feat(exec): enroll SUITE_LOADER — the hosted api.qa/vitest@1 runner goes live - #8
Conversation
…oes live
The account (b6641681fe423910342b9ffa1364c76d) accepted the beta
`worker_loaders` key today for the apis-vin exec rail; this flips api.qa's
documented-but-disabled A.8.6 provisioning to ENABLED, the same
same-worker-loopback shape:
- wrangler.jsonc: "worker_loaders" SUITE_LOADER + "services"
SUITE_OUTBOUND -> api-qa#SuiteGateway. main moves to src/entry.ts.
- src/exec/gateway.ts (new): SuiteGateway WorkerEntrypoint — a thin mount
over the unit-tested createOutboundGateway, with a MODULE-LEVEL sink so
per-invocation entrypoint instances share one out-of-band violation
record; fetch carries the floor, drainViolations the fail-closed drain.
- src/entry.ts (new): the wrangler entry. Re-exports the default handler +
both DO classes + SuiteGateway; the `cloudflare:workers` import lives one
file above everything vitest resolves (the apis-vin entry-only trick),
typed by a local ambient d.ts (no @cloudflare/workers-types).
- GET /health?exec=1: the measured runner-availability probe — runs the
fixed server-owned one-test suite through the same execRunner a
verification uses, TTL-memoized per binding signature to bound
unauthenticated isolate spins. Plain /health is byte-unchanged.
- test/suite-loader-enrollment.test.ts: pins the enrolled config, the
entry split (cloudflare:workers stays out of the vitest graph), the
RPC-shaped async drain failing closed, and the probe's three states.
Rollback: the code still feature-detects env.SUITE_LOADER, so reverting
wrangler.jsonc to the flag-held shape is the whole rollback — absent
bindings degrade to the typed runner-unavailable, never a crash.
Verified: 1248 tests green, tsc clean, wrangler dry-run validates both
bindings, and a local workerd run answers /health?exec=1 with
{ available: true, status: "ran" } from a real loader isolate.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 247c5bedf7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| /** The isolate-global gateway instance — the one record both halves share. */ | ||
| const gateway: OutboundGatewayLike = createOutboundGateway() |
There was a problem hiding this comment.
When hosted suites run concurrently in the same Worker isolate, this module-global gateway lets one run drain another run's record: if run A records a refusal and run B calls drainViolations() first, the underlying splice() clears A's violation, causing B to fail while A's later drain is empty. A hostile A that suppresses the in-isolate marker channel—the scenario this out-of-band record is intended to defend—can therefore pass despite forbidden egress. Correlate violations with individual runs or serialize the fetch/drain lifecycle rather than sharing one destructive sink.
Useful? React with 👍 / 👎.
| const hit = execProbeMemo.get(key) | ||
| if (hit && atMs - hit.probedAtMs < EXEC_PROBE_TTL_MS) return { ...hit, cached: true } | ||
| const outcome = await execRunner.run({ |
There was a problem hiding this comment.
When several unauthenticated /health?exec=1 requests arrive after this memo is cold or expired, every request observes the miss before any reaches execProbeMemo.set() and therefore starts its own metered Worker Loader run. A burst can consequently create an unbounded number of billed isolate executions every five minutes per Worker isolate, defeating the stated abuse bound. Cache the in-flight promise before awaiting the runner so concurrent callers share one probe.
Useful? React with 👍 / 👎.
1 participant
What
Flips the A.8.6 hosted-runner provisioning from documented-but-disabled to ENABLED, now that account
b6641681fe423910342b9ffa1364c76daccepted the betaworker_loaderskey (today, for the apis-vin exec rail — the precedent this copies: same account, same same-worker-loopback outbound shape)."worker_loaders": [{"binding":"SUITE_LOADER"}]+"services": [{"binding":"SUITE_OUTBOUND","service":"api-qa","entrypoint":"SuiteGateway"}];mainmoves tosrc/entry.ts.SuiteGatewayWorkerEntrypoint: a thin mount over the already-unit-testedcreateOutboundGateway. Module-level sink on purpose (fresh entrypoint instance per invocation; the loopback binding serves in-isolate, so both halves — the floorfetchand the fail-closeddrainViolationsRPC — see one record).main), andSuiteGateway. Thecloudflare:workersimport lives only here-below, out of the vitest graph (the apis-vin entry-only trick); typed by a local ambient d.ts, keeping the no-@cloudflare/workers-types stance.execRunnera verification uses and reports{ runner, available, status, reason?, cached }. TTL-memoized (5 min) per binding signature to bound unauthenticated metered isolate spins. Plain/healthis byte-unchanged (its declared contract stays graded).Rollback
The code still feature-detects
env.SUITE_LOADER: reverting wrangler.jsonc to the flag-held shape is the whole rollback — absent bindings degrade to the typedrunner-unavailable, never a crash. Deploy-level rollback per repo convention: revert the merge, ornpx wrangler rollback(previous good deploy tagged66e52fa main (github-actions)).Verified
tsc --noEmitand build cleanwrangler deploy --dry-run:env.SUITE_LOADER (Worker Loader)+env.SUITE_OUTBOUND (api-qa#SuiteGateway)both validatewrangler dev):GET /health?exec=1→{ available: true, status: "ran", cached: false }from a real loader isolate; repeat →cached: true; plain/healthunchanged🤖 Generated with Claude Code