Repository navigation
Add embedded Python and verified runtime packages - #92
Merged
Merged
Conversation
Keep SDK effects in their original native invocation so Python awaits cannot bypass ownership or durability gates. Verify provisioned runtime files before admission and retain joined shutdown evidence. Track remaining production qualification in the plan 007 audit.
Executable hashes alone leave runtime dependencies unverified. Bind inventories to process and generation admission, then restore checked runtime blobs before publishing the executable. Qualify removal of the original runtime, clean-environment startup and joined shutdown. Retain remaining production gates in the plan audit.
Checkpoint distant alarms without firing before their original deadline. Valid Python alarm timestamps otherwise overflow the timer wheel and panic the actor.
Own and join a separate execution domain so archive qualification cannot replace the native worker test process initializer.
Qualify native-writer conflicts and stale Python work after a real ownership fence. Keep native fence outcomes incomplete while observing managed cleanup. Suppress private unraisable and thread exception text before application imports. Record interpreter CPU, handler timings and bounded-work evidence separately from Rust accounting.
forhappy
changed the title
Importing signal installs a Python INT handler even when initialization handlers are disabled. Remove that implicit handler before the Rust supervisor starts, preserving pre-existing native handlers. Real INT handoff completed natively but raised KeyboardInterrupt in the Python loop. Retain sanitized failure-stage diagnostics and require complete reports in the regression.
RUNPATH lets ambient LD_LIBRARY_PATH replace the inventoried libpython with a different same-SONAME interpreter. Emit GNU RPATH and retain actual loaded-library verification. Exercise loader precedence with two distinct shared libraries. Refuse paths whose separators or dynamic tokens change Linux loader meaning.
Build changed Python cell code and source inventories in a private locked application. Prove old-process adoption refusal, TERM/INT handoff, new handler execution, state recovery and exact receipt replay.
Record accepted bootstrap, authority, bridge, packaging and replacement choices. Preserve CI failures and unresolved qualification gates without claiming full plan completion.
Classify proven validation and admission refusals separately from submitted mutations with unknown outcomes. Preserve available typed routing verdicts and sanitize backend text without inferring rollback. A callee can propagate a nested refusal after committing its own writes. Qualify real three-node proof holds/failures, binding-handle authority and native depth boundaries. Fix the Linux loader-test lint found by CI without suppressing it. Record direct evidence and remaining gates.
Keep bounded lifecycle/timing observations with each native operation through dequeue, cancellation and reply delivery. Require quiescent stage counts and terminal conservation before reporting complete drain. Separate reservations from explicit UTF-8 copies. Publish age-stamped interpreter observations without waiting for the GIL, expose scoped allocation probes, and clean up optional profiling on failure paths. Qualify local traced/untraced execution and the provisioned package.
Persist rendered application status, headers and body with the atomic receipt. Re-serializing stored JSON changed key order after a lost reply. Compare retained wire fields across restart, later writes and upgrades. Keep the changed-source revision header on GET so POST receipt headers remain stable. Requalify fresh installation and TERM/INT handoff.
Keep pre-effect settlement refusals distinct from unknown mutations. Discard raw bootstrap Python errors so exception values and paths cannot escape through public error chains. Qualify real queue settlement, timeout redelivery, overlap backpressure and cron retry decisions with retained authority and persisted receipts.
A request proof can fail while an alarm still runs on the same cell. Retire that firing operation before entering cleanup, preserving wake discovery and ignoring its late completion instead of violating residency. Cover running and proof-gated alarms through public core events. Failed proof remains an unknown outcome, never a rollback certificate.
Exercise real KV, SQL and producer cancellation, unknown proof failures, explicit reconciliation and overlap backpressure without adapter replay. Verify exact codec/batch boundaries and native factory progress during blocked Python execution. Retain cold-follower replay diagnostics and record requirement-specific evidence without claiming full qualification.
CString errors retain original bytes. Validate source and filename first to keep private Python content out of startup error chains.
