mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
main
1166
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Shaojin Wen
|
6c8d1e0f70 |
test(managed-agent): pin the queue_one reachability (FG11d) (#15187)
* test(managed-agent): pin the queue_one reachability (FG11d) The design record claims the queued-input arm is reachable under queue_one; this cell is the witness. A second manual fire is admitted at one active run, its run commits, and no prompt for its occurrence ever appears. The cancel half stays open: measured here, a task cancel on that queued run is accepted and the run stays running, because the queue is settled by the turn. * test(managed-agent): align the queue_one assertions and mark the cancel half ungated (FG11d) The active-run half of the reachability cell excluded one settled state fewer than the queued half, so a run that had failed would still read as untouched. Both halves now exclude the same three settled states. The design record called the un-gated cancel half "(measured)", which reads as if a witness exists in the tree. It now says "measured locally, not gated", the same claim the PR body makes. * test(managed-agent): observe the queue_one dwell and scope the record to what it proves (FG11d) The negative rested on a single `isEmpty()` sampled one poll after the run row committed, so an asynchronous dispatch of the queued input would land after the assertion had already returned green. It now runs as a bounded dwell through `waiting()`, keeping the failFast and lock-exception guard. Both records cited the cell as pinning that no prompt appears, which attributes the absence to the overlap arm. The first turn is parked, so the wake pump cannot start the queued input under any policy; the records now say the cell pins admission (its own run id and a `fired` occurrence) and only observes the absence over a dwell. |
||
|
|
cfd95f6abb |
fix(ci): scope the sdk-java host lock to the cache write-back (#15128)
* fix(ci): scope the sdk-java host lock to the cache write-back (#15117) Run 39627609266's fast-tier job arrived at 17:38, stayed head of the sdk-java host-lock queue, and failed at 19:15 without starting Maven. The MariaDB integration lane held the same lock across its install and full MySQL clean verify; under pool contention that hold ran from 15:54 to 18:57 (run 39628985638), past the fast tier's 90-minute budget. Both MariaDB Maven runs already resolve from a job-local repository, so they touch no host-shared state. Seed that repository before the lock, run both Maven commands unlocked, and take the host lock only for the cache write-back, the sole remaining host-shared mutation. Drop fd 9 on the write-back children so a cancelled job's survivor cannot retain the lock. Raise the lane ceiling to 300 minutes for the ~3-hour verify plus one lock wait and setup, and pin the new order and fd closes. Fixes #15117 * test(ci): exempt the OpenTUI parity suites from the no-AK gate (#15117) The main merge brought three interactive suites from #14964. The no-AK gate requires every runnable integration test to be selected or explicitly exempted, so the Test job fails until they are listed. Co-authored-by: Qwen-Coder <[email protected]> --------- Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: jinjing.zzj <[email protected]> Co-authored-by: 易良 <[email protected]> |
||
|
|
06e59666df |
fix(ci): skip the duplicate prepare build in the daemon E2E lane (#14884)
* fix(ci): skip the duplicate prepare build in the daemon E2E lane (#14870) Co-authored-by: Qwen-Coder <[email protected]> * test(ci): pin the daemon E2E prepare-skip premises (Refs #14870) * test(ci): keep the daemon E2E step commands pinned (Refs #14870) * test(ci): pin the daemon E2E step and its install warning (#14870) --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: qwen-code-dev-bot <[email protected]> |
||
|
jinyeandQwen-Coder
|
288e4c481d |
perf(ci): Optimize MySQL integration verification (#15200)
Close Spring contexts before fixture database cleanup, run integration classes in isolated reusable forks, and remove redundant fixture validation and duplicate load-test execution. Document bounded local validation and preserve full CI gates. Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良andQwen-Coder
|
0b3c2f816a |
feat(ci): restore a MariaDB leg for the non-Hosted IT family (#15003)
* fix(ci): align Java integration database and lock lifetime * test(ci): re-pin the sdk-java lock and MySQL probe after the single-step merge The merge commit staged the conflict resolution before these two re-pins were written, so they land as a follow-up in the same push: - `keeps the host lock out of every Maven child` counted three lock-bearing steps; #14903 collapsed the MariaDB lane's two Maven steps into one, so the count is now two (test job + mysql-integration). - The MySQL startup probe took the step's first `mvn` line, which is now the `-DskipTests install` staging command; select the `-Pmysql-integration` command instead so the probe still exercises the consumer. Verified: vitest sdk-java-workflow.test.js 96 passed; prettier --check clean. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-conflict/jmvgz448zlp * fix(ci): skip the MySQL binlog, drop the unused database, correct the reaper bound Three independent corrections to the mysql-integration lane this PR reworks. 1. MySQL 8 enables the binary log by default (MariaDB 10.11 did not in the configuration this lane replaced), and the datadir is an uncapped tmpfs. Nothing in packages/managed-agent-server/src or packages/sdk-java reads a binlog (0 hits for binlog|log_bin|GTID|SHOW MASTER STATUS), and the container is disposable with no replica, so `--skip-log-bin` is appended after the image name beside --innodb-use-native-aio=0. Without it the ~67 MiB hex-encoded LONGBLOB query this lane already raises max_allowed_packet for is serialized a second time into host RAM. 2. `--env MYSQL_DATABASE='runtime_broker_test'` had no consumer: the lane's only connection is -Dmysql.url=.../managed_agent_test?createDatabaseIfNotExist=true. The declaration invited a cleanup that drops createDatabaseIfNotExist and dies at first connect with Unknown database. Dropping it lets the JDBC URL own the schema and shrinks the diff. 3. The cleanup comment and removal-failure warning said the host reaper reclaims a stranded container "after a 24h age gate" / "up to a day". The real bound is ~48h: qwen-docker-cleanup.sh:31 gates on a strict `now - created_at > 86400` (exactly 24h is SKIPPED) and qwen-docker-cleanup.timer fires once a day, so a container created just after a fire is skipped at the next one and reaped at the one after. Test pins updated in the same change: the start-step assertion, the exact docker-run trace literal, and the cleanup warning literal. All three were mutant-verified red (drop --skip-log-bin / re-add MYSQL_DATABASE / restore "after 24h") and restored byte-identical. Only this PR's own copy of the reaper wording is corrected; the two pre-existing copies (sdk-java.yml's event-transport-multi-node job and release-managed-agent-reference.yml) are untouched to keep this diff scoped. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * feat(ci): restore a MariaDB leg for the non-Hosted IT family #14936 moved the mysql-integration lane onto MySQL 8.4 and removed the last real MariaDB server, leaving the published MariaDB-only V12 repair (RTRIM, error 1901) and the schema catalog's MariaDB branches without a falsifier. Both engines now run the same non-Hosted *IT family as two matrix legs of one job: the container image, its startup arguments, its client, and its readiness signal come from the leg, and the container name carries the engine so two legs on one pool host cannot collide. --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Shaojin Wenand易良
|
ec82cac361 |
test(managed-agent): keep a sibling run alive past a cancel (FG11d) (#14999)
* test(managed-agent): keep a settled run's outcome (FG11d)
* test(managed-agent): reuse a same-key cancel (FG11d)
* test(managed-agent): refuse a second fire while the turn runs (FG11d)
