Skip to content

test: characterize pg-erd upstream read stall - #18

Draft
seonghobae wants to merge 22 commits into
test/pg-erd-upstream-failure-recovery-v1from
test/pg-erd-read-stall-recovery-v1
Draft

test: characterize pg-erd upstream read stall#18
seonghobae wants to merge 22 commits into
test/pg-erd-upstream-failure-recovery-v1from
test/pg-erd-read-stall-recovery-v1

Conversation

@seonghobae

@seonghobae seonghobae commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Valid migration evidence gap

#17 characterizes connection refusal. This Draft owns the next distinct gateway failure phase: the characterized backend TCP connection succeeds, the request reaches that authority, and the origin then sends no HTTP response bytes. It stays inside pingora-gateway transport/runtime responsibility and adds no product authorization/business logic, route authority, retries/failover, service discovery, Keyverse identity, or Wardnet/EgressWeave policy.

Parent-first ordinary succession

Parent #17 is exact 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3, independently terminal hosted/technical GREEN. Ordinary two-parent 0c90ff2a91bda6c310cd01bded135c89f7d21c87 retained predecessor #18 and adopted exact current #17 without force-push or destructive rebase. The effective child scope remains six paths: API_CONFIG_CONTRACT.md, CHANGELOG.md, TEST_STRATEGY.md, docs/doctoring/TRACEABILITY.md, docs/product-technical-gap-baseline.md, and tests/pg_erd_read_stall_traffic.rs.

Causal traffic contract

The backend accepts /api/read-stall, reads request headers, and stays connected without sending response bytes until the gateway has already returned and the fixture is explicitly released. With read_ms=100, acceptance requires HTTP 502 inside a conservative <1 s outer envelope, /readyz 200, exact Prometheus sample cwl_pingora_gateway_request_errors_total 1, and a later independent frontend route 200. Pingora read_timeout is treated as a per-individual-read inactivity budget; no whole-response lifetime claim is made.

Executed fixture-authority repair

Predecessor #18 selected traffic and metrics listener addresses through sequential bind-and-drop ephemeral reservations. Because the OS may reuse a released ephemeral address, that did not structurally guarantee distinct gateway listener authority. Test-only commit b31c85ba204f8699ea70396fbf51cb60fbf8f4c0 binds both reservations concurrently, reads both addresses while both sockets are held, asserts they differ, then releases them for process startup. It changes no production Rust, route, timeout, request volume, metric oracle, OCI rule, dependency or product/security authority.

Exact follow-up 9bcf3df639c633fdf9f8a985c6fde307d09189ce completed CI 34176646015 and Supply Chain 34176646009 terminal GREEN. Test/lint/rustdoc, 100% owned-production line/region coverage, resolved lock verification and dual-profile OCI runtime all passed. Generic-loopback artifact 10037539770, digest sha256:c7787c3943292fd4769315d0d6fc088ee20a5ca1d6c91c35417bc6107892a327, records 400 requests, 800/800 checks, zero HTTP failures and p95 0.9491437 ms; this is controlled generic evidence, not routed pg-erd or production SLO evidence.

Review finding → documentation repair

CodeRabbit run 27344a8e-90b8-46ac-bacf-ba632dfbb8b7 reviewed exact 7a7e1f1...9bcf3df, covered exactly the six child paths and generated no actionable code comments. Its pre-merge documentation check nevertheless reported 11.11% docstring coverage across nine touched test functions against an 80% service threshold. This lane does not ignore a review/check warning when a causal repair is available.

Behavior-neutral commit b1727cbc4003c89e7c27b8a18f84502d39f37884 adds purpose/constraint rustdoc to all nine touched test functions/helpers: child teardown, simultaneous listener reservation, bounded config construction, listener startup proof, compiled-process startup, raw HTTP capture, characterized GET construction, header-only origin reading and the final connected-inactivity contract. Commit 9749d01ae0e9aae027d7fce1a2c15e6a8358acd9 projects the resulting state into the code-current gap baseline. Production behavior and migration semantics are unchanged.

Exact current closure

Current exact head is 9749d01ae0e9aae027d7fce1a2c15e6a8358acd9 and has independently reacquired terminal hosted GREEN without predecessor transfer. CI 34177466780 succeeded for load-contract 101909644250, test 101909644264, and dual-profile OCI runtime 101909644366. The test job passed exact checkout, Rust 1.98.0 formatting, compile/test, strict lint, warning-denied public rustdoc, complete owned-production coverage enforcement and resolved-lock verification. Supply Chain 34177466712 / candidate-evidence 101909636817 succeeded through committed dependency audit, both admitted candidate-image builds, SPDX dependency SBOM generation, both image scans, exact-source binding and evidence upload.

A fresh owner technical sweep re-read the complete six-path exact range and found no actionable source/documentation defect; there are no inline review threads. The predecessor CodeRabbit review is not transferred to this head, and the owner sweep is technical evidence only, not an independent human APPROVED review. #18 is therefore stable enough to be the exact parent for ordinary/non-force #19 succession while the separate supplier and #56 governance roots remain open.

Keep Draft. Supplier derivative 2.2.0, independent #56 approval, protected integration and release/cutover remain upstream gates. No protected merge, immutable release, canary, cutover, rollback or legacy-removal credit is claimed.

@coderabbitai

coderabbitai Bot commented Sep 2, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 27344a8e-90b8-46ac-bacf-ba632dfbb8b7

📥 Commits

Reviewing files that changed from the base of the PR and between 7a7e1f1 and 9bcf3df.

📒 Files selected for processing (6)
  • API_CONFIG_CONTRACT.md
  • CHANGELOG.md
  • TEST_STRATEGY.md
  • docs/doctoring/TRACEABILITY.md
  • docs/product-technical-gap-baseline.md
  • tests/pg_erd_read_stall_traffic.rs

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.


📝 Walkthrough

Walkthrough

Pingora read_ms 계약을 개별 읽기 비활성 제한으로 명확히 했다. 연결된 침묵 backend에 대한 컴파일 통합 테스트를 추가했다. 관련 기준선과 검증 범위를 갱신했다.

Changes

연결된 upstream read stall 검증

Layer / File(s) Summary
read timeout 계약 및 검증 범위
API_CONFIG_CONTRACT.md, docs/doctoring/TRACEABILITY.md, CHANGELOG.md, TEST_STRATEGY.md
read_ms를 성공한 upstream read()마다 재설정되는 비활성 제한으로 정의했다. 전체 응답 수명 제한과 연결 재설정, 부분 응답, slow-drip 검증은 별도 범위로 남겼다.
컴파일된 gateway read stall 테스트
tests/pg_erd_read_stall_traffic.rs
침묵 상태로 연결을 유지하는 backend가 read_ms=100 후 502를 반환하도록 검증한다. /readyz, 정확히 하나의 오류 메트릭, 독립적인 frontend 라우트도 검증한다.
기술 기준선 및 실행 상태 갱신
docs/product-technical-gap-baseline.md
PR 상태, hosted GREEN 증거, listener 예약 수정, 현재 검증 범위와 남은 failure 시나리오를 갱신한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 9bcf3

This change documents per-read timeout behavior and adds coverage for a silent connected upstream, including failure response, health, metrics, and independent-route recovery. No actionable current-head risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 1 files. (5 skipped: 5… Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed 제목은 pg-erd 업스트림 읽기 정체를 검증하는 테스트 추가라는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Full details: Docstring Coverage

Explanation

Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 9 functions across 1 files. (5 skipped: 5 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch test/pg-erd-read-stall-recovery-v1

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

seonghobae commented Sep 7, 2026

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact current range c1100b297e4dd832c9990a0e66e9e9b210f5cea9...87a8922fff8d7495c531290946faf0f35a77fed7. Predecessor #18/#17 review evidence is stale. The ordinary two-parent restack must have exact #17 as merge base with behind=0 and an effective six-file delta only: API_CONFIG_CONTRACT.md, CHANGELOG.md, TEST_STRATEGY.md, docs/doctoring/TRACEABILITY.md, docs/product-technical-gap-baseline.md, and tests/pg_erd_read_stall_traffic.rs. Verify parent-owned src/gateway_proxy.rs and tests/pg_erd_runtime_isolation_traffic.rs remain unchanged from exact #17.

Focus especially on the connected-silent-origin fixture: the backend must accept and retain the routed connection without sending response bytes until after the gateway has produced its downstream failure, so fixture closure cannot create a false timeout GREEN. Verify that <1 s is only a conservative fail-closed outer envelope around read_ms=100, that the metric oracle requires exact cwl_pingora_gateway_request_errors_total 1, and that API/TRACEABILITY/baseline wording preserves Pingora per-read semantics without inventing a whole-response SLO or moving product/security authority into the gateway.

@coderabbitai

coderabbitai Bot commented Sep 7, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="ce2b3032580fa851f9ccd34462801920be947a09"
head="d6e61e59bfdca47dd2e9542001938b5c33674314"

echo '== Range validation =='
git merge-base "$base" "$head"
git rev-parse "$base" "$head"
git diff --name-status "$base" "$head"
echo
echo '== Exact diff =='
git diff --find-renames --find-copies --unified=100 "$base" "$head" -- \
  tests/pg_erd_read_stall_traffic.rs \
  API_CONFIG_CONTRACT.md \
  docs/doctoring/TRACEABILITY.md \
  TEST_STRATEGY.md \
  CHANGELOG.md \
  docs/product-technical-gap-baseline.md

echo
echo '== Test file outline =='
ast-grep outline tests/pg_erd_read_stall_traffic.rs --items all || true
echo
echo '== Timeout/configuration candidates =='
rg -n -i -C 4 \
  'read_ms|read_timeout|connect_ms|connect_timeout|upstream|proxy' \
  -g '*.rs' -g '*.toml' -g '*.yaml' -g '*.yml' -g '*.json' -g '*.md' \
  -g '!tests/pg_erd_read_stall_traffic.rs' .

Length of output: 167235


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="ce2b3032580fa851f9ccd34462801920be947a09"
head="d6e61e59bfdca47dd2e9542001938b5c33674314"

echo '== Range and changed paths =='
printf 'merge-base: '; git merge-base "$base" "$head"
git diff --name-status "$base" "$head"
echo

echo '== Complete added read-stall test at requested head =='
git show "$head:tests/pg_erd_read_stall_traffic.rs" | nl -ba
echo

for path in \
  API_CONFIG_CONTRACT.md \
  docs/doctoring/TRACEABILITY.md \
  TEST_STRATEGY.md \
  CHANGELOG.md \
  docs/product-technical-gap-baseline.md
do
  echo "== Changed hunks: $path =="
  git diff --unified=12 "$base" "$head" -- "$path"
done

echo '== Pingora dependency pin =='
git show "$head:Cargo.toml" | rg -n -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true
git show "$head:Cargo.lock" 2>/dev/null | rg -n -C 2 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

echo '== Migration route and peer selection implementation =='
nl -ba src/migration_proxy.rs | sed -n '212,310p'
nl -ba src/migration_delivery.rs | sed -n '60,125p'
nl -ba src/pingora_delivery.rs | sed -n '43,82p'

Length of output: 1762


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base="ce2b3032580fa851f9ccd34462801920be947a09"
head="d6e61e59bfdca47dd2e9542001938b5c33674314"

numbered_show() {
  git show "$1:$2" | awk '{printf "%6d\t%s\n", NR, $0}'
}

echo '== Complete added read-stall test at requested head =='
numbered_show "$head" tests/pg_erd_read_stall_traffic.rs
echo

for path in \
  API_CONFIG_CONTRACT.md \
  docs/doctoring/TRACEABILITY.md \
  TEST_STRATEGY.md \
  CHANGELOG.md \
  docs/product-technical-gap-baseline.md
do
  echo "== Changed hunks: $path =="
  git diff --unified=12 "$base" "$head" -- "$path"
done

echo '== Pingora dependency pin =='
git show "$head:Cargo.toml" | grep -n -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true
git show "$head:Cargo.lock" 2>/dev/null | grep -n -E -C 2 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

echo '== Migration runtime selections =='
sed -n '212,310p' src/migration_proxy.rs
sed -n '60,125p' src/migration_delivery.rs
sed -n '43,82p' src/pingora_delivery.rs

Length of output: 87211


@seonghobae Reviewed exact range ce2b3032580fa851f9ccd34462801920be947a09...d6e61e59bfdca47dd2e9542001938b5c33674314. I found no correctness issues in the six-file effective delta.

The read-stall fixture is causally sound. The backend accepts the routed connection, reads complete request headers, sends the connection signal, and remains open without response bytes. It waits for explicit release. The test releases it only after the gateway returns HTTP 502 and the one-second outer-envelope assertion passes. Origin closure cannot produce a false timeout GREEN.

read_ms: 100 maps directly to HttpPeer.options.read_timeout. The API contract and traceability documentation correctly define this as a per-read inactivity budget that resets after successful reads. They do not claim a whole-response deadline. The remaining-gap wording keeps slow-drip, whole-response lifetime, reset, truncation, retry, and failover separate.

The migration path continues to select only fixed, prevalidated backend and frontend authorities. The change does not add product routing, service discovery, retries, failover, or product-policy authority.

This source review does not replace the required exact-head hosted test and supply-chain evidence.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact current range ce2b3032580fa851f9ccd34462801920be947a09...d6e61e59bfdca47dd2e9542001938b5c33674314. Treat predecessor #18/#17 review evidence as stale. Focus on whether tests/pg_erd_read_stall_traffic.rs causally proves a connected silent upstream (not connection refusal or fixture closure), the 100 ms read_ms per-read inactivity semantics, 502/readiness/error-telemetry/independent-route recovery, and whether API_CONFIG_CONTRACT.md, docs/doctoring/TRACEABILITY.md, TEST_STRATEGY.md, CHANGELOG.md, and docs/product-technical-gap-baseline.md are code-current without overstating whole-response lifetime. Do not suggest moving product auth/business, retry/failover, Keyverse, Wardnet, or EgressWeave authority into this slice.

@coderabbitai

coderabbitai Bot commented Sep 7, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='ce2b3032580fa851f9ccd34462801920be947a09'
head='d6e61e59bfdca47dd2e9542001938b5c33674314'

echo '== Exact range =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'base: '; git rev-parse "$base"
printf 'head: '; git rev-parse "$head"
git diff --name-status "$base" "$head"

echo '== Added test at exact head =='
git show "$head:tests/pg_erd_read_stall_traffic.rs" | nl -ba

echo '== Documentation hunks =='
for path in \
  API_CONFIG_CONTRACT.md \
  docs/doctoring/TRACEABILITY.md \
  TEST_STRATEGY.md \
  CHANGELOG.md \
  docs/product-technical-gap-baseline.md
do
  printf '\n== %s ==\n' "$path"
  git diff --unified=20 "$base" "$head" -- "$path"
done

echo '== Dependency pin =='
git show "$head:Cargo.toml" | grep -n -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

echo '== Candidate configuration and timeout wiring =='
rg -n -i -C 5 \
  'read_ms|read_timeout|connect_ms|connect_timeout|HttpPeer|ProxyHttp|backend|frontend' \
  -g '*.rs' -g '*.toml' .

echo '== Runtime source outlines =='
for path in src/migration_proxy.rs src/migration_delivery.rs src/pingora_delivery.rs; do
  if [ -f "$path" ]; then
    printf '\n== Outline: %s ==\n' "$path"
    ast-grep outline "$path" --items all || true
  fi
done

