Repository navigation
Draft RFC: bounded job limits and recovery semantics (O03) - #22
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41dfe11556
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| The job deadline prevents admission of a call or retry with no positive budget | ||
| remaining. When it expires during a provider call, the host requests cancellation | ||
| once through the existing out-of-band cancellation mechanism. It preserves any | ||
| normalized outcome that returns, even after the deadline. Bounded persistence | ||
| and terminalization of that already-started attempt may continue within its | ||
| previously reserved material budget; they do not reset the deadline or permit |
There was a problem hiding this comment.
When a call is dispatched with any positive time remaining, its Provider Execution timeout_ms may still be as high as 3,600,000 ms (schemas/json/execution-contracts/v1/provider-execution.schema.json:446); this rule merely requests cancellation at the 300,000 ms job deadline and allows the call to return afterward. If cancellation is not honored promptly—as the later successful-response path explicitly anticipates—the purported five-minute execution budget can be exceeded by almost an hour. Require the call timeout to be no greater than the remaining job budget, or define another hard upper bound for cancellation completion.
Useful? React with 👍 / 👎.
| The original deadline MUST still be unexpired for restart-driven preparation, | ||
| dispatch, outcome advancement, or terminal linking. After expiry, only reads | ||
| and an explicitly requested cancellation-only marker/signal are permitted. |
There was a problem hiding this comment.
If the process restarts after the deadline while an exact provider outcome or immutable result is recoverable, this rule permits only reads or cancellation and the recovery table prohibits persistence or a terminal link. Because an unresolved job retains the only admitted-job slot (line 82), and no abandonment or other terminal reconciliation transition is defined, that common crash timing can leave the runner permanently rejecting every subsequent job. Add a bounded post-expiry reconciliation/closure path that cannot initiate provider work but can safely release the slot.
Useful? React with 👍 / 👎.
Summary
Draft RFC 0011 for Studio O03 #104. It proposes finite job/time/material limits and cancellation, retry, and restart/reconciliation rules for one synthetic Comic Manifest revision and one offline mock Provider Execution call per attempt.
Candidate host defaults are one active job with no queue, two attempts total, a 300,000 ms monotonic execution budget, 8 MiB rendered prompts, 16 MiB normalized provider text per call, 64 MiB generated artifacts per job, and 128 MiB aggregate material. Lifecycle metadata is capped at 32 entries of at most 32 KiB each, with 1 MiB reserved. These are proposed owner choices, not existing contract requirements.
Restart recovery is read-only by default. A one-job, one-transition caller/owner authorization is required before restart-driven mutation. A prepared call may dispatch once only if the reader confirms that
dispatch-startedis absent, using the existing IDs. Authorization cannot override an expired deadline, unknown clock epoch, changed revision, ambiguous dispatch, blocked timeout, or unresolved write. The explicit retry proposal is limited to one eligible, resolved no-action rate-limit result.RFC 0010 coordination
RFC 0010 was merged to
mainat 952518820f8f7984414acbedba9dcc8d7082f394 and remains Draft; contract-owner decision pending. The O03 RFC links to the current main document. The merge did not accept RFC 0010 or authorize production work.Decision boundary
This remains a design draft. It adds no schema, runtime, storage implementation, real provider, release, or production authority. Owner decisions are proposed in the RFC; semantic fixture rows are expectations, not executed tests.
Validation
git diff --checkpassed.Base:
952518820f8f7984414acbedba9dcc8d7082f394Head:
41dfe11556e2a7e9c9d66bc057f1fb8ca0003726