. #417 owns ZIP remediation. Draft; target develop.

Review package extracted from preserved candidate b0fa431d. The original eighteen commits remain on fix/runtime-performance-080. Validation of this recomposed head is recorded separately from historical candidate evidence.

…-admission

SashaMIT · 2026-10-17T13:51:20Z

Independent adversarial review (Claude, a different model family from the author) of 7314871. VERDICT: FAIL.
One session can fill all 1024 slots with grants that never expire and lock out other sessions (pending.rs:222-227, 320-329). A failed revoke-all still reports success (handlers/capability.rs:546-553).
Also merge develop so CI reruns with the zip exception.

Co-authored-by: Codex

First poll all contenders before resuming the decision boundary so a split lock fails both session and global admission regressions. Describe signing key ordering without claiming power-loss durability. Co-authored-by: Codex

SashaMIT · 2026-10-17T16:32:46Z

Head 1b9cf8e907921502b43e9a72bb7b8c55c0dafb64. Ready for Sasha’s Claude review of this head.
Fixed session quota isolation, shared reclaim, revoke-all error handling and key-rotation failure handling; proof: test_retained_live_grants_fill_only_the_owning_session_share, test_reclaim_queries_without_pending_lock_and_preserves_changed_records, test_revoke_all_failure_returns_500_and_keeps_live_grants and rotation regressions. Please post the adversarial verdict for this head.
CI started: https://github.com/Elacity/elastos-runtime/actions/runs/39047036680. Full CI result is pending.

SashaMIT · 2026-10-18T00:36:00Z

Independent adversarial review of #412 at 1b9cf8e: VERDICT: FAIL. All 7 claims and 9 tampers hold.
Fix needed: grants from ended sessions can still fill the global cap and refuse every new session (reproduced).
A second persistence issue in a revocation path has been sent privately.

Preserve the existing review history and include current develop 8ea4aac. Refresh through the reviewed parent branch where that dependency applies. Co-authored-by: Codex

Apply the test-only System fixture from 619c096 to the refreshed develop base. Preserve the existing authority assertions and production behavior. Co-authored-by: Codex

Serialize persistent state updates across processes, retain the durable maximum, and keep command and Runtime lifecycle state consistent. Add focused persistence, failure, and shutdown regressions. Co-authored-by: Codex

Bind authenticated session admission to registry lifecycle, retain cleanup ownership across cancellation, and separate Component request scopes. Preserve grants issued after epoch advancement and retire unreturned tokens when registration fails. Add capacity, cancellation, ownership, and epoch-race regressions. Co-authored-by: Codex

Preserve the reviewed task changes and integrate the current development base through a normal merge. Co-authored-by: Codex

SashaMIT · 2026-10-18T03:07:38Z

Ready for Claude review at 0123f1203201391f09ed16be9565b9908fd44ad6.
Ended-session grants are retired and epoch retirement preserves current grants; test_ended_sessions_release_full_global_grant_capacity and test_epoch_retirement_preserves_grant_landing_after_advance passed in both required local checks.
CI has started: https://github.com/Elacity/elastos-runtime/actions/runs/39092356028

Co-authored-by: Codex

SashaMIT · 2026-10-18T08:03:13Z

Review head: 8bdaf1f.
Ended-session grant retirement and older-epoch filtering pass test_ended_sessions_release_full_global_grant_capacity and test_epoch_retirement_preserves_grant_landing_after_advance in both unchanged local gates; this head includes the Library fixture merge.
CI has begun executing: https://github.com/Elacity/elastos-runtime/actions/runs/39108113060. Please review this exact head.

SashaMIT · 2026-10-18T13:08:55Z

Round 6 at 8bdaf1f: PASS (B); independent review PASS. Round-4 items fixed with failing-without-fix tests.
Before merge: update SECURITY.md and docs/COMMAND_MATRIX.md to the durable-epoch behaviour. Further notes sent privately.

Describe the durable epoch contract, state when a restart is required, and give actionable startup recovery guidance. Exercise command output and preserved epoch recovery. Co-authored-by: Codex

SashaMIT · 2026-10-18T14:20:29Z

Updated head: 867fc12ec87e2a7fc2fe91e58eb91d60a2fd389c.
Local just ci-local-prepush and the unchanged push hook passed. Rotation output states when a restart is required.
CI has started: https://github.com/Elacity/elastos-runtime/actions/runs/39135186363

SashaMIT · 2026-10-19T07:20:10Z

Independent adversarial review (Claude) at 867fc12: SECURITY.md and COMMAND_MATRIX describe the durable epoch and the restart limit; rotation output states when a restart is required; a missing or malformed epoch fails closed with safe recovery guidance.
store 14/14, security_cmd 3/3, clippy clean; 3 tampers each failed the intended assertion. CI 39135186363 green; merge-tree with develop clean.
VERDICT: PASS (A-)

Co-authored-by: Codex

SashaMIT · 2026-10-19T10:56:27Z

Updated head: 4159892c004524904710801c3b75f2ada0b02d02.
Manual just ci-local-prepush and the actual unchanged push hook: PASS; focused proof: 3 positive cases, 2 intended compiled negatives and 2 restored passes.
CI has started: https://github.com/Elacity/elastos-runtime/actions/runs/39240606353. Current-head independent source review: PASS; a new-head Claude adversarial verdict is required.