* revert: move the second-fire cell onto its own branch
The cell belongs to the next PR in the chain, which bases on this branch, so
it cannot also live here: the next PR's diff would be empty. Content of this
branch is unchanged from
|
||
|
易良andQwen-Coder
|
54a56f30ce |
fix(ci): write back only the MariaDB lane's Maven delta and size its ceiling (#15000) (#15064)
* fix(ci): bound the MariaDB lane's cache write-back and size its ceiling (#15000) Run 39563394993's mysql-integration job was cancelled at the 200-minute ceiling: 54 minutes queued for the host lock, 75 minutes of Maven work, then a 60-minute unbounded tar of the host-shared ~/.m2. The cache is an optimization, so skip it after five minutes; the ceiling now covers the 90-minute wait, the measured Maven pass, the bounded write-back and setup headroom. * fix(ci): write back only the MariaDB lane's Maven delta by hardlink The bounded tar pipeline extracted straight into the host-shared ~/.m2, so a timeout mid-member left a truncated artifact that --skip-old-files never repaired and the next seed hardlinked into its job. Its 300 s cap was also below the measured 26-61 minute whole-tree cost, so it would have tripped on every run. Publish only the files Maven fetched in this job (nlink == 1 after the hardlink seed) with per-file cp -ln, keeping the two in-house excludes. Each link is atomic and never replaces a host file, so the 300 s backstop can only leave artifacts missing. Distinguish the timeout from other failures, and fold the backstop into the derived ceiling floor instead of a second hardcoded one. * ci: record sdk-java.yml's real size in the workflow ratchet This PR grows .github/workflows/sdk-java.yml from 113473 to 114180 bytes: the MariaDB lane's timeout ceiling moves 200 -> 280 with the arithmetic that justifies it, and the Maven write-back is rewritten to publish only this job's own downloads (nlink == 1) under a 300 s backstop instead of taring the whole tree. The growth is the change, so record it rather than move the step out. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-conflict/jmvj37bcsp8 --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良andQwen-Coder
|
d6abebb40c |
fix(ci): report swap and a df -h fallback in the lint lane failure dump (#15095)
* fix(ci): report swap and a df -h fallback in the lint lane's failure dump The lint lane's state-at-failure dump asked /proc/meminfo for MemTotal and MemAvailable only, and ran df -hT with no retry, while the three sibling dumps in the same workflow grep SwapTotal|SwapFree and fall back to df -h. A swap-exhausted death on the contended pool therefore uploaded an artifact that could not show it, and a runner whose df has no -T uploaded no filesystem table at all. Witness it by executing the step body rather than pinning its text: the new case stubs a df that rejects any option cluster carrying T, so the marker can only come from the -h retry, and asserts both swap fields reach the artifact. Red before (the artifact held MemTotal/MemAvailable only and no filesystem table), green after. Co-authored-by: Qwen-Coder <[email protected]> * test(ci): pin the retained dump fields and the three sibling dumps R1-1: the swap/df-fallback case asserted only what the PR adds, so the halves of the two edited lines it kept were unguarded. Collapsing the retry to `df -h || true`, or reordering it to `df -h || df -hT || true`, stayed green while the artifact permanently lost the filesystem Type column; narrowing the grep to swap alone stayed green while the lane this PR fixes stopped reporting RAM at failure. Give the stub's `-hT` arm its own marker so "retried after -hT failed" is distinguishable from "never tried -hT", and assert both RAM fields beside the swap ones. R1-2: the same dump is replicated at four sites and nothing pinned them equal, so dropping the swap fields or the `|| df -h` retry from test, test_macos or test_windows shipped green. Pin the three siblings textually, extending the sampler pin loop idiom already in this file -- textual rather than executed because test_windows greps /proc/meminfo, which Git Bash lacks. Test-only: .github/workflows/ci.yml is byte-unchanged by this commit (md5 31b18cbbaeb407d9348e1f3f51f1c0b4). Verified with a nine-mutant battery run one mutant at a time against ci.yml, restoring and md5- checking after each: all nine are now killed, each by a named assertion. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvik9qbdof --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
|
438bcb2a8f |
fix(ci): let the fast Java tier overtake waiting full-tier lock tickets (#15035)
* fix(ci): serve the fast Java tier before full-tier lock holds (#15032) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): keep a parked lock head's ticket alive under fast priority A head blocked in `flock --wait` could not touch its ticket, so once a hold outlasted the 1800s mtime arm another waiter reaped a live head and the next ticket, whatever its class, parked in the kernel too. With two classes that lets normal tickets take kernel positions ahead of fast tickets that arrive later during a long hold. A keepalive now refreshes the parked head's ticket at the waiters' two-second cadence; it closes the lock fd and uses `touch -c`, so it can neither hold the lock nor recreate a removed ticket. The ordering and promotion cases used a stub whose `--wait` returned every 200 ms, so they exercised a head that loops, which production never does. They now park `--wait` until release and assert the reachable paths: a fast ticket overtaking a normal ticket that is still waiting, and a promoted waiting normal ticket preceding a later fast ticket. The comments and design docs no longer claim a fast job waits at most the hold already running (a parked head still goes first) or cite #14962/#15032 as fast-behind-full evidence; they state what priority removes and that a single hold longer than the budget is outside it. --------- Co-authored-by: Qwen Autofix <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: wenshao <[email protected]> |
||
|
Shaojin Wenand易良
|
f773580e13 |
test(managed-agent): refuse a second fire while the turn runs (FG11d) (#14998)
* test(managed-agent): keep a settled run's outcome (FG11d)
* test(managed-agent): reuse a same-key cancel (FG11d)
* test(managed-agent): refuse a second fire while the turn runs (FG11d)
* revert: move the second-fire cell onto its own branch
The cell belongs to the next PR in the chain, which bases on this branch, so
it cannot also live here: the next PR's diff would be empty. Content of this
branch is unchanged from
|
||
|
ChiGao
|
0ac1fcca91 |
feat(cli): align OpenTUI input, editing and status lines with Ink (#14964)
* fix(cli): restore bounded OpenTUI dialogs and add migration gates * fix(cli): preserve OpenTUI input and attachment ownership * feat(cli): align OpenTUI status lines with Ink * fix(cli): align OpenTUI editor and cancellation transactions * fix(tui): harden migration cleanup and evidence after review * test(tui): fail acceptance on unhandled errors * docs(cli): clarify consolidated OpenTUI delivery status * test(cli): isolate system settings in TUI parity fixtures * fix(cli): settle OpenTUI cancellation when replay resets a session * style(cli): format merged OpenTUI test callbacks * test(cli): preserve visible input across session rotation * test(cli): await cancellation before releasing held response * fix(cli): preserve completion and escape precedence and validate status colors * fix(cli): preserve attachment navigation with one completion * fix(cli): display session titles in the OpenTUI composer border * fix(cli): discard generated command work after cancellation |
||
|
Shaojin Wen
|
fbeb188b16 |
test(managed-agent): reuse a same-key cancel (FG11d) (#14997)
* test(managed-agent): keep a settled run's outcome (FG11d)
* test(managed-agent): reuse a same-key cancel (FG11d)
* test(managed-agent): refuse a second fire while the turn runs (FG11d)
* revert: move the second-fire cell onto its own branch
