Add-host: a killed shim's leftover .stop endpoint makes leftovers unofferable (exit 71) #387

New issue

Open

opened 2026-11-06 03:44:18 +00:00 by kayg · 0 comments

kayg commented

2026-11-06 03:44:18 +00:00

Owner

Follow-up from #305 (J272 verdict 81663, P3-d; J241 round 4).

What happens: a shim that is killed (not stopped through its cleanup endpoint) leaves sessions/sessions/<id>.sock and <id>.stop behind. <id>.stop is the shim's cleanup endpoint, a Unix socket (crates/infraternal-shim/src/cleanup.rs:44). The stale-setup inspection in crates/plugins/ssh/src/previous_attempt.sh accepts only <id>.sock sockets (and, since #305, .readiness markers) in that directory. It refuses anything else with exit 71 ("Host provisioning cannot safely remove these leftovers because their ownership is not proven"), so such leftovers can never be offered for Start fresh. Evidence: compute01:~claude/j272/logs/b1-live-shim.txt, control 1.

Why it isn't in #305: accepting .stop safely needs proof that no process still serves it. The runtime helper's kernel check (--bootstrap-runtime … sessions, crates/plugins/remote/src/runtime_lock.rs) probes only *.sock endpoints. Inferring "dead" from the sibling .sock alone isn't provably safe, because a shim may unbind one endpoint before the other. That makes it a helper change (Rust, versioned helper level) plus the shell inspection and cleanup, not a few lines of shell.

Suggested fix:

Teach the helper's sessions mode to treat <id>.stop like <id>.sock: kernel-bound by a live owner means 73; otherwise it's ours and dead.
Accept <hex id>.stop sockets in the inspection and remove them with the session sockets in Start fresh.
Write a failing oracle test first: a killed shim's .sock + .stop, then Start fresh offered and cleaned; and a live owner of .stop must refuse.

Follow-up from #305 (J272 verdict 81663, P3-d; J241 round 4). **What happens:** a shim that is killed (not stopped through its cleanup endpoint) leaves `sessions/sessions/<id>.sock` and `<id>.stop` behind. `<id>.stop` is the shim's cleanup endpoint, a Unix socket (`crates/infraternal-shim/src/cleanup.rs:44`). The stale-setup inspection in `crates/plugins/ssh/src/previous_attempt.sh` accepts only `<id>.sock` sockets (and, since #305, `.readiness` markers) in that directory. It refuses anything else with exit 71 ("Host provisioning cannot safely remove these leftovers because their ownership is not proven"), so such leftovers can never be offered for Start fresh. Evidence: `compute01:~claude/j272/logs/b1-live-shim.txt`, control 1. **Why it isn't in #305:** accepting `.stop` safely needs proof that no process still serves it. The runtime helper's kernel check (`--bootstrap-runtime … sessions`, `crates/plugins/remote/src/runtime_lock.rs`) probes only `*.sock` endpoints. Inferring "dead" from the sibling `.sock` alone isn't provably safe, because a shim may unbind one endpoint before the other. That makes it a helper change (Rust, versioned helper level) plus the shell inspection and cleanup, not a few lines of shell. **Suggested fix:** 1. Teach the helper's `sessions` mode to treat `<id>.stop` like `<id>.sock`: kernel-bound by a live owner means 73; otherwise it's ours and dead. 2. Accept `<hex id>.stop` sockets in the inspection and remove them with the session sockets in Start fresh. 3. Write a failing oracle test first: a killed shim's `.sock` + `.stop`, then Start fresh offered and cleaned; and a live owner of `.stop` must refuse.

kayg referenced this issue

2026-11-06 06:51:32 +00:00

Add-host: a failed install leaves a bootstrap lock that blocks every re-add forever #305

kayg referenced this issue

2026-11-06 09:29:54 +00:00

Add-host: a failed install leaves a bootstrap lock that blocks every re-add forever #305

kayg referenced this issue

2026-11-06 12:22:15 +00:00

Add host (root): upload fails with exit 71 and every retry repeats it; message tells the owner to inspect folders (J303) #394

kayg referenced this issue

2026-11-06 12:43:34 +00:00

Add host (root): upload fails with exit 71 and every retry repeats it; message tells the owner to inspect folders (J303) #394