[omry]

Move pairing and control TLS I/O onto shared bounded carrier credits and a serialized memory-BIO pump. Add a private bidirectional Python/Go streaming peer to exercise fragmentation, coalescing, backpressure, partial writes, and actual-worker ownership during cancellation.

Validation: 1,665 unit tests passed (43 skipped), 61 real native-peer tests passed, Go test/vet passed, Black checked 143 files, and pyrefly reported zero errors. The optional full Python suite retains one Docker-access failure.

---

• -> [arbiter-authentication/3.1.1] Shared bounded carrier and streaming peer #84
• docs: record reviewed authentication design for milestones 3–11 #83

[gitar-bot]

CI failed: Five unit tests in the server suite timed out waiting on bounded HTTP capacity and request completion (artifact lock contention, cancelled request, and request-body admission cases), while the other 1,660 tests passed. The analyzer judged these unrelated to this PR, though the stall cause is not confirmed.

Overview

One unique failure pattern was found across 2 logs (one job, 126428454138). The Python 3.10 compat nox session ran 1,666 tests: 1,660 passed, 43 skipped, and 5 failed with asyncio.exceptions.TimeoutError. The failing excerpts do not show a confirmed root cause.

Failures

Five asyncio timeouts in bounded capacity/request tests (confidence: medium)

• Type: test
• Affected jobs: 126428454138
• Related to change: no (analyzer verdict; not confirmed by the log excerpts)
• Root cause: Bounded 2–3 second asyncio.wait_for waits timed out while waiting for HTTP worker capacity or request completion in test_artifact_lock_contention_keeps_health_responsive[True-GET-True], test_artifact_lock_contention_keeps_health_responsive[False-GET-True], test_cancelled_request_keeps_capacity_until_its_underlying_work_finishes, and test_invalid_declared_length_is_rejected_while_capacity_is_full[65-413] and [invalid-400]. The logs do not establish why the waits stalled. Shared worker or event-loop scheduling delay is possible but unconfirmed. The PR does not touch artifact locking or HTTP admission, so the analyzer assessed it as unrelated.
• Suggested fix: Inspect the worker-capacity and request-completion paths in the five named tests. Rerun them in isolation and in the full suite with timing instrumentation to check whether workers stay occupied or scheduling is delayed. Only relax timeout budgets if the behavior is correct and the tests are shown to be overly timing-sensitive.

Summary

• Change-related failures: None confirmed. The analyzer marked the single finding as unrelated to this PR.
• Infrastructure/flaky failures: The 5 timeouts may be timing-sensitive or flaky, but this is not confirmed. They should be triaged separately.
• Recommended action: Do not treat these as caused by this PR without further evidence. Rerun the five named tests in isolation and with timing instrumentation, then decide whether to fix the capacity path or the test timeouts.

Code Review ✅ Approved

🟡 Medium risk · Refactoring pairing/control TLS I/O into a shared streaming pump changes transport and buffer-credit handling; errors could disrupt exchanges or exceed buffer limits.

Moves pairing and control TLS I/O onto shared bounded carrier credits and a serialized memory-BIO pump, and adds a private bidirectional Python/Go streaming peer to exercise fragmentation, coalescing, backpressure, partial writes, and worker ownership during cancellation. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Tip

Comment Gitar fix CI or enable auto-apply: gitar auto-apply:on

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}