test: pipefail proof (DO NOT MERGE) - #206
Closed
MichaelTaylor3d wants to merge 5 commits into
Closed
Conversation
Wires sage::sync (initial_sync + run_update_loop, zero production call sites today) behind a supervisor with a real lifecycle, records the peak, and serves control.wallet.syncStatus. Co-Authored-By: Claude <noreply@anthropic.com>
`sage::sync` was a complete subscription loop with no production call site, so `sync_state.peak_height` was NULL on every install. Add the supervisor that owns its lifecycle — connect, catch up, consume pushes, reconnect with a jittered 1s..60s backoff, shut down cleanly — and the control-plane surface that reports it. The invariant this is built around: a catch-up must never run over an empty puzzle-hash set. A fresh install has zero custodied keys, so that is the DEFAULT path, not an edge case. An empty subscription is answered "finished" at once, which would set `initial_sync_complete`, flip `routing::route` to the DB tier, and answer every wallet-scoped read from a DB holding no coins. Guarded in `initial_sync` itself as well as in the supervisor, because a caller-side check is one refactor away from gone. The subscription set comes from custody's persisted PUBLIC keys, readable while every wallet is locked, so the supervisor starts at boot with no seed and nothing on this path can sign (SS908). `control.wallet.syncStatus` and `control.peerCounts` (dig-node-control-interface 0.8.0): `synced` requires a completed catch-up AND a live peer, so a replica that went offline reports `syncing`. The height is the replica's own, read from the DB and never from `chain_peak`'s coinset oracle -- that would answer the replica's progress with a third party's number and route an unauthenticated loopback read into outbound requests. Both methods take `chia_peer_count` from one accessor so they cannot disagree. Closes #2501 Closes #2408 Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
…kwards A `coin_state_update` could roll the wallet replica back to any depth — including height 0, which deletes every coin — while leaving `initial_sync_complete` set. The routing gate then served that emptied DB as authoritative, so a funded wallet answered `balance 0` with `synced: true`, persistently. The peer socket is attacker-reachable: discovery tries `127.0.0.1:8444` before any introducer and the client does not verify the server certificate. * Clear `initial_sync_complete` on any applied rollback or backwards peak, so wallet reads route to the fallback tier until a genuine catch-up re-establishes it. * Refuse a fork deeper than 128 blocks and drop the session, leaving the replica intact. * Filter applied coin states to the puzzle-hash set the session actually subscribed. * Refuse a backwards `new_peak_wallet`; that height bounds a claimed confirmation. * Re-poll the subscription set while a peak-only session is connected, so a wallet created after boot is subscribed in seconds rather than at the next disconnect. * Add `Config::enable_chain_sync` and turn it off in the integration harness, which was dialling `127.0.0.1:8444` and the Chia DNS introducers from every test. * Add `set -o pipefail` to the coverage step: the Actions default shell lacks it, so the required check reported green off `tee` while the test run died with exit status 102. * Remove the dead `AppState::wallet_sync` field and its false doc claim. Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Temporary scratch PR to observe the coverage gate turn RED on a failing test after adding
set -o pipefail(#2501, R2). Closed immediately after the observation.