The cell belongs to the next PR in the chain, which bases on this branch, so
it cannot also live here: the next PR's diff would be empty. Content of this
branch is unchanged from
|
||
|
易良
|
21337f0e51 |
fix(release): cover every spawned vendored binary in the tarball exec-bit gate (#15008)
* fix(release): cover every spawned vendored binary in the tarball exec-bit gate The gate matched only vendor/ripgrep/*/rg, but the tarball spawns a second vendored executable: vendor/landlock-run/<arch>-linux/qwen-landlock-run. Its own runtime heal shares the ripgrep heal's hard limit — it can only chmod an install the running user owns, so a root-owned sudo install degrades the same silent way. Widen the expected set with a small spec list keyed on the leaf binary's presence (the landlock-run/src source directory falls out structurally), parse every regular-file tar entry instead of a single ripgrep regex, and extend the fixture tests to cover both trees with pass/reject cases. Also correct the stale comment above the landlock heal: it claimed npm archives strip non-bin exec bits, which is the inverse of what #12668 established — pnpm's packer wrote 0644 for every non-bin entry from 0.24.4 to 0.25.3; npm keeps working-tree modes. Refs #12668 * fix(release): keep missing-binary strictness in the widened exec-bit gate Deriving the expected set from the leaf binary's presence meant a platform directory whose binary was dropped during staging silently shrank the expected set: a dist without vendor/ripgrep/x64-linux/rg but with the directory would pass with five entries. Platform membership now comes from the directory name alone — ripgrep skips '-win32', landlock-run skips the 'src' source directory — so a missing binary fails as 'missing from the packed tarball' again, matching the pre-widening strictness. Also update the function doc block, which still claimed the gate covered ripgrep only. Regression test: an empty ripgrep platform directory fails with the missing-entry diagnostic even when every other binary passes. |
||
|
易良
|
f036ab2360 |
fix(ci): name the sdk-java host lock holder when a ticket starves (#15031)
Three main runs went red today (2026-10-21) with 'host lock not acquired within 90 minutes as queue ticket N; head of queue is N-...': the starved waiter WAS the head of the ticket queue, so the flock is held by an unticketed process -- a stray left by a canceled job, the bare-flock fallback of a resumed release tag, or another machine sharing the runner HOME. The current log cannot name any of them, and each occurrence costs a 90-minute lane plus a flaky-red main. Add best-effort holder diagnostics around the existing queue, with no change to ticket, timeout, or error-signature semantics: the first time the head fails a lock probe it prints a one-shot ::warning:: with the holders visible via lslocks (fuser fallback), and the timeout error now lists the holder under the unchanged ::error:: line. An empty answer means the holder lives on another machine sharing this HOME, which is itself the topological evidence needed for the follow-up fix. |
||
|
易良andQwen-Coder
|
a4562edb67 |
fix(ci): align Java integration database and lock lifetime (#14936)
* fix(ci): align Java integration database and lock lifetime * test(ci): re-pin the sdk-java lock and MySQL probe after the single-step merge The merge commit staged the conflict resolution before these two re-pins were written, so they land as a follow-up in the same push: - `keeps the host lock out of every Maven child` counted three lock-bearing steps; #14903 collapsed the MariaDB lane's two Maven steps into one, so the count is now two (test job + mysql-integration). - The MySQL startup probe took the step's first `mvn` line, which is now the `-DskipTests install` staging command; select the `-Pmysql-integration` command instead so the probe still exercises the consumer. Verified: vitest sdk-java-workflow.test.js 96 passed; prettier --check clean. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-conflict/jmvgz448zlp * fix(ci): skip the MySQL binlog, drop the unused database, correct the reaper bound Three independent corrections to the mysql-integration lane this PR reworks. 1. MySQL 8 enables the binary log by default (MariaDB 10.11 did not in the configuration this lane replaced), and the datadir is an uncapped tmpfs. Nothing in packages/managed-agent-server/src or packages/sdk-java reads a binlog (0 hits for binlog|log_bin|GTID|SHOW MASTER STATUS), and the container is disposable with no replica, so `--skip-log-bin` is appended after the image name beside --innodb-use-native-aio=0. Without it the ~67 MiB hex-encoded LONGBLOB query this lane already raises max_allowed_packet for is serialized a second time into host RAM. 2. `--env MYSQL_DATABASE='runtime_broker_test'` had no consumer: the lane's only connection is -Dmysql.url=.../managed_agent_test?createDatabaseIfNotExist=true. The declaration invited a cleanup that drops createDatabaseIfNotExist and dies at first connect with Unknown database. Dropping it lets the JDBC URL own the schema and shrinks the diff. 3. The cleanup comment and removal-failure warning said the host reaper reclaims a stranded container "after a 24h age gate" / "up to a day". The real bound is ~48h: qwen-docker-cleanup.sh:31 gates on a strict `now - created_at > 86400` (exactly 24h is SKIPPED) and qwen-docker-cleanup.timer fires once a day, so a container created just after a fire is skipped at the next one and reaped at the one after. Test pins updated in the same change: the start-step assertion, the exact docker-run trace literal, and the cleanup warning literal. All three were mutant-verified red (drop --skip-log-bin / re-add MYSQL_DATABASE / restore "after 24h") and restored byte-identical. Only this PR's own copy of the reaper wording is corrected; the two pre-existing copies (sdk-java.yml's event-transport-multi-node job and release-managed-agent-reference.yml) are untouched to keep this diff scoped. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Shaojin Wen
|
96953853fd |
test(managed-agent): resume the automation streams across a settle (FG11e) (#15017)
* test(managed-agent): resume the automation streams across a settle (FG11e) Gate the FG11e row of #14446 with two cells in the FG11 automation class. One cuts a run's task event feed and a public Session stream while the wake Turn is held between its fire and its settle, and resumes both from their last positions; the other pages the run list across an insert. The Session arm asserts today's precondition that a run adds no event to the Session stream, so it gates the resume across that window rather than automation content. The cells book 39 s on the shared Hosted fork (healthy 10272 s, fork 10872 s, so the Verify step moves to 192 minutes and the job ceiling to 295), and the FG11e design record moves to partly delivered in both languages. * test(managed-agent): decode the FG11e task cursor independently The stream cell built each expected task cursor with the store's own encoder, so the cursor format was never witnessed apart from the code that writes it. The served cursor is now decoded in the test and must name its row's sequence. The Session comparison trims the ledger with a limit instead of subList, so a stream that served more frames than the journal holds fails as an assertion rather than an IndexOutOfBounds. * test(managed-agent): count each run's settle in the FG11e list cell The run-list cell counted model Turns for the automation but never read the settle commands, so a run settled twice without a second model call would pass it, while both design records say each cell checks one settle per occurrence. It now asserts the journal holds exactly one settleRun per run, in the order the runs settled. * test(managed-agent): fail an FG11e task cursor outside its format The independent cursor check fell back to the decoded text when it did not match the cursor format, so a cursor that decodes to a bare number became a valid-looking sequence and matched the ledger. A cursor outside the format now fails the check outright. * test(managed-agent): rebook the FG11e cells at their slower samples Two later runs measured the stream cell at 14.1 s and the run-list cell at 5.6 s, above the 13.8 s and 5.2 s the ledger was booked against. At 2x the slower samples the cells take 41 s: healthy 10424 s, fork 11024 s, which the 194-minute Verify step still wraps with 16 s of margin. |
