Preserve transport truth and batch attributed requests - #749
Open
tony wants to merge 6 commits into
Open
Conversation
tony
force-pushed
the
engine-ops-hardening
branch
from
August 23, 2026 01:21
d6347b9 to
1f7c749
Compare
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## engine-ops-on-seam #749 +/- ##
======================================================
+ Coverage 79.60% 80.52% +0.92%
======================================================
Files 240 242 +2
Lines 16511 17687 +1176
Branches 2075 2164 +89
======================================================
+ Hits 13143 14243 +1100
- Misses 2652 2705 +53
- Partials 716 739 +23 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
why: Direct argv parsing, pinned server scope, control-mode correlation, and async subprocess cleanup could misroute commands, misattribute results, leak process resources, or leave pane output encoded. what: - Protect literal semicolons and reject incompatible engine connections - Correlate control replies without treating guard-shaped output as protocol - Drain and reap async children through cancellation and reader failures - Expose decoded pane-output bytes to control-mode consumers
why: Semicolon folding erased control-mode reply boundaries, reported failures against the wrong operations, and borrowed tmux's server-global marked pane. what: - Replace folded command strings with ordered batches of distinct requests - Validate planner partitions, dependency boundaries, and result cardinality - Snapshot in-flight plans and bindings across sync and async execution - Make workspace, fluent, query, docs, and CLI surfaces use batching vocabulary
why: Adapter lifespans did not distinguish borrowed from owned engines, and a second cancellation or close failure could strand resources or mask the body exception. what: - Model engine ownership and close only adapter-owned instances - Shield one close task through repeated cancellation with stable precedence - Align plan preview and execution defaults on the batching planner - Cover concurrent clients, borrowed engines, and close-error propagation
why: The earlier workload could not measure planner batching and conflated planner steps, engine calls, tmux requests, and transport process models. what: - Add session x window x pane scenarios with verified live postconditions - Report planner, request, engine-call, and process-model quantities separately - Mark historical timings stale until regenerated with the current workload - Add lossless source-scroll and bounded-overload async control demos
why: Sync warmup checked the full expected session set from inside the per-session build loop, so it validated every requested name after building only the first one. Every multi-session scenario aborted after its first build, which took valid hierarchy benchmarks down with it. what: - Build every warmup session before topology verification, and clean the set only once it passes - Cover it through the public matrix command, requiring a clean exit, so the regression is pinned at the surface a user actually invokes
why: The script carries a `uv run --script` shebang but shipped without the executable bit, so the shebang was misleading: the one invocation it advertises could not work. ruff's EXE001 catches exactly this, and CI runs on Linux where the rule applies -- it is skipped on Windows and WSL, so a developer working there cannot see it locally. what: - Record the file as mode 755, matching the other runnable scripts
tony
force-pushed
the
engine-ops-hardening
branch
from
August 23, 2026 13:31
80c20ae to
8389250
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes by area
Transports
src/libtmux/_internal/tmux_argv.py,engines/connection.py: protect literal semicolons and reject incompatible engine connections.experimental/engines/control_mode.py: correlate replies without treating guard-shaped output as protocol.experimental/engines/async_control_mode.py,asyncio.py: drain and reap async children through cancellation and reader failures.pane.py,experimental/mcp/events.py: expose decoded pane-output bytes to control-mode consumers.Planner
experimental/ops/: ordered batches of distinct requests in place of folded command strings, with planner partitions, dependency boundaries, and result cardinality validated. In-flight plans and bindings are snapshotted across sync and async execution.MCP lifespan
experimental/mcp/: model engine ownership and close only adapter-owned instances, shielding one close task through repeated cancellation with stable precedence.Benchmark matrix
Design decisions
Batches, not folded strings. Folding several commands into one semicolon-separated string erases control-mode's reply boundaries: the transport returns output with no way to say which command produced which part, so a failure gets reported against the wrong operation. Ordered batches keep one request per result.
Close only what you own. An adapter handed an engine by its caller must not close it — the caller may still be using it. Ownership is now modelled explicitly rather than inferred from who happened to construct it.
Warmup completes before it is checked. Verifying the full expected topology from inside the per-session build loop asserts a postcondition that cannot hold until the loop finishes, so every multi-session scenario failed on its first build.
Test plan
uv run ruff check .— lint cleanuv run ruff format .— formatting clean, tree unchangeduv run mypy— types cleanuv run pytest --reruns 0— see the note belowjust build-docs— docs build cleantests/test_server.py::test_new_session_shell_envfails from a shell whose environment exceeds tmux's command-length limit; it is unrelated to this branch and is fixed higher in the stack.