Uh oh!
There was an error while loading. Please reload this page.
feat(runtime-host): add safe-boundary continuation authority - #1996
Merged
M4n5ter merged 1 commit intoAug 3, 2026
Merged
Conversation
M4n5ter
marked this pull request as ready for review
August 3, 2026 12:20
Uh oh!
There was an error while loading. Please reload this page.
Astro-Han added a commit
that referenced
this pull request
Aug 4, 2026
… non-terminal prior runs (#2078) * fix(runtime): replay prior runs that never reached a terminal fact A run stopped while parked on an interaction keeps a non-terminal header and a ledger with no terminal fact. buildPriorRuntimeContext treated that as skippable and dropped the whole run, so the turn's user message, assistant text, and tool activity disappeared from every later turn's model context — silently, and permanently, because the header never becomes terminal on its own. Read the ledger it does have instead: attempt the same repair the terminal-status branch already performs, and replay the events either way. Only the effective run header still depends on a terminal fact. Refs #2074 * fix(runtime): land the terminal fact a stop already claimed stop() takes the Run's terminal claim, but only finalize() — reached when the backend's event stream ends — ever cashed it. A turn parked on an unanswered interaction never ends that stream, so the stop projected an aborted turn into the Session while the Run stayed non-terminal in the ledger for good, and the backend generation it was waiting on could never wake it. Cash the claim where the stop completes. The claim itself keeps this idempotent: a stream that later produces its own terminal event finds the claim taken and writes nothing. Refs #2074 * fix(runtime): keep the stop terminal fact inside the embedded owner The ledger may already hold a terminal fact this Run never wrote — a Host recovery or a resumed continuation sealed it — and a sealed run rejects further appends. Read before landing one. Scope the settlement to embedded owners too. A Hosted Run's terminal fact belongs to the Host's terminal authority (#1359, #1996), which parks provider-indeterminate Runs that a stop must not resolve on their behalf. Refs #2074 * fix(runtime): drop the unreachable repair from the non-terminal prior run repairRunTerminalFact returns false for a non-terminal header before it reads anything, so the call could only ever answer "no". It read as a recovery attempt that never happens. Refs #2074 * fix(runtime): commit a run's terminal fact at most once under a racing stop commitTerminalRun checked terminalRunHeaderCommitted only on entry. A stop settling the claim and the stream's own finalize both pass that guard, then queue behind the same in-flight write. The claim slot dedupes the RuntimeEvent, but the run-store projection appended a second terminal AgentRunEvent for the one run. Re-check after the await. Before this, the new stop settlement made the duplicate reachable on the ordinary path: stopping mid-generation overlaps the stream's unwind. Refs #2074 * fix(runtime): fail a stop whose terminal settlement never landed * test(runtime): pin the stop settlement's hosted and sealed boundaries * style(runtime): apply Biome formatting to the stop settlement guard
This was referenced Aug 22, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
English
Summary
turn.resume.queryandturn.resume.startoperations for Host-owned safe-boundary continuation.Why
Runtime Host needs one authoritative way to continue a recoverable provider boundary without trusting Client-supplied safety claims, duplicating user input, or dispatching the provider twice. The public surface remains opt-in through
MAKA_RUNTIME_SAFE_BOUNDARY_RESUME=1.Validation
npm run build:testnpm --workspace @maka/runtime-host run test:dist— 597 passednpm --workspace @maka/storage run test:dist— 1016 passed, 13 skippednpm run format:checknpm run lintnpm run typecheckgit diff --checkPart of #1167. Runtime Host roadmap context: #853.
中文
概要
turn.resume.query与turn.resume.start操作，由 Runtime Host 统一管理安全边界续跑。原因
Runtime Host 需要一条权威续跑路径，在不信任 Client 安全声明、不重复用户输入、也不重复调用 Provider 的前提下，从可恢复的 Provider 边界继续执行。公开能力仍需通过
MAKA_RUNTIME_SAFE_BOUNDARY_RESUME=1显式启用。验证
npm run build:testnpm --workspace @maka/runtime-host run test:dist— 597 项通过npm --workspace @maka/storage run test:dist— 1016 项通过，13 项跳过npm run format:checknpm run lintnpm run typecheckgit diff --check属于 #1167 的一部分；Runtime Host 路线图背景见 #853。