Dividing the interface into projects does not isolate execution if every run shares one busy flag. I extracted the ownership rule behind Northstar project lanes into an independent Python example. It starts no external work: it models which run owns a lane, what a stop request means and who may release that ownership.
Give each project one occupied place
Claim takes a project and run label and returns a lease. A second claim for an occupied project is rejected, while another project can own its independent lane. There is no automatic queue or deferred replay. A caller receiving busy must decide what to inspect or tell the user.
Submitting the same run label also does not recover an existing lease. Reconnection needs a separate execution journal; convenient name-based reuse would let a caller appear to inherit a run merely by matching its label. Labels describe the run for people, while a distinct ownership token controls release.
Question the late cleanup from an older run
After an old run finishes, a new run can occupy the same project. If delayed cleanup removes state by project name alone, it can erase the new owner. The module compares token object identity and run label with the currently held lease. Even reusing a run label produces a different token.
Views omit the token and the lease representation hides it. This is still no security boundary against code that can inspect the same Python process. Ownership here prevents accidental cross-run calls. An integration for mutually untrusted users needs real authentication and an appropriate process boundary, not confidence in a private-looking field.
Keep a stop request distinct from a finished run
Request stop records a flag while keeping the lane occupied. It cannot terminate a process or browser. Allowing the next claim immediately after a stop button would permit overlapping work while the original external operation remains unresolved. Delivery of cancellation and confirmation of termination belong in the adapter.
A stop can race with an already completed success. Release therefore allows success with the stop-request flag retained. The caller supplies the outcome, and the receipt explicitly reports that no work was executed here. It records metadata cleanup rather than certifying business success, cancellation or reversal of earlier effects.
Explore the implementation
Complete independent synthetic implementation
"""One-process project lanes with ownership and explicit stop-request state."""
from dataclasses import dataclass, field
from threading import RLock
import re
class LaneError(ValueError):pass
def _label(value):
if not isinstance(value,str) or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._-]{0,79}',value):raise LaneError('INVALID_LABEL')
@dataclass(frozen=True,eq=False)
class Lease:
project:str
run:str
_token:object=field(repr=False)
class ProjectLanes:
def __init__(self):
self._lock=RLock()
self._active={}
def claim(self,project,run):
_label(project);_label(run)
with self._lock:
if project in self._active:raise LaneError('PROJECT_BUSY')
lease=Lease(project,run,object())
self._active[project]={'lease':lease,'stop_requested':False}
return lease
def _owned(self,lease):
if type(lease) is not Lease:raise LaneError('INVALID_LEASE')
item=self._active.get(lease.project)
if not item or item['lease']._token is not lease._token or item['lease'].run!=lease.run:raise LaneError('LEASE_NOT_CURRENT')
return item
def request_stop(self,lease):
with self._lock:
item=self._owned(lease)
item['stop_requested']=True
return self.view(lease.project)
def release(self,lease,outcome):
if outcome not in ['succeeded','failed','cancelled','needs_review']:raise LaneError('INVALID_OUTCOME')
with self._lock:
item=self._owned(lease)
receipt={'project':lease.project,'run':lease.run,'outcome':outcome,'stop_requested':item['stop_requested'],'work_executed_here':False}
del self._active[lease.project]
return receipt
def view(self,project):
_label(project)
with self._lock:
item=self._active.get(project)
return {'project':project,'busy':bool(item),**({'run':item['lease'].run,'state':'stop_requested' if item['stop_requested'] else 'running'} if item else {})}
Serialize the short metadata transition
An instance-local reentrant lock protects claims, stop flags, releases and views. No network request or long-running business operation executes under that lock. One test releases eight threads from a barrier to claim the same project and requires exactly one winner. This checks the metadata transition within this process.
The twenty-one tests cover independent projects, isolation of stop requests, stale release and stop rejection, reused run labels, foreign-manager leases and fabricated tokens. Invalid outcomes must retain occupancy, and editing a returned view must not mutate internal state. These tests establish the module contract, not concurrency safety at an external service.
Retain five actual local example records
The examples exercise independent claims, a busy project, a stop request that keeps occupancy, an explicit final outcome and a late stale release. The selector reads five records generated by local Python. It neither accesses visitor files and sessions nor starts execution. Readers can inspect which other project remains untouched.
The ZIP is extracted into another folder, checked against source hashes and tested with the same twenty-one cases. Initial and selected records in both language viewers are compared using DOM stubs. Displaying saved records, executing module code and inspecting a rendered browser remain separate verification scopes. This content work does not rerun the original Northstar application tests.
Connect recovery and durable execution records separately
The standard-library package includes full implementation, tests, examples, generated records and README, with modification and reuse permitted. It is newly authored around the ownership idea in Northstar; stop state and outcome receipts are added for this explanation. It is not a copied production runner.
Occupancy disappears when this in-memory process exits. No multiprocess lock, durable journal, scheduler or crash recovery is supplied. Releasing with an unresolved outcome does not authorize replay of an uncertain external action. A real system must retain termination evidence and unresolved runs separately. An empty lane and permission to repeat business work are distinct conclusions.