Make bridge delivery and failure accounting thread-safe while retaining invocation ownership and strict matching of the selected runtime ABI.
Activation retirement discarded retry identity and unfinished expressions. Checkpoint progress with history and the next alarm through native storage. Preserve interrupted history and the existing retry/calendar policy. Qualify native fan-out retirement plus Python timeout and killed-owner/disk loss recovery on both standard and free-threaded CPython.
Compare equivalent HTTP and checked-counter operations in separate native and Python hosts. Retain raw timing/copy/memory data and exact acknowledged counts through owner death, local-disk deletion and bucket-only takeover. Require complete replacement drain and refuse an embedded native reference. Keep production capacity claims separate from closed-loop lab measurements.
Match CPython 3.14.5/3.14.5t and preserve both raw experiments, executable digests, command receipts, memory/copy observations and recovery reports. Validate published samples and recovered effects before rendering tables. Record shared-machine load and development-store limits without inventing capacity targets. Keep unresolved native CI failures visible in the audit.
Keep resource refusals local to their invocation. Enforce task admission without depending on an invocation ContextVar, and retain failures raised during cancellation cleanup.
Bootstrap configuration and malformed HTTP headers could expose private values when native ingress formatted the full error chain. Replace these with bounded stage messages before crossing the public boundary. Preserve typed shutdown reports and unknown mutation outcomes; regression tests cover both CPython ABIs and verified package refusal paths.
CPython 3.14.8 dumps configured paths on codec import failure before Python error hooks exist, ignoring pathconfig_warnings=0. Discard C initialization stderr and restore the host descriptor/flags before application imports or host admission. Document the process-wide scope. Reproduce with a fresh shared 3.14.8 build; retain redacted failure output and test codec failure, closed stderr and descriptor restoration. Add delivery-stage context without changing deadlines or assertions. Local full adapter suites and strict Clippy pass on CPython 3.14.8 and 3.14.5t. Linux qualification and native deadline diagnosis remain open.
Bundle hashes alone do not identify OS/native providers used by Python and its extensions. Capture resolved load contexts, exact external file identities and OS cohorts, including macOS shared-cache UUIDs. Verify prerequisites before installation/initialization and loaded providers before host admission. Runtime verification needs no inspector/compiler. Require prerequisite metadata under format marker 1; recapture existing development inventories. No legacy reader or automatic OS installer. Match workspace crypto profiles in private rolling fixtures. CPU samples identify slow SHA256 verification; matching profiles reduce checker time from 13.3-13.6s to 1.4-1.9s without changing the 15s deadline. Preserve checker failure output. Keep qualification guards active under Python -O. Local full adapter suites/Clippy pass in both ABIs; native node tests pass 87/87. Both current-source packages pass fault/pre-admission guards, archive recovery, TERM/INT replacement and forced-KILL supervision. Linux GNU-loader/final-source packaging qualification remains open.
Checking sys.abiflags through PyO3 already touches ABI-dependent object and refcount layouts. A real opposite-library override reproduced SIGSEGV before admission. Probe opaque C configuration before initialization and retain actual opposite-library refusal checks for both threading ABIs in CI.
GNU --list can print a canonical loader as an absolute PT_INTERP alias while libc requests its bare SONAME. Capture lost that alias and refused every Linux dependency closure. Preserve the qualified interpreter name in both listing forms. Real C/ELF regressions fail before and pass after on Ubuntu amd64 and Debian arm64, without executing constructors.
Run the baseline, default-limit and opposite-library ABI checks before the long native workspace suite. Preserve every command and assertion while surfacing bootstrap failures earlier.
A fixed 250ms attempt floor can exceed the remaining proven authority following a timed-out renewal and retry delay. Keep half that authority for actual readback of a committed renewal whose response was lost. Preserve the watchdog, fencing and proof rules. A real Node/SQLite regression fails with the old floor and passes after removing it.
