feat(managed-agent): admit workspace-bound sessions without execution - #12709

E2E test report (W0b)

Status: production authenticated HTTP E2E not run. The standalone Spring server does not include a production adapter that supplies a verified tenant-scoped actor, and W0b intentionally refuses bound Turn execution. The global qwen CLI was dry-run at version 0.24.4, but it does not expose this standalone managed-agent API, so it cannot serve as a bound-Session baseline.

Narrower verification completed on macOS: 68 Java unit/H2 integration tests, 6 fresh-schema MySQL 8.4 integration tests including cross-JVM retry and exact-case isolation, a focused SSE revocation test, Checkstyle, repository build, and typecheck. MockMvc injected a trusted principal to exercise public and WebShell admission, replay, revocation, and execution rejection; coordinator and Broker tests verified fail-closed behavior. This evidence does not prove a production authentication adapter, Worker mount isolation, or bound execution. Those remain separate W0c gates.

The local E2E plan is recorded under .qwen/e2e-tests/2026-09-26-managed-workspace-admission.md (ignored working artifact).

Maintainer verification: real MySQL + real server JAR, head cd76773f

Verdict: the W0b behavior is correct end to end (62/62 live checks). I recommend fixing F1 before merge. F1 is the measured answer to the CAST question that triage left open (stage 2, stage 3). The rewrite does take the legacy unbound paths off their indexes, and the FOR UPDATE variant locks every tenant's command rows. A +29/−17 candidate patch keeps the exact-byte check and restores main's query plans. I verified it below. F2 (three guards with no test) and F3 (Idempotency-Key namespaces) are smaller and do not block merge.

What I ran

• Environment: macOS arm64, JDK 21.0.12, Maven 3.9.16, MySQL 8.4.7 on a fresh datadir. Control arm: origin/main 9e51e6ac, whose packages/sdk-java is identical to the PR base be1a0a1f.
• Suites: mvn verify on managed-agent-server: 69/69 passed, Checkstyle clean. -Pmysql-integration: 6/6 on a fresh default-collation database, and 6/6 on a utf8mb4_unicode_ci database (the collation behind the feat(managed-agent): Spring control plane and dual-path WebShell #12692 F1). All four new tables and the new session columns come out as utf8mb4_bin.
• Live rig:
  • The real Spring Boot JAR, started through PropertiesLauncher.
  • A 60-line adapter JAR that sets an AuthenticatedTenantActor principal from X-Rig-Actor. It stands in for the host's verified ingress, which the standalone server does not have. By construction it trusts that header, so it does not replace production-auth E2E.
  • A counting fake Hosted Harness that logs every request and answers 503.
  • Registry rows, grants and the tenant default seeded by an administrator over SQL.

Reviewer Test Plan, live (Fig. 1)

All 62 checks passed:

• Admission normalized ./services/./api/ to services/api and stored the seven-field binding plus the frozen configRef/policyRef. No Turn row was written and the Harness got no request.
• A retry after generation=2, DRAINING and a default change returned the original Session and binding. A changed cwd returned 409 idempotency_conflict.
• The actor is taken only from the principal. Header and JSON-body claims got 401. A tenant mismatch got 403. Alice and ACME case variants got 404.
• All 10 malformed selections were rejected before any row was written.
• Every bound Turn and lifecycle operation got 409 for a reader and 404 for a non-reader. No command or Turn row was written, and the Harness got no request.
• I inserted a bound ACCEPTED Turn directly in MySQL to simulate a persisted one. The dispatcher marked it FAILED workspace_unavailable with the Harness untouched.
• Revocation returned 404 on every read route and hid the Session from lists. An open SSE stream closed about 2 s after the grant was revoked.
• The legacy unbound path still reaches the Harness. This is the positive control that the counter works.

F1 (fix before merge): the CAST(CONCAT(col,'!') AS BINARY(513)) predicates are not index-usable on MySQL (Fig. 2)

Setup: 100,000 legacy Sessions across 1,000 tenants, 100,000 command rows and 20,000 grants, with the same data for each arm.

• Plans:

  • listSessions goes from a ref on managed_agent_session_list_idx (100 rows) to a full scan of 99,375 rows plus a filesort. Its new grant EXISTS scans all 20,000 grants for each bound row.
  • findCommand … FOR UPDATE goes from a const PK lookup to a full scan of 98,670 rows. canRead is also a full scan.
  • findSession/requireSessionForUpdate are unaffected, because UNIQUE(session_id) still serves them. Triage called that correctly.

• Locks: under REPEATABLE READ, the PR's findCommand … FOR UPDATE for tenant t0500 takes 101,650 record locks (main takes 1). Meanwhile tenant t0001's own lookup and its INSERT into managed_agent_command both fail with ERROR 1205 Lock wait timeout. That statement runs inside insertTurnCommand, beginSessionMutation and completeSessionMutation. As a result, legacy Turn submission and every lifecycle mutation serialize across all tenants.

• Real HTTP latency (median):

  Path	main	PR	Slowdown
  List	6.9 ms	88.9 ms	13×
  Create	5.8 ms	46.9 ms	8×
  16 tenants × 10 Turn submissions in parallel	39 ms (0.7 s wall)	687 ms (7.0 s wall)	17×
  Bound list, 300 bound Sessions	—	687 ms	—

  All of these scale linearly with table size, and the command table only grows.

• What the CAST buys: it is not a no-op. utf8mb4_bin is PAD SPACE on MySQL 8.4, so 'ws-a' = 'ws-a ' is TRUE with a plain =. So it adds exactness for Workspace IDs. For tenant IDs and idempotency keys it has no effect, because their validators already reject spaces.

• Candidate fix: put a sargable col = ? in front of the CAST predicate in 7 queries, and keep the CAST. Any row the CAST accepts also satisfies the new =, so results are unchanged.

  • Verified: 69/69 unit/H2, 6/6 MySQL IT, Checkstyle clean, 62/62 live walk-through.
  • Main's plans are restored: ref list_idx for the list, a const PK lookup for findCommand, and eq_ref/const PK for the grant lookups.
  • The lock test is back to 1 lock with no cross-tenant wait. Latency: list 7.6 ms, create 5.1 ms, parallel submit 24 ms median / 0.4 s wall, bound list 9.5 ms.

--- a/packages/sdk-java/managed-agent-server/src/main/java/com/alibaba/qwen/code/managedagent/store/ManagedAgentStore.java
+++ b/packages/sdk-java/managed-agent-server/src/main/java/com/alibaba/qwen/code/managedagent/store/ManagedAgentStore.java
@@ -217,9 +217,10 @@ public class ManagedAgentStore implements AgentStateStore {
             String actorId, String idempotencyKey) {
         return jdbc.query("SELECT request_digest, session_id, turn_id"
                         + " FROM managed_workspace_create_command"
-                        + " WHERE CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
+                        + " WHERE tenant_id = ? AND actor_id = ?"
+                        + " AND idempotency_key = ?"
+                        + " AND CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))"
-                        + " AND actor_id = ?"
                         + " AND CAST(CONCAT(idempotency_key, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))",
                 (result, row) -> new WorkspaceCommand(
@@ -227,7 +228,7 @@ public class ManagedAgentStore implements AgentStateStore {
                         result.getString("session_id"),
                         result.getString("turn_id")),
                 tenantId, ManagedWorkspaceRegistry.actorKey(tenantId, actorId),
-                idempotencyKey);
+                idempotencyKey, tenantId, idempotencyKey);
     }
 
     private record WorkspaceCommand(String requestDigest, String sessionId,
@@ -507,10 +508,11 @@ public class ManagedAgentStore implements AgentStateStore {
                         + " command_status, session_status_before,"
                         + " created_at, updated_at"
                         + " FROM managed_agent_command WHERE"
+                        + " tenant_id = ? AND operation = ?"
+                        + " AND idempotency_key = ? AND"
                         + " CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))"
-                        + " AND operation = ? AND"
-                        + " CAST(CONCAT(idempotency_key, '!') AS BINARY(513))"
+                        + " AND CAST(CONCAT(idempotency_key, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))"
                         + (forUpdate ? " FOR UPDATE" : ""),
                 (result, row) -> new CommandRecord(
@@ -524,7 +526,8 @@ public class ManagedAgentStore implements AgentStateStore {
                         result.getString("session_status_before"),
                         result.getLong("created_at"),
                         result.getLong("updated_at")),
-                tenantId, operation, idempotencyKey);
+                tenantId, operation, idempotencyKey, tenantId,
+                idempotencyKey);
         return rows.stream().findFirst();
     }
 
@@ -551,6 +554,7 @@ public class ManagedAgentStore implements AgentStateStore {
             Long beforeUpdatedAt, String beforeSessionId, int limit) {
         List<Object> arguments = new ArrayList<>();
         arguments.add(tenantId);
+        arguments.add(tenantId);
         arguments.add(actorId == null ? null
                 : ManagedWorkspaceRegistry.actorKey(tenantId, actorId));
         String cursorClause = "";
@@ -563,13 +567,17 @@ public class ManagedAgentStore implements AgentStateStore {
         }
         arguments.add(limit + 1);
         List<SessionRecord> rows = jdbc.query(
-                "SELECT * FROM managed_agent_session WHERE"
-                        + " CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
+                "SELECT * FROM managed_agent_session WHERE tenant_id = ?"
+                        + " AND CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))"
                         + " AND status <> 'DELETED'"
                         + " AND (workspace_id IS NULL OR EXISTS (SELECT 1"
                         + " FROM managed_workspace_access wa"
-                        + " WHERE CAST(CONCAT(wa.tenant_id, '!') AS BINARY(513))"
+                        + " WHERE wa.tenant_id = managed_agent_session.tenant_id"
+                        + " AND wa.workspace_id"
+                        + " = managed_agent_session.workspace_id"
+                        + " AND wa.actor_id = ?"
+                        + " AND CAST(CONCAT(wa.tenant_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT("
                         + "managed_agent_session.tenant_id, '!')"
                         + " AS BINARY(513))"
@@ -577,7 +585,6 @@ public class ManagedAgentStore implements AgentStateStore {
                         + " = CAST(CONCAT("
                         + "managed_agent_session.workspace_id, '!')"
                         + " AS BINARY(513))"
-                        + " AND wa.actor_id = ?"
                         + " AND wa.can_read = TRUE))"
                         + cursorClause
                         + " ORDER BY updated_at DESC, session_id DESC LIMIT ?",
--- a/packages/sdk-java/managed-agent-server/src/main/java/com/alibaba/qwen/code/managedagent/store/ManagedWorkspaceRegistry.java
+++ b/packages/sdk-java/managed-agent-server/src/main/java/com/alibaba/qwen/code/managedagent/store/ManagedWorkspaceRegistry.java
@@ -38,12 +38,14 @@ public class ManagedWorkspaceRegistry {
             return false;
         }
         return !jdbc.queryForList("SELECT 1 FROM managed_workspace_access"
-                + " WHERE CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
+                + " WHERE tenant_id = ? AND workspace_id = ?"
+                + " AND CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
                 + " = CAST(CONCAT(?, '!') AS BINARY(513))"
                 + " AND CAST(CONCAT(workspace_id, '!') AS BINARY(513))"
                 + " = CAST(CONCAT(?, '!') AS BINARY(513))"
                 + " AND actor_id = ? AND can_read = TRUE",
-                Integer.class, tenantId, workspaceId, key).isEmpty();
+                Integer.class, tenantId, workspaceId, tenantId, workspaceId,
+                key).isEmpty();
     }
 
     public ResolvedBinding resolveForCreation(String tenantId,
@@ -67,9 +69,10 @@ public class ManagedWorkspaceRegistry {
         if (selection == null) {
             List<String> defaults = jdbc.queryForList(
                     "SELECT workspace_id FROM managed_workspace_default"
-                            + " WHERE CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
+                            + " WHERE tenant_id = ?"
+                            + " AND CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
                             + " = CAST(CONCAT(?, '!') AS BINARY(513)) FOR UPDATE",
-                    String.class, tenantId);
+                    String.class, tenantId, tenantId);
             if (defaults.isEmpty()) {
                 throw workspaceRequired();
             }
@@ -81,12 +84,13 @@ public class ManagedWorkspaceRegistry {
                 "SELECT workspace_generation, storage_id, display_name,"
                         + " config_ref, policy_ref, state FROM"
                         + " managed_workspace_registry WHERE"
+                        + " tenant_id = ? AND workspace_id = ? AND"
                         + " CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))"
                         + " AND CAST(CONCAT(workspace_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513)) FOR UPDATE",
                 (result, row) -> workspaceRow(tenantId, workspaceId,
-                        result), tenantId, workspaceId);
+                        result), tenantId, workspaceId, tenantId, workspaceId);
         if (records.isEmpty()) {
             if (selection == null) {
                 throw workspaceRequired();
@@ -96,14 +100,15 @@ public class ManagedWorkspaceRegistry {
         }
         List<AccessRow> access = jdbc.query(
                 "SELECT can_read, can_create FROM managed_workspace_access"
-                        + " WHERE CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
+                        + " WHERE tenant_id = ? AND workspace_id = ?"
+                        + " AND CAST(CONCAT(tenant_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))"
                         + " AND CAST(CONCAT(workspace_id, '!') AS BINARY(513))"
                         + " = CAST(CONCAT(?, '!') AS BINARY(513))"
                         + " AND actor_id = ? FOR UPDATE",
                 (result, row) -> new AccessRow(result.getBoolean("can_read"),
                         result.getBoolean("can_create")), tenantId,
-                workspaceId, key);
+                workspaceId, tenantId, workspaceId, key);
         if (access.isEmpty() || !access.getFirst().canRead()) {
             if (selection == null) {
                 throw workspaceRequired();

F2 (recommended, test-only): three load-bearing guards have no test (Fig. 3)

I removed one guard at a time on a copy of cd76773f and ran the PR's 66 unit/H2 tests; the MySQL IT was not part of these runs. 20 of 28 mutants were killed.

• Defense in depth (4 survivors): M02, M09, M11 and M18. An upstream guard still catches each one. For example, the store's non-empty check keeps the 409 when the service check is removed.
• Untested integrity check (1): M23, the re-derivation of the frozen descriptor. It works live: a tampered row fails closed.
• Load-bearing (3): I built a server JAR for each and ran it against a fresh MySQL. Each mutant changes only its own row; the PR code is correct on all three.
  • M12: after the read grant is revoked, a WebShell create retry gets 202 {sessionId: <original>, replayed: true} instead of 404. The public route stays 404 only because its controller re-reads the Session.
  • M14: the same key sent with ws-b/docs instead of ws-a/services/api gets 202 replay=true and silently keeps the original binding, instead of 409.
  • M24: a read-only grant creates a bound Session (202 instead of 403).

Three candidate tests (+74 lines in ManagedWorkspaceAdmissionTest) pass on the PR code (66 → 69) and kill M12, M14 and M24.

    @Test
    void webShellRetryAfterRevocationReturnsNoSession() throws Exception {
        String tenant = "tenant-" + UUID.randomUUID();
        register(tenant, "ws-a", "storage-a");
        grant(tenant, "ws-a", "actor-a", true);
        String body = """
                {"idempotencyKey":"web-retry","agentId":"qwen-code",
                 "input":[],"workspace":{"workspaceId":"ws-a"}}
                """;
        mvc.perform(post("/api/agent/web-shell/v1/sessions/create")
                        .header(TenantContextFilter.HEADER, tenant)
                        .principal(actor(tenant, "actor-a"))
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(body))
                .andExpect(status().isAccepted());
        jdbc.update("UPDATE managed_workspace_access SET can_read = FALSE"
                        + " WHERE tenant_id = ? AND workspace_id = ?"
                        + " AND actor_id = ?", tenant, "ws-a",
                "actor-a".getBytes(java.nio.charset.StandardCharsets.UTF_8));
        mvc.perform(post("/api/agent/web-shell/v1/sessions/create")
                        .header(TenantContextFilter.HEADER, tenant)
                        .principal(actor(tenant, "actor-a"))
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(body))
                .andExpect(status().isNotFound())
                .andExpect(jsonPath("$.sessionId").doesNotExist());
    }

    @Test
    void sameKeyWithDifferentWorkspaceSelectionConflicts() throws Exception {
        String tenant = "tenant-" + UUID.randomUUID();
        register(tenant, "ws-a", "storage-a");
        register(tenant, "ws-b", "storage-b");
        grant(tenant, "ws-a", "actor-a", true);
        grant(tenant, "ws-b", "actor-a", true);
        for (String[] selection : new String[][] {
                {"ws-a", "services/api", "202"},
                {"ws-a", "services/web", "409"},
                {"ws-b", "services/api", "409"}}) {
            mvc.perform(post("/v1/agents/sessions")
                            .header(TenantContextFilter.HEADER, tenant)
                            .header("Idempotency-Key", "same-key")
                            .principal(actor(tenant, "actor-a"))
                            .contentType(MediaType.APPLICATION_JSON)
                            .content("{\"agent_id\":\"qwen-code\",\"input\":[],"
                                    + "\"workspace\":{\"workspace_id\":\""
                                    + selection[0] + "\",\"cwd_relative\":\""
                                    + selection[1] + "\"}}"))
                    .andExpect(status().is(Integer.parseInt(selection[2])));
        }
    }

    @Test
    void readOnlyGrantCannotCreateBoundSession() throws Exception {
        String tenant = "tenant-" + UUID.randomUUID();
        register(tenant, "ws-a", "storage-a");
        grant(tenant, "ws-a", "reader", false);
        mvc.perform(post("/v1/agents/sessions")
                        .header(TenantContextFilter.HEADER, tenant)
                        .header("Idempotency-Key", "reader-create")
                        .principal(actor(tenant, "reader"))
                        .contentType(MediaType.APPLICATION_JSON)
                        .content("""
                                {"agent_id":"qwen-code","input":[],
                                 "workspace":{"workspace_id":"ws-a"}}
                                """))
                .andExpect(status().isForbidden())
                .andExpect(jsonPath("$.error.code")
                        .value("workspace_forbidden"));
        assertThat(jdbc.queryForObject("SELECT COUNT(*) FROM"
                        + " managed_agent_session WHERE tenant_id = ?",
                Integer.class, tenant)).isZero();
    }