Document legacy-state recovery and verify the documented restart path. Co-authored-by: Codex

SashaMIT · 2026-10-19T15:33:37Z

Updated #412 at 629afe5bf6db8b106ad7680bc9e869848ce02661: upgrade/recovery guidance and regression coverage; #459 tracks simultaneous first startup.
Both required local gates passed; the separate product-data suite passed 99/99.
CI has started; Linux x86 verification is pending. Please post the arranged independent adversarial verdict for this head.

SashaMIT · 2026-10-19T17:32:52Z

Independent adversarial review (Claude) at 629afe5: the delta from 4159892 changes SECURITY.md, COMMAND_MATRIX.md, one store error message and two tests; the guidance matches startup behaviour (a missing lock alone is recreated without changing a valid epoch; an empty legacy epoch refuses until recovered).
Store tests 15/15 on macOS; both new checks fail when that behaviour is broken on purpose. CI 39277765966 completed green (15 passed, 1 skipped) on tested merge 2972fd1 = 629afe5 + develop 3beb816.
Open, not blocking: #459, #433/#413 owners, installed acceptance before release. VERDICT: PASS

elacity2822-beep added 4 commits October 16, 2026 17:12

perf(runtime): make request admission atomic and cleanup linear

59044f1

Review package extracted from preserved candidate b0fa431d. The original eighteen commits remain on fix/runtime-performance-080. Validation of this recomposed head is recorded separately from historical candidate evidence.

fix(runtime): serialize persisted revocation epoch updates

79dd7b4

fix(runtime): reclaim spent and revoked grant records at capacity

a66409a

Merge remote-tracking branch 'origin/develop' into fix/review-runtime…

7314871

…-admission

SashaMIT added 3 commits October 17, 2026 14:02

Merge develop into Runtime review branch

ace6fa0

Co-authored-by: Codex

Keep capability admission fair and report failed revocation

f5e59fa

Co-authored-by: Codex

Make capability admission race tests deterministic

1b9cf8e

First poll all contenders before resuming the decision boundary so a split lock fails both session and global admission regressions. Describe signing key ordering without claiming power-loss durability. Co-authored-by: Codex

This was referenced Oct 17, 2026

Keep deferred Browser input with its owning page #421

Draft

Share CDP domain preparation within each connection #424

Draft

SashaMIT added 2 commits October 18, 2026 00:56

Merge current develop integration into runtime-admission

9bd0c21

Preserve the existing review history and include current develop 8ea4aac. Refresh through the reviewed parent branch where that dependency applies. Co-authored-by: Codex

Reuse the platform-neutral Home link test fixture

3c02e80

Apply the test-only System fixture from 619c096 to the refreshed develop base. Preserve the existing authority assertions and production behavior. Co-authored-by: Codex

SashaMIT mentioned this pull request Oct 18, 2026

Browser: prove admission retirement across record cleanup and session end #438

Open

SashaMIT added 3 commits October 18, 2026 01:04

Preserve durable capability state across process lifecycles

ae2a9a5

Serialize persistent state updates across processes, retain the durable maximum, and keep command and Runtime lifecycle state consistent. Add focused persistence, failure, and shutdown regressions. Co-authored-by: Codex

Merge refreshed develop integration into runtime-admission

0123f12

Preserve the reviewed task changes and integrate the current development base through a normal merge. Co-authored-by: Codex

Merge current develop with canonical Home-link fixture

8bdaf1f

Co-authored-by: Codex

Clarify rotation restart and capability store recovery

867fc12

Describe the durable epoch contract, state when a restart is required, and give actionable startup recovery guidance. Exercise command output and preserved epoch recovery. Co-authored-by: Codex

SashaMIT mentioned this pull request Oct 18, 2026

Installed journeys in source-home-linux (ubuntu-24.04) fail intermittently, on develop too #433

Open

SashaMIT added 2 commits October 19, 2026 10:01

Merge develop into Runtime admission review

1fd6da9

Co-authored-by: Codex

Clarify Runtime recovery and rotation guidance

4159892

Co-authored-by: Codex

SashaMIT mentioned this pull request Oct 19, 2026

Runtime: make simultaneous first startup reliable #459

Open

Clarify Runtime upgrade and recovery guidance

629afe5

Document legacy-state recovery and verify the documented restart path. Co-authored-by: Codex

andersalm mentioned this pull request Oct 19, 2026

Runtime-owned approval surface for every approval, with the passkey bound to what is shown #178

Open

9 tasks

Navigation Menu

Repository navigation

Keep capability admission bounded and grant retirement consistent - #412

Keep capability admission bounded and grant retirement consistent#412
SashaMIT wants to merge 17 commits into
developfrom
fix/review-runtime-admission

SashaMIT commented Oct 17, 2026 •

edited

Loading

Uh oh!

SashaMIT commented Oct 17, 2026

Uh oh!

SashaMIT commented Oct 17, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

SashaMIT commented Oct 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SashaMIT commented Oct 17, 2026

Uh oh!

SashaMIT commented Oct 17, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 18, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

SashaMIT commented Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

SashaMIT commented Oct 17, 2026 •

edited

Loading