[PHP] fix: keep host/browser runtime and SharedFS state coherent#757
Merged
Conversation
Phase B-1 matrix build status —
|
| Package | Arch | Status | Sha |
|---|---|---|---|
| libcurl | wasm32 | built | 05131d85 |
| libcxx | wasm32 | built | 8da1dda5 |
| libcxx | wasm64 | built | 3f9d7318 |
| libiconv | wasm32 | built | 98ae39cc |
| libiconv | wasm64 | built | 364f191d |
| libpng | wasm32 | built | 57911579 |
| libxml2 | wasm32 | built | c9190593 |
| libxml2 | wasm64 | built | 29606a80 |
| openssl | wasm32 | built | b830c422 |
| openssl | wasm64 | built | 0ad8e76e |
| sqlite | wasm32 | built | 22892317 |
| sqlite | wasm64 | built | a488b172 |
| zlib | wasm32 | built | 6258205e |
| zlib | wasm64 | built | 10905a61 |
| bc | wasm32 | built | f45b6fc6 |
| bzip2 | wasm32 | built | ccaed6f7 |
| coreutils | wasm32 | built | 9c2f9610 |
| curl | wasm32 | built | 2a9910ba |
| dash | wasm32 | built | dad4f1d0 |
| diffutils | wasm32 | built | 243e8f6c |
| dinit | wasm32 | built | 8692ce28 |
| fbdoom | wasm32 | built | 4de08e20 |
| file | wasm32 | built | 37c5ed26 |
| findutils | wasm32 | built | abaccfbd |
| gawk | wasm32 | built | 5870aeeb |
| git | wasm32 | built | 3a505148 |
| grep | wasm32 | built | 873a4b9d |
| gzip | wasm32 | built | bbf648b6 |
| kandelo-sdk | wasm32 | built | 6054195f |
| kernel | wasm32 | failed | — |
| less | wasm32 | built | cff77508 |
| lsof | wasm32 | built | b2808d0b |
| m4 | wasm32 | built | eeecbe81 |
| make | wasm32 | built | 73a97016 |
| mariadb | wasm32 | built | d51494dd |
| mariadb | wasm64 | built | 019f4e3b |
| modeset | wasm32 | built | 26449a18 |
| msmtpd | wasm32 | built | 8d5e57c3 |
| nano | wasm32 | built | e11bb2fe |
| ncurses | wasm32 | built | 077d7b78 |
| netcat | wasm32 | built | 81674bbc |
| nginx | wasm32 | built | a39e497d |
| php | wasm32 | built | 5a58aac5 |
| posix-utils-lite | wasm32 | built | b6e3e07f |
| sed | wasm32 | built | 2dbe649f |
| spidermonkey | wasm32 | built | 022c3dd5 |
| tar | wasm32 | built | 79facabd |
| tcl | wasm32 | built | 950a960f |
| unzip | wasm32 | built | 87cc1e61 |
| userspace | wasm32 | built | 3ca5b0d1 |
| vim | wasm32 | built | 0d676ada |
| wget | wasm32 | built | de9df728 |
| xz | wasm32 | built | 52fe1260 |
| zip | wasm32 | built | a4a53388 |
| zstd | wasm32 | built | 346b97c8 |
| bash | wasm32 | built | 9d94677c |
| mariadb-test | wasm32 | built | 00b542dd |
| mariadb-vfs | wasm32 | built | 83005b2b |
| mariadb-vfs | wasm64 | built | a79c1b0d |
| nethack | wasm32 | built | 799bbd26 |
| node | wasm32 | built | d57f5d71 |
| spidermonkey-node | wasm32 | built | fbcde318 |
| vim-browser-bundle | wasm32 | built | 22e962ba |
| nethack-browser-bundle | wasm32 | built | a1711c12 |
| rootfs | wasm32 | built | c314bfde |
| shell | wasm32 | built | 6ddcec14 |
| node-vfs | wasm32 | built | 685a8cbd |
Auto-generated; replaced on each push. Raw data in the publish-status workflow artifact.
This was referenced Jul 10, 2026
(cherry picked from commit d746770)
(cherry picked from commit 6f9ccbc)
(cherry picked from commit 4956be4)
Propagate mount ownership and native metadata through Node worker setup, preserve host-backed filesystem semantics, and apply the configured process-worker stack policy.
Validate hostnames before synthetic browser resolution, reserve the .invalid namespace for failures, and keep localhost aliases available without claiming general DNS reachability.
(cherry picked from commit 38a0e78)
Preserve MSG_PEEK across browser networking backends and carry CORS proxy configuration through the browser worker protocol without consuming queued data.
Implement POSIX O_CREAT|O_EXCL handling in SharedFS so open fails with EEXIST when the final pathname already exists, including a final symlink.
(cherry picked from commit 20fae8b)
Track directory entries and allocation hints explicitly for large PHP test directories. This commit makes no performance claim; performance was not measured.
(cherry picked from commit 3c68749)
(cherry picked from commit 0449eb9)
(cherry picked from commit f0a021a)
(cherry picked from commit f92b00d)
(cherry picked from commit 374ff84)
Carry the cooperative VM interrupt hook into browser process workers so kernel-requested deadlines can interrupt CPU-bound guest execution.
Validate supported clock and timer IDs, carry runtime hooks through Node and browser process launches, keep host time conversion bounded, and preserve PHP runner filesystem expectations.
Resolve host-backed paths component by component, preserve virtual ownership and native timestamp identity, and keep mount operations inside their configured root. Validate the larger Node worker stack policy with real recursive Wasm workers.
Validate exec and spawn modules before committing process state, share process longjmp tags with side modules, keep network and interface behavior host-parallel, validate CPU clock encodings, enforce generation-safe VM deadlines, and route host failures outside guest stderr.
Serialize namespace mutations, bound sparse growth, preserve partial-write and ENOSPC state, snapshot only quiescent filesystem data, bind deferred backing to inode generations and data sequences, and preserve hard-link identity during rebases. Performance was not measured.
Use the canonical services database and dinit image helpers when deriving browser VFS artifacts, align WordPress and LAMP on PHP 8.3.15, and invalidate every serialized image whose inputs changed.
Keep the soft-plus-hard deadline for unresponsive Wasm execution, but reset shutdown callbacks to a new soft timeout so ordinary PHP cleanup remains bounded without being killed immediately.
GNU netcat treats reset-style SO_LINGER as an optimization. Kandelo truthfully rejects that mode until every transport can model it, so the wasm package retains ordinary FIN close semantics instead. Make source builds resolver-safe at the same time: activate the worktree SDK, verify resolver-provided source identity, keep scratch state under the resolver work directory, and install resolver builds only into their declared output directory.
Map CLOCK_REALTIME_COARSE and CLOCK_MONOTONIC_COARSE to Kandelo's corresponding host clock domains. The hosts do not expose distinct coarse sources, but returning EINVAL causes libc consumers such as MariaDB to retry before startup. Cover clock_gettime and clock_getres and document the fallback.
Each timeout flag byte is written with an atomic store; the pair is not one atomic transaction.
brandonpayton
force-pushed
the
gascity/kd-6nz/kd-lnp-pr717-host-runtime-browser-split
branch
from
62a5771 to
bb5a0b1
Compare
brandonpayton
changed the title
brandonpayton
changed the base branch from
integration/kd-6nz-php-phpt-fork-process-shm-base
to
integration/kd-6nz-php-phpt-platform-fixes
brandonpayton
deleted the
gascity/kd-6nz/kd-lnp-pr717-host-runtime-browser-split
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Browser PHPT workloads exposed platform-contract failures at the shared
filesystem, process-worker, networking, clock, and package-image boundaries.
This change repairs those boundaries in Kandelo's normal runtime path for both
Node.js and browsers; it does not weaken PHPT expectations or synthesize
application success.
