Skip to content

fix(collector): fail closed on shadow memory pressure - #54

Merged
proerror77 merged 1 commit into
mainfrom
codex/polymarket-shadow-memory-evidence
Jul 16, 2026
Merged

fix(collector): fail closed on shadow memory pressure#54
proerror77 merged 1 commit into
mainfrom
codex/polymarket-shadow-memory-evidence

Conversation

@proerror77

@proerror77 proerror77 commented Jul 16, 2026

Copy link
Copy Markdown
Owner

Summary

  • bind the Polymarket shadow gate to the exact systemd cgroup for the reviewed candidate PID
  • fail closed if memory.events high grows or any MemoryMax/OOM counter is nonzero
  • persist start/end counters in gate evidence and enforce them in the promotion policy
  • add rejection and control-plane coverage

Validation

  • bash -n deployment/aliyun/polymarket-raw-ops-shadow-gate.sh
  • ShellCheck
  • bash deployment/aliyun/test-polymarket-raw-ops-control-plane.sh
  • git diff --check

This closes the gap found during the Tokyo one-hour shadow: business health was green, but the soft-limit counter was growing and was not represented in promotion evidence.

Summary by CodeRabbit

  • Enhancements

    • Increased the collector services’ high-memory threshold to 576 MiB while retaining the 768 MiB maximum.
    • Added memory-pressure and out-of-memory stability checks to shadow validation gates.
    • Gate evidence now records starting and ending memory-event counters.
  • Documentation

    • Updated memory calibration guidance, measured headroom details, and promotion requirements.
  • Tests

    • Expanded validation coverage for memory-event violations and unsafe control-group paths.

@coderabbitai

coderabbitai Bot commented Jul 16, 2026

Copy link
Copy Markdown

Review Change Stack

Warning

Review limit reached

@proerror77, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 49 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 96a55d69-0b5d-4b2c-9042-3d2fe030e8c2

📥 Commits

Reviewing files that changed from the base of the PR and between c59f33d and cbb6424.

📒 Files selected for processing (8)
  • deployment/aliyun/README.md
  • deployment/aliyun/polymarket-raw-ops-shadow-gate.sh
  • deployment/aliyun/polymarket-reference-collector-shadow@.service
  • deployment/aliyun/polymarket-reference-collector.service
  • deployment/aliyun/polymarket-shadow-gate-policy.jq
  • deployment/aliyun/test-polymarket-raw-ops-control-plane.sh
  • docs/reports/polymarket-shadow-memory-calibration-2026-07-16.md
  • rust_hft/tools/collector/src/polymarket_raw.rs
📝 Walkthrough

Walkthrough

The shadow gate now records and validates cgroup memory.events stability from startup through shutdown. Gate policy and tests enforce zero memory-pressure and OOM counters, while collector services use MemoryHigh=576M and MemoryMax=768M. Documentation records the updated calibration and promotion criteria.

Changes

Shadow memory stability gate

Layer / File(s) Summary
Runtime memory evidence collection
deployment/aliyun/polymarket-raw-ops-shadow-gate.sh, deployment/aliyun/polymarket-reference-collector*.service
The gate validates the shadow cgroup, captures baseline and final memory.events, enforces PID and counter stability, emits both snapshots in gate.json, and updates MemoryHigh to 576M.
Gate policy and control-plane validation
deployment/aliyun/polymarket-shadow-gate-policy.jq, deployment/aliyun/test-polymarket-raw-ops-control-plane.sh
Policy checks require zero baseline and terminal max/OOM counters with unchanged high; tests cover invalid evidence, safe cgroup paths, and updated unit limits.
Memory calibration records
docs/reports/polymarket-shadow-memory-calibration-2026-07-16.md, deployment/aliyun/README.md
Calibration documentation records the 512MiB watermark observations, the 576MiB/768MiB envelope, and memory-event requirements before promotion.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Systemd
  participant ShadowGate
  participant CgroupMemoryEvents
  participant GatePolicy
  participant GateJson
  Systemd->>ShadowGate: Start shadow and provide MainPID
  ShadowGate->>CgroupMemoryEvents: Read baseline counters
  CgroupMemoryEvents-->>ShadowGate: Return memory.events
  ShadowGate->>CgroupMemoryEvents: Check stable counters during monitoring
  CgroupMemoryEvents-->>ShadowGate: Return unchanged counters
  ShadowGate->>GateJson: Write start and end snapshots
  GateJson->>GatePolicy: Validate memory_events and stability check
Loading

Possibly related PRs

  • proerror77/monday#34: Introduced the shadow gate and jq policy framework extended by this change.
  • proerror77/monday#44: Added related shadow-gate deadline controls extended alongside the memory stability checks.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the main change: making the collector shadow gate fail closed on memory pressure.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch codex/polymarket-shadow-memory-evidence

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 51a4f21878

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread deployment/aliyun/polymarket-raw-ops-shadow-gate.sh Outdated
@proerror77
proerror77 force-pushed the codex/polymarket-shadow-memory-evidence branch from 51a4f21 to c59f33d Compare July 16, 2026 02:41

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
deployment/aliyun/test-polymarket-raw-ops-control-plane.sh (2)

1275-1277: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert the production unit’s MemoryMax too.

