From 5fda8df551f49ccc406cc0a09478e7bab50f59ac Mon Sep 17 00:00:00 2001 From: Dotta Date: Sat, 12 Sep 2026 22:37:59 -0500 Subject: [PATCH] docs(runner): explain remote signal failure handling Co-Authored-By: Paperclip --- doc/execution-semantics.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/execution-semantics.md b/doc/execution-semantics.md index 3846253c80..bb5c14a503 100644 --- a/doc/execution-semantics.md +++ b/doc/execution-semantics.md @@ -1222,3 +1222,8 @@ Local and remote runners use the same attachment publication contract. Remote files are read through the bound environment runner, with workspace confinement, no symlinks or hardlinks, stable file identity, a 10 MiB bound, and exact size and SHA-256 checks before storage. Remote paths are never opened on the controller. + +An asynchronous remote signal failure, including a sandbox already removed by +the operator, must not crash the controller. Logging that failure must also be +contained. A rejected signal does not prove termination: existing process and +provider monitoring still own stop acknowledgement and cleanup proof.