Repository navigation
fix(managed-agent): verify ambiguous Linux workspace birth times - #14505
yiliang114 wants to merge 5 commits into
Conversation
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
Verification reportThe candidate permits an ambiguous Linux Workspace birth time only when native device, inode and full nanosecond birth evidence match. This report records narrow remote observations; full registration and Hosted acceptance remain unverified.
中文验收记录实际远程证据限于解析器与文件系统探测：Darwin/JDK 21 上逐字提取的候选解析逻辑 10/10 通过；Linux 原生 stat 观察到出生时间与 mtime 相等，实际输出可被该解析器接受。设备号、inode、纳秒及不可用/畸形证据均拒绝。 后续实际 Linux/JDK 21 原生方法检查 8/8 通过，验证了 NIO/stat 纳秒一致性、真实 Java 子进程调用与身份不匹配拒绝。完整 Workspace/JDBC 注册、目录替换保护回归、MySQL、公开创建/Turn/关闭和 Hosted 验收均未执行，没有运行本地 build。集中源码审查与 ponytail 无阻塞，完整静态 gate 已结束，没有阻塞问题。不能将这些窄范围证据写成生产链路验收通过。 Retained observation record{
"provenance": "Retained test-engineer report from this task. It is an observation record, not a full module or Hosted acceptance log.",
"candidate_source_sha256": "cfc797960337a88e22c0598a8999e45695d4be29fd7d4a0b80c21bb31bcdded2",
"extracted_formatter_and_method_sha256": "fe3b5c4353aa31fd05c30ae4106c38f15d2e7f1842c94567633e2b21564652d7",
"harness_sha256": "e26f5b38ab35429012f369aad17ddd7283e599301ed15ed59147db2efd9d3e51",
"remote_java_environment": "codex-macmini, Darwin, OpenJDK 21.0.12.1",
"method": "Formatter and verifiedNativeBirthTime copied verbatim into temporary remote Java harness",
"results": {
"passed": 10,
"failed": 0,
"stdout_final": "RESULT 10/10 passed",
"ssh_exit": 0
},
"cases": [
"matching nine-digit nanoseconds",
"different device refused",
"different inode refused",
"same-second different nanos refused",
"unknown birth refused",
"invalid calendar date refused",
"extra field refused",
"missing field refused",
"epoch refused",
"actual Linux GNU stat output accepted"
],
"linux_probe": {
"environment": "qwenbot Linux Python3/GNU stat, no JDK on PATH",
"before": "66307|14656098|2026-10-17 17:32:15.448074816 +0000|2026-10-17 17:32:15.448074816 +0000",
"after_marker_and_forced_equal_mtime": "66307|14656098|2026-10-17 17:32:15.448074816 +0000|2026-10-17 17:32:15.448074816 +0000",
"ssh_exit": 0,
"cleanup": "temporary directory deleted"
},
"limits": [
"Darwin parser10/10 and Linux native-method8/8 are distinct evidence",
"Full WorkspaceStorageGuard registration/JDBC/root replacement/module/MySQL/Hosted acceptance NOT RUN",
"No local build/test/install or deployment change",
"Remote probe source/log directories were removed; retained observations are not a full raw module archive"
],
"linux_jdk_preflight": {
"result": "environment-blocked",
"host": "qwenbot",
"host_standard_jvm_paths": "No java/javac under /usr/lib/jvm or /opt within bounded search",
"existing_image": "qwen4-allcase-tools:20261014 checked once with --pull=never --network=none --read-only; no Java/Javac",
"changes": "No install, pull or host/service change",
"acceptance": "Linux NIO -> ProcessBuilder registration path remains UNVERIFIED"
},
"native_linux_verification": {
"provenance": "Actual read-only test-engineer run on qwenbot, retained observation report",
"result": "8/8 passed; remote exit 0",
"java": "Temurin21.0.12.1+1-LTS, Linux x86_64",
"jdk_path": "/tmp/qwen-managed-jdk21-TMtjIo/jdk",
"official_release": "https://github.com/adoptium/temurin21-binaries/releases/tag/jdk-21.0.12.1%2B1",
"jdk_archive_sha256": "ce79869e1307ed8ee1e2baa86a412b1eb5b75d10a01006d788a6f968bcfaee94",
"official_checksum": "verified before Java execution",
"candidate_source_sha256": "cfc797960337a88e22c0598a8999e45695d4be29fd7d4a0b80c21bb31bcdded2",
"exact_members": [
"LINUX_BIRTH_TIME_FORMAT",
"linuxBirthTime",
"verifiedNativeBirthTime",
"verifiedBirthTime"
],
"extracted_members_sha256": "f58cfeb3d273b1413964ac55a857a718ed77899a5f9306d78b18abbe82197b8f",
"harness_sha256": "b08b5bffba69702238ed37f95c14d3ae0785950ed25f2ecc33a388adc8ff7ea2",
"mkdir": {
"dev": "66307",
"ino": "39780184",
"nio_creation": "2026-10-17T18:30:49.571592795Z",
"nio_modified": "2026-10-17T18:30:49.571592795Z",
"stat": "66307|39780184|2026-10-17 18:30:49.571592795 +0000"
},
"after_marker": {
"nio_creation": "2026-10-17T18:30:49.571592795Z",
"nio_modified": "2026-10-17T18:30:49.588592805Z"
},
"forced_equal": {
"nio_creation": "2026-10-17T18:30:49.571592795Z",
"nio_modified": "2026-10-17T18:30:49.571592795Z"
},
"checks": [
"actual NIO dev/ino/nanos match stat",