Length of output: 1994


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='ce2b3032580fa851f9ccd34462801920be947a09'
head='d6e61e59bfdca47dd2e9542001938b5c33674314'

numbered_show() {
  git show "$1:$2" | awk '{ printf "%6d  %s\n", NR, $0 }'
}

echo '== Read-stall test at exact head =='
numbered_show "$head" tests/pg_erd_read_stall_traffic.rs

echo '== Documentation changes =='
for path in \
  API_CONFIG_CONTRACT.md \
  docs/doctoring/TRACEABILITY.md \
  TEST_STRATEGY.md \
  CHANGELOG.md \
  docs/product-technical-gap-baseline.md
do
  printf '\n== %s ==\n' "$path"
  git diff --unified=30 "$base" "$head" -- "$path"
done

echo '== Cargo dependency pin =='
git show "$head:Cargo.toml" | grep -n -E -C 4 \
  'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

echo '== Configuration and Pingora timeout wiring =='
grep -RInE -C 5 \
  'read_ms|read_timeout|connect_ms|connect_timeout|HttpPeer|backend|frontend' \
  --include='*.rs' --include='*.toml' \
  src tests Cargo.toml 2>/dev/null || true

echo '== Exact-head runtime excerpts =='
for path in src/migration_proxy.rs src/migration_delivery.rs src/pingora_delivery.rs; do
  if [ -f "$path" ]; then
    printf '\n== %s ==\n' "$path"
    awk 'NR >= 1 && NR <= 380 { printf "%6d  %s\n", NR, $0 }' "$path"
  fi
done

Length of output: 229784


@seonghobae Reviewed the exact range ce2b3032580fa851f9ccd34462801920be947a09...d6e61e59bfdca47dd2e9542001938b5c33674314.

I found no correctness issues in the six-file effective delta.

tests/pg_erd_read_stall_traffic.rs causally proves a connected silent upstream. The backend accepts the TCP connection, reads complete request headers, and verifies GET /api/read-stall. It then keeps the connection open and writes no response bytes. The test sends the fixture release only after it receives HTTP 502 and verifies the one-second outer envelope. Fixture closure cannot create a false timeout pass.

The test sets backend.timeouts.read_ms to 100. src/pingora_delivery.rs maps this value directly to HttpPeer.options.read_timeout. The test correctly treats one second as a conservative acceptance envelope around the configured per-read timeout. It does not define a whole-response lifetime objective.

The test also verifies all required recovery evidence:

  • HTTP 502 for the silent backend request.
  • HTTP 200 from /readyz.
  • Visibility of cwl_pingora_gateway_request_errors_total 1.
  • HTTP 200 and the expected body from the independent frontend request.

API_CONFIG_CONTRACT.md, docs/doctoring/TRACEABILITY.md, TEST_STRATEGY.md, CHANGELOG.md, and docs/product-technical-gap-baseline.md match the inspected runtime wiring. They define read_ms as a per-read inactivity budget that resets after successful reads. They do not claim a whole-response deadline. They retain TCP reset, post-commit truncation, slow-drip, whole-response lifetime, retry, and failover as separate gaps.

The migration runtime still selects only the prevalidated backend and frontend peers. This delta does not add product authorization, business logic, service discovery, retry/failover, Keyverse identity, Wardnet, or EgressWeave authority.

This source review does not replace required exact-head hosted CI and supply-chain evidence.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Fresh exact-head request after ordinary parent succession. Review c1100b297e4dd832c9990a0e66e9e9b210f5cea9...87a8922fff8d7495c531290946faf0f35a77fed7; do not transfer prior #18 review credit. Verify merge base is exact #17 with behind=0 and the effective child delta is only the six declared paths. Focus on the connected-silent-origin fixture, exact one-error metric oracle, <1 s fail-closed envelope around read_ms=100, pinned per-read timeout semantics, and preservation of parent-owned gateway/runtime-isolation blobs. Do not expand gateway authority into product auth/business, retry/failover, Keyverse, Wardnet or EgressWeave.

@coderabbitai

coderabbitai Bot commented Sep 8, 2026

Copy link
Copy Markdown

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='c1100b297e4dd832c9990a0e66e9e9b210f5cea9'
head='87a8922fff8d7495c531290946faf0f35a77fed7'

echo '== Topology =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'base: '; git rev-parse "$base"
printf 'head: '; git rev-parse "$head"
printf 'head parents: '; git show -s --format='%P' "$head"
printf 'behind base..head: '; git rev-list --count "$head..$base"
printf 'ahead base..head: '; git rev-list --count "$base..$head"

echo '== Effective delta =='
git diff --name-status --find-renames "$base" "$head"

echo '== Parent-owned blob identity =='
for path in src/gateway_proxy.rs tests/pg_erd_runtime_isolation_traffic.rs; do
  printf '%s base=' "$path"; git rev-parse "$base:$path"
  printf '%s head=' "$path"; git rev-parse "$head:$path"
done

echo '== Added test =='
git show "$head:tests/pg_erd_read_stall_traffic.rs" | nl -ba

echo '== Documentation delta =='
for path in API_CONFIG_CONTRACT.md CHANGELOG.md TEST_STRATEGY.md docs/doctoring/TRACEABILITY.md docs/product-technical-gap-baseline.md; do
  printf '\n== %s ==\n' "$path"
  git diff --unified=20 "$base" "$head" -- "$path"
done

echo '== Relevant runtime/configuration references at head =='
for path in src/pingora_delivery.rs src/migration_proxy.rs src/migration_delivery.rs; do
  if git cat-file -e "$head:$path" 2>/dev/null; then
    printf '\n== %s ==\n' "$path"
    git show "$head:$path" | nl -ba | grep -E -C 5 'read_ms|read_timeout|HttpPeer|backend|frontend|timeouts' || true
  fi
done

echo '== Pingora pin =='
git show "$head:Cargo.toml" | grep -n -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

Length of output: 2838


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='c1100b297e4dd832c9990a0e66e9e9b210f5cea9'
head='87a8922fff8d7495c531290946faf0f35a77fed7'

show_numbered() {
  git show "$1:$2" | awk '{printf "%6d  %s\n", NR, $0}'
}

echo '== Added read-stall test =='
show_numbered "$head" tests/pg_erd_read_stall_traffic.rs

echo '== Documentation delta =='
for path in API_CONFIG_CONTRACT.md CHANGELOG.md TEST_STRATEGY.md docs/doctoring/TRACEABILITY.md docs/product-technical-gap-baseline.md; do
  printf '\n== %s ==\n' "$path"
  git diff --unified=20 "$base" "$head" -- "$path"
done

echo '== Runtime timeout and authority excerpts at head =='
for path in src/pingora_delivery.rs src/migration_proxy.rs src/migration_delivery.rs; do
  if git cat-file -e "$head:$path" 2>/dev/null; then
    printf '\n== %s ==\n' "$path"
    git show "$head:$path" |
      awk '{printf "%6d  %s\n", NR, $0}' |
      grep -E -C 6 'read_ms|read_timeout|HttpPeer|backend|frontend|timeouts' || true
  fi
done

echo '== Pingora dependency pin =='
git show "$head:Cargo.toml" |
  grep -n -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

Length of output: 73925


@seonghobae I found one documentation issue.

docs/product-technical-gap-baseline.md states that #18 “is being ordinarily/non-force restacked onto exact #17.” The reviewed head, 87a8922fff8d7495c531290946faf0f35a77fed7, has already completed that ordinary two-parent succession. The document should identify the completed exact head and state that fresh hosted execution and review remain required. This change keeps the baseline code-current and prevents readers from treating the restack as still pending.

All other requested checks pass:

  • The merge base is exact #17. The range is behind by 0 commits.
  • The effective delta contains exactly the six declared paths.
  • src/gateway_proxy.rs and tests/pg_erd_runtime_isolation_traffic.rs have byte-identical blobs at base and head.
  • The fixture accepts the backend connection, reads the request headers, and sends no response bytes. It waits for explicit release until after the gateway returns HTTP 502. Fixture closure cannot create the timeout result.
  • read_ms=100 maps to HttpPeer.options.read_timeout. The <1 s assertion is an outer fail-closed envelope. It does not claim a whole-response lifetime.
  • The metric oracle requires the exact line cwl_pingora_gateway_request_errors_total 1.
  • The test verifies readiness and independent frontend recovery.
  • The timeout documentation preserves the per-read Pingora semantics. The runtime continues to use only prevalidated peers. This delta does not add product authority, retry/failover, Keyverse, Wardnet, or EgressWeave authority.

Fresh exact-head hosted CI, supply-chain evidence, and technical review remain required.

You are interacting with an AI system.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please re-review exact current range c1100b297e4dd832c9990a0e66e9e9b210f5cea9...c0c160ac1b4811f0f34182edb3419c3a3766476d. The prior exact-range review found one valid documentation issue on 87a8922...: the baseline still described the completed restack as pending. c0c160ac... changes only that baseline wording. Verify that the current range remains behind=0 with exact #17 merge base and exactly the same six effective paths, that the baseline now records completed ordinary succession without transferring 87a8922... execution/review credit, and that no other code/document contract regressed.

@coderabbitai

coderabbitai Bot commented Sep 8, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='c1100b297e4dd832c9990a0e66e9e9b210f5cea9'
predecessor='87a8922fff8d7495c531290946faf0f35a77fed7'
head='c0c160ac1b4811f0f34182edb3419c3a3766476d'

echo '== Exact topology =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'base: '; git rev-parse "$base"
printf 'head: '; git rev-parse "$head"
printf 'head parents: '; git show -s --format='%P' "$head"
printf 'behind (head..base): '; git rev-list --count "$head..$base"
printf 'ahead (base..head): '; git rev-list --count "$base..$head"

echo '== Effective delta paths =='
git diff --name-status --find-renames "$base" "$head"

echo '== Documentation-only child =='
git diff --name-status --find-renames "$predecessor" "$head"
git diff --unified=30 "$predecessor" "$head" -- docs/product-technical-gap-baseline.md

echo '== Parent-owned blob identity =='
for path in src/gateway_proxy.rs tests/pg_erd_runtime_isolation_traffic.rs; do
  printf '%s base: ' "$path"; git rev-parse "$base:$path"
  printf '%s head: ' "$path"; git rev-parse "$head:$path"
done

echo '== Read-stall test at head =='
git show "$head:tests/pg_erd_read_stall_traffic.rs" | nl -ba

echo '== Documentation delta from base =='
for path in \
  API_CONFIG_CONTRACT.md \
  CHANGELOG.md \
  TEST_STRATEGY.md \
  docs/doctoring/TRACEABILITY.md \
  docs/product-technical-gap-baseline.md
do
  printf '\n== %s ==\n' "$path"
  git diff --unified=16 "$base" "$head" -- "$path"
done

echo '== Runtime timeout wiring and dependency pin =='
git show "$head:src/pingora_delivery.rs" | nl -ba | grep -E -C 5 'read_ms|read_timeout|HttpPeer' || true
git show "$head:Cargo.toml" | grep -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

Length of output: 17303


🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='c1100b297e4dd832c9990a0e66e9e9b210f5cea9'
head='c0c160ac1b4811f0f34182edb3419c3a3766476d'

numbered_show() {
  git show "$1:$2" | awk '{ printf "%6d  %s\n", NR, $0 }'
}

echo '== Read-stall test at exact head =='
numbered_show "$head" tests/pg_erd_read_stall_traffic.rs

echo '== Documentation changes from exact base =='
for path in \
  API_CONFIG_CONTRACT.md \
  CHANGELOG.md \
  TEST_STRATEGY.md \
  docs/doctoring/TRACEABILITY.md \
  docs/product-technical-gap-baseline.md
do
  printf '\n== %s ==\n' "$path"
  git diff --unified=20 "$base" "$head" -- "$path"
done

echo '== Exact-head runtime timeout mapping =='
numbered_show "$head" src/pingora_delivery.rs | \
  grep -E -C 6 'read_ms|read_timeout|HttpPeer|PeerOptions' || true

echo '== Exact-head fixed authority selection =='
for path in src/migration_proxy.rs src/migration_delivery.rs; do
  printf '\n== %s ==\n' "$path"
  numbered_show "$head" "$path" | \
    grep -E -C 5 'backend|frontend|HttpPeer|upstream|route' || true
done

echo '== Exact Pingora source pin =='
git show "$head:Cargo.toml" | \
  grep -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

Length of output: 85110


@seonghobae Reviewed exact range c1100b297e4dd832c9990a0e66e9e9b210f5cea9...c0c160ac1b4811f0f34182edb3419c3a3766476d. I found no correctness issues.

The merge base is exact #17, c1100b297e4dd832c9990a0e66e9e9b210f5cea9. The range is behind by 0 commits. The effective delta contains exactly these six paths:

  • API_CONFIG_CONTRACT.md
  • CHANGELOG.md
  • TEST_STRATEGY.md
  • docs/doctoring/TRACEABILITY.md
  • docs/product-technical-gap-baseline.md
  • tests/pg_erd_read_stall_traffic.rs

c0c160ac... modifies only docs/product-technical-gap-baseline.md relative to 87a8922....

The baseline correction is code-current. It records that ordinary two-parent succession onto exact #17 completed at 87a8922fff8d7495c531290946faf0f35a77fed7. It also states that hosted execution and review must be reacquired on the resulting head. It does not transfer #17 or 87a8922... execution or review evidence.

The child did not change the read-stall contract. The fixture accepts the backend connection, reads the request headers, sends no response bytes, and remains open until explicit release after the gateway returns 502. The test still requires the <1 s fail-closed envelope around read_ms=100, /readyz 200, the exact cwl_pingora_gateway_request_errors_total 1 sample, and independent frontend recovery.

The timeout mapping still assigns read_ms to HttpPeer.options.read_timeout. The documentation continues to define this value as a per-read inactivity budget. It does not claim a whole-response lifetime bound.

The parent-owned blobs remain unchanged from exact #17:

  • src/gateway_proxy.rs
  • tests/pg_erd_runtime_isolation_traffic.rs

The migration boundary still uses only prevalidated transport authorities. This range does not add product authorization, business logic, service discovery, retry/failover, Keyverse, Wardnet, or EgressWeave authority.

Exact-head hosted CI, Supply Chain, and independent review evidence remain required.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Review exact current range 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3...c7735ca8067e77c588a474cc41df3ce47bd04d43. Do not transfer predecessor review credit. Verify merge base is exact current #17 with behind=0 and the effective child delta remains exactly six declared paths. Focus on the connected-silent-origin fixture retaining the accepted backend connection until after downstream failure, exact single-error telemetry, the conservative <1 s envelope around read_ms=100, Pingora per-read timeout semantics, and preservation of parent-owned runtime/source. Also verify the code-current baseline repair does not claim predecessor execution as current-head GREEN or expand gateway authority into product auth/business, retry/failover, Keyverse, Wardnet or EgressWeave.

@coderabbitai

coderabbitai Bot commented Sep 8, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3'
head='c7735ca8067e77c588a474cc41df3ce47bd04d43'

numbered_show() {
  git show "$1:$2" | awk '{ printf "%6d  %s\n", NR, $0 }'
}

echo '== Exact topology =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'base: '; git rev-parse "$base"
printf 'head: '; git rev-parse "$head"
printf 'head parents: '; git show -s --format='%P' "$head"
printf 'behind (head..base): '; git rev-list --count "$head..$base"
printf 'ahead (base..head): '; git rev-list --count "$base..$head"

echo '== Effective delta paths =='
git diff --name-status --find-renames "$base" "$head"

echo '== Parent-owned blob identity =='
for path in src/gateway_proxy.rs tests/pg_erd_runtime_isolation_traffic.rs; do
  printf '%s base: ' "$path"; git rev-parse "$base:$path"
  printf '%s head: ' "$path"; git rev-parse "$head:$path"
done

