headroom/tests/test_platform_stabilization_functional.py
Abhay Singh c5a08d22e0
fix(proxy): time-cap the compression timeout-debt quarantine (#2360) (#2412)
## Description

Fixes #2360.

The proxy runs compression on a bounded thread-pool executor with a
per-request deadline. Because Python cannot preempt a worker after its
`asyncio.wait_for` times out, the code quarantines new compression while
a timed-out worker is still running (`_compression_timed_out_in_flight >
0`), to avoid piling more work onto a saturating executor.

The gap: that counter only decrements when the worker finally exits. A
worker that **never returns** — a hung or pathological compression of a
large frame — keeps the counter above zero forever, so the quarantine
stays open permanently and every subsequent compression raises
`CompressionQuarantinedError`. On Codex WS this is exactly what #2360
reports: one 5s timeout, then Token Savings pinned at ~0% with no
recovery, even though the machine is fine.

The "parity with direct upstream" nature of the accounting was correct;
the only missing piece is an upper bound on how long a single stuck
worker may hold the quarantine.

## Fix

Add a time cap on the quarantine:

- A deadline (`_compression_quarantine_deadline`) is (re)armed on every
fresh timeout, to `now + HEADROOM_COMPRESSION_QUARANTINE_MAX_SECONDS`
(default **60s**).
- The gate quarantines only while `timed_out_in_flight > 0` **and** `now
< deadline`. Once the deadline lapses with no new timeouts, the worker
is presumed leaked/abandoned and compression resumes. The release is
counted once (a `"released"` quarantine metric + a warning), and the
deadline is cleared so it is not re-counted on every later request.
- The bounded executor still caps thread growth, and any new timeout
re-arms the quarantine, so ongoing genuine slowness keeps quarantining
while a single hung worker cannot pin it forever.

This preserves the original protection (a burst of slow compressions
still quarantines) while guaranteeing recovery.

## Type of Change

- [x] Bug fix (non-breaking change that fixes an issue)
- [ ] New feature (non-breaking change that adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
- [ ] Performance improvement
- [ ] Code refactoring (no functional changes)

## Changes Made

- `headroom/proxy/server.py`: add `_compression_quarantine_deadline` /
`_compression_quarantine_max_seconds` (from
`HEADROOM_COMPRESSION_QUARANTINE_MAX_SECONDS`, default 60s) and
`_compression_quarantine_releases`; arm the deadline when timeout debt
is recorded; release the quarantine (once) in the gate when the deadline
lapses.
- `tests/test_platform_stabilization_functional.py`: add a test that a
standing timed-out worker quarantines within the cap and releases
(running compression again, counted once) past it.

## Testing

- [x] Unit tests pass (`pytest`)
- [x] Linting passes (`ruff check .`)
- [x] Type checking passes (`mypy headroom`)
- [x] New tests added for new functionality
- [ ] Manual testing performed

### Test Output

```text
$ uvx ruff@0.15.17 check headroom/proxy/server.py tests/test_platform_stabilization_functional.py
All checks passed!
$ uvx mypy@1.20.2 --ignore-missing-imports headroom/proxy/server.py
Success: no issues found in 1 source file
```

## Real Behavior Proof

- Environment: Windows 11, Python 3.12, `uvx ruff@0.15.17` / `uvx
mypy@1.20.2`. A full `pytest` here imports the ML stack and OOMs this
box, so I modeled the gate/deadline state machine with a dependency-free
script and left the added `create_app` test to CI.
- Exact command / steps: simulated a standing timed-out worker, then
exercised the gate at times within the cap, past the cap, and after a
fresh timeout, plus a normal worker exit.
- Observed result: within the cap the gate quarantines (raises); past
the cap it releases exactly once and then lets compression run; a new
timeout re-arms the quarantine; a normal worker exit clears the debt.
Matching the added handler test (`_run_compression_in_executor` raises
`CompressionQuarantinedError` within the cap and returns the callable's
result past it, with `_compression_quarantine_releases == 1`).
- Not tested: a live Codex WS session hanging a real worker; the added
test drives `_run_compression_in_executor` directly with the quarantine
state set.

## Review Readiness

- [x] I have performed a self-review
- [x] This PR is ready for human review

## Checklist

- [x] My code follows the project's style guidelines
- [x] I have performed a self-review of my code
- [x] I have commented my code, particularly in hard-to-understand areas
- [ ] I have made corresponding changes to the documentation
- [x] My changes generate no new warnings
- [x] I have added tests that prove my fix is effective or that my
feature works
- [ ] New and existing unit tests pass locally with my changes
- [x] I have updated the CHANGELOG.md if applicable

## Additional Notes

The default cap (60s) is deliberately well above a normal
slow-but-completing compression so the original saturation protection is
unchanged in practice; it only ever fires for a worker that has run far
past its deadline. Tunable via
`HEADROOM_COMPRESSION_QUARANTINE_MAX_SECONDS`. The `"released"`
quarantine metric and a one-time warning make the recovery observable.
The "unit tests pass locally" box is unchecked because the added
`create_app` test imports the ML stack (OOM on this box); it runs under
the normal CI job, and the state machine is verified by the standalone
proof above.
2026-08-12 00:05:56 -05:00

202 lines
7.3 KiB
Python

from __future__ import annotations
import json
import time
from typing import Any
import pytest
pytest.importorskip("fastapi")
pytest.importorskip("headroom._core")
from fastapi.testclient import TestClient
from headroom.config import TransformResult
from headroom.proxy.server import ProxyConfig, create_app
def _proxy_config(**overrides: Any) -> ProxyConfig:
defaults: dict[str, Any] = {
"optimize": True,
"cache_enabled": False,
"rate_limit_enabled": False,
"cost_tracking_enabled": False,
"log_requests": False,
"ccr_inject_tool": False,
"ccr_handle_responses": False,
"ccr_context_tracking": False,
"image_optimize": False,
"disable_kompress": True,
"compression_max_workers": 1,
}
defaults.update(overrides)
return ProxyConfig(**defaults)
def test_proxy_health_surfaces_compression_runtime_metrics(monkeypatch) -> None:
monkeypatch.setenv("HEADROOM_SKIP_UPSTREAM_CHECK", "1")
app = create_app(_proxy_config(optimize=False))
with TestClient(app, base_url="http://127.0.0.1", client=("127.0.0.1", 12345)) as client:
live = client.get("/livez")
health = client.get("/health")
assert live.status_code == 200
assert live.json()["alive"] is True
assert health.status_code == 200
runtime = health.json()["runtime"]
assert runtime["compression_executor"]["max_workers"] == 1
assert runtime["compression_executor"]["queued"] == 0
assert runtime["compression_executor"]["queue_timeouts_total"] == 0
def test_v1_compress_success_reports_actual_metrics(monkeypatch) -> None:
monkeypatch.setenv("HEADROOM_SKIP_UPSTREAM_CHECK", "1")
app = create_app(_proxy_config())
proxy = app.state.proxy
request_messages = [{"role": "user", "content": "summarize this repeated payload"}]
compressed_messages = [{"role": "user", "content": "summary payload"}]
ccr_hash = "abc123def4567890abc123de"
def fake_apply(**kwargs):
assert kwargs["messages"] == request_messages
assert kwargs["model"] == "gpt-4o"
return TransformResult(
messages=compressed_messages,
tokens_before=100,
tokens_after=40,
transforms_applied=["test:compress"],
markers_inserted=[ccr_hash],
)
# The default /v1/compress mode runs a marker-free pipeline derived from
# `openai_pipeline`, not `openai_pipeline` itself, so patch the one the
# route actually uses. It is built eagerly at create_app() time.
monkeypatch.setattr(proxy._compress_pipeline_cache["no_ccr"], "apply", fake_apply)
with TestClient(app, base_url="http://127.0.0.1", client=("127.0.0.1", 12345)) as client:
response = client.post(
"/v1/compress",
json={"model": "gpt-4o", "messages": request_messages},
)
body = response.json()
assert response.status_code == 200
assert body["messages"] == compressed_messages
assert body["tokens_before"] == 100
assert body["tokens_after"] == 40
assert body["tokens_saved"] == 60
assert body["compression_ratio"] == 0.4
assert body["transforms_applied"] == ["test:compress"]
assert body["transforms_summary"] == {"test:compress": 1}
assert body["ccr_hashes"] == [ccr_hash]
def test_v1_compress_timeout_fails_open_quickly(monkeypatch) -> None:
monkeypatch.setenv("HEADROOM_SKIP_UPSTREAM_CHECK", "1")
app = create_app(_proxy_config())
proxy = app.state.proxy
request_messages = [{"role": "user", "content": "do not mutate me"}]
async def timeout_executor(fn, *, timeout): # noqa: ANN001
raise TimeoutError("compression deadline exceeded")
monkeypatch.setattr(proxy, "_run_compression_in_executor", timeout_executor)
with TestClient(app, base_url="http://127.0.0.1", client=("127.0.0.1", 12345)) as client:
started = time.perf_counter()
response = client.post(
"/v1/compress",
json={"model": "gpt-4o", "messages": request_messages},
)
elapsed = time.perf_counter() - started
body = response.json()
assert response.status_code == 200
assert elapsed < 0.5
assert body["messages"] == request_messages
assert body["tokens_saved"] == 0
assert body["compression_ratio"] == 1.0
assert body["transforms_applied"] == []
assert body["compression_skipped"] is True
assert body["skip_reason"] == "compression_timeout"
def test_v1_compress_real_json_tool_payload_reduces_tokens(monkeypatch) -> None:
monkeypatch.setenv("HEADROOM_SKIP_UPSTREAM_CHECK", "1")
app = create_app(
_proxy_config(
ccr_inject_marker=False,
min_tokens_to_crush=20,
max_items_after_crush=10,
)
)
items = [
{
"id": i,
"status": "ok",
"score": i % 5,
"message": "same repeated value " * 20,
}
for i in range(80)
]
request = {
"model": "gpt-4o",
"messages": [
{"role": "user", "content": "summarize rows"},
{
"role": "assistant",
"content": None,
"tool_calls": [
{
"id": "call-1",
"type": "function",
"function": {"name": "list_rows", "arguments": "{}"},
}
],
},
{"role": "tool", "tool_call_id": "call-1", "content": json.dumps(items)},
],
}
with TestClient(app, base_url="http://127.0.0.1", client=("127.0.0.1", 12345)) as client:
response = client.post("/v1/compress", json=request)
body = response.json()
assert response.status_code == 200, response.text
assert body["tokens_before"] > body["tokens_after"], body
assert body["tokens_saved"] > 0
assert body["compression_ratio"] < 1.0
assert body["transforms_applied"], body
def test_compression_quarantine_releases_after_time_cap(monkeypatch) -> None:
"""A leaked/hung timed-out worker must not pin the quarantine open forever:
once the time cap lapses, compression resumes and the release is counted
once (#2360)."""
import asyncio
from headroom.proxy.server import CompressionQuarantinedError
monkeypatch.setenv("HEADROOM_SKIP_UPSTREAM_CHECK", "1")
app = create_app(_proxy_config())
proxy = app.state.proxy
# Simulate a timed-out worker that is still running (debt standing).
proxy._compression_timed_out_in_flight = 1
# Within the cap: new compression is quarantined.
proxy._compression_quarantine_deadline = time.monotonic() + 1000.0
with pytest.raises(CompressionQuarantinedError):
asyncio.run(proxy._run_compression_in_executor(lambda: "unused", timeout=5.0))
assert proxy._compression_quarantine_releases == 0
# Past the cap: the worker is presumed leaked and compression runs again;
# the release is recorded once.
proxy._compression_quarantine_deadline = time.monotonic() - 1.0
assert asyncio.run(proxy._run_compression_in_executor(lambda: "ran", timeout=5.0)) == "ran"
assert proxy._compression_quarantine_releases == 1
# A subsequent request is not re-counted and still runs.
assert asyncio.run(proxy._run_compression_in_executor(lambda: "ok", timeout=5.0)) == "ok"
assert proxy._compression_quarantine_releases == 1