mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-12 22:56:58 +01:00
## Thinking Path > - Paperclip is the open source app people use to manage AI agents for work > - After a restart, the control plane settles in-progress records (leases, claims, intents) only once it proves their owner process is gone > - The proof compares host and PID space, so a stamp from a replaced container or a rebooted machine stays unprovable forever, and its records never settle > - Self-hosted users on Docker, Kubernetes and Fly hit this on every redeploy; a Railway deployment with an exclusive volume is covered by `deployment_replaced` (#20026) > - This pull request adds a fenced controller epoch: each boot holds a database lease, and an expired boot is fenced so its records can be proven gone > - The benefit is that work stranded by a replaced container is recovered, without keeping an idle database awake ## Linked Issues or Issue Description Follow-up to #20026 and the Phase 2 durable-ownership data. Related: #19965 (owner stamps), #19883 (process space). No duplicate PR was found. **What happened?** A record stamped by a server process in another container reports `different_process_space`. A dead PID elsewhere is never proof, so the record stays `unprovable` and is never settled. Every redeploy of a self-hosted container leaves such records behind. **Expected behavior** A record owned by a server boot that was replaced (stopped cleanly, or lost its lease and was fenced) is proven gone and settled exactly once. A live boot's records stay with it. An idle server issues no recurring queries. **Steps to reproduce** 1. Run Paperclip in a container and start work, so an environment lease is stamped by that boot. 2. Replace the container. The new container has a new PID namespace. 3. The ownership reconciler reports `different_process_space` (unprovable) for the old lease, forever. **Paperclip version or commit** `master` before this PR. ## What Changed - New `controller_instances` table (migration 0449): boot id, epoch (bigserial), process space, pid, a lease on the database clock, `fenced_at` / `fenced_by_epoch`, `stopped_at`. - `controller-instance-lease.ts`, registered with the shared delivery-work coordinator (`controller-instance-lease` queue, runs during drain): - **Holds work → renews; idle → silent.** One upsert creates the row on first use and extends the lease only if the boot holds work: a stamp within the last 90 s, or a stamp whose ownership write may still be pending (held until the server's tracked work settles, capped at 10 minutes; a renewal that sees some other held record does not clear it, so a slow ownership write cannot be outlived), or an in-progress record held by its boot id. Those records are active environment leases, in-flight cleanup claims, sandbox creation intents, workspace finalize attempts, agent lifecycle steps, native finalizer and cleanup leases (`lease_holder` bound to the token), open native coordinator claims, and running legacy runs. Renewal runs every 30 s while the boot holds work. When it finds none, the lease lapses and the worker sleeps until the next stamp (`onControllerStamp`). - **No idle trailing statements.** When the server's last tracked work settles, the worker re-checks holdings at once, at most every 5 s (the rate limit also absorbs the worker's own run). So the last check happens with the work, not 30 s later. - **Quiesce, don't crash.** Each renewal has a 10 s bound. A failed or timed-out renewal applies an internal task drain, so no new work is dispatched. A recovered renewal resumes. The boot exits only after 60 s of failure (counted from the first failed attempt's start) while it still holds work, or at once when it finds itself fenced. - **Fence on demand, by a newer epoch.** For a stamp from another host or PID space, the prover reads that boot's row: - `stopped` or `fenced`: gone. - live lease: alive. - otherwise, the boot's last sign of life is the later of its lease expiry and the record's last write plus the TTL. Within 30 s of that, the owner stays `alive` (`controller_lease_grace`), so the settle watch keeps rechecking. After that, the prover fences the boot, but only with a lease row of its own (created on demand) and only an older epoch. - A graceful shutdown records `stopped_at`. - A reconciliation pass that settles nothing (`record: false` or `settle: false`) never fences and never creates the boot's row. - `owner-proof.ts`: these proofs apply only to server-held records. A stamp with a recorded process group stays unprovable, because agent processes can outlive their server. The reconciler passes each record's `updatedAt` to the proof. - `task-admission.ts`: - the quiesce drain never replaces an operator's drain, and has no idle owner, so HTTP stays open; - a `subscribeIdleWorkSettled` hook fires when the last tracked work finishes. - Off on a Railway deployment with an exclusive volume (it has its own replacement proof). `PAPERCLIP_CONTROLLER_INSTANCE_LEASE=on|off` overrides this. A stateless Railway service keeps the lease. A server without its own lease row never fences. - `maintenance-server-routes.test.ts`: in the post-run quiet window, the lease may check once more that the run's records were released. The test now excludes those statements, then asserts that the lease issues nothing in a further window. - Docs: `doc/execution-semantics.md`; the Phase 2 data doc records the two known gaps. ## Verification - `controller-instance-lease.test.ts` (15 cases): - a replaced container with all Railway variables empty is fenced and settled exactly once over two passes; - a live lease is alive; - an owner in grace, and work written after an idle lapse, stay alive and watched; - an older epoch never fences a newer one; - no fencing without its own lease row (off or unregistered), and an idle prover creates its row on demand; - a stopped boot is gone; - process-group stamps stay unprovable; - idle issues zero statements, and one upsert renews only while records are held; - **a 45 s outage:** quiesced, no exit, resumes; - **a renewal that never answers:** bounded, and the boot exits on time; - **a 70 s outage:** exits at 60–65 s, and the successor recovers the work exactly once; - fenced: stops; - the settle re-check; - graceful stop; off on a volume-exclusive Railway deployment, on for a stateless one, and the on/off override; - a running legacy run keeps the lease live. - Red, with the proof's instance check removed: the replaced-container, live, stopped and successor cases fail. - Wider: task-drain, idle-sleep, idle-local-work, owner-proof and ownership suites, plus the maintenance quiet-window tests. Server low-memory typecheck is clean. ## Risks - **Clock skew.** The proof compares a record's `updatedAt` (often the writer's clock) with the lease (database clock). The 30 s grace absorbs ordinary skew. - **A new exit path exists.** A server whose database is unreachable for more than 60 s while it holds work now exits, after first quiescing. This is the intended safety backstop. - **Bounded trailing activity.** A lease that holds work issues one statement every 30 s, plus at most one check when its work settles. An idle server issues none. - **Boots from before this release** have no row, and their records stay unprovable. The board "mark owner gone" action for those follows in a separate PR. ## Model Used - Anthropic Claude Opus 5.5 (`claude-opus-5-5`), via Claude Code with tool use. ## Checklist - [x] I have included a thinking path that traces from project context to this change - [x] I have specified the model used (with version and capability details) - [x] I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work - [x] I have searched GitHub for duplicate or related PRs and linked them above - [x] I have either (a) linked existing issues with `Fixes: #` / `Closes #` / `Refs #` OR (b) described the issue in-PR following the relevant issue template - [x] I have not referenced internal/instance-local Paperclip issues or links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip` URLs) - [x] My branch name describes the change (e.g. `docs/...`, `fix/...`) and contains no internal Paperclip ticket id or instance-derived details - [x] I have run tests locally and they pass - [x] I have added or updated tests where applicable - [x] I have updated relevant documentation to reflect my changes - [x] I have considered and documented any risks above - [ ] All Paperclip CI gates are green - [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups - [x] I will address all Greptile and reviewer comments before requesting merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
121 lines
4.6 KiB
TypeScript
121 lines
4.6 KiB
TypeScript
import { randomUUID } from "node:crypto";
|
|
import type { createDeliveryWorkCoordinator } from "./delivery-work-coordinator.js";
|
|
import { DELIVERY_QUEUES } from "./delivery-work-notifications.js";
|
|
|
|
export type TaskDrainState = { startedAt: Date; expiresAt: Date | null; ownerId?: string };
|
|
let taskDrainState: TaskDrainState | null = null;
|
|
const expiryListeners = new Set<() => void>();
|
|
const changeListeners = new Set<() => void>();
|
|
|
|
function notifyDrainChanged() {
|
|
for (const listener of changeListeners) listener();
|
|
}
|
|
export function subscribeTaskDrainChanges(listener: () => void) {
|
|
changeListeners.add(listener);
|
|
return () => { changeListeners.delete(listener); };
|
|
}
|
|
export function subscribeTaskDrainExpiry(listener: () => void) {
|
|
expiryListeners.add(listener);
|
|
return () => { expiryListeners.delete(listener); };
|
|
}
|
|
|
|
// The shared coordinator owns this process-local deadline and its shutdown.
|
|
// Reading admission can also establish expiry, so both paths notify the same
|
|
// listener. No database scan or recurring timer is needed while idle.
