mirror of
https://github.com/QwenLM/qwen-code.git
synced 2026-11-07 06:19:43 -10:00
Shaojin Wen
0c1b42fa31
* test(managed-agent): gate the B3a finished-before-commit crash window Package the recovery-matrix B3a row: crash the replacement Harness after its post-tool main stream records the durable Finished marker but before the assistant output commits. A test-gated hook (QWEN_E2E_CRASH_BEFORE_ASSISTANT_COMMIT, set only on the crashing generation, never in production) holds the turn in that window; the runner asserts the barrier landed, kills the generation, and requires the next one to reissue the saved request deep-equal and project one terminal with the recovered answer rather than compensate an already-committed output. Adds the failover arm, CI step and ceiling (25 arms), contract pins, the serve env-guard allowance, and bilingual design/README updates. * test(managed-agent): harden the B3a arm barrier, hold and contract pins Address review R1-1..R1-4: assert the durable crash precondition (the approved execution SETTLED) from MySQL before the SIGKILL like the sibling crash arms, instead of trusting the hook log alone; wire the test-gated hold to the Turn abort signal so a leaked flag cannot park a real Session uncancellably; pin the crashing/recovery generation call sites and the parameter default rather than bare identifiers; and pin the combined deep-equal parity gate so reverting it to after-result-only reds the fast-tier contract suite. * test(managed-agent): assert the B3a crash window from the durable journal The finished-before-commit barrier proved only that the approved execution settled (executionAtCrash=SETTLED) and that the hook printed its log line. It did not read the post-tool main model attempt's durable Finished marker, so a hold moved above the model layer's usage-only output_committed commit could crash with no durable Finished marker and still pass every downstream check (the recovery reader also accepts a saved request whose attempt is started). Before the SIGKILL, read the same journal the recovery reads (ma_session_journal_tx) and assert findHostedCommittedModelOutput's own discriminator: the latest <promptId>:main: model.attempt is output_committed and no assistant message.committed follows it. Retain the attempt identity and sequence in approval-crash-barrier.json. Add a window-shaped fast-tier contract pin for the new assertion, keeping the existing pins. Verified on real MySQL/Spring/Broker: head green (attempt retained, parity equal); moving the hold above output_committed reds at the new pre-crash assertion; removing the hook still reds at the barrier timeout; moving the hook after the assistant commit now reds at the new post-commit assertion. * test(cli): cover the finished-before-commit hold's abort release The QWEN_E2E_CRASH_BEFORE_ASSISTANT_COMMIT hold's abort wiring had no test that reds without it: the env-guard only counts AST reads, the meta-tests grep source text, and the packaged arm SIGKILLs the pending generation, so no lane exercised the release path. Arm the module-scope switch via a vi.hoisted env stub set before the static import under a dedicated Session id, then drive a real turn into the hold and assert the abort settles it cancelled with no assistant message.committed; a non-matching-id case pins that the hold never fires. Removing the release/addEventListener wiring makes the matching case time out. Test-only; the single env read and the hold's park-until-killed behaviour are unchanged. * test(managed-agent): pin the B3a hold id-guard and window arming R4-1: run the non-matching finished-before-commit hold case before the abort case so the module-scope one-way latch is still unset, letting the session-id comparison (not a spent latch) suppress the hold. Deleting the id conjunct now reds the non-matching case. R4-2: pin the finishedBeforeCommitWindow arming ternary condition, so narrowing its guard can no longer silently delete the arm's only durable-window check while the scripts suite stays green. * test(managed-agent): exercise the B3a window helper on injected journal rows Address the round-5 deferred suggestion: finishedBeforeCommitWindow had only source-spelling pins. Add a behavioural test that injects runMysql through the existing load() machinery and asserts the latest-attempt selection and both throw branches on journal rows (the output_committed window holds; a started or newer-started latest attempt reds before the Finished marker; a following assistant commit reds after it; role/prompt/sequence filters hold). Witness: mutating the latest-attempt index to mainAttempts[0] — a change the source pins survive — reds the behavioural test.