feat(stack): read the process identity token via sysctl on darwin (RIG-3548) - #1033
Open
rigel-mintaka wants to merge 1 commit into
Open
feat(stack): read the process identity token via sysctl on darwin (RIG-3548)#1033rigel-mintaka wants to merge 1 commit into
rigel-mintaka wants to merge 1 commit into
Conversation
|
Merging to
After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here |
|
Compass engineering docs preview: https://compass-native-rig-3548-darw.compass-eng-docs.pages.dev Deployed from |
…G-3548) compass-stack up records a start-time identity token for every child it spawns, to close the pid-recycling window. The only reader was /proc/<pid>/stat, so up refused on macOS: pgidfile.go is //go:build unix, which darwin satisfies, meaning darwin compiled the Linux reader and failed at runtime rather than at build time. Add a darwin reader at BOTH identity sites, split behind the existing seams into _linux.go/_darwin.go files. The token is read at spawn by the core and independently at teardown by the group-signal adapter, and GroupSignaller.Alive compares the two for uint64 equality — so both darwin readers share one packing rule (sec*1e6 + usec over the KinfoProc start timeval, via sysctl kern.proc.pid), pinned by mirrored tests in both packages. A drift between them would report every live child as not-alive and silently skip it at teardown, which is why the duplication is pinned rather than trusted. Both readers fail closed on a dead pid, so a failed read can never yield a 0 token that would spuriously match a record carrying 0. The darwin CI lane gains a step running the stack suite natively, because cross-compiling type-checks these readers but never executes them, and the sysctl has no Linux stand-in. The readers have NOT run on a real macOS host yet; that step is what will prove them. Promotes golang.org/x/sys to a direct dependency (already in the module graph); go.sum unchanged. Refs RIG-3548, RIG-1662. Co-authored-by: Matt Wilkinson <matt@rigel.build>
rigel-mintaka
force-pushed
the
compass-native/rig-3548-darwin-starttime
branch
from
September 8, 2026 21:56
701934f to
f683bed
Compare
rigel-mintaka
marked this pull request as ready for review
September 8, 2026 22:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR is part of a stack containing 2 PRs:
maincompass-stack up records a start-time identity token for every child it
spawns, to close the pid-recycling window. The only reader was
/proc//stat, so up refused on macOS: pgidfile.go is //go:build unix,
which darwin satisfies, meaning darwin compiled the Linux reader and failed
at runtime rather than at build time.
Add a darwin reader at BOTH identity sites, split behind the existing seams
into _linux.go/_darwin.go files. The token is read at spawn by the core and
independently at teardown by the group-signal adapter, and
GroupSignaller.Alive compares the two for uint64 equality — so both darwin
readers share one packing rule (sec*1e6 + usec over the KinfoProc start
timeval, via sysctl kern.proc.pid), pinned by mirrored tests in both
packages. A drift between them would report every live child as not-alive
and silently skip it at teardown, which is why the duplication is pinned
rather than trusted.
Both readers fail closed on a dead pid, so a failed read can never yield a
0 token that would spuriously match a record carrying 0.
The darwin CI lane gains a step running the stack suite natively, because
cross-compiling type-checks these readers but never executes them, and the
sysctl has no Linux stand-in. The readers have NOT run on a real macOS
host yet; that step is what will prove them.
Promotes golang.org/x/sys to a direct dependency (already in the module
graph); go.sum unchanged.
Refs RIG-3548, RIG-1662.
Co-authored-by: Matt Wilkinson matt@rigel.build