feat: enforce caller-scoped application service leases

[seonghobae]

Application-service lease ownership

This Draft owns caller-scoped lease ownership/idempotency in the Supporting application_service bounded context. Current exact head is 785c2cc84861d3bce5fb78a7183cf3102b743bf5; live parent is now feat/runtime-foundation-tdd@a85dc86c00f00354d9ddb9bf7c291c2c1cd40884.

Single-writer repair

Review 5230212241 found that #6 carried a leaf-owned repository-wide Gap delta. 29d491369efcc4da104784147d92ff7d4d74c8e9 migrated #6-specific causal history into owner-local TRACEABILITY and ecdd84836d1d04660f620156f2190d8eb5664837 restored the then-exact parent Gap blob. Repository-wide live Gap authority remains #121.

Completed live-root adoption

Review 5230412333 found that root had advanced 33 commits and that a wholesale parent- or child-tree preference would silently discard valid deltas. The independent overlaps were .github/workflows/ci.yml, src/application_service/mod.rs, and tests/runtime_boundary_regressions.rs.

a08a786e7744f6697d93da6f41a1a04796cad10e first adopted root CI blob d172e830706afc290696c818730e1cf570df2be6, including persist-credentials: false. Ordinary two-parent 64283e08d99b353430bc1ce97f20019d89f8fbd0 then used the exact live-root tree as the merge foundation so all root-only coverage/runtime changes survive while #6-owned coordinator/backend/package/test deltas remain.

The semantic overlaps were merged explicitly: src/application_service/mod.rs@74270f29a1fe60b6e3a739514a5f17ab685bb3b4 keeps the coordinator module/export plus root repository-name coverage simplification; tests/runtime_boundary_regressions.rs@78b11bf8aebcd08dda86b9137963e16e2fc2e0e8 keeps isolated tempfile fixtures while using the root-safe 64-lowerhex fake container identity. 63062201... made that completed root adoption code-current in owner-local TRACEABILITY.

CI warning owner-path repair — issue #131

Artifact-analysis predecessor CI later exposed a real rustup warning in the stable production-coverage install: the workflow installed Rust 1.97.1 but invoked bare cargo install cargo-llvm-cov --locked --version 0.8.6, causing rustup to report an implicit toolchain override. The branch-coverage lane already selected its nightly toolchain explicitly.

An initial ordinary child commit e58bedc9ad97faa67f66c5e9b59648fde15c32a7 changed only the stable install to cargo +1.97.1 install cargo-llvm-cov --locked --version 0.8.6. Fresh owner review then corrected the ownership path rather than leaving a #6-only CI fork: canonical root #1 applied the byte-identical change at a85dc86c00f00354d9ddb9bf7c291c2c1cd40884, and ordinary two-parent 785c2cc84861d3bce5fb78a7183cf3102b743bf5 adopts that root exact while preserving the already-equivalent #6 tree. No force update, tool/version change, warning suppression, coverage-policy weakening, or child-delta deletion occurred.

A search of ContextualWisdomLab/.github found reusable coverage infrastructure, but no released reusable Rust application-coverage workflow matching this repository's cargo-llvm-cov line/branch evidence contract. The existing exact-head coverage reusable workflow is for Python/script coverage, while central OpenCode Rust coverage uses a separately checksum-pinned archive rather than this repository CI contract. The current repair therefore remains on the repository integration-root owner path instead of copying an unrelated central workflow.

Issue #131 stays open until exact current-head coverage execution proves the pinned install warning-free. No predecessor check result transfers after either root or child movement.

Executed historical evidence

Native CI 33962779845 executed historical exact 8daab565bba1b61e605488c080eb28de371990a3. Verify 101297469596 passed full test/lint/doc and hosted negative rootless/AppArmor 101297469544 passed. Coverage remained a real admission failure: 101297469496 failed during generation and branch coverage 101297469509 reported lines 2356/2442 (96.48%), functions 218/228 (95.61%), regions 3085/3211 (96.08%), branches 429/492 (87.20%). Those results are historical evidence only.

