fix(compass-agent): isolate transport gauge tests from the shared metric registry (RIG-2656) - #712
Open
rigel-mintaka wants to merge 1 commit into
Open
fix(compass-agent): isolate transport gauge tests from the shared metric registry (RIG-2656)#712rigel-mintaka wants to merge 1 commit into
rigel-mintaka wants to merge 1 commit into
Conversation
…ric registry (RIG-2656) The three transport LEVEL gauges (trace_queue_depth, priority_retry_depth, no_progress_depth) were asserted as absolute values read off Effect's process-global in-memory metric registry, which every ManagedRuntime and Effect.runSync shares. A gauge is last-writer-wins, and bun runs test files concurrently in one process, so a sibling test file constructing its own spine/control-source moved the shared gauge between a test's Metric.set and its synchronous read -- the assertion flaked ~2/3 under the concurrent suite while passing 100% in isolation. Counters were unaffected: they are read as a before/after delta, which concurrent movement cannot corrupt. Per-runtime registry isolation is impossible in Effect 3.x -- the registry is a hard process-global globalValue singleton with no FiberRef override. Instead the gauges are built through a namespace-prefix factory: production passes no prefix (the exact frozen metric names, byte-identical behavior), and each affected test passes a unique prefix so its gauge read hits a private registry entry immune to concurrent writers. The registry keys structurally on the metric name, so two same-name gauge instances collide to one entry and a unique-named gauge is private by construction. createPublishSpine takes an optional metricNamespace positional (internal seam, already effect-typed); createSocketControlSource takes it via its options bag as a plain string, never an effect type, so the re-exported factory's public .d.ts stays free of the effect package (export-surface guard). A new discriminating test reproduces the race deterministically: after the spine sets its private gauge, a hostile writer clobbers the shared key; the namespaced read is unaffected while the shared-key read returns the clobber. Collapsing the namespace to the shared key reddens exactly that test, proving the isolation is load-bearing. Every gauge assertion is mutation-proven non-vacuous. Full suite 635 pass/0 fail across repeated concurrent runs. Co-authored-by: Matt Wilkinson <matt@rigel.build>
|
Compass engineering docs preview: https://compass-agent-rig-2656-gauge.compass-eng-docs.pages.dev Deployed from |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The three transport LEVEL gauges (trace_queue_depth, priority_retry_depth,
no_progress_depth) were asserted as absolute values read off Effect's
process-global in-memory metric registry, which every ManagedRuntime and
Effect.runSync shares. A gauge is last-writer-wins, and bun runs test files
concurrently in one process, so a sibling test file constructing its own
spine/control-source moved the shared gauge between a test's Metric.set and its
synchronous read -- the assertion flaked ~2/3 under the concurrent suite while
passing 100% in isolation. Counters were unaffected: they are read as a
before/after delta, which concurrent movement cannot corrupt.
Per-runtime registry isolation is impossible in Effect 3.x -- the registry is a
hard process-global globalValue singleton with no FiberRef override. Instead the
gauges are built through a namespace-prefix factory: production passes no prefix
(the exact frozen metric names, byte-identical behavior), and each affected test
passes a unique prefix so its gauge read hits a private registry entry immune to
concurrent writers. The registry keys structurally on the metric name, so two
same-name gauge instances collide to one entry and a unique-named gauge is
private by construction.
createPublishSpine takes an optional metricNamespace positional (internal seam,
already effect-typed); createSocketControlSource takes it via its options bag as
a plain string, never an effect type, so the re-exported factory's public .d.ts
stays free of the effect package (export-surface guard).
A new discriminating test reproduces the race deterministically: after the spine
sets its private gauge, a hostile writer clobbers the shared key; the namespaced
read is unaffected while the shared-key read returns the clobber. Collapsing the
namespace to the shared key reddens exactly that test, proving the isolation is
load-bearing. Every gauge assertion is mutation-proven non-vacuous. Full suite
635 pass/0 fail across repeated concurrent runs.
Co-authored-by: Matt Wilkinson matt@rigel.build