mirror of
https://github.com/headroomlabs-ai/headroom.git
synced 2026-08-27 14:17:10 -04:00
Production incident (Finding #2 of HEADROOM_PROXY_LOG_FINDINGS_2026_05_03.md): on this customer's deployment the Rust extension `headroom._core` was never installed into the runtime Docker image. Diff compression failed 54 times in a single day; "Optimization failed: ModuleNotFoundError" hit 379 times. The failure rate climbed every day and reached ~223/day on 2026-05-03 — effectively 100% of requests on the Rust path. Every Rust PR we'd merged (MessageScorer, ICM, DiffCompressor, etc.) was providing zero customer value because the module wasn't loadable at all. Root cause: the Dockerfile builder stage installed Python deps and the in-tree `headroom-ai` package but never ran `maturin build` for the `headroom-py` crate, so the runtime image shipped without `_core.so`. The Python proxy continued to start because the extension's absence is caught and routed through Python-only fallbacks that either silently no-op or raise per-request. This change makes that mode impossible by default: * `headroom.proxy.server._check_rust_core()` runs as the first step of the FastAPI lifespan. If the import fails it prints a structured diagnostic, logs `event=rust_core_missing`, and calls `sys.exit(78)` (sysexits.h `EX_CONFIG`). Process supervisors (systemd / k8s / docker) treat this as a deliberate config error and stop restart loops. * `HEADROOM_REQUIRE_RUST_CORE=false` is the explicit opt-out for Python-only `pip install -e .` developer flows; lifespan logs `event=rust_core_disabled` and continues. Any other value (including unset) keeps the fail-loud default. * `/health` now surfaces `rust_core: "loaded" | "disabled" | "missing"` (plus `rust_core_error` when non-loaded) so operators can alert on the degraded state rather than discovering it via a customer ticket. * `scripts/build_rust_extension.sh` is the single dev-time path: build → install → import-verify with the same `hello()` marker the lifespan checks. Failures are loud at every step. * `Makefile` exposes the script as `make verify-rust-core`. * `Dockerfile` now installs `rustup` + `maturin`, builds the wheel from `crates/headroom-py`, force-installs it into site-packages, and runs the same `hello()` import-verify in the build image so a broken build fails the docker-build, not the next runtime restart. Tests: * `tests/test_rust_core_smoke.py` pins all four contracts: - `_core.hello()` returns `"headroom-core"` - missing extension + default env → `SystemExit(78)` - missing extension + opt-out env → lifespan starts, `/health` returns `rust_core: "disabled"` with the underlying error - present extension + default env → `("loaded", None)` Per-finding-#2: ~/Desktop/HEADROOM_PROXY_LOG_FINDINGS_2026_05_03.md.
141 lines
5.9 KiB
Makefile
141 lines
5.9 KiB
Makefile
# Headroom Rust build targets. `just` is not installed on dev boxes; this
|
|
# Makefile is the source of truth and is mirrored by .github/workflows/rust.yml.
|
|
|
|
SHELL := /bin/bash
|
|
CARGO ?= cargo
|
|
MATURIN ?= maturin
|
|
PYTHON ?= python3
|
|
FIXTURES ?= tests/parity/fixtures
|
|
|
|
.PHONY: help test test-parity bench build-proxy build-wheel fmt fmt-check lint clippy clean ci-precheck ci-precheck-rust ci-precheck-python ci-precheck-commitlint install-git-hooks verify-rust-core
|
|
|
|
help:
|
|
@echo "Headroom Rust targets:"
|
|
@echo " make test - cargo test --workspace"
|
|
@echo " make test-parity - maturin develop + parity-run against fixtures"
|
|
@echo " make bench - cargo bench --workspace"
|
|
@echo " make build-proxy - release build + strip headroom-proxy, print size"
|
|
@echo " make build-wheel - release wheel for headroom-py"
|
|
@echo " make verify-rust-core - build + install + import-verify headroom._core"
|
|
@echo " make fmt - cargo fmt --all"
|
|
@echo " make fmt-check - cargo fmt --all -- --check"
|
|
@echo " make lint - cargo clippy --workspace -- -D warnings"
|
|
@echo " make clean - cargo clean"
|
|
@echo ""
|
|
@echo "Pre-push verification (run BEFORE git push to catch CI failures locally):"
|
|
@echo " make ci-precheck - run all CI gates (rust + python + commitlint)"
|
|
@echo " make ci-precheck-rust - cargo fmt --check + clippy + test"
|
|
@echo " make ci-precheck-python - smart_crusher-affected python tests"
|
|
@echo " make ci-precheck-commitlint - lint commits since origin/main"
|
|
@echo " make install-git-hooks - install a pre-push hook that runs ci-precheck"
|
|
|
|
test:
|
|
$(CARGO) test --workspace
|
|
|
|
test-parity:
|
|
@if [ -z "$$VIRTUAL_ENV" ]; then \
|
|
echo "error: activate a venv first (e.g. source .venv/bin/activate)"; \
|
|
exit 1; \
|
|
fi
|
|
$(MATURIN) develop -m crates/headroom-py/Cargo.toml
|
|
$(CARGO) run -p headroom-parity -- run --fixtures $(FIXTURES)
|
|
|
|
bench:
|
|
$(CARGO) bench --workspace
|
|
|
|
build-proxy:
|
|
$(CARGO) build --release -p headroom-proxy
|
|
@BIN=target/release/headroom-proxy; \
|
|
if command -v strip >/dev/null 2>&1; then strip "$$BIN" || true; fi; \
|
|
SIZE=$$(wc -c < "$$BIN"); \
|
|
printf 'headroom-proxy: %s bytes (%.1f MiB)\n' "$$SIZE" "$$(echo "$$SIZE / 1048576" | bc -l)"
|
|
|
|
build-wheel:
|
|
$(MATURIN) build --release -m crates/headroom-py/Cargo.toml
|
|
|
|
# Hotfix-A0: maturin-develop + symlink + import-verify in one shot. Run this
|
|
# any time you suspect the proxy is silently falling back to Python-only
|
|
# mode (Finding #2 in HEADROOM_PROXY_LOG_FINDINGS_2026_05_03.md). The
|
|
# proxy itself runs the same check at lifespan startup; this target
|
|
# exposes it as a developer-facing one-liner.
|
|
verify-rust-core:
|
|
@if [ -z "$$VIRTUAL_ENV" ]; then \
|
|
echo "error: activate a venv first (e.g. source .venv/bin/activate)"; \
|
|
exit 1; \
|
|
fi
|
|
bash scripts/build_rust_extension.sh
|
|
|
|
fmt:
|
|
$(CARGO) fmt --all
|
|
|
|
fmt-check:
|
|
$(CARGO) fmt --all -- --check
|
|
|
|
clippy lint:
|
|
$(CARGO) clippy --workspace -- -D warnings
|
|
|
|
clean:
|
|
$(CARGO) clean
|
|
|
|
# ─── Pre-push CI gate ──────────────────────────────────────────────────────
|
|
#
|
|
# These targets run the same checks GitHub Actions runs, locally. The intent
|
|
# is: if `make ci-precheck` is green, `git push` will not turn red. The
|
|
# 2026-04-27 push surfaced five CI breaks (cargo fmt drift, x86_64-apple-
|
|
# darwin wheel, headroom._core not built in test-extras + smoke-test,
|
|
# commitlint footer-leading-blank). The first three are caught by the gates
|
|
# below; the last two are caught by the workflow fixes themselves.
|
|
#
|
|
# Run before EVERY `git push`. Install the git hook (one-time) with:
|
|
# make install-git-hooks
|
|
|
|
ci-precheck: ci-precheck-rust ci-precheck-python ci-precheck-commitlint
|
|
@echo ""
|
|
@echo "✅ ci-precheck PASSED — safe to push."
|
|
|
|
ci-precheck-rust:
|
|
@echo "── ci-precheck-rust ────────────────────────────────────────────"
|
|
$(CARGO) fmt --all -- --check
|
|
$(CARGO) clippy --workspace -- -D warnings
|
|
$(CARGO) test --workspace
|
|
|
|
# Mirrors the smart_crusher-affected test files we expect green on every
|
|
# push. Builds the Rust extension first because most of these tests
|
|
# instantiate `SmartCrusher`, which hard-imports `headroom._core`.
|
|
ci-precheck-python:
|
|
@echo "── ci-precheck-python ─────────────────────────────────────────"
|
|
@if [ -z "$$VIRTUAL_ENV" ]; then \
|
|
echo "error: activate a venv first (e.g. source .venv/bin/activate)"; \
|
|
exit 1; \
|
|
fi
|
|
bash scripts/build_rust_extension.sh
|
|
$(PYTHON) -m pytest -q \
|
|
tests/test_transforms/test_smart_crusher_bugs.py \
|
|
tests/test_transforms/test_smart_crusher_rust_parity.py \
|
|
tests/test_transforms/test_diff_compressor.py \
|
|
tests/test_transforms/test_diff_compressor_rust_parity.py \
|
|
tests/test_relevance.py \
|
|
tests/test_relevance_extra.py \
|
|
tests/test_ccr.py \
|
|
tests/test_acceptance.py \
|
|
tests/test_critical_fixes.py \
|
|
tests/test_quality_retention.py \
|
|
tests/test_toin_integration.py
|
|
|
|
# Lint commits since `origin/main`. Requires npx (Node 18+) on PATH.
|
|
# Skips silently if npx is unavailable; install nodejs to enable.
|
|
ci-precheck-commitlint:
|
|
@echo "── ci-precheck-commitlint ─────────────────────────────────────"
|
|
@if ! command -v npx >/dev/null 2>&1; then \
|
|
echo "skip: npx not on PATH (install node 18+ to enable commitlint pre-check)"; \
|
|
exit 0; \
|
|
fi
|
|
@if ! git rev-parse --verify origin/main >/dev/null 2>&1; then \
|
|
echo "skip: origin/main not fetched (run 'git fetch origin main')"; \
|
|
exit 0; \
|
|
fi
|
|
npx --yes --package=@commitlint/cli --package=@commitlint/config-conventional -- \
|
|
commitlint --from origin/main --to HEAD --config .commitlintrc.json
|
|
|
|
install-git-hooks:
|
|
@scripts/install-git-hooks.sh
|