Fail closed when supervisor IPC fails on a non-success terminal state by potiuk · Pull Request #66573 · apache/airflow

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk · 2026-05-07T22:17:45Z

Summary

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor's final_state property maps to SUCCESS for an exit_code == 0 process without a _terminal_state (the supervisor never received the message).

A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal.

Fix

Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured).

The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI — covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass.

Test

New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() raises SystemExit(1).

Reported by

L3 ASVS sweep — apache/tooling-agents#24 (FINDING-006).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 4.7)

Generated-by: Claude Code (Opus 4.7) following the guidelines

potiuk · 2026-05-17T19:45:07Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

Lee-W

approved with nit

jason810496

Not sure if it's a good idea to add the early exit for this case.

vatsrahul1001 · 2026-05-18T17:00:43Z

@potiuk can you address comments?

When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006).

- Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil).

The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback.

github-actions · 2026-05-19T13:42:09Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

…rminal state (apache#66573) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

…rminal state (#66573) (#67183) * Fail closed when supervisor IPC fails on a non-success terminal state When a task FAILED / SKIPPED / etc. and the IPC send of the terminal-state message to the supervisor itself raised, the existing finally block logged the exception and let run() return normally. The task subprocess then exited with code 0, which the supervisor final_state property maps to SUCCESS for an exit_code-0 process without a _terminal_state (the supervisor never received the message). A genuine task FAILURE was silently being upgraded to SUCCESS on transient IPC failures, breaking downstream pipeline correctness without any signal. Exit non-zero from the finally block when the terminal state is anything other than SUCCESS, so the supervisor's final_state correctly classifies as FAILED (or UP_FOR_RETRY when retries are configured). The SUCCESS exemption preserves the existing softening for the legitimate scenario where the supervisor rejects the terminal-state send with a 409 because the server already terminalised the TI -- covered by test_run_swallows_supervisor_terminal_send_failure, which continues to pass. New regression test: when the task fails and the supervisor IPC send raises (BrokenPipeError simulating a dead Unix socket), run() now raises SystemExit(1). Reported by the L3 ASVS sweep at apache/tooling-agents#24 (FINDING-006). * Address review comments: defer fail-closed exit, narrow guard - Narrow the fail-closed guard from `state != SUCCESS` to FAILED / UP_FOR_RETRY only (kaxil). SKIPPED / UP_FOR_RESCHEDULE / DEFERRED would otherwise be mismapped to FAILED by supervisor's final_state, which is strictly worse than the default mapping. - Stop calling sys.exit(1) inside run()'s finally — SystemExit is a BaseException so main()'s `except Exception:` would not catch it and finalize() would be skipped, silently dropping on_failure_callback / on_retry_callback / listener hooks / email_on_failure / email_on_retry on the same IPC failure (kaxil). Signal via `_terminal_state_send_failed` on the ti and let main() sys.exit(1) after finalize() has run. - Remove the redundant inline `from ... import run` in the test (Lee-W, kaxil) — `run` is already imported at module level. - Rework the existing regression test to assert the new contract (run() returns FAILED + sets the flag) and add a listener-based test that locks in callbacks/listeners still firing on the IPC-broken path (kaxil). * Declare _terminal_state_send_failed on RuntimeTaskInstance for mypy The fail-closed path in _handle_current_task_failure set ti._terminal_state_send_failed = True dynamically without a class-level declaration, so mypy raised [attr-defined]. Add the field as a Pydantic PrivateAttr (bool, default False) matching the existing _cached_template_context pattern. No runtime behavior change — getattr(ti, '_terminal_state_send_failed', False) still returns False for the unset case, now via the PrivateAttr default instead of the getattr fallback. --------- (cherry picked from commit 7e91517) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: vatsrahul1001 <rah.sharma11@gmail.com>

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

potiuk requested review from amoghrajesh, ashb and kaxil as code owners May 7, 2026 22:17

boring-cyborgBot added the area:task-sdk label May 7, 2026

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from 607e582 to 2acf7f0Compare May 17, 2026 19:33

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W approved these changes May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

jason810496 reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/src/airflow/sdk/execution_time/task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

kaxil reviewed May 18, 2026
View reviewed changes

Comment threadtask-sdk/tests/task_sdk/execution_time/test_task_runner.py Outdated

potiukand others added 3 commits May 19, 2026 13:27

potiuk force-pushed the fix/tasksdk-fail-closed-terminal-state branch from be3187f to d1a32abCompare May 19, 2026 11:55

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit 7e91517 into apache:mainMay 19, 2026
113 checks passed

mobuchowski mentioned this pull request Jun 18, 2026
OpenLineage: add execute_in_thread to emit task events without forking #68708
Merged
1 task

shahar1 mentioned this pull request Jul 24, 2026
Status of testing Providers that were prepared on July 22, 2026 #70355
Closed

This was referenced Aug 3, 2026
Status of testing Providers that were prepared on August 01, 2026 #70953
Closed
Status of testing Providers that were prepared on August 06, 2026 #71246
Closed

Uh oh!

Conversation

potiuk commented May 7, 2026

Summary

Fix

Test

Reported by

Was generative AI tooling used to co-author this PR?

Uh oh!

potiuk commented May 17, 2026

Uh oh!

Lee-W left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jason810496 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vatsrahul1001 commented May 18, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actionsBot commented May 19, 2026

Backport successfully created: v3-2-test

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

potiuk commented May 7, 2026

Summary

Fix

Test

Reported by

Was generative AI tooling used to co-author this PR?

Uh oh!

potiuk commented May 17, 2026

Uh oh!

Lee-W left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jason810496 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vatsrahul1001 commented May 18, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actionsBot commented May 19, 2026

Backport successfully created: v3-2-test

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

potiuk commented May 7, 2026

Summary

jason810496 left a comment •
edited
Loading

jason810496 left a comment •
edited
Loading

jason810496 left a comment •
edited
Loading

jason810496 left a comment •
edited
Loading