PR 029 P2: Capture settlement Promise then

[LogicDuke]

Purpose

Stacked validation PR for:

AUDIT-PR029-UNCAPTURED-PROMISE-THEN-DEFEATS-SETTLEMENT

This PR is intentionally narrow and quarantined.

It targets protected parent PR #29:

repair/pr025-normalization-release-order

It does NOT target main.

It does NOT directly target PR #25.

It does NOT directly target protected PR #10.

Finding

Classification:

CURRENT P2

Ownership:

Inherited

At exact protected parent HEAD:

7a99af69ba7e4eeb22ec729de40c18a578ac4bb3

settlement-critical process transport paths invoked .then(...) through an ordinary mutable property lookup.

Hostile code reachable before those settlement registrations could replace:

Promise.prototype.then

A swallowing hook could prevent caller settlement indefinitely.

A throwing hook could replace the intended caller-visible terminal reason.

On the Windows helper-reap path, the same defect could also leave a discarded rejection and unhandled-rejection evidence.

The defect reproduced identically against the parent lineage and was not introduced by PR #29.

Repair

The bounded repair:

• captures Promise.prototype.then at module evaluation;
• invokes the captured intrinsic through the already-captured Reflect.apply;
• removes the mutable .then lookup from both proven settlement-critical sites;
• guards synchronous Promise constructor / @@species prologue failure at those same sites;
• preserves the intended hardening failure on the main process path;
• preserves bounded TIMED_OUT / DIRECT_CHILD_ONLY behavior on the Windows helper path;
• preserves exactly-once caller settlement;
• preserves mandatory child release;
• preserves no-abandonment behavior;
• preserves Error identity and exact cause handling;
• preserves the prior Symbol.hasInstance hardening repair;
• preserves global Error poisoning defenses;
• introduces no new process authority;
• leaves process transport dormant/unwired;
• preserves AgentBridge V1 managed-repository READ-ONLY authority.

Changed files exactly:

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

Exact quarantine identity

Protected parent PR #29 HEAD:

7a99af69ba7e4eeb22ec729de40c18a578ac4bb3

Repair commit:

556d642da1465e9510b8f94a9729ac917da2faf7

Validated patch SHA-256:

4692AF8D661ADD0706739D053B711D174A548D5A65FF6033B6D65B3BA85BE939

Patch bytes:

28709

Changed files exactly:

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

The committed patch was mechanically verified byte-for-byte identical to the candidate that passed fresh independent validation.

Independent validation

Fresh independent validation:

PASS

The validator independently:

• reproduced the original mutable-then defect against exact pristine parent HEAD;
• reproduced the caller-pending failure;
• reproduced hostile terminal-reason replacement;
• reproduced the helper-reap stall and unhandled-rejection consequence;
• verified hostile .then hooks are genuinely installable and reachable;
• verified the repaired transport does not consult those hooks;
• verified caller settlement is restored;
• verified intended terminal causes remain stable;
• verified release still occurs;
• verified the child is not abandoned;
• verified no unhandled rejection remains;
• independently reproduced the Promise constructor / @@species pre-registration hazard;
• proved the new local try/catch is load-bearing for that hazard;
• classified the species/constructor hazard as FIXED in the candidate;
• verified there are no additional settlement-critical .then sites;
• verified prior process-transport hardening invariants;
• found zero new CURRENT P0/P1/P2/P3 candidate defects;
• reverified the final patch fingerprint byte-for-byte.

Validation evidence

Focused adversarial tests:

4 passed

Complete process transport:

150 passed, 9 skipped

Full suite:

1185 passed, 9 skipped

Typecheck:

PASS

Lint:

PASS

Build:

PASS

git diff --check:

PASS

Validation host:

Windows.

The 9 skipped tests are POSIX-gated tests.

No Windows result is claimed as proof of POSIX runtime behavior.

Out-of-scope inherited tracks

This PR does NOT repair:

AUDIT-PR025-ABSORBER-LOST-ON-PARTIAL-LISTENER-CLEAR

This PR does NOT repair:

AUDIT-PR026-TEMPDIR-SILENT-LEAK

Any broader inherited Promise/await/species behavior not required to close this exact finding also remains outside this repair.

