coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(runtime): consume governed Activity Core closes

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
This commit is contained in:
tegwick 2026-09-04 19:54:07 +02:00
parent 0e6d795aa4
commit d00ffcb402
22 changed files with 1218 additions and 148 deletions
Download patch file Download diff file Expand all files Collapse all files

307
tests/test_claim_loop.py
View file

@ -2,6 +2,7 @@
from __future__ import annotations
import json
import subprocess
import time
from pathlib import Path
@ -14,14 +15,17 @@ from rein_aharness.claim_loop import (
process_one,
poll_peek,
)
from rein_aharness.close_outbox import CloseOutbox, CloseRequest
from rein_aharness.execution_cancel import ExecutionCancel, active_cancel
from rein_aharness.glas_execution import GLAS_APPROACH, GlasExecutionError
from rein_aharness.metrics import external_metrics_dir
from rein_aharness.ops_run_client import (
ActivityCoreOpsClient,
OpsRun,
OpsRunConfig,
OpsRunError,
)
from rein_aharness.repository_grant import RepositoryGrant
from rein_aharness.repository_transaction import RepositoryTransaction
@ -75,6 +79,45 @@ def _profiled_case(
return repo, run, client
def _grant(*paths: str) -> RepositoryGrant:
return RepositoryGrant.from_mapping(
{
"version": "1",
"allowed_paths": list(paths or ("docs/",)),
"commit_count": {"min": 1, "max": 1},
"publish": False,
}
)
def _commit_file(repo: Path, relative: str, value: str = "result\n") -> str:
path = repo / relative
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(value, encoding="utf-8")
subprocess.run(["git", "add", relative], cwd=repo, check=True)
subprocess.run(
[
"git",
"-c",
"user.email=test@example.invalid",
"-c",
"user.name=test",
"commit",
"-qm",
"profiled result",
],
cwd=repo,
check=True,
)
return subprocess.run(
["git", "rev-parse", "HEAD"],
cwd=repo,
check=True,
capture_output=True,
text=True,
).stdout.strip()
def test_process_one_empty() -> None:
client = MagicMock(spec=ActivityCoreOpsClient)
client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
@ -150,6 +193,31 @@ def test_process_one_failure_reopens() -> None:
assert client.fail.call_args.kwargs["reopen"] is True
def test_grant_without_authoritative_profile_refuses_before_execution() -> None:
client = MagicMock(spec=ActivityCoreOpsClient)
client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
run = _claimed_run()
run.repository_grant = _grant("docs/")
client.claim.return_value = [run]
client.fail.return_value = OpsRun(
id=run.id,
activity_definition_id="def",
idempotency_key="k",
target_repo=run.target_repo,
title=run.title,
description="",
state="failed",
)
with patch("rein_aharness.claim_loop.execute_approach") as execute:
result = process_one(client)
assert result.ok is False
assert "requires an authoritative harness_profile_ref" in result.reason
execute.assert_not_called()
assert client.fail.call_args.kwargs["reopen"] is False
def test_process_one_refuses_close_after_lease_loss() -> None:
client = MagicMock(spec=ActivityCoreOpsClient)
client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
@ -340,7 +408,8 @@ def test_profiled_run_uses_glas_and_completes_with_full_result(
complete_run_id = client.complete.call_args.args[0]
complete_result = client.complete.call_args.kwargs["result"]
assert complete_run_id == run.id
assert complete_result["evidence"] == gateway_result["evidence"]
assert complete_result["execution_evidence"] == gateway_result["evidence"]
assert "tool_output" not in complete_result
assert complete_result["repository_transaction"] == transaction
client.fail.assert_not_called()
select.assert_not_called()
@ -379,7 +448,7 @@ def test_profile_refusal_fails_terminally_without_legacy_fallback(
execute.assert_not_called()
def test_profiled_signal_cancellation_releases_repository_lock(
def test_profiled_signal_cancellation_releases_lock_and_durably_fails(
tmp_path: Path,
) -> None:
repo, _run, client = _profiled_case(tmp_path)
@ -397,7 +466,9 @@ def test_profiled_signal_cancellation_releases_repository_lock(
assert result.ok is False
assert result.reason == "execution cancelled (signal)"
client.complete.assert_not_called()
client.fail.assert_not_called()
client.fail.assert_called_once()
assert client.fail.call_args.kwargs["reopen"] is False
assert "repository_transaction" in client.fail.call_args.kwargs["result"]
with RepositoryTransaction(repo) as retry:
assert retry.locked is True
@ -416,12 +487,240 @@ def test_profiled_close_failure_happens_after_repository_lock_release(
result = process_one(client)
assert result.ok is False
assert result.reason.startswith("close ops_run failed:")
assert result.reason == "close evidence remains pending"
assert "repository_transaction" in result.detail
with RepositoryTransaction(repo) as retry:
assert retry.locked is True
def test_granted_profile_accepts_commit_records_metrics_and_durable_close(
tmp_path: Path,
) -> None:
repo, run, client = _profiled_case(tmp_path)
run.repository_grant = _grant("docs/")
client.complete.return_value = OpsRun(
id=run.id,
activity_definition_id="def",
idempotency_key="k",
target_repo=run.target_repo,
title=run.title,
description="",
state="succeeded",
close_disposition="applied",
)
outbox = CloseOutbox(state_dir=tmp_path / "state")
def execute(*_args, **_kwargs):
head = _commit_file(repo, "docs/result.md")
return {
"ok": True,
"evidence": {
"outcome": "succeeded",
"commit_sha": head,
"provider_response": {"secret": "must-not-persist"},
},
"tool_output": "must-not-persist",
}
with patch("rein_aharness.claim_loop.execute_profiled_run", side_effect=execute):
result = process_one(client, outbox=outbox)
assert result.ok is True
transaction = result.detail["repository_transaction"]
assert transaction["acceptance"]["accepted"] is True
assert transaction["acceptance"]["changed_paths"] == ["docs/result.md"]
assert transaction["repository_grant"]["grant_id"] == run.repository_grant.grant_id
assert transaction["metrics"]["session_id"] == transaction["transaction_id"]
assert outbox.status() == {"pending": 0, "delivered": 1, "quarantined": 0}
close_payload = client.complete.call_args.kwargs["result"]
serialized = json.dumps(close_payload)
assert "tool_output" not in serialized
assert "provider_response" not in serialized
assert close_payload["repository_transaction"]["acceptance"]["accepted"] is True
ledger = external_metrics_dir(repo, "rein-aharness") / "executions.jsonl"
record = json.loads(ledger.read_text(encoding="utf-8").strip())
assert record["success"] is True
assert record["session_id"] == transaction["transaction_id"]
def test_granted_profile_rejects_out_of_grant_commit_and_closes_failed(
tmp_path: Path,
) -> None:
repo, run, client = _profiled_case(tmp_path)
run.repository_grant = _grant("docs/")
client.fail.return_value = OpsRun(
id=run.id,
activity_definition_id="def",
idempotency_key="k",
target_repo=run.target_repo,
title=run.title,
description="",
state="failed",
close_disposition="applied",
)
def execute(*_args, **_kwargs):
head = _commit_file(repo, "UNRELATED.md")
return {"ok": True, "evidence": {"outcome": "succeeded", "commit_sha": head}}
with patch("rein_aharness.claim_loop.execute_profiled_run", side_effect=execute):
result = process_one(client, outbox=CloseOutbox(state_dir=tmp_path / "state"))
assert result.ok is False
assert result.reason.startswith("repository acceptance failed: path-not-granted")
client.complete.assert_not_called()
client.fail.assert_called_once()
close_payload = client.fail.call_args.kwargs["result"]
assert close_payload["repository_transaction"]["repository_grant"]["grant_id"]
assert "acceptance" not in close_payload["repository_transaction"]
assert client.fail.call_args.kwargs["reopen"] is False
def test_granted_profile_metrics_failure_prevents_successful_close(
tmp_path: Path,
monkeypatch,
) -> None:
repo, run, client = _profiled_case(tmp_path)
