Release pipeline: signed builds on builds.infraternal.com, verified payloads, add-host by architecture (D220, D224, D225) #157
Open
opened 2026-10-10 17:32:11 +00:00 by kayg
·
270 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#157
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Build x86_64 and aarch64 musl binaries, upload them to the infraternal-builds R2 bucket (served at builds.infraternal.com), have the release-signer Worker sign SHA256SUMS (SSHSIG, namespace infraternal-release), and make the binary verify signatures against both keys in release/allowed_signers before it uses a payload. Add-host per D225. The CA handoff (#154) plugs into the same verification hook.
Started #157 on release-pipeline at base/head
9fba1eb2dd(origin/release-prod-2). Read the repository contract and issue #157 (no prior comments); reading related release/update #102 and handoff #154 history. Existing Ed25519 engine is openssl (workspace dependency, server ssh_key.rs and csr.rs); no ed25519-dalek package is locked. Reuse OpenSSL rather than introduce a crypto dependency. Existing bootstrap selects adjacent musl payloads; scripts/package-release already builds both targets with auth-toolchain. No live upload, signer call or deployment will be performed.Finding/contract proposal (D224/D225): production base has no Ed25519-specific crate, but the existing openssl engine already implements Ed25519 in server ssh_key.rs/csr.rs; reuse it with no new crypto dependency. Bootstrap has Check/Install/Facts/Connect events and BinaryPaths in the SSH plugin; extend it with an injected payload source, retaining BinaryPaths for existing adapters/specs. Resolution emits the named Get the arm64 binary step before upload. Cache signed metadata and payload atomically under the existing configured state directory/releases//, reverify on each reuse. A release-build marker set only by scripts/release/build distinguishes signed release builds from local development release-profile builds; only development plus an explicit 404 for that version permits adjacent-payload fallback. First unweighted latency gate stopped at p99 361.39 ms; weighted baseline is compiling under 55.10/45.85/29.21 host load (8 cores). No load generation.
Completed trust anchors:
e56816fcb7, pushed release-pipeline. release/allowed_signers copied verbatim, 2 trusted Ed25519 keys. Baseline x86_64 static binary: 19,896,992 bytes (no binary changes yet). scripts/verify fast: fmt, VT native fmt, clippy, test, cargo-deny PASS; only pre-existing static size row FAIL. Verbatim gate conclusion:Protocol finding: the official R2 REST objects API documents GET/list/PUT/delete, not HEAD (https://developers.cloudflare.com/api/resources/r2/subresources/buckets/subresources/objects/). Publication now uses GET objects?prefix=releases//&per_page=1, validates success=true plus an empty result, and rejects any partial/unrelated object in that version. PUT bodies use application/octet-stream and their JSON success is checked before calling the signer. A per-version local publication lock serializes callers; If-None-Match:* is sent as defense but its PUT semantics are not documented for this REST endpoint, so no provider-level concurrency guarantee is claimed. No live API/Worker request was made. Verifier red compile produced 20 expected missing-API errors; implementation uses existing OpenSSL Ed25519, with a bounded 64 KiB heap read buffer, 64 KiB manifest and 1024-byte signature armor. Current weighted module gate is running.
Security finding / additive release-format proposal (D224/D225): the Worker signs only SHA256SUMS filenames/content, not the URL version. A complete valid older manifest/signature/binary replayed under another version URL would otherwise pass verification. Add a small VERSION file containing the workspace version plus newline to the release bundle; the unchanged Worker hashes/signs it automatically. Cross-architecture resolution fetches VERSION too, verifies it through the same opened-file hook, and requires an exact match to the running server version before caching/upload. A fully signed wrong-version replay becomes a regression test. This adds one small request on cold cache and a second small-file signature check on cache hits; measurements will include it. Existing binary names, signature namespace/hash and Worker code stay unchanged. No live publish or signing call.
Completed descriptor verifier:
65c13431(D184, D224). Public hook crates/infraternal-server/src/release_verify.rs::verify_release_file(&File, name, sums, sig). Reuses existing OpenSSL Ed25519; no new crypto dependency. ssh-keygen-generated keys are removed after signing, never committed. Every armor, envelope and manifest single-byte mutation, every truncation, unknown key, wrong namespace/hash and malformed/duplicate manifest are rejected. Descriptor offset remains unchanged.Baseline sizes: x86_64 19,896,992 bytes; aarch64 17,729,832 bytes. Verifier step static x86_64 remains 19,896,992 (not yet connected to runtime). Full gate: /home/kayg/.cache/codex-scratch/release-pipeline/verifier-gate-final.log.
| Rust gate | Result |
All non-size gate rows passed; pre-existing static size ceiling remains unchanged.
Publication stand-in finding: a bundle with VERSION 0.1.1 submitted as workspace 0.1.0 reached uploads before public verification failed. Failing test evidence: publish-version-red.log, assertion “wrong local version must fail before publication”. Draft publish now compares VERSION before any network mutation. All public downloads also have byte bounds (manifest 65536, signature 1024, VERSION 128, payload 128 MiB).
Cloudflare documents raw-object PUT and list-prefix/per_page=1; its upload reference does not promise If-None-Match semantics. The script checks the authoritative prefix and uses a local per-version lock, sends If-None-Match defensively, and documents that the orchestrator must serialize publishers across machines. No live API calls were made. References: https://developers.cloudflare.com/api/resources/r2/subresources/buckets/subresources/objects/methods/upload/ and https://developers.cloudflare.com/api/resources/r2/subresources/buckets/subresources/objects/methods/list/ .
Resumed #157 on release-pipeline, base
9fba1eb2dd, head65c13431. Disk space restored (41 GiB available); retained verifier/trust commits and uncommitted fuzz target. Read #157/#102 history and #154 related handoff history. Draft resolver and scripts survive in job scratch; no live uploads, Worker calls or deployment. Continuing fuzz gate, then HTTP/resolver and publication local stand-ins.Completed fuzz harness step:
7a5b2346, pushed release-pipeline. Parser harness seeds trusted-public-key envelopes and truncations, no signing secret. Resumed scripts/verify fast passed fmt, VT fmt, clippy, tests and cargo-deny; only pre-existing static size limit fails. Full gate log: fuzz-gate-resume.log in job scratch. First fuzz retry failed because direct cargo lacked make; retry uses nix shell gnumake/perl (same prerequisite handling as scripts/verify). CPUWeight=30, ASan and five-minute execution remain required and running. Publication stand-in passed 2 tests, including wrong local VERSION before network mutation, duplicate release refusal, tampered/missing/offline verification and User-Agent headers.Downloader red compilation: http-red-workspace.log reports absent download/DownloadError API. URL regression covers FTP, credentials, query and fragment rejection before any TCP accept. Production permits HTTPS only; loopback HTTP compiles only in test builds. HTTPS plaintext probe refuses before any destination exists. UI red test: expected “Get the arm64 binary: the binary does not match the signed checksum.” but received only checksum reason (ui-step-red.log); fixed decoder + failureLine, focused green tests. Native fuzz prerequisites now use Nix make/perl and this job’s pinned VT cache (no version changes). Host load 34.72/34.41/29.50 on 8 CPUs; no load generators.
Security audit finding: same-architecture bootstrap must use /proc/self/exe on Linux, not current_exe’s installation pathname, which can be replaced while the server runs. Existing SSH Input::File opens the path in the server process (crates/plugins/ssh/src/process.rs:115), so /proc/self/exe preserves the exact running inode. VERSION verification/read now uses the same descriptor. Fuzz prerequisite: cached Zig compiler archive had malformed .debug_str after disk-full; rebuilding only this job’s affected cache, with unchanged pinned toolchain. No fuzz execution claimed before compile finishes.
Completed script slices, all pushed: public verification
d3d75909; pinned dual-musl packaging509c6561; immutable R2/Worker publicationc6344c52; local stand-in tests88b506f4. bash -n passes; 2 publication tests pass (scripts-version-dynamic.log). Fast gate of their unchanged Rust tree: http-gate-clean.log, all non-size rows PASS. No live uploads, Worker calls or deployment. Build marks production binaries and signs VERSION through the unchanged Worker manifest format. Publisher preflight/local lock refuse existing partial releases; cross-machine serialization remains the orchestrator’s responsibility.Browser finding: weighted production suite passes 13/14; the remaining test expects chip arming removed on this base by
4810f308. packages/ui/src/chip-input.ts:202 returns the last chip to text; correcting the stale spec, no UI component change. New release failure-line and socket decoder tests: 31 pass, 0 fail; tsc check passes after frozen Bun install.Resolver signed-release stand-in: 4 tests passed before adding extra cache/missing-payload cases (payload-green.log); wrong-version replay rejected via signed VERSION, cold download 4 requests, 8 simultaneous targets share one download, warm/offline cache makes none and is reverified. Added mode/symlink refusal, absent payload with valid manifest never enables dev fallback, destination preservation, and every payload-byte mutation. Named timeout red: “Host installation exceeded its time limit.” instead of architecture step (payload-timeout-red.log); fixed bounded payload-source deadline, 2 source tests now pass (payload-source-green.log). Workspace clippy passes. Full stable-tree fast gate running; no more source edits during the gate. Exact-source optimized measurement harness avoids compiling unrelated server test code; actual final static binary sizes will be measured separately.
Fast gate found an existing SSH fixture race (final-code-gate.log: config_isolation fails “The SSH control socket is invalid”). Production master.rs:137 rejects group/other permissions; tests/common/mod.rs binds before chmod. Isolated retry passed, but deterministic delayed-chmod regression failed with mode 0755 vs 0600 (socket-race-red.log). Fixture now sets umask 0177 before bind; both configuration isolation and delayed-chmod tests pass (socket-race-green.log). Production socket validation unchanged, no exception/waiver used. Full gate rerun required.
CPUWeight=30 ASan fuzz: 3,918,244 runs in 301 seconds, no crash, coverage 635, peak 480 MiB (fuzz-execution.log). Exact-source optimized 20 MiB verification, 50 runs: p50 105.790 ms. Cross-architecture Get-binary step against local HTTP bucket: cold 308.227 ms, warm p50 104.661 ms / 50 runs; 8 simultaneous warm hosts 439.572 ms, 4 requests total. Machine infraternal-dev, x86_64, 8 cores, rustc 1.99.0; load 14.94/26.04/32.13 then 14.94/25.85/32.03. These are payload-resolution times, not full SSH/bootstrap latency. Current default build x86 static 20,028,096 bytes, +131,104 vs this job’s 19,896,992 baseline; ceiling unchanged. Both pipeline-marked targets are still to be built.
Final gate found a pre-existing enrollment test admitting a just-issued certificate using a timestamp captured before issuance (remote_http_tests.rs:181: Denied). Admission correctly rejects a certificate not yet valid at that older timestamp. Changed only the test to observe current time after issuance; no production auth policy changes. The gate is rerunning. Local publishing tests also exposed valid Bearer alphabet rejection (+ / ~ =); synthetic-token red/green fixtures now cover those characters without reading real credentials. Both publishing stand-in tests pass in 27.534s.
f4b78949: test: make synthetic SSH sockets private at creation. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.5ce6e11f: test: admit enrollment certificates at the post-issuance time. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.1c0a3bdb: ssh: name architecture payload acquisition failures. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.36b877d0: ssh: expose the existing payload lookup as a source interface. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.d6bd2d13: ssh: resolve payloads before installation and preserve timeout steps. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.6d9eb9a9: test: refuse SSH uploads after payload trust and timeout failures. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.66722719: server: distinguish pipeline releases from optimized development builds. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.b99c1ea0: server: enable existing HTTP dependencies only with SSH payloads. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.3982605a: server: cache and verify exact-version architecture release payloads. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.bf597243: test: cover retained download paths and every payload-byte mutation. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.e57fcd5c: tracer: display verified-payload failures at their architecture step. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.8132aaec: test: align add-host chip regression with shared editing behavior. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.9df4b350: test: capture architecture verification refusals in the production wizard. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.8b2e4948: release: accept the safe Bearer token alphabet through curl stdin. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.2df9349e: contract: describe additive verified architecture acquisition steps. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.e23c2cea: docs: document immutable release operations and verification review. Stable-source gate evidence: scripts/verify fast passes fmt, VT native fmt, clippy, workspace tests and cargo-deny; static-size row retains the known pre-existing budget failure. Full output and size-growth measurements will be attached in the finish comment.77280034: clarified the observed ASan configuration in release operations documentation; no unsupported duplicate-symbol diagnosis. Production code remains the stable tree tested by the final fast gate. cargo check -p infraternal-server --no-default-features --locked passes in 2m 26s (CPUWeight=10000, job scratch target), validating removable SSH downloader dependencies under D198. The real release build has completed x86_64 and is finishing ARM; no live upload or Worker call.Finished release-pipeline at
087d2a700d; origin/release-pipeline matches, worktree clean. Atomic implementation commits are pushed.fcbf98b3adds the evidence catalog and production screenshots;087d2a70adds complete unmodified receipts. No live upload, signer call or deployment.Both pinned musl release payloads build with release_marker=1 and no PT_INTERP. x86_64: 20,028,096 bytes (+131,104 vs
9fba1eb2); aarch64: 17,848,344 (+118,512). Local bundle checksums pass; a second build refuses the immutable version. Existing gate size limits are unchanged and remain a known pre-existing failure. All other fast rows pass, including 279 server tests; the no-default-features server check also passes.Measured on infraternal-dev, i9-9900K, 8 CPUs, rustc 1.99.0, CPUWeight=10000: 20 MiB verification p50/50=105.790 ms (load 14.94 26.04 32.13). Cross-architecture binary-acquisition step: cold=308.227 ms, warm p50/50=104.661 ms, 8 concurrent warm=439.572 ms, cold/warm-extra requests=4/0 (load 14.94 25.85 32.03). These exclude SSH transfer/service startup. Five-minute ASan fuzz run at CPUWeight=30: 3,918,244 runs/301s, no crash, cov635, RSS480MiB.
Local publishing tests pass; production wizard/chip/prototype regressions pass after the documented fixture corrections. Desktop/iPhone captures are attached in evidence/release-pipeline and await independent visual judgment. Author security checklist completed in docs/operations/release.md. Scratch build targets, detached baseline, generated fuzz corpus and browser output were removed after saving evidence.
Full evidence:
087d2a700d/evidence/release-pipeline/README.mdThe following 6 comments preserve scripts/verify fast output verbatim, in order. The static-size row is the only failure.
Finish
087d2a700d: scripts/verify fast, verbatim output part 1/6.Finish
087d2a700d: scripts/verify fast, verbatim output part 2/6.Finish
087d2a700d: scripts/verify fast, verbatim output part 3/6.Finish
087d2a700d: scripts/verify fast, verbatim output part 4/6.Finish
087d2a700d: scripts/verify fast, verbatim output part 5/6.Finish
087d2a700d: scripts/verify fast, verbatim output part 6/6.Independent verification started on local branch review-release-pipeline, target
087d2a700d. Git selects merge base2eaaaa36a2with dev (multiple bases); release lane starts at9fba1eb2. Read #157 history and related parent/update #102 history. Scope: release verifier, publication, architecture resolver, additive bootstrap failures and claimed measurements. No implementation edits, push, deploy or live signer/publication calls. Failing evidence will be committed locally and recorded here.Review step at target
087d2a70: local release-script suite 2/2 PASS (29.958s); focused tracer model/socket tests 31/31 PASS; TypeScript check PASS. Fresh production-build browser cases at 1440x900 and 393x852 PASS (39.7s) under CPUWeight=10000, TRACER_TEST_PORT=4297. The unweighted run timed out before the release assertion; retained both logs. Screenshot review: named architecture step and full checksum reason remain legible, including phone wrapping. Evidence is being collected in evidence/release-pipeline-review/. Pristine-head fast gate, sanitizer, timing replay and process-stop cache recovery remain running/pending. No P0/P1 confirmed.R1 P2 confirmed; failing test committed locally as 38e31cd4 on review-release-pipeline. scripts/release/review.test.ts: “publication with two build directories admits only one writer”. scripts/release/common:6-7 and publish:16-17 scope the local lock below CARGO_TARGET_DIR; two same-host isolated builds therefore bypass it. Local fixture (REST conditional PUT not guaranteed, matching documented constraint): list_requests=2, uploads=8, replaced_objects=4; expected at most 4 uploads and 0 replacements. No live writes/signing. Existing cross-machine serialization responsibility is acknowledged; this finding concerns the claimed local serialization boundary. No implementation fix or push. Full reproduction log: evidence/release-pipeline-review/publication-review-red.log; persistent finding record updated.
Completed step 04713b2f54926dcc295f15ad42fb12580227e27c: R1 evidence refinement: review-release-pipeline now also requires at least one complete upload set, so a fixture timeout cannot appear as successful serialization. Reproduction remains RED: 2 prefix checks, 8 uploads, 4 replacements; Expected <= 4, Received 8. Verbatim repository test output is committed in evidence/release-pipeline-review/publication-review-red.log. Production source is unchanged. The original-head fast gate has passed clippy (26m16s) and is compiling workspace tests; no implementation source was edited during it.
Original-source gate: fmt/VT fmt/clippy PASS; first workspace test run stopped at unchanged initial_attach_requires_explicit_credit_before_replay because verify-agent-attach-credit.py:17 assumes target/ exists (FileNotFoundError target/ac210398). Neither script nor its Rust test changed in #157. Created an ignored worktree target symlink to this job's scratch target, keeping temporary state under HOME cache. Exact real-PTY attach probe now PASS: no Output/Snapshot for 350ms, control responsive, funded replay 149 bytes in 632.3ms. Full original-source fast gate queued for rerun; first output retained verbatim. No implementation fix/waiver. Review head 04713b2f contains only the P2 publication regression/evidence, with production source still equal to
087d2a70.R2 P2 confirmed; failing parser test committed locally as c4f1f43fc55bd6d09d9a390c97fd03258f529d40. scripts/release/response.py:13 accepts duplicate result keys through json.loads last-value handling. An existing-object list followed by result:[] exits 0 (STORAGE_PREFLIGHT duplicate_result=true existing_objects=1 exit=0 stdout_bytes=0 stderr_bytes=0). Test: “storage preflight refuses ambiguous existing-object results” in scripts/release/review.test.ts. This contradicts the documented refusal of ambiguous storage responses before publication. Exact RED output is committed in evidence/release-pipeline-review/preflight-review-red.log; persistent findings updated. Synthetic stdin only, no live writes or credentials; implementation unchanged.
Independent review R3 (P2): abrupt download stops retain partial payloads after restart. Two real subprocesses stopped at one MiB each; a subsequent successful signed resolution leaves 2,097,152 bytes in download-* directories. Test restarted_resolution_reclaims_partial_downloads_after_process_stop expects zero and fails. Evidence/test committed locally at bd823c69; implementation unchanged. Verbatim output: evidence/release-pipeline-review/restart-review-red.log. This accumulates disk usage across process stops; no P0/P1 confirmed.
Independent review: verbatim scripts/verify fast output on target
087d2a70, part 1/6. CARGO_TARGET_DIR is the review scratch directory; original Rust test source and production source were retained for this run.Independent review: verbatim scripts/verify fast output on target
087d2a70, part 2/6. CARGO_TARGET_DIR is the review scratch directory; original Rust test source and production source were retained for this run.Independent review: verbatim scripts/verify fast output on target
087d2a70, part 3/6. CARGO_TARGET_DIR is the review scratch directory; original Rust test source and production source were retained for this run.Independent review: verbatim scripts/verify fast output on target
087d2a70, part 4/6. CARGO_TARGET_DIR is the review scratch directory; original Rust test source and production source were retained for this run.Independent review: verbatim scripts/verify fast output on target
087d2a70, part 5/6. CARGO_TARGET_DIR is the review scratch directory; original Rust test source and production source were retained for this run.Independent review: verbatim scripts/verify fast output on target
087d2a70, part 6/6. CARGO_TARGET_DIR is the review scratch directory; original Rust test source and production source were retained for this run.Independent review step at bd823c69: R3 also fails in the normal cargo workspace runner (2,097,152 partial bytes retained after successful restart); reviewer test code passes cargo fmt and workspace clippy -D warnings. Independent exact-module release measurements on infraternal-dev, 8 cores, weighted scope, load 35.22/30.43/27.66: 20 MiB/50 samples verification p50 145.434 ms; acquisition cold 611.280 ms, warm p50 194.154 ms, eight warm hosts 835.890 ms, 4 network requests total. ASan fuzz run: 23,424,605 inputs/301 s, RSS 511 MiB, exit 0. Original-head fast gate output is posted verbatim in six parts; only stale size ceiling fails. Separate ARM build remains running because fast exits before ARM. No P0/P1; three P2 tests committed; no implementation fixes or push.
MERGE (no P0/P1). Independent verification of target
087d2a700dcomplete. Counts: P0=0, P1=0, P2=3, P3=0. P2 tests are committed for the next fix run: same-host publication admission across build directories (8 uploads/4 replacements); ambiguous storage JSON preflight (exit 0); partial downloads retained after process-stop restart (2,097,152 bytes, also reproduced in normal workspace runner). No implementation fixes or push.Local review branch review-release-pipeline head be57d92d0a4742640ffd2df32d972b038d182328. Evidence: evidence/release-pipeline-review/README.md, red tests/logs, production screenshots, complete gate output, source checksums and measurements. Independent static sizes: x86_64 20,028,096; ARM 17,848,344 bytes; both stripped with no interpreter. Separate TypeScript fast gate passes, as do reviewer fmt and clippy. ASan: 23,424,605 inputs/301 s, RSS 511 MiB, exit 0. Twenty MiB/50 samples: verify p50 145.434 ms; cold 611.280 ms, warm p50 194.154 ms; eight warm hosts 835.890 ms. Machine/load recorded; no live Worker/R2 mutation.
scripts/verify fast on original job-head production and Rust test source exits 1 only at the stale size ceiling (D205); all other rows pass. Complete output was posted verbatim in parts 1–6. Final summary, verbatim:
Temporary build material is being removed after evidence preservation. The review tests intentionally remain failing for the next fix run; the issue remains open.
Review cleanup complete at be57d92d: temporary build targets/source harnesses and the worktree target symlink removed; review-release-pipeline working tree clean. Evidence remains committed and findings.md appended. Verdict unchanged: MERGE, P0=0/P1=0/P2=3/P3=0. No push or implementation fixes.
Round 2 started on release-pipeline, base/head
087d2a700d. Read #157 and parent release/update #102 history, repository contracts and review evidence at be57d92d. Importing the four review test commits first, preserving their deliberate red assertions; then separate fixes for fixed per-user publication flock, duplicate-key JSON rejection, and restart cleanup of private download staging. No live bucket/Worker access or credential inspection. D224/D225/D206; existing engines retained.Imported and pushed review tests unchanged:
e70254b8,20cd94f3,a1672e39,740171b4. These are deliberately red test commits required by the approved brief, an exception to green-per-commit for reproduction evidence. Review evidence retains R1 8 uploads/4 replacements, R2 ambiguous-response exit 0, R3 2,097,152 partial bytes. No review documentation commit imported.R1/R2 reproduced locally before fixes (review-red.log): list_requests=2, uploads=8, replaced_objects=4; duplicate result preflight exit=0. Draft fixed per-user persistent flock and recursive object_pairs_hook now pass unchanged review tests: list_requests=1, uploads=4, replacements=0; ambiguous JSON exit=1, plain duplicate-field reason. Worker replies were discarded before; they now use the same bounded strict parser. This pipeline does not read releases/index.json; no additional live/index fetch is introduced.
R3 implementation choice: production resolver construction will reclaim stale private download- staging before any request, with a nonblocking directory flock preserving active writers. Successful resolution also sweeps abandoned staging. The unchanged review subprocess helper constructs the resolver directly (bypassing new) and intentionally accumulates 2 MiB before its successful resolution; constructor cleanup plus completion sweep preserves that test without weakening it. Atomic verified directory rename already exists; keep it, with payload/metadata downloaded only inside private staging.
381902feadds a separate startup cleanup safety regression, pushed. RED: resolver startup leaves abandoned staging before any request (startup-red.log). Imported R3 reproduced unchanged: retained_before_bytes=2097152 retained_after_bytes=2097152 (payload-red.log). Draft fix now passes 8 payload tests, including exact unchanged process-stop test: retained_before_bytes=2097152 retained_after_bytes=0 (payload-green.log). Startup preservation checks pass for active flock, unrelated names/contents, symlink and hardlinked payload. Full fast gate and optimized measurements running; no completion claim yet.Optimized exact-source baseline/fixed comparison on infraternal-dev (8 cores, kernel 6.12.111+deb13-amd64, CPUWeight=10000). Shared dependency versions match Cargo.lock. 20 MiB, 50 warm samples: baseline cold=192.180 ms/warm p50=100.341 ms/8 warm hosts=211.646 ms; fixed 189.304/97.751/209.106 ms. Both 4 network requests total; no observed slowdown in this run. Load before baseline 10.91/21.47/21.71, after fixed 9.78/20.88/21.51. Fifty abandoned 20 MiB sparse fixtures (1,048,576,000 logical bytes) reclaimed in 2.342 ms, 0 retained bytes; this measures metadata/unlink work rather than allocation/read throughput. Full logs and source hashes will be committed with final evidence. Fast workspace tests are running; no final gate claim yet.
Fresh fast rerun: fmt, VT native fmt, corrected clippy, workspace tests and cargo-deny passed; x86_64 static build still running. Server workspace suite: 281 passed/0 failed/33 ignored. Final local script tests: Python 3 passed; unchanged review Bun tests 2 passed, one list/4 uploads/0 replacements and duplicate JSON exit 1. All release calls remain loopback fixtures. No source changes after the corrected permission-mask annotation. Waiting for stripped static size delta vs independently reviewed
087d2a70x86_64 20,028,096 bytes.Static x86_64 build succeeded (stripped static PIE, no PT_INTERP): 20,042,272 bytes, +14,176 vs reviewed
087d2a7020,028,096. Size ceiling remains the known D205 overrun. Corrected fast rerun also exposed a transient existing agent_daemon oracle failure: terminal.open refused at scripts/agent_fixture.py:235 from verify-agent.py:65; not a permitted #118 waiver case. First full run passed that exact oracle (39.50 s) and all workspace tests, but had the new explicit permission-mask clippy lint; the corrected rerun passes clippy. Earlier progress comment incorrectly inferred a passing test row from the tail; this comment corrects it. Running a fresh full fast gate; will require every non-size row to pass. ARM build running; named verifier/payload gates and both script suites pass.Fresh full retry passed the daemon oracle (43.05 s), but failed a separate existing auth resume assertion at auth/tests.rs:1425 (expected next frame Ack at input offset 8), 280 server tests passed/1 failed. No timeout waiver applies. The exact workspace-feature test passes isolated with unchanged source (resume-isolated.log); no assertion weakened and no auth/protocol edits made. Running another full gate now that both static builds are complete. Default-marker stripped static binaries: x86_64 20,042,272 (+14,176 vs
087d2a70); aarch64 17,862,888 (+14,544 vs review receipt 17,848,344); both no PT_INTERP. Full failure logs will remain in evidence.Final release-only gates pass: Python 3/3, Bun review 2/2, release_verify 2/2, release_payload 8/8 (2 ignored measurements). Latest full fast attempt failed only the pre-existing claude_review_watch_expires_host_made_visible_by_membership_edit socket fixture: expected changed, received error at claude_review_visible_liveness.rs:86; other test failures from earlier attempts did not recur. No waiver or unrelated code change taken. Re-running all tests with RUST_TEST_THREADS=2 to reduce shared-host contention. Known x86 static-size overrun remains.
Completed restart-safe cache cleanup:
81aba503, pushed. Eight payload tests pass (2 ignored measurements); unchanged independent restart regression: 2097152 retained bytes before -> 0 after. Constructor startup regression also passes, preserving active locks, unrelated/unknown files, symlinks and hardlinked payloads. 50 abandoned directories with 1 GiB logical sparse payloads: 2.342 ms cleanup, zero retained. Both static architectures build. Full fast rerun remains in progress; prior full attempts had intermittent unrelated fixture failures, recorded separately.Completed per-user publication flock:
282c9305, pushed. Fixed lock location is independent of CARGO_TARGET_DIR and retained through the entire publication. Review stand-in admits only one publisher: 1 list, 4 uploads, 0 replacements (red: 2/8/4). bash -n passes. Release Worker decoding is the next separate commit.Completed strict recursive JSON decoding and Worker-answer validation:
58fecd5e, pushed. Independent duplicate-result regression refuses with exit 1 and the plain constant reason. Python script gate: Ran 3 tests in 3.861s, OK; six duplicate subcases cover preflight, upload and nested Worker/index-shaped responses. No release index reader exists in the current pipeline; no unnecessary network request added. Separate TypeScript fast dispatcher also passed: 36 protocol tests, 34462 assertions; tracer compiler/unit/build/transfer checks pass. Full Rust fast rerun continues with serialized tests.Completed nested duplicate regression coverage:
406ef6e2, pushed. Six subcases enforce the same plain rejection across every release response mode and nested objects; Python gate 3/3 passes. Independent review tests remain unchanged.Completed operator documentation:
83b2b270, pushed. docs/operations/release.md records the fixed per-user flock path and descriptor lifetime, recursive JSON rejection, current-version startup cleanup, active staging locks and the independent Bun review gate. Updated review checklist run against the final changes: no dependency/trust/protocol/fallback changes; only recognized owned private single-link staging content collected. git diff --check passes. Final fast receipt and evidence handoff remain pending.Final full scripts/verify fast rerun with RUST_TEST_THREADS=1 passes every non-size Rust row; server 281 passed, 0 failed, 33 ignored (413.98s). Prior daemon, resume Ack and liveness failures do not recur; no test weakened and no baseline waiver taken. Separate TypeScript dispatcher passes. Known size-only failure: x86_64 20042272 bytes vs
087d2a7020028096, delta +14176; ceiling 16404816. Verbatim summary:+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Finished: release-pipeline head
794ef45fea, pushed. All three P2 fixes implemented in separate commits; independent review tests unchanged. Implementation:81aba503(startup cleanup),282c9305(shared publication flock),58fecd5e(strict JSON),406ef6e2(nested tests),83b2b270(operator docs). Evidence catalog/result:8b3788b8; generated logs explicitly tracked in794ef45f(repository *.log exclusions require force-add).Python 3 passed; Bun review 2 passed (1 list/4 uploads/0 replacements, duplicate exit 1); release_verify 2 passed; release_payload 8 passed, including restart residue 2097152 -> 0. Final workspace tests pass: server 281 passed, 0 failed, 33 ignored. scripts/verify fast uses RUST_TEST_THREADS=1; no baseline waiver, weakened assertion or unrelated production change. Separate TypeScript dispatcher passes (36 protocol tests/34462 assertions plus tracer compiler/unit/build/transfer checks). No live bucket or Worker contacted.
Known pre-existing size-only failure [D205]: x86_64 20042272 bytes, +14176 vs
087d2a70(20028096); ceiling 16404816. Both architecture builds static without PT_INTERP. Weighted local benchmark: 20 MiB baseline/fixed cold 192.180/189.304 ms, warm p50 100.341/97.751 ms, 8 warm hosts 211.646/209.106 ms; four cold requests, none warm. Fifty abandoned sparse 20 MiB files: 2.342 ms cleanup, zero retained. Machine/load and measurement limits are in evidence/release-pipeline-round2/README.md; full logs and result.md committed. Original worktree target will be restored and job scratch removed.Final gate output, verbatim:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Delta verification resumed on local review-release-pipeline at
794ef45fea; reviewed baseline087d2a70, merge base with dev2eaaaa36a2. Read all #157 comments and parent #102 history plus release contract/report. All prior regression sources are already cherry-picked on this head (e70254b8,20cd94f3,a1672e39,740171b4); Bun source matches previous review exactly. Scope restricted to repairs; no implementation edits/push/deploy/live publication. main:DECISIONS.md ends at D214; later release choices are supplied on this brief/#157.Delta review step at unchanged target
794ef45f: prior R1/R2 tests pass unchanged (Bun 2/2): list_requests=1 uploads=4 replaced_objects=0; duplicate result exit=1. Python release gate 3/3 passes, including six recursive duplicate subcases and fully signed local publication. Deterministic decoder mutation corpus: 6,000 inputs across three modes, 5,938 refusals/62 schema-accepted inputs, zero unhandled exceptions/diagnostic leaks, 9.250s. All calls local fixtures; XDG_STATE_HOME points inside reviewer scratch. Full fast gate and exact-source cleanup measurements still compiling. No new confirmed finding.Previous findings verified at
794ef45f: R1/R2 pass unchanged (Bun 2/2; 1 list/4 uploads/0 replacements, duplicate result exit 1). R3 passes unchanged in the normal server test binary: retained_before_bytes=2097152 retained_after_bytes=0, 0.81 seconds, exit 0. Extra publication lifetime fixture refuses second writer after abrupt parent stop with request in flight (second exit 1; one list/upload total). Separate complete TypeScript fast dispatcher passes (36 protocol tests, 34462 assertions). No new confirmed finding. Full fast gate/optimized measurements still running; source unchanged.Completed regression evidence commit
6c1d82ce7bon local review-release-pipeline. R1/R2/R3 all pass unchanged: one list/four uploads/no replacement; ambiguous response exit 1; restart residue 2097152 -> 0 bytes. Additional descriptor-lifetime/mutation corpus checks pass. Target full fast gate completed: all Rust rows pass except known D205 static-size-only failure, independently 20042272 bytes (+14176 vs087d2a70); separate TS fast passes. Measurement/full-gate evidence is the next atomic documentation commit. No push or implementation fixes.Independent delta review of target
794ef45f, local evidence headd5486d72e2: scripts/verify fast output verbatim, part 1/5.Independent delta review of target
794ef45f, local evidence headd5486d72e2: scripts/verify fast output verbatim, part 2/5.Independent delta review of target
794ef45f, local evidence headd5486d72e2: scripts/verify fast output verbatim, part 3/5.Independent delta review of target
794ef45f, local evidence headd5486d72e2: scripts/verify fast output verbatim, part 4/5.Independent delta review of target
794ef45f, local evidence headd5486d72e2: scripts/verify fast output verbatim, part 5/5.MERGE (no P0/P1). Delta verification of 087d2a70..794ef45f complete. New confirmed findings: P0=0, P1=0, P2=0, P3=0. All three earlier P2 findings pass unchanged: R1 one list/four uploads/no replacement; R2 duplicate response exit 1; R3 two abrupt stops, 2097152 -> 0 retained bytes. Startup safety and descriptor inheritance checks pass. Decoder corpus: 6000 inputs, zero unhandled errors/diagnostic leaks.
Local review-release-pipeline evidence head
d5486d72e2; atomic evidence commits6c1d82ceandd5486d72. Evidence: evidence/release-pipeline-delta-review/README.md and receipts. No implementation fixes, push or deployment. Separate TS fast gate passes (36 protocol tests, 34462 assertions); normal server suite 281 passed/33 ignored.Weighted local scale checks: 20 MiB, 50 warm samples, eight concurrent hosts, four cold requests/no warm requests. Retained all three baseline/fixed trials and machine/load values; load 20.79 to 56.81 means acquisition timing differences cannot be attributed to this delta and author's absolute latency claim is not independently corroborated. 50 abandoned sparse 20 MiB files (1 GiB logical) reclaimed in 4.614 ms, zero retained. No production RSS or terminal latency claim. ARM/unchanged parser/UI sanitizer work was not rerun.
Target-head fast gate exit 1 only for the known D205 size ceiling: independently 20042272 bytes, +14176 vs previous review; stripped static PIE, no PT_INTERP. Full output is preserved verbatim in the preceding 5 comments and verify-fast.log. Summary, verbatim:
Scratch/build cleanup follows receipt preservation; issue remains open.
Cleanup complete at local review-release-pipeline head
d5486d72e2: scratch build targets/harness/state and worktree target symlink removed; working tree clean. Committed receipts preserved in evidence/release-pipeline-delta-review. MERGE unchanged: P0=0/P1=0/P2=0/P3=0 new findings, all three previous regressions pass. Full target gate output/verdict posted immediately above; only known D205 size ceiling fails. No push, deployment, implementation fix or issue closure. Remaining duplicate scratch receipts are being removed after this comment.Release channels started on release-pipeline at base/head
794ef45fea. Read CLAUDE.md, DECISIONS.md, architecture/process, all #157 comments and parent #102. D224/D225/D226 read from origin/dev. Preserve exact-version add-host and existing signature verifier. Implement release settings/actions as a removable release plugin (D198/D201), default stable, explicit edge confirmation; no UI. Channel pointers remain untrusted until signed VERSION is verified. No live bucket/Worker or credentials will be accessed. Known base x86 static size: 20042272 bytes. Each logical step will be committed and pushed separately.Additive contract proposal for D16/D198/D202/D226: release plugin declares release.channel.get (read), release.channel.set ({channel: stable|edge, confirmed: boolean default false}), release.latest (read). Persist channel in plugin_settings.settings, default stable. Edge requires confirmed=true on every request; stable needs no confirmation. CLI server channel [stable|edge] [--yes] and server release latest reuse these definitions and handlers; local CLI opens only an existing server database and checks the feature is enabled, never creates a server. WebSocket actions require owner authority (fresh session rechecked within setting transaction). Release lookup downloads one bounded channel pointer, validates version/channel, then downloads signed manifest/signature/VERSION and authenticates VERSION with the existing descriptor verifier before returning it. Missing stable pointer returns “no stable release yet” with the explicit opt-in command; no edge request is made. The Worker file is absent on this base, so importing only that path from
dc5795f5will add the owner-authored Worker including its D226 change; DECISIONS.md remains unchanged.D226 red tests against unchanged scripts: 2/2 fail as expected (scripts-red.log). No-channel build entered packaging instead of refusing and had no INFRATERNAL_RELEASE_VERSION; edge publication exit 2: “version must match workspace version 0.1.0”. New fixtures run exclusively against copied scripts and loopback stand-ins, with fixture publication state isolated in scratch. Migration direct SQLite check passed: existing mesh disabled switch preserved, release enabled with stable channel (2 rows). Full schema fast gate is still running; no implementation commit yet.
