deer-flow/backend/tests/test_runtime_keyed_lock.py
Shxiao 572744975d
fix(tools): run tool assembly off-loop at async entry points (#5224)
* fix(tools): run tool assembly off-loop at async entry points

get_available_tools() may block on MCP cache initialization while it is
called on async agent-assembly paths (task_tool, durable batch execution),
stalling the calling event loop for the full discovery duration.

Dispatch the (unchanged, synchronous) assembly call to a worker thread via
asyncio.to_thread at the two async entry points so the loop keeps processing
requests, SSE frames, cancellations, and timers.

Fixes #5172

* fix(tools): offload lead-agent assembly off-loop and pin with blocking-io anchors

Review follow-up for #5224:

- run_agent now dispatches agent_factory(...) through asyncio.to_thread, so
  lead-agent assembly (including both get_available_tools call sites in
  _assemble_lead_agent) runs off the event loop — the Gateway headline
  scenario from issue #5172.
- _ensure_sync_invocable_tool takes a double-checked threading.Lock, making
  the in-place tool.func wrap on the shared tool singletons explicitly
  single-shot now that assembly can run concurrently on worker threads.
- Add backend/tests/blocking_io/test_tool_assembly_offloop.py: blocking-probe
  anchors for task_tool and SubagentBatchService._execute_item under the
  strict Blockbuster gate, plus a meta-check proving the gate trips on the
  exact syscall class (ExtensionsConfig.from_file on the loop). Verified the
  anchor goes red when the offload is flattened back to a plain call.

* fix(gateway): build checkpoint state accessor off-loop; anchor run_agent offload

Review follow-up for #5224:

- Add abuild_checkpoint_state_accessor (asyncio.to_thread around the
  unchanged sync builder) and switch every async call site to it: the
  stateless_wait route, thread_runs, both threads call sites, and the
  build_thread_checkpoint_state_accessor boundary. The agent-factory
  assembly re-enters get_available_tools() and may block on MCP cache
  initialization; repeat calls hit _state_accessor_graph_cache and only
  pay the thread hop.
- Add a third blocking-io anchor driving the real run_agent with minimal
  RunManager/bridge stubs; the factory performs a real production blocking
  read (ExtensionsConfig.from_file()) and the test asserts assembly never
  runs on the main thread. Verified the anchor goes red when the run_agent
  offload is flattened back to a plain call.
- Adapt the test_threads_router checkpoint-builder patch sites to the new
  async name.

* refactor(tools): carry assembly offloads on a dedicated bounded pool

Review follow-up for #5224:

- Add utils/assembly_io.py: a dedicated ThreadPoolExecutor (default 8
  workers, DEER_FLOW_ASSEMBLY_WORKERS-overridable, mirroring
  utils/file_io.py and tools/sync.py) with run_assembly(), which copies
  contextvars explicitly. A hung stdio MCP server parks its worker for
  the full MCP timeout; carrying assembly hops on the loop's default
  executor would let a few parked assemblies queue every other
  to_thread/run_in_executor(None, ...) caller behind them.
- Switch all four offloads (run_agent, task_tool, batch _execute_item,
  abuild_checkpoint_state_accessor) to run_assembly().
- State the cold-path behavior in the accessor docstring: the graph
  cache validates factory identity, so non-identity-stable factories may
  duplicate lead-agent assembly across concurrent readers (MCP discovery
  stays process-wide single-flight); the pool bounds the duplicates.
- Add a fourth blocking-io anchor driving build_thread_checkpoint_state_
  accessor with a per-resolution fresh factory (always a cache miss) and
  the real production blocking read; enumerate all four offloads in the
  gate's module docstring. Verified the anchor goes red when
  abuild_checkpoint_state_accessor is flattened back to a plain call.

* fix(subagents): revalidate batch item before launch; make assembly pool observable

Review follow-up for #5224:

- _execute_item() revalidates the durable state right after assembly and
  before executor.execute_async(): renew_item_lease() returns valid=False
  when cancel_batch() terminalized the item or the lease was lost while
  assembly was parked, and the launch is skipped (the canceller already
  finalized the item). Previously the launch was unconditional and the
  poll loop's cancellation checks only started after execution began.
- Regression test driving the real SQLite repository: a blocking assembly
  probe parks _execute_item, cancel_batch() lands, and the launch is
  skipped with the item staying cancelled. Verified the test goes red
  when the revalidation is removed.
- run_assembly() tracks pending assemblies and logs a throttled WARNING
  once the pending count exceeds the worker count, so assembly starvation
  (workers parked on a hung MCP server) is distinguishable from idle.
- The run_agent blocking-io anchor now binds a sentinel extension
  snapshot via ctx.extensions and asserts the factory observed it through
  get_agent_build_extensions(), pinning run_assembly()'s ContextVar
  propagation. Verified red when ctx.run is dropped.
- Document the assembly pool in backend/AGENTS.md.

* fix(utils): decrement the assembly pending count on the pool thread

The pending-assembly counter behind the starvation warning decremented
from the asyncio future's done callback, which never fires once the
submitting loop is closed while its worker is still running: the count
ratcheted up permanently and eventually fired the starvation warning
with no starvation behind it (reproduced at 97dc9bec by review).

Decrement instead from the dispatched work item: run_assembly() wraps
func so a finally drops the count under the pending lock on the pool
thread, and the done callback is gone.

Pin the counter with tests/test_assembly_io.py: a healthy call returns
the count to zero, and an abandoned loop (stopped while the worker is
parked) does not wedge it — the abandoned case goes red against the old
done-callback decrement.

* docs(utils): fix the pending-counter comment after the decrement move

The comment still described the removed done-callback decrement,
contradicting _work()'s own comment; state the actual mechanism
(increment on the loop before dispatch, decrement from the dispatched
work item's finally on a pool thread).

* test(gateway): retarget checkpoint-accessor stubs to the services seam

thread_runs and runs now call abuild_checkpoint_state_accessor, so the
upstream wait-reader, regenerate-prepare, and idempotency tests must stub
the sync builder where abuild resolves it (app.gateway.services); stubbing
the removed router re-exports fails with AttributeError at setup. The
async seam semantics are unchanged: run_assembly invokes the stubbed
sync builder off-loop and propagates its return values and exceptions.

Move the agent/tool assembly off-load note from backend/AGENTS.md to
deerflow/utils/AGENTS.md (next to assembly_io.py) so the effective
instruction chain for agents/middlewares no longer grows past the AG002
hard limit.

* fix(runtime): serialize same-key accessor assembly and release queued-cancel slots

Address the three review follow-ups on the assembly off-load:

- assembly_io: a job cancelled while still queued never runs its work
  item, so the dispatched finally never fired and _pending_assemblies
  stayed elevated until a false starvation warning. Exactly-once cleanup
  now rides the concurrent future's cancelled() state — cancel() only
  succeeds before the executor starts the item, so cancelled() is true
  precisely when the finally will never run — plus a submit-failure
  release; the one-worker queued-cancellation case is pinned red/green.
- services: overlapping cold readers sharing one cache key could both
  run full agent assembly. _state_accessor_graph now serializes per key
  through a thread-side KeyedLockTable (pool threads, no running loop)
  and re-validates factory/app-config identity under the lock, so the
  factory runs exactly once while identity changes still rebuild. Cache
  dict access is lock-guarded now that construction runs off-loop.
- guidance inventory: register deerflow/utils/AGENTS.md in
  EXPECTED_GUIDANCE_PATHS so test_repository_has_the_approved_scoped_
  guidance_shape matches the relocated assembly note (CI shard 4).

* test(keyed-lock): pin KeyedLockTable reclamation and waiter bypass directly

Thread-side counterparts of the async table's own tests: overlapping
hold() calls serialize (a late arrival joins the live entry instead of
creating a second lock that bypasses a queued waiter), the last check-in
pops the entry, and many unique keys leave the registry empty. Both
regressions verified red — popping unconditionally trips the late-arrival
test, never reclaiming trips the many-keys test.

