gowalk-cicd 1.0.112 → 1.0.114

package/CLAUDE.md

@@ -214,6 +214,8 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   that multiline secret masking can erase. Never reconstruct masked fields or include arbitrary text.
   Native bundle/Pods failures emit `native_prepare_failed` with fixed refusal codes and observed
   signals. Unknown signals remain unclassified; never copy child output or commands into annotations.
+  Timeout and cancellation retain the existing bounded sanitized diagnostic after owned-child cleanup;
+  preserve the failure code, install deadline and retry fences.
 - The mobile workflow's feature-branch-only `backend-preview` job bootstraps a
   new app before GitHub registers `deploy-backend.yml` on the default branch.
   Default-branch deploys continue through the separate backend workflow.
@@ -395,8 +397,12 @@ node /path/to/gowalk-cicd/bin/cli.mjs
   `APP_ROBOT_PLAY_EDIT_BINDING` is panel-provisioned repository data; workflows pass it as
   `PLAY_EDIT_BINDING` with the repo-local GitHub token and `contents:write`/`actions:read`.
   `play-upload/owner_run.cjs` protects Python entrypoints; `run.cjs` holds the same owner across
-  its permitted upload retry. Missing/retired bindings, unknown write outcomes and active owners
-  refuse before provider work; only exact terminal run/attempt/source proof permits recovery.
+  its permitted upload retry. An active owner gets a single 60-second acquisition wait budget;
+  each retry revalidates the record, cancellation interrupts the wait, and an expired budget
+  never clears an owner. Missing/retired bindings and unknown write outcomes still refuse;
+  only exact terminal run/attempt/source proof permits CI-owner recovery.
+  Both entrypoints emit brace-free `play_edit_owner` errors with fixed codes and optional child
+  exit evidence, preserving the existing upload receipt and refusal. Never reconstruct masked text.
   Other packages stay parallel. The GitHub coordination request is fixed-origin and does not
   change the Google account proxy. Update workflow wiring as well as action directories.
 

package/README.md

@@ -361,6 +361,7 @@ the situation and whose **message** is one line of JSON carrying a versioned
 | `play_review_pending` | `gowalk-cicd/play-review-pending.v1` | `package`, `track`, `version_code` |
 | `play_upload_result` | `gowalk-cicd/play-upload.v1` | `ok`, `code`, `attempts`, `review_pending`, upstream identity |
 | `play_upload_diagnostic` | `gowalk-cicd/play-upload-diagnostic.v1` | Fixed process evidence; see below |
+| `play_edit_owner` | `gowalk-cicd/play-owner.v1` | Ownership refusal; no implied upload retry permission |
 | `store_version_locked` | `gowalk-cicd/store-version-locked.v1` | `version`, `state`, `build_number` |
 | `firebase_symbols_pending` | `gowalk-cicd/firebase-symbols-pending.v1` | `platform`, `app_id`, `source_sha`, `artifact`, `file`, `sha256`, `status` |
 | `mobile_upload_reused` | `gowalk-cicd/mobile-upload-reused.v1` | `platform`, `fingerprint`, `run_id`, `run_attempt`, `source_sha`, `deployment_id`, `next_action` |
@@ -379,6 +380,8 @@ Native bundle and Pods failures emit `native_prepare_failed` with schema
 Backend failures emit `backend_deploy_failed` with schema `gowalk-cicd/backend-deploy-failed.v1`,
 the runner/host `phase` and `exit_code`. These receipts preserve the failed result and exclude
 private command output, commands, hosts and runtime credentials. Empty signals are unclassified.
+Timeout and cancellation preserve the bounded, sanitized child diagnostic after owned-process cleanup;
+observed signals do not authorize another attempt or change the failed result.
 The backend message is `gowalk-cicd/backend-deploy-failed.v1 phase=<phase> exit_code=<code>`:
 fixed fields without JSON braces, which GitHub can mask when a multiline secret has brace-only lines.
 Consumers validate the complete envelope, the known phase and exit code 1–255; older JSON messages
@@ -475,6 +478,16 @@ bounded to 16 KiB. No provider message, path, URL, track or credential is republ
 These observations never authorize a retry. Missing commit output does not prove no mutation,
 and a reported commit does not prove review submission. Unknown failures remain unclassified.
 