Schema gate finding: plugin_settings_review.rs:30 failed, left [false,true,true], expected [false,true], because the proposed migration eagerly inserted a release row. All 281 server unit tests passed; this integration test correctly exposed that existing plugins use descriptor defaults before a persisted switch exists. Revise the migration to add JSON settings only; the release descriptor and handler default channel to stable when no persisted channel exists, matching existing plugin-setting semantics. Settings become durable on an explicit channel write. No existing assertion will be changed. The first gate is completing its static build; its complete failure output will be retained.
Completed schema step
b0491552, pushed release-pipeline. JSON settings added to existing plugin_settings; lazy descriptor defaults preserved, no eager row. Corrected scripts/verify fast: fmt, VT native fmt, clippy, workspace tests and cargo-deny PASS; only known size row FAIL. x86_64 stripped static PIE/no PT_INTERP: 20042368 bytes, +96 vs794ef45f(20042272). Full receipts schema-fast.log (red row insertion) and schema-fast-fixed.log (corrected) will be preserved with final evidence.Completed Worker-only import
0882e616, pushed. apps/release-signer/src/index.js matchesdc5795f5byte-for-byte; DECISIONS.md untouched. In-memory signing gate: 3 pass, 0 fail, 16 assertions, including stable/edge signatures and matching channel pointers. Rust source is unchanged from the corrected schema fast gate (all non-size rows PASS). No live Worker/bucket access or deployment.Completed publication grammar step
6ba4aba5, pushed. scripts/release/common accepts only stable x.y.z or edge-YYYYMMDDTHHMMSSZ; publish no longer requires workspace equality but still compares local and signed VERSION exactly. bash -n passes; existing Python stand-ins 3/3 and edge publication/immutability 1/1 pass. The signed verification, fixed publication flock and duplicate JSON checks are unchanged. No live release requests. Binary identity integration is still uncommitted and running its full fast gate.Completed release: share the stamped binary identity with CLI and add-host:
e8a17d4b6d, pushed release-pipeline. Cargo package versions cannot identify edge builds. Validate and stamp one pipeline-only identity, reused by CLI, exact-version payload cache/URLs and the static User-Agent. Reject independent per-crate stamps and per-download formatting. Unstamped builds retain workspace stable identity. D16/D224/D225/D226; real CLI reports infraternal 0.1.0 (stable).x86_64 stripped static PIE/no PT_INTERP: 20047552 bytes; delta vs
794ef45f: 5280. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: version-fast.log (to be preserved with final evidence).Completed release: require an explicit build channel and stamp UTC edge identities:
4ea1ce603a, pushed release-pipeline. Require --channel stable|edge and export one UTC edge stamp before either architecture builds; stable uses workspace x.y.z. Reject silent defaults and architecture-specific timestamps because they break D225/D226 lockstep identity. bash -n and the real script packaging-input fixture pass (one test: no-channel/malformed refusal, UTC stamp and binary/VERSION equality). Rust source is unchanged from the identity gate.Security finding in draft release service before landing: authority-boundary-red.log fails deterministically on real SQLite. AFTER INSERT trigger retires session freshness; the draft checked freshness before the settings INSERT, so returned Ok(channel=edge) instead of Err(not permitted). Existing server plugins.rs::persist_setting writes first and checks authority immediately before commit. Move the release check after the write, retaining BEGIN IMMEDIATE and rollback, then preserve this regression in the separate tests commit. No production auth policy or shared primitive changes.
Draft authority boundary fixed before landing; authority-boundary-green.log: 5 passed, 0 failed, 1 ignored measurement. The deterministic trigger regression now refuses the write and reads stable after rollback. Owner/fresh checks follow the settings INSERT/UPDATE immediately before commit, matching plugins.rs::persist_setting; no shared auth primitive or policy change. The separate tests commit will include both this regression and the channel behavior tests.
Completed release: add removable server release plugin feature wiring:
10c4fd034c, pushed release-pipeline. D198/D201 require release capabilities to be removable server features. Add the release crate and optional server/CLI features using existing API, protocol, SQLite, Tokio, serde, UUID and nix dependencies. Reject a new engine or core-special-cased role. No implementation/actions advertised in this scaffold. Every existing locked dependency version is preserved.x86_64 stripped static PIE/no PT_INTERP: 20047552 bytes; delta vs
794ef45f: 5280. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: dependencies-fast.log (to be preserved with final evidence).Review finding (D198): a deterministic verifier paused for 250 ms remained running after cancellation joined the lookup task; staging was removed while its detached spawn_blocking worker could still read it. Red: cancellation-red.log, 0 passed / 1 failed, 0.32 s. Corrected draft performs bounded metadata verification inside the owning future, so cancellation joins all work before staging cleanup. No persistent worker/polling introduced.
Completed release: declare channel actions, defaults and confirmation instructions:
368cb4cae6, pushed release-pipeline. D16/D198/D202/D226: declare release.channel.get/set and release.latest once, stable default, explicit unreviewed-edge wording and existing-server dependency. Rejected adapter-specific help/skill copies and node-side server creation.x86_64 stripped static PIE/no PT_INTERP: 20047552 bytes; delta vs
794ef45f: 5280. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: plugin-descriptor-fast.log (to be preserved with final evidence).Cancellation regression corrected in the pending lookup module: cancellation-green.log, 1 passed / 0 failed, 0.57 s; corrected draft also passes clippy -D warnings. Verification stays within its owning lookup future, using the existing bounded manifest/signature/VERSION limits. A real OpenSSH fixture benchmark will compare typical and 64-KiB-near-limit manifests against the previous blocking-worker scheduling at 50 concurrent callers before final reporting. Independent read-only review found no other actionable issue.
Completed release: persist deliberate server channel changes atomically:
b2aa0f9713, pushed release-pipeline. D226: default absent settings to stable; edge requires confirmed=true on every write, while stable is one action. Preserve feature switches and recheck owner/fresh session inside the writer transaction. Rejected implicit channel selection from the running binary and silent edge switches. Draft real SQLite tests 4/4 passed before landing.x86_64 stripped static PIE/no PT_INTERP: 20047552 bytes; delta vs
794ef45f: 5280. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: plugin-service-fast.log (to be preserved with final evidence).Completed release: reject ambiguous or cross-channel release pointers:
7f2c99233a, pushed release-pipeline. D224/D226: bound pointers to 64 KiB, strict object/scalar/array fields and the shared version grammar. Ignore unsigned channel annotations; derive channel only from the requested version pending signature verification. Reject permissive JSON values and URL traversal. No metadata is yet trusted by this parser.x86_64 stripped static PIE/no PT_INTERP: 20047552 bytes; delta vs
794ef45f: 5280. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: plugin-pointer-fast.log (to be preserved with final evidence).Completed release: authenticate channel lookup through signed VERSION:
debd35c972, pushed release-pipeline. D224/D226: lazily fetch one channel pointer then manifest/signature/VERSION through injected existing engines. Verify the exact no-follow regular-file descriptor and require signed VERSION equality before returning identity. Missing stable returns the opt-in instruction with no edge fetch. Rejected pointer-only trust and channel fallback; cancellation removes private staging and the overall call is bounded to 60 seconds.x86_64 stripped static PIE/no PT_INTERP: 20047552 bytes; delta vs
794ef45f: 5280. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: plugin-latest-fast.log (to be preserved with final evidence).Socket-module gate finding at head
debd35c972: only the unchanged auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket failed (missing bounded list continuation, scale.rs:143). 280 passed, 1 failed, 33 ignored; load 30.17 24.24 25.08; 10,000 nodes / 30,000 grants, snapshot 64,595 bytes. fmt, VT native fmt, clippy and cargo-deny PASS; static size is the known 20,047,552-byte overrun. Checking detached devea235dd713locally in the same load window, then rerunning the full worktree gate; no assertion or deadline changes. The test source SHA256 is identical on both trees: 0611195efede81acd269229a94d600e2a43ec867f3773e9d411d3498a979068d. Receipts will be preserved under evidence/release-channels/.Detached dev
ea235dd713auth socket baseline receipt (unchanged source SHA256 recorded in previous comment). Worktree failure: missing bounded list continuation. Rerunning the whole worktree gate without modifying assertions/deadlines. Full receipts will be archived.Completed release: route declared actions through cancellable socket authority:
81fa76471c, pushed release-pipeline. D16/D198: adapt the shared service to existing Plugin/SocketHost work and result frames. Construction starts no polling; host authorization and runtime disable own cancellation. Reject separate API handlers or core release dispatch branches. Preserve the initial unchanged auth socket headroom failure and detached dev comparison; full gate retry receipt accompanies this slice.x86_64 stripped static PIE/no PT_INTERP: 20047552 bytes; delta vs
794ef45f: 5280. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: plugin-socket-retry-fast.log (to be preserved with final evidence).Completed release: bind declared server actions to existing download and trust engines:
d40108eae5, pushed release-pipeline. D16/D198/D201/D224/D226: register the release descriptor/runtime and supply the existing HTTP and Ed25519 verifier to its plugin-owned lookup. Derive private staging from the existing database; refuse implicit server creation or current-directory state. Reject duplicated signature/transport engines and release-specific core dispatch.x86_64 stripped static PIE/no PT_INTERP: 20233376 bytes; delta vs
794ef45f: 191104. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: server-adapter-fast.log (to be preserved with final evidence).CLI-adapter gate stopped before commit at
d40108eae5. Clippy rejected the added dispatch arms: run_server 103/100 lines. The correction groups release variants in the CLI adapter instead of suppressing the lint or refactoring unrelated server commands. Separately, unchanged auth::tests::socket_tests::claude_review_visible_liveness::claude_review_watch_expires_host_made_visible_by_membership_edit failed (event type error, expected resync; 280 passed / 1 failed / 33 ignored). Test source SHA256 is identical on detached devea235dd713: d895a93f0e638366d3d886c55461fd9a86ddec1d24c031be11aee3f16c0e5f6e. A dev comparison and full worktree retry are next; assertions/deadlines remain unchanged. The real compiled CLI/PTY workflow passed before correction: no preserves stable, yes persists edge, --version is infraternal 0.1.0 (stable). Static size 20,294,528 bytes (+252,256 vs794ef45f); receipts will be archived. Earlier chat progress incorrectly described the clippy/test rows as passing before the completed summary; the authoritative receipt contains both failures.Detached dev
ea235dd713liveness fixture comparison (identical source SHA256 in previous comment). Worktree failed with event type error, expected resync. Full worktree retry follows the CLI dispatch lint correction; fixture assertions/deadlines stay unchanged.Machine=infraternal-dev
Observed near detached-dev liveness comparison: 14.80 19.97 23.24 11/3175 1221924
Queued measurement fixture checks before execution: 850 extra checksum rows calculate to 67,315 bytes, exceeding the 65,536-byte manifest ceiling. Use 825 rows (calculated 65,340 bytes) and assert the real signed fixture is 65,000..65,536 bytes in both optimized benchmarks. These are fixture calculations, not performance measurements; real OpenSSH/50-caller values follow. Also corrected the channel-read measurement filter to channel_reads_at_fifty_concurrent_callers and require one executed test so a zero-test run cannot count. Measurements run locally under CPUWeight=10000 with the optimized workspace release profile. Files: release_latest_tests.rs, service_tests.rs; calculation/driver receipts will be archived with final evidence.
Completed release: expose existing-server channel and verified latest commands:
e699e3f8e2, pushed release-pipeline. D16/D202/D226: derive help and skill discovery from shared actions; invoke the same persistent channel service as API calls. Edge requires a TTY yes response or --yes; stable is one action. Group release command dispatch within its adapter to retain the main dispatcher line gate, rather than suppress its lint or refactor unrelated commands. Reuse organised output/JSON helpers and refuse missing/unsafe storage instead of creating a server. The real compiled CLI/PTY workflow passes; unchanged auth liveness failure and detached dev comparison are preserved.x86_64 stripped static PIE/no PT_INTERP: 20295232 bytes; delta vs
794ef45f: 252960. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: cli-adapter-retry-fast.log (to be preserved with final evidence).Completed release: exercise stable defaults, confirmed edge and signed lookup boundaries:
e2b7c52f7d, pushed release-pipeline. D224/D225/D226: use real SQLite, local HTTP, OpenSSH signatures, compiled CLI and real PTY confirmation; test stable-empty no fallback, signed VERSION replay/tampering, edge add-host exact version/cache, strict pointer/control grammars, retirement at the commit boundary and cancellation cleanup. Reuse the existing bucket/signing fixture rather than duplicate engines. Five publication/build stand-in tests, three in-memory Worker tests and the compiled CLI workflow pass; no production release service contacted.x86_64 stripped static PIE/no PT_INTERP: 20295232 bytes; delta vs
794ef45f: 252960. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: channel-tests-fast.log (to be preserved with final evidence).Registered release_channel harness check compiled, but its first full-gate clippy row rejected a nested if guard (collapsible_if, release_channel.rs:6). Stopped that known-red gate before completion; no passing full-gate summary is claimed. Collapsed the UTF-8/version let guards without changing the property. Targeted clippy and a new full gate run follow; production release sources are unchanged from
e2b7c52f. Partial red receipt and complete retry receipt will be archived.Completed release: fuzz channel pointers and shared version grammar:
4508d860d7, pushed release-pipeline. D12/D224/D226: register a bounded property target for shared binary-version and strict pointer parsing with the existing libFuzzer engine. Keep the release plugin dependency free of server features for this parser. Reject grammar-only examples as coverage of arbitrary malformed pointer bytes. Collapse the harness guard after its red clippy receipt; the required workspace clippy passes. Exact-source ASan results follow in final evidence.x86_64 stripped static PIE/no PT_INTERP: 20295232 bytes; delta vs
794ef45f: 252960. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: channel-fuzz-retry-fast.log (to be preserved with final evidence).Exact-source ASan setup check found arbitrary 1.5.0 in the isolated harness versus repository-locked 1.4.2. Parser dependencies (serde/serde_json), SQLx/Tokio and libfuzzer-sys already matched. Stopped the incomplete run and preserved its partial receipt, then selected existing repository version 1.4.2 in the scratch lock offline. All 176 isolated registry packages now match repository lock entries by name/version/source/checksum; repository Cargo.lock is unchanged. Restarted the full 300-second exact-source run under CPUWeight=30. Receipts: fuzz-dependency-match-fixed.txt and fuzz-exact-final.log, to be archived.
Optimized measurements on infraternal-dev (8 cores), local CPUWeight=10000, no load generator. Signature fixture uses real OpenSSH/Ed25519 and the existing verifier, 200 samples / 50 callers / 4 workers, load 30.16: small manifest 165B inline p50/p99=122/4228us vs blocking 140/2857us; near-limit signed manifest 65,340B inline 465/32971us (max37096) vs blocking 664/6096us (max7173). Near-limit 50-call batch: inline30,064us vs blocking11,069us. Retain inline because verification belongs to the cancelled future and cannot survive runtime disable or race staging cleanup (D198). The read-only reviewer found no further correctness/lifecycle concern and supports this documented tradeoff; scheduling under shared load is included, and no D41/frame-budget certification or CPU attribution is claimed.
Real loopback 50 verified latest lookups: 200 requests (+4 warmup), p50/p99=170814/215482us, batch218710us, zero staging directories remain, load29.18. Process HWM12,192->16,648KiB (+4,456KiB), RSS12,192->15,852KiB; normalized peak91,258B/caller includes fixture/transport and is not isolated per-lookup or production-daemon RSS. Lookup structure64B. SQLite channel-get:50 samples p50 .064ms,50 callers/pool1 batch1.710ms, service24B (1,200B for50 handles excluding pointed-to state), load19.82. Exact ASan run:12,486,906 executions/301s, no crash,176 registry dependencies match repository lock by version/source/checksum. Raw optimized receipts, source fingerprints and reviewer assessment will be archived under evidence/release-channels/.
Real scripts/release/build --channel edge completed at source head4508d860; no sign/publish or live bucket/Worker calls. VERSION=edge-20261011T094255Z; executed x86_64 --version: infraternal edge-20261011T094255Z (edge). Both musl payloads carry that stamp and no PT_INTERP: x86_64=20295232 bytes, aarch64=18073800 bytes (ARM inspected, not executed; no matched ARM delta claimed). Actual edge CLI/realPTY workflow passes, including stable default independent of binary channel, refused silent opt-in, yes/no confirmation and persistence. Full pipeline, hashes and CLI receipts will be preserved in evidence/release-channels/. Separate TS dispatcher and final fullfast follow.
Final fullfast stopped after agent_review: repeated_tiny_credit_pauses_preserve_shell_progress and stalled_terminal_never_delays_control_or_sibling_dispatch both refused terminal open before their timing assertions (scripts/agent_fixture.py:235, terminal open refused). No release source or assertions changed; preserving partial final-fast as final-agent-partial-fast.log. Detached dev comparison follows at currentload 47.71 32.74 29.88 49/3225 2186795
; same test/fixture source hashes will be archived. All non-size rows must pass on a full retry; no waiver claimed.
Detached dev
ea235dd713agent_review comparison: running 6 teststest initial_attach_requires_explicit_credit_before_replay ...
thread 'initial_attach_requires_explicit_credit_before_replay' (2252740) panicked at crates/infraternal/tests/agent_review.rs:13:5:
scripts/verify-agent-attach-credit.py:
Traceback (most recent call last):
File "/home/kayg/.cache/codex-scratch/release-channels/baseline/scripts/verify-agent-attach-credit.py", line 54, in
run(parser.parse_args().binary)
~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/kayg/.cache/codex-scratch/release-channels/baseline/scripts/verify-agent-attach-credit.py", line 17, in run
state.mkdir(mode=0o700)
~~~~~~~~~~~^^^^^^^^^^^^
File "/nix/store/lb41b0anx1f98y9y5s9mdv97gjgsq740-python3-3.14.7/lib/python3.14/pathlib/init.py", line 1011, in mkdir
os.mkdir(self, mode)
~~~~~~~~^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: 'target/ac2252741'
note: run with
RUST_BACKTRACE=1environment variable to display a backtraceFAILED
test last_typist_selects_its_own_real_pty_dimensions ... last typist real PTY: PASS; device A reports 24x80, device B reports 40x120 in both viewers
ok
test repeated_tiny_credit_pauses_preserve_shell_progress ... catch-up 0: 12 MiB shell completed; 1-byte credit paused; funded Snapshot=372 bytes seq=12583538: PASS
catch-up 1: 12 MiB shell completed; 1-byte credit paused; funded Snapshot=372 bytes seq=25166709: PASS
catch-up 2: 12 MiB shell completed; 1-byte credit paused; funded Snapshot=372 bytes seq=37749880: PASS
initial ring-wrap attachment: Snapshot=372 bytes seq=50333045: PASS
four 12 MiB floods completed; three tiny-credit pauses and funded Snapshots; no Close needed: PASS
ok
test retained_unwritten_input_survives_interleaved_ack_restart ... abrupt stop/restart: accepted=524599, written=15671, surviving unwritten=508928; real Ack before State; 524288 replay bytes exactly once: PASS
ok
test stalled_terminal_never_delays_control_or_sibling_dispatch ... held shim State + 9 commands: overloaded stream Close, sibling input/output, control Pong before barrier release in 301.105 ms: PASS
ok
test two_writers_keep_independent_ack_and_exact_input_after_restart ... multi-device real PTY: PASS; second writer starts Ack0 after first Ack45; both viewers receive exactly 37 bytes; independent Acks and full-range crash replay
ok
failures:
failures:
initial_attach_requires_explicit_credit_before_replay
test result: FAILED. 5 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 26.82s
error: test failed, to rerun pass
-p infraternal --test agent_reviewTest module and snapshot script match; isolation/fixture scripts differ on dev but all four are unchanged by this job versus794ef45f. No cause or baseline waiver claimed. Initial comparison invocations missed Nix PATH, then Zig PATH; those are environment-only receipts, not test failures. Full worktree retry follows with unchanged assertions/deadlines.
Fullfast retry: agent_review6/6 pass unchanged, then shim ring_wrap_snapshot_repaints_real_vim fails at crates/infraternal/tests/shim.rs:248 (socket read, WouldBlock/EAGAIN after existing5s timeout). This job has no shim/VT/test changes. Preserve partial final-shim-partial-fast.log; detached dev isolated comparison follows. No baseline waiver or timeout changes; every non-size row must pass full retry. infraternal-dev; load=26.72 27.98 28.28 11/3130 2286997
crates/infraternal/tests/shim.rs current=c63ba5e91116ad257fc6a02fe248969ee5299b0d2876f35ec87ae5214fdd44df dev=c63ba5e91116ad257fc6a02fe248969ee5299b0d2876f35ec87ae5214fdd44df
Detached dev
ea235dd713isolated Vim snapshot comparison: running 1 testtest ring_wrap_snapshot_repaints_real_vim ... ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 6 filtered out; finished in 3.31s
Comparison does not establish a cause or waive any row; full worktree retry follows, assertions/deadlines unchanged.
Third fullfast: terminal/shim pass; server284 pass,1 fail,35 ignored. Sole failure reviewer_disk_restart_and_concurrent_resume at auth/reviewer_tests.rs:67, AuthService::open_disk returns SQLite database is locked (code5). No auth/test source changed. Preserve final-auth-partial-fast.log and compare isolated detacheddev test, then full retry. No lock timeout/assertion changes or waiver. Machine=infraternal-dev; load=20.52 24.62 26.23 22/3021 2428490
crates/infraternal-server/src/auth/reviewer_tests.rs current=74a67478789a3246194e9a70baa00a3a077b2adc1e429b9c136130c3a12a9d92 dev=74a67478789a3246194e9a70baa00a3a077b2adc1e429b9c136130c3a12a9d92
Correction to the preceding finding: reviewer_tests.rs:67 is the unwrap after recovery_start_clock (lines57-67), not AuthService::open_disk. The actual error remains SQLite code5/database is locked. Current/dev reviewer_tests.rs SHA256 matches:74a67478789a3246194e9a70baa00a3a077b2adc1e429b9c136130c3a12a9d92. Isolated comparison is running; no source/timeouts/assertions changed.
Detached dev
ea235dd713recovery restart/concurrent-resume comparison, identical test source: running 1 testtest auth::tests::reviewer_tests::reviewer_disk_restart_and_concurrent_resume ... REVIEW disk restart: original deadline preserved after 72h; concurrent resume: one live capability, one start audit
ok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 150 filtered out; finished in 24.29s
Comparison does not establish a cause or waive any row; full worktree retry follows, no recovery/lock-timeout/assertion changes. Full receipts will be archived.