F3 (design question, does not block): legacy and bound creation use separate Idempotency-Key namespaces

Live on the PR server, sending the same key with and without workspace creates two Sessions, and both responses say replay=false. This happens in either order. The controls behave correctly: within one mode, changed content gets 409 idempotency_conflict. A client or proxy that adds or drops workspace on retry will therefore get a duplicate Session silently. That goes against the test plan's "changing the request content should produce an idempotency conflict". Two options:

• Reserve the key across both tables: bound creation also checks (tenant, CREATE_SESSION, key), and legacy creation checks the receipt table for (tenant, *, key).
• Or state in the design doc that the two key spaces are separate.

Notes (do not block)

• SSE with Accept: text/event-stream: any 404 becomes a 500, because ApiExceptionHandler cannot write JSON to an SSE response (HttpMediaTypeNotAcceptableException). This is pre-existing: main returns 500 for a nonexistent id too. It does mean a real EventSource client of a revoked actor gets 500 rather than the 404 the design describes; ?stream=true without that header gets 404. Mid-stream revocation closes the stream correctly, but logs 3 ERROR entries with full stack traces for an expected condition.
• Tampered frozen configRef: it fails closed as designed (GET → 500). It also makes that actor's whole list return 500, so one bad row takes down the page. This is fine for W0b but worth knowing for operations.
• I agree with triage on the default-Workspace branch (selection == null, managed_workspace_default): no HTTP route reaches it in this PR.
• On triage note 3 (a SELECT per SSE event): M18, the per-event recheck on live delivery, is the only SSE guard mutant that survives, because the loop-top recheck covers it. Rechecking once before each batch would likely keep every tested behavior at one query per batch. I did not measure that.

Not covered

• Production authenticated ingress, Worker mounts and bound execution. These are out of scope per the PR, and my rig's adapter trusts a header by design.
• MariaDB locally. The CI MariaDB job is green. The index loss comes from a non-sargable predicate, which should behave the same way on MariaDB, but I only measured MySQL 8.4.7.
• Windows and Linux locally. The CI Java jobs are green on ubuntu, macOS and windows.

Fixed in 02c2c82 and aa3ef35 (negative SSE cursor validation).

The three failing managed-agent CI tests are addressed: the Workspace identifier expectation now matches the frozen API contract; SSE revocation coverage verifies actual grant state and graceful completion; the batch projection fixture acquires its manual lease in the same transaction as admission so the background dispatcher cannot steal it first.

Correctness fixes also cover cross-shape creation idempotency (including concurrent requests and legacy receipt migration), indexed exact-match lookups, complete binding constraints, invalid Registry data classification, and SSE delivery through deletion. Session streams remain open across terminal Turn events and recheck bound grants before every event. English and Chinese designs are synchronized.

Verification / E2E report

• Fresh-schema MariaDB 10.11 + Java 21 run: 85 unit/integration tests + 6 MariaDB IT cases passed, no failures/errors/skips; Checkstyle clean. After the final cursor-only correction, the full module rerun passes 86 unit/integration tests, with zero Checkstyle violations. Database code is unchanged by that correction.
• Repository build, typecheck and bundle passed; build/typecheck were rerun after the final Java source correction.
• Independent MariaDB probes: both sequential and forced-overlap bound/unbound creation orders yield one Session and one conflict; 10 simultaneous races pass. NULL numeric binding fields are rejected.
• Actual JDBC SQL was captured and explained: primary-key, constant one-row access for command, Registry/ACL and Workspace receipt reads. A different tenant's locking lookup completed in 2 ms while the first transaction held its lock; the baseline timed out.
• Six copied-module mutation controls turned the targeted regressions red when the relevant guards/parsing were broken. An additional SSE control failed all four delivery variants when turn.completed prematurely closed the stream; the final implementation passes all 11 SSE tests. The added negative-cursor test also failed before its validation guard was restored.
• The affected MariaDB exact-case test passes independently on a fresh schema, without relying on test order.

Scope of evidence: HTTP behavior was exercised through MockMvc with trusted test principals. The final cursor fix was independently checked through both real controllers and async dispatch (400 invalid_event_cursor), with valid cursor controls. Full deployed authenticated Hosted Harness E2E is unavailable in this slice because the production ingress adapter and hosted session loop are not implemented; the report does not claim it ran. Database concurrency probes used real MariaDB.