The test verifies the full shadow envelope but only MemoryHigh for the production collector.

Proposed test addition
 grep -Fxq 'MemoryHigh=576M' "$SCRIPT_DIR/polymarket-reference-collector.service"
+grep -Fxq 'MemoryMax=768M' "$SCRIPT_DIR/polymarket-reference-collector.service"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deployment/aliyun/test-polymarket-raw-ops-control-plane.sh` around lines 1275
- 1277, Update the assertions in the service-memory test to also verify that
polymarket-reference-collector.service contains the expected MemoryMax=768M
setting, matching the existing shadow-unit envelope checks while retaining the
current MemoryHigh assertions.

864-888: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover every newly enforced memory counter with rejection tests.

The mutations omit baseline max/OOM counters and terminal oom_kill/oom_group_kill. Add these fields to a table-driven rejection matrix so each promotion-policy invariant is protected.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@deployment/aliyun/test-polymarket-raw-ops-control-plane.sh` around lines 864
- 888, Extend the rejection-test matrix in the memory-events policy checks to
cover nonzero baseline max and oom counters, plus nonzero terminal oom_kill and
oom_group_kill counters. Include each mutation in the same table-driven
structure as the existing high, max, and oom cases, and assert that the policy
rejects every generated gate fixture.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@deployment/aliyun/polymarket-raw-ops-shadow-gate.sh`:
- Around line 751-753: Update the shutdown and terminal snapshot flow around
stable_memory_events_snapshot so the candidate is quiesced or frozen before
taking the final memory.events snapshot, or continue collecting counters
throughout process termination. Ensure high, max, and OOM events occurring
during shutdown are included before the gate evaluates the complete run.

---

Nitpick comments:
In `@deployment/aliyun/test-polymarket-raw-ops-control-plane.sh`:
- Around line 1275-1277: Update the assertions in the service-memory test to
also verify that polymarket-reference-collector.service contains the expected
MemoryMax=768M setting, matching the existing shadow-unit envelope checks while
retaining the current MemoryHigh assertions.
- Around line 864-888: Extend the rejection-test matrix in the memory-events
policy checks to cover nonzero baseline max and oom counters, plus nonzero
terminal oom_kill and oom_group_kill counters. Include each mutation in the same
table-driven structure as the existing high, max, and oom cases, and assert that
the policy rejects every generated gate fixture.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 6ed1cb6f-ccf4-4e74-bb74-b674d4625150

📥 Commits

Reviewing files that changed from the base of the PR and between cfeb6d0 and c59f33d.

📒 Files selected for processing (7)
  • deployment/aliyun/README.md
  • deployment/aliyun/polymarket-raw-ops-shadow-gate.sh
  • deployment/aliyun/polymarket-reference-collector-shadow@.service
  • deployment/aliyun/polymarket-reference-collector.service
  • deployment/aliyun/polymarket-shadow-gate-policy.jq
  • deployment/aliyun/test-polymarket-raw-ops-control-plane.sh
  • docs/reports/polymarket-shadow-memory-calibration-2026-07-16.md

Comment thread deployment/aliyun/polymarket-raw-ops-shadow-gate.sh
@proerror77
proerror77 force-pushed the codex/polymarket-shadow-memory-evidence branch from c59f33d to 64f3e0d Compare July 16, 2026 02:46
@proerror77
proerror77 force-pushed the codex/polymarket-shadow-memory-evidence branch from 64f3e0d to cbb6424 Compare July 16, 2026 02:52
@proerror77

Copy link
Copy Markdown
Owner Author

Addressed the CodeRabbit terminal-snapshot review in cbb6424. The gate now freezes the exact shadow unit, verifies FreezerState=frozen and the pinned PID/invocation again, captures terminal memory.events, then sends SIGTERM to the frozen main process before the existing stop/restart-journal checks. Cleanup always thaws before stopping, so failures cannot leave a frozen unit. The rejection matrix now covers nonzero start max/oom/oom_kill/oom_group_kill and end max/oom/oom_kill/oom_group_kill; both production and shadow MemoryMax=768M assertions are present. Bash syntax, ShellCheck, the control-plane suite, and diff-check pass.

@proerror77
proerror77 merged commit 85e58c0 into main Jul 16, 2026
17 checks passed
@proerror77
proerror77 deleted the codex/polymarket-shadow-memory-evidence branch July 16, 2026 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant