🤖 Codex PR Review

✅ Merge allowed: 1 finding(s) reported but none are blocking

ℹ️ Other Findings

1. 🟡 [MEDIUM] Reliability in application/runtime_deadline.py

recycle_current_process_after_response() does not actually wait for the worker to become unavailable before killing it; it just sleeps for one second and then sends SIGTERM to the current PID. On the current /dry-run timeout path introduced by this PR, the handler returns 503 first and only then schedules this delayed kill, so the same Gunicorn worker can accept a new /probe, /monitor-dispatch, or user request during that 1-second window and have it torn down mid-flight when the background thread fires. (line 62)

Suggestion: Recycle the worker through a post-response mechanism that stops it from taking new work first (for example a Gunicorn/worker-exit hook or immediate process exit after the response is flushed), instead of using a delayed daemon thread that sends SIGTERM to a still-accepting worker.

Review by Codex PR Review bot • PR

Addressed both reliability findings in 8c848f3: the deadline now wraps the full /dry-run lifecycle, uses a BaseException sentinel so strategy/broker except Exception handlers cannot swallow it, skips potentially blocking persistence after interruption, emits a minimal structured timeout event, and schedules SIGTERM so Gunicorn replaces the interrupted worker. The same bounded path is used for in-process host prechecks. Focused regression suite: 31 passed; full Ruff and deployment workflow contract checks pass.

Addressed the second-round findings in 8146bac. Nested in-process prechecks now only return worker_recycle_required; /monitor-dispatch waits for remote aggregation, logs the combined result, and only then schedules worker recycle. Direct /dry-run still schedules recycle at its own response boundary. Timeout reports are finalized and persisted under a separate 5-second grace deadline before the interrupted worker is retired. Added regressions for deferred nested recycle and exactly-once timeout report persistence; focused suite is now 33 passed.

Addressed the third-round findings in 155aef4. Strategy/plugin processing keeps its 105-second deadline, while report persistence now runs afterward under an independent 5-second grace deadline; persistence timeout is logged but cannot flip a completed strategy response. Timeout reports use the same bounded persistence helper. Monitor target parsing now rejects any non-object array element with its index instead of silently dropping it. Focused suite: 35 passed; Ruff and workflow contract checks pass.