Skip to content

feat(runtime): automatically scale CPU work and prepare 0.89.0 - #393

Merged
fylorn merged 3 commits into
mainfrom
codex/automatic-runtime-memory
Nov 3, 2026
Merged

fylorn merged 3 commits into
mainfrom
codex/automatic-runtime-memory

Conversation

@fylorn

@fylorn fylorn commented Nov 3, 2026 •

Copy link
Copy Markdown
Contributor

What this changes

Prepare Core 0.89.0 with automatic resource scheduling: keep up to eight permanent I/O workers, expand CPU execution to the available parallelism within a memory budget, and retire surplus execution and plugin threads after ten idle seconds. Use mimalloc, disable transparent huge pages for the Linux Core process where permitted, and admit request buffering by bytes with retryable 429 responses under pressure; existing configurations need no changes.

Why

An almost idle 80-core server can retain excessive memory through per-thread allocation arenas. Reducing permanent workers must preserve the ability to use its CPUs under load, including concurrent small-body scans and sandbox calls. Transparent huge pages also inflate sparse small-object heaps on Linux, so the allocator policy must keep the physical footprint low without changing host settings.

Fixes #392.

How it was verified

  • GitHub CI: Windows, macOS, Linux, shared-crate compatibility with Enterprise, formatting/type checks, and RustSec audit.
  • macOS: all 4,328 tests and 86 real-binary smoke checks pass.
  • Linux: all 4,325 tests and 86 smoke checks pass, including the process THP policy test. Smoke RSS is 89 MiB against the unchanged 150 MiB limit.
  • Local workspace Clippy with warnings denied, release-note tests, and the system-allocator comparison build pass.
  • Scheduling tests demonstrate 80 concurrent CPU calls with two I/O workers, timer progress, idle thread retirement and renewed plugin demand. Budget tests cover cancellation, shared buffer lifetime and incremental decompression.
  • Smoke verifies redaction, dangerous tool-call refusal, stored-body masking, forwarding, control authentication and shutdown. UUID regression preserves identifier privacy without treating ordinary IDs as credential-exfiltration evidence.

Notes for review

CPU and memory ceilings are selected at startup; execution threads follow demand during operation. The byte budget estimates buffering and parsing overhead rather than imposing a hard process RSS ceiling. Tests use a simulated 80-core policy; throughput and long-term RSS have not been measured on an actual 80-core Linux host. Control-plane and store schemas stay unchanged.

Order and trace UUIDs must stay redacted without becoming evidence of credential exfiltration. Cover canonical and compact IDs in the tool check and document format boundaries, observation mode and saved-credential handling.
Keep a small permanent I/O scheduler while CPU work can use the available cores within a memory-based admission budget. Promote concurrent small-body scans as well as large requests, and let surplus execution and sandbox threads retire after ten idle seconds.

Use mimalloc by default and retain body-byte reservations through shared buffers and incremental decompression. Return retryable 429 responses under buffering pressure instead of letting concurrent bodies grow without admission. Prepare version 0.89.0 and document the automatic policy.

Fixes #392
Sparse allocator heaps can keep whole transparent huge pages resident and exceed the existing Linux smoke memory limit even after traffic has settled. Disable THP for the Core process before worker creation and stop mimalloc from explicitly requesting it. This preserves system settings and requires no user configuration.

Keep the 150 MiB smoke limit and add a Linux test for the process policy. The system-allocator comparison build remains unaffected.
@fylorn
fylorn merged commit c66a3b0 into main Nov 3, 2026
7 checks passed
@fylorn
fylorn deleted the codex/automatic-runtime-memory branch November 3, 2026 05:00
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 3, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

内存占用高:glibc 的 80 个 arena 不归还,建议换 mimalloc 并支持限制 worker 线程数

1 participant