fix: atomically accept runtime source packs#558
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7c8eeb0aec
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return tuple( | ||
| _material_from_item( |
There was a problem hiding this comment.
When cached_package.paths overlap, such as a directory plus a JSON file inside that directory, CachedPackageProvider returns the same JSON source item twice. This new path forwards every collected item into one source pack, so intake derives a duplicate source_id and raises submission_replay_conflict after the source-provider invocation has already been started; no sources are committed and the invocation remains active, leaving the run unable to progress. Reject overlapping cached paths before starting the invocation or deduplicate identical collected items before building the pack.
Useful? React with 👍 / 👎.
| contents = [self._read_human_source_bytes(item) for item in request.members] | ||
| if sum(len(item) for item in contents) > 256 * 1024 * 1024: |
There was a problem hiding this comment.
When a human source pack contains many files that are each under the 16 MiB per-file cap but exceed the 256 MiB pack cap in total, this list comprehension reads every member into memory before the total-size guard runs. With the allowed 256 members this can allocate roughly 4 GiB and OOM the host instead of returning runtime_human_request_invalid; track cumulative size as each file is read and abort once the pack limit is crossed.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6c7378cd27
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| f"{scratch}/source_raw.json", | ||
| material.raw_payload, | ||
| members: list[dict[str, object]] = [] | ||
| for position, material in enumerate(materials, start=1): |
There was a problem hiding this comment.
When a deterministic route can return more than 256 items, such as three web-search tasks at max_results=100 or a cached-package directory with more than 256 files, this loop writes every member and only then builds a SourcePackCommitRequest, whose members field is capped at 256. The resulting validation error is recorded as dispatch_unavailable, exhausting the route with zero accepted sources and falling through to human input even though valid source items were available; cap/split the collected materials or reject the frozen plan before starting the invocation.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a425bcfbcc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| service = RuntimeHostService( | ||
| workspace, | ||
| adapter_loader=load_codex_adapter_binding, | ||
| adapter_loader=workspace_codex_adapter_loader(workspace), |
There was a problem hiding this comment.
When a workspace is created through InitWebSubmitter, it calls create_workspace and bootstraps the DB with the packaged load_codex_adapter_binding, but it never installs a workspace .codex kit. With runtime next now always using workspace_codex_adapter_loader, the first runtime command after a successful init-web submission fails with runtime_adapter_binding_mismatch because .codex is missing, leaving that user-created workspace unable to continue without an undocumented manual install step. Either install the Codex kit in the init-web submit flow or keep the adapter source consistent for those workspaces.
Useful? React with 👍 / 👎.
1 participant
Outcome\n\nCodex fixes the v0.14 SQLite runtime so one frozen input pack is registered completely instead of silently selecting the first source.\n\n## Changes\n\n- add strict 1-256 member human/internal source-pack contracts\n- commit all sources through one Invocation, one ControlStore UoW, and one Receipt\n- preserve zero partial registration when any member is missing, changed, duplicated, or invalid\n- retain every deterministic cached/provider result in stable order\n- bind runtime execution to the actual workspace-local Codex kit; tamper/delete/extra/symlink fails closed\n- add Experimental A2 procedural-isolation preflight with an explicit no-OS-sandbox boundary\n- hide the retired --skip-doctor flag while preserving its fail-closed rejection\n- update Codex Skill and public architecture/support docs\n\n## Evidence\n\n- focused normal: 329 passed\n- focused python -O: 329 passed\n- source/wheel packaging + launch smoke: 5 passed\n- 25-file cached pack: one transaction Receipt with all 25 source IDs\n- release consistency, public safety, terminology, product baseline, Skill freshness, generated assets, Ruff: PASS\n\n## Boundaries\n\n- SQLite receipts and ledger relations remain sole runtime authority\n- no legacy JSON fallback\n- A2 check is procedural isolation only, not an OS sandbox\n- no claim that multiple sources improve report quality