CPython's compatibility shim uses an ORIGIN-relative DT_NEEDED entry; GNU --list emits the expanded provider path. Resolve the documented ORIGIN/LIB/PLATFORM tokens using the qualified loader, retain the raw reference and require an observed provider in that actual load context. Run loader diagnostics with an empty environment and retain only token values. Real ELF regressions cover six spellings without constructors; complete Linux ARM64 free-threaded runtime/package capture verifies 6,139 files. Full installed-host Linux qualification remains open.
A failed output proof resets its native activation asynchronously. Reads queued during cleanup are refused when that reset finishes, even after storage and peer transports are available. The final audit incorrectly required its first read to succeed. Reproduce the 503 with a real Cell destruction barrier, then repeat only the fixed read-only observation within its original 20s HTTP budget. Keep proof/handler/operation/lease deadlines and all mutation, fencing, acknowledged-state and complete-join assertions unchanged.
A fixed public Unavailable message can conceal a retained native admission or transport cause. Log its bounded chain in the private fixture without changing the response or replaying a claiming fetch.
Retain the first native admission failure while complete Python ABI qualification runs independently. Keep all full qualification steps and budgets, and record terminal Linux evidence separately from local fixes.
Record twenty unchanged native fixture passes without claiming a cause for the preserved Linux failure. Keep final-source Linux acceptance open.
Verify the privacy source closure against complete Linux evidence and record twenty serial delivery passes. Keep historical failure causes and full-release qualification open.
Exercise the preserved receipt failure independently on Linux while retaining full qualification and consumer replay. Keep fresh fixtures, original deadlines and bounded first-failure evidence.
Accept the controlled correction at the adapter boundary in both ABIs. Keep complete release qualification and historical failure causes open.
Record all four adapter/package steps and the exact 100-fixture Linux consumer result. Preserve the different historical catalog startup failure without assigning a cause or accepting the full release.
Preserve twenty current-source passes on the historical filesystem and profile. Record the independent Cargo timing outlier without claiming CPU or storage causality for the failed historical startup.
Cargo succeeds when an exact filter selects no tests. Require one listed fixture before replay so renamed or absent cases cannot qualify a campaign without executing it. Retain the real zero-test before/after oracle and both valid fixture runs.
Exercise original failing revisions with the current diagnostic driver. Validate and verify the exact checkout, record source identity and keep independent campaigns separate from complete SDK qualification.
forhappy
marked this pull request as ready for review
October 21, 2026 07:08
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cellar applications can handle HTTP and durable business logic in embedded CPython through an optional PyO3 adapter. Python supports named cells, checked JSON batches, local SQL, alarms, KV, shared SQL, queue consumers and cron. Conventional CPython 3.14 and free-threaded 3.14t use separately matched build ABIs and package inventories.
SDK operations execute inside the original Rust invocation, preserving domain, cancellation, ownership and durability/output-proof checks. Nested calls progress through the invocation pump. Activation retirement, bounded admission and combined shutdown reports cover managed work. Ambiguous submitted mutations require receipt reconciliation; the adapter never automatically replays them.
Verified packages bind source, hash-locked dependencies, runtime, loaded libpython/threading ABI and native prerequisites before admission. Offline installation restores the environment archive. Source changes require a new executable and process. The Unix supervisor supplies bounded startup/liveness/termination and restart policy for noncooperative Python or native extensions.
Validation:
85cdef4, across both threading ABIs: adapter/bootstrap, baseline/default verifiers, actual loaded-ABI guards, installed-package refusal/offline recovery, changed-source TERM/INT replacement, forced-KILL supervisor recovery, native-node 88/88 per job, workspace tests/lints, Axum modes and native examples. Push results, PR results.git diff --check; Rust format/layout and the no-JavaScript dependency check also pass.The delivery review found no missing required core runtime, SDK or packaging surface in M0–M5. Release qualification remains open for preserved historical delivery-deadline, initial-consumer and clock/replay failures with unexplained causes. Passing repetitions do not establish those causes. Optional ASGI/streaming adapters remain deferred.
The implementation plan, ADR 004, baseline harness and runnable example describe the delivered contracts, deployment steps and remaining acceptance scope.