Preflight Linux local-run mount namespace mismatches

[devin-ai-integration]

Summary

Awaiting human design review; not ready to merge. Assigned to Myles Anderson based on the closest local-run/sandbox history, with awaiting review and do not merge labels. Fresh origin/main is an ancestor of this branch; there are no merge conflicts.

Design decision needed. The independent scope review returned no: this history-based guard cannot protect a new/legacy project with no namespace reference. Inspection found no existing configured authoritative local mount environment. Completing OR-552 requires choosing explicit known-good environment registration or a centralized local launch owner; neither policy is being selected silently. Post-fix functionality verification is deferred until that decision and passing review gates.

• For OR-552, record boot-scoped Linux mount namespace identity on local runs and reject a different namespace for the same project and unchanged command when an active or successful run establishes the execution environment.
• Check before snapshot/reservation, then recheck inside an immediate SQLite transaction to prevent concurrent submissions from bypassing the guard. Reuse the existing backend descriptor; no database migration, dependency, privileged namespace switching, or remote/non-Linux execution change.
• Ignore failed/cancelled runs, legacy records without metadata, other commands/backends/projects, and earlier boots. Document the limits: no first-launch dependency validation or detection of mount changes within one namespace.

Test plan

• Clean tracked main 6285fee7f42bc8ad21500b84278d38679f1ac01b: controlled reproduction through real standalone Claude sessions and the real CLI on Ubuntu 22.04.5 x86_64; subscription CLI preflight and live dashboard reply passed.
• Namespace regression matrix and concurrent-reservation regression with two store connections, different experiments, identical project/command, and different namespaces: exactly one reservation succeeds, with no rejected run or telemetry row.
• cargo fmt --all --check; cargo clippy --locked --all-targets -- -D warnings; localization/style checks.
• Full Rust suite on b7e5fe692627b154bf5977232bf00f255c82c26c, serial with test-only isolation from global Git configuration and injected author/committer environment. The initial ambient run had unrelated Git-fixture failures and a transient SSH test failure; no unrelated code was changed.
• CI on the latest commit: 7 passed, 0 failed, 0 pending; 9 conditional jobs skipped.
• Full-scope review yes (first review: no, missing independent namespace authority).
• Greptile 5/5 with no findings (initial: 4/5; concurrent-reservation finding addressed in b7e5fe69).
• Rebuild PR branch and record real-agent post-fix functionality on Linux after passing code-review gates.

Bug reproduction on main

Both sessions submitted the same experiment and fixed source /mnt/profile && printf "SOURCE_OK\n" command; one namespace lacked the path and created a failed run, while the other privately bind-mounted the genuine /etc at /mnt and completed. This is a controlled analogue on orx 0.2.19, not the original redacted 0.2.18 Conda/GPU environment. Dashboard-forwarded namespace behavior and automatic repair-attempt accounting were not reproduced.

Post-fix functionality

Not yet performed: the scope gate has not passed. No claim of a verified fix or authorization to merge.

Automation improvements

• The VM's injected Git identity and global URL rewrites broke unrelated Git-fixture tests; run local Rust fixture tests with test-only Git isolation and serial execution to avoid misleading failures.

Link to Devin session: https://app.devin.ai/sessions/da2c1d26fcc640b5b0702978da15126b
Open in Devin Desktop: https://app.devin.ai/desktop/session/da2c1d26fcc640b5b0702978da15126b?variant=devin

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Confidence Score: 4/5

[Medium impact] Adds mount namespace preflight checks for local job runs.

The PR appears safe to merge, with a non-blocking request to test concurrent reservations.

Findings

1.  Concurrent reservations lack test coverage ▶

Fix with agent prompt

### Issue 1
src/local/localrun.rs:244
The new tests call `check_mount_namespace` directly, so they never exercise the second check inside `reserve_run`. That check prevents submissions from different experiments from racing past the first check. A regression there could pass every new test.

Add a test with two store connections, the same project and command, different experiments, and different namespace values. Assert that only one reservation succeeds and that the rejected reservation leaves no run or telemetry row.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Records Linux mount namespace identity for local runs and rejects a different namespace for the same project and unchanged command.

• Linux local runs stop same-command launches from another namespace this boot.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Submit run] --> B[Read local Linux namespace]
    B --> C[Check matching run history]
    C -->|Mismatch| X[Reject without creating a run]
    C -->|Allowed| D[Check backend and stage source]
    D --> E[Begin immediate transaction]
    E --> F[Check namespace again]
    F -->|Mismatch| X
    F -->|Allowed| G[Reserve telemetry and run]
    G --> H[Commit]
    H --> I[Launch job and save handle]

Loading

_{Reviews (1) · Last reviewed commit: "Preflight local runs against Linux mount..." · Reviewed by Greptile}