fix(signoz): exclude full controller ancestry from guard

scripts/ops/tests/test_agent99_signoz_metadata_executor_runtime_entrypoint.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import re
+import shutil
 import subprocess
 from pathlib import Path
 
@@ -72,11 +73,11 @@ def test_entrypoint_uses_fixed_public_key_transport_and_no_arbitrary_shell() ->
     assert '$OperationLock = "/tmp/awoooi-signoz-backup-operation.lock"' in source
     assert '[ -f `"$OperationLock`" ] && [ ! -L `"$OperationLock`" ]' in source
     assert 'exec 8<`"$OperationLock`"; /usr/bin/flock -n 8' in source
-    assert "$TargetGuardWorstCaseSeconds = 95" in source
+    assert "$TargetGuardWorstCaseSeconds = 143" in source
     assert "$CheckVerifyTargetTimeoutSeconds = 90" in source
     assert "$ApplyTargetTimeoutSeconds = 720" in source
     assert "$CheckVerifyControllerWaitSeconds = 300" in source
-    assert "$ApplyControllerWaitSeconds = 900" in source
+    assert "$ApplyControllerWaitSeconds = 960" in source
     assert "$ControllerTransportReserveSeconds = 30" in source
     assert (
         "New-Agent99SignozLockedRemoteCommand $applyProgram "
@@ -104,8 +105,20 @@ def test_entrypoint_uses_fixed_public_key_transport_and_no_arbitrary_shell() ->
         '[ `"`$active_rc`" -eq 0 ] || [ `"`$active_rc`" -eq 1 ]'
         in lock_helper
     )
+    assert "ancestor_pattern=`$`$; ancestor_cursor=`$PPID" in lock_helper
     assert (
-        '/usr/bin/grep -Ev `"^(`$`$|`$PPID)[[:space:]]`"'
+        "for ancestor_step in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16"
+        in lock_helper
+    )
+    assert "/bin/ps -o ppid= -p" in lock_helper
+    assert (
+        "/usr/bin/timeout --signal=TERM --kill-after=1s 2s /bin/ps"
+        in lock_helper
+    )
+    assert "ancestor_complete=1; break" in lock_helper
+    assert '[ `"`$ancestor_complete`" -eq 1 ]' in lock_helper
+    assert (
+        '/usr/bin/grep -Ev `"^(`$ancestor_pattern)[[:space:]]`"'
         in lock_helper
     )
     assert "filter_rc=`$?; set -e" in lock_helper
@@ -168,16 +181,24 @@ def test_locked_process_guard_rendered_shell_behavior(
     row_scenario: str,
     expected: bool,
 ) -> None:
+    timeout_path = shutil.which("timeout")
+    assert timeout_path is not None
+    rendered_gate = _render_locked_process_gate().replace(
+        "/usr/bin/timeout", timeout_path
+    )
     setup = {
         "empty": 'active_output=""; ',
         "ancestors": (
+            'grandparent=$(/bin/ps -o ppid= -p "$PPID" | '
+            '/usr/bin/tr -d "[:space:]"); '
             'active_output="$$ bash -c fixed-export\n'
-            '$PPID sudo bash -c fixed-export"; '
+            '$PPID sudo bash -c fixed-export\n'
+            '$grandparent outer-shell fixed-export"; '
         ),
         "external": (
             'active_output="$$ bash -c fixed-export\n'
             '$PPID sudo bash -c fixed-export\n'
-            '812 python3 signoz-metadata-export.py --apply"; '
+            '99999999 python3 signoz-metadata-export.py --apply"; '
         ),
     }[row_scenario]
     completed = subprocess.run(
@@ -185,11 +206,12 @@ def test_locked_process_guard_rendered_shell_behavior(
             "/bin/bash",
             "-c",
             f"set -euo pipefail; active_rc={pgrep_rc}; {setup}"
-            f"{_render_locked_process_gate()}printf guard_accepted",
+            f"{rendered_gate}printf guard_accepted",
         ),
         check=False,
         capture_output=True,
         text=True,
+        timeout=10,
     )
     assert (completed.returncode == 0) is expected
     assert (completed.stdout == "guard_accepted") is expected
@@ -208,6 +230,41 @@ def test_locked_process_guard_rendered_filter_error_fails_closed() -> None:
         check=False,
         capture_output=True,
         text=True,
+        timeout=10,
+    )
+    assert completed.returncode != 0
+    assert completed.stdout == ""
+
+
+@pytest.mark.parametrize(
+    "replacement",
+    (
+        "/usr/bin/false",
+        "/usr/bin/printf not-a-pid",
+        "/usr/bin/printf 99999999",
+    ),
+)
+def test_locked_process_guard_ancestor_walk_faults_fail_closed(
+    replacement: str,
+) -> None:
+    gate = _render_locked_process_gate()
+    lookup = (
+        "/usr/bin/timeout --signal=TERM --kill-after=1s 2s "
+        '/bin/ps -o ppid= -p "$ancestor_cursor"'
+    )
+    assert gate.count(lookup) == 1
+    fault_injected_gate = gate.replace(lookup, replacement)
+    completed = subprocess.run(
+        (
+            "/bin/bash",
+            "-c",
+            "set -euo pipefail; active_rc=1; active_output=\"\"; "
+            f"{fault_injected_gate}printf guard_accepted",
+        ),
+        check=False,
+        capture_output=True,
+        text=True,
+        timeout=10,
     )
     assert completed.returncode != 0
     assert completed.stdout == ""
@@ -303,11 +360,11 @@ def test_entrypoint_typed_readbacks_are_exact_and_preserve_unknown_state() -> No
     assert "$RemoteResult.completed -ne $true" in source
     assert "$RemoteResult.timedOut" in source
 
-    guard = 95
+    guard = 143
     kill_after = 15
     transport_reserve = 30
     assert guard + 90 + kill_after + transport_reserve < 300
-    assert guard + 720 + kill_after + transport_reserve < 900
+    assert guard + 720 + kill_after + transport_reserve < 960
 
 
 def test_entrypoint_never_reads_or_persists_credential_value_in_controller() -> None: