fix(jobs): harden resume locks and durability

2026-07-12 04:05:43 +02:00
parent a4acee4c70
commit 9f069cdd5b
6 changed files with 348 additions and 24 deletions
@@ -55,3 +55,33 @@ tests; no Task 4 file is among them. L2 tests remain deselected by the repositor
  `JobContext.run_dir` for staging and perform their own final atomic publish only after validation.
 - A dry run is an execution mode foundation: the runner exposes and records it; individual stages
  remain responsible for suppressing external mutations.
+
+## Review hardening follow-up
+
+Four post-implementation findings were fixed test-first:
+
+1. Resume compatibility is now a canonical SHA-256 fingerprint over checkpoint schema version,
+   hashed workspace identity, job type, dry-run mode, explicit spec/pipeline versions,
+   configuration/input fingerprints, and the exact ordered explicit `stage_ids`. Any insertion,
+   removal, reorder, mode, identity, version, config, or input change rejects resume before a stage
+   executes. Omitting `resume_run_id` remains the explicit safe path for a new run.
+2. Lock traversal now uses directory file descriptors with `O_DIRECTORY` and `O_NOFOLLOW`.
+   Lock files use `O_NOFOLLOW | O_CLOEXEC`; `fstat` requires a regular file owned by the current
+   UID with one link, and permissions are forced to `0600` (`0700` for private directories).
+   Pre-existing lock-file and lock-directory symlinks are rejected.
+3. Stage failures now serialize only the fixed safe tuple `internal` / `stage_exception` /
+   `stage execution failed`. Neither exception class names nor messages are inspected for output;
+   a hostile exception-name/message regression test proves a terminal failed report is retained.
+4. Job/run directory creation is no-follow, owner-checked, private, and durable. Each newly created
+   parent is fsynced, the run directory is fsynced before the first atomic file write, and the
+   existing file-fsync → replace → directory-fsync ordering has an explicit regression test.
+
+Follow-up verification:
+
+```text
+focused job/lock suite: 27 passed in 0.45s
+full harness suite: 613 passed, 5 deselected, 17 warnings in 29.65s
+Task 4 scoped Ruff: All checks passed
+```
+
+Repository-wide Ruff continues to report the same 34 unrelated pre-existing legacy-test findings.