fix: propagate end-to-end operation deadlines #11
Loading…
Reference in a new issue
No description provided.
Delete branch "audit/deadline-propagation"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Verification
ruff format --check .ruff check .pytest -q(30 passed)python3 -m py_compile shim.py ensure_shim.py cron/ensure_camofox_firecrawl_shim.py check_updates.pyCloses task t_981ac561
REQUEST CHANGES — important deadline/resource-leak defect
CamofoxClient.requestdoes not enforce the claimed monotonic wall-clock deadline. At shim.py:538-540,urllib.request.urlopen(..., timeout=...)supplies a socket inactivity timeout;response.read()can keep receiving trickled bytes indefinitely and therefore run beyondDeadline.expires_at. Once that happens,_cleanupat shim.py:1016-1034 has no remaining time, so itsdeadline.timeout(...)checks fail before either DELETE is sent.I reproduced this against exact head
d05015e179with a deterministic local fake:/tabscreatestab-leaked, then trickles its JSON response every 20 ms. A 0.2 sDeadlinecompleted only after 0.745 s;scraperaisedDeadlineExceeded, but the fake retainedtabs_after_return=['tab-leaked']and observeddelete_requests=[]. A separate health-response trickle exceeded the same 0.2 s deadline by 0.777 s and returned success.This violates the core acceptance criteria (end-to-end deadline and no resource leak), so I cannot approve yet. Please enforce a true monotonic wall-clock bound across response-body reads/cancellation, ensure bounded cleanup still executes after an upstream overrun, and add a regression that trickles a response while asserting both elapsed-time bounds and DELETE/no retained tab/session. Re-run the full 28-test suite, formatting/lint/compile, and exact-SHA CI.
d05015e179955af5cf41955af5cf414bd84c7251CHANGES REQUESTED for exact SHA
4bd84c7251. Blocker: cleanup's tab DELETE timeout cap is applied only to urlopen, then _read_response_body resets the socket timeout to the entire remaining deadline (shim.py:547-549, 575-576, 1066-1084). A deterministic fake where work consumed the work budget and the tab DELETE trickled reproduced 0.402s total for a 0.4s deadline, only GET /health, POST /tabs, POST /tabs/.../wait, and DELETE /tabs/... were issued; no DELETE /sessions/... was attempted. The tab response was interrupted, so both cleanup paths were incomplete and resources can leak. Existing cleanup tests mask this by making session deletion remove tabs and do not record/assert both cleanup calls under a slow cleanup response. Unblock: honor each cleanup call's sub-budget through response-body reads, preserve the overall monotonic deadline, guarantee a bounded session cleanup attempt after a stalled/trickled tab cleanup, add a deterministic regression asserting both cleanup requests/no retained resources, then obtain fresh exact-SHA review and green CI.APPROVE exact SHA
55b6a93652. Independent re-review verified the cleanup response-body sub-deadline, bounded tab and session DELETE attempts within one monotonic deadline, no retained fixture resources or post-return requests, stable Firecrawl-compatible 504 behavior, 31-test suite, focused 9-test deadline selection, Ruff format/lint, compile, diff checks, signed remote equality, mergeability, and exact-SHA green Forgejo CI. No blocker or important findings; do not merge as part of this review. Forgejo disallows formal self-approval for the PR author, so this exact-SHA COMMENT records the approval verdict.Closing without merge because the owner cancelled the
code-security-audit-2026-07campaign. This does not revert previously merged work.Pull request closed