echo '== Connected-silent-origin fixture =='
numbered_show "$head" tests/pg_erd_read_stall_traffic.rs

echo '== Documentation delta =='
for path in \
  API_CONFIG_CONTRACT.md \
  CHANGELOG.md \
  TEST_STRATEGY.md \
  docs/doctoring/TRACEABILITY.md \
  docs/product-technical-gap-baseline.md
do
  printf '\n== %s ==\n' "$path"
  git diff --unified=25 "$base" "$head" -- "$path"
done

echo '== Exact-head timeout and authority wiring =='
for path in src/pingora_delivery.rs src/migration_proxy.rs src/migration_delivery.rs; do
  if git cat-file -e "$head:$path" 2>/dev/null; then
    printf '\n== %s ==\n' "$path"
    numbered_show "$head" "$path" |
      grep -E -C 7 'read_ms|read_timeout|HttpPeer|backend|frontend|timeouts|upstream' || true
  fi
done

echo '== Pingora dependency pin =='
git show "$head:Cargo.toml" |
  grep -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

Length of output: 94224


@seonghobae Reviewed exact range 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3...c7735ca8067e77c588a474cc41df3ce47bd04d43. I found no actionable correctness issues.

The merge base is exact current #17: 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3. The range is behind by 0 commits.

The effective child delta contains exactly six paths:

  • API_CONFIG_CONTRACT.md
  • CHANGELOG.md
  • TEST_STRATEGY.md
  • docs/doctoring/TRACEABILITY.md
  • docs/product-technical-gap-baseline.md
  • tests/pg_erd_read_stall_traffic.rs

The parent-owned files are byte-identical at the base and head:

  • src/gateway_proxy.rs
  • tests/pg_erd_runtime_isolation_traffic.rs

The read-stall fixture proves a connected silent origin. The backend accepts the routed connection and reads complete request headers. It signals the test after it receives GET /api/read-stall. It keeps the accepted socket open and sends no response bytes. It waits for explicit release. The test sends that release only after it receives HTTP 502 and checks the <1 s envelope. Fixture closure cannot produce the asserted timeout result.

The test sets read_ms=100. The runtime maps this value directly to HttpPeer.options.read_timeout. The <1 s check is a conservative fail-closed outer envelope. It does not claim that 100 ms is a whole-response deadline.

The test requires all specified outcome evidence:

  • HTTP 502 for the silent backend request.
  • HTTP 200 from /readyz.
  • Exact metric line cwl_pingora_gateway_request_errors_total 1.
  • HTTP 200 with the expected response body from the independent frontend route.

The documentation defines Pingora read_timeout as a per-read inactivity budget. It states that successful reads reset the budget. It does not define a whole-response SLO. It keeps slow-drip, whole-response lifetime, TCP reset, and post-commit failure as separate gaps.

The baseline is code-current for the parent succession. It identifies #17 as exact-head hosted GREEN. It identifies 0c90ff2... CI and Supply Chain execution as predecessor evidence. It does not claim that predecessor execution is current-head GREEN for c7735ca....

The migration runtime still binds only prevalidated transport authorities. This range does not add product authorization, business logic, retry/failover, Keyverse identity, Wardnet policy, or EgressWeave policy.

Fresh exact-head CI, Supply Chain, and independent technical review evidence remain required before successor credit.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

@coderabbitai review

Please review exact current range 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3...9bcf3df639c633fdf9f8a985c6fde307d09189ce. Predecessor review evidence is stale and must not transfer.

Focus on the connected-silent-origin acceptance and the latest test-only listener-authority repair. Verify that tests/pg_erd_read_stall_traffic.rs holds traffic and metrics ephemeral reservations concurrently while selecting their addresses so the fixture cannot configure the two gateway listeners to the same effective authority, and that releasing those reservations before process startup can at worst create a false RED if another process steals a port rather than a false timeout GREEN. Confirm the backend remains connected and sends no response bytes until after downstream 502 evidence, read_ms=100 is treated only as Pingora's per-read inactivity budget, the <1 s assertion is only a conservative outer envelope, telemetry requires exact cwl_pingora_gateway_request_errors_total 1, and no product/auth/Wardnet/EgressWeave/Keyverse authority or parent-owned runtime source is introduced. Also verify the effective child scope remains the declared six paths from exact #17.

@coderabbitai

coderabbitai Bot commented Sep 8, 2026

Copy link
Copy Markdown
🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

base='7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3'
head='9bcf3df639c633fdf9f8a985c6fde307d09189ce'

numbered_show() {
  git show "$1:$2" | awk '{ printf "%6d  %s\n", NR, $0 }'
}

echo '== Topology =='
printf 'merge-base: '; git merge-base "$base" "$head"
printf 'behind (head..base): '; git rev-list --count "$head..$base"
printf 'ahead (base..head): '; git rev-list --count "$base..$head"
printf 'head parents: '; git show -s --format='%P' "$head"

echo '== Effective delta =='
git diff --name-status --find-renames "$base" "$head"

echo '== Parent-owned blob identity =='
for path in src/gateway_proxy.rs tests/pg_erd_runtime_isolation_traffic.rs; do
  printf '%s base: ' "$path"; git rev-parse "$base:$path"
  printf '%s head: ' "$path"; git rev-parse "$head:$path"
done