Those tracks must remain independently quarantined and reverified before repair.

Protected invariants

This repair preserves:

• exactly-once caller settlement;
• bounded child-release attempt;
• intended terminal-cause precedence;
• no SPAWN_FAILED laundering;
• no AgentExchange laundering;
• no discarded rejected Promise;
• Error identity;
• exact cause retention;
• existing termination semantics;
• existing timeout/cancellation semantics;
• raw output behavior;
• output bounds;
• environment isolation;
• cwd/stdin behavior;
• shell:false;
• no PID/PGID authority expansion;
• dormant/unwired process transport;
• frozen AgentBridge architecture;
• AgentBridge V1 managed-repository READ-ONLY authority.

Quarantine rule

This DRAFT PR is evidence/proposal only.

Do not merge it because implementation, independent validation, CI, CodeRabbit, or Codex reports success.

Required before upward integration into PR #29:

• exact-head CI;
• independent GitHub review evidence;
• classification of every new finding against exact CURRENT HEAD;
• policy/evidence gate PASS;
• Ready transition only after those gates;
• POST-READY review/check observation;
• human merge authority;
• CREATE A MERGE COMMIT upward into PR PR 025 P2: Release child before hardening error normalization #29;
• establish PR PR 025 P2: Release child before hardening error normalization #29 NEW HEAD;
• fresh exact-head PR PR 025 P2: Release child before hardening error normalization #29 audit.

Summary by CodeRabbit

• Bug Fixes
  • Improved process exchange reliability when applications override or interfere with native Promise behavior.
  • Prevented exchanges and Windows process cleanup operations from remaining pending unexpectedly.
  • Preserved required errors and rejection details while ensuring failed operations settle correctly.
  • Improved cleanup reliability, including child-process handling and prevention of unhandled promise rejections.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: da642cc1-4c9c-478c-a248-d3143f795a67

📥 Commits

Reviewing files that changed from the base of the PR and between 7a99af6 and 556d642.

📒 Files selected for processing (2)

• src/adapters/process-transport.ts
• tests/adapters/process-transport.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The process transport now captures the intrinsic Promise.prototype.then and uses guarded settlement paths for process reaping and release handling. Adversarial tests cover swallowing and throwing substitutions, bounded completion, error identity, cleanup, scheduler restoration, and unhandled rejections.

Changes

Promise settlement hardening

Layer / File(s)	Summary
Intrinsic settlement paths src/adapters/process-transport.ts	The transport captures Promise.prototype.then. Reaping failures resolve false, while release failures reject with the required hardening error.
Exchange adversarial settlement tests tests/adapters/process-transport.test.ts	Exchange probes cover hostile then implementations, bounded completion, rejection identity, child cleanup, scheduler restoration, and unhandled-rejection tracking.
Windows helper settlement tests tests/adapters/process-transport.test.ts	Windows tree-kill tests cover swallowed and thrown continuations without pending helper settlement or scheduler leaks.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 556d6

This is a localized settlement-hardening change with passing validation and no actionable merge-blocking correctness or production risk remaining at the current head.

Sequence Diagram(s)

sequenceDiagram
  participant ProcessTransport
  participant CapturedThen
  participant ChildProcess
  participant ReleasePromise
  ProcessTransport->>CapturedThen: attach reaping and release handlers
  CapturedThen->>ChildProcess: observe process settlement
  ChildProcess-->>ProcessTransport: report reaping result
  CapturedThen->>ReleasePromise: observe release settlement
  ReleasePromise-->>ProcessTransport: resolve or reject
  CapturedThen-->>ProcessTransport: throw during setup
  ProcessTransport->>ProcessTransport: apply explicit fallback outcome

Loading

Poem

I’m a rabbit with a promise to keep,
No hostile then can make flows sleep.
Reap or release, the paths now end,
Errors stay true, and children mend.
Tests watch the scheduler hop—
No dangling work, no failures lost.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: capturing the settlement Promise.then intrinsic in process transport.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch repair/pr029-captured-promise-then

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[LogicDuke]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[LogicDuke]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 556d642da1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".