||
|
Shaojin Wen
|
86875ee18b |
test(managed-agent): reuse the pinned registration after a lost ack (FG13a) (#14993)
* test(managed-agent): lose the store ack after the result commit (FG13a) StoreFaultGate's existing seam rejects a commit before it applies, so the whole commit rolls back. This layer adds the opposite failure: the commit lands and the caller never sees its acknowledgement. The faulting store calls afterApply only after super.apply succeeds; the new cell proves one physical Hook call, a durable settled result, and a status read that returns it without a second call. Adds the bilingual design note. One cell adds 150 s to the shared fork: healthy 10189 s, fork 10789 s, Verify 190 minutes, job 293 minutes. * test(managed-agent): keep the durable dispatch after a lost ack (FG13a) * test(managed-agent): reuse the pinned registration after a lost ack (FG13a) * test(managed-agent): report the lost ack after the commit lands (FG13a) * test(managed-agent): let the dispatch ack-loss cell call its Hook (FG13a) * docs(managed-agent): describe the ack seam without overclaiming (FG13a) * test(managed-agent): bound the dispatch recovery instead of guessing (FG13a) * docs(managed-agent): carry the audit fixes into the registration slice (FG13a) * docs(managed-agent): align the Chinese dispatch slice with its cell (FG13a) * docs(managed-agent): drop the model-request claim from the Chinese slice (FG13a) * docs(managed-agent): align the Chinese registration slice budget (FG13a) * test(managed-agent): witness the replay instead of a transient phase (FG13a) * test(managed-agent): witness the replay on the registration ack loss (FG13a) |
||
|
Shaojin Wen
|
644dfcf68b |
test(managed-agent): keep the durable dispatch after a lost ack (FG13a) (#14992)
* test(managed-agent): lose the store ack after the result commit (FG13a) StoreFaultGate's existing seam rejects a commit before it applies, so the whole commit rolls back. This layer adds the opposite failure: the commit lands and the caller never sees its acknowledgement. The faulting store calls afterApply only after super.apply succeeds; the new cell proves one physical Hook call, a durable settled result, and a status read that returns it without a second call. Adds the bilingual design note. One cell adds 150 s to the shared fork: healthy 10189 s, fork 10789 s, Verify 190 minutes, job 293 minutes. * test(managed-agent): keep the durable dispatch after a lost ack (FG13a) * test(managed-agent): report the lost ack after the commit lands (FG13a) * test(managed-agent): let the dispatch ack-loss cell call its Hook (FG13a) * docs(managed-agent): describe the ack seam without overclaiming (FG13a) * test(managed-agent): bound the dispatch recovery instead of guessing (FG13a) * docs(managed-agent): align the Chinese dispatch slice with its cell (FG13a) * docs(managed-agent): drop the model-request claim from the Chinese slice (FG13a) * test(managed-agent): witness the replay instead of a transient phase (FG13a) |
||
|
Shaojin Wen
|
021dc1fdd6 |
test(managed-agent): lose the store ack after the result commit (FG13a) (#14991)
* test(managed-agent): lose the store ack after the result commit (FG13a) StoreFaultGate's existing seam rejects a commit before it applies, so the whole commit rolls back. This layer adds the opposite failure: the commit lands and the caller never sees its acknowledgement. The faulting store calls afterApply only after super.apply succeeds; the new cell proves one physical Hook call, a durable settled result, and a status read that returns it without a second call. Adds the bilingual design note. One cell adds 150 s to the shared fork: healthy 10189 s, fork 10789 s, Verify 190 minutes, job 293 minutes. * test(managed-agent): report the lost ack after the commit lands (FG13a) * docs(managed-agent): describe the ack seam without overclaiming (FG13a) * docs(managed-agent): drop the model-request claim from the Chinese slice (FG13a) |
||
|
Shaojin Wen
|
8545558a25 |
test(managed-agent): keep a settled run's outcome (FG11d) (#14996)
* test(managed-agent): keep a settled run's outcome (FG11d) * docs(managed-agent): name the settled run's real refusal code The cell's own comment still said task_already_settled while the assertions and both design docs record 409 task_action_unavailable, which is the code the measured behaviour actually answers. |
||
|
易良
|
17fc98adf9 |
docs(ci): correct stale MariaDB CI claims and host reaper bound (#14995)
The design docs recorded mariadb:10.11.18 as the image CI uses. The six validation bullets now state only what was verified - ManagedAgentMySqlIT passed against both mariadb:10.11.18 and mysql:8.4 - so the claim stays true whether or not the MariaDB lane remains in CI. The two older host-reaper comments no longer claim a 24h bound: they describe the strict >24h age gate and the daily timer's 30m jitter that put the worst case at ~48.5h, and the warnings report that bound. |
||
|
Shaojin Wen
|
15ab745f1e |
test(managed-agent): gate R1-1 owner-release recovery across a Spring restart (FG12d) (#14990)
Cover #14880 item 3. During a lifecycle v2 close the Broker proxy refuses the owner release after every configuration is drained, then the test replaces Spring and its embedded Broker. Detach must recover with exactly one forwarded owner release (no acquire, no MCP control), clear the storage holder, and leave the Runtime Session RELEASED. The recorded blocker was the rig, not WorkspaceStorageGuard: startSpring() registered the storage and inserted the Workspace rows on every boot, and the guard refuses a second registration while the holder is booked. Production never re-registers on start, so seed only on the first boot and restart in the JVM; the Broker's close writes nothing and the durable provisioner keeps the worker alive, which is the state R1-1 needs. R1-1 does not reproduce on main: the replaced Broker reaches the persisted-Session release path, and #13673's managed-context branch releases the saved Session while the Harness drains. Disabling that branch turns the case red 3 of 3 times with the original symptom (every retry answers 503 and the holder stays booked). Budget the cell at 24 s (2x its measured 11.9 s): healthy 10039 -> 10063, fork 10639 -> 10663, Verify stays 188 minutes. |
||
|
顾盼
|
a791e47a54 |
feat(cua): streamline computer use and port native reliability fixes (#14846)
* feat(cua): preload the JavaScript computer use runtime * refactor(cua): remove the native Wayland backend * feat(cua): move app computer use into the driver * feat(cua): preserve background delivery and port platform fixes * feat(cua): add explicit desktop input and browser runtime facade * feat(cua): package the unified 0.26.0 computer use runtime * fix(cua): finalize cross-platform native reliability * fix(cua): isolate runtime releases from CLI versioning * fix(cua): keep Electron out of root workspace installs * fix(cua): synchronize consumers and async cleanup tests * fix(browser): migrate smoke to preloaded cua runtime * docs(cua): document MCP setup for Qwen Code Claude Code and Codex |
||
|
Shaojin Wen
|
e17380e6ef | test(managed-agent): reuse the run on a same-key retry (FG11d) (#14981) | ||
|
Shaojin Wen
|
7d27f475be |
test(managed-agent): keep a suppressed reply suppressed across a reload (FG13f) (#14978)
A MessageDisplay command Hook suppresses the streamed reply; the public
ledger must not carry its text, and after a Harness restart the next model
request's history must not carry it either. The fixture gains a
hook-suppress mode that records the Hook input and answers
{suppressOutput:true}.
Adds the bilingual design note. One cell adds 150 s to the shared fork:
healthy 10012 s, fork 10612 s, Verify 187 minutes, job 290 minutes.
