base red: app_lines +6, set-network-access's read-apply-write moves to CmuxNextCloud (#31666)

Merged
LA
5d ago
+44-12

Fixes the tip arch red [app_lines] CmuxNextApp +6 from #31666 (STATUS 4697, 4729).

Culprit

#31666 (49fef16f8e59, Leo, "cloud set-network-access: a slow server answers pending before the result deadline (#28855)").

  • Red at the culprit alone: python3 scripts/cmux-next/arch-ratchet.py --base 49fef16f8e59^ --head 49fef16f8e59 gives app_lines +6 (CloudNetworkAccessActions.swift: 2 doc lines, the pendingAfter parameter, and the guard that builds the pending answer).
  • No open or merged PR fixes it. A revert would take back a user-facing fix (the slow-server pending answer), so this PR moves code instead.

Change

The pending answer itself must stay in the App: CloudHandlers.result(pendingAfter:pending:) is App code, and ActionResultValue lives in CmuxNextActions, which CmuxNextCloud does not import. So the network-policy logic of the same set function moves (lead decision): CloudNetworkAccessQueue.set(_:on:refusal:read:write:) in CmuxNextCloud now does the serialized read, apply and write, and keeps the agent-may-only-close rule and its reason (#28706). The handler keeps the wiring: the refusal value, the result fields and the pending answer.

Behavior is the same:

  • An agent's run that is not none throws the same ActionFailure, inside the per-machine queue and before the read.
  • An applied policy at the same level is not written again.
  • The fields come from the state the server holds.

Verification

  • arch-ratchet.py --base origin/feat-cmux-next --head HEAD: app_lines -7, no count rises. With #31666's +6, the range is -1. prepush-gate.py: no new violations. lint-ios-package-conventions.sh: OK.
  • cmux-ci compile-check --app --package CmuxNext --recipe-version 2 --ref fceb5198f706256d8604b1bd81574dc15d2640b9 (job f2d95b3e612a1f00b530ee23): CmuxNext passed (202 s), app passed (59 s). cmux-tui failed on the base red cannot update the lock file cmux-tui/Cargo.lock because --locked (#31462's stale lock; #31654 and #31697 are open). This PR changes no Rust.
  • Fleet step 6ef5c9d6d55ec38728f88fea (aws-m4pro-2): CloudNetworkAccessTests passed, 16 tests, including #31666's aSlowServerAnswersPendingAndTheChangeGoesOn and the new theQueuesSetRefusesWideningAndWritesOnlyAChange.

Observed / Not run

  • Observed: the arch-ratchet, prepush gate, the namespace lint, and the fleet compile and suite above.
  • Not run: a live cloud set-network-access against a Cloud machine.

Changelog

none

View with [code]smith Autofix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Fixes the tip arch red [app_lines] CmuxNextApp +6 from #31666 by moving set-network-access's read-apply-write out of the app handler.

The pending answer added in #31666 must stay in the App, so the network-policy logic moves instead: CloudNetworkAccessQueue.set(_:on:refusal:read:write:) in CmuxNextCloud now does the serialized read, apply, and write and keeps the agent-may-only-close rule. The handler keeps the wiring. Behavior is unchanged—an agent run that is not none throws the same ActionFailure before the read, an applied policy at the same level is not written again, and the result fields come from the state the server holds.

Adds CloudNetworkAccessTests.theQueuesSetRefusesWideningAndWritesOnlyAChange covering the moved logic.