Skip to content

Close cold-start egress cancellation races - #373

Merged
NotASithLord merged 4 commits into
mainfrom
ci-race-fixes
Aug 9, 2026
Merged

Close cold-start egress cancellation races#373
NotASithLord merged 4 commits into
mainfrom
ci-race-fixes

Conversation

@NotASithLord

Copy link
Copy Markdown
Owner

Summary

  • wait for denylist policy hydration before VM and Notebook egress
  • bind hydration to the same Stop and deadline signal as the admitted operation
  • make the Firefox cancellation probe wait for a real in-flight request
  • preserve accurate user and model copy for network-specific and shared failures

This integrates the useful work from #372 while preserving Jonathan Bursztyn’s authorship. The overlapping Notebook polling commit is already on main.

Validation

  • bun test ./tests (5,688 tests)
  • bun run typecheck
  • bun run lint
  • bun run check:tscheck
  • bun run red-team
  • focused denylist and engine route tests
  • independent security, correctness, Firefox, user UX, and model UX review

jonybur and others added 4 commits August 9, 2026 16:48
… SW start

The denylist seed hydrates async at service-worker boot, and webFetch's
getDenylist does a synchronous readiness check. A sw/web-fetch request
(Notebook module fetch, VM egress) that raced a cold start was refused
with DenylistPolicyUnavailableError instead of waiting - the packaged
page boot job hit exactly this on main's #370 merge run (the same tree
passed on the PR branch and locally).

The engine route now awaits an injected awaitDenylistPolicy gate
(requireDenylistPolicy(await denylistReady)) before any fetch work, so
the race becomes a short wait while a genuinely failed hydration still
refuses before any egress. The sync check inside getDenylist stays as
the last-resort chokepoint for every other direct caller.

Signed-off-by: Jonathan Bursztyn <jobur93@gmail.com>
…st arrival

The remote-fetch stop probe slept a fixed 150ms after starting the run,
then aborted - on a slow runner the abort landed before the resolver had
even issued the slow fetch, so the fixture saw 0 requests instead of the
in-flight cancel the test pins (CI hit this on the #372 branch run).

The fixture now serves a status endpoint reporting how many slow-module
requests have arrived, and the probe polls it through the same audited
sw/web-fetch relay the resolver uses, aborting only once the request is
on the wire. Single injected block (geckodriver gives each script a
fresh sandbox, so cross-call state is not an option), and elapsedMs now
measures abort to settled - the prompt-stop property - instead of
including run setup.

Signed-off-by: Jonathan Bursztyn <jobur93@gmail.com>
@github-actions

github-actions Bot commented Aug 9, 2026

Copy link
Copy Markdown

Visual regression

No visual drift. Every state renders identically to the committed baselines.

📸 Browse the visual gallery — 54 baseline screens (light + dark) as of this commit.

@NotASithLord
NotASithLord merged commit 6ccf228 into main Aug 9, 2026
19 checks passed
@NotASithLord
NotASithLord deleted the ci-race-fixes branch August 9, 2026 22:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants