Repository navigation
Protect shell generation build leases through completed provider teardown #147
Description
Current state: upstream primitive Done/Passed from public Feedz 0.0.30-preview.162, merge 0f25bbac71a713cf93af728086ecc7b6517be24b; acceptance evidence. The execution notes below preserve the original integration plan. Mandatory Foundation #2164 consumer proof remains outstanding under open parent Feature #145 and final qualification #2509; closing this upstream task does not close that adoption requirement.
Outcome
An optional root-owned CShells build participant acquires protection before any catalog initialization/read, receives the exact selected detailed snapshot before feature construction, and keeps its lease through candidate creation, initialization, promotion, overlapping generations, drain and completed provider teardown.
Parent: #145
Program: elsa-workflows/elsa-foundation#2500
Project: https://github.com/orgs/elsa-workflows/projects/58
Approved additive contract
In Abstractions, namespace CShells.Lifecycle: immutable ShellGenerationBuildContext(ShellDescriptor Descriptor, ShellId ShellId), IShellGenerationBuildParticipant.BeginAsync(context, CancellationToken) returning a non-null IShellGenerationBuildLease, and lease OnSnapshotSelectedAsync(RuntimeFeatureCatalogSnapshot, CancellationToken) plus IAsyncDisposable.
Reserve a unique monotonic descriptor and immutable blueprint metadata before Compose. Compose and validate name, then Begin in registration order before EnsureInitialized or any catalog read. Reject generation exhaustion before narrowing to int. OnSnapshotSelected receives the exact detailed snapshot instance used by feature selection, once per reached lease, before any feature construction/configuration. Root DI participants are excluded from child copying. Same-name lifecycle reentry from callbacks is unsupported and documented; distinct names can proceed concurrently. No catalog/global lock surrounds user callbacks.
Use one small internal idempotent lease owner. Acquired leases transfer to Shell before initializer resolution. Release in reverse order only after confirmed provider teardown. Existing Disposed notification remains earlier; do not release there. Unpublished initializer failure performs existing partial provider cleanup without extra transitions/double disposal and returns an explicit teardown outcome.
If lifecycle notification or provider teardown fails, release no lease and strongly retain unresolved leases in a private synchronized collection owned by root-lifetime ShellRegistry, independent of slot history/Shell reachability. On lease release failure, attempt all remaining releases and retain failed leases only. No timeout, automatic retry or public recovery API. The collection itself must not retain the provider/Shell/snapshot; individual participants own any necessary external references. Retaining an object cannot undo arbitrary disposal side effects: implementers must keep external protection intact when their release fails. No pruning/unloading guarantee is implied.
Preserve original Begin/catalog/build/initializer/activation errors if cleanup fails; log cleanup without masking the primary error. On otherwise successful teardown aggregate release failures deterministically. Cleanup ignores an already-cancelled build token. Begin implementations clean their own partial acquisition when throwing before returning a lease. Maintain no-participant behavior and ordinary service lifetime semantics.
Required proof
Deterministic barriers for old snapshot selection followed by a new commit/all other old pins dropping before first initializer; candidate protection remains. Cover identity/metadata snapshot, acquisition/callback ordering, no Begin on composition/name mismatch, begin/catalog/callback/feature-build failure and cancellation, initializer cleanup success/failure, activation rollback primary-error preservation, reverse multiple cleanup faults, slow provider disposal with early Disposed event, provider/lifecycle failure strong-root retention after GC, distinct-name concurrency, root-only registration, overlapping old drain/new generation, and no-participant regressions. Use shared lifecycle fixtures where clear.
Mutation/revert: move lease release before blocked provider teardown; the central ordering test must fail, then pass after restoration. Focused tests, full upstream gates/current-head review, merge/main verification, exact preview identity and Foundation #2164 consumer proof are separate requirements; local checks do not satisfy release acceptance.
Execution
Prior local implementation is preserved at 8b22edc49cef02e8879bb669c6d28da181d3a7f5, branch 018-shell-generation-build-leases, checkout /tmp/hosting-cshells-generation, original combined prerequisite base 352a25ed1aa5af7ffed43c686591e8477e70cd83. Official Spec Kit 018 artifacts and earlier proof remain attributed to that source, not a future integrated head.
Ownership PR150 and catalog PR151 now merged normally into upstream main e172a3ae6a1e8454c813837f5a018e87e49acc7b; Packages37781957221 passed full build/test (690 library +31 end-to-end) and published all9 0.0.30-preview.161 packages. Root independently verified Feedz/pipeline archive identity, source/dependencies and three-framework assets. The actual public-package consumer passed on .NET8/9/10 with root-reviewed identity/disposal/commit assertions and root-recomputed source/cache/archive hashes; #144/#146 and their Features #140/#141 are closed Done/Passed. Prerequisites for this integration are satisfied.
Next action after prerequisite acceptance: preserve the qualified ref, normally merge actual upstream main into this branch without rewriting history, resolve registration/exclusion seams, inspect exact delta, run affected lease/ownership/catalog/blueprint proof plus production three-framework build, then publish a ready organization PR and converge exact-head review/CI. Review new introduced code against upstream style before submission. The old tests/packages do not qualify a changed integrated head.
Claim this issue before edits and recheck comments/open PRs before commit. Root owns integration and QA; exactly one product implementation leaf. Maintainer work uses organization branches without a Git-selection or local-preference gate. No Elsa policy, Nuplane deletion or actual assembly-unloading implementation is part of this task. Final release/adoption and Foundation #2164 proof remain separate requirements.
Activity
sfmskywalker commentedon Oct 8, 2026
Implementation started for Program elsa-workflows/elsa-foundation#2500; this is the single active product implementation leaf.
Lead-owned scope: this task's optional root build participant/lease contract, exact selected snapshot hook, actual teardown ordering, conservative framework rooting on cleanup failure, documentation and deterministic regression/mutation proof. Worker owns the bounded implementation; root reviews, integrates and verifies.
Exclusive worktree
/tmp/hosting-cshells-generation, local combined prerequisite base352a25e(ownership #144 and catalog #146; source main49c912633d968197ddd430c5bd826acd9cfcb15d). Spec Kit selects branch/spec 018. Previous leaves are locally reviewed, not merged/released. No Elsa policy, Nuplane pruning or assembly-unload edits here.The parent design gate is resolved by the approved task contract; detailed research is carried into Spec Kit. Push/PR remains pending the delivery conversation's repository-required Git/session preference. No implementation or release gate is claimed yet.
sfmskywalker commentedon Oct 8, 2026
Local implementation complete and root-reviewed: branch
018-shell-generation-build-leases, clean worktree/tmp/hosting-cshells-generation, commit8b22edc49cef02e8879bb669c6d28da181d3a7f5. Implementation claim is released; preserve this unpublished checkout/ref for qualification.Root reviewed production, public contract/docs and failure/race tests. Independent read-only review found no concrete blocker. Worker evidence: 21 focused lease tests; 66 existing focused lifecycle tests; net8/net9/net10 build with zero warnings/errors; whitespace check. Required mutation moved release to early Disposed notification and failed the slow-provider test, then passed after restoration. Generation exhaustion is tested at the pure boundary helper, not by forcing a live slot.
Root rebuilt and ran the complete combined CShells.Tests at the exact final commit: 696 passed, zero failed/skipped, Debug/net10. TRX:
/tmp/hosting-cshells-147-root-results/cshells-147-root.trx. Includes locally combined ownership/catalog prerequisites. Root GC review verified the retention test participant holds only WeakReference and the failed lease survives while Shell/provider collect. Machine load was high; no timing/performance conclusion is claimed.Task #147 and Feature #145 move to In Review. No push/PR, exact-head external CI/review, merge/main, preview release or Foundation adoption has happened. Git/session preference remains pending. No milestone is Done. CShells #148 becomes the only implementation leaf under startup Feature #143; it preserves routing visibility while waiting for activation settlement. Root retains integration/QA, Luna High delegate fallback.
sfmskywalker commentedon Oct 8, 2026
Integration implementation claim: root owns
/tmp/hosting-cshells-generation, branch018-shell-generation-build-leases, preserved qualified head8b22edc49cef02e8879bb669c6d28da181d3a7f5. Both prerequisites are merged/published and actual consumer qualified at preview161; #144/#146 Done/Passed. Scope: normally merge actual maine172a3a into147 without history rewriting, preserve registration state and build-participant injection/exclusions, resolve any source conflicts, apply introduced-code upstream style, inspect exact147delta, run lease+ownership+catalog+guard proof and three-framework build, then publish ready organization PR for exact-head review/CI. No competing claim/openPR found. This is the only active product implementation leaf;148/149 are a locally qualified buffer awaiting147integration. No Elsa policy or Nuplane prune/unload edits.sfmskywalker commentedon Oct 8, 2026
PR opened for review: #152, organization branch
018-shell-generation-build-leases, exact headfd6da4ac6f15ef55f8f0d2031373719b232a0e77.Root normally integrated actual ownership/catalog main
e172a3aat local merge5091ecb; the integration preserves the original #147 behavioral patch (identical stable patch-id). The follow-up changes only three files for introduced-code declaration style. Root inspected the full implementation and integration boundaries.Current-head local verification: Release net8/net9/net10 library build, zero warnings/errors; 76 focused lease/ownership/guard/catalog tests; complete CShells.Tests 711 passed, zero failed/skipped. Root causal mutation moved release ahead of provider disposal: the blocked-teardown test failed (expected zero releases, actual one); restoration passed and the source/worktree is clean. Logs/TRX and the source-restoration record are retained under
cshells-generation-review-fd6da4a/in the program artifact directory.CI37784121468 and Greptile are running on the submitted head. Fresh independent pinned source QA is in progress. Copilot was requested at creation, but the account's previously verified monthly quota is unavailable; no Copilot approval or queued review is claimed. Root/fresh source review is the documented fallback, not external approval. Hosted review, merge/main publication and actual published-package lease qualification remain outstanding. #147 moves to In Review; #148/#149 remain buffered pending this prerequisite. No milestone is complete.
sfmskywalker commentedon Oct 8, 2026
Local actual-package harness preflight found a lifecycle defect before merge. A candidate is blocked after selecting v1; the old main and sibling drain to Disposed; the catalog advances to v2. Candidate activation succeeds, but ReloadResult.Drain starts another drain against the old disposed provider and faults with ObjectDisposedException during handler scope creation. The existing selected-snapshot regression did not await that returned drain; the existing repeated-drain test required a fresh operation but did not await it either.
Root claims the same #147 worktree/branch for the bounded correction: strengthen both existing assertions, preserve fresh-operation and public Drain-null-on-Disposed semantics, skip handler resolution only for a provider disposed by the shell lifecycle, and still join the shell's shared provider-teardown completion so no lease releases early. Arbitrary handler construction failures must remain failures. Root owns correction/integration/QA; fresh independent design review is underway. No competitor claim found. #147 returns to In Progress/verification Running until the fix and causal proof pass; no merge/publication is permitted from fd6da4a. Existing Greptile is still live, so no duplicate trigger or interim push.
sfmskywalker commentedon Oct 8, 2026
Review round 1 found five actionable issues at fd6da4a (3/5): ordinary Disposed subscriber failures can release protection, concrete participant aliases can enter shell providers, generation identity documentation exceeds the existing unregister semantics, a retained release task can retain exception payloads/providers, and new locals violate var-always style. The existing generation-lease work unit remains owned here on 018-shell-generation-build-leases; these corrections stay in #147 / PR #152. The separately reproduced disposed-generation drain race is fixed locally at 8ef2c34 (three-framework Release build, 712 library tests passed), not yet pushed. I am batching the review corrections with that commit, with focused regressions and fresh combined review before the next push. No generation package publication or merge is claimed.
sfmskywalker commentedon Oct 8, 2026
Review correction batch pushed at e463910. All five round1 findings have direct commit/evidence replies and resolved threads. Ordinary Disposed callback failures now retain protection while notifying peers and disposing providers; participant descriptors stay root-only; recreated names keep registry-lifetime unique generations; failed release drops the original exception graph without retry; new locals follow var-always. Additional root/fresh QA fixed late disposed-provider drain joining and completion-before-pointer-release ordering. Three-framework Release build: zero warnings/errors. Complete affected library suite:721 passed, zero failed/skipped. Causal negative/restored tests reproduced each behavioral defect. Fresh independent exact-head source reviews found no material blocker. The strengthened six-group external consumer passed .NET8/9/10 with freshly packed local-only packages from this head and isolated caches; this is NOT published-package acceptance. Hosted CI37789878802 is now SUCCESS; exact job results are being retained. Copilot re-request was accepted by CLI but reviewRequests remains empty under the verified monthly quota limit, not approval. The latest-head Greptile result remains outstanding; round1 score3/5 at fd6da4a is historical, not current approval. No merge/publication or M1 completion is claimed.
sfmskywalker commentedon Oct 8, 2026
Program Lead review fallback for exact head
e46391082f0d88509b7f8fe1aab92b31f3f443e0(treee2eb6c864a24191d7d655df91d4c100ee11b5e4a).Greptile last reviewed
fd6da4ac6f15ef55f8f0d2031373719b232a0e77at 3/5. All five findings have direct fix replies and resolved threads; zero threads remain unresolved. No review/check/status for the current head has appeared after the two request attempts, and the documented nonduplicate retrigger control redirects to sign-in in both available browsers. Copilot is separately unavailable due to its monthly quota. We do not claim a global Greptile outage, a terminated Greptile job, current-head 5/5, or external approval. The unfinished Greptile loop remains recorded as such.The program lead is applying the explicit external-review fallback in the Agentic Program Lead skill: record the last reviewed head and exact delta, review that delta plus every affected risk boundary, pass required automated/live gates, and proceed only with no material finding. Root reviewed the entire 17-file delta and the participant ownership, disposed-notification/provider teardown, failed-release exception retention, registry generation identity, and concurrent drain completion boundaries. Fresh independent pinned source review also found no release blocker. Static-metadata limits for participant factories are documented; failed leases are retained without automatic retry.
Current-head CI37789878802 passed: 721 library tests and31 E2E tests. Release net8/net9/net10 builds have zero warnings/errors. The actual two privately packed candidate packages passed six consumer groups on actual .NET8/9/10 with source/archive/cache identity verified. Regression and causal mutation proofs cover every material corrected behavior. Full evidence:
cshells-152-exact-head-root-review.json,cshells-152-unreviewed-by-greptile-delta.patch,greptile-recovery-audit-20261008.json, andcshells-generation-review-corrections/root-qualification.jsonin the program artifact directory.Proceed with normal merge only. Resulting-main CI, publication of all nine preview packages and actual public-feed generation consumer acceptance remain required before #147 completes. No final release or Foundation adoption is claimed. Retry external review when available and handle any late material finding through a qualified fix forward.
sfmskywalker commentedon Oct 8, 2026
PR #152 merged normally at
0f25bbac71a713cf93af728086ecc7b6517be24b; resulting-main tree exactly matches reviewed heade463910(treee2eb6c864a24191d7d655df91d4c100ee11b5e4a). The external-review fallback is explicitly documented in the preceding comment; Greptile is not marked passed or approved.Owner Packages run37795690347 is live on this exact main commit and will build/test/pack the nine-package family as
0.0.30-preview.162. #147 stays open and verification remains Running until that run passes and the public-feed generation consumer passes on .NET8/9/10 with package archive/source identity verified. #148 remains buffered until this acceptance completes.sfmskywalker commentedon Oct 8, 2026
Upstream primitive delivery and public-preview qualification complete. PR #152 merged normally at
0f25bbac71a713cf93af728086ecc7b6517be24bwith source tree exactly equal to reviewed heade463910. Owner Packages run37795690347 passed Release build/test/pack (721 library +31 E2E; zero warnings/errors) and published all nine0.0.30-preview.162packages to Feedz. Root independently verified all nine pipeline/public archive pairs, nuspec versions/source, framework assets and family dependencies.The standalone public Feedz PackageReference consumer passed six generation-lease groups on actual .NET8.0.10/9.0.9/10.0.8: ordered Begin/exact snapshot before construction, old selected snapshot retained after newer commit and other old pins dropping, old/new generation overlap, lease held through blocked provider teardown despite public Disposed state, Begin failure reverse unwind/original error, and snapshot failure reverse unwind/skipped later callbacks. Root recomputed cache/public SHA256 and NuGet SHA512, verified restore source, and compared each actually loaded library to its published archive DLL. No project/assembly substitution. Evidence:
cshells-published-preview-162/andcshells-published-generation-consumer/evidence/20261008T145410Z-AP3utR/root-qualification-verification.json.Current-head external review used the explicitly recorded Program Lead fallback (#152 comment6062500873): all five prior Greptile findings fixed/replied/resolved; root and independent exact-head source reviews had no material finding. Greptile has no fresh score and is not marked passed or approved; Copilot quota was unavailable.
Close #147 for the delivered generic upstream primitive and this preview acceptance. Foundation #2164 consumer/readability proof remains mandatory and unfulfilled, tracked by parent Feature #145 and final qualification #2509; Feature #145 stays open. This preserves the separate adoption requirement and avoids making downstream settlement/runner delivery depend on final adoption that itself needs those primitives. No final release, adapter, actual pruning, Foundation runtime adoption or program completion is claimed. #148 can now be integrated against actual main as the sole next implementation leaf.