cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door)

Summary

infra/cargo-target-janitor/bin/cargo_target_janitor.py: the janitor's deletion-safety readers disagree about malformed input. The two gh-based readers convert shape errors to SafetyError — labelled_claimed_issues (:400, conversion at :427) and open_pr_branches (:486, conversion at :515) both catch (ValueError, KeyError, TypeError) and re-raise as SafetyError("invalid gh ... response"). The other three readers do not:

parse_fallback_scan (:384) — the LIVE fallback claims path (cargo-target-janitor: queue helper path is dead (~/hatch/tools/repo-queue.py) — every hourly run refuses cleanup while in-scope targets sit at 275G vs the 150G cap #6812 made it the primary source when the queue helper is absent): scan.get, item.get, claim.get, and int(item["number"]) are all unguarded;
queue_claims (:277) — rows.extend(page), int(row["id"]), (row.get("payload") or {}).get(...) unguarded;
queue_task_states (:323) — int(row["id"]) / row["status"] unguarded.

That matters because of how main ends (:963): it catches (SafetyError, OSError, CalledProcessError, TimeoutExpired, SystemExit), writes the refused run record to the state-dir log, and exits 2. The comment there records the #6812 lesson verbatim: a refusal is a run too — until it left a record, an hourly-dead janitor was visible only in the systemd journal. A malformed scan document or broker row raises AttributeError/KeyError/TypeError/ValueError instead, which is NOT in that tuple: the process dies with a raw traceback, no refused record is written, and the janitor is hourly-dead invisibly again — the exact failure mode #6812 fixed, through a different door. (The crash still happens before any deletion, so this is an observability/robustness defect, not a wrongful-deletion one.)

Evidence (verified this run, laptop @ origin/main `07ecb67`)

Probe: ~/git/fleet/probe-janitor-shapes/probe.py (laptop), importing the real cargo_target_janitor.py from the laptop primary and driving the three readers directly. Control plus 10 malformed shapes:

control scan {"items":[{"number":123,"claim":{"state":"live"}}]} → {123} OK;
scan item is a string → AttributeError: 'str' object has no attribute 'get';
scan claim is a string → AttributeError (same);
scan item missing number → KeyError: 'number';
scan number is a dict → TypeError: int() argument ... not 'dict';
scan items is a dict / scan itself is a list → AttributeError;
queue_claims page is a PostgREST-style error dict → AttributeError: 'str' object has no attribute 'get' (the dict's keys are extended as rows);
queue_claims row id "abc" → ValueError: invalid literal for int();
queue_claims row payload is a string → AttributeError;
queue_task_states row missing id → KeyError: 'id'.

Every malformed case: SafetyError=False — none is the exception main records as a refusal.

Why it matters

The janitor is the only thing standing between the fleet worktree cargo targets and the disk-full failures in #6797/#3372, and its safety model is "fail closed AND leave a record". A shape change in the fleet queue fallback scan output (a binary that is actively evolving, #6658) or a broker error payload returned as a 200-shaped dict silently reverts the janitor to dying hourly with no state-dir record — the operator signal #6812 deliberately built disappears, while the systemd journal is the only witness, again.

Acceptance criteria

parse_fallback_scan, queue_claims, and queue_task_states validate the shapes they consume (scan is a dict with a list items; each item/claim is a dict; number/id are int-convertible; payload is a dict or null; page/rows are lists of dicts) and raise SafetyError naming the reader and the bad shape — mirroring the labelled_claimed_issues/open_pr_branches conversion pattern.
A malformed scan or broker response produces the refused run record and exit 2 from main, never a raw traceback.
Well-formed inputs behave byte-identically: the control scan, a normal claimed set, and normal task states return the same results as today.
Tests in infra/cargo-target-janitor/tests/test_cargo_target_janitor.py cover the malformed shapes above for all three readers plus the well-formed controls.
No change to what the janitor deletes, its caps, or its claim semantics — protection sets are computed exactly as before for valid inputs.

🤖 Filed by the fleet new-issue-creator (lane B) — verified with a probe against the real module this run; see the probe path in the evidence section.

CODE-2112

🤖 Agent note · filed

Agent: new-issue-creator job (new-issue-creator-code-b)
Session / ID: cron new-issue-creator-code-b run 2026-11-07 00:50 CST
Found via: filed this run
Task: parse_fallback_scan / queue_claims / queue_task_states raise raw AttributeError/KeyError/TypeError/ValueError on malformed shapes instead of SafetyError, so main() writes no refused run record — verified with a laptop probe driving the real module (control OK, 10 malformed shapes, none SafetyError)
Expectation: effort s; done = all three readers raise SafetyError naming the bad shape, malformed input yields the refused record + exit 2, well-formed behavior unchanged, tests cover the shapes
Links: probe ~/git/fleet/probe-janitor-shapes/probe.py (laptop) @07ecb675ef · related issue cargo-target-janitor: queue helper path is dead (~/hatch/tools/repo-queue.py) — every hourly run refuses cleanup while in-scope targets sit at 275G vs the 150G cap #6812, issue cargo-target-janitor: both deletion-safety liveness reads are single-page — queue_claims caps at 1000 rows and open_pr_branches at 500 PRs, so a claimed task or open-PR worktree past the page silently loses its never-delete protection #6618, issue cargo-target-janitor(queue_claims): offset pagination over the live claimed set can skip a still-claimed task — it loses never-delete protection #6790

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane code-v
Session / ID: task 11061
Found via: queue claim
Task: Fix issue cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door) #6844 — janitor readers parse_fallback_scan, queue_claims, queue_task_states raise SafetyError on malformed shapes, with regression tests
Expectation: s — done looks like a PR for issue cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door) #6844 with all three readers converting malformed shapes to SafetyError and tests covering them
Links: branch queue/11061-6844-janitor-safetyerror (to be created)

🤖 Agent note · picked up (resume)

Agent: queue worker (repo-worker-code), lane code-n
Session / ID: task 11061
Found via: queue claim (resuming after lane code-z parked it for CI)
Task: recheck CI on PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005 (bound branch queue/11061-6844-janitor-safetyerror); merge when green under the standing criteria
Expectation: effort s; done = PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005 merged and issue cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door) #6844 closed, or re-parked with the CI state named
Links: PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005 checks pending at pickup (basic: proxy port fallbacks, scripts-test 3.12/3.14); no Codex reviews or findings on PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005 as of 2026-11-08T02:08Z. Claim labels synced (removed stale queue/parked, status/parked and the malformed status:in-review).

🤖 Agent note · parked — CI pending on PR #7005

Agent: queue worker (repo-worker-code), lane code-n
Session / ID: task 11061
Found via: queue claim (resume)
Task: merge PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005 when its checks go green
Expectation: parked 20 min; resume by re-reading PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005 check state fresh
Links: PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005 head c1c8942 (single commit, unchanged). Verified fresh 2026-11-08T02:14Z via three independent reads (gh pr checks, gh run view, gh run list): both workflow runs — scripts-test (run 42431574432) and proxy port fallbacks (run 42431574394) — are still QUEUED, created 2026-11-08T00:50Z, never started. No Codex reviews/findings on PR fix(cargo-target-janitor): readers raise SafetyError on malformed shapes (#6844) #7005. Diff reviewed by this lane: two files (janitor + its tests), shape validation raising SafetyError as issue cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door) #6844 requires. Parking task 11061 rather than holding the claim on a runner backlog.

fix(cargo-target-janitor): readers raise SafetyError on malformed sha…

Fixed and merged. PR #7005 squash-merged as daa445170d2668183e05c0ab23fd34c934f61487.

queue_claims, queue_task_states and parse_fallback_scan now raise SafetyError naming the reader and field on malformed page/row/payload/status shapes, instead of dying on raw TypeError/ValueError — closing the second door of the cargo-target-janitor: queue helper path is dead (~/hatch/tools/repo-queue.py) — every hourly run refuses cleanup while in-scope targets sit at 275G vs the 150G cap #6812 invisible-death mode.
_shape_int validates shape and rejects bools and non-int/non-str values with a named SafetyError.
Verification on the laptop at head c1c894287b: 35 janitor tests OK, including the three new cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door) #6844 shape tests and the well-formed-rows control. Codex review completed with no findings.
CI: basic: checks sat queued ~18h with no runner pickup (fleet-wide stall); merged on local evidence under the standing criteria.

The issue is satisfied by this merge; closing it is left to the next reconciliation pass so the merge is visible on the timeline first.

Navigation Menu

Repository navigation

cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door) #6844

Summary

Evidence (verified this run, laptop @ origin/main `07ecb67`)

Why it matters

Acceptance criteria

20 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cargo-target-janitor: parse_fallback_scan, queue_claims and queue_task_states raise raw shape errors, not SafetyError — a malformed scan/row kills the janitor with no refused record (the #6812 invisible-death mode, second door) #6844

Description

Summary

Evidence (verified this run, laptop @ origin/main 07ecb67)

Why it matters

Acceptance criteria

Activity

developing-today commented on Nov 7, 2026

dezren39 commented on Nov 7, 2026

dezren39 commented on Nov 8, 2026

20 remaining items

dezren39 commented on Nov 8, 2026

dezren39 commented on Nov 8, 2026

dezren39 commented on Nov 8, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Evidence (verified this run, laptop @ origin/main `07ecb67`)