"natural equal timestamps accepted",
"marker preserves birth",
"marker state accepted",
"forced equality read back",
"real ProcessBuilder equal case accepted",
"wrong dev refused",
"wrong inode refused"
],
"limits": [
"Exact methods only; no WorkspaceStorageGuard JDBC registration",
"No full marker/root replacement/module/MySQL/Hosted acceptance",
"One Linux/JDK/filesystem combination only"
],
"cleanup": "Only verified named JDK cache retained; harness and temporary roots removed; no host configuration or local build"
}
}Candidate and reviewCommit: 提交为 |
yiliang114
added
the
autofix/takeover
|
🤝 Takeover engaged: the autofix loop now manages this PR — it will address new review feedback and resolve base conflicts until the label is removed or the round cap is reached. Remove the 中文说明🤝 已接管：autofix 循环现在管理此 PR —— 将持续处理新的评审反馈与 base 冲突，直到移除标签或达到轮次上限。移除 |
|
🔀 Base updated: red check(s) [web-shell E2E Smoke (ubuntu-latest, Node 22.x)] pass on current main — merged current main via update-branch; CI will re-run. 中文说明🔀 已更新 base：红色检查 [web-shell E2E Smoke (ubuntu-latest, Node 22.x)] 在当前 main 上通过 —— 已通过 update-branch 合入当前 main，CI 将重新运行。 |
… lock-order audit (#14505) #14461 added hasLiveTurn and markTurnRecoveryBlocked to ManagedAgentStore without updating the pinned turn-row accessor set in SessionRowLockOrderTest, so the exact-set assertion fails on any tree containing both — including this PR's merge commit, whose fast tier is red because of it. hasLiveTurn is a read-only helper and markTurnRecoveryBlocked is fenced by the live dispatch lease rather than the session-row lock, and the audit finds no lock-ordering violation in either, so both belong in the pinned accessor set.
|
CI triage for head Both the store and this audit test are byte-identical to the merge’s main parent The takeover bot is already active, so this records the diagnosis for its repair rather than starting a concurrent push. Failing job. No local build was run. 中文说明当前 head 的 Java 快速检查执行 4,580 项测试，只有一项失败：锁顺序审计发现实际访问器集合多了 store 和审计测试与合入的 main 父提交 该 PR 已有活跃 takeover bot，此评论记录定位，供同一个修复执行者处理，避免并行推送。没有运行本地 build。 |
|
🤖 Addressed the latest review feedback (round 1/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 1/100 轮）。改动内容与我反驳保留之处如下： Autofix round summary — PR #14505Feedback dispositions
Root cause of the red checksThe fast tier's Change (1 commit, +4/−1)
Conflict notesNone. Local-environment caveatsThis sandbox lacks Verification
中文说明Autofix 本轮总结 — PR #14505反馈处置
检查变红的根因fast tier 在 本次修改（1 个提交，+4/−1）
冲突说明无。本轮 本地环境注意事项本沙箱缺少 验证记录
Base-conflict check · 基分支冲突检查: no conflict with main. · 与 main 无冲突。 Re-review when you have a moment. After round 100 this bot stops and leaves the PR for a human. · 有空请复审；第 100 轮后本 bot 停止并将 PR 交给人工。 🧠 Handled by Qwen Code · model/模型 |
…e-birth-time # Conflicts: # packages/managed-agent-server/src/test/java/com/alibaba/qwen/code/managedagent/store/SessionRowLockOrderTest.java
|
🤖 Addressed the latest review feedback (round 2/100). What changed, and what I pushed back on: · 已处理最新评审反馈（第 2/100 轮）。改动内容与我反驳保留之处如下： Autofix round summary — PR #14505Feedback triage[ic:6242075835] CI triage:
|
This branch has not been deployed
2 participants
What this PR does
Allows a newly created Linux Workspace root to register when its storage marker is published in the same filesystem clock tick. Ambiguous creation timestamps are accepted only when GNU stat confirms the same device, inode and full nanosecond birth time.
Why it's needed
The JDK can substitute mtime when birth time is unavailable, so the existing guard rejects equal creation and modification times. A real birth time can also equal mtime immediately after directory creation. The marker publication can therefore reject a valid production Workspace. This change preserves refusal when native birth evidence is missing or inconsistent, without sleeps or timestamp mutation in the identity reader.
Reviewer Test Plan
How to verify
On Linux with JDK 21 and filesystem birth-time support, verify that a registered root remains valid when its mtime is explicitly restored to its real birth time, including after constructing a second guard. Later mtime changes must remain valid, while marker tampering and a replacement directory carrying a copied marker must still be refused. Exercise public Workspace creation, a bounded Turn and close on the same build before accepting the user-facing fix.
Evidence (Before & After)
The issue's original Linux failures are reporter evidence. The added native regression forces and reads back an equal birth-time/mtime pair: the previous guard rejects that state, while the candidate requests exact native evidence. The complete regression has not been executed in this worktree.
A remote Linux filesystem probe observed a real new directory with equal birth time and mtime, retained that equality after marker publication, and supplied its actual GNU stat output to the candidate's verbatim extracted parser on remote Darwin JDK 21. The parser harness passed 10/10 cases, including device/inode/nanosecond mismatches, unknown birth time, malformed output, invalid calendar date and epoch refusal. A separate actual Linux x86_64 Temurin 21.0.12.1 run then executed the exact candidate birth-time methods: 8/8 assertions passed, including natural and forced equal timestamps, Java NIO/GNU stat nanosecond agreement, real ProcessBuilder execution and mismatched device/inode refusal. The temporary JDK archive was verified against its official SHA256 before execution. Full JDBC registration, public-flow verification and screenshots remain unverified.
Completed static review of this exact candidate found no blocking issue. Formatting and whitespace checks passed for the changed documents and patch. No local Java/Maven/npm build was run, as requested. Full module, Linux/MySQL and Hosted acceptance are pending.
Tested on
Environment (optional)
Existing remote Linux host with a temporary checksum-verified official Temurin 21 JDK, plus remote macmini JDK 21. Temporary probe directories were removed; the verified named Linux JDK cache is retained for this active acceptance work. No services or deployment were modified.
Risk & Scope
/usr/bin/stat, with a five-second process budget and a 256-byte output limit. Missing executables or unavailable birth time continue to fail closed. Some identity checks run while authority locks are held, as with existing filesystem/marker reads and the macOS helper; the additional ambiguous-Linux probe latency has not been measured under contention.Design: English, 简体中文.
Linked Issues
Fixes #14453
Refs #12380
中文说明
本 PR 的改动
允许新建 Linux Workspace 根目录在存储 marker 与目录创建发生于同一文件系统时钟 tick 时完成注册。只有 GNU stat 确认 device、inode 以及精确至纳秒的出生时间均相同时，才接受存在歧义的创建时间。
修改原因
缺少出生时间时，JDK 可能使用 mtime 替代，因此原有 guard 拒绝创建时间与修改时间相等的目录。真实出生时间在新建目录时也可能等于 mtime，导致发布 marker 时拒绝合法的生产 Workspace。本次在原生证据缺失或不一致时继续安全拒绝，不通过 sleep 或在身份读取器中修改时间戳绕过问题。
评审验证计划
验证方式
在支持文件系统出生时间的 Linux/JDK 21 上，将已注册根目录的 mtime 显式恢复为实际出生时间，再验证原实例和新 guard 实例均可接受该目录。后续 mtime 变化应继续允许；marker 篡改以及携带复制 marker 的替换目录应继续拒绝。用户可见修复验收还需在同一构建上完成公开 Workspace 创建、有界 Turn 和关闭流程。
修改前后证据
issue 中的原始 Linux 失败归属于报告者。新增原生回归用例会强制制造并读回出生时间与 mtime 相等的状态：旧 guard 拒绝该状态，候选实现则要求精确原生证据。本工作树尚未执行完整回归用例。
远程 Linux 文件系统探测观察到新目录的真实出生时间与 mtime 相等，发布 marker 后保留该相等状态，再将实际 GNU stat 输出交给远程 Darwin/JDK 21 上从候选代码逐字提取的解析器。解析检查 10/10 通过，包含 device、inode、纳秒不匹配、出生时间未知、格式错误、非法日期及 epoch 拒绝。另一次实际 Linux x86_64/Temurin 21.0.12.1 检查运行了逐字提取的候选出生时间方法，8/8 断言通过，覆盖自然及强制相等时间戳、Java NIO/GNU stat 纳秒一致性、真实 ProcessBuilder 调用以及 device/inode 不匹配拒绝。执行前已按官方 SHA256 校验临时 JDK 归档。完整 JDBC 注册、公开流程验收和截图仍未验证。
此精确候选的完整静态审查已结束，没有阻塞问题。变更文档的格式及补丁空白检查通过。按要求没有执行本地 Java/Maven/npm build；完整模块、Linux/MySQL 与 Hosted 验收仍待执行。
验证平台
环境
使用现有远程 Linux 主机与临时、经过官方校验的 Temurin 21 JDK，以及远程 macmini/JDK 21。临时探测目录已清理，保留具名且已校验的 Linux JDK 缓存用于当前验收工作，未修改服务或部署。
风险与范围
/usr/bin/stat，进程预算五秒、输出上限 256 字节。程序缺失或出生时间不可用时继续安全拒绝。部分身份检查会在持有权威锁时执行，与现有文件系统/marker 读取和 macOS helper 一致；新增 Linux 歧义探测在争用下的延迟尚未测量。设计：English、简体中文。
关联 Issue
Fixes #14453
Refs #12380