01d97f571a
* test(managed-agent): expect the canonical V2 baseline * fix(core): retain CSI preparation resources through the HTTP store * fix(ci): lint Java acceptance scripts with Node globals Co-authored-by: Qwen-Coder <[email protected]> * fix(ci): narrow Node globals to managed-agent fixtures Co-authored-by: Qwen-Coder <[email protected]> * test: witness the file-history refusal path and label acceptance cleanup Address review round 1 findings R1-3, R1-4, R1-10 and R1-12. The managed-file_history branch of collectNestedResourceRefs refuses a malformed record instead of collapsing its closure to an empty set, but nothing pinned that: wrapping the branch in a catch that returns [] survived the whole suite. Two assertions at the collector seam now kill that mutant, verified by applying it and confirming the new test reds. The prepared-record case modelled previousRecordRef and intentRef as two distinct resources, a shape production never emits: SQL admission requires both to equal the predecessor's file-history ref and reads that ref from this transaction. Share one ref so the fixture models a real record, and retitle the test and the collector comment to what the walk actually does. In the acceptance gate, release the adapter, executor and HTTP client unconditionally and assert the three waits afterwards, so a slow child can no longer leak them for the rest of the surefire fork, and name each wait in its assertion message. Pass the case label to post() in the worker refusal loop, matching its SQL-readback twin, so a stopped refusal names which of the five cases changed instead of naming the route twice. * test(managed-agent): translate proc-fd addresses on every platform The acceptance harness short-circuited its /proc/self/fd translation when the host really was Linux, so the file backend's native proc-fd arm ran there for the first time while the macOS arm stayed on the translated path. That short-circuit is the only platform-varying input in the bind path, and bind is where the harness dies. The 409 it dies with does not locate the fault. The worker answers every throw from the history handler with managed_csi_history_unavailable and discards the error object, and the broker recognises only managed_context_unavailable and managed_context_conflict, so anything else becomes a 409 managed_runtime_identity_conflict - a code that names a comparison the request never reaches. The identity, context and installedContext fields are pure functions of one SQL-stored handle and never carry mount, pod or proc-fd state. Translate unconditionally instead, matching managed-csi-mount.test.ts, which forces platform linux through a Proxy and translates every owned descriptor with no host-platform short-circuit. The fixture fakes the mount, so the descriptors that matter are the ones it tracks whether or not the host exposes /proc/self/fd. Update both design docs, which claimed Linux uses actual proc-fd addressing. Not verified on Linux from this checkout. The decisive check is one run of WorkspaceCsiSqlWorkerMySqlIT on ubuntu-latest; if it still 409s, proc-fd addressing is exonerated and the remaining candidates are the openDirectory device/inode comparison and the readdir emptiness gate in the bind branch. --------- Co-authored-by: Qwen-Coder <[email protected]> Co-authored-by: Shaojin Wen <[email protected]>
4.3 KiB
CSI SQL-to-worker acceptance
Problem and current state
The private READY original-owner CSI contract has SQL admission, authenticated native readback, finite file tools and retained history. Existing component tests use captured native prefixes or worker replies. They do not establish that a grant minted by SQL from live native records reaches the authenticated worker and continues through retained history on the same original activation.
Proposed test
Add an explicitly invoked MySQL integration test and a Node producer/worker
fixture. Create a fresh canonical V1/V2 catalog and an original private Session
through the production create and reservation APIs. Run the actual Core managed
authority and HTTP store adapter against the production JDBC store. Use the
actual Broker service, HTTP server and WorkspaceCsiRuntimeAccess.readNative.
The worker uses production authentication, native fetch, composer, file tools
and retained-history implementation. SQL grants must originate from dispatch;
the fixture must never insert native_authorization_json or manufacture a
positive native journal marker.
Run sequential write, edit and read batches under one writer and activation. Commit observed history and tool receipts through the authority, consume the runtime results, and continue to the next input. Check the original preimage, later retained backups and final working bytes. Exact allocation/start retries must preserve grant and effects. Wrong credentials, owner/context or an ungranted execution must refuse before file effects.
Fixture boundaries
The database, listeners, worker process and working directory are owned by the
test and are removed in finally. Placement/protection descriptors are an
explicit fixture, not Kubernetes observations. A test-only HTTP destination
mapping routes the fixed fixture Pod endpoint to the owned loopback worker;
headers, body, lease and incarnation remain unchanged. On every platform a
labelled mount/proc-fd mapping delegates to genuine inodes and file handles,
so the file backend does not depend on the host exposing /proc/self/fd,
while mount provenance remains a fixture. No worker result, native readback,
SQL authorization, file tool or history composer is stubbed. This qualifies
the SQL/HTTP/file chain under these boundaries, not a native CSI mount or
Kubernetes deployment.
Files and scope
Live reproduction found that the HTTP adapter omitted the private file-history
preparation's nested input, declaration and intent references. Collect those
references for schemaVersion 2 / csi-files-retirement/1; omit the predecessor
metadata reference, whose original journal transaction already owns it. This
keeps SQL's exact same-transaction candidate check intact. The collector's
commit, resource-read and read-only snapshot consumers share this rule; ordinary
file-history snapshots retain their existing behavior.
The change is limited to this Core collector and regression test, a
managed-agent-server MySQL test, its test resources and these bilingual design
files. The existing mysql-integration profile discovers the new IT. Published
V1/V2 and the 32 business tables remain unchanged. There is
no public selector, Hosted private execution, replacement writer, cold
recovery, DRAINING continuation, terminal/finalization, retirement, release,
reuse or deployment feature. A discovered production correctness defect must
be reproduced and fixed separately within the original READY owner boundary.
Validation and acceptance
Use an isolated MySQL database, built Node modules and freshly compiled Java classes. Record source, dependency, commit and cleanup bindings. The global CLI has no operator entry for this internal fixture; use an explicit test-script fallback. Verify the positive SQL grant/readback/worker/continuation chain and negative cases, then run build, typecheck, bundle, affected tests and Java static checks. Read the complete diff in two clean audit passes and obtain an independent review. Evidence must distinguish H2, actual MySQL, macOS platform mapping and Linux CI. Maintainer architecture review remains required.
Open questions
None about scope. Native Linux CSI and deployment qualification remain future work and must not be inferred from this integration fixture.