hotcell-server 0.6.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14fae075c3d4fef73a330453eff2c295ac7e67895d50e2b9ad73d800b50ff2f8
-  data.tar.gz: d3730524324b2283332bdf2f04c90923a6dc3b0ed4a8b6821b10dc46a7e1fd3a
+  metadata.gz: 53155a8007bc4aca15485dd336ec9a4f74942a0315d14b605e3f05b224d68f01
+  data.tar.gz: bfb05888e741fb289abb075712894900b022c16d32affd5f21d53a44f2f437da
 SHA512:
-  metadata.gz: 063e11ec9aac319a707f3ca11d2d92b02d4aeeeffc35fdf2ec7e169ab8e14b82f4949b0d6f03255a4285186d43620ccb102584feaa616c02677ce6cefbee39b4
-  data.tar.gz: f7ca005517c6bc32c6e3b803b3c577b4e5e103bcc34b603e64534526430189b8f5b39cc87ee3235832ec4d2c078088091251fa1c66e409111ef20020d6d3e5ff
+  metadata.gz: d9a0fe3431faabd5b3f19fdac5afd4f5346e85dc4513598242253134d7b392352d15de9ff9debab298103997ac1a28938c1cb1cbb04db2f80121e02dd2fe72c9
+  data.tar.gz: 8e35674f33719a62d26a4a269a19017deb9e7de30b8afbf5802a22cba0db6abd5a9348f90cb81e7691dd9f8bb6f3db01d1c8e7e0e0ba4db106a9a7547ce6788a

data/lib/hot_cell/log.rb

@@ -12,7 +12,7 @@ module HotCell
   # This is the channel for everything no response can carry: deadline kills, reaps that found a signal,
   # boot checks, and queue high-water.
   #
-  # Lines follow docs/LOGS.md: ECS field names, domain fields under the hotcell namespace. The fleet's
+  # Lines follow docs/observability.md: ECS field names, domain fields under the hotcell namespace. The fleet's
   # collector routes on service.name, takes the record timestamp from @timestamp, and severity from
   # log.level, so those three are load-bearing: renaming any of them silently drops or mislabels every
   # cell log line in production.

data/lib/hot_cell/operation.rb

@@ -57,7 +57,7 @@ module HotCell
       # class's own declaration, or of the nearest ancestor's when this class has none yet. That is what
       # lets a subclass narrow a single number, and what lets an operator give a shipped operation a
       # different budget from an operations file, after the operation loads, without editing the gem. The
-      # cell's own limits still clamp whatever is declared. docs/DEPLOYMENT.md, "Changing a shipped
+      # cell's own limits still clamp whatever is declared. docs/operation-api.md, "Changing a shipped
       # operation's limits".
       def limits(**values)
         return inherited_value(:@limits) || Limits.new if values.empty?

data/lib/hot_cell/server/errors.rb

@@ -7,8 +7,13 @@ module HotCell
 
   # The input could not be decoded. Terminal: the same bytes fail the same way on an idle cell. Common
   # rather than exceptional — it covers truncated uploads, formats the build was not compiled with, and
-  # formats deliberately refused.
-  class UnreadableInput < OperationError; end
+  # formats deliberately refused. A subclass may name the failure's cause, for a caller that must act
+  # on the reason without parsing a message.
+  class UnreadableInput < OperationError
+    def self.cause
+      nil
+    end
+  end
 
   # Reported as `killed` with `cause: memory` rather than as an ordinary failure, because it is the
   # decompression-bomb case and a caller must be able to act on it without parsing a message.

data/lib/hot_cell/server/version.rb

@@ -2,6 +2,6 @@
 
 module HotCell
   module Server
-    VERSION = "0.6.0"
+    VERSION = "1.1.0"
   end
 end

data/lib/hot_cell/slot.rb

@@ -37,7 +37,7 @@ module HotCell
   # uid and `0700` is the owner's own mode, so a concurrent sibling — or a `setsid` descendant of a finished
   # request, which process groups do not contain — can still write into a home the moment it exists. The
   # slot directory itself can be renamed aside and replaced, and `chmod` follows what it finds. Both are the
-  # residuals `docs/DESIGN.md` records under worker isolation, and neither is closed here.
+  # residuals `docs/design/worker-isolation.md` records, and neither is closed here.
   #
   # There is one directory per request and not two. A request's staged inputs and outputs are named inside
   # `$HOME` rather than in a scratch directory of their own, because the two had the same lifetime and the

data/lib/hot_cell/supervisor.rb

@@ -281,7 +281,7 @@ module HotCell
       # `Codes` already relies on when it refuses to attribute a signal to the input a worker was holding.
       # The premise is that handling TERM is not optional — it is how an orchestrator stops a cell without
       # killing requests in flight — and that denial of service against a cell is out of scope per
-      # docs/DESIGN.md.
+      # docs/design/threat-model.md.
       def trap_signals
         @signals, @signal_writer = IO.pipe
         trap("CHLD") { @signal_writer.write_nonblock "C", exception: false }
@@ -527,9 +527,9 @@ module HotCell
         # capability and so survives `cap-drop ALL`, and neither the deadline kill nor the reap sweep reaches
         # it afterwards. It then runs untimed until `pids-limit` or the cgroup ends it.
         #
-        # It reaches further than that, so this is not the denial of service docs/DESIGN.md puts out of
+        # It reaches further than that, so this is not the denial of service docs/design/threat-model.md puts out of
         # scope. A stolen listener needs a live process to hold it, and this escape is the only way one
-        # outlives the reap — so it is what turns the socket theft under "Worker isolation" from a dead
+        # outlives the reap — so it is what turns the socket theft in docs/design/worker-isolation.md from a dead
         # socket path into a cell that intercepts every later request.
         #
         # The premise is that nothing in this process prevents it. A process group is the only bound the
@@ -546,7 +546,7 @@ module HotCell
         # for it: a warning written from inside libvips is a `write(2)` in a C call Ruby cannot interrupt, so
         # the conversion would wait on the supervisor's scheduling — nearest exactly when the host is under
         # pressure and the supervisor is scheduled least. That trade is refused; the conversion path must
-        # never wait on the supervisor. What non-blocking loses instead is in docs/LOGS.md, and a test pins
+        # never wait on the supervisor. What non-blocking loses instead is in docs/observability.md, and a test pins
         # the flag so that a well-meaning fix has to argue with it.
         stderr_reader.close
         stderr_writer.fcntl Fcntl::F_SETFL, stderr_writer.fcntl(Fcntl::F_GETFL) | Fcntl::O_NONBLOCK

data/lib/hot_cell/worker.rb

@@ -219,7 +219,8 @@ module HotCell
 
         response
       rescue *operation.unreadable => error
-        refuse "unreadable", error, timing
+        cause = error.class.respond_to?(:cause) ? error.class.cause : nil
+        refuse "unreadable", error, timing, cause: cause
       end
 
       # `post` returns what each output received and the worker used to throw all of it away, leaving the

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hotcell-server
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 1.1.0
 platform: ruby
 authors:
 - Mike Dalessio
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.6.0
+        version: 1.1.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.6.0
+        version: 1.1.0
 description: |
   Runs a HotCell container. A supervisor listens on two Unix sockets, forks a worker for each request,
   and enforces a wall clock deadline and resource limits on it. Write the work as a subclass of
@@ -64,8 +64,9 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/basecamp/hotcell
-  source_code_uri: https://github.com/basecamp/hotcell/tree/v0.6.0/hotcell-server
-  changelog_uri: https://github.com/basecamp/hotcell/blob/v0.6.0/CHANGELOG.md
+  source_code_uri: https://github.com/basecamp/hotcell/tree/v1.1.0/hotcell-server
+  changelog_uri: https://github.com/basecamp/hotcell/blob/v1.1.0/CHANGELOG.md
+  documentation_uri: https://basecamp.github.io/hotcell/
   bug_tracker_uri: https://github.com/basecamp/hotcell/issues
   rubygems_mfa_required: 'true'
 rdoc_options: []
@@ -82,7 +83,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.16
 specification_version: 4
 summary: 'Run a HotCell: the supervisor, the worker, and the operation API.'
 test_files: []