[aviggiano]

Summary

• allow descriptor-anchored init writes when Modal reports different st_dev values for a stable parent directory and its child files
• keep opened-versus-lexical file identity checks intact
• require atomic stock-adapter sidecars to share the target file's device, which is the relevant hard-link/rename boundary
• cover fresh init, stock-adapter migration, and a deliberate inode mismatch with a Modal-shaped regression

Live reproduction

The exact origin/main runner image used by public benchmark run 31285069172 reports device 19 for the opened target directory and device 17 for a child created through /proc/self/fd/<dirfd>; the lexical child has the same device/inode as the opened child. Before this change, fresh ultrafuzz init --force --json exits 1 with INIT_PATH_UNSAFE after writing only ultrafuzz.toml.

Injecting the compiled fix into that same image makes all of these succeed:

• fresh force init
• repeated force init
• non-force atomic migration of a historical stock Codex adapter

Validation

• @ultrafuzz/runtime full suite: 183 passed, 16 expected skips, 0 failed
• focused init/stock-adapter security suite: 15 passed
• runtime typecheck
• workspace format check and lint
• CLI dependency build and local CLI init

Unblocks the public benchmark acceptance required by #427. This PR does not close #427; complete 3/3 benchmark, cost/wall-clock, and supersession evidence still need to land.

Greptile Summary

The PR adjusts init-time filesystem identity validation for environments where directory descriptors and their child files report different devices, while retaining opened-versus-lexical file checks.

• Removes the requirement that descriptor-anchored project files share their parent directory’s device.
• Anchors atomic adapter sidecars to the original target file’s device, matching the hard-link and rename boundary.
• Adds coverage for fresh initialization, stock-adapter migration, and deliberate inode mismatch rejection under a Modal-shaped device split.

Confidence Score: 5/5

The PR appears safe to merge because the relaxed parent-device checks retain direct opened-versus-lexical identity validation and atomic sidecars remain bound to the target file’s device.

The changed checks align device validation with the identities used by file writes, hard links, and renames, and the added regression test exercises both valid split-device behavior and deliberate identity mismatch rejection.

Important Files Changed

Filename	Overview
packages/runtime/src/init.ts	Updates device checks to tolerate descriptor-directory versus child-file splits while preserving lexical identity and same-device atomic-publication constraints.
packages/runtime/test/runtime.test.ts	Adds a focused regression test covering successful initialization and adapter migration plus rejection of an opened-versus-lexical inode mismatch.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  D[Open and authenticate parent directory] --> C[Open or create child through directory descriptor]
  C --> I{Existing target?}
  I -->|Yes| E[Match opened child to expected target dev and inode]
  I -->|No| L[Match opened child to lexical child dev and inode]
  E --> L
  L --> W[Write and fsync child]
  W --> V[Revalidate opened child, lexical child, and parent directory]
  V --> A{Atomic adapter migration?}
  A -->|Yes| S[Create sidecars sharing original target device]
  S --> P[Rename, hard-link, verify, and clean up]
  A -->|No| F[Finish initialization]

Loading

_{Reviews (1): Last reviewed commit: "fix(runtime): support Modal descriptor d..." | Re-trigger Greptile}

Context used:

• Knowledge Base — Runtime: Run Orchestration Lifecycle
• Knowledge Base — Security