From a155cd4fdc5d0dbe45f812c7b1cb1d0c698975b4 Mon Sep 17 00:00:00 2001 From: Dotta Date: Tue, 22 Sep 2026 09:11:56 -0500 Subject: [PATCH] docs: define native worker-loss continuation qualification Co-Authored-By: Paperclip --- .../native-session-executor.test.ts | 2 +- tests/runner-e2e/README.md | 25 +++++++++++-------- 2 files changed, 16 insertions(+), 11 deletions(-) diff --git a/server/src/services/native-runtime/native-session-executor.test.ts b/server/src/services/native-runtime/native-session-executor.test.ts index 844751791b4..d50a2f0b836 100644 --- a/server/src/services/native-runtime/native-session-executor.test.ts +++ b/server/src/services/native-runtime/native-session-executor.test.ts @@ -3900,7 +3900,7 @@ describe("stopped native conversation physical cleanup", () => { const run = { id: input.binding.runId, companyId: mode === "foreign_company" ? "foreign" : input.binding.companyId, agentId: input.binding.agentId, nativeIssueId: input.binding.issueId, runtimeMode: "native", status: "failed", finishedAt: new Date(), nativeSessionId: input.session.normalizedSessionId, runnerInstanceId: mode === "foreign_runner" ? "foreign" : identity.runnerInstanceId, - runnerProfileJson: { nativeExecutionInput: input, nativeToolContractFingerprint: nativeToolContractFingerprintForTarget("local") } } as typeof heartbeatRuns.$inferSelect; + runnerProfileJson: { nativeExecutionInput: input, nativeToolContractFingerprint: nativeToolContractFingerprintForTarget("local") } } as unknown as typeof heartbeatRuns.$inferSelect; try { await mkdir(join(root, "runner"), { recursive: true }); await mkdir(join(root, "control-plane"), { recursive: true }); diff --git a/tests/runner-e2e/README.md b/tests/runner-e2e/README.md index 88c04773584..577c1e2ed81 100644 --- a/tests/runner-e2e/README.md +++ b/tests/runner-e2e/README.md @@ -903,12 +903,18 @@ successor-owned document. It budgets three provider runs. Worker recovery requires Linux with Python pidfd support (as on the CI workers). It kills only the exact running native worker PID from the public run record, after verifying its command-line run ID, process start identity, and isolated -local workspace. The signal uses an owned pidfd so PID reuse cannot retarget it. The real UI must show one Retry button. Clicking it must produce one -successful attempt, consume the original message once, preserve the saved plan, -and return a reference that was supplied only after the crash. This qualifies -**user-initiated Retry after worker process loss**, not automatic recovery of -arbitrary provider failures. It budgets two provider runs. Unexpected failures -remain fatal; only the positively identified injected-fault run is exempted. +local workspace. The signal uses an owned pidfd so PID reuse cannot retarget it. +The UI must preserve the plan and withhold generic Retry while cleanup remains +quarantined; the public retry API must return 409 without admitting another run. +The fixture then releases the read-only brief wait and sends a new chat message +that records the known saved-plan and interrupted-command outcomes. The server +must verify that the recorded worker and provider process groups stopped before +admitting exactly one successful fresh session. The answer must contain the +reference supplied only after the crash, and the saved plan must remain unchanged. +This qualifies **explicit conversation continuation after local worker loss**. +It does not qualify replay of uncertain actions, automatic recovery, remote worker +loss, or exact-session resumption. It budgets two provider runs. Unexpected +failures remain fatal; only the positively identified injected-fault run is exempted. Answer quality uses two read-only turns over public fixture tasks and conflicting historical comments. Exact structured propositions grade current blockers, @@ -933,7 +939,6 @@ it does not certify a native option in the wizard, which is not offered yet. Current proof and remaining decisions are recorded in [the 21 September qualification report](QUALIFICATION-2026-09-21.md). In particular, -worker loss currently quarantines both providers. The crash eval retains a red -qualification result when no usable recovery exists, while also verifying that -quarantine preserves the plan and rejects a misleading generic Retry. A passing -quarantine guard is not a recovered workflow. +the original worker-loss attempts quarantined both providers. The version 7 crash +eval requires a usable fresh conversation after verified cleanup. A passing +quarantine guard alone is not a recovered workflow.