fix(runtime): read the boot envelope as a rendering, and walk the scan window - #235
Merged
Conversation
…n window
The Spacedock strip published nothing while a workflow was plainly running,
reporting "A workflow exists, but nothing is fresh enough to show" — which
reads like a freshness problem and is not one. Two independent defects, each
fatal on its own.
The envelope arrives rendered, not raw. `boot_records` looked for the literal
`{"command"` of a JSON object. The first officer's skill tells it to run
`status --boot --identify --json`, but nothing tells it to echo that JSON, and
both real first-officer sessions measured piped it through a formatter, so the
transcript carried an indented key/value rendering and the object never
appeared. Across 120 transcripts over 21 days the JSON branch matched exactly
one file, and that one was this repository's own fixtures catted into a tool
result: the strip had never fired on a real session.
So the fields are read line by line as well. The trust model is unchanged — a
rendered path is gated on a top-level `command: boot` exactly as the JSON
branch is gated on `envelope["command"] == "boot"`, only column-0 keys are
read so a nested decoy cannot nominate one, and every downstream guard still
stands between an extracted path and anything published.
And it is not in the head. The scan read the first `spacedock_boot_scan_bytes`
on the reasoning that boot output is written at session start. A first officer
greets and discovers before it boots: the two sessions measured booted at 69%
and 73% of the way through their transcripts, at bytes 803,503 and 821,199.
Raising the cap only moves the guess and is the expensive direction, because
the old `(path, size)` key misses on every write below the cap. The window
walks instead — each pass reads at most `spacedock_boot_scan_bytes` of
not-yet-scanned bytes and remembers how far it reached, stopping on a line
boundary and stepping over a record longer than the window.
Verified end to end against the live transcript: the strip now renders
roadmap-burndown with drc-4029 live on triage, matching the running worker.
Records the reasoning as S-7 in docs/design-spacedock.md.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Signed-off-by: Jared Scott <jared.scott@variable.team>
The shipped skill body told readers no strip appears when the boot output sits outside the scanned head of a long transcript. The window walks now, so a late boot is a lag of a refresh or two rather than a permanent blank. The architecture doc described `spacedock_boot_cache` as keyed on a path and a bounded size; it holds a scan position beside its records instead. Its `spacedock.py` row gains the S-7 distinction that provenance settles where an envelope may come from, not what it looks like once it is there. S-7 rewritten to the voice standard: no em dashes, no boldface leads. Marker left alone, per the parallel-branch rule. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Signed-off-by: Jared Scott <jared.scott@variable.team>
Contributor
CoverageThreshold: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The Spacedock strip showed
A workflow exists, but nothing is fresh enough to show.for the entire life of a running workflow. It is not a freshness problem. Two independent defects in the boot-envelope read, each fatal on its own.The envelope arrives rendered, not raw
boot_recordslooked for the literal{"command"of a JSON object. The first-officer skill tells it to runstatus --boot --identify --jsonand "consume JSON, not the human table", but nothing tells it to echo that JSON. Both real first-officer sessions measured piped it through a formatter, so the transcript carried an indented key/value rendering and the object never appeared.Across 120 transcripts over 21 days the JSON branch matched exactly one file, and that one was this repository's own test fixtures catted into a tool result. The strip had never fired on a real session.
The fields are now read line by line as well. The trust model is unchanged: a rendered path is gated on a top-level
command: bootexactly as the JSON branch is gated onenvelope["command"] == "boot", only column-0 keys are read so a nested decoy cannot nominate one, and every downstream guard (_usable_dir, canonicalisation, the symlink and identity checks,commissioned-by: spacedock@) still stands between an extracted path and anything published.And it is not in the head
The scan read the first
spacedock_boot_scan_byteson the reasoning that boot output is written at session start. A first officer greets and discovers before it boots: the two sessions measured booted at 69% and 73% of the way through their transcripts, at bytes 803,503 and 821,199.Raising the cap only moves the guess and is the expensive direction, since the old
(path, size)key misses on every write below the cap and re-reads the whole file under the collection lock. The window walks instead: each pass reads at mostspacedock_boot_scan_bytesof not-yet-scanned bytes and remembers how far it reached, stopping on a line boundary and stepping over a record longer than the window. A shorter file restarts the walk.Verification
Run against the live transcript that produced the empty panel, at default config:
drc-4029ontriagematches the running workerspacedock-ensign-drc-4029-triage.6 new tests: the rendered envelope parses; a rendering without
command: bootnominates nothing; a nested key cannot nominate a path; a rendering with nodefinition_diris refused; the scan walks forward across refreshes (asserted non-vacuous); a shorter transcript restarts the walk.Full pre-PR suite green: ruff,
ruff format --check,mypy --strict,lint_embedded,validate_plugins, 1941 tests, coverage 90.8% (spacedock.py90.3%). No version fields touched.Docs
Reasoning recorded as S-7 in
docs/design-spacedock.md. Corrected the shipped skill body (which told readers a deep boot output means no strip at all) and the architecture doc'sspacedock_boot_cachedescription. Sync marker left alone per the parallel-branch rule.🤖 Generated with Claude Code