code-coordinator 0.5.209__tar.gz → 0.5.210__tar.gz

{code_coordinator-0.5.209 → code_coordinator-0.5.210}/.gitignore

@@ -18,3 +18,8 @@ tui/*.out
 # tui/cargo-config-local-quadraui.toml.example) — never commit a
 # machine-local co-development override.
 tui/.cargo/config.toml
+
+# scratch $HOME created inside disposable worktrees by the CI-mode
+# acceptance runner (scripts/coord-test-runner.sh) — never meant to
+# leave the throwaway worktree, let alone land in git history (#2527).
+.coord-ci-home/

{code_coordinator-0.5.209 → code_coordinator-0.5.210}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.209
+Version: 0.5.210
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.209 → code_coordinator-0.5.210}/code_coordinator.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-coordinator
-Version: 0.5.209
+Version: 0.5.210
 Summary: Coordinate Claude Code workers across multiple machines and repos.
 Author-email: John Donaghy <johnfdonaghy@gmail.com>
 License-Expression: LicenseRef-FSL-1.1-MIT

{code_coordinator-0.5.209 → code_coordinator-0.5.210}/code_coordinator.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "0.5.209",
+  "tag": "0.5.210",
   "distance": 0,
-  "node": "g8dd6856fa1b46016cf34e83dd691cc4cec06d72e",
+  "node": "gd5dc3b7d2bb67fd517cd7ac495abb3076f2017e4",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-21"

{code_coordinator-0.5.209 → code_coordinator-0.5.210}/coord/confirm_test.py

@@ -82,7 +82,12 @@ saying so:
   that lesson is not re-learned here;
 * a timeout (:data:`~coord.revalidate.KIND_TIMEOUT`) — a hung or merely slow
   suite says nothing about the branch. Classifying a timeout as a refutation
-  would let a too-tight ceiling fail every branch in the fleet, so it does not.
+  would let a too-tight ceiling fail every branch in the fleet, so it does not;
+* an external signal killing the confirmation subprocess (:data:`KIND_SIGNAL`,
+  #2527) — a negative ``returncode`` from `subprocess.run` (e.g. ``-15`` for
+  SIGTERM), most often a `coord-agent`/`coord-serve` restart landing mid-run.
+  The command never ran to completion, exactly like a timeout, so it gets the
+  identical inconclusive treatment rather than being read as "ran and failed".
 
 That asymmetry is the safety property: the worst case of a broken confirmation
 environment is that the Test stage behaves exactly as it did before this module
@@ -181,6 +186,17 @@ DISABLE_ENV_VAR = "COORD_CONFIRM_TEST_VERDICT"
 _FALSEY = frozenset({"0", "false", "no", "off", ""})
 _TRUTHY = frozenset({"1", "true", "yes", "on"})
 
+#: #2527: a confirmation subprocess terminated by an external signal (a
+#: coord-agent/coord-serve restart, a manual ``kill``, anything that delivers
+#: a signal rather than letting the command run to completion) — not
+#: :data:`KIND_TIMEOUT` (this module's own deadline) but the same shape from
+#: the branch's point of view: the suite never got a chance to finish, so
+#: nothing was learned about it. `subprocess.run` surfaces this as a negative
+#: ``returncode`` (``-signal.SIGTERM`` == ``-15``) through its normal return
+#: path rather than raising, which is exactly what let it slip past the
+#: existing ``TimeoutExpired`` carve-out and get misread as "ran and failed".
+KIND_SIGNAL = "signal"
+
 #: The only kinds that may overturn a PASS claim: a build or test command that
 #: ran to completion and returned nonzero. Nothing weaker. See the module
 #: docstring's fail-direction section — this frozenset IS that safety property.
@@ -188,7 +204,7 @@ REFUTING_KINDS = frozenset({KIND_BUILD, KIND_SUITE})
 
 #: Kinds meaning "the check could not reach a verdict". The caller falls back to
 #: the worker's own claim on any of these, which is pre-#2464 behaviour.
-INCONCLUSIVE_KINDS = frozenset({KIND_SETUP, KIND_INFRA, KIND_TIMEOUT})
+INCONCLUSIVE_KINDS = frozenset({KIND_SETUP, KIND_INFRA, KIND_TIMEOUT, KIND_SIGNAL})
 
 
 # ── Per-pass budget (#2464-review) ──────────────────────────────────────────
@@ -477,10 +493,35 @@ def _classify_failure(
 ) -> ConfirmationResult:
     """Turn a nonzero build/test exit into the right kind.
 
-    Order matters and mirrors :func:`coord.revalidate.revalidate`: infra first
-    (the suite never ran), then baseline-red (it ran, but the branch is not at
-    fault), and only what is left over is a genuine refutation.
+    Order matters and mirrors :func:`coord.revalidate.revalidate`: signal-kill
+    first (#2527 — the command never ran to completion at all, so there is
+    nothing left to classify), then infra (the suite never ran), then
+    baseline-red (it ran, but the branch is not at fault), and only what is
+    left over is a genuine refutation.
     """
+    if returncode < 0:
+        # #2527: a negative returncode means `subprocess.run` reports the
+        # child was killed BY a signal, not that it ran and exited nonzero —
+        # e.g. `-15` for SIGTERM from a `coord-agent`/`coord-serve` restart
+        # landing mid-confirmation, or a manual `kill`. Same fail-direction
+        # as `subprocess.TimeoutExpired` just above this function's callers:
+        # a command that never finished says nothing about the branch, so
+        # this must stay inconclusive — never `REFUTING_KINDS` — no matter
+        # how "nonzero" the raw exit code looks.
+        return ConfirmationResult(
+            kind=KIND_SIGNAL,
+            reason=(
+                f"confirmation {stage} command was killed by signal "
+                f"{-returncode} (exit {returncode}) rather than running to "
+                "completion — like a timeout, a command that never finished "
+                "says nothing about the branch, so this is not a refutation "
+                "(#2527)"
+            ),
+            output=_tail(output),
+            command=command,
+            returncode=returncode,
+            worktree=worktree,
+        )
     infra = is_infrastructure_failure(returncode, output)
     baseline = not infra and is_baseline_red_failure(returncode, output)
     if infra:
@@ -780,6 +821,7 @@ __all__ = [
     "CONFIRM_PASS_BUDGET_SECONDS",
     "DISABLE_ENV_VAR",
     "INCONCLUSIVE_KINDS",
+    "KIND_SIGNAL",
     "NOTIFY_BASE_CLIENT_TIMEOUT_SECONDS",
     "REFUTING_KINDS",
     "ConfirmationResult",

{code_coordinator-0.5.209 → code_coordinator-0.5.210}/tests/test_confirm_test.py

@@ -299,6 +299,113 @@ class TestConfirmBranch:
         assert result.refuted is False
         assert result.inconclusive is True
 
+    def test_signal_killed_suite_is_inconclusive_not_a_refutation(
+        self, checkout: Path
+    ) -> None:
+        """#2527: a confirmation subprocess killed by an external signal (a
+        `coord-agent`/`coord-serve` restart, a manual `kill`, ...) surfaces as
+        a negative returncode through `subprocess.run`'s normal (non-raising)
+        return path. That must read exactly like a timeout — the command
+        never ran to completion, so nothing was learned about the branch —
+        not like a real nonzero exit that ran to completion and failed.
+        """
+        runner = _ScriptedRunner(default=_FakeProc(-15, stdout="killed"))
+        result = ct.confirm_branch(
+            "api", BRANCH, _StubConfig(repo_path=str(checkout)), runner=runner,
+        )
+
+        assert result.kind == ct.KIND_SIGNAL, result.reason
+        assert result.refuted is False, (
+            "a signal-killed subprocess must never overturn a pass claim — "
+            "it never ran to completion"
+        )
+        assert result.inconclusive is True
+        assert result.returncode == -15
+
+    def test_signal_killed_build_is_inconclusive_before_the_suite_runs(
+        self, checkout: Path
+    ) -> None:
+        repo = _StubRepo(build_command="build-it")
+        runner = _ScriptedRunner(results={"build-it": _FakeProc(-9, stderr="killed")})
+        result = ct.confirm_branch(
+            "api", BRANCH, _StubConfig(repo, repo_path=str(checkout)), runner=runner,
+        )
+
+        assert result.kind == ct.KIND_SIGNAL, result.reason
+        assert result.refuted is False
+        assert result.inconclusive is True
+        assert [c[0] for c in runner.calls] == ["build-it"], (
+            "a signal-killed build must short-circuit before the suite is "
+            "attempted, same as a real build failure"
+        )
+
+    def test_every_kind_the_module_emits_lands_in_exactly_one_bucket(
+        self,
+    ) -> None:
+        """#2527: no kind may fall through all four `ConfirmationResult`
+        predicates.
+
+        `_confirmed_pass_verdict` (coord/notify.py) dispatches on `.confirmed`
+        / `.refuted` / `.baseline_red` / `.inconclusive`, so a kind that
+        answers False to all four has no defined verdict at all — which is
+        precisely how `KIND_SIGNAL` would have been born broken had it been
+        added as a constant without also being added to `INCONCLUSIVE_KINDS`.
+        Enumerating the kinds here means the next one cannot be half-added.
+        """
+        kinds = [
+            KIND_OK,
+            KIND_SETUP,
+            KIND_INFRA,
+            KIND_TIMEOUT,
+            ct.KIND_SIGNAL,
+            KIND_BASELINE_RED,
+            KIND_BUILD,
+            KIND_SUITE,
+        ]
+        for kind in kinds:
+            result = ct.ConfirmationResult(kind=kind, reason="x")
+            buckets = [
+                name
+                for name, flag in (
+                    ("confirmed", result.confirmed),
+                    ("refuted", result.refuted),
+                    ("baseline_red", result.baseline_red),
+                    ("inconclusive", result.inconclusive),
+                )
+                if flag
+            ]
+            assert len(buckets) == 1, (
+                f"kind {kind!r} must answer True to exactly one verdict "
+                f"predicate, got {buckets!r}"
+            )
+
+    def test_signal_is_inconclusive_and_never_refuting(self) -> None:
+        """The #2527 safety property, pinned on the sets themselves.
+
+        The two behavioural tests above go through `confirm_branch`, so they
+        would both still pass if someone *also* added `KIND_SIGNAL` to
+        `REFUTING_KINDS` and the membership check happened to be ordered in
+        `KIND_SIGNAL`'s favour. This pins the invariant directly instead.
+        """
+        assert ct.KIND_SIGNAL in ct.INCONCLUSIVE_KINDS
+        assert ct.KIND_SIGNAL not in ct.REFUTING_KINDS
+        assert not (ct.REFUTING_KINDS & ct.INCONCLUSIVE_KINDS), (
+            "a kind that both refutes and is inconclusive makes the verdict "
+            "depend on which property notify.py happens to test first"
+        )
+
+    def test_refuting_kinds_is_exactly_build_and_suite(self) -> None:
+        """Deliberately a change-detector.
+
+        coord/confirm_test.py's own comment says this frozenset IS the
+        fail-direction safety property: only a command that RAN TO COMPLETION
+        and returned nonzero may overturn a worker's PASS claim. Widening it
+        is the one edit in this module that can fail every branch in the
+        fleet, so it must not be possible to do by accident — a reviewer has
+        to see this assertion change too.
+        """
+        assert ct.REFUTING_KINDS == frozenset({KIND_BUILD, KIND_SUITE})
+
     def test_ci_command_wins_over_test_command(self, checkout: Path) -> None:
         """#2091: when a repo declares what CI runs, confirm with THAT."""
         repo = _StubRepo(ci_command="the-ci-suite")

{code_coordinator-0.5.209 → code_coordinator-0.5.210}/tests/test_notify.py

@@ -2563,6 +2563,64 @@ class TestMuteSmokeLegLoopTerminates:
         )
 
 
+class TestConfirmedPassVerdictSignalKill:
+    """#2527: a confirmation subprocess killed by an external signal (a
+    `coord-agent`/`coord-serve` restart landing mid-run, a manual `kill`, ...)
+    must be treated as inconclusive, exactly like `subprocess.TimeoutExpired`
+    already is — never as a refutation.
+
+    `_confirmed_pass_verdict` branches purely on `ConfirmationResult`'s
+    `.refuted` / `.baseline_red` / `.confirmed` / `.inconclusive` properties,
+    so a stubbed `_run_pass_confirmation` returning a `KIND_SIGNAL` result
+    (coord/confirm_test.py's new classification for a negative returncode) is
+    enough to pin the notify-side outcome without spinning up a real
+    subprocess.
+    """
+
+    def _transition(self):
+        from coord.notify import Transition, EVENT_COMPLETION  # noqa: PLC0415
+
+        return Transition(
+            assignment_id="work-1",
+            machine_name="laptop",
+            repo_name="api",
+            issue_number=42,
+            event=EVENT_COMPLETION,
+            exit_code=0,
+        )
+
+    def test_signal_killed_confirmation_is_unconfirmed_not_failed(self) -> None:
+        from coord import confirm_test as ct  # noqa: PLC0415
+        from coord.notify import _confirmed_pass_verdict  # noqa: PLC0415
+
+        killed = ct.ConfirmationResult(
+            kind=ct.KIND_SIGNAL,
+            reason=(
+                "confirmation suite command was killed by signal 15 (exit "
+                "-15) rather than running to completion — like a timeout, a "
+                "command that never finished says nothing about the branch, "
+                "so this is not a refutation (#2527)"
+            ),
+            returncode=-15,
+        )
+        entry = {"branch": "issue-42-fix-thing"}
+
+        with patch(
+            "coord.notify._run_pass_confirmation", return_value=killed,
+        ):
+            state, reason = _confirmed_pass_verdict(
+                self._transition(), entry, claim_reason="SMOKE: pass",
+            )
+
+        assert state == "passed", (
+            "a signal-killed confirmation subprocess never ran to completion "
+            f"— it must fall back to the worker's own claim, not fail closed "
+            f"(got state={state!r}, reason={reason!r})"
+        )
+        assert "REFUTED" not in reason
+        assert "UNCONFIRMED" in reason
+
+
 class _FakeAssignClient:
     """Minimal agent stand-in for `dispatch_smoke`: /health has no
     `tool_versions` (the #1570 D probe fails open) and /assign returns an id."""