Review handling: 29 existing threads are fixed or explicitly clarified and resolved. Eight nonblocking suggestions remain open with an individual rationale: R1-4 (catalog adapter refactor), R1-6 (error taxonomy), R1-22 (lazy digest optimization), R1-24 (fixture constants), R1-30 (broader cleanup-error preservation), R1-32 (ingress adapter diagnostics), R1-33 (shared-lock policy), and R1-38 (process launcher consolidation). These are deliberately deferred rather than represented as implemented.

GitHub CI for the new head is running; the local results above are independent of its pending result.

Lease precision follow-up: 286bb8e.

The latest CI run exposed an additional lease-precision defect in the existing cross-process recovery test. This was reproduced rather than retried away: Connector/J sees MariaDB's 5.5.5 compatibility version and removes fractional seconds from Timestamp parameters. A nominal 1000 ms lease persisted about 800 ms early, so a commit 300 ms later failed even though the returned grant still advertised roughly 690 ms remaining.

The follow-up preserves fractional precision at all four lease-deadline writes (initial acquisition, reacquisition, renewal and takeover) by binding whole-second timestamps through JDBC and adding the preserved microseconds in SQL. This keeps the existing JDBC connection-timezone conversion. The database clock, lease duration, fencing and process-loss proof remain unchanged. The existing precision integration test now compares the persisted deadline with the returned grant for all four paths; it failed before the fix.

Final local verification: 86 unit/integration tests + 7 MariaDB IT cases passed on a fresh schema, with no failures/errors/skips and zero Checkstyle violations. The precision regression is parameterized over UTC and +08:00 connection timezones. Independent probes cover default and explicit connection timezones with UTC/Asia-Shanghai JVMs, including connection and JVM timezones that differ; all four paths retain the advertised deadline and delayed commits remain valid. Repository build/typecheck and independent code review were also rerun.

The six timezone combinations produced 42 exact deadline matches and 18 successful delayed commits. The SDK Java workflow for 286bb8e3de is now fully green, including all Java matrix jobs, the MariaDB job (86 + 7 managed-agent tests), and the real daemon E2E. General Qwen Code CI and the automated PR review are still running; no check is currently failing.

Follow-up CI fix: 1fadbc6c4d makes the Linux unit-test commands honor filesystem permissions when the runner uses UID 0. Both workspace and script tests run with CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH removed from the bounding and inheritable sets; ownership of the job checkout and isolated test home is normalized first.

The failed Node run had 11 cases where chmod-based read/delete/rename denial unexpectedly succeeded. All 11 passed under a normal local user, and a temporary permission-relaxing control reproduced all 11 CI failures. Local validation passed: 261 workflow tests, 18 execution-path checks of the actual workflow shell script with stubbed external commands, actionlint/ShellCheck, formatting, build, typecheck, and bundle.

Update: the Linux Node job passed on 1fadbc6c4d. All eight previously failing test files passed, and the script suite passed 2,627 tests across 96 files (12 conditional skips). The complete Qwen Code CI workflow, including Web Shell browser smoke, and the complete SDK Java workflow both finished successfully on the same head. Automatic PR review remains in progress.

Verification limitation: this attempt ran as the normal runner user (/home/github-runner), so the root-only capability branch was not executed. Its command wiring was reviewed and exercised with local stubs, but actual root-run setpriv validation remains unperformed.

Maintainer verification, round 2: head 1fadbc6c (packages/ identical to 286bb8e3)

Follow-up to round 1, same rig: real server JAR, MySQL 8.4.7, trusted-actor adapter, counting fake Hosted Harness.

Verdict: F1 and F3 are fixed and hold on real MySQL, including concurrency and an upgrade from a main-schema database. The SSE session.deleted regression flagged by bot finding R1-42 is also fixed; it was real, and my round 1 did not test deletion. Behavior is 68/68 live. From my side the only remaining item is one small test: M12, the replay-time read check, is still load-bearing and untested, and my round-1 test for it ports unchanged. Merge still needs the bot's CHANGES_REQUESTED review cleared, plus the still-pending Node CI for the new ci.yml change.

What changed since round 1

• Fix commits (all in managed-agent-server): 7 commits covering:
  • indexable lookups (F1);
  • a single Idempotency-Key scope table with a V9 backfill (F3);
  • the W0a identifier rule at the API edge;
  • SSE changes: grant recheck with no per-event SELECT on legacy streams, graceful completion, delivery through deletion, and negative-cursor validation;
  • NOT NULL checks in V7;
  • Registry-row classification;
  • a lease-precision change in the shared ManagedSessionStore.
• 1fadbc6c: touches only .github/workflows/ci.yml (git diff --quiet 286bb8e3 1fadbc6c -- packages docs is clean), so every measurement below applies to the current head.
• Main: main has moved, but its only sdk-java change is docs plus one runtime-broker test, and git merge-tree is clean.

Suites

• mvn verify: 86/86, Checkstyle clean.
• MySQL IT: 7/7 on a fresh schema in each of 5 setups: JVM Asia/Shanghai or UTC × server CST or +00:00, plus one utf8mb4_unicode_ci database. The combinations exercise the lease-precision change; on MySQL, that change produces no regression.

Live walk-through: 68/68 (Fig. 1)

This is round 1's 62 checks plus new cases.

• 'ws-a ' now gets 400 at the API edge (it was 404), as intended.
• 'ws/a' gets 400.
• New section 10 covers cross-shape keys:
  • unbound → bound: 409;
  • bound → unbound: 409;
  • WebShell unbound → public bound: 409;
  • the same key from a second actor still gets its own Session;
  • an identical retry replays.
• The positive control shows the fake Harness is reached only by the legacy Turn.

Round-1 findings (Fig. 2)

Mutation matrix: 35/38 killed (round 1: 20/28) (Fig. 3)

The matrix covers 38 single-guard mutants: round 1's 28 (5 re-targeted to the new code) plus 10 guards added by the fix commits. Every new guard is killed, including M38, which reverts findCommand to CAST-only; a test now catches that. Three mutants survive:

• M12, the replay-time read check (load-bearing, no test). I built an R2 JAR without this check. On the real stack, a revoked actor retrying WebShell create gets 202 {sessionId: <original>, replayed: true}; R2 returns 404. The public route stays 404 only because its controller re-reads the Session. My round-1 test webShellRetryAfterRevocationReturnsNoSession ports unchanged: R2 goes 83 → 84 green, and the test kills M12.
• M16, the loop-top SSE grant recheck (observable, no data leak). Without it, a revoked actor's idle bound stream stays open and keeps receiving :keepalive frames; it was still open 38 s later. R2 closes it at +2 s. The per-event checks still stop any event delivery, so no data leaks. A test is optional.
• M11 (defense in depth). The store's non-empty check still returns 409.

    @Test
    void webShellRetryAfterRevocationReturnsNoSession() throws Exception {
        String tenant = "tenant-" + UUID.randomUUID();
        register(tenant, "ws-a", "storage-a");
        grant(tenant, "ws-a", "actor-a", true);
        String body = """
                {"idempotencyKey":"web-retry","agentId":"qwen-code",
                 "input":[],"workspace":{"workspaceId":"ws-a"}}
                """;
        mvc.perform(post("/api/agent/web-shell/v1/sessions/create")
                        .header(TenantContextFilter.HEADER, tenant)
                        .principal(actor(tenant, "actor-a"))
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(body))
                .andExpect(status().isAccepted());
        jdbc.update("UPDATE managed_workspace_access SET can_read = FALSE"
                        + " WHERE tenant_id = ? AND workspace_id = ?"
                        + " AND actor_id = ?", tenant, "ws-a",
                "actor-a".getBytes(java.nio.charset.StandardCharsets.UTF_8));
        mvc.perform(post("/api/agent/web-shell/v1/sessions/create")
                        .header(TenantContextFilter.HEADER, tenant)
                        .principal(actor(tenant, "actor-a"))
                        .contentType(MediaType.APPLICATION_JSON)
                        .content(body))
                .andExpect(status().isNotFound())
                .andExpect(jsonPath("$.sessionId").doesNotExist());
    }

Notes (do not block)

• V7 migration: ADD CONSTRAINT … CHECK cannot run INPLACE on MySQL 8.4 (ERROR 1845), so it copies the table and writes to managed_agent_session wait for it. Measured on 500,000 legacy Sessions: V7 takes 3.8 s and the V9 backfill 2.1 s. That is fine at this size; for much larger tables, plan the upgrade window.
• Legacy SSE behavior change: legacy (unbound) streams now complete after session.deleted, where main kept them open. That seems right, but it is a change to already-shipped behavior, so it may deserve one line in the design notes.
• ci.yml scope: 1fadbc6c is a repo-wide change to the Node test job, outside W0b's scope. Its chown stays inside the job workspace and the per-job HOME (runner.temp/qwen-ci-home). The Java jobs are all green on 1fadbc6c, including MariaDB; Test (ubuntu-latest, Node 22.x), the job this change affects, was still pending when I checked.
• The tampered-descriptor case is unchanged apart from a better error message. I did not re-test it.

Not covered

• Production authenticated ingress, Worker mounts and bound execution (out of scope per the PR).
• MariaDB locally (the CI MariaDB job is green).
• Linux/Windows locally.
• The Linux capability behavior of the ci.yml change.

Maintainer verification, round 3: Linux gap coverage, head 1fadbc6c

Verdict: merge-ready (round-3 scope). 21/21 scripted assertions passed, 0 unexpected failures. Verified head: 1fadbc6c4d2b4ac35bbe93781db84fd4e7967201.

Follow-up to round 2 at the same head. Round 2 (macOS arm64) left four items in Not covered: Linux/Windows locally, MariaDB locally, and the Linux capability behavior of the ci.yml change. This round runs on exactly the regime that was missing: Linux aarch64, UID 0 — the same regime as the root-run ecs-qwen lanes that 1fadbc6c targets. The live walk-through (68 checks, mutation matrix, SSE A/B) was not re-run: the head is byte-identical to round 2's, and those behaviors are platform-independent Java logic; instead I re-measured the load-bearing database claims (F1's fixed plans and lock footprint) independently on Linux, on both engines.

Environment

• Orange Pi (aarch64), Linux, UID 0, Oracle JDK 21 (build 21+35; round 2 used 21.0.12 on macOS), Maven 3.9.0, Node 24.14.0 + pnpm 11.24.0.
• Docker mysql:8.4 and mariadb:11.4 containers on fresh schemas (this round's own instances).
• Merge-base with origin/main is be1a0a1f — identical to baseRefOid, so no stale-base skew.

Suites on Linux (Fig. 1)

Unit counts match round 2's macOS counts exactly. The MariaDB 11.4 arm is new coverage — round 2 listed it in Not covered. V1–V9 migrations apply cleanly on both engines; all tables come out utf8mb4_bin.

F1 re-measured on Linux, both engines (Fig. 2)

Seed: 100,000 sessions / 100,000 commands / 20,000 grants across 1,000 tenants (round 1's shape). SQL taken verbatim from ManagedAgentStore.java at head:

The ci.yml capability fix, verified in its target regime (Fig. 3, Fig. 4)

1fadbc6c is the head commit and was round 2's biggest Not covered item. This host is the regime it targets (root-run Linux lane).

• Mechanism (Fig. 3): plain root reads a chmod-000 file (CapBnd: …fffff, all capabilities). The exact setpriv --bounding-set=-dac_override,-dac_read_search --inh-caps=… line from ci.yml drops the two bits (CapBnd: …ffff9) and the same read is EACCES. The chown -R 0 step is load-bearing: under the wrapper, a file owned by uid 65534 is EACCES until the chown restores owner-bit access — on a root lane whose checkout ran as another uid, the suite could not even read its own workspace without it.
• Real-suite A/B (Fig. 4): packages/cli/src/utils/housekeeping/cleanup.test.ts has three chmod-000 permission fixtures that skip only on win32. Plain root: 3 failed / 31 passed — the failure shape the ECS root lane was hitting. Under the wrapper: 34/34 passed, same machine, same build.

Previous findings status

Notes (do not block)

• The broker MySQL IT is not re-run-safe against a non-fresh schema. A second run on the same database fails verifyBinding (expected <[1]> but was <[2]>); dropping the database restores 2/2. CI always uses a fresh schema, so this only bites local re-runs.
• This base still installs with pnpm. package-lock.json does not exist at the PR's merge-base (CI uses corepack pnpm install --frozen-lockfile); main has since switched to the npm lockfile, so this resolves itself at merge.
• Trial merge against current origin/main is clean (git merge-tree --write-tree); main's only sdk-java changes since the merge-base are docs plus one conformance test.

Not covered

• Round 2's full live walk-through, mutation matrix, and SSE A/B — same head, platform-independent behavior; see the round-3 scope note at the top.
• Windows locally; production authenticated ingress, Worker mounts, bound execution (W0c, out of scope per the PR).
• The full Node suites (test:ci:workspaces / test:scripts end-to-end as root) — only the permission-fixture file was A/B'd; CI's Test (ubuntu-latest, Node 22.x) is green on this head.

Methodology

Worktree at 1fadbc6c (fetched from QwenLM/qwen-code), no source modifications. Java: mvn verify per module; ITs via -Pmysql-integration -Dmysql.url=… against this round's own MySQL 8.4 and MariaDB 11.4 containers, fresh schema per run (the one dirty-rerun failure is called out above). F1: migrations V1–V9 applied by hand, seeded via recursive CTEs, EXPLAIN of SQL copied verbatim from head source, lock counts via performance_schema.data_locks (MySQL) / information_schema.innodb_trx (MariaDB) with a two-connection holder/waiter rig. Capability: the exact setpriv line extracted from ci.yml, first against synthetic fixtures, then driving vitest on the real test file in both arms. Evidence captures via scripts/verify-capture.mjs; harnesses and raw logs live in tmp/pr12709-verify-20260926-104612/.

@qwen-code /triage