feat(daemon): let supervisors check monitor runtimes without a request

[clvsh]

PR 4a of the monitor stack, on top of #412. It adds what the cutover PR (4b) needs from the monitor engine. Production behavior doesn't change; nothing calls these yet.

What's added

• live_runtime(paths, subject) reports a monitor's runtime (its instance and pid) without sending the monitor a request. It reads the monitor's record and checks that the boot session, the monitor's start identity and the runtime's start identity all still match.
  • An identity lookup never finds a process that has exited, and a monitor reaps its runtime only after recording the exit. So Some means the monitor is alive and its runtime has not exited.
  • It is synchronous on purpose. The supervisor's ownership checks, the Caddy admin verifier and the health scan are all synchronous, so 4b can call it from them without making 20-odd call sites async.
• recorded_monitor_subjects(paths) lists the monitors that have published a record. Disable and uninstall will use it in 4b.
• MonitorHooks.lifeline_fd: test hooks can supply the test process's lifeline for monitors whose controller passes none. A daemon running inside a test starts runtimes without a lifeline, so this is how 4b's daemon tests will still clean up when a test dies. Production pv always uses the default hooks.

Why this PR is small

The plan had 4a also rewrite the runtime test fixtures so they would work both before and after the cutover. That would have been throwaway work. Once runtimes run under monitors, the test lifeline cleans up every runtime when a test process exits. Most of the pid-file fixture guards (about 430 lines in gateway_reconciliation.rs alone) then get deleted in 4b rather than rewritten.

MonitorState doesn't gain an instance field either. The state reply's envelope already carries instance, and the flattened state would emit it twice. 4b reads the instance through live_runtime instead.

Test plan

• The main lifecycle test now covers both new functions. live_runtime matches the record while the runtime runs and returns None once the monitor only holds the exit. recorded_monitor_subjects lists the subject before release and nothing after it.
• The closed-lifeline test now passes the lifeline through the hooks, as 4b's daemon tests will.
• Monitor tests: --stress-count 5, all passed.
• Full suite: 1654 passed. cargo clippy --workspace --all-targets --all-features --locked -- -D warnings, cargo fmt --all --check and cargo shear are clean.

Summary by CodeRabbit

• New Features
  • Monitor status can identify active runtime instances and list subjects with recorded monitor data. Monitor controls are available on more supported platforms.
  • Fake runs can simulate descendants holding resident memory.
• Bug Fixes
  • Runtime status is reported only when the recorded monitor and runtime processes match their expected identities and the record belongs to the current boot.
  • Monitors clean up when their lifeline closes, and stopping a runtime retains its monitor record until release.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: 83054f09-a26c-4cd0-8b74-e1f4292af53b

---

📥 Commits

Reviewing files that changed from the base of the PR and between e8299ad and f5ccf6f.

---

📒 Files selected for processing (1)

• crates/daemon/tests/monitor.rs

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 7 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The monitor module adds APIs to query live runtime state and recorded monitor subjects. It also supports a lifeline descriptor supplied through monitor hooks. Tests check runtime state across stop and release, and exercise the hook-provided lifeline descriptor.

Changes

Monitor runtime and lifeline

Layer / File(s)	Summary
Expose and validate monitor runtime state crates/daemon/src/lib.rs, crates/daemon/src/monitor.rs, crates/daemon/src/monitor/macos.rs, crates/daemon/tests/monitor.rs	The monitor exports add LiveRuntime, live_runtime, and recorded_monitor_subjects. Runtime lookup checks the current boot and recorded process identities. Tests verify runtime and recorded-subject state before and after stop and release.
Select lifeline from monitor hooks crates/daemon/src/monitor.rs, crates/daemon/src/monitor/macos.rs, crates/daemon/tests/monitor.rs	MonitorHooks adds an optional lifeline descriptor. Monitor startup uses the request descriptor when present and otherwise uses the hooks descriptor. The lifeline test exercises the hooks-provided descriptor.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Feature

---

Merge Risk | ⚪ Minimal · up to f5ccf

Merge Risk: ⚪ Minimal · up to f5ccf

The monitor discovery and hook-lifeline changes show no identified material regression, and the fallback test checks cleanup. The PR appears ready to merge after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to f5ccf

The changes add local runtime discovery and test cleanup support without introducing production callers. Process discovery remains a snapshot, not proof that startup completed or a guarantee of continuing ownership. Later integrations must preserve that distinction.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The added discovery functions read local monitor records and process identities; they do not themselves signal processes or expose a new network handler. The lifeline change affects cleanup for a monitor whose trusted startup hooks supply a descriptor. No new remote or cross-tenant reachability was established in this change.

Trust Boundaries and Controls

• observed — The existing mutable command path checks the peer UID, protocol version, and monitor instance before dispatch. Release remains gated on completed cleanup. The new read-only queries do not replace these command controls.

Hardening Proposals

• proposed — For the later cutover, document discovery as a snapshot and keep startup readiness separate. Consumers performing privileged actions should use instance-authenticated commands or revalidate process identity immediately before acting rather than treating the returned PID as durable authority.

---

Pre-merge checks | 4 | 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding supervisor access to monitor runtime information without sending a request.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

---

---

---

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-10T17:40:56.190483Z	f5ccf6f	New commits
🔒 Security Review	✅ Completed 2026-10-10T04:41:06.380599Z	e8299ad	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codspeed]

Merging this PR will not alter performance

✅ 7 untouched benchmarks

---

_{Comparing feat/service-monitor-prep (f5ccf6f) with feat/service-monitor-core (388e7a9)¹}

Footnotes

1. No successful run was found on feat/service-monitor-core (f9a9f59) during the generation of this report, so 0978115 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[pullfrog]

✅ No new issues found.

Reviewed changes Review covered all four changed files and traced record publication, process identity inspection, exit handling, recovery, and test lifeline inheritance.

• Synchronous runtime inspection: live_runtime returns the recorded instance and runtime PID only when the boot session and both process start identities match, without querying the monitor.
• Recorded subject enumeration: recorded_monitor_subjects lists published records in sorted order while ignoring reservation files and unpublished directories, preserving errors for invalid records.
• Test lifeline fallback and coverage: Hooks supply a lifeline when the start request provides none, and the integration tests cover live/post-stop inspection, enumeration, and hook-driven cleanup.

cargo fmt --all --check passed. The changed process tests are macOS-only and could not run on this Linux runner; macOS CI was still pending when inspected.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}