+Package-owner acquisition rechecks an occupied record within one 60-second wait budget before
+provider work. Every read retains the binding and identity checks; cancellation interrupts the wait.
+Time passing never authorizes clearing an owner. A known CI owner still requires exact terminal
+run, attempt and source proof before recovery; the panel releases its own requests.
+Both entrypoints emit `play_edit_owner` as `gowalk-cicd/play-owner.v1 code=<code> child_exit_code=<0-255|unknown>`.
+Codes are `play_owner_binding_required`, `play_owner_unverified`, `play_owner_busy`,
+`play_owner_release_unverified`, `play_owner_cancelled`, `play_owner_principal_unverified`,
+`play_owner_child_failed` and `play_owner_package_unverified`. An unknown child exit proves no outcome.
+These errors preserve the failed job and existing upload receipt; they do not authorize replay.
+
 An expired/deleted edit does not identify its cause. Another edit opened with the
 same API user/package can invalidate it; avoid competing read edits while uploading.
 An external actor is not proven by an expired-edit error alone. Ambiguous outcomes

package/action/.daemux-version

@@ -1 +1 @@
-1.0.112
+1.0.114

package/action/scripts/native_bundle.py

@@ -22,7 +22,7 @@ def command(argv: list[str], cwd: Path, log, *, timeout: float = 900) -> int:
     try:
         return native_pods_process.command(argv, cwd, log, timeout=timeout)
     except native_pods_process.Interrupted:
-        raise guard.Refused("native_pods_operation_interrupted") from None
+        refuse("native_pods_operation_interrupted", log, guard.Refused)
     except (OSError, RuntimeError, subprocess.SubprocessError):
         raise guard.Refused("native_pods_process_unverified") from None
 

package/action/scripts/native_pods_retry.py

@@ -7,7 +7,7 @@ import time
 
 import native_bundle
 import native_dependency_guard as guard
-from native_pods_diagnostics import diagnostic
+from native_pods_diagnostics import diagnostic, refuse
 
 TERMINAL = re.compile(
     r"certificate|SSL peer|TLS|authentication|unauthorized|forbidden|permission denied|"
@@ -27,7 +27,7 @@ def install(argv: list[str], folder, log, snapshot: dict, *, timeout: float = 90
         native_bundle.unchanged(snapshot)
         remaining = deadline - time.monotonic()
         if remaining <= 0:
-            raise guard.Refused("native_pods_operation_interrupted")
+            refuse("native_pods_operation_interrupted", log, guard.Refused)
         with tempfile.TemporaryFile() as child_log:
             code = native_bundle.command(argv, folder, child_log, timeout=remaining)
             body = diagnostic(child_log)

package/action/scripts/test_native_pods.py

@@ -142,6 +142,7 @@ class PodsTests(unittest.TestCase):
         self.locked()
         script = self.root / "pod"
         script.write_text('#!' + sys.executable + '\nimport os,time\nfrom pathlib import Path\n'
+                          'print("Downloading dependencies\\nRead timed out\\nPRIVATE_SENTINEL", flush=True)\n'
                           'Path("owned-child").write_text(str(os.getpid()))\ntime.sleep(30)\n')
         script.chmod(0o700)
         self.env["PATH"] = str(self.root) + os.pathsep + self.env["PATH"]
@@ -155,8 +156,11 @@ class PodsTests(unittest.TestCase):
             output, errors = child.communicate(timeout=10)
         self.assertTrue((self.root / "owned-child").exists())
         self.assertEqual(json.loads(output)["code"], "native_pods_operation_interrupted")
+        self.assertIn("Downloading dependencies", json.loads(output).get("diagnostic", ""))
+        self.assertNotIn("PRIVATE_SENTINEL", output + errors)
         self.assertTrue(errors.startswith("::error title=native_prepare_failed::"))
         self.assertEqual(json.loads(errors.strip().split("::", 2)[2])["code"], "native_pods_operation_interrupted")
+        self.assertEqual(json.loads(errors.strip().split("::", 2)[2])["signals"], ["connection_timeout"])
         owned_pid = int((self.root / "owned-child").read_text())
         deadline = time.monotonic() + 5
         while time.monotonic() < deadline:

package/action/scripts/test_native_pods_retry.py

@@ -95,6 +95,7 @@ class RetryTests(unittest.TestCase):
             self.assertEqual([c.kwargs["timeout"] for c in command.call_args_list], [899, 200])
             command.reset_mock()
             with patch.object(native_pods_retry.time, "monotonic", side_effect=[0, 1, 901]):
-                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted"):
+                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted") as caught:
                     native_pods_retry.install(["fixture"], self.root, log, {})
             self.assertEqual(command.call_count, 1)
+            self.assertEqual(caught.exception.diagnostic, PARTIAL)

package/action/scripts/test_native_pods_timeout.py

@@ -0,0 +1,34 @@
+"""Keep a real timed-out Pod child's sanitized evidence after its private log closes."""
+import os
+from pathlib import Path
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+import native_dependency_guard as guard
+import native_pods_retry
+
+
+@unittest.skipUnless(os.name == "posix", "owned POSIX process groups")
+class TimeoutTests(unittest.TestCase):
+    def test_timeout_retains_bounded_diagnostic_without_retrying_or_leaving_child(self):
+        with tempfile.TemporaryDirectory(prefix="native-pods-timeout-") as folder:
+            root = Path(folder)
+            script = ('import os,time; from pathlib import Path; '
+                      'Path("attempts").open("a").write("attempt\\n"); '
+                      'print("x" * 20000, flush=True); '
+                      'print("Downloading dependencies\\nRead timed out\\nPRIVATE_SENTINEL", flush=True); '
+                      'Path("child").write_text(str(os.getpid())); time.sleep(30)')
+            with tempfile.TemporaryFile() as log, patch.dict(os.environ, {"TEST_TOKEN": "PRIVATE_SENTINEL"}):
+                with self.assertRaisesRegex(guard.Refused, "native_pods_operation_interrupted") as caught:
+                    native_pods_retry.install([sys.executable, "-c", script], root, log, {}, timeout=1)
+            self.assertEqual((root / "attempts").read_text(), "attempt\n")
+            with self.assertRaises(ProcessLookupError):
+                os.kill(int((root / "child").read_text()), 0)
+            body = getattr(caught.exception, "diagnostic", "")
+            self.assertIn("Downloading dependencies", body)
+            self.assertIn("Read timed out", body)
+            self.assertNotIn("PRIVATE_SENTINEL", body)
+            self.assertLessEqual(len(body), 4000)
+            self.assertLessEqual(len(body.splitlines()), 30)

package/android-action/.daemux-version

@@ -1 +1 @@
-1.0.112
+1.0.114

package/android-action/play-upload/owner.cjs

@@ -1,5 +1,7 @@
 const http = require('./owner_http.cjs');
 const record = require('./owner_record.cjs');
+const {performance} = require('node:perf_hooks');
+const {setTimeout: delay} = require('node:timers/promises');
 
 async function seal(client, selected) {
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -14,16 +16,27 @@ async function seal(client, selected) {
   throw new Error('play_owner_release_unverified');
 }
 
-async function acquire(client, selected, attempted = () => {}) {
+async function acquire(client, selected, attempted = () => {}, waiting = {}) {
+  const now = waiting.now || (() => performance.now());
+  const sleep = waiting.sleep || ((ms, signal) => delay(ms, undefined, {signal}));
+  const deadline = now() + 60000;
   const protocol = (await client.read('protocol.json')).value;
   if (protocol?.schema !== record.schema || protocol.repository !== selected.value.repo
       || Object.keys(protocol).length !== 2) throw new Error('play_owner_unverified');
-  for (let attempt = 0; attempt < 3; attempt++) {
+  for (let attempt = 0; attempt < 3;) {
+    if (waiting.signal?.aborted) throw new Error('play_owner_cancelled');
     const row = record.validate(await client.read(selected.path), selected);
     if (row.value.owner !== null) {
       const owner = row.value.owner;
-      if (owner.kind !== 'ci' || !record.terminal(await client.run(owner), owner)) throw new Error('play_owner_busy');
+      if (owner.kind !== 'ci' || !record.terminal(await client.run(owner), owner)) {
+        const remaining = deadline - now();
+        if (remaining <= 0) throw new Error('play_owner_busy');
+        await sleep(Math.min(5000, remaining), waiting.signal);
+        continue;
+      }
     }
+    if (waiting.signal?.aborted) throw new Error('play_owner_cancelled');
+    attempt++;
     const desired = record.replacement(row, selected.owner);
     attempted();
     try { await client.write(selected.path, row, desired); } catch { /* Only exact readback may adopt it. */ }
@@ -33,14 +46,15 @@ async function acquire(client, selected, attempted = () => {}) {
   throw new Error('play_owner_busy');
 }
 
-async function withOwner(env, packageName, operation, transport) {
+async function withOwner(env, packageName, operation, transport, timing = {}) {
   const selected = record.binding(env, packageName);
   const client = http.client(selected.value.repo, env.GITHUB_TOKEN, transport);
+  const controller = new AbortController();
   let cancelled = false, dirty = false, result, failure;
-  const stop = () => { cancelled = true; };
+  const stop = () => { cancelled = true; controller.abort(); };
   process.on('SIGTERM', stop); process.on('SIGINT', stop);
   try {
-    await acquire(client, selected, () => { dirty = true; });
+    await acquire(client, selected, () => { dirty = true; }, {...timing, signal: controller.signal});
     if (cancelled) throw new Error('play_owner_cancelled');
     result = await operation(() => cancelled);
   } catch (error) { failure = error; }
@@ -48,7 +62,7 @@ async function withOwner(env, packageName, operation, transport) {
     try { if (dirty) await seal(client, selected); } catch { failure = new Error('play_owner_release_unverified'); }
     process.off('SIGTERM', stop); process.off('SIGINT', stop);
   }
-  if (cancelled && !failure) failure = new Error('play_owner_cancelled');
+  if (cancelled && (!failure || failure.name === 'AbortError')) failure = new Error('play_owner_cancelled');
   if (failure) {
     if (result !== undefined) failure.operationResult = result;
     throw failure;
@@ -58,4 +72,10 @@ async function withOwner(env, packageName, operation, transport) {
 
 const codes = ['play_owner_binding_required', 'play_owner_unverified', 'play_owner_busy',
   'play_owner_release_unverified', 'play_owner_cancelled', 'play_owner_principal_unverified'];
-module.exports = {acquire, seal, withOwner, codes};
+function annotation(reason, childExit) {
+  const allowed = [...codes, 'play_owner_child_failed', 'play_owner_package_unverified'];
+  const code = allowed.includes(reason) ? reason : 'play_owner_unverified';
+  const exit = Number.isInteger(childExit) && childExit >= 0 && childExit <= 255 ? childExit : 'unknown';
+  return `::error title=play_edit_owner::gowalk-cicd/play-owner.v1 code=${code} child_exit_code=${exit}`;
+}
+module.exports = {acquire, seal, withOwner, codes, annotation};

package/android-action/play-upload/owner_run.cjs

@@ -51,9 +51,7 @@ async function main(argv = process.argv.slice(2), env = process.env) {
   } catch (error) {
     const code = [...owner.codes, 'play_owner_child_failed', 'play_owner_package_unverified'].includes(error.message)
       ? error.message : 'play_owner_unverified';
-    const receipt = {schema: 'gowalk-cicd/play-owner.v1', code};
-    if (Number.isInteger(error.operationResult?.code)) receipt.child_exit_code = error.operationResult.code;
-    console.log(`::error title=play_edit_owner::${JSON.stringify(receipt)}`);
+    console.log(owner.annotation(code, error.operationResult?.code));
     process.exitCode = 1;
   }
 }

package/android-action/play-upload/run.cjs

@@ -44,6 +44,7 @@ async function main() {
       upload(program, env, directory, processRunner.execute, 3600000, cancelled,
         (attempt, result) => console.log(diagnostics.annotation(attempt, result))));
   } catch (error) {
+    if (owner.codes.includes(error.message)) console.log(owner.annotation(error.message));
     const allowed = ['assigned_proxy_required', 'runner_context_required', 'uploader_integrity_refused',
       'uploader_source_unavailable', ...owner.codes];
     receipt = {ok: false, code: allowed.includes(error.message) ? error.message : 'uploader_failed',

package/backend-action/.daemux-version

@@ -1 +1 @@
-1.0.112
+1.0.114

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.112",
+  "version": "1.0.114",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {