Repository navigation
Conversation
…lidation proof A browser-session connection prompted for sign-in only when a run failed with a session or 401 reason. No production code produced the verified provider_invalidation_proof that connection-health already accepts, so the projection input was always null. The runtime now records a proof when a run fails and the last top-level page URL of its own leased browser surface matches the connector manifest's optional runtime_requirements.bindings.browser.sign_in_url_pattern. Visiting the sign-in page on a healthy run is not proof, and nothing reads connector-reported gaps or message text. A succeeded run marks earlier proofs repaired, which suppresses replay. connection-health now evaluates a verified proof before the credentials-accepted branch, so a run with no failure reason no longer hides it. The summary path loads the durable proof into browserSurfaceRepair. Connectors without a pattern behave as before. Fixes #647 Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
- Match the sign-in pattern with a segment scan instead of a regular expression, so a hostile pattern cannot backtrack on the controller loop. - Fence the run-completion writer on the run's slot ownership and generation, so a late result from a reclaimed run cannot mark a newer run's proof repaired or record another run's page. - Capture failure evidence on the watchdog and rejection paths before the lease is released. - Return a page URL only when exactly one page target qualifies; several targets make the last navigation unknowable, so no proof is recorded. - Cascade proof rows when the connection is deleted, on both backends. - Reject sign_in_url_pattern values over the runtime limit, on the browser binding only. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
The recorder wrote after an await with no identity re-check, so a reclaimed run's delayed DevTools read could insert an unrepaired proof that outranks the newer run's success. The write now re-checks run, generation and slot after the await. The first terminal path to reach a run owns the capture. The watchdog records under the run's actual terminal status. A success repairs earlier proofs before the manifest-pattern gate. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
A second terminal path returned immediately, so cleanup released the slot while the first path's DevTools read was in flight and the proof was dropped as superseded. The capture is now one per-run promise that every terminal path and slot cleanup awaits. Also registers the proof-store Postgres test in the template eligibility inventory, which failed CI shard 4. Assisted-by: AI Signed-off-by: Tim Nunamaker <tnunamak@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #647
A failed run records a proof when its leased browser surface shows exactly one page whose URL matches
runtime_requirements.bindings.browser.sign_in_url_pattern. The runtime reads the DevTools target list on its own surface, so no request reaches the provider. Several candidate pages record nothing. A sign-in page visit on a healthy run is not proof.connection-health.tschecks a verified proof before the credentials-accepted branch, so a run with no failure reason no longer hides it.provider_invalidation_proofs(both backends, cascades on connection delete). The writer runs at run completion, on the watchdog and on rejection. One capture per run is awaited by every terminal path before the slot is released, and the write re-checks run slot and generation after the DevTools read, so a reclaimed run cannot touch a newer run's proof.Assisted-by: AI