Repository navigation
Conversation
Pin the endpoint-release interleaving that lets an old daemon remove the replacement admin credential.
Keep shutdown credential cleanup within endpoint ownership so an old daemon cannot delete its replacement credential. 1 failing -> 0 failing; 127 daemon server tests pass.
Document credential removal before socket release so replacement credentials remain protected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #609
Status
Implement: done (red 43f9f67, green 81e8bd2). Review: 2 rounds, 0 open. Hardware: n/a. Gate: merged.
What is this?
This PR fixes a daemon replacement race that can leave admin commands without a credential after a restart.
How does it work?
The old daemon removes its admin credential before releasing the endpoint, and releases the endpoint even when that removal fails. A replacement can then claim the endpoint and persist its credential without old shutdown deleting it. The daemon manual and startup flow describe this ordering.
Why is it useful?
Restart authentication has a deterministic regression instead of depending on slow-lane scheduling. Restoring the old ordering fails its credential-read assertion.
Done when
src/daemon/server.ts.src/daemon/server.test.ts; red 43f9f67, green 81e8bd2; fails again with the ordering reverted.Assumptions
none
Review
Spec review: 0 blocking, 0 fixed, 1 note. Code review: 1 blocking, 1 fixed, 0 notes. Claims review: 0 blocking, 0 fixed, 0 notes.
Rounds: 2. Tokens: n/a.
The reviews ran as detached fresh
claude -pchild sessions (one per reviewer, blind to the PR body and to each other, each in its own worktree of the reviewed head built byreview-inputs.sh); this session's harness refused nested subagents. The code finding was raised as a note in both round-1 passes, verified as wrong state by a probe (failingremove()skippedhost.stop(), leaving the endpoint claimed), and confirmed; round 2 (code + claims,6d75aacc..144ed24f) found nothing. A continuation session repeated the round-2 check independently on the same head with the same result, and its own revert probes reddened each test variant for its named reason.Written by an agent.