echo '== Read-stall fixture at exact head =='
numbered_show "$head" tests/pg_erd_read_stall_traffic.rs

echo '== Documentation delta =='
for path in \
  API_CONFIG_CONTRACT.md \
  CHANGELOG.md \
  TEST_STRATEGY.md \
  docs/doctoring/TRACEABILITY.md \
  docs/product-technical-gap-baseline.md
do
  printf '\n== %s ==\n' "$path"
  git diff --unified=24 "$base" "$head" -- "$path"
done

echo '== Runtime timeout and authority wiring at exact head =='
for path in src/pingora_delivery.rs src/migration_proxy.rs src/migration_delivery.rs; do
  printf '\n== %s ==\n' "$path"
  numbered_show "$head" "$path" |
    grep -E -C 7 'read_ms|read_timeout|HttpPeer|backend|frontend|timeouts|upstream' || true
done

echo '== Pingora dependency pin =='
git show "$head:Cargo.toml" |
  grep -E -C 3 'pingora|09696b51bc59315353d96686355861604d0bb48c' || true

Length of output: 95543


@seonghobae Reviewed exact range 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3...9bcf3df639c633fdf9f8a985c6fde307d09189ce. I found no actionable correctness issues.

The merge base is exact #17, 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3. The range is behind by 0 commits.

The effective child delta contains exactly these six paths:

  • API_CONFIG_CONTRACT.md
  • CHANGELOG.md
  • TEST_STRATEGY.md
  • docs/doctoring/TRACEABILITY.md
  • docs/product-technical-gap-baseline.md
  • tests/pg_erd_read_stall_traffic.rs

The parent-owned blobs remain byte-identical at the base and head:

  • src/gateway_proxy.rs
  • tests/pg_erd_runtime_isolation_traffic.rs

reserve_distinct_loopbacks() binds traffic and metrics loopback sockets concurrently. It reads both addresses while both reservations remain held. It then asserts that the addresses differ. This removes the sequential bind-and-drop reuse race.

The function releases both reservations when it returns, before the gateway starts. If another process takes either address during that window, the gateway cannot bind its configured listener and the test fails. This can produce a false RED. It cannot cause the fixture to configure equal traffic and metrics listener authorities.

The silent-origin fixture is causally sound. The backend accepts the routed TCP connection and reads the complete request headers. It verifies GET /api/read-stall. It sends no response bytes. It waits for explicit release. The test sends that release only after it receives HTTP 502 and verifies the <1 s outer envelope. Fixture closure cannot create the asserted timeout result.

The test configures read_ms: 100. src/pingora_delivery.rs maps this value to HttpPeer.options.read_timeout. The test and documentation treat it as a per-read inactivity budget. They do not treat it as a whole-response deadline. Slow-drip and whole-response-lifetime behavior remain separate gaps.

The test requires:

  • HTTP 502 for the silent backend request.
  • HTTP 200 from /readyz.
  • The exact Prometheus sample cwl_pingora_gateway_request_errors_total 1.
  • HTTP 200 with the expected response body from the independent frontend route.

The updated documentation is consistent with the runtime wiring. It preserves the boundary between gateway transport/runtime responsibility and product authorization, business logic, Keyverse, Wardnet, and EgressWeave authority. It does not introduce retry, failover, service discovery, or new route authority.

This source review does not transfer predecessor evidence. Exact-head hosted CI, Supply Chain, and independent technical review remain required.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Copy link
Copy Markdown
Contributor Author

Exact-head owner technical sweep — 9749d01ae0e9aae027d7fce1a2c15e6a8358acd9 against exact parent 7a7e1f1ca4c8310220b7ff2fb96e01027a7e89f3.

I re-read the complete six-path effective range rather than transferring predecessor review credit. The connected-silent backend fixture is causal: the backend accepts and reads /api/read-stall, sends no response bytes, and remains open until after the downstream 502 has already been observed; the test independently proves backend contact, <1 s failure around read_ms=100, /readyz 200, exact-line cwl_pingora_gateway_request_errors_total 1, and later frontend recovery. Traffic/metrics listener reservations remain simultaneously held until both distinct addresses are selected. All touched named test helpers/functions now carry purpose/constraint rustdoc. The API contract, test strategy, traceability and changelog consistently describe Pingora read_timeout as a per-read inactivity budget and leave whole-response lifetime/reset/post-commit behavior separate. No product auth/business logic, Keyverse, Wardnet, EgressWeave, retry/failover, service discovery or TLS-authority expansion is present.

No actionable source/documentation finding remains in this exact range and there are no inline review threads. This is owner technical-review evidence only; it is not an independent human APPROVED review and does not weaken the separate #56 governance gate.

Current exact hosted evidence is terminal GREEN without predecessor transfer: CI 34177466780 succeeded for load-contract 101909644250, test 101909644264 (fmt, compile/test, strict lint, warning-denied public rustdoc, complete owned-production coverage enforcement, resolved lock), and dual-profile OCI runtime 101909644366; Supply Chain 34177466712 / candidate-evidence 101909636817 succeeded through committed dependency audit, both candidate-image builds, SPDX SBOM, both image scans, exact-source binding and evidence upload. This closes #18's current-parent technical/execution gate only; it is not protected merge/release/canary/cutover evidence.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant