feat(sandbox): PID 1 process tree lifecycle and ownership reaper #6

New issue

Closed

opened 2026-09-09 10:08:48 +00:00 by larandar · 1 comment

larandar commented

2026-09-09 10:08:48 +00:00

Owner

Proposal

Make workflow process-tree cleanup bounded and ownership-safe, including orphan reaping and timeout termination.

Design

Run the sandbox with PID 1 semantics so the kernel can orphan-reap descendants. Watch wall-clock deadlines and use instance.nu ownership records to signal only proven run-root PIDs, escalating from SIGTERM to SIGKILL after five seconds.

Tasks

2.3 Enable --unshare-pid and PID 1 orphan reaping.
2.6 Implement the wall-clock timeout watcher and instance.nu ownership law (signal only proven run-root PIDs; SIGTERM, five-second grace, then SIGKILL).

Gherkin Specification Delta

must.contracts.ting-workflows.executor.process-tree-reaper

Scenario: Reap a timed-out workflow process tree

GIVEN a sandboxed workflow with a proven run-root PID and an expired wall-clock deadline
WHEN the timeout watcher fires
THEN only the owned run root is signaled with SIGTERM
AND after five seconds any remaining owned process is signaled with SIGKILL
AND orphaned descendants are reaped by PID 1.

## Proposal Make workflow process-tree cleanup bounded and ownership-safe, including orphan reaping and timeout termination. ## Design Run the sandbox with PID 1 semantics so the kernel can orphan-reap descendants. Watch wall-clock deadlines and use `instance.nu` ownership records to signal only proven run-root PIDs, escalating from SIGTERM to SIGKILL after five seconds. ## Tasks - 2.3 Enable `--unshare-pid` and PID 1 orphan reaping. - 2.6 Implement the wall-clock timeout watcher and `instance.nu` ownership law (signal only proven run-root PIDs; SIGTERM, five-second grace, then SIGKILL). ## Gherkin Specification Delta ### must.contracts.ting-workflows.executor.process-tree-reaper **Scenario: Reap a timed-out workflow process tree** - **GIVEN** a sandboxed workflow with a proven run-root PID and an expired wall-clock deadline - **WHEN** the timeout watcher fires - **THEN** only the owned run root is signaled with SIGTERM - **AND** after five seconds any remaining owned process is signaled with SIGKILL - **AND** orphaned descendants are reaped by PID 1.

larandar added a new dependency

2026-09-09 10:09:16 +00:00

#2 Session: ting-workflow-executor — embedded Nushell, bwrap sandboxing, and OWS DSL 1.0

larandar added a new dependency

2026-09-09 10:09:16 +00:00

#5 feat(sandbox): Bubblewrap mount scaffolding and UNIX domain socket bridge

larandar added a new dependency

2026-09-09 10:09:17 +00:00

#10 feat(cli): wf CLI binary and integration verification suite

larandar commented

2026-09-09 10:15:29 +00:00

Author