|
|
export function registerTaskDrainExpiryWork(
|
|
coordinator: ReturnType<typeof createDeliveryWorkCoordinator>,
|
|
onExpired: () => void,
|
|
) {
|
|
const worker = coordinator.register(DELIVERY_QUEUES.taskDrainExpiry, {
|
|
retryMs: 1000,
|
|
runDuringDrain: true,
|
|
run: async () => { readTaskDrain(new Date()); },
|
|
hasPending: async () => false,
|
|
nextRunAt: () => taskDrainState?.expiresAt?.getTime() ?? null,
|
|
});
|
|
expiryListeners.add(onExpired);
|
|
changeListeners.add(worker.wake);
|
|
return {
|
|
ready: worker.ready,
|
|
async stop() {
|
|
changeListeners.delete(worker.wake);
|
|
expiryListeners.delete(onExpired);
|
|
await worker.stop();
|
|
},
|
|
};
|
|
}
|
|
|
|
// Set while this server cannot renew its controller instance lease: it stops
|
|
// dispatching new work until the lease is renewed (or it exits). It never
|
|
// replaces an operator's drain and has no idle owner, so HTTP stays open.
|
|
let controllerLeaseQuiesce: TaskDrainState | null = null;
|
|
export function setControllerLeaseQuiesce(quiesced: boolean): void {
|
|
if (quiesced === (controllerLeaseQuiesce !== null)) return;
|
|
controllerLeaseQuiesce = quiesced ? { startedAt: new Date(), expiresAt: null } : null;
|
|
notifyDrainChanged();
|
|
}
|
|
|
|
export function readTaskDrain(now: Date): TaskDrainState | null {
|
|
if (taskDrainState?.expiresAt && taskDrainState.expiresAt.getTime() <= now.getTime()) {
|
|
taskDrainState = null;
|
|
for (const listener of expiryListeners) {
|
|
try { listener(); } catch (error) { process.emitWarning(`Task drain expiry notification failed: ${String(error)}`); }
|
|
}
|
|
}
|
|
return taskDrainState ?? controllerLeaseQuiesce;
|
|
}
|
|
|
|
export function computeTaskDrain(opts: { ttlMs?: number | null; purpose?: "idle" } = {}): TaskDrainState {
|
|
const startedAt = new Date();
|
|
return { startedAt, expiresAt: opts.ttlMs == null ? null : new Date(startedAt.getTime() + opts.ttlMs),
|
|
...(opts.purpose === "idle" ? { ownerId: randomUUID() } : {}) };
|
|
}
|
|
|
|
export function applyTaskDrain(drain: TaskDrainState): void {
|
|
taskDrainState = drain;
|
|
notifyDrainChanged();
|
|
}
|
|
export function startTaskDrain(opts: { ttlMs?: number | null; purpose?: "idle" } = {}): TaskDrainState {
|
|
const drain = computeTaskDrain(opts);
|
|
applyTaskDrain(drain);
|
|
return drain;
|
|
}
|
|
export function stopTaskDrain(): { wasActive: boolean } {
|
|
const wasActive = readTaskDrain(new Date()) !== null && taskDrainState !== null;
|
|
taskDrainState = null;
|
|
notifyDrainChanged();
|
|
return { wasActive };
|
|
}
|
|
export function isIdleTaskDrainActive(): boolean { return Boolean(readTaskDrain(new Date())?.ownerId); }
|
|
|
|
// Tokens count work until its actual promise settles, including after HTTP
|
|
// disconnects and after a cleanup batch has been removed from its input queue.
|
|
// The generation also catches work which starts AND finishes during a scan.
|
|
let generation = 0;
|
|
let active = 0;
|
|
const settledListeners = new Set<() => void>();
|
|
/** Called (synchronously) whenever the last tracked work finishes. */
|
|
export function subscribeIdleWorkSettled(listener: () => void): () => void {
|
|
settledListeners.add(listener);
|
|
return () => { settledListeners.delete(listener); };
|
|
}
|
|
export function beginIdleTrackedWork(): () => void {
|
|
generation++;
|
|
active++;
|
|
let finished = false;
|
|
return () => {
|
|
if (finished) return;
|
|
finished = true;
|
|
active--;
|
|
generation++;
|
|
if (active === 0) for (const listener of settledListeners) {
|
|
try { listener(); } catch { /* a listener never blocks work accounting */ }
|
|
}
|
|
};
|
|
}
|
|
export function trackIdleWork<T>(work: Promise<T>): Promise<T> {
|
|
const finish = beginIdleTrackedWork();
|
|
return work.finally(finish);
|
|
}
|
|
export function idleWorkSnapshot() { return { generation, active }; }
|