run.repository_grant = _grant("docs/")
client.fail.return_value = OpsRun(
id=run.id,
activity_definition_id="def",
idempotency_key="k",
target_repo=run.target_repo,
title=run.title,
description="",
state="failed",
)
def execute(*_args, **_kwargs):
head = _commit_file(repo, "docs/result.md")
return {"ok": True, "evidence": {"outcome": "succeeded", "commit_sha": head}}
def fail_metrics(*_args, **_kwargs):
raise OSError("state volume unavailable")
monkeypatch.setattr(
"rein_aharness.claim_loop.metrics.record_external_execution",
fail_metrics,
)
with patch("rein_aharness.claim_loop.execute_profiled_run", side_effect=execute):
result = process_one(client, outbox=CloseOutbox(state_dir=tmp_path / "state"))
assert result.ok is False
assert result.reason == "required external metrics persistence failed"
client.complete.assert_not_called()
close_payload = client.fail.call_args.kwargs["result"]
assert close_payload["repository_transaction"]["acceptance"]["accepted"] is True
assert "metrics" not in close_payload["repository_transaction"]
def test_response_lost_close_replays_without_reexecuting_workload(
tmp_path: Path,
) -> None:
repo, run, client = _profiled_case(tmp_path)
run.repository_grant = _grant("docs/")
outbox = CloseOutbox(state_dir=tmp_path / "state")
reconciled = OpsRun(
id=run.id,
activity_definition_id="def",
idempotency_key="k",
target_repo=run.target_repo,
title=run.title,
description="",
state="succeeded",
close_disposition="reconciled",
)
client.complete.side_effect = [
OpsRunError("complete transport failed", action="complete"),
reconciled,
]
gateway_calls = 0
def execute(*_args, **_kwargs):
nonlocal gateway_calls
gateway_calls += 1
head = _commit_file(repo, "docs/result.md")
return {
"ok": True,
"evidence": {"outcome": "succeeded", "commit_sha": head},
}
with patch("rein_aharness.claim_loop.execute_profiled_run", side_effect=execute):
first = process_one(client, outbox=outbox)
assert first.reason == "close evidence remains pending"
assert outbox.status()["pending"] == 1
client.claim.return_value = []
second = process_one(client, outbox=outbox)
assert second.empty is True
assert gateway_calls == 1
assert client.complete.call_count == 2
assert outbox.status() == {"pending": 0, "delivered": 1, "quarantined": 0}
commit_count = subprocess.run(
["git", "rev-list", "--count", "HEAD"],
cwd=repo,
check=True,
capture_output=True,
text=True,
).stdout.strip()
assert commit_count == "2"
def test_pending_close_failure_blocks_new_claim(tmp_path: Path) -> None:
client = MagicMock(spec=ActivityCoreOpsClient)
client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
client.complete.side_effect = OpsRunError("transport failed", action="complete")
outbox = CloseOutbox(state_dir=tmp_path / "state")
outbox.enqueue(
CloseRequest(
run_id="run-1",
transaction_id="tx-1",
worker_id="w",
action="complete",
result={"ok": True},
)
)
result = process_one(client, outbox=outbox)
assert result.claimed is False
assert result.retry_full_interval is True
assert "remains pending" in result.reason
client.claim.assert_not_called()
def test_permanent_close_conflict_is_quarantined_before_claim(tmp_path: Path) -> None:
client = MagicMock(spec=ActivityCoreOpsClient)
client.config = OpsRunConfig(worker_id="w", lease_seconds=90)
client.complete.side_effect = OpsRunError(
"conflict",
action="complete",
status_code=409,
code="terminal_conflict",
)
client.claim.return_value = []
outbox = CloseOutbox(state_dir=tmp_path / "state")
outbox.enqueue(
CloseRequest(
run_id="run-1",
transaction_id="tx-1",
worker_id="w",
action="complete",
result={"ok": True},
)
)
result = process_one(client, outbox=outbox)
assert result.empty is True
assert outbox.status() == {"pending": 0, "delivered": 0, "quarantined": 1}
client.claim.assert_called_once()
def test_poll_peek_reports_authoritative_profile_route() -> None:
client = MagicMock(spec=ActivityCoreOpsClient)
run = _claimed_run()