fix: fail-closed host-memory guard (TODO #13) — the freeze config is now rejected at submission#148
Merged
Merged
Conversation
…6GB host (TODO #13) Observed live: an agent-built sort_spill config swept duckdb.memory_limit [512MB, 16GB] on the 16GB dev machine. DuckDB takes the memory it is granted; the 16GB lane froze the host hard. The config was well-designed for the question — the danger was host-relative, and nothing fail-closed existed below it (no OS sandbox; harness-tenets gap). Guard at the single validation choke point (both API submission and executor entry inherit): any engine memory-limit value — matrix lane (execution.matrix."<engine>.memory_limit") or static engine_params.<engine>.memory_limit — above 50% of physical RAM is rejected at submission, naming the value, host RAM, cap, and the explicit override (meta.allow_high_memory: true). The agent coaching loop turns the 422 into a smaller resubmission automatically — the same mechanism that already handles schema errors. 6 tests including the exact freeze config (16GB lane, 16GB host). OS-level enforcement (sandbox/ulimit) recorded as still open in TODO #13.
# Conflicts: # TODO.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Live incident: an agent-built sort_spill config swept
duckdb.memory_limit: [512MB, 16GB]on the 16GB dev machine — DuckDB took what it was granted and froze the host hard. The config was well-designed for the question; the danger was host-relative, and nothing fail-closed existed below it.Guard at the single validation choke point (
_check_memory_limits_fit_host— API submission and executor entry both inherit): any engine memory-limit (matrix lane orengine_params) above 50% of physical RAM is rejected with a message naming the value, host RAM, cap, and the explicit override (meta.allow_high_memory: true). The agent coaching loop turns the 422 into a smaller resubmission automatically.OS-level enforcement (sandbox/ulimit) remains open in TODO #13 — validation can't stop a workload that grows past its declared limit.
(Note: branch includes files identical to main from the PR #147 restore; net diff is validation.py + tests + TODO.)