|
| 1 | +# Local defaults: managed Host supervision and reconciled delivery plan |
| 2 | + |
| 3 | +- Baseline: `fd96e5e25`, audited September 27, 2026. |
| 4 | +- Outcome: overall roadmap S2/S4/R5, shared authority external-execution closure, |
| 5 | + TS replacement-first migration. No provider or capability is introduced. |
| 6 | +- This replaces the **remaining delivery estimate**, not the historical evidence, |
| 7 | + in the September 24 reconciliation. The recovery slice proposed in |
| 8 | + [#5140](https://github.com/loopx-project/loopx/pull/5140) is still open. |
| 9 | +- [中文](2026-09-27-host-supervision.zh-CN.md). |
| 10 | + |
| 11 | +## Count deliveries, not architectural headings |
| 12 | + |
| 13 | +Complete-source transport/assembly, transaction capture, canonical pagination, |
| 14 | +File v1 automatic backup/upgrade and Python prototype retirement are already on |
| 15 | +main. #5013, #5063, #5102 and #5105 are not future work. Two promoted Goals prove |
| 16 | +those particular cutovers, not every execution, migration or recovery boundary. |
| 17 | + |
| 18 | +The old “three packages” and #5140's “three PRs afterwards” were too coarse for |
| 19 | +execution protection. An actual subprocess reproduction shows the missing |
| 20 | +prerequisite: generic Host timeout kills only its leader, while Codex cleanup |
| 21 | +returns early after the leader exits. Both can leave descendants doing work. |
| 22 | +Deleting a lease or rejecting a later result does not stop that process. |
| 23 | + |
| 24 | +The current **four newly planned deliveries include this PR**: |
| 25 | + |
| 26 | +| Delivery | Observable exit and Python retirement | |
| 27 | +| --- | --- | |
| 28 | +| **1. Managed subprocess supervision (this PR)** | Generic command and Codex CLI share one TS lifecycle through timeout, caller loss, pipe drain and process-group termination. Retire their separate Python termination/thread-reader implementations. This closes the process component, not the lease component below. | |
| 29 | +| **2. Authority-bound execution interval** | Connect the existing provider-neutral lease owner to actual execution: current proof before start, bounded renewal, cancellation on expiry/reclaim/revocation, and uncertain-effect recovery. Reclaim must not silently overlap an old executor. Test with real processes and File/SQLite; explicitly qualify attached Hosts without cancellation. Remove replaced Python decisions rather than create a second lease store. | |
| 30 | +| **3. Whole-Goal migration and fenced recovery integration** | Adopt #5140 recovery and #5054 source retirement; cover source drain, reviewed cutover, retained command consumers, projection readback and rollback after later writes. Inventory existing callers before adding writers. Delete legacy decisions only when their actual callers have moved. | |
| 31 | +| **4. Default onboarding and bounded Python retirement** | New-Goal creation, settings, CLI, packaged frontend and Lark select the qualified local profile consistently. Existing Goals have explicit upgrade, backup and recovery. Remove remaining replaced Python business writers, retaining necessary rendering and Host IO adapters. | |
| 32 | + |
| 33 | +**Three planned new PRs remain after this one.** This is a scoped delivery plan, |
| 34 | +not an unconditional total or proof that lease supervision has shipped. It is |
| 35 | +one additional execution slice compared with #5140's proposed estimate; the |
| 36 | +reproduction above is the reason, and this PR does not subtract the uncompleted |
| 37 | +lease row. If another slice is needed, amend its named row and evidence. |
| 38 | + |
| 39 | +Separately, existing open PRs are #5140 (recovery/audit), #5054 (old Todo event |
| 40 | +retirement and supervisor logging), and #4931 (SQLite receipt-proof encoding). |
| 41 | +Thus the integration inventory is **six named PR deliveries for the File route** |
| 42 | +(this + three planned + #5140 + #5054), or **seven for the SQLite route** including |
| 43 | +#4931. These counts include already implemented open PRs; they do not mean six |
| 44 | +or seven new implementations. #5140's SQLite batch proof read complements #4931; |
| 45 | +neither small-suite success qualifies D2. New defects discovered by qualification |
| 46 | +can still require changes, so there is no justified guaranteed PR total today. |
| 47 | + |
| 48 | +D1 consumer parity, profile-specific D2 capacity/recovery/soak and D3 cohort |
| 49 | +cutover remain acceptance work, not invented PR allocations. The audited #4224 |
| 50 | +1 MiB report still fails receipt p95 (269.03 ms / 50 ms) and scan-100 p95 |
| 51 | +(801.81 ms / 250 ms); this process change cannot fix or certify those metrics. |
| 52 | +PostgreSQL retains its separate authenticated transport, tenant/identity, |
| 53 | +cross-host execution, pooling/failover and operations qualification. Local |
| 54 | +process cleanup is reusable across providers because it does not read their |
| 55 | +physical layouts or create authority. |
| 56 | + |
| 57 | +## Ownership and neighboring work |
| 58 | + |
| 59 | +`control_plane/turn_driver/host_process.ts` owns the managed process lifetime; |
| 60 | +its private bridge treats the Python owner's control-pipe EOF as cancellation. |
| 61 | +Python adapts transient output, Codex sessions and typed results. Existing |
| 62 | +`turn run-once` callers adopt this automatically; no new CLI option, configuration |
| 63 | +editor, capability registration, frontend or Lark surface is needed. Attached |
| 64 | +App sessions and in-process DSH adapters do not pass through this subprocess |
| 65 | +owner and are not represented as newly protected. |
| 66 | + |
| 67 | +#5141 fences Host state by GoalRef, while #5142 preserves effect uncertainty in |
| 68 | +Turn error readback. Neither replaces process supervision. Integration must |
| 69 | +retain their admission checks before launching and their recovery observations; |
| 70 | +this PR changes neither GoalRef authority nor settlement semantics. |
| 71 | + |
| 72 | +[Operational behavior and limits](../../../../reference/protocols/loopx-turn-v0.md#managed-host-process-lifetime). |
0 commit comments