From 551867a73ad96cb7560a6f6d629022564c014987 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:30:34 +0530 Subject: [PATCH 1/6] chore: map mzyas for salvage of #133720 --- contributors/emails/mzykr@yahoo.co.jp | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 contributors/emails/mzykr@yahoo.co.jp diff --git a/contributors/emails/mzykr@yahoo.co.jp b/contributors/emails/mzykr@yahoo.co.jp new file mode 100644 index 0000000000000..78ef864045f23 --- /dev/null +++ b/contributors/emails/mzykr@yahoo.co.jp @@ -0,0 +1,2 @@ +mzyas +# PR #133720 salvage From 4d3b390df0fbe73a8d9db0286bdf35f3f6d5c1ed Mon Sep 17 00:00:00 2001 From: mzyas Date: Tue, 6 Oct 2026 15:25:54 +0900 Subject: [PATCH 2/6] fix(cron): a source-update relaunch replays the external worker before its ack The external worker first imported hermes_bootstrap through run_agent inside run_one_job, after it had read (and deleted) its payload and published its ownership ack. When the dependency inputs were not current, prepare_launch synced and relaunched the worker into an -I interpreter that ignores the pinned PYTHONPATH, and worker_bootstrap had already popped the boot marker: the new process died on `import ruamel` and the adopted run was left `unknown` (#122290 follow-up). The worker's __main__ now runs hermes_bootstrap (finish_worker_boot) before it touches the payload, and the marker is dropped only after that, so a relaunch replays the whole worker and boots its dependencies again. The call cannot live in worker_bootstrap(): during `-m cron.scheduler`'s package import sys.argv[0] is still "-m" and __main__ has no spec, so the relaunch command could not name the module. Covers the POSIX execv and Windows subprocess.call relaunch branches alike. Co-Authored-By: Claude Opus 5.5 (cherry picked from commit b537b59787acf3b3f5828c0fb6ce82482de40820) --- cron/AGENTS.md | 5 +- cron/scheduler.py | 10 ++-- cron/worker_bootstrap.py | 30 ++++++++++-- tests/cron/test_restart_safe_worker.py | 64 ++++++++++++++++++++++++-- 4 files changed, 95 insertions(+), 14 deletions(-) diff --git a/cron/AGENTS.md b/cron/AGENTS.md index f9ec35d457439..761d1203075c4 100644 --- a/cron/AGENTS.md +++ b/cron/AGENTS.md @@ -79,7 +79,10 @@ Hardening invariants — each guards a real failure; don't weaken without answer activates it before the first third-party import. A failed activation is fatal: the worker exits before its ownership ack (a reported dispatch failure) rather than run on an unleased generation the collector may delete. The gateway never re-runs the boot — `hermes_bootstrap` - already did at its own launch (#122222). + already did at its own launch (#122222). The worker's `__main__` imports `hermes_bootstrap` + (`finish_worker_boot`) before it reads the payload, and only then drops the marker: a + source-update relaunch (`-I`, no `PYTHONPATH`) must replay the whole worker, never land after + the ack with the payload gone and no dependency boot. - Cron sessions pass `skip_memory=True`; memory providers intentionally do not run during cron. - Cron execution has its own session. Eligible continuable deliveries may mirror or seed the reply-facing conversation: origin, origin-less home fallback, user-written bare-platform home, diff --git a/cron/scheduler.py b/cron/scheduler.py index 4b852e5973f49..175cc28cf8b70 100644 --- a/cron/scheduler.py +++ b/cron/scheduler.py @@ -36,7 +36,7 @@ # `hermes update`) otherwise fail with ModuleNotFoundError for hermes_time et al. sys.path.insert(0, str(Path(__file__).parent.parent)) -from cron.worker_bootstrap import WORKER_MARKER +from cron.worker_bootstrap import WORKER_MARKER, finish_worker_boot from hermes_constants import get_hermes_home, hermes_home_key from hermes_cli.observability.shared_metrics_gateway