You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "Siyao Meng (Jira)" <ji...@apache.org> on 2026/09/15 23:58:00 UTC
[jira] [Updated] (HDDS-16428) Formal verification for Ozone OM read consistency (follower reads and hsync lease commit) with TLA+
[ https://issues.apache.org/jira/browse/HDDS-16428?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Siyao Meng updated HDDS-16428:
------------------------------
Description:
Use TLA+ (via the Specula pipeline) to model and verify OM read consistency: follower read visibility under LINEARIZABLE and LINEARIZABLE_ALLOW_FOLLOWER, and the hsync lease commit path. Model check the specification and validate real OM traces against it. Bugs found by this effort are linked under this issue.
h3. Run environment
{noformat}
Ozone commit: 9fbf9ee0cb1bd2f5f5d437b6719ebbe5309351fb
Specula: v1.1.0 (commit c6aa3dfa)
Agent/model: claude-code, Claude Opus 4.8 (1M context)
{noformat}
h3. Coverage
||Target||Effort||Guidance||Result||
|om-follower-read|high|{{campaigns/ozone-9fbf9ee/targets/001-om-follower-read/.prompt-extra.md}}|3 findings, all ENV_LIMITED High (HDDS-16435)|
|om-hsync-lease-commit|high|{{campaigns/ozone-9fbf9ee/targets/003-om-hsync-lease-commit/.prompt-extra.md}}|No findings|
h3. Reproduce
{code:none}
specula run --agent=claude-code --effort=high --keep-original --max-parallel=2 \
--enable-reviews --confirm-debate --tlc-memory-limit=28G --tlc-worker-limit=8 \
"<target>|apache/ozone|Java|Use the target-specific .prompt-extra.md"
{code}
h3. Bugs (link via "Testing discovered")
* (ENV_LIMITED, High) HDDS-16435: under LINEARIZABLE_ALLOW_FOLLOWER a read served by a superseded leader can return stale local state. Three related model checking findings (MC-1, MC-2, CR-2) share this root cause; reachable only in the allow-follower read configuration, so env-limited rather than reproduced.
Generated with Specula (Claude Opus 4.8).
was:
Use TLA+ (via the Specula pipeline) to model and verify OM read consistency: follower read visibility under LINEARIZABLE and LINEARIZABLE_ALLOW_FOLLOWER, and the hsync lease commit path. Model check the specification and validate real OM traces against it. Bugs found by this effort are linked under this issue.
h3. Run environment
{noformat}
Ozone commit: 9fbf9ee0cb1bd2f5f5d437b6719ebbe5309351fb
Specula: v1.1.0 (commit c6aa3dfa)
Agent/model: claude-code, Claude Opus 4.8 (1M context)
{noformat}
h3. Coverage
||Target||Effort||Guidance||Result||
|om-follower-read|high|{{campaigns/ozone-9fbf9ee/targets/001-om-follower-read/.prompt-extra.md}}|3 findings, all ENV_LIMITED High (BUG_FOLLOWER_READ)|
|om-hsync-lease-commit|high|{{campaigns/ozone-9fbf9ee/targets/003-om-hsync-lease-commit/.prompt-extra.md}}|No findings|
h3. Reproduce
{code:none}
specula run --agent=claude-code --effort=high --keep-original --max-parallel=2 \
--enable-reviews --confirm-debate --tlc-memory-limit=28G --tlc-worker-limit=8 \
"<target>|apache/ozone|Java|Use the target-specific .prompt-extra.md"
{code}
h3. Bugs (link via "Testing discovered")
* (ENV_LIMITED, High) BUG_FOLLOWER_READ: under LINEARIZABLE_ALLOW_FOLLOWER a read served by a superseded leader can return stale local state. Three related model checking findings (MC-1, MC-2, CR-2) share this root cause; reachable only in the allow-follower read configuration, so env-limited rather than reproduced.
Generated with Specula (Claude Opus 4.8).
> Formal verification for Ozone OM read consistency (follower reads and hsync lease commit) with TLA+
> ---------------------------------------------------------------------------------------------------
>
> Key: HDDS-16428
> URL: https://issues.apache.org/jira/browse/HDDS-16428
> Project: Apache Ozone
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Priority: Major
>
> Use TLA+ (via the Specula pipeline) to model and verify OM read consistency: follower read visibility under LINEARIZABLE and LINEARIZABLE_ALLOW_FOLLOWER, and the hsync lease commit path. Model check the specification and validate real OM traces against it. Bugs found by this effort are linked under this issue.
> h3. Run environment
> {noformat}
> Ozone commit: 9fbf9ee0cb1bd2f5f5d437b6719ebbe5309351fb
> Specula: v1.1.0 (commit c6aa3dfa)
> Agent/model: claude-code, Claude Opus 4.8 (1M context)
> {noformat}
> h3. Coverage
> ||Target||Effort||Guidance||Result||
> |om-follower-read|high|{{campaigns/ozone-9fbf9ee/targets/001-om-follower-read/.prompt-extra.md}}|3 findings, all ENV_LIMITED High (HDDS-16435)|
> |om-hsync-lease-commit|high|{{campaigns/ozone-9fbf9ee/targets/003-om-hsync-lease-commit/.prompt-extra.md}}|No findings|
> h3. Reproduce
> {code:none}
> specula run --agent=claude-code --effort=high --keep-original --max-parallel=2 \
> --enable-reviews --confirm-debate --tlc-memory-limit=28G --tlc-worker-limit=8 \
> "<target>|apache/ozone|Java|Use the target-specific .prompt-extra.md"
> {code}
> h3. Bugs (link via "Testing discovered")
> * (ENV_LIMITED, High) HDDS-16435: under LINEARIZABLE_ALLOW_FOLLOWER a read served by a superseded leader can return stale local state. Three related model checking findings (MC-1, MC-2, CR-2) share this root cause; reachable only in the allow-follower read configuration, so env-limited rather than reproduced.
> Generated with Specula (Claude Opus 4.8).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org