Carry an unattended fail-closed deny to the gateway (gatewaystack-connect#690 fix 3) - #25
Open
davidcrowe wants to merge 1 commit into
Open
Carry an unattended fail-closed deny to the gateway (gatewaystack-connect#690 fix 3)#25davidcrowe wants to merge 1 commit into
davidcrowe wants to merge 1 commit into
Conversation
…oolUse (gatewaystack-connect#690 fix 3) The interactive fail-open branch has queued its lapse for the session's next PostToolUse since 0.14.0; the unattended fail-closed branch recorded nothing, so a call this client blocked while the gateway was answering allow left the two ledgers disagreeing with no way to see it. Same lapse log (posture: closed) and same per-session carry, with the detail marked so the gateway's row says blocked client-side, not ran ungoverned.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
gatewaystack-connect#690, fix 3 — the ledger reconciliation half. Stacked on #24 (0.15.0); merge that first. Gateway wording for the carried row: davidcrowe/gatewaystack-connect#1000.
What was wrong
Confirmed 2026-08-13 on that issue:
/govern/tool-useanswered a slow request with an allow after this hook had already aborted and, at an unattended tier, denied. The server's ledger said allowed; the agent was blocked; neither side could see the contradiction. Fixes 1 and 2 (retry within budget, duplicate-hook detection) shipped in 0.10.2. Since 0.14.0 the interactive fail-open branch queues its lapse and the session's next PostToolUse carries it to the gateway aspre_lapse. The unattended fail-closed branch still recorded nothing anywhere.What this does
On an unattended-tier outage the hook still denies exactly as before, and now also:
lapse.logline withposture: "closed"(the interactive branch's lines have no posture field, so the two are distinguishable in the same file);fail-closed (<tier> tier): <detail>, so the session's next PostToolUse carries it aspre_lapseand the gateway writes the row. The gateway side reads that prefix and stamps the row "blocked client-side: gateway unreachable at PreToolUse, unattended tier fails closed" instead of "ran ungoverned" — a call that never ran must not be recorded as having run ungoverned.Nothing about the deny itself changes: same message, same steer, same exit.
Tests
test/fail-closed-carry.test.mjs: background-tier outage → deny,posture: "closed"lapse line, marked marker; the next PostToolUse carries it and clears on 2xx; the carried record never changes the PostToolUse output. Fullnode --test: 118 pass.