Publish curated Unraid-AppOps-Gateway source from af7a7bd69966cb9939bf331cab169e2ec61e8f26

backend/tests/test_runner_resource_envelope.py

@@ -1921,7 +1921,8 @@ def test_attestor_rejects_unowned_descendants_below_dind():
     assert result["reason"] == "resource_cgroup_unmapped_descendant"
 
 
-def test_build_probe_attestor_binds_exact_cid_nested_pid_and_build_cgroup(monkeypatch):
+@pytest.mark.parametrize("race_count", [0, 1, 2, 3])
+def test_build_probe_attestor_binds_exact_cid_nested_pid_and_build_cgroup(monkeypatch, race_count):
     envelope = _module()
     snapshot = _snapshot()
     family_path = str(snapshot["family"]["path"])
@@ -1949,10 +1950,28 @@ def test_build_probe_attestor_binds_exact_cid_nested_pid_and_build_cgroup(monkey
         "cpuMilli": 4000,
         "memoryBytes": 6 * 1024**3,
     }]
-    monkeypatch.setattr(envelope, "_collect_snapshot", lambda _expected: snapshot)
+    attempts = []
+    waits = []
+
+    def collect(_expected):
+        attempts.append(True)
+        if len(attempts) <= race_count:
+            raise RuntimeError("resource_cgroup_process_mapping_invalid")
+        return snapshot
+
+    monkeypatch.setattr(envelope, "_collect_snapshot", collect)
+    monkeypatch.setattr(envelope.time, "sleep", waits.append)
 
     result = envelope.attest_build_probe_workload(probe_id, 77)
 
+    assert len(attempts) == min(race_count + 1, 3)
+    assert waits == [0.1] * min(race_count, 2)
+    if race_count == 3:
+        assert result["ready"] is False
+        assert result["reason"] == "resource_cgroup_process_mapping_invalid"
+        assert "probeWorkload" not in result
+        return
+
     assert result["ready"] is True, result
     assert result["runningRunnerContainers"] == 0
     assert result["probeWorkload"] == {
@@ -1967,6 +1986,25 @@ def test_build_probe_attestor_binds_exact_cid_nested_pid_and_build_cgroup(monkey
     assert envelope.attest_build_probe_workload(probe_id, 78)["ready"] is False
 
 
+@pytest.mark.parametrize("reason", [
+    "resource_cgroup_probe_namespace_invalid", "resource_cgroup_probe_identity_invalid",
+    "resource_cgroup_probe_lock_busy", "resource_cgroup_workload_unmapped",
+])
+def test_build_probe_attestor_does_not_retry_other_resource_refusals(monkeypatch, reason):
+    envelope = _module()
+    attempts = []
+
+    def collect(_expected):
+        attempts.append(True)
+        raise RuntimeError(reason)
+
+    monkeypatch.setattr(envelope, "_collect_snapshot", collect)
+    monkeypatch.setattr(envelope.time, "sleep", lambda _seconds: pytest.fail("Refusal cannot be retried"))
+    proof = envelope.attest_build_probe_workload("f" * 64, 77)
+    assert proof["ready"] is False and proof["reason"] == reason
+    assert len(attempts) == 1 and "probeWorkload" not in proof
+
+
 def test_collect_snapshot_uses_host_helper_and_exports_real_family_counters(monkeypatch):
     envelope = _module()
     snapshot = _snapshot()