Orchestrata Ultimate › Plans › briefs › kimi-c2-result

Kimi task C2 — twin-bug sweep results

Source: plans/briefs/kimi-c2-result.md at 8a2cb42ad · last changed 2026-07-27 · first committed 2026-07-22 · 220 lines.

Prose pending.

Plan text

Kimi task C2 — twin-bug sweep results

Generated from a repo-wide sweep of tests/ + src/orchestrata_ultimate/ for bind/listen/serve sites and a cross-check of every MERGE (:<Label> {…}) against knowledge_graph/canonical_schema.py.

Part 1 — fixed ports bound by tests across parallel batches

Method

• Searched for add_insecure_port, socket.bind, websockets.serve, uvicorn.run/uvicorn.Server, asyncio.start_server, HTTPServer, TCPServer, and bare serve() calls.
• Traced each port back to its source: dynamic (bind((host, 0)) / _free_port()), environment variable, or literal default.
• Classified "worker-slot-scoped" as: value varies by ORCHESTRATA_WORKER_SLOT via the remap in tests/conftest.py (currently NEO4J_URI and KG_GRPC_PORT).
• Excluded shared infra ports a test merely connects to, per the brief (Redis 6379, Neo4j 7687, gateway 8765, kernel/CXP_GRPC_PORT 50053), unless the test itself binds one.

Findings

• ~80 test-side bind/listen/serve sites use dynamic port allocation (socket.bind((..., 0)) or a local _free_port() helper). These are safe and are summarized in the note below rather than tabulated individually.
• 1 test-side site reads an env var: tests/knowledge_graph/test_server.py binds KG_GRPC_PORT. This is the known Workstream A issue; tests/conftest.py now remaps it per worker slot (gwN → base+N), so it is worker-slot-scoped.
• 5 source-side bind sites are reachable from tests; their port sources are shown in the table.

Port-source table (non-dynamic / env-driven sites only)

Dynamic-port sites (safe — not collision candidates)

The following patterns were found repeatedly and all bind port 0 or a _free_port() / _find_free_port() value:

• tests/agents/test_kernel_handler.py:35, test_kernel_handler_memory.py:118, test_runtime_main.py:60, test_web_tools.py:133
• tests/cxp/test_grpc.py:63, test_grpc_client.py:62, test_grpc_fields.py:65, test_grpc_kernel_endpoint.py:101, test_proto_grpc.py:54 (bind) and :67/:89/:114/:137/:158/:203/:231/:263 (add_insecure_port with f-string built from _free_port()), test_websocket.py, test_ws_client.py
• tests/gateway/conftest.py:18/:54, test_cli_behavioral.py, test_server_behavioral.py, test_server_coverage_wave.py, test_server_integration.py, handlers (test_cxp.py, test_cxp_kernel_dispatch.py, test_orchestrator_kernel_dispatch.py, test_state.py, test_volk.py), test_audit_behavioral.py, test_kernel_reply_consumer.py, test_cli_coverage_wave.py
• tests/generated_recovery/test_gateway_auth_handler.py
• tests/governance/e2e/test_policy_evaluator_dispatcher_enforcement_proof.py, test_escalation_handler.py
• tests/harness/test_cxp_live.py:58
• tests/infrastructure/kernel.py:23, test_kernel_infra.py:37
• tests/kernel/test_cli_main.py, test_cli_main_extended.py, test_cli_main_kernel_boot.py, test_dispatcher.py, test_dispatcher_expanded.py, test_dispatcher_policy_audit.py, test_kernel_defect_regressions.py, test_pipeline_expanded.py, test_pipeline_kg.py
• tests/llm/test_client_extended.py:69
• tests/postman/test_sync_router.py:280
• tests/scripts/conftest.py:103/:109, test_start_test_services.py:106/:176/:227
• tests/semantic_graph/conftest.py:238/:244, test_memgraph_adapter.py
• tests/tools/test_remote_trigger_tool.py:99/:533/:684
• tests/verification/integrations/test_redis_manager.py:56

These are not tabulated individually because every one uses dynamic allocation.

Part 1 summary line

Part 1: 3 candidate ports (3 new).

• New candidates: src/orchestrata_ultimate/cxp/ws_server.py:200 (default 8765), src/orchestrata_ultimate/gateway/http_surface.py:89 (GATEWAY_HTTP_PORT 8766), src/orchestrata_ultimate/semantic_graph/ha_controller_cli.py:177 (MEMGRAPH_HA_PORT 8080).
• Known / in-flight (now worker-slot-scoped, not a current candidate): tests/knowledge_graph/test_server.py (KG_GRPC_PORT 50052).

Part 2 — uniqueness-constraint labels vs MERGE keys

Canonical constraints source

Uniqueness constraints are taken from src/orchestrata_ultimate/knowledge_graph/canonical_schema.py (CANONICAL_MERGE_KEYS), rendered by _constraint_ddl() and exposed through get_all_ddl(). There are 70 canonical (label, key) pairs; the full list is:

(Constraints are also applied by scripts/migrate_neo4j_canonical.py and the kg_schema.py apply step invoked from scripts/bootstrap_graphs.py.)

MERGE / constraint mismatches found

Swept src/orchestrata_ultimate/ and scripts/ for MERGE (:<Label> {<key>: …}) on canonical labels and compared the MERGE key to the canonical constraint key.

Known File/Directory self-check

The brief's known instances are the historical File/Directory mismatch (File/Directory MERGEd on id while the constraint was on path). The canonical_schema.py ruling has since been updated: File and Directory now have canonical keys id (file_id / directory_id constraints), and the old file_path / directory_path constraints were removed from knowledge_graph/schema.py.

Part 2 summary line

Part 2: 10 mismatches (10 new).

The 3 known File/Directory sites are included as a self-check; they are now aligned with the canonical id constraint and no longer constitute mismatches.

Related

• Plans
• Orchestrata Ultimate — project index
• Workflow
• Tasks