Preserve transport truth and batch attributed requests - #749
Open
tony wants to merge 8 commits into
Open
Conversation
tony
force-pushed
the
engine-ops-hardening
branch
from
August 23, 2026 01:21
d6347b9 to
1f7c749
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## engine-ops-on-seam #749 +/- ##
======================================================
+ Coverage 72.50% 73.56% +1.05%
======================================================
Files 171 172 +1
Lines 11469 11809 +340
Branches 1821 1898 +77
======================================================
+ Hits 8316 8687 +371
+ Misses 2490 2449 -41
- Partials 663 673 +10 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
tony
force-pushed
the
engine-ops-hardening
branch
from
August 23, 2026 13:31
80c20ae to
8389250
Compare
tony
force-pushed
the
engine-ops-hardening
branch
from
August 23, 2026 15:35
8389250 to
65304a8
Compare
tony
force-pushed
the
engine-ops-hardening
branch
from
August 23, 2026 15:58
65304a8 to
9a33450
Compare
why: Direct argv parsing, pinned server scope, control-mode correlation, and async subprocess cleanup could misroute commands, misattribute results, leak process resources, or leave pane output encoded. what: - Protect literal semicolons and reject incompatible engine connections - Correlate control replies without treating guard-shaped output as protocol - Drain and reap async children through cancellation and reader failures - Expose decoded pane-output bytes to control-mode consumers
why: Semicolon folding erased control-mode reply boundaries, reported failures against the wrong operations, and borrowed tmux's server-global marked pane. what: - Replace folded command strings with ordered batches of distinct requests - Validate planner partitions, dependency boundaries, and result cardinality - Snapshot in-flight plans and bindings across sync and async execution - Make workspace, fluent, query, docs, and CLI surfaces use batching vocabulary
why: Adapter lifespans did not distinguish borrowed from owned engines, and a second cancellation or close failure could strand resources or mask the body exception. what: - Model engine ownership and close only adapter-owned instances - Shield one close task through repeated cancellation with stable precedence - Align plan preview and execution defaults on the batching planner - Cover concurrent clients, borrowed engines, and close-error propagation
why: The earlier workload could not measure planner batching and conflated planner steps, engine calls, tmux requests, and transport process models. what: - Add session x window x pane scenarios with verified live postconditions - Report planner, request, engine-call, and process-model quantities separately - Mark historical timings stale until regenerated with the current workload - Add lossless source-scroll and bounded-overload async control demos
why: Sync warmup checked the full expected session set from inside the per-session build loop, so it validated every requested name after building only the first one. Every multi-session scenario aborted after its first build, which took valid hierarchy benchmarks down with it. what: - Build every warmup session before topology verification, and clean the set only once it passes - Cover it through the public matrix command, requiring a clean exit, so the regression is pinned at the surface a user actually invokes
why: The script carries a `uv run --script` shebang but shipped without the executable bit, so the shebang was misleading: the one invocation it advertises could not work. ruff's EXE001 catches exactly this, and CI runs on Linux where the rule applies -- it is skipped on Windows and WSL, so a developer working there cannot see it locally. what: - Record the file as mode 755, matching the other runnable scripts
… it does not `scripts/bench/primitives.py` exists so a benchmark need not carry its own copy of the isolation, naming, and statistics helpers. The grid carried both: a second hermetic-isolation routine is exactly the case that module was extracted to prevent, since each copy is free to forget one of the tmux behaviours the other encodes -- which is how they came to disagree about `config_file` in the first place. Delegated because they are equivalent once the private-name prefix is normalised: `new_server`, `uniq`, `percentile`, `summarize`, `STAT_LABELS`, and the scratch-directory machinery behind them. Kept local because they are not the same function: - `build_classic` applies `BENCH_OPTIONS`, which exists to hold this grid's cells steady and means nothing to a benchmark that does not have cells. - `parse_shape` here accepts the multi-session `SxWxP` scenarios this grid sweeps and rejects the rest; the shared one parses the two-axis `WxP` its own callers use. `reap_stale_scratch` returns a count rather than printing one, because a module with no console cannot decide how a caller reports; the grid does that with the console it already had. Verified: `contract` reports parity with exit 0, the script's tests pass, and a `classic,mock` grid builds and reports percentiles through the shared helpers.
…ripts Both cover `scripts/`, so they belong beside the other script tests rather than in the library's half of the `tests/` namespace. Their repository-root lookups count directories, and the counts move with them. One stale path travelled with them. The commit that moved the grid to `scripts/bench/engines.py` sits a branch below, but a later commit here adds a test that spawns the grid by path and was written against the old spelling, so it named a file that no longer exists. It ran `uv run scripts/bench_engines.py` and failed to spawn. That is the shape of this whole change: a path written down in one place and not the other. The mirrored layout is what makes the pairing checkable -- a test under `tests/scripts/bench/` has exactly one script it can be about.
tony
force-pushed
the
engine-ops-hardening
branch
from
August 23, 2026 18:09
9a33450 to
552ac5e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes by area
Transports
src/libtmux/_internal/tmux_argv.py,engines/connection.py: protect literal semicolons and reject incompatible engine connections.experimental/engines/control_mode.py: correlate replies without treating guard-shaped output as protocol.experimental/engines/async_control_mode.py,asyncio.py: drain and reap async children through cancellation and reader failures.pane.py,experimental/mcp/events.py: expose decoded pane-output bytes to control-mode consumers.Planner
experimental/ops/: ordered batches of distinct requests in place of folded command strings, with planner partitions, dependency boundaries, and result cardinality validated. In-flight plans and bindings are snapshotted across sync and async execution.MCP lifespan
experimental/mcp/: model engine ownership and close only adapter-owned instances, shielding one close task through repeated cancellation with stable precedence.Benchmark matrix
Design decisions
Batches, not folded strings. Folding several commands into one semicolon-separated string erases control-mode's reply boundaries: the transport returns output with no way to say which command produced which part, so a failure gets reported against the wrong operation. Ordered batches keep one request per result.
Close only what you own. An adapter handed an engine by its caller must not close it — the caller may still be using it. Ownership is now modelled explicitly rather than inferred from who happened to construct it.
Warmup completes before it is checked. Verifying the full expected topology from inside the per-session build loop asserts a postcondition that cannot hold until the loop finishes, so every multi-session scenario failed on its first build.
Test plan
uv run ruff check .— lint cleanuv run ruff format .— formatting clean, tree unchangeduv run mypy— types cleanuv run pytest --reruns 0— see the note belowjust build-docs— docs build cleantests/test_server.py::test_new_session_shell_envfails from a shell whose environment exceeds tmux's command-length limit; it is unrelated to this branch and is fixed higher in the stack.