What changed
lazy-file/archive identity, hard links, rebasing, and quiescent image
persistence coherent across workers. Preserve POSIX
O_EXCL, unlink,rename, timestamp, directory-read, and append behavior.
root; preserve virtual ownership and native timestamp identity; carry mount
and worker-resource policy into process workers.
exec/spawn Wasm, share process longjmp tags with side modules, route host
diagnostics separately from guest stderr, and use generation-safe
kernel-worker timers for cooperative VM interruption.
MSG_PEEK, synthetic DNS validation, CORS proxyrouting), virtual interface naming, and supported clock/timer behavior
across hosts.
instrumentation.
/etc/servicesauthoritative in rootfs-derived images, alignWordPress/LAMP on PHP 8.3.15, give PHP shutdown callbacks a fresh bounded
soft-timeout phase, and invalidate changed package/VFS revisions.
abortive
SO_LINGERuntil every transport can model reset-style close.Its build now honors resolver source identity, verifies SHA-256, activates
the worktree SDK, rejects non-wasm32 targets, applies patches idempotently,
and installs resolver builds only into their declared output directory.
documentation for supported behavior and remaining boundaries.
Review changes
The reviewed branch starts at exact Batch-2 tip
23e70c569. It carries 20source-derived commits plus nine review commits, without duplicating stronger
#756/#859 dylink and poll-deadline work.
Review removed false artifact and performance claims and repaired in-place
instrumentation permissions, Node mount/resource behavior, Node/browser
runtime parity and diagnostics, SharedFS persistence races, canonical rootfs
inputs, PHP shutdown timing, the netcat package boundary, and Linux coarse
clock handling. Performance was not measured and no performance claim is made.
The first canonical
./run.sh browserattempt exposed a real reviewregression: LAMP preinstall timed out before
/data/wordpress, with noMariaDB bootstrap/error log. A controlled comparison traced the spin to
#757 rejecting Linux
CLOCK_REALTIME_COARSEandCLOCK_MONOTONIC_COARSErequests. The repair maps those IDs to Kandelo'scorresponding realtime/monotonic host domains, adds kernel coverage, and
documents the approximation.
Validation
Validation on the final reviewed tree:
cargo test -p kandelo --target aarch64-apple-darwin --lib:1,071 passed.
failures; 19 skipped.
scripts/run-libc-tests.sh: 302 passed, 20 expected failures,1 flake-pass, and 1 unexpected failure:
regression/raise-raceexited 3.bash scripts/check-abi-version.sh: synchronized and passed. This isstructural evidence, not semantic ABI clearance.
./run.sh browser: all 66/66 resolver assets wereavailable, with no source rebuilds or fallback artifacts; LAMP and
WordPress final checks passed; preparation reached Vite in 3m23s.
Readyin 1.004s; PHP 8.3.15 exited 0with correct output; console, page, request, and HTTP-error collections
were empty.
The full PHP PHPT suite, POSIX suite, Sortix suite, final aggregate gate, and
performance benchmarks were not run for this constituent.
ABI and landing boundary
This constituent remains at ABI 16 and is not standalone- or main-ready. The
new PHP host import, existing Batch-2 kernel/host semantic changes, and the
fork-buffer repair required for
raise-racebelong in the single aggregateABI 16->17 reconciliation.
The
raise-racecase also fails on exact #871 tip; #757 did not introduce it.Existing repair
e8fa12447makes the focused case pass but changes thefork-buffer meaning, so it must not ship under ABI 16.
Before #871 can merge to
main, Batch 2 must incorporate that repair,regenerate
abi/snapshot.jsonand generated C/TypeScript bindings, raise thePHP package ABI floor, rebuild ABI-bound packages/VFS images/indexes, and run
the full aggregate gate.
Review view
Accept into quarantined Batch 2. Do not merge this PR independently to
main,and do not treat its structural ABI check or constituent browser evidence as
aggregate merge clearance.