Repository navigation
id(cli): module_trust_keys test stack-overflows on host runs (unbounded recursion), aborts full-lib suite #5216
Description
Observed 2026-11-03 on the laptop (amd-6) while reproducing #5195 — unrelated subsystem, filed so it exists as a tracked problem:
cli::tests::module_trust_keys_are_repeatable_and_require_world_mode stack-overflows and aborts the whole lib test binary on host runs:
thread 'cli::tests::module_trust_keys_are_repeatable_and_require_world_mode' has overflowed its stack
fatal runtime error: stack overflow, aborting
Evidence:
- Reproduces in isolation (
--exact) on the current-main lib binary and on several pre-existing primary-built lib binaries under~/git/code/pkgs/id/target/debug/deps/(id-6ef43893fd006436, id-b87063fabef9c143, id-ba32ff1f3cf2d9e3, id-cf7e07685103fdc8, id-d3684de534d38795, id-d6065620e2eebd91). - Still overflows with
RUST_TEST_THREAD_STACK_SIZE=67108864(64 MiB test-thread stack) — the recursion reads as unbounded, not merely deep. - Independent of working directory and of test-thread count.
- Per the id(world_net): inbound_refusal_backpressures test is flaky — intermittent "a pre-auth refusal sheds the stream" #5195 record, the
nix build .#id-websandbox check phase the same day ran 3294 tests / 0 failed, so the trigger is host-environment-specific (something about the host filesystem/HOME the test walks, that the sandbox does not present).
Impact: any full cargo test -p id --lib run on the host aborts mid-suite, so host full-suite verification of the id package is currently impossible without skipping this test.
Acceptance: the test passes on host runs (or terminates with an ordinary failure, never a process abort), with the recursion source named in the closing comment; the nix check phase stays green.
Acceptance criteria
cli::tests::module_trust_keys_are_repeatable_and_require_world_modecompletes without stack overflow on a host (laptop) run, in isolation (--exact) and inside the fullcargo test -p id --libsuite, which runs to completion instead of aborting.- The unbounded recursion is identified and bounded at its source (named in the closing comment) — not masked by a larger test-thread stack.
- The
nix build .#id-webcheck phase stays green (it currently passes; the fix must not regress the sandbox run).
Metadata
Metadata
Assignees
Labels
Package/app: id (pkgs/ or apps/ in this repo)Small: expected under 2 hours of workSomething isn't working (prefixed form of the classic bug label)Intake review done: acceptance criteria, links, and normalized labels addedImportant and time-sensitiveQueue packet kind: verify, reproduce, and route this item
Activity
dezren39 commentedon Nov 4, 2026
Broader than first filed: the overflow is a family across the whole
climodule, not one test. Skipping tests one at a time surfaced, in order:cli::tests::source_only_mode_is_opt_in_and_requires_world_mode— same stack overflow / abort.cli::tests::test_cli_parse_cat_aliases— same (a plain CLI parse test).cli::world_limits_args_tests::flag_defaults_match_the_built_in_limitsandcli::world_limits_args_tests::flags_override_each_bound— same.Every crasher builds the clap command/args tree, which points at shared CLI-construction code recursing on something host-specific (the sandbox check phase passes these same tests). Full-lib host runs currently need
--skip cli::to complete at all.dezren39 commentedon Nov 4, 2026
One more data point, same session: with the whole
cli::prefix skipped, the next crasher iscommands::serve::tests::serve_server_config_flag_defaults_to_none— also a clap-tree-building test. The family is "every test that builds the CLI command tree", acrosscli::tests,cli::world_limits_args_tests, andcommands::serve::testsso far. Root cause should be looked for in shared command construction (something it scans or expands on this host that the sandbox does not present).dezren39 commentedon Nov 4, 2026
Intake review
Related: Found while reproducing #5195 (different subsystem — flaky world_net test).
Notes: Host-only failure with strong evidence: reproduces in isolation on current-main and on several pre-existing lib binaries, persists at a 64 MiB test-thread stack, while the nix sandbox check phase passed 3294 tests the same day — so the trigger is host-environment-specific (something in the host environment feeds the recursion: config, keyring, or filesystem state the sandbox lacks). No merged PR resolves this (filed 2026-11-04T00:19Z from the #5195 reproduction session; merged-PR search this run: none). Risks: a stack-size bump would mask it — the acceptance bars that. Suggested approach: get a backtrace under gdb/lldb or add a recursion-depth probe, and diff host vs sandbox inputs to the trust-key walk.
— fleet monitor intake (protocol §5), 2026-11-03 18:12 CST run. Verified still live this run per the notes above.
dezren39 commentedon Nov 4, 2026
Agent note — task 9468 triaged
module_trust_keys(searched all states; PR id(world_net): make inbound_refusal_backpressures test deterministic (#5195) #5215 is the merged, unrelated id(world_net): inbound_refusal_backpressures test is flaky — intermittent "a pre-auth refusal sheds the stream" #5195 fix in whose reproduction this was found)cli::tests::module_trust_keys_are_repeatable_and_require_world_modestack-overflows in isolation (--exact) on current-main and multiple pre-existing lib binaries, overflows even with a 64 MiB test-thread stack (unbounded recursion, not depth), independent of cwd/thread count, and does NOT reproduce in thenix build .#id-websandbox check phase (3294 tests green) — so the trigger is something the host filesystem/HOME presents that the sandbox does not.pkgs/id, trace what the module-trust-key code path walks/resolves on the host (filesystem walk or recursive key/module resolution reachable from that test), find the cycle/unbounded step the host layout creates, and bound it at the source (visited-set or depth bound in the production path, not a bigger test stack and not a test-only skip). Verify: isolated test passes on the laptop host, fullcargo test -p id --libruns to completion on host,nix build .#id-webcheck phase stays green; name the recursion source in the closing comment per the issue acceptance.triaged; issue stays open.