Domain and next gate

LeaseOwnerId is authenticated command context supplied by a transport boundary. ApplicationServiceCoordinator owns caller-scoped idempotency, active-lease ownership, bounded expiry cleanup, cleanup fairness and backend-neutral lifecycle coordination. Backend invocation identity (#20/#40), durable restart/orphan reclamation, consumer authentication and Core sandbox-isolation semantics remain separate owner responsibilities.

Keep Draft. Exact 785c2cc... must independently reacquire repository/fmt/full tests/Clippy/rustdoc, 100% owned-production coverage, security/review and applicable runtime evidence. Descendant #9 now trails this moved parent and must reconcile its overlapping effective-isolation application_service/mod.rs, Podman and runtime-boundary deltas by ordinary non-force adoption before #9/#10/#13/#14/#112 can be considered current.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Stack reconciliation evidence: current head 049194a6dff177aadfef80e7f4691d006f21aa8f now descends from parent PR #1 exact head e4222208f0d1a6d28f570c45dc7385fd75b16a4b and preserves the current application-service lease schema 1.1.0 plus canonical full isolation-policy SHA-256 while adding caller-scoped LeaseOwnerId/idempotency coordination. The real rootless Podman podman-e2e job on this exact head completed successfully. verify, statement coverage, and branch coverage are still queued and there is no qualifying approval, so this is not merge-ready evidence; predecessor checks/reviews do not transfer.

[seonghobae]

Consumer owner-path dependency remains fail-closed: contextual-orchestrator must not consume this stacked branch by sibling checkout/path. Integrate only after the application-service contract is protected and published by immutable artifact/full digest with provenance. The current lease contract carries policy identity/digest and caller-scoped ownership; the consumer ACL must verify both rather than accepting only a loopback URL.

[seonghobae]

No source changes should be made just to retrigger the queued verify/coverage jobs. This lane is waiting on current-head evidence; continue independent owner-path and Context Fabric dependency work instead.

[seonghobae]

The parent policy panic-shortcut repair has also been merged non-destructively into this stacked branch. Current head is 0d6a3f1756d91f7ac334954aad7a12ed832e03fe over parent c78fd491f84fae773b3691b10b6a0c21940808d5. Exact-head podman-e2e is running; verify/coverage/branch-coverage are queued. No predecessor evidence transfers.

[seonghobae]

@coderabbitai review

Please review exact child 8daab565bba1b61e605488c080eb28de371990a3 against its executed native evidence 33962779845, with emphasis on child-owned application-service coordinator semantics and coverage gaps. verify=101297469596 and hosted negative LSM passed, while branch coverage produced lines 2356/2442, functions 218/228, regions 3085/3211, branches 429/492. Distinguish genuine production paths in src/application_service/coordinator.rs from #[cfg(test)] helper paths that happen to share a src file; do not recommend coverage exclusions or bypasses. Root/infrastructure gaps remain prerequisite-owner work because current root has moved to 9bae89ca..., so #6 must be non-force restacked after root GREEN before any child completion claim.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

target="8daab565bba1b61e605488c080eb28de371990a3"
repo="ContextualWisdomLab/quarantine-sandbox-runtime"

echo '== Exact target commit =='
git cat-file -e "${target}^{commit}"
git show -s --format='commit=%H%nparents=%P%nsubject=%s' "$target"
echo
echo '== Delta summary against first parent =='
git diff-tree --no-commit-id --name-status -r "$target"
echo
echo '== Coordinator structure at target =='
git show "${target}:src/application_service/coordinator.rs" > /tmp/coordinator.rs
ast-grep outline /tmp/coordinator.rs --items all --view expanded
echo
echo '== Coordinator cfg(test) boundaries and coverage-related markers =='
rg -n -C 4 '#\[cfg\(test\)\]|coverage|fn |impl |match |if ' /tmp/coordinator.rs
echo
echo '== Coordinator tests and direct call sites at target =='
git grep -n -E 'ApplicationServiceCoordinator|LeaseOwnerId|acquire_lease|release_lease' "$target" -- '*.rs' || true
echo
echo '== Workflow run evidence =='
for run in 33962779845 101297469596 101297469544 101297469496 101297469509; do
  echo "-- run ${run} --"
  gh run view "$run" --repo "$repo" --json databaseId,headSha,conclusion,status,name,event,url,workflowName \
    --jq '{databaseId, headSha, conclusion, status, name, event, url, workflowName}' || true
done

Length of output: 29905

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

target="8daab565bba1b61e605488c080eb28de371990a3"
repo="ContextualWisdomLab/quarantine-sandbox-runtime"

echo '== Merge-parent deltas =='
for parent in $(git show -s --format=%P "$target"); do
  echo "-- target versus parent ${parent} --"
  git diff --stat "$parent" "$target"
  git diff --name-status "$parent" "$target"
done

git show "${target}:src/application_service/coordinator.rs" > /tmp/coordinator.rs
echo
echo '== Coordinator production methods (Lines 214-508) =='
sed -n '214,508p' /tmp/coordinator.rs
echo
echo '== Coordinator embedded tests (Lines 510-760) =='
sed -n '510,760p' /tmp/coordinator.rs

echo
echo '== Ownership and cleanup integration tests at target =='
for path in tests/application_service_ownership.rs tests/application_service_cleanup_fairness.rs tests/application_service_policy_idempotency.rs; do
  echo "-- ${path} --"
  git show "${target}:${path}"
done

echo
echo '== GitHub Actions CI job conclusions =='
gh run view 33962779845 --repo "$repo" --json jobs \
  --jq '.jobs[] | {databaseId,name,conclusion,status,startedAt,completedAt,url}' || true

echo
echo '== Supplied IDs as possible Actions job records =='
for job in 101297469596 101297469544 101297469496 101297469509; do
  echo "-- job ${job} --"
  gh api "repos/${repo}/actions/jobs/${job}" \
    --jq '{id,name,status,conclusion,head_sha,started_at,completed_at,html_url,steps:[.steps[]|{name,conclusion}]}' || true
done

Length of output: 54537

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

target="8daab565bba1b61e605488c080eb28de371990a3"
repo="ContextualWisdomLab/quarantine-sandbox-runtime"

echo '== Failed coverage job logs: coordinator and enforcement diagnostics =='
for job in 101297469496 101297469509; do
  echo "-- job ${job} --"
  gh run view 33962779845 --repo "$repo" --job "$job" --log-failed 2>&1 \
    | rg -n -i -C 5 'coordinator|missing|uncovered|coverage|error|failed|src/' || true
done

echo
echo '== Request, policy, and lease declarations and validation at target =='
git grep -n -E '^(pub )?(struct|enum) (ApplicationServiceRequest|ApplicationServiceLease|IsolationPolicy|ResourceRequest)|^(    )?pub fn validate|fn validate|effective_policy_sha256' "$target" -- 'src/*.rs' 'src/**/*.rs' || true

echo
echo '== Narrow source definitions =='
for path in src/application_service/contracts.rs src/sandbox_execution.rs src/isolation_policy.rs; do
  if git cat-file -e "${target}:${path}" 2>/dev/null; then
    echo "-- ${path} --"
    git show "${target}:${path}" | sed -n '1,520p'
  fi
done

echo
echo '== All coordinator test names and test assertions =='
git grep -n -E '^\s*#\[test\]|^\s*fn [A-Za-z0-9_]+\(' "$target" -- \
  'src/application_service/coordinator.rs' 'tests/application_service_*.rs'

Length of output: 199265

---

@seonghobae Reviewed exact child 8daab565bba1b61e605488c080eb28de371990a3 against CI run 33962779845.

I found no additional coordinator correctness defect in the static review. The coordinator uses (LeaseOwnerId, request_id) as the registry key. It rejects cross-owner termination before backend cleanup. It preserves idempotency conflicts when the request or effective policy changes. It retries failed expired cleanup fairly.

The exact-head evidence is not GREEN:

• verify job 101297469596 passed.
• podman-e2e-negative-rootless-apparmor job 101297469544 passed.
• coverage job 101297469496 failed before coverage generation completed.
• branch-coverage job 101297469509 completed generation, then failed complete-coverage enforcement.

The failed coverage job is also a real blocker. failed_launch_releases_idempotency_reservation_for_retry failed in tests/application_service_ownership.rs. The retry still returned BackendInvocationFailed { operation: "rootless_probe" } after the fixture changed from failure mode to success mode. This test path needs deterministic repair and a fresh exact-head run.

The branch-coverage report identifies these genuine production paths in src/application_service/coordinator.rs:

• Lines 238-241: an identical launch while the lease is Terminating.
• Line 310: termination with a receipt that differs from the active lease.
• Lines 326 and 329: termination while launch or termination is already in progress.
• Line 419: cleanup failure takes precedence when recording the failure also cannot access the registry.

These paths need direct tests after the root is adopted. They must not be excluded from coverage.

The other reported coordinator gaps are inside the #[cfg(test)] module at Lines 654-732. The branch command used --lib --tests, so LLVM included embedded test helpers in src/application_service/coordinator.rs. These gaps are distinct from production coverage. Keep any structural test-measurement cleanup separate from the production-path tests. Do not use exclusions or #[coverage(off)].

The remaining src/infrastructure/podman.rs coverage gaps remain root prerequisite-owner work. This evidence applies only to 8daab565.... After root exact-head GREEN, restack #6 without force or destructive rebase, then rerun verify, coverage, branch coverage, and LSM evidence on the new child head.

You are interacting with an AI system.

[seonghobae]

Root Draft #1 authority has advanced to 8e51c28eea6f31a19f13811e926574f5d44ae757; the 9bae89ca... root SHA in this PR body is historical, not current authority. Keep #6 Draft and preserve its caller-scoped lease/coordinator delta. Do not restack while root issue #83's exact coverage/process gate is still unresolved; after one root exact candidate stabilizes, adopt it by ordinary non-force integration, then reacquire #6's own coverage/runtime/security evidence before #9 or later descendants advance.

[seonghobae]

Single-writer repair finding: this application-service lease/idempotency branch still carries a repository-wide docs/product-technical-gap-baseline.md delta against exact base 0f765af1a4eea83029febee3b24c55cd7e7ce4e1, while live Gap authority is #121. The delta also contains valid #6/root-causal history, so repair must be migration-first: preserve #6-specific ownership/idempotency, coverage and inherited root-trigger context in owner-local doctoring, then restore only the global Gap file to the exact base blob. Do not force-rebase, copy the current #121 ledger into this leaf, or discard lease-owner/coordinator evidence.

[seonghobae]

Current-head review: the remaining blocker is not just stale ancestry; a blind two-parent merge or tree preference would silently drop valid deltas. Live root feat/runtime-foundation-tdd@5c6a44bb2b35eb17d0315d72db242f4488c3c426 is 33 commits ahead of this PR's recorded base 0f765af1a4eea83029febee3b24c55cd7e7ce4e1. Three paths overlap and require explicit adoption/adaptation: .github/workflows/ci.yml, src/application_service/mod.rs, and tests/runtime_boundary_regressions.rs. Root CI adds persist-credentials: false to every checkout and must win over the child fixture-only CI delta. Root application_service/mod.rs removes parser-dominated repository-name branches required by the exact 100% coverage contract, while this child adds the coordinator module/export at the top; both deltas must survive. Root runtime-boundary fixtures also bind fake container identity to the current safe-identifier grammar, while the child independently moved fixtures into tempfile; neither intent should be lost. Repair this as an ordinary non-force two-parent adoption with an explicitly merged tree, then reacquire exact-head CI; do not use child-tree or root-tree preference as an 'evil merge', and do not transfer predecessor GREEN.

[seonghobae]

Fresh native CI evidence exposed a warning in the root workflow now adopted by #6. On #57 predecessor CI 35120293221, coverage job 104876068419, cargo install cargo-llvm-cov --locked --version 0.8.6 emitted warning: default toolchain implicitly overridden with 1.97.1-x86_64-unknown-linux-gnu by rustup toolchain file. Current #6 .github/workflows/ci.yml still uses that bare stable cargo install, while the branch-coverage lane already pins cargo +nightly-2026-07-01 install. Issue #131 records the root cause and minimum owner-path repair: use explicit cargo +1.97.1 install ... on the canonical CI/root lane, then require an exact-head warning-free coverage install without changing tool versions or suppressing stderr. This is a CI/root finding, not an artifact-analysis #57 change.