codna 0.2.79__tar.gz → 0.2.81__tar.gz

{codna-0.2.79 → codna-0.2.81}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.79
+Version: 0.2.81
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.79 → codna-0.2.81}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.79"
+__version__ = "0.2.81"

{codna-0.2.79 → codna-0.2.81}/codna/webhook_pg_ops.py

@@ -6,8 +6,9 @@ answerable.
 Also here: the read models the metrics endpoint (``webhook_metrics``), the SLO endpoint and the
 autoscaler consume (:func:`metrics_snapshot`, :func:`slo_snapshot`, :func:`scaler_inputs`), the
 worker registry (:func:`register_worker` / :func:`worker_heartbeat` / :func:`workers`), and the
-leader election the reaper and the scaler use (:func:`try_leader_lock`: a session-level advisory
-lock on a dedicated connection).
+leader election the reaper and the scaler use (:class:`LeaderLock`: an advisory lock held inside
+one open transaction on a dedicated connection, so it is exclusive through a transaction-pooling
+PgBouncer as well as on a direct connection).
 """
 from __future__ import annotations
 
@@ -328,9 +329,24 @@ def dead_after_outage(queue: PostgresQueue, *, since_s: float = 6 * 3600, limit:
 
 # --- leader election ---------------------------------------------------------------------------------------
 class LeaderLock:
-    """A session-level advisory lock held on a DEDICATED connection for as long as this object is
-    alive. ``try_acquire`` is non-blocking; whoever holds it runs the reaper / the scaler. Losing
-    the connection releases the lock, so a dead leader is replaced within one poll."""
+    """An advisory lock held INSIDE ONE OPEN TRANSACTION on a DEDICATED connection for as long as
+    this object is alive. ``try_acquire`` is non-blocking; whoever holds it runs the reaper / the
+    scaler. Losing the connection ends the transaction and with it the lock, so a dead leader is
+    replaced within one poll.
+
+    Transaction-level (``pg_try_advisory_xact_lock``) rather than session-level on purpose. The
+    pooled ``DATABASE_URL`` Fly Managed Postgres hands out is PgBouncer in TRANSACTION mode: the
+    server connection goes back to the pool after every autocommit statement, so a session-level
+    lock taken through it stays with the server backend, not with this client, and the next client
+    to land on that backend "acquires" the same lock. Observed 2026-09-21, the first time two
+    ingress machines ran: both published ``codna_webhook_scaler_leader 1`` and both scalers ticked
+    (a probe from inside a machine took one key on two connections, six times out of six). An open
+    transaction pins the server connection to this client for the transaction's whole life under
+    either pool mode, and a transaction-level lock lives exactly as long as that transaction. A
+    loser rolls its probing transaction back at once so it holds no server connection between polls.
+    The server's ``idle_in_transaction_session_timeout`` is 0 on that cluster; the holder's ticks
+    (2 s scaler, 15 s reaper) keep the transaction from ever being idle for long anyway.
+    """
 
     def __init__(self, queue: PostgresQueue, purpose: str) -> None:
         from .webhook_pg_schema import lock_key
@@ -344,13 +360,17 @@ class LeaderLock:
         try:
             if self._conn is None or self._conn.closed:
                 self._conn = self._queue.dedicated_connection()
+                self._conn.autocommit = False  # every statement below runs in ONE transaction that stays open while the lock is held
                 self.held = False
-            if self.held:
-                # Prove the session is still alive; a dropped connection means a dropped lock.
-                self._conn.execute("SELECT 1").fetchone()
-                return True
-            row = self._conn.execute("SELECT pg_try_advisory_lock(hashtext(%s)) AS got", (self._key,)).fetchone()
+            # Asked again on every poll, not only once: inside the open transaction that holds the
+            # lock this is idempotent (true again), and if that transaction ended behind our back
+            # (a pooler or the server closed it) it is the truthful answer -- false when another
+            # candidate has taken the lock meanwhile, and leadership is dropped right here rather
+            # than believed in on the strength of a `SELECT 1`.
+            row = self._conn.execute("SELECT pg_try_advisory_xact_lock(hashtext(%s)) AS got", (self._key,)).fetchone()
             self.held = bool(row and row["got"])
+            if not self.held:
+                self._conn.rollback()  # end the probing transaction: a pooled server connection returns to the pool until the next poll
             return self.held
         except Exception:  # noqa: BLE001 -- not the leader while the database is unreachable
             self.held = False
@@ -365,7 +385,7 @@ class LeaderLock:
     def release(self) -> None:
         try:
             if self._conn is not None and self.held:
-                self._conn.execute("SELECT pg_advisory_unlock(hashtext(%s))", (self._key,))
+                self._conn.rollback()  # ending the transaction releases the lock
         except Exception:  # noqa: BLE001
             pass
         finally:

{codna-0.2.79 → codna-0.2.81}/codna/webhook_pg_queue.py

@@ -182,8 +182,9 @@ class PostgresQueue:
         return self._pool.connection()
 
     def dedicated_connection(self):
-        """A connection OUTSIDE the pool for session-level advisory locks (leader election): a
-        pooled connection could be handed to another caller while the lock is meant to be held."""
+        """A connection OUTSIDE the pool for the leader election's transaction-held advisory locks
+        (webhook_pg_ops.LeaderLock): a pooled connection could be handed to another caller while
+        the lock is meant to be held."""
         from psycopg.rows import dict_row
 
         return connect(self._url, row_factory=dict_row)

{codna-0.2.79 → codna-0.2.81}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.79
+Version: 0.2.81
 Summary: Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.79 → codna-0.2.81}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.79"
+version = "0.2.81"
 description = "Understand. Fix. Evolve. Codna maps your repository before it spends a token, reviews pull requests, fixes bugs and proves which scanner findings are reachable. Runs on your machine."
 readme = "README.md"
 requires-python = ">=3.12"

{codna-0.2.79 → codna-0.2.81}/tests/test_fly_toml.py

@@ -5,7 +5,9 @@ The routing health check of the ingress is ``/health`` (liveness) and nothing el
 worker pool looked unhealthy and every GitHub delivery was refused at the edge. The worker pool
 config has NO ``[http_service]`` at all (nothing to unroute), bounds its kill timeout at Fly's
 maximum, stays stopped after a clean drain, and documents the cost ceiling the capacity model
-implies. Expectations are read from the files, never hardcoded counts."""
+implies. Expectations are read from the files, never hardcoded counts. The ingress ``[[vm]]`` is
+sized for the ingress role plus ONE degraded-lane review thread, and that arithmetic is checked
+against the pool's own constants (``webhook_control``), not against numbers copied into this file."""
 from __future__ import annotations
 
 import re
@@ -36,6 +38,12 @@ def _seconds(value: str) -> int:
     return int(m.group(1)) * (60 if m.group(2) == "m" else 1)
 
 
+def _memory_mb(value: str) -> int:
+    m = re.fullmatch(r"(\d+)(mb|gb)", value.strip().lower())
+    assert m, f"unparseable memory {value!r}"
+    return int(m.group(1)) * (1024 if m.group(2) == "gb" else 1)
+
+
 def test_both_configs_parse_and_name_distinct_apps(ingress, worker):
     assert ingress["app"] == "codna-webhook"
     assert worker["app"] == "codna-webhook-worker"
@@ -64,6 +72,29 @@ def test_ingress_never_stops_its_last_machine(ingress):
     assert "CODNA_WEBHOOK_QUEUE_BACKEND" not in ingress["env"]
 
 
+def test_ingress_is_sized_for_its_role_plus_one_degraded_lane_thread(ingress):
+    """Role ``ingress`` runs no worker pool (webhook_service.build_service builds one for ``all`` and
+    ``worker`` only) and was measured at 130 MB resident; what sets its memory is the degraded lane
+    on the ``role=all`` rollback -- one ``review`` thread, sized by the pool's own constants."""
+    from codna import webhook_control
+
+    [vm] = ingress["vm"]
+    assert vm["size"] == "shared-cpu-1x", "the smallest shared shape; the service is one Python process"
+    memory_mb = _memory_mb(vm["memory"])
+    assert memory_mb == 2048, "shared-cpu-1x carries at most 2048 MB (fly platform vm-sizes)"
+    reserved, per_job = webhook_control._RESERVED_MEMORY_MB, webhook_control._JOB_MEMORY_MB
+    # one degraded-lane review thread fits without overcommit ...
+    assert reserved + per_job <= memory_mb, f"{reserved} + {per_job} MB does not fit in {memory_mb} MB"
+    # ... it IS one thread by the derivation the pool would run on this machine ...
+    assert min(webhook_control._MAX_DERIVED_CONCURRENCY, (memory_mb - reserved) // per_job) == 1
+    # ... and the next shape down could not hold it: the reason the machine is not smaller
+    assert reserved + per_job > memory_mb // 2
+    text = INGRESS.read_text(encoding="utf-8")
+    for needle in ("DEGRADED LANE", "default_concurrency", "NO worker pool", "shared-cpu-4x / 8 GB",
+                   "ingress-scale", "$10.69/mo", "Rollback:"):
+        assert needle in text, f"the ingress toml must document {needle!r}"
+
+
 def test_worker_pool_has_no_routing_surface(worker):
     assert "http_service" not in worker, "workers take no proxy traffic: there must be nothing to unroute"
     assert "services" not in worker

{codna-0.2.79 → codna-0.2.81}/tests/test_webhook_lease.py

@@ -240,3 +240,35 @@ def test_leader_lock_is_exclusive_per_purpose_and_released_on_close(make_pg_queu
     finally:
         for lock in (la, lb, other):
             lock.release()
+
+
+def test_leader_lock_lives_inside_the_holders_open_transaction(make_pg_queue):
+    """Fly Managed Postgres's pooled URL is PgBouncer in TRANSACTION mode: the server connection is
+    handed to whichever client runs the next statement, so a session-level lock taken through it
+    belongs to the backend, not to the client, and a second client landing on that backend gets it
+    too (two ingress machines both held the scaler lock, 2026-09-21). The lock must therefore be
+    transaction-level and the holder's transaction must stay OPEN (the pooler pins the server
+    connection to a client for exactly that long); a loser must leave no transaction open."""
+    from psycopg.pq import TransactionStatus
+
+    a, b = make_pg_queue(owner="a:1"), make_pg_queue(owner="b:1")
+    la, lb = LeaderLock(a, "scaler"), LeaderLock(b, "scaler")
+    try:
+        assert la.try_acquire() is True
+        assert la._conn.info.transaction_status == TransactionStatus.INTRANS   # the lock's transaction is open ...
+        granted = la._conn.execute(
+            "SELECT count(*) AS n FROM pg_locks WHERE locktype = 'advisory' AND granted AND pid = pg_backend_pid()").fetchone()["n"]
+        assert granted == 1                                                    # ... and the lock is on this backend
+        assert lb.try_acquire() is False
+        assert lb._conn.info.transaction_status == TransactionStatus.IDLE      # a loser holds no transaction (no pinned server connection)
+        assert la.try_acquire() is True                                        # re-asserting stays inside the same transaction
+        assert la._conn.info.transaction_status == TransactionStatus.INTRANS
+        # Transaction-level means exactly that: when the transaction ends -- a pooler or the server
+        # closing it, not only release() -- the lock is gone and the next poll elects someone else.
+        la._conn.rollback()
+        assert lb.try_acquire() is True
+        assert la.try_acquire() is False                                       # the old holder learns it lost on its very next poll
+        assert not la.held
+    finally:
+        for lock in (la, lb):
+            lock.release()