morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #4798] [Bug] WABT drops incomplete command cleanup ownership before runtime removal #2495

New issue

Closed

opened 2026-10-17 21:05:43 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-17 21:05:43 +00:00

Owner

Originally created by @morluto on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4798

Before submitting

Searched open/closed WABT cleanup reports.
No credentials or private target data are included.

Area

Evidence, artifacts, or reconstruction

Observed behavior

Source-derived finding at 7aa4b98c9; no natural OS process-cleanup failure was reproduced. WABT command failures can carry an exact retained ProviderProcessSupervisor, but WabtArtifactProvider does not adopt it. It translates the failure and then attempts recursive runtime-root removal even while command cleanup is unconfirmed.

Reproduction

Source inspection: src/process/OwnedCommand.ts returns OwnedCommandFailure.cleanupOwner when its bounded stop is incomplete and no retention callback was supplied. WabtArtifactProvider supplies no callback, its outer catch only calls wabtFailure, and its final cleanup releases the runtime root independently. wabtFailure copies diagnostic resource labels but drops the process cleanup capability. The provider's close() therefore has no retained command supervisor to retry.

Runtime reproduction: NOT_ENOUGH_INFO. This report does not claim a live escaped WABT process, a naturally failed kill, or a deleted runtime still used by a real process. A deterministic ownership-boundary regression is being prepared.

Expected behavior

Retain the exact supervisor supplied by the command boundary, retry it before removing its runtime, and keep unrelated pending owners unresolved. Resource labels or a PID must not substitute for the capability. If no ownership capability is available, runtime release must remain unconfirmed.

Impact and scope

Source-supported WABT lifecycle gap on the incomplete-stop branch. Real-world frequency, affected applications and OS-specific prevalence are NOT_ENOUGH_INFO. #4787 concerns stale error status after successful runtime removal; this finding concerns a separate, earlier command-ownership boundary.

REA version

6.5.0 at 7aa4b98c9829148b81211aff4e0413cb4ff2ff92.

Runtime and platform

Source inspection on macOS arm64, Node 24.18.0. Process failure not reproduced on macOS, Windows or Linux.

Target and artifact context

No investigated target. The branch owns trusted caller-supplied WABT helper executables parsing inert selected module bytes; it does not authorize WASM instantiation.

Interface

Shared provider behind CLI/MCP.

Earliest failure stage

Command finalization, before runtime-root release.

Relevant output or evidence

Source evidence above. NOT_ENOUGH_INFO for real-provider failure output; diagnostic labels alone are insufficient proof of process release.

Typed outcome or recovery expected

Keep cleanup_incomplete until the retained command supervisor and runtime owner independently confirm release. Successful peer cleanup must not clear a still-failing owner.

Analysis or suspected cause

Error translation preserves failure text but discards the cleanup capability. Root cleanup has no command dependency. The existing ArtifactResourceScope and exact AnalysisCleanupLease grouping can represent the required order without new process-control authority.

Additional context

Found during #4787's ownership audit. No target execution or external software installation is proposed. Prepared with AI assistance; source evidence and runtime limits are distinguished above.

Originally created by @morluto on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4798 ### Before submitting - [x] Searched open/closed WABT cleanup reports. - [x] No credentials or private target data are included. ### Area Evidence, artifacts, or reconstruction ### Observed behavior **Source-derived finding at `7aa4b98c9`; no natural OS process-cleanup failure was reproduced.** WABT command failures can carry an exact retained `ProviderProcessSupervisor`, but `WabtArtifactProvider` does not adopt it. It translates the failure and then attempts recursive runtime-root removal even while command cleanup is unconfirmed. ### Reproduction Source inspection: `src/process/OwnedCommand.ts` returns `OwnedCommandFailure.cleanupOwner` when its bounded stop is incomplete and no retention callback was supplied. `WabtArtifactProvider` supplies no callback, its outer catch only calls `wabtFailure`, and its final cleanup releases the runtime root independently. `wabtFailure` copies diagnostic resource labels but drops the process cleanup capability. The provider's `close()` therefore has no retained command supervisor to retry. Runtime reproduction: **NOT_ENOUGH_INFO**. This report does not claim a live escaped WABT process, a naturally failed kill, or a deleted runtime still used by a real process. A deterministic ownership-boundary regression is being prepared. ### Expected behavior Retain the exact supervisor supplied by the command boundary, retry it before removing its runtime, and keep unrelated pending owners unresolved. Resource labels or a PID must not substitute for the capability. If no ownership capability is available, runtime release must remain unconfirmed. ### Impact and scope Source-supported WABT lifecycle gap on the incomplete-stop branch. Real-world frequency, affected applications and OS-specific prevalence are **NOT_ENOUGH_INFO**. #4787 concerns stale error status after successful runtime removal; this finding concerns a separate, earlier command-ownership boundary. ### REA version 6.5.0 at `7aa4b98c9829148b81211aff4e0413cb4ff2ff92`. ### Runtime and platform Source inspection on macOS arm64, Node 24.18.0. Process failure not reproduced on macOS, Windows or Linux. ### Target and artifact context No investigated target. The branch owns trusted caller-supplied WABT helper executables parsing inert selected module bytes; it does not authorize WASM instantiation. ### Interface Shared provider behind CLI/MCP. ### Earliest failure stage Command finalization, before runtime-root release. ### Relevant output or evidence Source evidence above. **NOT_ENOUGH_INFO** for real-provider failure output; diagnostic labels alone are insufficient proof of process release. ### Typed outcome or recovery expected Keep `cleanup_incomplete` until the retained command supervisor and runtime owner independently confirm release. Successful peer cleanup must not clear a still-failing owner. ### Analysis or suspected cause Error translation preserves failure text but discards the cleanup capability. Root cleanup has no command dependency. The existing `ArtifactResourceScope` and exact `AnalysisCleanupLease` grouping can represent the required order without new process-control authority. ### Additional context Found during #4787's ownership audit. No target execution or external software installation is proposed. Prepared with AI assistance; source evidence and runtime limits are distinguished above.

bsakaguchi

2026-10-17 21:05:43 +00:00

closed this issue
added the
triage

bug
labels

bsakaguchi commented

2026-10-17 21:05:45 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed on main in 22a0746f9.

Runtime and descriptor failures now follow their exact cleanup leases through retry and error translation; confirmed recovery clears live resource claims. Primary typed failures, captured diagnostics, completed partial Evidence and finalization abort reasons remain available. Command supervisors are retained until stop is confirmed before runtime removal (#4798).

Validation: 88 focused tests across 10 files; post-fixture-refactor 28 provider tests; build, static and documentation checks. The actual CLI and real stdio MCP verifier passed 51 cases with official WABT 1.0.42, including authored exact-root/descriptor denials followed by real removal/close and same-connection retry. The baseline reproduced stale cleanup claims for valid input, rejected input and descriptor failure.

Limits: permission denials were controlled injections; incomplete command stop/mixed retries were source controls using exact supervisors, not a real failed OS kill. No WASM target was instantiated. Twelve small ordinary CLI cost tasks retained byte-identical replies and Evidence IDs; no performance improvement is claimed.

@morluto commented on GitHub (Oct 17, 2026): Fixed on main in 22a0746f9. Runtime and descriptor failures now follow their exact cleanup leases through retry and error translation; confirmed recovery clears live resource claims. Primary typed failures, captured diagnostics, completed partial Evidence and finalization abort reasons remain available. Command supervisors are retained until stop is confirmed before runtime removal (#4798). Validation: 88 focused tests across 10 files; post-fixture-refactor 28 provider tests; build, static and documentation checks. The actual CLI and real stdio MCP verifier passed 51 cases with official WABT 1.0.42, including authored exact-root/descriptor denials followed by real removal/close and same-connection retry. The baseline reproduced stale cleanup claims for valid input, rejected input and descriptor failure. Limits: permission denials were controlled injections; incomplete command stop/mixed retries were source controls using exact supervisors, not a real failed OS kill. No WASM target was instantiated. Twelve small ordinary CLI cost tasks retained byte-identical replies and Evidence IDs; no performance improvement is claimed.

bsakaguchi referenced this issue

2026-10-31 01:05:21 +00:00

[PR #2495] [MERGED] fix(gemini): compare consolidated allowlists through one normalizer #5272

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2495

No description provided.

Rows
Columns