bug(review): native status timeout leaves authority inventory unavailable #213

Activity

1. Alan-TheGentleman

   added

   status:needs-design

   on Sep 6, 2026
2. Alan-TheGentleman commented on Sep 6, 2026

   

   Alan-TheGentleman

   on Sep 6, 2026

   Collaborator

   More actions

   One real contributor to native STATUS timeouts is now fixed on the gentle-ai side: the lens-context budget probe re-rendered the whole candidate once per selected lens on every STATUS poll (gentle-ai #3733 and #3871). The specific scenario here, graph quorum loss plus a stale v2 lock, runs through the authority repair path and needs a typed partial-inventory contract before the host can render anything useful. That is a native design decision, so this stays open as needs-design until that contract exists.
3. dnlrsls

   added

   type:bugBug fixBug fix

   bugSomething isn't workingSomething isn't working

   on Oct 1, 2026
4. Sechi42 commented on Oct 2, 2026

   

   Sechi42

   on Oct 2, 2026

   More actions

   Related observation on Windows x64 with gentle-pi 4.0.0 and Pi 1.0.0.

   One gentle_review inspect selecting three new files in an isolated sibling worktree returned a typed failure before candidate START:

   schema: gentle-ai.review-integration.failure/v2
   operation: review.status
   phase: pre_native
   code: operation_timeout
   message: The negotiated review operation exceeded its aggregate time budget.
   cause: context deadline exceeded
   mutation_outcome: not_started
   authority_applicability: not_evaluated
   retry_safe: false
   replayability: manual_action_required
   next_action: stop
   inventory_complete: false
   

   No START was attempted for this candidate. We stopped without retry, reset, recovery, lock deletion, or configuration changes. Existing work was preserved.

   This may be related to the timeout/incomplete-inventory boundary reported here, but equivalence and root cause are unconfirmed. We have NOT established the missing-quorum or retained-legacy-lock conditions described in this issue. There has been no fresh reproduction after the stop.

   Could a maintainer confirm whether this belongs here and identify the supported read-only diagnostic or continuation for this failure?
5. dnlrsls commented on Oct 8, 2026

   

   dnlrsls

   on Oct 8, 2026

   Member

   More actions

   Could you update this report in place using the current bug report form, including the problem, steps to reproduce, expected and actual behavior, gentle-pi and Pi versions, operating system, and the search/privacy confirmations? Keeping the missing information here will help distinguish related STATUS failures without opening a duplicate.

   One additional observed incident on Windows may be useful while completing the report:

   • START returned a created review, then the first bound STATUS returned operation_timeout, phase pre_native, and context deadline exceeded. It reported mutation_outcome: not_started, authority_applicability: not_evaluated, retry_safe: false, replayability: manual_action_required, and next_action: stop. That stop was respected; there were no subsequent lifecycle retries, captures, or acknowledgement.
   • Session timing recorded 111,216 ms for the whole tool execution. This is not a measured native subprocess duration. The inspected sources define a 25-second native STATUS budget and a 30-second default non-mutating relay subprocess timeout, but there is no invocation-specific process/stage trace to establish where this elapsed time was spent or whether either budget was exceeded.
   • Installed source/package metadata identified gentle-pi 4.0.0. The loaded extension version, actual executable selected for this invocation, and Pi version at incident time were not established. This is one observed incident, not a deterministic reproduction or proof of a common root cause with this issue.

   Please include sanitized timing and executable provenance if available, and explicitly mark unknown version details rather than inferring them. The current evidence does not justify attributing this incident to a zombie process or replaying a nonretryable STATUS.
6. dnlrsls commented on Oct 8, 2026

   

   dnlrsls

   on Oct 8, 2026

   Member

   More actions

   Please incorporate this scoped diagnostic design into the report in place, alongside the missing bug-form details requested above. Maintainer approval covers instrumentation only, not a reproduced, explained, or fixed timeout.

   Diagnostic scope

   • Explicit session-only activation, off by default. Observe the next separately authorized STATUS, never invoke or retry it automatically.
   • Bounded metadata in memory, with manual consultation of the last completed summary. Clear on disable or session end. No automatic file export or persistent settings.
   • Monotonic durations for host/controller dispatch, executable resolution, adapter execution/settlement, decoding, sidebar publication, and completion. Record effective timeout and existing typed outcome. Exclude paths, arguments, credentials, raw output/error text, and session/lineage identifiers.
   • Preserve protocol, elapsed-timing/v1 ledger, deadlines, retries, reviewer/admission logic, and authority. Observer failures must not alter or mask the original outcome.

   Source boundaries

   • lib/native-review-cli.ts:1104-1126 uses promisified execFile; :2142 forwards the timeout; :2307-2354 invokes negotiated STATUS once. It does not expose Node's internal timer firing instant. A returned timeout flag does not prove that instant.
   • lib/gentle-ai-binary.ts:271-306 already hashes for integrity. Measure resolution and reuse safely available verified metadata, without extra hashing or version subprocesses. A file fingerprint does not prove the original executed image.
   • lib/review-sidebar-state.ts:160-208 emits synchronously; extensions/gentle-ai.ts:9539-9550 records whole-tool wall-clock timing separately. Neither allocates the observed 111,216 ms to a proven slow stage.

   Acceptance criteria

   1. Disabled mode adds no trace/invocations. Enabled capture is bounded, isolates overlapping calls, exposes only allowed metadata, and clears reliably.
   2. Fake-adapter tests preserve success/failure behavior, invocation count, timeout configuration, and protocol bytes, including when observers throw.
   3. Isolated Node-child checks distinguish adapter and host durations without existing review transactions. Existing binary, elapsed-ledger, and sidebar tests remain passing.
   4. No automatic export/publication, deadline increase, or recovery/replay of the stopped review. Synthetic checks prove instrumentation behavior, not the original incident.

   Native stage instrumentation is a separate follow-up only if subsequent authorized evidence localizes the delay there. No code changes or tests have been executed for this design.
7. dnlrsls

   added

   status:approvedIssue approved by maintainer; PR may be openedIssue approved by maintainer; PR may be opened

   and removed

   status:needs-design

   on Oct 8, 2026
8. dnlrsls commented on Oct 10, 2026

   

   dnlrsls

   on Oct 10, 2026

   Member

   More actions

   Investigation update: #1950 merged the opt-in STATUS timing diagnostics and Windows fixture corrections. It did not reproduce or fix the original macOS timeout. This issue remains open, and investigation of the original incident is blocked on missing preserved evidence.

   Three isolated inventory-contract checks passed, with independent read-only evidence audits:

   • Historical source 51a5d9e: empty lineage inventory completed in 26 ms; an empty synthetic compact-v2 lineage returned complete=false and authoritative=false in 25 ms, without a timeout.
   • Pinned modern source 417c7a24: the equivalent incomplete-lineage fixture returned complete=true and authoritative=true in 54 ms, while still identifying the unusable entry as incomplete-store-entry.
   • The synthetic LOCK remained physically present and all recorded .git paths and bytes were unchanged. These Windows source-compiled API checks are not the original macOS binary, native CLI, or controller execution. Authoritative inventory does not make a damaged lineage valid. Cancellation, full-suite and CI behavior were not tested by these experiments; timings are observations, not benchmarks.

   The tested completeness condition is already handled in the pinned modern snapshot, so these results do not justify a duplicate production fix. The original timeout cause and a safe, audited, version-matched continuation remain unestablished. Next, we need already-preserved, sanitized original error/controller payloads, invocation timing and executable provenance, and any contemporaneous authority classification or OS-lock evidence. pre_native is a failure classification, not proof of where execution stalled; stale PID metadata is not proof of lock ownership. No additional STATUS retry, real-authority mutation, recovery, or capture was performed for these checks, and none is proposed to obtain this evidence.