fix(dogfood): close the confine-tamper pins race at its root (exit-wait)#119
Merged
Conversation
The macOS confine dogfood intermittently failed the tamper assertion with 'failed closed on pins, not confine — gate not isolated' (seen again on a docs-only PR #118, proving it's nondeterministic). #114 narrowed this by deleting the whole pins sidecar set before tampering, but couldn't beat the real cause: an async writer in another process. Root cause: driveHappy() resolved the instant the 3rd JSON-RPC response arrived and did child.kill() WITHOUT waiting for exit. The relay child's off-thread pins TOFU write (pins.json + .integrity, triggered by tools/list) was still in flight when control returned, so it landed AFTER the tamper step's rmSync — recreating a partial pins state, so the tampered run's readPins raised PINS-READ-ERROR and failed closed for an UNRELATED reason, masking the CONFINE gate under test. Fix: driveHappy() now resolves only on the child's 'exit' event (with a 2s SIGKILL escalation if SIGTERM stalls). Once the process is gone, no write from it can land after the delete, so the rmSync is final. Test-harness only — no product code; the confine enforcement path itself was always correct (secret read denied EPERM). Verified 3x locally.
m1ngshum
added a commit
that referenced
this pull request
Jul 3, 2026
Developer-reach release: Claude Code (~/.claude.json) becomes a first-class client (D1). First release to attach the CycloneDX SBOM correctly (v0.17.0's attach step tripped over GitHub immutable releases; fixed in #116). Also folds in the confine macOS dogfood race fix (#119). Version is derived from the git tag.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Symptom
The
confine dogfood (macOS)CI leg intermittently fails:It re-appeared on a docs-only PR (#118), which proves it's nondeterministic — identical code to the green #117. The merge still landed because this leg is advisory (not a required check), but a flaky gate erodes trust and keeps pinging.
Root cause
driveHappy()resolved the instant the 3rd JSON-RPC response arrived and calledchild.kill()without waiting for the child to exit. The relay child does an off-thread TOFU pins write (pins.json+.integrity) triggered by thetools/list; that write was still in flight when control returned to the tamper step'srmSync, so it landed after the delete — recreating a partial pins state. The tampered run'sreadPinsthen raisedPINS-READ-ERRORand failed closed for an unrelated reason, masking the CONFINE hash-mismatch gate under test.#114deleted the whole pins sidecar set to fix this, but a point-in-time delete can't beat an async writer in another process.Fix
driveHappy()now resolves only on the child'sexitevent (2sSIGKILLescalation ifSIGTERMstalls). Once the process is gone, no write from it can land after thermSync, so the delete is final and the tamper run sees a clean pins state — exercising the CONFINE gate as intended.Test-harness only — no product code. The confine enforcement itself was always correct (
secret read denied EPERMpasses every run). Verified 3× locally; the real proof is this PR's own macOS leg.