Repository navigation
Conversation
…e instance lock Initialize complete private authority generations behind a durable active selector. Reconcile interrupted initial publication with exact IDs and trust, and preserve/refuse malformed or unreferenced saved state. Use native write-through publication on Windows. Hold the existing persistent authority lock for the actual ASGI lifetime through HTTP cleanup so offline setup and competing starts cannot write concurrently. Keep runtime API authentication and later restore/undo behavior in their planned slices. Validation: 1280 Python unit tests passed on native Python and Python 3.10, 13 platform skips each; Black/Pyrefly, Go tests/vet and website build passed. Real killed-process, orphan preservation and directory-flush failure probes cover publication recovery. DBB code review and independent full local review are clean. Native Windows x64 and ARM64 CI remains required on the published head.
omry
added this pull request to stack #43
October 20, 2026 20:03
CI failed: 14 Windows unit tests fail in both Windows CI jobs because the server's authority directory ACL check rejects the Owner Rights (S-1-3-4) ACE during startup; the relationship to this PR is unclear since only title and diff stats were provided, and the authority.py change overlaps the failing area.OverviewTwo unique error templates from 2 logs (Windows arm64 and Windows x64 unit runs, jobs 118855854845 and 118855854709). Both show the same 14 failing unit tests and the same root cause, so this is one failure pattern. Overall assessment: a real, deterministic Windows-only startup failure, not a flake. FailuresAuthority directory ACL rejected on Windows startup (confidence: high)
Summary
Code Review ✅ Approved🔴 High risk · Publishing and reconciling authority generations changes persistent identity and trust state; a selector or recovery error could compromise server identity. Publishes initial private authority generations behind a durable active selector, reconciles interrupted publication, and holds the persistent authority lock for the full ASGI lifetime through HTTP cleanup. No issues found. VerificationRules No rules evaluated Functional validation Not enabledFor more verification details, comment Tip Comment OptionsAuto-apply is off → Gitar will not commit updates to this branch. Comment with these commands to change the behavior for this request:
Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source |
Owner
Author
|
PR-cycle state — maintained automatically. Do not edit by hand. Mechanical PR-cycle state (JSON){
"check_observations": [
{
"checks": [
{
"conclusion": "SUCCESS",
"name": "Gitar",
"run_id": 118855856744,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/runs/118855856744"
},
{
"conclusion": "SUCCESS",
"name": "Platform Linux arm64",
"run_id": 118855854528,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854528"
},
{
"conclusion": "SUCCESS",
"name": "Platform Linux x64",
"run_id": 118855854558,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854558"
},
{
"name": "Platform Windows arm64",
"run_id": 118855854845,
"run_status": "in_progress",
"status": "pending",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854845"
},
{
"conclusion": "FAILURE",
"name": "Platform Windows x64",
"run_id": 118855854709,
"run_status": "completed",
"status": "failure",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854709"
},
{
"name": "Platform macOS arm64",
"run_id": 118855854634,
"run_status": "in_progress",
"status": "pending",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854634"
},
{
"name": "Platform macOS x64",
"run_id": 118855854517,
"run_status": "in_progress",
"status": "pending",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854517"
},
{
"conclusion": "SUCCESS",
"name": "Python 3.10",
"run_id": 118855854581,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854581"
},
{
"conclusion": "SUCCESS",
"name": "Python 3.11",
"run_id": 118855854208,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854208"
},
{
"conclusion": "SUCCESS",
"name": "Python 3.12",
"run_id": 118855854000,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854000"
},
{
"conclusion": "SUCCESS",
"name": "Python 3.14",
"run_id": 118855854677,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854677"
},
{
"conclusion": "SUCCESS",
"name": "Python lint",
"run_id": 118855853754,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855853754"
},
{
"conclusion": "SUCCESS",
"name": "Website",
"run_id": 118855854028,
"run_status": "completed",
"status": "success",
"url": "https://github.com/omry/arbiter/actions/runs/39488728452/job/118855854028"
}
],
"head_sha": "8e6b2f511ad4af378011ab5b2dbdba0463f60e2b",
"id": "sha256:69ea1cb85f6b90813e6ea73c091e09622b16f8bbfd2d719f4252247fe410b9bd",
"required_checks": [
"Gitar",
"Platform Linux arm64",
"Platform Linux x64",
"Platform Windows arm64",
"Platform Windows x64",
"Platform macOS arm64",
"Platform macOS x64",
"Python 3.10",
"Python 3.11",
"Python 3.12",
"Python 3.14",
"Python lint",
"Website"
],
"status": "failure"
}
],
"delivery_deferrals": [],
"findings": [
{
"disposition": "fix-current-slice",
"evidence": [
"/tmp/arbiter-auth-m1-run_4k366kj4pkc87k47vavsr5n9m0/pr48-ci-finding1.json",
"/tmp/arbiter-auth-m1-run_4k366kj4pkc87k47vavsr5n9m0/pr48-windows-x64-round1.log"
],
"id": "CI-48-001",
"rationale": "Exact-head Windows x64 CI proves14 real-lifespan tests lack required private inheritable test-parent ACL fixture. Add only existing fixture to four functions; preserve production validator and all assertions.",
"severity": "medium",
"source_surface": "required-check",
"status": "accepted"
},
{
"disposition": "fix-current-slice",
"evidence": [
"https://raw.githubusercontent.com/Kludex/uvicorn/0.30.0/uvicorn/server.py",
"server/src/arbiter_server/main.py:_run_server/_run_serve"
],
"id": 4329845283,
"rationale": "Confirmed supported Uvicorn0.30 Server.run/_serve returns normally on failed lifespan. Existing wrapper unconditionally returns success. Startup must refuse busy/damaged authority with nonzero CLI outcome. Use public Config/Server.started and explicit failure without changing dependency floor or authority policy.",
"severity": "high",
"source_review_id": 5591167300,
"source_surface": "review-comment",
"source_url": "https://github.com/omry/arbiter/pull/48#discussion_r4329845283",
"status": "accepted",
"thread_id": "PRRT_kwDOSmRaHM6ugfRD"
}
],
"pr": {
"base_ref": "pr47",
"base_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
"body_digest": "sha256:39181db4eea49c6b467ea63992072f70e503d7190841d4660d2c9e3c6c75a2b1",
"diff_digest": "sha256:3cf670bb81a3c33d6ae9f990606d7c2916bf10993a81f3cee13a7ba51fa1ab8c",
"head_ref": "pr48",
"head_sha": "8e6b2f511ad4af378011ab5b2dbdba0463f60e2b",
"pr": 48,
"repository": "omry/arbiter",
"scope_authority": [
{
"digest": "sha256:b6511414b3a9b485542df83c8f7abfc499dc8d06e522819b48e162a562d21c57",
"path": "docs/authentication/high-level-design.md"
},
{
"digest": "sha256:c576091af919c3ec99f0e0edb5795cf4e7bd37a44415ae24742393822317ad3d",
"path": "docs/authentication/implementation-plan.md"
},
{
"digest": "sha256:d56e92a7cb01f131ba499650c4a5d7b2c8d17adf2cdc7d612eee7c5f53d07929",
"path": "docs/authentication/requirements.md"
}
],
"title_digest": "sha256:fcdbab514b41f6fc37bfc5f30c1e07af540bee97ddde478df32dfcfef800e8d3"
},
"record_version": 2,
"review_observations": [],
"review_requests": [
{
"base_established_at": "2026-10-20T20:03:31Z",
"base_ref": "pr47",
"base_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
"body_digest": "sha256:ab1f212a0746e8f125e80eb908360de556b92f9c483e078f5b2c824cad386df5",
"created_at": "2026-10-20T20:11:45Z",
"head_sha": "8e6b2f511ad4af378011ab5b2dbdba0463f60e2b",
"id": 6300445056,
"kind": "regular-review"
}
],
"review_results": [
{
"base_ref": "pr47",
"base_sha": "823f498776bb9e7a8799e7518929f4470ad65a19",
"body_digest": "sha256:2d9fca465bd492488d977870e1819cdada8c2fd3f7d80bc6cd6cac059fe7fae8",
"commit_id": "8e6b2f511ad4af378011ab5b2dbdba0463f60e2b",
"id": 5591167300,
"inline_message_ids": [
4329845283
],
"request_comment_id": 6300445056,
"result_kind": "findings",
"status": "result",
"submitted_at": "2026-10-20T20:18:20Z",
"unresolved_thread_ids": [
"PRRT_kwDOSmRaHM6ugfRD"
]
}
],
"revision_fingerprint": "sha256:c7bcc076eeda5d8d2ff6318becbf5ea8e2fc4ab5fec466e82469d8e504b5926d",
"rounds": [],
"schema": "awd:swe:pr-cycle-state",
"version": 2
} |
omry
marked this pull request as ready for review
October 20, 2026 20:09
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Owner
Author
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8e6b2f511a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Initialize complete private authority generations behind a durable active selector. Reconcile interrupted initial publication with exact IDs and trust, and preserve/refuse malformed or unreferenced saved state. Use native write-through publication on Windows.
Hold the existing persistent authority lock for the actual ASGI lifetime through HTTP cleanup so offline setup and competing starts cannot write concurrently. Keep runtime API authentication and later restore/undo behavior in their planned slices.
Validation: 1280 Python unit tests passed on native Python and Python 3.10, 13 platform skips each; Black/Pyrefly, Go tests/vet and website build passed. Real killed-process, orphan preservation and directory-flush failure probes cover publication recovery. DBB code review and independent full local review are clean. Native Windows x64 and ARM64 CI remains required on the published head.