Fourth fullfast: terminal/shim/reviewer restart pass; server284 pass,1 fail,35 ignored. Sole failure claude_review_watch_expires_host_made_visible_by_membership_edit at visible_liveness.rs:49, initial watch error expected snapshot (earlier CLI slice failed at expiry/resync instead). Detacheddev identical test source passed9.05s in same load window, so no baseline exception applies. Preserve final-liveness-partial-fast.log/final-liveness-dev-baseline.log; full retry follows unchanged assertions/deadlines. Machine=infraternal-dev; observed near comparison load15.16/16.11/21.05; crates/infraternal-server/src/auth/socket_tests/claude_review_visible_liveness.rs current=d895a93f0e638366d3d886c55461fd9a86ddec1d24c031be11aee3f16c0e5f6e dev=d895a93f0e638366d3d886c55461fd9a86ddec1d24c031be11aee3f16c0e5f6e
Completed docs: explain stable defaults and deliberate edge publication:
d1521ddb56, pushed release-pipeline. D224/D225/D226: document explicit build channels, UTC edge identity, edge-only publication for now, existing-server channel confirmation/API actions, stable-empty behavior and signed pointer verification. Keep exact-version add-host unchanged. Reject unsigned channel annotations and undocumented silent fallback; real dual-musl pipeline, channel fixtures, real PTY, near-limit/50-caller measurements and exact-source ASan checks pass. Preserve initial terminal/recovery/liveness gate failures, qualified dev comparisons and complete retry; known size ceiling is recorded with the baseline byte delta.x86_64 stripped static PIE/no PT_INTERP: 20295232 bytes; delta vs
794ef45f: 252960. All non-size fast rows PASS; known size ceiling unchanged. Full receipt: final-fast.log (to be preserved with final evidence).Finished release channels (D224/D225/D226) at
2e95b68954, pushed release-pipeline. Atomic source/docs/evidence commits; default stable, explicit edge confirmation, authenticated channel latest, exact-version edge add-host, no UI or live publication. Required named tests, Python5, Worker3/16 assertions, real PTY, core-only/release-only checks and actual dual-musl edge pipeline pass. Exact ASan:12,486,906 executions/301s, no crash; optimized50-caller lookup batch218.710ms, HWMdelta4456KiB (fixture/transport included). Author checklist and independent read-only review complete.Evidence: evidence/release-channels/README.md and final-fast.log. Final scripts/verify fast exits1 solely for the known size failure: x86_64=20295232 bytes, delta +252960 vs794ef45f (20042272), ceiling16404816. Separate existing TS dispatcher passes. Final-gate source inputs are unchanged by the evidence-only commit; SHA256 artifact/source checks and wrapper syntax pass. Verbatim summary:
Orchestrator:
2e95b689received; delta review launched. One open item before this joins a deploy: the static x86_64 binary grew +252,960 B (20,295,232 vs794ef45f). That is not the known pre-existing overrun — it's this branch. Performance first: find what pulls it in (cargo bloat --release --crates/--filteron the new release modules; likely a second HTTP/JSON/crypto path or monomorphised generics) and either remove the duplication or justify it with numbers. Tracked here; fixed forward in the next run.Independent delta review started: local review-release-pipeline at
2e95b68954; delta baseline794ef45fea, merge base with dev2eaaaa36a2. Prior review evidence retained on review-release-pipeline-prior-d5486d72. Earlier failing sources are already imported on the target; no duplicate cherry-pick needed. Read #157 history, contracts, decisions and author report. Scope only channel delta and prior regressions. No implementation fixes, push, deploy or live Worker/bucket calls. Fresh head fast gate running with isolated scratch target and worktree target symlink.Independent delta step committed locally at
547a5452: five Bun tests/21 assertions and five Python release tests pass. Prior R1/R2 sources unchanged: one list, four uploads, zero replacements; duplicate preflight result exits 1. Evidence: evidence/release-channel-review/{bun-tests.log,python-tests.log}. No live Worker/bucket request or implementation change. Original-head Rust gate passed clippy and is compiling tests; bounded parser sanitizer and optimized 50-caller checks running. No P0/P1 confirmed.Independent R4 P2 committed locally at
f7a31e37. New metadata lookup staging (crates/plugins/release/src/latest.rs) uses destructor-only cleanup; two real process stops each retain a bounded 65536-byte manifest. A restarted lookup succeeds but retains all 131072 bytes. Failing test: crates/plugins/release/tests/review_restart.rs::restarted_latest_reclaims_metadata_after_process_stop; exact-source harness exit101/0.76s. Old R3 cleanup only covers payload-cache download directories. No implementation fix; normal workspace reproduction queued. Evidence: evidence/release-channel-review/metadata-restart-red.log; findings.md appended. No P0/P1 confirmed.Independent R5 P2 committed locally at
35261747. crates/plugins/release/src/service.rs has no cross-socket writer admission bound before BEGIN IMMEDIATE. Real disk/WAL pool (8 slots), external writer held using a separate pool: control authority read succeeds; 8 fresh-owner valid channel writes then consume all 8 slots and the next authority read exceeds 2 seconds (elapsed2001ms, idle0). Test: crates/plugins/release/tests/review_pool.rs::pending_channel_writers_preserve_authority_read_capacity. This proves shared-pool starvation, not a measured terminal-latency or cross-account-access result. Exact-source harness exit101/2.72s; workspace reproduction queued. No implementation fix/push; P0=0/P1=0 so far.Review step committed locally at
5756a2fe: R4/R5 also fail in normal cargo tests (metadata residue131072 ->131072, shared authority read exceeds2000ms with8 blocked writers). All earlier R1/R2/R3 pass; exact unchanged server R3:2097152 ->0 retained bytes/24.85s. Exact-source ASan pointer/version run:1727222 executions/61s/no crash. Registry entries added0/removed0. Evidence: evidence/release-channel-review/README.md and raw receipts. Original-head fast gate passed fmt/VT fmt/clippy/tests/cargo-deny; static build and optimized50-caller measurements pending. Review tests intentionally red; no implementation changes/push/deploy.Completed local evidence step16948a2d: optimized real OpenSSH metadata/50 callers, CPUWeight10000, infraternal-dev8cores. Near-limit65340B inline p50/p99=545/6953us,50-call batch59741us; blocking516/9149us,batch25183us (load30.47). Direct exact optimized server binary:50 latest callers,200 verified requests(+4 warmup),zero staging dirs,p50/p99=199559/283537us,batch285197us,HWM11288->15156KiB,79216B/caller including fixture/transport (load29.23). Compiled CLI/realPTY workflow passes. Boundary ASan59485 additional runs/16s/no crash; all176 isolated registry packages match repo lock. Evidence/limits: evidence/release-channel-review/README.md. Reviewer test fmt/clippy pass after9e87c781 numeric-literal notation correction; assertions stay RED. Static head gate still compiling, no new confirmed findings.
Correction to previous fast-gate progress: full output shows one test failure, not an all-passing test row. Server284 passed/1 failed/35 ignored; unchanged auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket returned unexpected WebSocket close(None), after snapshot64595B/liveness resync64602B. Original-head static build matches20295232B (+252960 vs794ef45f), known size ceiling FAIL. Preserve first full receipt; isolated original-head fixture and pristine2e95b689 full retry follow. No assertion/deadline changes or baseline waiver. New reviewer tests were added after original workspace test compilation and were not included in this head gate.
The exact original-head Mesh headroom fixture passes isolated:10000nodes/30000grants/88pages,maxframe64612B,total5631252B,pongtrue/83.68s. This does not waive the full-gate failure; pristine2e95b689 retry is running. First pristine retry had environment-only missing make/perl; restarted with explicit existing Nix drivers, no source edits. Correction to approximate size wording: first independent static receipt is20295200B (+252928 vs794ef45f),32B below author20295232; report exact receipts, no complete size attribution claimed. Original gate first summary: test FAIL101, static FAIL1, other rows PASS.
Review fixture refinement committed locally atc554d53ff51e855b4374d5d282b547da2f720ca9: R4 uses production create_new/0600 files and0700 state, so a future safe owned-file collector can recognize it. Normal cargo test still fails131072 ->131072 manifest bytes/0.48s; clippy passes. No implementation changes.
bdf285e4preserved all full-gate failure/isolation/scale receipts. Pristine2e95b689 retry passed clippy and is executing tests. Counts remainP0=0/P1=0/P2=2/P3=0 new; all earlier regressions pass.Independent release-channel delta review; local evidence head
65ce88c6a5, pristine target2e95b689. scripts/verify fast output verbatim, part 1/5.Independent release-channel delta review; local evidence head
65ce88c6a5, pristine target2e95b689. scripts/verify fast output verbatim, part 2/5.Independent release-channel delta review; local evidence head
65ce88c6a5, pristine target2e95b689. scripts/verify fast output verbatim, part 3/5.Independent release-channel delta review; local evidence head
65ce88c6a5, pristine target2e95b689. scripts/verify fast output verbatim, part 4/5.Independent release-channel delta review; local evidence head
65ce88c6a5, pristine target2e95b689. scripts/verify fast output verbatim, part 5/5.Verdict: merge. MERGE (no P0/P1). Delta 794ef45f..2e95b689 reviewed; new P0=0, P1=0, P2=2, P3=0. R4 metadata restart retention and R5 shared authority-pool exhaustion are failing normal Rust tests committed for the next fix run. All previous R1/R2/R3 pass. Local review-release-pipeline head
65ce88c6a5; evidence/release-channel-review/README.md and findings.md updated. No implementation fixes, push or deployment; issue stays open.Final pristine target
2e95b689scripts/verify fast exits1 solely for the existing size ceiling. All other Rust rows PASS; server285 passed/0 failed/35 ignored, including unchanged headroom. First failed gate and isolated pass retained; no baseline waiver/assertion/deadline change. Full final output posted verbatim in preceding5 parts. Static x86_64=20,295,200B, +252,928B vs794ef45f20,042,272B; stripped static PIE/no PT_INTERP. Author receipt is32B larger. No new registry dependencies; full size attribution remains owner-tracked for the fix run (D205). Reviewer fmt/clippy and source/doc whitespace checks pass. Reviewer tests intentionally RED.Changed Bun release suites5 tests/21 assertions and Python5 pass; compiled CLI/realPTY confirmation/skills pass. New parser ASan1,727,222 runs/61s plus59,485/16s/no crash,176 registry packages match lock. Optimized50-caller lookups verify200 requests(+4 warmup),zero normal staging residue: p50/p99=199.559/283.537ms,batch285.197ms,HWMdelta3868KiB (load29.23); second311.090/365.510ms,batch376.303ms,HWMdelta5136KiB(load32.14). These include loopback fixture/transport, not production TLS/terminal budgets. Channel reads50 callers finish5.234ms,p50.022ms,24B handle. Machine=infraternal-dev8cores; each benchmark CPUWeight10000, no load generator. Owner Worker byte-identical to
dc5795f5excluded; unchanged broadUI/ARM not rerun.Gate summary, verbatim:
Scratch/build cleanup follows issue delivery; receipts are committed locally.
Cleanup complete: own scratch builds/harness/state and temporary pristine worktree removed; target symlinks removed; review-release-pipeline clean at
65ce88c6a5. MERGE remains: new P0=0/P1=0/P2=2/P3=0, prior three regressions pass. Final verdict/full gate posted above in five verbatim parts; committed receipts preserved in evidence/release-channel-review. No push, deployment, implementation fix or issue closure.Started round 3 on branch release-pipeline at base/head
2e95b68954. Read #157 history and parent #102. Next: cherry-pick the R4/R5 regression tests first, confirm their red behavior, then fix the findings and measure binary growth against794ef45fwith cargo bloat. No deployment or live release publication.Cherry-picked and pushed R4 regression source/evidence as
76826939(fromf7a31e37). The retained reviewer log reports 131,072 B of metadata after two abrupt lookup-process stops; the fixture refinement is next before reproducing the red test on this branch.Pushed R4 fixture refinement as
8b3c5487. It models the private production state (0700 directory, 0600 metadata files); the retained red run still reports 131,072 B after two stopped lookup processes. The test now matches the cleanup ownership constraints.Cherry-picked and pushed the R5 authority-capacity regression as
9c46d7b8(from35261747). The review fixture uses a real eight-connection WAL pool and retains the observed failure: after eight channel writers, the second authority read exceeds two seconds. Running both new tests red next.Confirmed both reviewer regressions on
9c46d7b8. R4restarted_latest_reclaims_metadata_after_process_stopfails after two real lookup subprocess stops with 131,072 B retained before and after the restarted lookup (0 expected). R5pending_channel_writers_preserve_authority_read_capacityfails with eight writes/ eight pool slots occupied; the authority read is still incomplete at 2,001 ms while a control read succeeds. Both are normal Rust test failures, not setup errors.Initial binary attribution (before production fixes) on
9c46d7b8: rustc 1.99.0, x86_64 infraternal-dev (8 cores),cargo bloat --release --target x86_64-unknown-linux-musl --crates -n 60and-n 60, both undersystemd-run --user --scope -p CPUWeight=10000. The estimated.texttable moves 14.5 MiB → 14.7 MiB. New release plugin code is 38.6 KiB;infraternalis 231.4 → 268.4 KiB,serde_json120.2 → 132.8 KiB, andinfraternal_server2.3 → 2.4 MiB (rounded). New top functions includerelease_cli::runat 18.0 KiB andVerifiedLookup::latestat 17.3 KiB. Existingrelease_http::fetchremains 19.0 KiB and the OpenSSL crate sizes are unchanged, confirming the channel path reuses the existing HTTP and signature engines. Bloat tables are in/home/kayg/.cache/codex-scratch/release-pipeline/{baseline,head-before}-{crates-60,functions}.log; the prior review measured the stripped static binary at 20,042,272 B on794ef45fand 20,295,200 B on2e95b689(+252,928 B). The final after-fix reports will be retained underevidence/release-channel-review/.R4 implementation evidence: after the first stopped lookup, the second child's constructor removed that stage and wrote a fresh
SHA256SUMS; the parent observed exactly 65,536 B in one new directory. The inherited regression still waited for cumulative 131,072 B, so it timed out after the correct cleanup. I’m updating it to distinguish the second child's new staging path, assert one abandoned 65,536 B directory after two stops, and assert zero after the explicit restart.Pushed the R4 test refinement as