import note_cron_execution, note_cron_skipped from cron.env_settings import cron_env_setting @@ -4435,16 +4435,16 @@ def _on_done(_f: concurrent.futures.Future) -> None: # tick paths see every name they need. if __name__ == "__main__": if "--external-worker-file" in sys.argv: + finish_worker_boot() # may relaunch: before the payload is read and the ack published import argparse parser = argparse.ArgumentParser(add_help=False) parser.add_argument("--external-worker-file", type=Path, required=True) parser.add_argument("--ack-file", type=Path, required=True) args = parser.parse_args() - # The gateway spawns this worker with stdout on DEVNULL and stderr on a - # capture file it only reads back if we die before the ack; without a - # log handler every adoption/ack failure below would otherwise be - # invisible to the persistent log. + # The gateway spawns this worker with stdout on DEVNULL and stderr on a capture file it + # only reads back if we die before the ack; without a log handler every adoption/ack + # failure below would otherwise be invisible to the persistent log. try: from hermes_logging import setup_logging diff --git a/cron/worker_bootstrap.py b/cron/worker_bootstrap.py index 4f3e944470e66..255f8c30ad447 100644 --- a/cron/worker_bootstrap.py +++ b/cron/worker_bootstrap.py @@ -23,6 +23,15 @@ acknowledgement, which ``_launch_external_cron_worker`` already reports as a failed dispatch with the worker's stderr. PM's legitimate no-ops (no committed generation under a venv, wheel, Nix) return normally. + +That boot covers dependencies only. ``hermes_bootstrap`` also finishes a pending source update +and may relaunch the process into a fresh one (``hermes_cli/venv_sync.py::relaunch_command``, an +``-I`` interpreter that ignores the pinned ``PYTHONPATH``). ``finish_worker_boot()`` runs it from +the worker's ``__main__`` before the payload is read, so a relaunch replays the whole worker: the +payload is still on disk and the marker still set, and the new process boots its dependencies +again. Left to ``run_agent``'s import inside ``run_one_job``, the relaunch came after the ack, with +the payload deleted and the marker consumed: the new process died on ``ruamel`` and the adopted +run was left ``unknown``. """ from __future__ import annotations @@ -30,16 +39,29 @@ import os from pathlib import Path -# Set by ``_launch_external_cron_worker`` in the child's env and consumed here, so it never -# reaches the worker's own children -- they inherit the activated PYTHONPATH instead. +# Set by ``_launch_external_cron_worker`` in the child's env and consumed by +# ``finish_worker_boot()`` -- after any relaunch, before the ack -- so it never reaches the +# worker's own children; they inherit the activated PYTHONPATH instead. # Distinct from ``_HERMES_CRON_EXTERNAL_WORKER`` (the owning execution id) in scheduler.py. WORKER_MARKER = "_HERMES_CRON_WORKER_BOOT" def worker_bootstrap() -> None: - """Run PM's dependency boot in the marked external worker, once.""" - if not os.environ.pop(WORKER_MARKER, None): + """Run PM's dependency boot in the marked external worker (again after a relaunch).""" + if not os.environ.get(WORKER_MARKER): return from pm.environments import activate_dependencies activate_dependencies(Path(__file__).resolve().parent.parent) + + +def finish_worker_boot() -> None: + """Run ``hermes_bootstrap`` before the worker reads its payload; may relaunch the worker. + + Not from ``worker_bootstrap()``: while ``-m cron.scheduler`` executes ``cron/__init__.py``, + ``sys.argv[0]`` is still ``-m`` and ``__main__`` has no spec, so the relaunch command could + not name the module to re-run. In ``__main__`` both are set. + """ + import hermes_bootstrap # noqa: F401 + + os.environ.pop(WORKER_MARKER, None) diff --git a/tests/cron/test_restart_safe_worker.py b/tests/cron/test_restart_safe_worker.py index 32b3c5c63c943..7d73b7e6ed338 100644 --- a/tests/cron/test_restart_safe_worker.py +++ b/tests/cron/test_restart_safe_worker.py @@ -757,9 +757,9 @@ def test_pin_restores_the_committed_generation_site_packages(tmp_path): def test_marked_worker_boots_dependencies_before_cron_jobs(marked): """#122222: ``-m cron.scheduler`` executes ``cron/__init__.py`` first, whose first import (``cron.jobs`` -> ``hermes_yaml`` -> ``ruamel``) is already a dependency, so the marked - worker must boot before it -- exactly once, consuming the marker so the worker's own - children do not inherit it. An unmarked importer (the gateway already booted through - ``hermes_bootstrap``) is never re-booted.""" + worker must boot before it -- exactly once. The marker survives the package import so a + relaunched worker boots again (``finish_worker_boot`` consumes it). An unmarked importer + (the gateway already booted through ``hermes_bootstrap``) is never re-booted.""" import cron.worker_bootstrap as worker_bootstrap repo_root = Path(worker_bootstrap.__file__).resolve().parent.parent @@ -773,7 +773,63 @@ def test_marked_worker_boots_dependencies_before_cron_jobs(marked): ) assert child.returncode == 0, child.stderr result = json.loads(child.stdout.strip().splitlines()[-1]) - assert result == {"boots": [False] if marked else [], "marker": None} + assert result == {"boots": [False] if marked else [], "marker": "1" if marked else None} + + +_RELAUNCH_PROBE = """ +import json, os, runpy, subprocess, sys +from pathlib import Path + +import pm.environments +pm.environments.activate_dependencies = lambda root: None +import hermes_cli.venv_sync as venv_sync + +payload, ack, record, marker = Path(sys.argv[1]), Path(sys.argv[2]), Path(sys.argv[3]), sys.argv[4] +venv_sync.prepare_launch = lambda root, argv: Path(sys.executable) + + +def relaunch(*args): + record.write_text(json.dumps({ + "payload": payload.exists(), "ack": ack.exists(), + "marker": os.environ.get(marker), "command": args[-1], + })) + raise SystemExit(0) + + +os.execv = relaunch +subprocess.call = relaunch +sys.argv = ["cron.scheduler", "--external-worker-file", str(payload), "--ack-file", str(ack)] +runpy.run_module("cron.scheduler", run_name="__main__", alter_sys=True) +""" + + +def test_source_update_relaunch_replays_the_worker_before_its_ack(tmp_path): + """A worker whose ``hermes_bootstrap`` finishes a source update relaunches into an ``-I`` + interpreter that ignores the pinned PYTHONPATH. Reached through ``run_agent`` inside + ``run_one_job``, that relaunch came after the ack: the payload was deleted, the marker + consumed, and the new process died on ``ruamel`` with the adopted run left ``unknown``. + The relaunch must instead replay the whole worker: payload unread, no ack, marker set, + re-running ``cron.scheduler`` as ``__main__``.""" + import cron.worker_bootstrap as worker_bootstrap + + repo_root = Path(worker_bootstrap.__file__).resolve().parent.parent + payload = tmp_path / "exec-1.json" + payload.write_text(json.dumps({ + "job": {"id": "job-1", "execution_id": "exec-1"}, + "profile_home": str(tmp_path / "profile"), + }), encoding="utf-8") + ack, record = tmp_path / "exec-1.ready", tmp_path / "relaunch.json" + env = dict(os.environ, PYTHONPATH=str(repo_root)) + env[worker_bootstrap.WORKER_MARKER] = "1" + child = subprocess.run( + [sys.executable, "-c", _RELAUNCH_PROBE, str(payload), str(ack), str(record), + worker_bootstrap.WORKER_MARKER], + cwd=repo_root, env=env, capture_output=True, text=True, timeout=120, + ) + assert record.exists(), f"worker never relaunched (exit {child.returncode}): {child.stderr}" + seen = json.loads(record.read_text()) + assert (seen["payload"], seen["ack"], seen["marker"]) == (True, False, "1") + assert "runpy.run_module('cron.scheduler', run_name='__main__'" in seen["command"][-1] _REAL_BOOT_PROBE = """ From 873dd42631419655dcd70f2ef03905c8b9d8e33f Mon Sep 17 00:00:00 2001 From: mzyas Date: Tue, 6 Oct 2026 16:16:20 +0900 Subject: [PATCH 3/6] fix(cron): run the interrupted-pull recovery before the external worker's ack run_agent's import also re-execs the process when it restores a tree a killed `hermes update` half-wrote (_early_recovery.relaunch_after_restore). The external worker never loads hermes_cli.main, so that check first ran inside run_one_job, after the ack: the re-exec found its payload deleted, refused the execution, and the adopted run was left `unknown`, the same class as the source-update relaunch. finish_worker_boot() now runs the recovery before the payload is read, so its re-exec replays the whole worker. Co-Authored-By: Claude Opus 5.5 (cherry picked from commit b28779fd3bbaa1b92272448d17ccbb47f2794e0f) --- cron/AGENTS.md | 7 ++++--- cron/worker_bootstrap.py | 7 +++++++ tests/cron/test_restart_safe_worker.py | 29 +++++++++++++++++--------- 3 files changed, 30 insertions(+), 13 deletions(-) diff --git a/cron/AGENTS.md b/cron/AGENTS.md index 761d1203075c4..ef7af5ae79db8 100644 --- a/cron/AGENTS.md +++ b/cron/AGENTS.md @@ -80,9 +80,10 @@ Hardening invariants — each guards a real failure; don't weaken without answer exits before its ownership ack (a reported dispatch failure) rather than run on an unleased generation the collector may delete. The gateway never re-runs the boot — `hermes_bootstrap` already did at its own launch (#122222). The worker's `__main__` imports `hermes_bootstrap` - (`finish_worker_boot`) before it reads the payload, and only then drops the marker: a - source-update relaunch (`-I`, no `PYTHONPATH`) must replay the whole worker, never land after - the ack with the payload gone and no dependency boot. + (`finish_worker_boot`) and runs `run_agent`'s interrupted-pull recovery before it reads the + payload, and only then drops the marker: a source-update relaunch (`-I`, no `PYTHONPATH`) or a + post-restore re-exec must replay the whole worker, never land after the ack with the payload + gone and no dependency boot. - Cron sessions pass `skip_memory=True`; memory providers intentionally do not run during cron. - Cron execution has its own session. Eligible continuable deliveries may mirror or seed the reply-facing conversation: origin, origin-less home fallback, user-written bare-platform home, diff --git a/cron/worker_bootstrap.py b/cron/worker_bootstrap.py index 255f8c30ad447..1a43e118dec4b 100644 --- a/cron/worker_bootstrap.py +++ b/cron/worker_bootstrap.py @@ -61,7 +61,14 @@ def finish_worker_boot() -> None: Not from ``worker_bootstrap()``: while ``-m cron.scheduler`` executes ``cron/__init__.py``, ``sys.argv[0]`` is still ``-m`` and ``__main__`` has no spec, so the relaunch command could not name the module to re-run. In ``__main__`` both are set. + + ``run_agent``'s other import-time relaunch -- restoring a tree a killed ``hermes update`` + half-wrote -- runs here too: the worker never loads ``hermes_cli.main``, so left to + ``run_one_job`` it re-executed the worker after the ack, onto a deleted payload. """ import hermes_bootstrap # noqa: F401 + from hermes_cli import _early_recovery + if _early_recovery.restore_interrupted_pull(): + _early_recovery.relaunch_after_restore() os.environ.pop(WORKER_MARKER, None) diff --git a/tests/cron/test_restart_safe_worker.py b/tests/cron/test_restart_safe_worker.py index 7d73b7e6ed338..c641074a8be3e 100644 --- a/tests/cron/test_restart_safe_worker.py +++ b/tests/cron/test_restart_safe_worker.py @@ -782,10 +782,15 @@ def test_marked_worker_boots_dependencies_before_cron_jobs(marked): import pm.environments pm.environments.activate_dependencies = lambda root: None +import hermes_cli._early_recovery as early_recovery import hermes_cli.venv_sync as venv_sync payload, ack, record, marker = Path(sys.argv[1]), Path(sys.argv[2]), Path(sys.argv[3]), sys.argv[4] -venv_sync.prepare_launch = lambda root, argv: Path(sys.executable) +if sys.argv[5] == "source_update": + venv_sync.prepare_launch = lambda root, argv: Path(sys.executable) +else: + venv_sync.prepare_launch = lambda root, argv: None + early_recovery.restore_interrupted_pull = lambda *args, **kwargs: True def relaunch(*args): @@ -803,13 +808,14 @@ def relaunch(*args): """ -def test_source_update_relaunch_replays_the_worker_before_its_ack(tmp_path): - """A worker whose ``hermes_bootstrap`` finishes a source update relaunches into an ``-I`` - interpreter that ignores the pinned PYTHONPATH. Reached through ``run_agent`` inside - ``run_one_job``, that relaunch came after the ack: the payload was deleted, the marker - consumed, and the new process died on ``ruamel`` with the adopted run left ``unknown``. - The relaunch must instead replay the whole worker: payload unread, no ack, marker set, - re-running ``cron.scheduler`` as ``__main__``.""" +@pytest.mark.parametrize("cause", ["source_update", "interrupted_pull"]) +def test_relaunch_replays_the_worker_before_its_ack(tmp_path, cause): + """``run_agent``'s import may relaunch the process: ``hermes_bootstrap`` finishing a source + update (into an ``-I`` interpreter that ignores the pinned PYTHONPATH), or the restore of a + tree a killed ``hermes update`` half-wrote. Reached inside ``run_one_job``, either came after + the ack: the payload was deleted, the marker consumed, and the new process died on ``ruamel`` + or found no payload, leaving the adopted run ``unknown``. The relaunch must instead replay + the whole worker: payload unread, no ack, marker set, the same worker re-run.""" import cron.worker_bootstrap as worker_bootstrap repo_root = Path(worker_bootstrap.__file__).resolve().parent.parent @@ -823,13 +829,16 @@ def test_source_update_relaunch_replays_the_worker_before_its_ack(tmp_path): env[worker_bootstrap.WORKER_MARKER] = "1" child = subprocess.run( [sys.executable, "-c", _RELAUNCH_PROBE, str(payload), str(ack), str(record), - worker_bootstrap.WORKER_MARKER], + worker_bootstrap.WORKER_MARKER, cause], cwd=repo_root, env=env, capture_output=True, text=True, timeout=120, ) assert record.exists(), f"worker never relaunched (exit {child.returncode}): {child.stderr}" seen = json.loads(record.read_text()) assert (seen["payload"], seen["ack"], seen["marker"]) == (True, False, "1") - assert "runpy.run_module('cron.scheduler', run_name='__main__'" in seen["command"][-1] + if cause == "source_update": + assert "runpy.run_module('cron.scheduler', run_name='__main__'" in seen["command"][-1] + else: + assert str(payload) in seen["command"] _REAL_BOOT_PROBE = """ From 8a33ea0f86c0ce4a4196037074d7b031a7bf1171 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Wed, 7 Oct 2026 10:40:57 +0530 Subject: [PATCH 4/6] refactor(cron): finish_worker_boot relies on hermes_bootstrap's own interrupted-pull repair Importing hermes_bootstrap already runs _settle_interrupted_update (restore_interrupted_pull + relaunch_after_restore) at module import, so the explicit second call in finish_worker_boot was a duplicate. The worker never imports hermes_bootstrap before __main__ (probed: not in sys.modules after `import cron.scheduler`, marked or not), so the import in finish_worker_boot is what runs the repair, before the payload is read and the ack published. The interrupted_pull case of test_relaunch_replays_the_worker_before_its_ack stays green. --- cron/worker_bootstrap.py | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/cron/worker_bootstrap.py b/cron/worker_bootstrap.py index 1a43e118dec4b..5b5e332b7a21b 100644 --- a/cron/worker_bootstrap.py +++ b/cron/worker_bootstrap.py @@ -26,7 +26,8 @@ That boot covers dependencies only. ``hermes_bootstrap`` also finishes a pending source update and may relaunch the process into a fresh one (``hermes_cli/venv_sync.py::relaunch_command``, an -``-I`` interpreter that ignores the pinned ``PYTHONPATH``). ``finish_worker_boot()`` runs it from +``-I`` interpreter that ignores the pinned ``PYTHONPATH``), and re-executes it after restoring a +tree a killed ``hermes update`` half-wrote. ``finish_worker_boot()`` runs it from the worker's ``__main__`` before the payload is read, so a relaunch replays the whole worker: the payload is still on disk and the marker still set, and the new process boots its dependencies again. Left to ``run_agent``'s import inside ``run_one_job``, the relaunch came after the ack, with @@ -61,14 +62,7 @@ def finish_worker_boot() -> None: Not from ``worker_bootstrap()``: while ``-m cron.scheduler`` executes ``cron/__init__.py``, ``sys.argv[0]`` is still ``-m`` and ``__main__`` has no spec, so the relaunch command could not name the module to re-run. In ``__main__`` both are set. - - ``run_agent``'s other import-time relaunch -- restoring a tree a killed ``hermes update`` - half-wrote -- runs here too: the worker never loads ``hermes_cli.main``, so left to - ``run_one_job`` it re-executed the worker after the ack, onto a deleted payload. """ import hermes_bootstrap # noqa: F401 - from hermes_cli import _early_recovery - if _early_recovery.restore_interrupted_pull(): - _early_recovery.relaunch_after_restore() os.environ.pop(WORKER_MARKER, None) From e1d335d2761e627afdbe7300807977732ee437e0 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Wed, 7 Oct 2026 11:12:35 +0530 Subject: [PATCH 5/6] docs(cron): name hermes_bootstrap as the pre-ack relaunch in the worker docstrings After the previous commit the worker's pre-ack recovery is the import of hermes_bootstrap, not run_agent's copy; the module docstring and the relaunch test still credited run_agent. Also restore the scheduler comment's original wrap (whitespace-only churn from the first pick). (Lead fold: quality + thermo + reuse lenses, Low.) --- cron/scheduler.py | 7 ++++--- cron/worker_bootstrap.py | 7 +++---- tests/cron/test_restart_safe_worker.py | 2 +- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/cron/scheduler.py b/cron/scheduler.py index 175cc28cf8b70..c126e57bd7258 100644 --- a/cron/scheduler.py +++ b/cron/scheduler.py @@ -4442,9 +4442,10 @@ def _on_done(_f: concurrent.futures.Future) -> None: parser.add_argument("--external-worker-file", type=Path, required=True) parser.add_argument("--ack-file", type=Path, required=True) args = parser.parse_args() - # The gateway spawns this worker with stdout on DEVNULL and stderr on a capture file it - # only reads back if we die before the ack; without a log handler every adoption/ack - # failure below would otherwise be invisible to the persistent log. + # The gateway spawns this worker with stdout on DEVNULL and stderr on a + # capture file it only reads back if we die before the ack; without a + # log handler every adoption/ack failure below would otherwise be + # invisible to the persistent log. try: from hermes_logging import setup_logging diff --git a/cron/worker_bootstrap.py b/cron/worker_bootstrap.py index 5b5e332b7a21b..0d5329aaa9800 100644 --- a/cron/worker_bootstrap.py +++ b/cron/worker_bootstrap.py @@ -2,7 +2,7 @@ ``sys.executable -m cron.scheduler --external-worker-file ...`` (``cron/scheduler.py::_launch_external_cron_worker``) is a full Hermes entry point that -does not go through ``hermes_bootstrap``, and it imports Hermes packages the moment it +reaches ``hermes_bootstrap`` only from its ``__main__``, and it imports Hermes packages the moment it starts. ``cron/scheduler_worker_env.py`` restores the committed generation's ``site-packages`` on its ``PYTHONPATH`` so those imports resolve, but a pinned path is not a boot: the worker holds no lease on the generation, so the PM collector may remove it @@ -30,9 +30,8 @@ tree a killed ``hermes update`` half-wrote. ``finish_worker_boot()`` runs it from the worker's ``__main__`` before the payload is read, so a relaunch replays the whole worker: the payload is still on disk and the marker still set, and the new process boots its dependencies -again. Left to ``run_agent``'s import inside ``run_one_job``, the relaunch came after the ack, with -the payload deleted and the marker consumed: the new process died on ``ruamel`` and the adopted -run was left ``unknown``. +again. ``hermes_bootstrap`` re-runs the (idempotent) dependency boot; the package-init call above +must stay, because ``cron.jobs`` needs dependencies before ``__main__`` can run. """ from __future__ import annotations diff --git a/tests/cron/test_restart_safe_worker.py b/tests/cron/test_restart_safe_worker.py index c641074a8be3e..9ccba5328a7d6 100644 --- a/tests/cron/test_restart_safe_worker.py +++ b/tests/cron/test_restart_safe_worker.py @@ -810,7 +810,7 @@ def relaunch(*args): @pytest.mark.parametrize("cause", ["source_update", "interrupted_pull"]) def test_relaunch_replays_the_worker_before_its_ack(tmp_path, cause): - """``run_agent``'s import may relaunch the process: ``hermes_bootstrap`` finishing a source + """Importing ``hermes_bootstrap`` may relaunch the process: finishing a source update (into an ``-I`` interpreter that ignores the pinned PYTHONPATH), or the restore of a tree a killed ``hermes update`` half-wrote. Reached inside ``run_one_job``, either came after the ack: the payload was deleted, the marker consumed, and the new process died on ``ruamel`` From 06c02c54ff2090abc1e39e01542042f170184ee9 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Wed, 7 Oct 2026 13:14:17 +0530 Subject: [PATCH 6/6] test(cron): pin that a booted worker drops the marker before any job child Review (greptile): after the boot moved before the ack, the tests checked that a relaunch keeps the marker but none checked that a boot without a relaunch consumes it. Job children would otherwise inherit it and repeat the dependency boot. --- tests/cron/test_restart_safe_worker.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/tests/cron/test_restart_safe_worker.py b/tests/cron/test_restart_safe_worker.py index 9ccba5328a7d6..8c154ff939847 100644 --- a/tests/cron/test_restart_safe_worker.py +++ b/tests/cron/test_restart_safe_worker.py @@ -11,6 +11,7 @@ import threading import time from pathlib import Path +from types import SimpleNamespace from unittest.mock import Mock import pytest @@ -841,6 +842,17 @@ def test_relaunch_replays_the_worker_before_its_ack(tmp_path, cause): assert str(payload) in seen["command"] +def test_booted_worker_drops_the_marker_before_any_job_child(monkeypatch): + """Without a relaunch, ``finish_worker_boot`` must consume the marker: job children spawned + later inherit this environment and would otherwise re-run the worker dependency boot.""" + import cron.worker_bootstrap as worker_bootstrap + + monkeypatch.setitem(sys.modules, "hermes_bootstrap", SimpleNamespace()) + monkeypatch.setenv(worker_bootstrap.WORKER_MARKER, "1") + worker_bootstrap.finish_worker_boot() + assert worker_bootstrap.WORKER_MARKER not in os.environ + + _REAL_BOOT_PROBE = """ import json, sys try: