Keep the invite path retryable through host session rollover - #118
Merged
Merged
Conversation
An idle host session rendezvous window lapses 120s after open while the session stays "current" until the 10-minute deadline, so a fresh client could fetch discovery for a window that was already gone or nearly gone. Mint an invitation only when the remaining window retains at least 30s of runway for the Responder claim to land; anything less returns V2TransientCoordinatorError (retryable) before any state is created. The same 30s invariant is enforced atomically at invitation-store commit time: create passes a commitGuard evaluated inside the serialized write, so a clock that drops below the runway during create is refused with V2InvitationWindowUnavailableError — converted to V2TransientCoordinatorError — and neither an invitation record nor role state is left behind. Constraint: the 120s invitation window is a protocol invariant enforced by the monitor; rotation, not extension, is the fix surface. The 90s agreement duration stays separate. Rejected: filter expired sessions out of /v1/discovery/current | leaves a dead window with nothing to rendezvous on and cannot rotate the host Rejected: keep a post-create expiry throw in the coordinator | the invitation record is already persisted at that point, so rejecting there orphans state Rejected: weaker commitGuard of now() < expiry | a commit at 29s remaining would silently violate the 30s runway guarantee the precheck established Confidence: high Scope-risk: narrow — invite() runway guard, store commitGuard, tests Directive: INVITATION_MIN_RUNWAY_MS must stay well below the 120s window; if responder claim latency grows, prefer faster rotation over shrinking the runway. Never gate expiry outside the commitGuard — only the serialized write can refuse the commit atomically. Tested: coordinator suite 21/21 incl. near-expiry (5s remaining) and runway-crossing-during-create cases; the crossing test proves create ran once, the record is absent from the invitation store, and no role state exists; root npm test 663 total, 0 fail; build + git diff --check clean Not-tested: live relay round-trip during production rollover
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
invite()now requiresINVITATION_MIN_RUNWAY_MS(30s) of remaining invitation window before minting; less returnsV2TransientCoordinatorError→ retryableHANDSHAKE_TEMPORARILY_UNAVAILABLEbefore any state exists.create()forwards acommitGuardevaluated inside the store's serialized write; if the clock drops below the runway mid-create, the commit is refused withV2InvitationWindowUnavailableError→ converted toV2TransientCoordinatorError. No invitation record, no role state.currentrefreshes; clients retry into the fresh session.Regression coverage
currentdiscovery → retryable + zero role statecreatenever invoked, zero role statecreateran once, record absent from invitation store, zero role stateTest plan
npm test: 663 total (627 workspace + 36 infra), 0 fail;npm run buildclean;git diff --checkcleanReviewed commit:
0bc59ba2381e257517164f3543df4cd78d9bbcc4(independent review: APPROVED, zero findings)Generated with Devin