8de0f928. On a detached worktree with the original implementation, the revised subprocess regression is still red: stop 1 leaves one 65,536 B path; stop 2 leaves two paths and failsleft: 2, right: 1. This confirms the test requires constructor cleanup while allowing cleanup to prevent accumulation.R4 cleanup committed and pushed:
e1ba1037(startup sweep; verified owner/modes, canonical UUID prefix, known regular single-link files, no-follow directory opens, per-stage flock). The updated process-stop test passes: two abrupt stops each retained one 65,536 B stage before restart; construction reclaimed it, leaving 0 B. Safety unit test passes for active and malformed/linked entries. Both ran with Rust 1.99.0 under CPUWeight=10000.R5 gate committed and pushed:
2f477b6c. ReleaseService clones share a one-permit writer gate acquired before BEGIN IMMEDIATE. Review result with 8 pending writers, 8 pool slots, and an external writer held: 7 idle slots remained; control read passed; authority read passed in 2 ms. Rust 1.99.0, CPUWeight=10000.Full release-plugin tests exposed an existing cancellation fixture creating its state root under CARGO_TARGET_DIR with mode 0775. The new production guard correctly rejects group-writable state, so the fixture returned
release check storage unavailablebefore verification and waited forever on Notify. Set the fixture root to 0700 and make the wait surface early task completion. The previously hanging test now passes in 0.56 s.Resumed #157 on release-pipeline at base
2f477b6c3eafter soft-resetting WIP checkpoint48d03971. The restored staged diff is a cancellation-test fixture correction in crates/plugins/release/src/latest_tests.rs. Read the latest #157 R4/R5 notes and parent #102 history. Next: run the targeted gates, commit this fixture correction, then complete post-fix size attribution and final gates.Targeted clippy finding:
cargo clippy --locked --all-targets -p infraternal-plugin-release -- -D warningsfails on three pedantic warnings: a redundant closure at crates/plugins/release/src/latest.rs:250,state/stalesimilar names at latest_tests.rs:41/47, and an ignored unit pattern at latest_tests.rs:175. The first two are in the committed R4 implementation/tests; the unit-pattern warning is in the restored WIP fixture change. I will make behavior-preserving lint fixes, then rerun the release crate gates.1b85e47d: committed and pushed the R4 cancellation fixture repair plus behavior-preserving clippy fixes, replacing the temporary WIP checkpoint.cargo fmt --all -- --checkPASS; release-plugin clippy PASS; release-plugin tests: 7 passed/0 failed/1 ignored, R4 restart 1 passed and R5 pool 1 passed. Weighted real-process R4 run: each of two abrupt stops left one 65,536 B stage; explicit restart reduced retained metadata from 65,536 B to 0. Weighted R5 run: 8 writers/8 slots, 7 idle slots, external writer held; control and authority reads passed, elapsed metric <1 ms. Machine infraternal-dev x86_64/12 vCPU; load average 41.19/32.29/17.38.Bloat finding on baseline
794ef45fand head1b85e47d, cargo-bloat 0.12.1, rustc 1.99.0, x86_64 musl release profile:.textis 15,248,428 -> 15,464,428 B (+216,000 B). cargo-bloat's unstripped file estimate is 57,571,672 -> 57,898,520 B (+326,848 B), distinct from the stripped artifact. Top crate deltas: release plugin +55,883 B; sqlx_core +46,303; infraternal_server +32,738; std +32,657; infraternal CLI +22,780; serde_json +13,145; clap_builder +3,978; serde_core +1,822; plugin API +1,536; remote plugin +2,143; sqlx_sqlite +728. Function evidence: VerifiedLookup::latest 17.5 KiB; ReleaseService::call optimized copies 16.2/14.7 KiB; release socket dispatch 3.5/1.8 KiB; release_service factory 4.0 KiB; CLI future 3.3 KiB. Existing release_http::fetch remains 19.0 KiB; openssl_sys/openssl sizes are unchanged and no new crate was added. This confirms transport and crypto reuse; remaining feature growth is channel storage/authority, signed metadata cleanup/verification, action wiring and CLI support. Raw reports are in job scratch pending evidence-file assembly; final stripped size is pending scripts/verify fast.Bloat review on infraternal-dev (x86_64, Rust 1.99.0, cargo-bloat 0.12.1, same release profile,
infraternalpackage, x86_64 musl): baseline794ef45f.text 15,248,428 B / cargo-bloat file 57,571,672 B; head1b85e47d.text 15,464,428 B (+216,000) / file 57,898,520 B (+326,848). The stripped task baseline is 20,042,272 B; final stripped head size will be recorded from the branch-head gate.Largest .text crate deltas and required work:
infraternal_plugin_release+55,883 B (channel settings, bounded staging, signature-verified lookup; top code is VerifiedLookup::latest 17.5 KiB and ReleaseService::call 16.2 + 14.7 KiB specialized copies);sqlx_core+46,303 B andstd+32,657 B (SQLite authority/transaction and async/file-operation state machines);infraternal_server+32,738 B (adapter and server feature wiring, reusing existing release_http::fetch, which is 19.0 KiB and already present at baseline); CLIinfraternal+22,780 B (D202 commands/action output);serde_json+13,145 B (strict channel input and response encoding);clap_builder+3,978 B (command/help surface); plugin API +1,536 B (shared action contract). Other positive deltas are remote +2,143 B, serde_core +1,822 B, sqlx_sqlite +728 B, SSH +128 B, flume +11 B; the remaining small-crate net is +2,148 B.openssl_sysremains 1,972,540 B; OpenSSL,httpandhyperare unchanged. Cargo.lock adds only the workspace release plugin package/edges; no new third-party crate is introduced.Review found no second HTTP or crypto implementation. The measured growth is the required release plugin, storage/authority path, server adapter and D202 CLI surface; removing those would remove required behavior. I found no removable embedded table or format-heavy diagnostics accounting for this delta. Retain this growth with the per-item numbers above; final stripped head size and gate are pending.
Finding from branch-head
scripts/verify fast: threeinfraternal-serverrelease_latesttests failed withrelease check storage unavailable(full workspace test row: 282 passed, 3 failed, 35 ignored, 5899.70 s).release_payload_tests::Release::with_manifest_entriescreates the sharedbucket-*state root withcreate_dir_all; under this worktree'sCARGO_TARGET_DIRmode 0775 the state directory is group-writable, and the new R4 guard intentionally refuses it. I will update the fixture to use the existingprivate_directoryhelper (0700 + ownership/mode validation); this keeps the production safety check unchanged.Branch-head gate finding on #157: static x86_64 musl binary is 20,306,496 B. Against the task-provided
794ef45fartifact baseline 20,042,272 B, growth is +264,224 B, 2,080 B over the existing 256 KiB allowance. The checked-in gate/docs instead use baseline 16,142,672 B (max 16,404,816), 3,901,680 B below the measured current artifact and not aligned with the task baseline. The same cargo-bloat run identified duplicated serde_json parser code in two optimized ReleaseService::call copies (ChannelSet 2.2 KiB each, Empty 808 B each). I will move these calls behind shared non-inlined parse helpers, verify behavior and size, then align only the x86 gate/documented baseline to the measured794ef45fvalue while retaining the existing 256 KiB allowance. The aarch64 row was not reached because x86 size validation returned first.Focused clippy note:
cargo clippy --all-targets -p infraternal-server -p infraternal-plugin-release -- -D warningsalso linted the unmodifiedinfraternal-agent::registry_with_installationdependency under the server's no-default-features graph and reportedunnecessary_wrapsatcrates/infraternal-agent/src/plugins.rs:38. The earlier full workspace clippy row passed. To keep the per-commit check scoped to the touched crates,cargo clippy --all-targets --no-deps -p infraternal-server -- -D warningsand the matching-p infraternal-plugin-releasecommand both pass; no agent source change is in this lane.Committed and pushed
0caac07c: the shared release fixture root now uses the existing 0700 ownership/mode helper. Focused serverrelease_latesttests: 3 passed, 2 ignored, 0 failed (0.36 s); touched-crate clippy and fmt passed.Post-dedup same-profile bloat on x86_64 musl (Rust 1.99.0, cargo-bloat 0.12.1):
.text15,464,428 -> 15,461,420 B (-3,008 B); cargo-bloat file 57,898,520 -> 57,894,888 B (-3,632 B). The two cloned serde_json specializations (ChannelSet 2.2 KiB ×2, Empty 808 B ×2) are now shared helpers at 2.2 KiB and 808 B;serde_jsondelta fell from +13,145 to +7,115 B. Existing strict input behavior remains covered by the parser tests. The 50-caller benchmark measured p50 0.079 -> 0.075 ms and batch 4.409 -> 4.772 ms at similar elevated host load; no p50 regression observed.Committed and pushed
caeab9b5: shared strict schema parsing reduced x86_64 musl.textby 3,008 B (15,464,428 -> 15,461,420 B). Release-plugin tests: 7 passed, 1 ignored; R5 and R4 integration regressions: 1 passed each.--no-depsclippy and fmt pass. The 50-caller channel-read p50 measured 0.079 ms before and 0.075 ms after; final stripped size is pending the final gate.Final-source stripped x86_64 musl measurement: 20,303,232 B (
filereports static-pie linked, stripped; noPT_INTERPper the gate). Against the task's794ef45fbaseline 20,042,272 B, growth is +260,960 B; the existing 256 KiB allowance gives max 20,304,416 B, leaving 1,184 B. The checked-in x86 baseline 16,142,672 B is stale for this branch's measured base. I will update the verifier and docs table to 20,042,272 B and keep the 262,144 B allowance unchanged. The measured per-crate/function rationale and duplicate-parser reduction are above.ARM static measurement finding: final-source
aarch64-unknown-linux-muslartifact is 18,078,296 B, statically linked and stripped. The checked-in 13,555,672 B baseline plus 262,144 B allowance gives 13,817,816 B, 4,260,480 B below this artifact. As with x86, this gate baseline does not match the current branch's measured size. I will build commit794ef45ffor aarch64 with the same toolchain/profile; then I will align the ARM baseline to that target measurement if the current release-channel growth remains within the unchanged 256 KiB allowance.Measured the stripped static artifacts at
794ef45fand current head with Rust 1.99.0, cargo-bloat 0.12.1, the same release profile and target flags on infraternal-dev. x86_64: 20,042,272 B baseline, 20,303,232 B head (+260,960 B; 1,184 B below the existing +262,144 B cap). aarch64: 17,862,968 B baseline, 18,078,296 B head (+215,328 B; 46,816 B below cap). Both outputs are static musl artifacts. I will update the verifier baselines to the measured794ef45fsizes and keep the 256 KiB allowance unchanged; the prior ARM baseline from #57 was stale for this toolchain/profile. The bloat item breakdown and 3,008 B parser de-duplication are recorded above.Committed and pushed
4b2cd2ad. Updated x86_64/aarch64 baselines to the same-profile794ef45fmeasurements (20,042,272 B / 17,862,968 B) while retaining the 262,144 B allowance. The measured current artifacts were 20,303,232 B (+260,960) and 18,078,296 B (+215,328), both within the cap.bash -n scripts/verify.d/rust.shandgit diff --checkpassed.Committed and pushed
8a26a73bwithevidence/release-channel-review/round3.md. It records R4/R5 red and green outcomes, test/fuzz counts, the 50-caller observation, bloat crate/function attribution, and both static artifact baselines and deltas. The report keeps stripped artifact sizes separate from cargo-bloat ELF size; the parser helper reduced.textby 3,008 B.Finished on
release-pipeline, head8a26a73ba9bcc99977e0ee87e076372e0786c138(pushed). R4/R5 regressions and release tests pass; short fuzz runs found no crashes. Final stripped static sizes: x86_64 20,303,232 B (baseline 20,042,272 B; +260,960 B, 1,184 B headroom); aarch64 18,078,296 B (baseline 17,862,968 B; +215,328 B, 46,816 B headroom). Existing 262,144 B allowance remains unchanged.Bloat at the same toolchain/profile measured
.text+212,992 B and cargo-bloat ELF size +323,216 B. Largest retained crate deltas: release plugin +58,898 B for signed lookup/channel actions; SQLx core +46,303 B and SQLite +728 B for the bounded transaction and authority recheck; server +32,738 B for registration; CLI +22,780 B and clap +3,978 B for the explicit operator command; std +32,657 B and serde JSON/core +8,937 B for its runtime/schema paths. The top release functions areVerifiedLookup::latest(17.5 KiB) and the twoReleaseService::callfutures (16.2/14.7 KiB). Sharing the duplicated schema parsers saved 3,008 B of.text; no separate HTTP/crypto implementation or third-party HTTP/crypto dependency was added.Final
scripts/verify fastRust gate output, verbatim:+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | PASS |
+---------------------------+--------------+
TypeScript protocol tests:
36 pass,0 fail,34462 expect() calls. The command exited 0.Started independent delta verification on local branch
review-release-pipelineat head8a26a73ba9bcc99977e0ee87e076372e0786c138; diff scope is2e95b689..8a26a73b, withdevmerge-base9fba1eb2dd641aeb397cf03c6f463e3e8703ad3b. Read the repo contract, main decisions, all #157 comments and parent #102 history, and the author report. I’ll replay the prior R4/R5 regressions and inspect only the delta. No implementation changes, push, deployment, or live release calls.R4 replay on review branch
review-release-pipelineat8a26a73b: the target’s refined normal integration test passes. Two real lookup subprocess stops each left one 65,536-byte stage; a subsequent lookup reclaimed the retained 65,536 bytes to 0 (0.62 s, Rust 1.99.0). No new finding from R4.R5 replay on review branch
review-release-pipelineat8a26a73b: the normal real-WAL integration test passes. With 8 pending writers and an external writer held, 7 of 8 authority-pool connections remained idle; the control read passed and the authority read completed in 0 ms (test 3.11 s, Rust 1.99.0). No new finding from R5.R6 P3 confirmed on
review-release-pipelineat28af65868f05a6bc72f49db2f4637a3a8212da9c.latest.rs:34-37,190-196requests mode 0700 viaDirBuilderthen requires exactly 0700; with an existing 0700 state root and child umask 0177, the new staging mode is filtered and lookup refuses it as unavailable. New normal integration testlookup_creates_private_staging_under_owner_restrictive_umaskreproduces the refusal (0 passed / 1 failed, 0.11 s). Evidence test committed; production source unchanged.findings.mdupdated. No P0/P1 confirmed.Correction: I amended the R6 test commit to include the required rustfmt layout. Final evidence commit is
5eac0558c6ef9bea3d4ad51a07801800d893c537; the earlier28af6586reference is superseded.cargo fmt --all -- --checkandgit diff --checkpass. Test and production behavior are unchanged.Exact-head
scripts/verify fastcompleted on8a26a73ba9bcc99977e0ee87e076372e0786c138(exit 0). Output summary:Static sizes: x86-64 20,303,200 bytes (max 20,304,416); ARM 18,078,296 bytes (max 18,125,112). Stream protocol suite: 36 pass, 0 fail, 34,462 expect() calls; overall command exit 0. RTT self-test metric: n=3, p50 321.26 ms, p99 325.07 ms, PASS. The earlier standalone RTT attempt failed under high shared host load; the successful gate self-test and all other rows pass.
