Skip to content

fix(e2e): pause supervisor during childless recovery - #8571

Merged
cv merged 2 commits into
mainfrom
codex/e2e-shields-supervisor
Aug 7, 2026
Merged

fix(e2e): pause supervisor during childless recovery#8571
cv merged 2 commits into
mainfrom
codex/e2e-shields-supervisor

Conversation

@jyaunches

@jyaunches jyaunches commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Summary

The Shields failed-startup E2E proof now pauses the sandbox supervisor before terminating the startup child. This prevents PID 1 from racing the childless census and killing docker exec with exit 137.

Changes

  • Build validated Docker signal commands for the supervisor and startup child.
  • Pause PID 1, prove stable childless guard recovery, then resume PID 1 before restart and relock checks.
  • Register fail-safe resume cleanup before the supervisor is paused.
  • Bind the live fixture change to focused E2E-support coverage.

Type of Change

  • Code change (feature, bug fix, or refactor)
  • Code change with doc updates
  • Doc only (prose changes, no code sample modifications)
  • Doc only (includes code sample changes)

Quality Gates

  • Tests added or updated for changed behavior
  • Existing tests cover changed behavior — justification:
  • Tests not applicable — justification:
  • Docs updated for user-facing behavior changes
  • Docs not applicable — justification: This changes only an internal live E2E fixture and its support tests.
  • Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
  • Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: Independent review covered Docker command construction, signal status propagation, fail-safe cleanup registration, and cleanup ordering.
  • Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

  • Documentation writer subagent reviewed the completed changes
  • Result: no-docs-needed
  • Evidence: The change only makes the existing Shields failed-startup E2E proof deterministic by pausing and resuming the sandbox supervisor. It does not change product behavior, commands, configuration, output, or documented procedures.
  • Agent: Codex Desktop

DGX Station Hardware Evidence

  • Tested on DGX Station
  • Tested commit:
  • Station profile/scenario:
  • Result:
  • Supporting evidence:

Verification

  • PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
  • Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
  • Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: npm run test:changed and focused E2E-support coverage passed 9 tests; E2E phase, mock/live parity, integration parity, and repository checks also passed.
  • Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result:
  • Quality Gates section completed with required justifications or waivers
  • No secrets, API keys, or credentials committed
  • npm run docs builds without warnings (doc changes only)
  • Doc pages follow the style guide (doc changes only)
  • New doc pages include SPDX header and frontmatter (new pages only)

Signed-off-by: Julie Yaunches jyaunches@nvidia.com

Summary by CodeRabbit

  • Bug Fixes

    • Improved recovery when a service fails during startup.
    • Safely pauses and resumes supervisor processes while terminating failed startup processes.
    • Added safeguards against unsafe process IDs and invalid container identifiers.
  • Tests

    • Added end-to-end coverage for startup failure recovery and process-control safety.
    • Added fast-test coverage for the updated recovery workflow and verified cleanup after recovery.

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
@jyaunches jyaunches self-assigned this Aug 7, 2026
@coderabbitai

coderabbitai Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 69eaf882-508b-40cb-964b-a35d8e431573

📥 Commits

Reviewing files that changed from the base of the PR and between 6f398d1 and 5bdfc2b.

📒 Files selected for processing (2)
  • test/e2e/fixtures/shields-failed-startup.ts
  • test/e2e/live/shields-config.test.ts

📝 Walkthrough

Walkthrough

The change adds validated Docker commands for failed-startup process control. The live E2E recovery flow pauses and resumes the supervisor around startup-child termination. Tests cover command generation and validation.

Changes

Failed-startup recovery

Layer / File(s) Summary
Process-control command contract
test/e2e/fixtures/shields-failed-startup.ts, test/e2e/support/shields-failed-startup.test.ts, test/e2e/mock-parity.json
Adds validated STOP, CONT, and TERM Docker commands. Tests cover valid commands and invalid container IDs or startup PIDs. The support test is added to the fast test set.
Recovery flow integration
test/e2e/live/shields-config.test.ts
The recovery flow pauses the supervisor, obtains the startup PID, terminates the startup child, waits for a childless state, and resumes the supervisor with cleanup fallback handling.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

Suggested labels: bug-fix

Suggested reviewers: cv

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main E2E change: pausing the supervisor during childless recovery.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/e2e-shields-supervisor

Comment @coderabbitai help to get the list of available commands.

@github-code-quality

github-code-quality Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit 5bdfc2b in the codex/e2e-shields-su... branch remains at 96%, unchanged from commit 272cc64 in the main branch.


Updated August 07, 2026 17:03 UTC

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)
test/e2e/live/shields-config.test.ts (1)

972-1013: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Capture the startup PID after the supervisor stops.

liveStartupPid is captured before pauseSupervisor stops PID 1. PID 1 can replace the child during that interval. terminateStartupChild can then target the stale PID and accept “no such process,” while the replacement child remains stopped and keeps the census nonzero.

Pause PID 1 first. Then run the startup census again and build the termination command from the current child PID.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@test/e2e/live/shields-config.test.ts` around lines 972 - 1013, Update the
phase-12 live-child refusal flow to pause the supervisor before determining the
startup child PID. After pauseSupervisor succeeds, rerun the startup census,
obtain the current child PID, and rebuild processControl or its
terminateStartupChild command from that PID before terminating it; do not use
the stale liveStartupPid captured earlier.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@test/e2e/live/shields-config.test.ts`:
- Around line 972-1013: Update the phase-12 live-child refusal flow to pause the
supervisor before determining the startup child PID. After pauseSupervisor
succeeds, rerun the startup census, obtain the current child PID, and rebuild
processControl or its terminateStartupChild command from that PID before
terminating it; do not use the stale liveStartupPid captured earlier.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: f133074b-fee4-4464-92fe-feb823d3955a

📥 Commits

Reviewing files that changed from the base of the PR and between aae23eb and 6f398d1.

📒 Files selected for processing (4)
  • test/e2e/fixtures/shields-failed-startup.ts
  • test/e2e/live/shields-config.test.ts
  • test/e2e/mock-parity.json
  • test/e2e/support/shields-failed-startup.test.ts

@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

  • GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
  • Nemotron 3 Ultra (second opinion): Failed

Second-opinion terminology and E2E selections are advisory. Live E2E does not run automatically for pull requests.

3 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

  • established — supervisor at test/e2e/live/shields-config.test.ts:988: Keep "supervisor" for the OpenShell process manager.
  • established — startup child at test/e2e/fixtures/shields-failed-startup.ts:27: Keep "startup child" for the supervised process in this recovery test.
  • justified — fail-safe at test/e2e/live/shields-config.test.ts:987: Keep "fail-safe" because it identifies the cleanup fallback and its distinct failure path.

E2E guidance

Advisory only. A maintainer can dispatch the default E2E suite against this exact revision.

Recommended E2E: cloud-inference, cloud-onboard, security-posture, shields-config

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

Signed-off-by: Julie Yaunches <jyaunches@nvidia.com>
@cv
cv merged commit a34803f into main Aug 7, 2026
55 of 58 checks passed
@cv
cv deleted the codex/e2e-shields-supervisor branch August 7, 2026 17:14
@github-actions github-actions Bot added the v0.0.105 Release target label Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v0.0.105 Release target

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants