feat(claude-ops): audit-performance kernel_objects census, the host-level floor beneath the four suspects - #3735
Conversation
…evel floor beneath the four suspects A read-only Windows census through NtQueryObject(ObjectTypesInformation) and GetPerformanceInfo: live and high-water counts for Token, Process, Thread, Key, File, Section, Event, and EtwRegistration objects, paged and nonpaged pool, system handle/process/thread totals, and uptime. Token leads because a Token object that outlives every handle to it is held by a kernel reference, and a leaking driver or service path accumulates them for the life of the boot: the host behind this carried 3.81M Token objects and ~10 GB of paged pool at two days' uptime, every process creation cost 1.4 to 4 s at 7% CPU, and a reboot restored a 14 ms floor. The section reports the mint rate as objects / uptime (a 3 s window read 0/s while a 60 s window read 15/s, so a short window under-reads), projects the hours to the 250,000-object threshold at that rate, and labels token-objects-leaked / paged-pool-high. Off Windows it says supported: false with the reason. The block parser is unit-tested on a synthetic x64 layout on every platform; the e2e contract asserts the section ships; the live parse was cross-checked against an independent C# reader within 0.6%. known-performance-issues.md records the signature, the ruled-out causes, and the elevated attribution runbook; SKILL.md reads kernel_objects before the four suspects. claude-ops 0.41.14 -> 0.42.0. Refs #3715 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8ExixbqhNTwnH14jLx7Nt
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Claude finished @kyle-sexton's task in 4m 10s —— View job Code review complete
Reviewed per FindingsOne inline comment posted on What held up well
Not independently verifiedPer the review lane's rules, the PR author's own claimed verification (unit test run, |
|
Claude finished @kyle-sexton's task in 1m 12s —— View job Security review complete
No security issues found. Reviewed all 8 changed files (
Nothing here crosses a trust boundary, handles untrusted input, or touches auth/secrets/CI. No findings to report. |
|
Last security-reviewed head: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 53824e9307
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
|
Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count. |
…nd names its ratio honestly Review findings on #3735, all classified VALID: - paged-pool-high alone no longer yields a leak verdict. GetPerformanceInfo reports aggregate pool with no attribution, so state_label is now `token-leak` only on token-objects-leaked, `paged-pool-high` when only the pool finding fires, and SKILL.md routes the latter to poolmon rather than to a reboot. - per_second_since_boot is renamed objects_per_uptime_second and the projection hours_to_leak_threshold_at_uptime_ratio; a `basis` string says the ratio includes the boot population (overstates early in a boot, so the projection errs short) and cannot see churn. The ratio stays instead of an in-run delta because a 3 s window read 0/s against a 60 s window's 15/s on the reporting host; the 60 s manual sample is the mint-rate measurement. - The reference's post-reboot timeline no longer presents two samples four minutes apart as one checkpoint: the table carries 1 h 57 min (25,623, the calibration basis) and the bullet its own 2 h 01 min and 2 h 10 min readings. CI's Python lane collects lib/test_spawn_noise.py and the engine's suite in one pytest process, and pytest prepends each suite's directory, so the lib's stand-alone check (engine script dir absent from sys.path) failed there. It now runs in a `python -I` child that proves the exclusion itself before importing, so it passes wherever it is collected. Refs #3715 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8ExixbqhNTwnH14jLx7Nt
…ption `node scripts/generate-catalog.mjs`, so the catalog block carries the audit-performance kernel-object census clause the plugin manifest now declares; test-linux's manifest-and-catalog validation gates on parity. Refs #3715 Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D8ExixbqhNTwnH14jLx7Nt
1 participant
Closes #3715
Summary
claude-ops0.41.14 to 0.42.0. The audit-performance engine gains a read-only, Windows-onlykernel_objectscensus: live and high-water counts for Token, Process, Thread, Key, File, Section, Event, and EtwRegistration objects throughNtQueryObject(ObjectTypesInformation), paged and nonpaged pool plus system handle, process, and thread totals throughGetPerformanceInfo, and uptime. It reportsobjects_per_uptime_second, a population ratio that names its own bias in abasisstring, projects the hours to a 250,000-object leak threshold at that ratio, and carries two findings that are not one verdict:token-objects-leakedalone yieldsstate_label: token-leak, whilepaged-pool-highis an unattributed pool signal routed topoolmon. Off Windows it returnssupported: falsewith the reason instead of vanishing.known-performance-issues.mdrecords the signature, the ruled-out causes, and the elevated attribution runbook, andSKILL.mdreads the section before the four suspects.Why: the host behind #3715 carried 3.81M Token objects and about 10 GB of paged pool at two days' uptime, every process creation on it cost 1.4 to 4 s at 7% CPU, and all four existing suspects cleared. A reboot restored a 14 ms floor and the leak re-armed at once (5 to 15 objects per second post-reboot). The audit could not see this floor before; now it names it and routes the reboot and the attribution to the operator. The issue's remaining step, attributing the minter from an elevated shell, is host operations: the post-reboot readings and a paste-ready bisection script are posted on the issue, and a recurrence now surfaces as
token-objects-leakedin the next audit instead of as a re-derived diagnosis.Fix
scripts/audit_performance.py:KERNEL_OBJECT_TYPES,TOKEN_LEAK_OBJECTS,PAGED_POOL_HIGH_MB, and the x64 struct offsets;parse_object_types(a pure memory walk, portable to any platform);_windows_object_type_table;_windows_performance_info;summarize_kernel_objects;kernel_objects; wired intomain()as the phase afterplugin_fleet; the module docstring names the host-level floor.scripts/test_audit_performance.py:TestKernelObjectCensus(synthetic x64 block parse including name padding, leak labelling, pool-alone labelling, fresh-boot projection, zero-uptime guard, off-Windows mock, live contract keys).scripts/audit_performance.test.sh: asserts the section ships and survives--skip-fan-out.lib/test_spawn_noise.py: the stand-alone check now runs in apython -Ichild that proves the engine's script directory is absent before importing, because CI's Python lane collects this suite and the engine's in one pytest process and pytest prepends each suite's directory (this is what turnedtest-linuxred on the first push).reference/known-performance-issues.md: the new "The host-level floor" section, measurement-method step 6, and a Windows-amplifier bullet.SKILL.md: description clause, a read-kernel_objects-first paragraph ahead of Suspect 1, and a gotcha..claude-plugin/plugin.json,CHANGELOG.md,README.md: version and description.Verification
python -m unittest -v test_audit_performance: 52 tests OK, 7 of them new.python -m unittest test_spawn_noise: 10 OK.python -m pytest -qover both suites in one process, pytest 9.1.1): 62 passed.bash audit_performance.test.sh: prints "OK: kernel-object census is present in the shipped report" and confirms--skip-fan-outkeeps the section.scripts/affected-tests.sh --run: both shell lanes pass.scripts/run-ruff.sh checkon the three Python files: "All checks passed!".scripts/check-changelog-parity.sh --check,--check-order, and--check-bump origin/main: all pass.scripts/check-purged-em-dashes.sh: no em dashes.markdownlint-cli2on the changed markdown files: 0 issues.plugins/skill-quality/scripts/check-skill.sh audit-performanceagainstorigin/main: PASS, 0 errors, 3 warnings of pre-existing classes.Token.objectsand an independent C#NtQueryObjectreader agree within 0.6%, andpool.paged_mbmatches the\Memory\Pool Paged Bytescounter within 0.4%.git status --porcelainidentical before and after a run).Related
check-skill.sh --require-evalsspin the diagnosis surfaced as a victim, already filed.🤖 Generated with Claude Code
https://claude.ai/code/session_01D8ExixbqhNTwnH14jLx7Nt