release: conexus 7.37.0 (paired with engine-service-v0.1.109) - #1521
Merged
Conversation
…e stale window, and reset on a hit (nexus-e0ypa) The aspect worker daemon swept the queue every 30s for a 300s stale window: 2,880 empty reclaim requests a day on an idle box, the dominant empty poll on the edge after the claim_batch backstop landed. The sweep cadence now doubles on consecutive empty sweeps, capped at the stale window (a row cannot become reclaimable faster than that), returns to the 30s base on any reclaim, and holds on a failed sweep. A live queue keeps the RDR-173 review-M1 promptness the fixed 30s was chosen for; an idle one costs about a tenth of the traffic. next_reclaim_wait is the pure rule; the loop reads _current_reclaim_wait.
…nt names the base and the idle worst case (nexus-e0ypa) Review of 53923fe: the backoff was invisible in the daemon's own logs, so aspect_worker_daemon.reclaim_wait_changed now records previous and next wait whenever a sweep moves it. The constructor comment still called the cadence a fixed 30s; it now names the base and states the idle-then-strand worst case (threshold plus threshold, the same as a flat threshold cadence).
…er names (nexus-0fw11) Sam's decision 2026-09-08. The MCP store_put tool and nx store put defaulted collection to "knowledge", and that default is what minted the knowledge__knowledge collection (1464 chunks) the collection rules forbid. store_put's collection argument is now required, nx store put's --collection is required, and every write resolution through t3_collection_name refuses the placeholder subjects docs/collections.md Rule 1 names (default, knowledge, notes, tmp, test) as a bare or two-segment name, with an error that names the rule. Reads keep their defaults so existing placeholder collections stay reachable, and a full four-segment conformant name still passes through untouched, the deliberate escape for what already exists. nx memory promote and the indexers share the resolver and get the same refusal. tests/test_corpus.py pins the placeholder set to the docs' list. Test fixtures that wrote to the placeholder now write to fixture-subject.
…r and never blocks a recovery-bundle restore (nexus-0fw11) Critique of 86cd65e: only nx store put caught PlaceholderCollectionError; nx memory promote, nx index pdf/md and nx dt index raised a traceback. The exception is now a click.ClickException as well as a ValueError, so every command sharing the resolver prints the message and exits 1 with no per-command catch; the store put catch is removed. The recovery-bundle import reduces a recorded conformant name to its two-segment base before resolving for write, which refused the two live placeholder collections (docs__default, knowledge__knowledge); t3_collection_name gains allow_placeholder, set only there, since a restore is not a new mint. The docs sentence names every writer the refusal covers. The full suite's other placeholder writers (attribution, scenario journeys, store enrich, index pdf normalization, dt index) move to a subject name.
…ad-id manifest refreshed (nexus-0fw11)
…ger (nexus-0fw11)
… interpreter, so hooks that import nexus resolve instead of falling through (nexus-4ti7e) Measured on the 7.36.1 install: Homebrew's python3.13 has no nexus, so rdr_hook's two resolution imports raised, the structlog warning meant to name the cause could not be written either, and every SessionStart reported a fully indexed tree as NOT indexed. The owna8 fix shipped inert. The runner now execs <tools>/current/bin/python (NX_TOOLS_DIR or ~/.local/share/nexus/tools) when it exists, then the named probes, then python3.
…tructlog, so an interpreter without the package still names the cause (nexus-4ti7e)
… that cannot run; the stdlib-only docstrings say when the interpreter lacks nexus (nexus-4ti7e)
…over the generation; the NOT-indexed verdict names a resolution failure on stdout and in <config>/rdr_hook.log (nexus-4ti7e)
…he verdict print is guarded, drives main() in its test, and caps the failure text (nexus-4ti7e)
…s archive/* branches, pushed from the source, as a real clone of github does (rdr-120's archive-only citation 122feaf)
…rot lint, which walks history a depth-1 single-tag checkout does not have (nexus-4ti7e cut)
…hannel until the client release carries the wheel half (nexus-0fw11) The plugin cut refuses an entry whose bead also touches wheel content: the reference.md row says collection is required, which is true only once the wheel with the refusal ships. Reverted from develop so plugin-v7.36.1-1 can cut; the row re-lands with the client release that carries 86cd65e.
…en, not a Voyage one, so the mode-declarations census reads no cloud claim (nexus-0fw11)
…g_collections columns (nexus-ft04v.2)
…enant, evicting the registry (nexus-ft04v.6)
…uest after boot (nexus-ft04v.3)
…v.2) catalog-036-3 creates nexus.embedding_profile with ENABLE + FORCE + tenant_isolation; the health check's _RLS_TENANT_TABLES and its test mirror must carry every RLS table or the changelog cross-walk fails.
…the seven stub-insert paths are retired (nexus-ft04v.7)
…s lifecycle_state; a differing model is a 422 naming the profile's value (nexus-ft04v.8)
…ase changeset (nexus-ft04v.4, nexus-ft04v.5)
…ction-attribute constraints (nexus-ft04v.4, nexus-ft04v.7) Six full-suite passes in the primary over the RDR-204 Phase 1 range (2350 run, 47 failures, 219 errors at the start; 250 classes green at the end). Test fixtures that inserted a bare catalog_collections row or wrote chunks, topics or aspects without registering now go through PgContainerHelper.insertCollection, which derives constraint-satisfying attributes from the name and is guarded for pre-catalog-036 migration depths; HTTP-driven tests spend the per-tenant boot sweep (bead .3) with one authenticated request before registering, since the sweep deletes a registered-but-chunkless row. RawSqlGateTest's per-file ceilings drop as raw fixtures converted (1191 -> 1129 total). Production, all consequences of the constraints: - CatalogRepository.importCollection / importCollectionsBatch write lifecycle_state; the unreachable stub-upgrade DO UPDATE arm becomes DO NOTHING (an import never overwrites a live row). - upsertCollection refuses a registration with no content_type with the same 422 shape as the profile conflict. - hygiene-003: the ninth stub-insert path, in the assign_from_chashes SQL functions, is retired with a fail-loud guard. - hygiene-004: hygiene-002-2's gc_quarantine_orphans rewrite had dropped catalog-033-2's gc_audit producer and sample_limit clamp; restored. Two tests changed contract with the design: the foreign-tenant assign-from-chashes case now expects the not-registered error under RLS, and the blank-stub import tests became existing-row-untouched tests.
…before the first write (nexus-f5wwx)
…s body; hygiene-004 squashed away (nexus-ft04v.4)
…ons carry content_type, fixtures send the effective model (nexus-f5wwx)
…on-attribute walk (hygiene-002-1, nexus-ft04v.4)
…ha and names both client halves (nexus-ft04v.8, nexus-f5wwx)
…, the user-level commit recorder's ambient writes (nexus-4ti7e cut battery)
…fixture collections before writing; the engine no longer auto-registers on a chunk write (nexus-ft04v.7) Found by --shakeout Phase F on the v0.1.109 candidate: the rerank fixture's store-put returned 422 'collection ... is not registered'. The same script runs in engine-service-release.yml, where it would have burned the tag; the local-service gate's vector leg writes the same way and would have failed the paired client release's battery. SMOKE_EXPECTED 11 -> 12.
…exus-f5wwx, fixed in 7.37.0; sh9v2's 7.7.0 ack was stale against every current client (nexus-ft04v.7)
…tered 422 like every other write path (nexus-f5wwx)
…st is order-independent (nexus-x75kg) The fan-out floor census renders whatever the T3 handle raised: "fan-out floor census: UNAVAILABLE (RuntimeError: HTTP 401: invalid api_key SUPERSECRET)". health.py's reachability probe redacted its 401 text (nexus-8ooxn / nexus-hcy4w); nothing else in doctor.py did, and the census is a default-sweep check, so any engine 401 whose body echoes the rejected credential printed it. Every doctor site that puts an exception into output or a log field now goes through _exc_detail(), which is redact_credentials() plus the optional class-name prefix those sites already carried. Why it only showed under -n auto: the test patches http_vector_client._get but not make_t3, so the census reaches the patched transport only when the process-global _vector_client_instance is already constructed - which an earlier test in the same xdist worker does once the engine substrate is up. Alone, construction fails first with ManagedServiceUnreachable and the message carries no secret. The doctor tests now reset that singleton on both sides, so they neither inherit it nor export one, and a new test patches make_t3 directly to pin the redaction without depending on that accident. health.py's other exception renders are unchanged - out of scope here.
…he walk completes on the disputed fixture (nexus-ft04v.7, nexus-ft04v.4, nexus-ft04v.8)
…plugin channel until the client release carries the wheel half (nexus-0fw11)" This reverts commit 29190c7.
… lines after the fixture-registration block (07d9361)
… and the acquire probe names a subject collection - test_changelog_rls_lint: allowlist hygiene-002-1 on nexus.catalog_collections; its UPDATEs LEFT JOIN nexus.embedding_profile (FORCE RLS, untoggled), which the changeset's own comment shows holds zero rows for every tenant at walk time. Published in engine-service-v0.1.109 and walked on the PITR fork. - test_nexus_config_dir_setattr_lint: the exempt setattr in test_health_service_checks.py moved from line 2671 to 2672 (80b3fee). - write-seam gate: the four tests set NX_LOCAL=1 instead of deleting it. With only NX_SERVICE_URL set the client reads as managed and registers a knowledge collection as voyage-context-3 (nexus-f5wwx), which the ONNX engine's bge-768 profile refuses with 422. - mcp store_put refuses a placeholder collection before _get_t3(): the managed floor probe ran first, so an unstamped or unreachable engine masked the nexus-0fw11 refusal (both shard-3 jobs). - rehearse_acquire.sh: the store put probe passes --collection, required since nexus-0fw11; the acquire gate on v0.1.109 failed three checks on that usage error, not on the engine.
…cal mode Same shape as 034043c for tests/db/test_write_seam_gate_integration.py: with only NX_SERVICE_URL set the client reads as managed and the nexus-f5wwx registration names voyage-context-3 for a knowledge collection, which the ONNX engine profile (bge-base-en-v15-768) refuses with 422. The four combined-query tripwire tests share the vec_client fixture, so they were the remaining write-seam reds on PR #1521.
…xus-0fw11) nexus-0fw11 made --collection required and refused the placeholder subjects, and shipped to develop without a PR; the gate scripts that only run at release or tag time kept the old invocation. Found by the battery (fresh-install MVV, step 5) and the --acquire gate (034043c fixed that one). This sweep covers the rest: fresh-install-mvv.sh (two puts), data-token-cli-gate.sh, rehearse.sh (the default, --comprehensive and --stress legs), and published-client-write-gate.sh, whose --collection knowledge is the refused placeholder once 7.37.0 is the published client (7.36.1 predates the change).
…their collections before seeding (RDR-204 client half, PR #1521) The local-service gate's 53 failed + 73 errors traced to two related gaps left by RDR-204's client-side registration change: - family A (422 profile mismatch): java_service-backed fixtures export NX_SERVICE_* for the client without NX_LOCAL=1, so is_local_mode() reads managed and derives voyage-context-3 for a knowledge/code write, which the ONNX-only test engine's bge-768 profile refuses. Fixed in test_retrieval_drift_gate.py (seeded_client, _service_env) with the same NX_LOCAL=1 pin as e08f68c/034043c65. test_xnz0o_commands_ integration.py and test_catalog_consumer_qnp5s_integration.py instead passed an explicit, now-stale voyage-context-3/voyage-code-3 literal to register_collection (never overridden by the derivation) -- both fixed to the model this ONNX engine actually serves for every content type (EmbedderRouter.contentTypeModelTokens' local branch). - family B/C (not registered / connection refused): every store's write_with_registration_retry self-heals via a DEFAULT registrar (catalog.factory.make_catalog_writer) that resolves NX_SERVICE_URL from the ambient env, not from the fixture's own base_url. A class- or module-scoped seed fixture runs before any function-scoped autouse fixture (pytest resolves by scope), so at seed time ambient env is either empty (connection refused) or points at a different shared substrate (registers there, then the real write 422s "not registered" against this fixture's own engine). Fixed by pre-registering every collection each file's tests actually write to, bound explicitly to that file's own service, in test_http_taxonomy_store_integration.py, test_http_aspects_stores_integration.py, and test_l9hd8_aspect_sql_service_integration.py (whose per-class seed fixtures needed the same pin repeated around each class's own writes, not just once at module setup, since one class's write could still trigger a stale-registration retry with a stale ambient env). test_http_chash_integration.py's _seed_chunk posts directly to /v1/vectors/upsert-chunks (bypassing the client's self-heal entirely) and now registers first under the same bearer the write uses. test_data_token_manager_e2e.py registers its collection before deliberately breaking the static service token, so the self-mint round trip it verifies is never masked by an unrelated registration failure under the mint-locked credential. test_collection_health_dsu5z_integration.py, test_http_telemetry_store_ integration.py, and test_coverage_3cwnx_integration.py were audited and left unchanged: none of their tests write a collection, so neither failure mode applies (confirmed by a clean run).
…204 client half, round 2)
Same two families as the first commit, in modules that first commit did
not touch, plus one distinct auth-tenant bug and one genuinely
unreachable non-vacuity constraint:
- tests/db/test_5xn3k_runfence_gate.py: service_env explicitly
monkeypatch.delenv("NX_LOCAL")'d, reading managed posture and deriving
voyage-context-3/voyage-code-3 for a docs/code registration. Pinned
NX_LOCAL=1 (5 tests: 4 direct 422s, one "batch 1 never landed" whose
background thread was swallowing that same 422 before ever setting its
landed-event).
- tests/db/test_http_catalog_integration.py,
tests/db/test_i711w_gap_xfails.py (TestSupersedeCollectionSemantics),
tests/db/test_i711w_gap_contracts_fresh.py
(TestItem12CatalogReadsAfterRename): explicit voyage-context-3/
voyage-code-3 literals passed to register_collection, never overridden
by the derivation since register_collection only derives on an EMPTY
kwarg. This ONNX engine's EmbedderRouter.contentTypeModelTokens (local
mode, verified in service/.../EmbedderRouter.java) maps every content
type, code included, to bge-base-en-v15-768 -- literals and the
matching name segments renamed to match. TestItem12's 5 setup errors
were all the same fixture failing once per dependent test.
- tests/db/test_frecency_enehl_integration.py,
tests/db/test_indexer_seam_b_integration.py
(test_store_put_get_roundtrip_ij9hg): same NX_LOCAL posture gap as the
first commit's family A, in files the first pass's file list didn't
name. test_indexer_seam_b's sibling
test_indexer_seam_b_index_search_round_trip deliberately omits
NX_LOCAL=1 (its own non-vacuity proof requires managed-mode routing to
activate BEFORE local-mode fallback) -- registered that one collection
explicitly instead, with an EXPLICIT bge-base-en-v15-768, bypassing the
ambient-mode derivation the test cannot use, and warmed
ensure_collection_registered's cache directly (the same test-sanctioned
pattern as tests/test_store_cmd.py / tests/test_collection_shape.py).
- tests/db/test_http_shape_parity_integration.py: _token_env pinned
NX_SERVICE_TOKEN but never NX_SERVICE_URL, so a client constructed
with only base_url (no explicit _token) resolved its OWN token from
this pin correctly, but ensure_collection_registered's DEFAULT
registrar resolved the URL from stale/ambient env -- landing on the
shared T2 substrate while presenting this module's bearer: 401.
Pinned URL alongside the token (plus NX_LOCAL=1).
- tests/test_indexer_e2e.py test_reindex_self_heals_missing_manifest:
this file's autouse _legacy_vector_backend pins
NX_STORAGE_BACKEND_VECTORS=local for local_t3's own in-memory double,
but the test's own real-engine mirror (seed_manifest_chunks, a bare
HttpVectorClient()) inherited that same ambient posture, deriving
minilm-l6-v2-384 (the client-local EF tier) instead of this engine's
actual bge-768 profile. Pinned service+local posture for the duration
of that one real-engine write only, restored immediately after.
- tests/db/test_data_token_manager_e2e.py: registration was already
correctly ordered before the static-token break in the first commit;
the residual "data_token_mint_failed" events in the full-gate run did
not reproduce in 2 separate isolated re-runs of this file (3/3 passed
both times) -- left as diagnosed-but-unreproduced-in-isolation, likely
full-session state this scoped verification protocol cannot surface.
Owner
Author
Release battery, conexus 7.37.0 paired with engine-service-v0.1.109Tree 034043c (
Engine: Suspect flake, not a fixed defect: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Paired with engine-service-v0.1.109 (tagged on 2839915), REQUIRED_ENGINE_VERSION 0.1.109. RDR-204 Phase 1: collections stop encoding metadata in their names. NON-additive pairing: the engine deploys only after this client tag.
Changed
Fixed
Engine v0.1.109
catalog-036, hygiene-002, hygiene-003 (nine changesets); seven stub-insert paths retired; register-422 with field-named refusals; ghost sweep and dormant marking at first request. Pre-tag battery on 2839915: Java suite 2697/0/0/7, --shakeout PASSED, --candidate-migration PASSED delta=9 invariants EXACT, published-client write gate EXPECTED-INCOMPATIBLE under f5wwx (7.36.1 < 7.37.0).
Client battery on this branch runs once the engine publishes (its cold-acquire legs need the published v0.1.109); the verdict table follows in a comment before merge.