|
||
|
|
976425cdb9 |
fix(ci): queue the sdk-java host lock first-come-first-serve (#14743) (#14912)
* fix(ci): queue the sdk-java host lock first-come-first-serve (#14743) flock(2) does not order its wakeups, so under continuous arrivals one waiter can lose every release and die at the wait budget — repeatedly burning 40, then 60, then 90 minutes per starved lane across at least three hosts. Replace the inline flock --wait at all three acquisition sites with a ticketed queue: every acquirer takes the next sequence number atomically, only the head of line retries the lock, dead owners are reaped, and the lock still releases at the step boundary. The pinned infrastructure-signature error text is preserved. The .size-baseline records the workflow's new size (smaller than main's, but main itself already exceeds its recorded baseline). * fix(ci): block the queue head instead of polling the lock The first live run starved its full 5400 s budget as queue ticket 1: the head polled flock --nonblock while main and older branches still run blocking flock --wait, so every release went to a legacy waiter's kernel wakeup. The head now blocks in five-second slices, re-entering the same wake race on even terms; tickets still order every run that uses this helper. * fix(ci): serve the fast tier before full-tier holds The queue bounded the wait by position but a fast-tier PR job still queued behind every full-tier hold ahead of it. Give the fast tier its own class: the head is the first sorted ticket and fast tickets sort first, so a PR job waits at most the hold already running. A normal ticket ages into the fast class after 20 minutes, so continuous PR traffic cannot starve the full tier. * refactor(ci): keep the lock queue plain FIFO. Drops the priority/aging classes: a single first-come-first-serve line is simpler to review and reason about. The head still blocks in five-second slices so it re-enters the kernel wake race on even terms with legacy waiters, and dead owners are still reaped. The tradeoff is explicit: a fast-tier job waits its turn behind full-tier holds instead of jumping them. * fix(ci): stop leaking the host-lock ticket and reap stale orphans Three bounded defects in the fair-lock helper, all confirmed by executing it rather than by reading alone: - The EXIT/TERM/INT traps quoted `${ticket}`, a `local` that is already out of scope once the sourcing step's shell exits, so every trap ran `rm -f ''` and each successful acquisition left its head ticket behind. Drop the traps and leave the queue at acquisition instead: a holder needs no place in line once the kernel holds the lock, and SIGKILL runs no trap. - The ticket was published after `exec 8>&-` released the counter lock, so a later arrival could take seq+1, see an empty queue, name itself head and win the lock out of arrival order. Publish inside the critical section. - Orphan liveness was decided solely by `kill -0`, so a ticket whose PID had been recycled to a live process was never aged out and, being head, made an idle lock unreachable for every job on the host. Age a ticket out on mtime alone above 1800s; a live waiter re-touches every ~7s. Measured on a free lock with a live-PID, 2h-old orphan head ticket: base burns its full 6023ms budget and exits 1 with the orphan intact; this commit acquires in 19ms and reaps it. Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * style(ci): keep only the load-bearing why in the lock helper comments Co-authored-by: Qwen-Coder <[email protected]> Patrol-Run: qwen-pr-closeout/jmvhb9cysmc * fix(ci): keep the lock queue head in one blocking wait The head re-entered the kernel wait queue every five seconds, so a release reached waiters that stayed blocked first; the head could lose every release and starve to its budget. Run 39472038337 still burned the full 5400 s as queue ticket 2. Wait once for the remaining budget and log the remaining time at most once a minute. A resumed release tag can predate the helper, so both acquisition sites fall back to the bare lock instead of dying before Maven and wedging the release. Pin the emitted ::error:: annotation prefix rather than a file substring a comment can satisfy, and observe the real acquisition order in the stub. * fix(ci): name the blocking ticket in the sdk-java lock timeout The timeout line reported only the dying waiter's own ticket, so a deep queue and a wedged one produced the same message and neither could be acted on from the log. Name the head of line, which separates a real sibling hold from an orphan ticket. Bring both design docs back to the shipped mechanism: two acquisition sites, the flock'd counter with no aging path, the 1800 s mtime arm and the ticket removed at acquisition, plus the operator recovery command. Refresh the stale .size-baseline entry for sdk-java.yml. * test(ci): wait for the first ticket instead of a fixed sleep The FIFO case started the second acquirer 800 ms after the first and relied on that being enough for A to take sequence 1. On a loaded runner it is not, and B wins sequence 1, so the case fails on timing rather than behavior. Poll for A's published ticket instead. * fix(ci): print the lock wait line before blocking The wait line was emitted only after `flock` returned, so a head parked behind a sibling hold printed nothing for its whole budget: run 39528681869's step sat in flock for 40 minutes and was cancelled with an empty log, which is the opposite of the attribution this change exists to add. Probe with --nonblock, print the ticket line, then block. The observability bullet in both design docs now states what the code does. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
Shaojin Wen
|
ee332fe5b2 |
test(managed-agent): gate a pre-dispatch MCP operation cancel (FG12d) (#14963)
Cover #14880 item 2 without seeding a row. invoke() commits the mcp_operation at intent, acquires the owner and only then commits dispatch_started, and the cancel route is not gated by an in-flight invoke. The Broker proxy parks the first tool-session acquire that arrives while the durable record is still intent, and the case cancels through the supported Harness route inside that window. The cancel settles managed_mcp_cancelled with the record at cancelled/not_started_proven; the resumed invoke, a same-id retry and a status read answer the same view, and no MCP control reaches the Broker after the parked acquire. Three bundle mutants (cancel skips its intent branch, invoke skips the post-acquire re-read, invoke ignores the local proof) each turn the case red; the last only through the wire assertion. Budget the cell at 18 s (2x its measured 9.1 s): healthy 9518 -> 9536, fork 10118 -> 10136, Verify stays 179 minutes. |
||
|
Shaojin Wen
|
bb2eb88a23 |
test(managed-agent): pin the close refusal while a turn is active (FG11d) (#14974)
* test(managed-agent): pin the close refusal while a turn is active (FG11d) * ci(managed-agent): budget the close-in-flight refusal cell |
||
|
ChiGao
|
6e6598e35c |
fix(cli): restore bounded OpenTUI dialogs and add migration gates (#14933)
* fix(cli): restore bounded OpenTUI dialogs and add migration gates * fix(tui): harden migration cleanup and evidence after review * test(tui): fail acceptance on unhandled errors |
||
|
Shaojin Wenand易良
|
f8c3388470 |
test(managed-agent): resume both Session streams across a held Hook (FG13e) (#14917)
* test(managed-agent): resume both Session streams across a held Hook (FG13e)
A PreToolUse command Hook holds inside the Runtime worker while the public
and WebShell clients read the Session stream. Both clients are then cut,
the deny lands while neither is connected, and each resumes with its own
cursor (Last-Event-ID on the public route, afterSequence on the WebShell
route). Each resumed view must equal the committed ledger byte for byte
with no gap and no duplicate, carry exactly one completion, and the model
must see exactly one tool result carrying the denial reason while the tool
never runs.
The tool-call start frame is only emitted after the call leaves the Hook,
so the cut deliberately happens before it: the frames written during the
hold are exactly the ones a cut client misses. Adds the bilingual design
note. One cell adds 150 s to the shared fork: healthy 9630 s, fork
10230 s, Verify 181 minutes.
* test(managed-agent): read the cut cursors after the readers stop
The resume cursor was sampled before abort(), so a frame the reader
thread appended in that window would be served again on resume and redden
the union as a duplicate. Take the cursors after abort(), matching the
FG12f class.
* test(managed-agent): release the held Hook after both streams are cut
The fixture now offers a hook-release mode that waits for <evidence>.release
instead of sleeping for a fixed 20 s, and the test writes that file only
after both readers abort. The deny therefore cannot land before the cut, so
the gap the cell claims to test is the one it actually creates.
assertResumedView now names what the Hook-held turn put on the ledger: one
failed terminal for call_FG13E_HOLD, past the cut cursor, and one
completion. Transport fidelity to a ledger that lost or duplicated the deny
no longer passes.
fg13-cases joins the Hosted artifact upload and the meta test pins it. Both
design docs correct the CI trigger: pull_request selects the fast tier, and
the full suite runs on the first maintainer approval of the head.
* test(managed-agent): correct the FG13e witness and raise the stall bound
Mutation witness #2 said a live-only resume reddens on the gap assertion.
continueFrom runs after the turn completed, so that client never reaches the
ledger tail: its 90 s wait exhausts and the case reddens on that timeout.
Both design docs now say so, and the Non-goals point the duplicated-helper
extraction at #14921.
The method's stall bound is raised to 480 s, above the 420 s of inner await
budgets, so a hung wait reports its own description instead of the outer
timeout. The Hosted lane trigger sentence was already corrected in
|
||
|
Shaojin Wenand易良
|
8cb67de793 |
test(managed-agent): skip a closed Session's automation slots (FG11d) (#14931)
* test(managed-agent): skip a closed Session's automation slots (FG11d) * test(managed-agent): park the scanner until the Session closes * test(managed-agent): keep the broker-directory comment on its wider arm * test(managed-agent): pin the closed-Session skip at one slot, with the helper --------- Co-authored-by: 易良 <[email protected]> |
||
|
jinye
|
e206b5ee8f |
fix(ci): isolate hosted MySQL integration test classes (#14875)
* fix(ci): isolate hosted MySQL integration test classes * codex: address PR review feedback (#14875) * codex: address PR review feedback (#14875) |
||
|
易良
|
41d0c9fb2a |
test(managed-agent): run the MariaDB lane's fixtures on MariaDB (#14906)
* test(managed-agent): read MariaDB lock waits and schema drift without MySQL-only SQL * chore(ci): record the MariaDB fixture lane's sdk-java workflow growth The packet-budget step takes sdk-java.yml to 108166 bytes, 4124 over the recorded 104042 (allowance 4096). The growth is the real fixture fix, so record it rather than trimming the rationale. |
||
|
易良andQwen-Coder
|
596b7b2c5e |
fix(release): publish the generated CLI with npm so vendored ripgrep keeps its exec bit (#14907)
* fix(release): publish the generated CLI with npm so vendored ripgrep keeps its exec bit `pnpm pack` writes 0755 for the entries named in the manifest's `bin` map and 0644 for every other entry, so ever since #12400 moved publishing to `corepack pnpm publish` the released tarball has shipped `vendor/ripgrep/*/rg` without an exec bit: 0.24.2 carries `-rwxr-xr-x`, 0.24.4 onward `-rw-r--r--`, while only `cli-entry.js` (the single `bin` entry) keeps 0755. A fresh install then cannot spawn the bundled ripgrep at all, and on a machine without a system rg search silently degrades to the built-in grep. The #12673 / #12892 runtime heals cannot chmod a root-owned or read-only install, so they do not cover it. The tar writer is the only place the bit is lost: `copy_bundle_assets.js` restores it on the staged binaries and every other copy path preserves it. So publish the generated CLI with npm, which keeps the working-tree mode, exactly as it was before #12400. The recursive workspace publish stays on pnpm; `publish_package` is only ever called for `dist`, the one package that carries vendored binaries. A pre-publish gate now packs the prepared CLI the same way the publish step does and reads the archive's recorded entry modes, failing when any unix vendored ripgrep lacks all three exec bits. It runs in the arm that produces `dist`, before the publish step consumes it, and refuses to pass vacuously when the vendored tree is missing. Unit coverage pins npm as the CLI's publisher, keeps the gate in that arm, and exercises both the npm-keeps-0111 and gate-rejects-0644 directions. Fixes #12668 Co-authored-by: Qwen-Coder <[email protected]> * fix(release): run the tarball exec-bit gate from the workflow-pinned scripts The gate was invoked through the selected release ref's own `scripts/` path. The publish job's trusted checkout only materializes the paths named in its sparse-checkout list, and a manual release may select any branch or full SHA — so releasing a ref that predates the gate (v0.25.3, or any commit before this change) died in `build-package` with MODULE_NOT_FOUND, dry runs included. Ship the gate with the workflow-pinned scripts — add its path to the release workflow checkout's sparse list — and run it from `.release-workflow/`, the same way the version guard rides that checkout. The working directory stays the selected release ref, so the `dist` argument still resolves to that ref's prepared package. The sparse-checkout list and the invocation are both pinned in the release workflow and package script tests. Fixes the blocking review finding on #12668. --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
易良andQwen-Coder
|
3820924bc2 |
fix(ci): hold chosen RocketMQ ports until the JVMs bind them (#14860)
* fix(ci): hold chosen RocketMQ ports until the JVMs bind them The chooser released its sockets as soon as it printed them, so between the choose step and the JVM bind (download, namesrv boot) any sibling job on the pool host could take the port: #14545's full lane died twice this way, on the broker HA listener and on the NameServer listener. Park each chosen port behind a detached holder process instead, and let rocketmq-lite-broker.sh kill only the holder of the port it is about to hand to a JVM, shrinking the pick-to-bind race to the sub-second kill-to-bind window. The pid files live in RMQ_HOLDER_DIR and are cleaned up on start success, rollback and stop; local runs without RMQ_HOLDER_DIR behave as before. * fix(ci): keep the broker companion arithmetic readable by macOS Bash 3.2 The inner quotes around the numeric operand make macOS's system Bash 3.2 raise "operand expected", so every start and stop failed there after the NameServer had already booted. The script supports macOS, so the operands stay unquoted. * fix(ci): terminate holder pid records and reject overlapping companions A pid file without a trailing newline makes bash read the last line and return 1, so unhold_port and release_holders aborted start and stop under set -e once the workflow consumed RMQ_HOLDER_DIR. Terminate the record and require the file to name the child this chooser just spawned. A broker companion (listenPort - 2 / + 1) can repeat a port an earlier role already parked, and the new holder then died on bind while the live holder's pid file faked success, leaving the fast channel or HA listener colliding with that role. Reject those companions and release only the holders the rejected candidate parked. The script tests now drive the real chooser, then start and stop against stand-in components with its ports and RMQ_HOLDER_DIR. * test(ci): cover the holder records on the stop path too unhold_port and release_holders read the chooser's holder records through separate code paths, and only the start side was exercised: stop with a populated holder directory is what rollback and stop rely on, so give it its own case and share the chooser invocation between both. * test(ci): check a released port by its listener, not by a bind probe A holder binds 0.0.0.0, and binding 127.0.0.1 against a wildcard listener still succeeds on macOS, so the stop case asserted a port was free while the holder could still be alive: with release_holders' kill removed the test stayed green. Ask the port's listener the way the script does, and wait for the socket the killed holder releases on exit rather than on kill. * test(ci): clean leaked holders up by pid, not by their records The afterEach cleanup read the holder records back, so a regression that makes release_holders drop a record without killing the process left the Node holder running and its port bound after a red run. Track the pids the chooser started and kill those, mirroring how this file already cleans up a leaked stand-in. --------- Co-authored-by: Qwen-Coder <[email protected]> |
||
|
|
b05be4cd23 |
fix(ci): hold the MariaDB lane's sdk-java lock once per job (#14896) (#14903)
* fix(ci): hold the MariaDB lane's sdk-java lock once per job (#14896) Co-authored-by: Qwen-Coder <[email protected]> * test(ci): pin the merged MariaDB step's order and SpotBugs witness The single-step merge dropped guarantees that the two-step layout got for free from step boundaries, and one witness became satisfiable by prose: - spotbugs-gate matched `verify` anywhere in the step body, and the merged step's own comments explain the incident with the word 'verify' twice. A later narrowing to `clean test` would stay green. Match `clean verify` on command lines only. - seed-before-write-back was a step-order invariant; both strings now live in one body with presence assertions only, and the write-back's warning arm swallows the ordering failure. Pin seed < install < verify < write-back. - `working-directory:` applied to the whole step and could not be misplaced; its `cd` replacement is positional inside the body. Pin it between the two Maven runs. - Drop the finder arm that matched the deleted `working-directory:` property: no step in either inspected job carries it any more. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: 易良 <[email protected]> Co-authored-by: Shaojin Wen <[email protected]> |
||
|
Shaojin Wen
|
6ca2c0bd52 |
test(managed-agent): settle a claim retired at intent (FG11d) (#14915)
* test(managed-agent): settle a claim retired at intent (FG11d) * test(managed-agent): carry the fire answer across threads, name the admission cell * ci(managed-agent): budget the retire-at-intent cell in the hosted fork |
||
|
Shaojin Wenand易良
|
c8971faac9 |
test(managed-agent): gate a late conclusive reply after outcome_unknown (#14892)
* test(managed-agent): gate a late conclusive reply after outcome_unknown * docs(managed-agent): drop the stale late-reply gap sentence * docs(managed-agent): align the FG12f budget note with the 50 s ledger entry * test(managed-agent): budget the fourth case at +10 s on main * docs(managed-agent): align the Chinese decision order with the English one * test(managed-agent): carry the class entry from 40 s to 50 s The class re-measures at 24.16 s, so its 2x entry is 50 s, not 40 s. Main carries it at 30 s, so the delta is +20 rather than the +10 the earlier draft assumed: healthy 9485, fork 10085, Verify 179, ledger 269, job 282. The three ledger chains now name this PR's entry, so each comment still computes the literal below it, and the class Javadoc lists the fourth cell. * docs(managed-agent): restate the FG12f entry as 30 s to 50 s * ci: name the FG12f +20 s in the hosted job ceiling comment --------- Co-authored-by: 易良 <[email protected]> |
||
|
Shaojin Wenand易良
|
ef155d8398 |
test(managed-agent): gate the per-run cancel on a parked wake turn (FG11d) (#14900)
* test(managed-agent): gate the per-run cancel on a parked wake turn (FG11d) The cell was recorded as blocked for want of a hold point; the parked model is that hold point. With the wake turn kept parked, the public task cancel settles the task and the run cancelled in under a second and the schedule stays live. Releasing the model immediately after the 202 instead lets the turn finish first and the run settles completed, which is why the cell asserts before the release. The case covers the public task id from the tasks projection, one run record, one cancelled settlement, and a schedule that survives its run's cancel. Measured at 7.4 s through the packaged stack, so the fork budget follows the 2x convention: healthy 9480 s, fork 10080 s. * docs(managed-agent): extend the pom ledger for the cancel cell The js ledger gained the cell's 15 s but the pom ledger still ended at 9465 s and 10065 s, contradicting the literal beneath it. The audit trail now records the same step the pin test carries. * docs(managed-agent): align the cancel limits text with #14882 Both PRs rewrite the same Limits bullet, so different wording would conflict on whichever lands second. This takes #14882's sentence verbatim and makes the delivered note a list item in English as it already is in Chinese. * test(managed-agent): pin the cancelled task and its occurrence The cell asserted the run's state and the schedule, while the matrix also wants the task and the occurrence to settle. It now pins the projected task's kind (automation_run) so a later task cannot silently take the cancel, the task's cancelled state, and the manual occurrence firing exactly once. The Verify step sat at exactly fork + 600 s after the new cell, so its "plus margin" comment was no longer true; it moves to 179 minutes and the job to 282. * ci(managed-agent): record the sdk-java workflow's new size The workflow grew to 108273 bytes on main without bumping its baseline, so any PR that touches the file - this one bumps the hosted gate's Verify timeout - inherits a 4231-byte drift past the 4096-byte allowance. --------- Co-authored-by: 易良 <[email protected]> |
||
|
qwen-code-dev-botandQwen Autofix
|
623cb40cf5 |
fix(ci): skip prepare's duplicate build in the daemon E2E install (#14861) (#14873)
The daemon E2E job's install ran prepare, which built and bundled the tree, then the job's next two steps built and bundled it again. The fast-tier lane failed inside that install-path prepare build. Set QWEN_SKIP_PREPARE so the install stays an install, matching the e2e build job. Co-authored-by: Qwen Autofix <[email protected]> |
||
|
|
8749bc465c |
fix(ci): skip Managed Agent reviews after the PR closes (#14774) (#14777)
* fix(ci): skip Managed Agent reviews after the PR closes (#14774) Co-authored-by: Qwen-Coder <[email protected]> * test(ci): pin closed-PR gate wiring and diagnostics (#14774) * refactor(ci): skip closed-PR reviews at the gate job level (#14774) #14857 landed the job-level review guard, so a closed-PR approval can skip before any job starts instead of selecting `none` from inside the tier step. Move the closed check into the `scope` and `gate` conditions, drop the `PR_STATE` env wiring and the tier-script branch, and restore the report text that described it — no job now reports a reason. Tests pin both jobs skipping for a closed-PR approval and keep open-PR approvals running. Resolves #14774 * docs(gate): describe an all-skipped review run precisely This branch already rewrites the lines that describe a skipped review run, so the correction belongs here rather than in a second PR touching the same paragraph. The skipped run still lists one check per job, and the reporting job's name is shown as its unevaluated expression, so "nothing reported" is wrong on both counts: three skipped checks appear, none of them named `Managed Agent gate`. Verified on run 39392964690, a `pull_request_review` event on the #14857 head. The `scope.if` comment carried the same overclaim ("it never reported the required name anyway"): on an untouched PR the review run did report `Managed Agent gate`, and only the same head's pull_request run makes that check redundant. --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: 易良 <[email protected]> |
||
|
Shaojin Wen
|
f1f8a94a40 |
test(managed-agent): reject Hook result and plan-result commits (FG13b) (#14848)
* test(managed-agent): reject Hook result and plan-result commits (FG13b) Adds the two remaining store-rejection cells that reuse the existing seam. The result cell refuses the settled commit after the worker already ran the Hook, then reads the status route to prove the receipt still settles the record without a second physical call. The plan-result cell refuses only the plan marker's own commit, proving the marker is rebuilt from the saved child receipts. The registration-settle cell is not here: it writes a hook-catalog record and the seam has no catalog phase, so it belongs with the FG13a store-ack slice rather than growing a second seam. Both cells add 150 seconds to the shared fork: healthy 9111, fork 9711, Verify 172, ledger 262/275. * test(managed-agent): scope the plan fault to PreToolUse and wait for it to fail Arming HOOK_PLAN_SETTLED matched the empty SessionStart and UserPromptSubmit plans, which commit a settled marker with no hooks at all: the wait fired before any physical call and the marker lookup could pick the wrong plan. The phase now also requires eventName == PreToolUse, and the cell filters its marker the same way; StoreFaultGateTest pins both sides. Both new cells also cleared the gate as soon as one commit attempt was rejected, but the store retries the same commit. They now keep the fault armed until the turn reaches failed and the record is still unsettled, so the status read has to recover instead of observing the original attempt land. * test(managed-agent): read the Harness attachment after the fault fires submit() returns 202 once the dispatch is queued, not once the connector has attached the Harness session, so a cold or slow scheduler can leave the lookup null before the fault is even armed. Both cells now wait for attempts >= 1, which proves the dispatch ran, and only then resolve the attachment before the recovery-blocked probe. |
||
|
|
848111433b |
fix(ci): retry transient pnpm installs in the SDK Java workflow (#14845) (#14851)
* fix(ci): retry transient pnpm installs in the SDK Java workflow (#14845) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): correct the retry's failure class and exercise the loop The install step's prepare re-enters the workspace build, so an absorbed failure here can be a build failure; the warning no longer routes it at the #11726 network-transient counter, and the recorded cost counts each attempt's rebuild. The meta-test now runs the loop under a stubbed corepack to prove the retry, the absorbed warning and the exit status. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: yiliang114 <[email protected]> |
||
|
Shaojin Wen
|
fc84ced8a5 |
test(managed-agent): gate the FG11f refusing arms (FG11f) (#14821)
* wip(managed-agent): stage the FG11f publication arms on a public Shell wake turn Not ready to push: the warm-up turn is refused with workspace_unavailable before the fault arm runs. Stage 1 of the stacked chain. * test(managed-agent): gate the FG11f lost-ack publication fault (FG11f) A wake turn that publishes a Shell capture can lose the object store's acknowledgement after the bytes landed. Nothing in CI pins what happens next: the shared OSS stub accepts every write, and the only real-bucket fault gate is opt-in and outside CI. The case runs a public Shell session through the packaged stack, faults the physical put, and pins the properties the store actually guarantees: the committed capture is kept and every large object is this run's bytes, a refused write never stores anything, the operation settles from what the store recorded, the Shell runs once, and the run settles once. `fail-before-write` and `timeout` remain scoped in the design. The fixture now registers the storage guard whenever the guard itself is enabled. It previously registered only on Linux, so a Shell turn on macOS was refused before its fault arm could run. The fork budget follows the 2x convention: the cell measured 41.1 s, so the healthy sum becomes 8527 s, the fork 9127 s, the Verify step 163 minutes and the job 256. * test(managed-agent): gate the FG11f refusing arms (FG11f) The publication gate shipped only the lost-ack arm, and the case resolves which arm to run from a property, so CI exercised whichever one the default picked. The two refusing arms now have their own methods: a put that throws before the bytes land, and a put that stays silent past the operation timeout. Both assert that nothing was stored, that the operation stays unresolved, that the Shell runs once and that the run settles once. Measured locally through the packaged stack: 41.2 s and 80.0 s. The fork budget follows the 2x convention, so the healthy sum becomes 8769 s, the fork 9369 s, the Verify step 167 minutes and the job 260. * fix(managed-agent): drop the unused import and re-align the ceiling comment The FG11f case carried an import for a symbol it never used; with includeTestSourceDirectory on and UnusedImports at error severity, that is a checkstyle failure rather than a warning. The step-ceiling comment also still read 161 while the literal beneath it is 163. * refactor(managed-agent): take the FG11f arm as a parameter and re-align the comments The wrapper methods delegated through a mutable field, which made the case property stop narrowing a run: naming one arm also ran the other wrapper and the default-resolving method. The arm is now a helper parameter and each method gates on `selected()` the way fg11b and fg11c do, so an unset property runs every arm and naming one runs only that arm. Two comments still described the older budget: the step-ceiling line read 161 against a 167 literal, and the job-ceiling derivation stopped at the 9045 s fork without the FG12d, FG11f-arm or refusing-arm steps it now includes. * test(managed-agent): pin that the fault fired and the payload is the run's own Three probes showed the arm passing for the wrong reason: with the injection removed, with the retained bytes replaced by a same-sized placeholder, and with the operation never settling, the case stayed green and only an absent object reddened it. The arm now asserts that its injection fired, that every OBJECT_PUT settles RETURNED, and that the retained payload is exactly the Shell's 2 MiB of output. Two ceiling comments still described the pre-merge budget; both now carry the FG11f step and the values the literals hold. * test(managed-agent): count the physical puts each object takes A reconcile that regressed into writing the same key again would be invisible to the arm: putIfAbsent reports FileAlreadyExists, the real adapter swallows it and the object map still holds the first write, so the settlement assertions keep passing. The stub now counts putObject calls per key and the lost-ack arm asserts every key was written exactly once. * test(managed-agent): restore the FG11b retryable-status guard The merge that retargeted this branch to main resolved the FG11b helper from the branch side, silently reverting #14645: it accepted a 409 as final and named only one code on a 503. The helper and the comment above the case are main's again, so a public route that starts answering 409 fails at once and a coded 503 must name the writer conflict or the lost-answer code. |
||
|
易良
|
8b6c310c4c |
ci(gate): skip the Managed Agent gate run for reviews that are not approvals (#14857)
* ci(gate): skip the Managed Agent gate run for reviews that are not approvals `pull_request_review: [submitted]` fires for `commented` and `changes_requested` too, but only a maintainer's approval can select a tier above `none`. Every other review started a run that could only publish the informational check `Managed Agent review (no full run)`, costing two runner slots on two different runners. Five comments in nine seconds on PR #14656 produced five such runs on one unchanged head. Both jobs now skip for a non-approval review, which takes no runner, and the run completes in seconds. The required check name is unaffected: such a review never reported it, before or after. Resolves #14854 * test(gate): drop unreachable dispatch case and clarify skipped-run docs `workflow_dispatch` is not a trigger of `managed-agent-gate.yml`, so the new "ignores the review guard" case covered an event this workflow cannot receive. The three real triggers already assert the same property. The design doc said a non-approval review produces "no run", while the paragraph below and the concurrency rationale both depend on a run existing and merely starting no job. Say that directly, in both languages, so the per-review concurrency group does not read as dead code. |
||
|
Shaojin Wen
|
7a9e4feec1 |
test(managed-agent): gate the FG11f lost-ack publication fault (FG11f) (#14819)
* wip(managed-agent): stage the FG11f publication arms on a public Shell wake turn Not ready to push: the warm-up turn is refused with workspace_unavailable before the fault arm runs. Stage 1 of the stacked chain. * test(managed-agent): gate the FG11f lost-ack publication fault (FG11f) A wake turn that publishes a Shell capture can lose the object store's acknowledgement after the bytes landed. Nothing in CI pins what happens next: the shared OSS stub accepts every write, and the only real-bucket fault gate is opt-in and outside CI. The case runs a public Shell session through the packaged stack, faults the physical put, and pins the properties the store actually guarantees: the committed capture is kept and every large object is this run's bytes, a refused write never stores anything, the operation settles from what the store recorded, the Shell runs once, and the run settles once. `fail-before-write` and `timeout` remain scoped in the design. The fixture now registers the storage guard whenever the guard itself is enabled. It previously registered only on Linux, so a Shell turn on macOS was refused before its fault arm could run. The fork budget follows the 2x convention: the cell measured 41.1 s, so the healthy sum becomes 8527 s, the fork 9127 s, the Verify step 163 minutes and the job 256. * fix(managed-agent): drop the unused import and re-align the ceiling comment The FG11f case carried an import for a symbol it never used; with includeTestSourceDirectory on and UnusedImports at error severity, that is a checkstyle failure rather than a warning. The step-ceiling comment also still read 161 while the literal beneath it is 163. * test(managed-agent): pin that the fault fired and the payload is the run's own Three probes showed the arm passing for the wrong reason: with the injection removed, with the retained bytes replaced by a same-sized placeholder, and with the operation never settling, the case stayed green and only an absent object reddened it. The arm now asserts that its injection fired, that every OBJECT_PUT settles RETURNED, and that the retained payload is exactly the Shell's 2 MiB of output. Two ceiling comments still described the pre-merge budget; both now carry the FG11f step and the values the literals hold. |
||
|
Shaojin Wen
|
e0d97c5569 |
test(managed-agent): reject Hook store commits (FG13b) (#14817)
* test(managed-agent): teach the store fault gate the Hook phases * test(managed-agent): reject a Hook intent commit in the store transaction * test(managed-agent): reject a Hook dispatch commit in the store transaction * test(managed-agent): teach the model stub the new FG13 prompts * ci(workflows): raise the sdk-java ledger baseline for the FG13b entries * test(managed-agent): tighten the FG13b cells and document the gate * test(managed-agent): describe the store fault gate for both record families * test(managed-agent): skip the plan marker in the Hook failure phases * test(managed-agent): pin which Hook commit the store gate refuses The two FG13b cells only waited for the gate to fire, so swapping the intent and dispatch_started branches kept both green. The intent cell now asserts that the rolled-back commit left no hook_execution record, and the dispatch cell asserts a single record still parked at intent. The design doc's mutation witnesses now describe the red each mutation was measured to produce: the phase and domain mutations time out on attempts, and letting every commit through stays green inside the shipped window and only reddens once the window is widened. |
||
|
|
5ec7d84ce6 |
fix(ci): skip failure reports for superseded run attempts (#14768) (#14771)
* fix(ci): skip failure reports for superseded run attempts (#14768) Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): scope failure reads to the event attempt (#14768) * fix(ci): fail open when the event has no run attempt (#14768) --------- Co-authored-by: qwen-code-dev-bot <[email protected]> Co-authored-by: Qwen-Coder <[email protected]> |
||
|
Shaojin Wen
|
d2e12e404f |
test(managed-agent): crash the approval result-commit barrier (#14733)
* test(managed-agent): crash the approval result-commit barrier A5's last packaged barrier: after the approved tool result commits, hold the post-tool model round and crash the Harness. The next generation must reissue the saved request (deep-equal), retract the published prefix, and finish with one execution, one file effect and one terminal. Part of #14481. * test(managed-agent): gate the result crash on the published prefix Review findings: wait for the public feed to carry the held prefix before SIGKILL and record it in the crash evidence, so the transcript assertion cannot pass on a no-op retraction. Also decouple the source pins from prettier whitespace and the comparison operator. * test(managed-agent): pin the after-result model count Review follow-up: keep the two-request expectation tied to the after-result arm via expectedModelsAfterResults, without reintroducing the indentation coupling that the previous split removed. * test(managed-agent): strengthen the result-commit assertions Review findings: name the two pre-dispatch barriers and pin after-result's exclusion from the held start, assert the stream.reconciled ordering beside the reload text, retain both request bodies in model-request-parity.json, and pin the retraction throw. * ci: record the sdk-java workflow growth The five approval fault arms add steps and comments to sdk-java.yml: 104042 bytes, 4100 over the previous 99942 baseline. Update the ratchet in the same PR, as check-workflow-size.sh prescribes for real growth. |
||
|
jinye
|
ca06036e54 | fix(managed-agent): Preserve original owners for owed Hosted cleanup (#14764) |