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-09-12 07:41:24 +08:00

303 lines
9.4 KiB
Python

from __future__ import annotations
import asyncio
import gc
import threading
import time
import weakref
from concurrent.futures import ThreadPoolExecutor
from uuid import uuid4
import pytest
from deerflow.runtime.goal import goal_thread_lock
from deerflow.runtime.runs.worker import _checkpoint_thread_lock
class _WeakThreadId(str):
pass
class _WeakKey:
pass
@pytest.mark.asyncio
@pytest.mark.parametrize(
"lock_factory",
[goal_thread_lock, _checkpoint_thread_lock],
ids=["goal", "checkpoint"],
)
async def test_runtime_thread_lock_releases_idle_thread_id(lock_factory) -> None:
thread_id = _WeakThreadId(f"retention-{uuid4().hex}")
thread_id_ref = weakref.ref(thread_id)
async with lock_factory(thread_id):
pass
del thread_id
gc.collect()
assert thread_id_ref() is None
@pytest.mark.asyncio
async def test_goal_and_checkpoint_lock_domains_remain_independent() -> None:
release_checkpoint = asyncio.Event()
checkpoint_entered = asyncio.Event()
goal_entered = asyncio.Event()
thread_id = f"independent-{uuid4().hex}"
async def hold_checkpoint() -> None:
async with _checkpoint_thread_lock(thread_id):
checkpoint_entered.set()
await release_checkpoint.wait()
async def hold_goal() -> None:
async with goal_thread_lock(thread_id):
goal_entered.set()
checkpoint_task = asyncio.create_task(hold_checkpoint())
await checkpoint_entered.wait()
goal_task = asyncio.create_task(hold_goal())
try:
await asyncio.wait_for(goal_entered.wait(), timeout=1)
finally:
release_checkpoint.set()
await checkpoint_task
await goal_task
@pytest.mark.asyncio
async def test_late_arrival_cannot_bypass_queued_waiter() -> None:
from deerflow.runtime.keyed_lock import AsyncKeyedLockTable
table = AsyncKeyedLockTable[str]()
release_first = asyncio.Event()
release_second = asyncio.Event()
first_entered = asyncio.Event()
second_started = asyncio.Event()
second_entered = asyncio.Event()
third_started = asyncio.Event()
third_entered = asyncio.Event()
active = 0
max_active = 0
order: list[str] = []
async def participant(
name: str,
started: asyncio.Event | None,
entered: asyncio.Event,
release: asyncio.Event | None,
) -> None:
nonlocal active, max_active
if started is not None:
started.set()
async with table.hold("thread"):
active += 1
max_active = max(max_active, active)
order.append(name)
entered.set()
try:
if release is not None:
await release.wait()
finally:
active -= 1
first = asyncio.create_task(participant("first", None, first_entered, release_first))
await first_entered.wait()
second = asyncio.create_task(participant("second", second_started, second_entered, release_second))
await second_started.wait()
release_first.set()
await second_entered.wait()
third = asyncio.create_task(participant("third", third_started, third_entered, None))
await third_started.wait()
assert not third_entered.is_set()
assert max_active == 1
release_second.set()
await asyncio.gather(first, second, third)
assert order == ["first", "second", "third"]
assert max_active == 1
@pytest.mark.asyncio
async def test_cancelled_waiter_releases_its_participation() -> None:
from deerflow.runtime.keyed_lock import AsyncKeyedLockTable
table = AsyncKeyedLockTable[_WeakKey]()
key = _WeakKey()
key_ref = weakref.ref(key)
release_holder = asyncio.Event()
holder_entered = asyncio.Event()
waiter_started = asyncio.Event()
async def holder(lock_key: _WeakKey) -> None:
async with table.hold(lock_key):
holder_entered.set()
await release_holder.wait()
async def waiter(lock_key: _WeakKey) -> None:
waiter_started.set()
async with table.hold(lock_key):
raise AssertionError("cancelled waiter entered the critical section")
holder_task = asyncio.create_task(holder(key))
await holder_entered.wait()
waiter_task = asyncio.create_task(waiter(key))
await waiter_started.wait()
waiter_task.cancel()
with pytest.raises(asyncio.CancelledError):
await waiter_task
release_holder.set()
await holder_task
del holder_task, waiter_task, key
gc.collect()
assert key_ref() is None
@pytest.mark.asyncio
async def test_many_unique_keys_are_reclaimed() -> None:
from deerflow.runtime.keyed_lock import AsyncKeyedLockTable
table = AsyncKeyedLockTable[_WeakKey]()
keys = [_WeakKey() for _ in range(1000)]
key_refs = [weakref.ref(key) for key in keys]
for key in keys:
async with table.hold(key):
pass
del key, keys
gc.collect()
assert all(key_ref() is None for key_ref in key_refs)
def test_same_key_is_independent_across_event_loops() -> None:
from deerflow.runtime.keyed_lock import AsyncKeyedLockTable
table = AsyncKeyedLockTable[str]()
barrier = threading.Barrier(2, timeout=2)
def run_loop() -> None:
async def run() -> None:
async with table.hold("thread"):
await asyncio.to_thread(barrier.wait)
asyncio.run(run())
with ThreadPoolExecutor(max_workers=2) as executor:
futures = [executor.submit(run_loop) for _ in range(2)]
for future in futures:
future.result(timeout=3)
def test_keyed_lock_table_late_arrival_cannot_bypass_queued_waiter() -> None:
"""Thread-side counterpart of the async table's late-arrival test.
Overlapping ``hold()`` calls on one key serialize the bodies, and a
queued waiter keeps the entry alive: an arrival that shows up while
waiters are still queued must join the live entry instead of creating
a second lock and entering concurrently (which is what an early
reclamation would allow).
"""
from deerflow.runtime.keyed_lock import KeyedLockTable
table = KeyedLockTable[str]()
release_first = threading.Event()
release_second = threading.Event()
release_third = threading.Event()
first_entered = threading.Event()
second_started = threading.Event()
second_entered = threading.Event()
third_started = threading.Event()
third_entered = threading.Event()
fourth_started = threading.Event()
fourth_entered = threading.Event()
guard = threading.Lock()
active = 0
max_active = 0
entered: list[str] = []
def participant(name: str, started: threading.Event | None, entered_event: threading.Event, release: threading.Event | None) -> None:
nonlocal active, max_active
if started is not None:
started.set()
with table.hold("key"):
with guard:
active += 1
max_active = max(max_active, active)
entered.append(name)
entered_event.set()
try:
if release is not None:
release.wait(timeout=10)
finally:
with guard:
active -= 1
first = threading.Thread(target=participant, args=("first", None, first_entered, release_first))
first.start()
assert first_entered.wait(timeout=5)
second = threading.Thread(target=participant, args=("second", second_started, second_entered, release_second))
second.start()
assert second_started.wait(timeout=5)
assert not second_entered.is_set(), "second must queue while the first still holds the entry"
third = threading.Thread(target=participant, args=("third", third_started, third_entered, release_third))
third.start()
assert third_started.wait(timeout=5)
time.sleep(0.05)
assert not third_entered.is_set(), "third must queue on the live entry, not enter"
# Hand the entry off: first leaves, exactly one queued waiter gets in
# and parks inside its body on its release event.
release_first.set()
first.join(timeout=10)
deadline = time.monotonic() + 5
while not (second_entered.is_set() or third_entered.is_set()) and time.monotonic() < deadline:
time.sleep(0.01)
assert second_entered.is_set() != third_entered.is_set(), "exactly one waiter holds the entry"
# A late arrival while a waiter is still queued must join the live
# entry (and therefore stay out until that waiter leaves), never enter
# through a freshly created second lock.
fourth = threading.Thread(target=participant, args=("fourth", fourth_started, fourth_entered, None))
fourth.start()
assert fourth_started.wait(timeout=5)
time.sleep(0.05)
assert not fourth_entered.is_set(), "late arrival bypassed a queued waiter"
release_second.set()
release_third.set()
for thread in (second, third, fourth):
thread.join(timeout=10)
assert not thread.is_alive()
assert max_active == 1
assert len(entered) == 4 and set(entered) == {"first", "second", "third", "fourth"}
assert table._entries == {}, "the last check-in must pop the entry"
def test_keyed_lock_table_many_unique_keys_are_reclaimed() -> None:
from deerflow.runtime.keyed_lock import KeyedLockTable
table = KeyedLockTable[int]()
for key in range(1000):
with table.hold(key):
assert len(table._entries) == 1
assert key not in table._entries
assert table._entries == {}