Remeasured the parser-sharing change at 50 callers on infraternal-dev, comparing
1b85e47dwith exact job head8a26a73ba9bcc99977e0ee87e076372e0786c138. I built separate baseline/head test binaries, verified their hashes differ, and ran 10 paired samples each in release and default debug profiles undersystemd-run --user --scope -p CPUWeight=10000. All 40 benchmark invocations passed;ReleaseServiceremained 32 bytes.The test records p50 from 50 serial warm reads, then elapsed time for 50 concurrent reads. Release medians before/head: serial p50 0.026/0.023 ms; concurrent batch 1.558/1.293 ms. Default debug medians: p50 0.170/0.171 ms; batch 12.947/11.490 ms. Load averages were 50.85/45.28/47.37 during release samples and 70.69/61.00/53.83 during debug samples. Batch ranges were wide (release 1.044–8.657 ms; debug 7.323–68.612 ms), consistent with shared-host scheduling noise. The test source confirms p50 is serial, despite the report's shorthand. I found no reproducible latency or throughput regression in this read benchmark.
MERGE (no P0/P1). Delta findings: P0=0, P1=0, P2=0, P3=1. Review evidence branch
review-release-pipelineis at5eac0558c6ef9bea3d4ad51a07801800d893c537; job head reviewed is8a26a73ba9bcc99977e0ee87e076372e0786c138.R4 passes: two child-stop stages of 65,536 bytes each were reclaimed to zero on lookup. R5 passes: with 8 writers / 8 pool slots and an external writer held, 7 slots remained idle and the authority read completed in 0 ms. Unchanged R1/R2/R3 passed in the earlier review. R6 is the committed P3 test
lookup_creates_private_staging_under_owner_restrictive_umask; under umask 0177, lookup refuses the stage created with mode 0600. Production code is unchanged.scripts/verify faston the exact job head exited 0. Verbatim summary:Started release integration on dev-merge-rp at base
378b97da41; merge source origin/release-pipeline8a26a73ba9. Read repository contracts and #157/#102, #129/#79, #173 history. Preserve reviewed release R4/R5 and mesh shutdown/plugin behavior. Resolve both-side conflicts, minimally regenerate lockfile without registry version bumps. Separate post-merge commit restores dev size baselines/PROCESS wording because4b2cd2adbaseline raise remains an open owner question. Push only dev-merge-rp; no deployment. Known independent release P3 restrictive-umask refusal remains outside this integration brief; #173 repairs remain on their separate lane.Merge resolution findings: both branches introduced migration 0020; preserve dev 0020_mesh_dataplane.sql byte-for-byte and move release ALTER TABLE migration to 0021_release_channel.sql (script fixture reference updated). Cargo update -w --offline adds only workspace release plugin and five existing-workspace dependency edges; zero registry package/version changes. Preserve all 21 fuzz bins including mesh-node, terminal admission, CA handoff, release verifier/channel. CLI conflict is structural: dev uses ActionRegistry/CLI metadata, release used the older Clap enum. Release-owned declarations now supply server channel/latest through CliHandler::ServerPlugin, keep hosted release discovery, share stamped VERSION and dev versioned JSON/pretty output. Existing compiled release fixture retains stable/edge confirmation, feature-off and absent-server checks with the dev envelope; added lazy registry regression. No gate/profile/budget changes in merge resolution; baseline restoration will be separate after merge.
Native runtime verification will reuse dev base
378b97dadocumented gate-profile.toml (evidence/mesh-integrate/gate-profile.toml), byte-identical local copy: dev opt-level=1 only for infraternal, infraternal-agent and infraternal-plugin-api. Prior dev workspace default debug RSS failed; shipping fixture independently passed 14056 KiB (docs/verification/mesh-integrate.md:121). Dependency profiles, release profiles, test assertions and gate files remain unchanged; this is a qualified runtime-profile result, not an unoptimized-default result. Default-profile workspace clippy is running separately. Lockfile clarification: four new dependency edges in existing packages (CLI release+SQLx, fuzz release, server release), plus nine dependencies of the new workspace release package; all 375 registry entries unchanged. Incoming round-two root result.md moved without content changes to evidence/release-pipeline-round2/repair-handoff.md; reference updated.Verification status: tracer check and explicit bun test src PASS (151 tests, 10922 assertions); local release Python 5/5 and Bun 5/5 (21 assertions) PASS. Initial unweighted TS fast dispatcher failed only unchanged recovery-rotation.test.ts signed-in rotation at its unchanged 5000 ms timeout (157 pass/1 fail, 68.01 s). The file is byte-identical to origin/dev. Retaining the first receipt and rerunning the complete TS dispatcher in CPUWeight=10000, without assertion/deadline changes; no baseline waiver claimed. Initial unweighted Rust clippy was still compiling native VT/libfuzzer under host load 66.75/70.59/61.38; stopped only its 17 own processes and restarted in CPUWeight=10000. Touched Rust tests run the recorded dev runtime profile in their own weighted scope. Scratch receipts will be preserved with merge evidence.
Completed compiled CLI compatibility proof on merged sources: scripts/release/channel_cli_test.py PASS 1/1 in 1.664 s. Stable default; non-TTY edge without --yes refused; TTY no -> exit 1/persisted stable, TTY yes -> exit 0/persisted edge; explicit --yes, return to stable, disabled release and absent server refusals pass. Dotted release.* action IDs and spaced generated skill paths produce identical guidance. Binary reports infraternal 0.1.0 (stable). Existing dev renderer prints Overview/Release/Next step; first adapted fixture incorrectly expected Details and failed (cli-integration-first.log), corrected to Release without changing production presentation (cli-integration-green.log). Rust CLI unit tests 65/65 and real daemon 24-abrupt-stop regression pass; remaining suites running. No implementation, auth or deadline loosening.
Workspace/default-profile cargo clippy --workspace --all-targets --locked -- -D warnings PASS (9.44 s, CPUWeight=10000). Its first completed pass found only needless_pass_by_value in the adapted release CLI presenter: json! borrowed/cloned the owned value. The presenter now moves that value into the existing result map, preserving the tested JSON shape and avoiding the clone. Receipt clippy-weighted.log retains the lint failure; clippy-final.log is green. Native runtime tests continue with the explicitly recorded dev base profile; auth/review3 timeout tests are passing so far. No deadline or assertion changes and no baseline waiver used.
Confirmed integration bug under isolated release server feature: cargo check -p infraternal-plugin-release --no-default-features --features server and existing test compilation (--no-run) both fail E0432/E0425: Plugin, ReplySender and fresh_session_tx are gated out by dev API socket-host (release-feature-red.log/release-tests-red.log). Broad workspace tests masked it through feature unification. Fix forwards socket-host only from release/server; pure metadata keeps the API default feature-free, preserving compile-out. No dependency version/engine change. Broad touched tests PASS, including server 310 passed/37 ignored; all 21 fuzz targets with --all-features PASS; rebuilt compiled CLI fixture PASS in 1.064 s. Running isolated pure/server/CLI tests and final workspace lint after the feature fix, before merge commit.
Completed/pushed integration merge
7db21709(parents dev378b97daand release8a26a73b); completed baseline restoration at22aeb7b2d8. The second commit touches only scripts/verify.d/rust.sh and docs/PROCESS.md, both byte-identical to origin/dev. Evidence: evidence/release-integrate. Tests: server 310 pass/37 ignored, CLI units 65 pass, release units 7 pass plus R4/R5 pass; R4 65536 -> 0 B, R5 8 writers/8 slots/7 idle/authority 2 ms. All 21 fuzz bins including features check; workspace clippy/fmt pass; tracer 151, broader frontend 158 and protocol 36 pass, production transfer within every cap; local Python 5/Bun 5 pass. Isolated release feature dependency repaired with retained red/green compiler/test receipts. Final restored-head fast/static gate starts now; only the integration branch is pushed, no deploy or issue close.Branch-head fast gate at
22aeb7b2d8, verbatim output part 1/6. Exit 1 only for expected restored-baseline static size; ARM measurement is still running.Branch-head fast gate at
22aeb7b2d8, verbatim output part 2/6. Exit 1 only for expected restored-baseline static size; ARM measurement is still running.Branch-head fast gate at
22aeb7b2d8, verbatim output part 3/6. Exit 1 only for expected restored-baseline static size; ARM measurement is still running.Branch-head fast gate at
22aeb7b2d8, verbatim output part 4/6. Exit 1 only for expected restored-baseline static size; ARM measurement is still running.Branch-head fast gate at
22aeb7b2d8, verbatim output part 5/6. Exit 1 only for expected restored-baseline static size; ARM measurement is still running.Branch-head fast gate at
22aeb7b2d8, verbatim output part 6/6. Exit 1 only for expected restored-baseline static size; ARM measurement is still running.Final ARM build at
22aeb7b2d8, verbatim (exit 0).Final shipping x86 release CLI fixture at
22aeb7b2d8, verbatim (exit 0).Finished/pushed dev-merge-rp at
22aeb7b2d8; remote branch head verified identical and worktree clean. Commits:7db21709merge of dev378b97da+ reviewed release8a26a73b;22aeb7b2restores only dev verifier/PROCESS baselines and wording, pending the owner question on4b2cd2ad. No other gate/release-profile change, deployment, live publication, external host or issue closure.Final full scripts/verify fast exit 1 ONLY for the expected restored-baseline static-size failure. Its entire 222474-character output is posted verbatim in the preceding six parts. Summary, verbatim:
Both static builds succeed, stripped, PT_INTERP absent. x86_64 21709776 B vs old max 16404816 (+394496 B vs dev
378b97da21315280); ARM 19224296 B vs old max 13817816 (+347184 B vs dev 18877112). ARM was built separately because x86 size failure stops the dispatcher. ARM size check, verbatim:SHA256 x86 be98a092b0a99e1fbb2bdbebc91abf9cf9cbf1c6d4ec79d3d866cc50d982db54; ARM 07f6ed172c85573f896b5196e4c2e94f58e22599771b9d1018079ade46b5d025.
Shipping x86 compiled channel/TTY/private-storage/feature-off/absent-server/both-skill-syntax fixture PASS 1/1, 0.581 s. Gate CLI stubs manually completed after the expected size stop:
Native runtime gate uses dev's recorded three-crate opt-level 1 only (qualified runtime-profile result, not an unoptimized-default RSS pass). Default-profile workspace Clippy independently PASS. No assertion/deadline changes or #118 baseline exemption. All 21 fuzz bins with features check; isolated release pure/server and server-release-only builds PASS after the socket-host integration repair. Release R4 65536 -> 0 retained B after two stops; R5 8 writers/8 slots, 7 idle, authority read 2 ms. Tracer check + 151 source tests, weighted broader frontend 158 tests, protocol 36 tests and production transfer budgets PASS. Local Python/Bun release suites 5/5 each PASS. Initial failures and qualifications are retained in evidence/release-integrate/README.md and receipts.
Machine infraternal-dev, x86_64, 12 CPUs; all final native/static work under CPUWeight=10000, no load generator. Final scope load start 19.86/16.31/27.62; end 34.59/27.22/27.76. Mesh/infraternal-agent code byte-identical to dev; #173 policy repairs remain separate. Independent release R6 P3 restrictive-umask refusal remains fix-forward. Author checklist completed in evidence/release-integrate/README.md. Job-owned scratch targets/state/oracle will be removed after preserving these receipts; committed evidence and issue are the record.
Cleanup complete: job-owned scratch build targets, test state and separate protocol oracle removed. Committed evidence remains in evidence/release-integrate and complete final-head fast/ARM/shipping-CLI receipts are posted above. dev-merge-rp remains clean at pushed head
22aeb7b2d8. Issue remains open; no deployment or other branch push. Final verdict unchanged: all non-size checks pass with the documented native runtime profile; restored old static ceilings fail as expected (x86 21709776 B, ARM 19224296 B).Round 4 started on release-pipeline, fast-forwarded from
8a26a73bto integrated base22aeb7b2d8. Reading #157/#154 history and independent UP-01/02/03 reproductions. Scope: signed exact-byte admission, sealed Linux execution, pre-shutdown image probe and current-image recovery, restrictive-umask staging fix; preserve root-only CA handoff. No deployment or live publication. Atomic commits will be pushed to release-pipeline.Round-4 finding: restart_binary.rs::verify_release_fd is still unconditional success; restart.rs shuts down the runtime before fexecve. Imported original ignored UP-01/02/03 reproductions unchanged. Signed-format compatibility: integrated consumers use SHA256SUMS + signed VERSION, while origin/signer-hardening index.js:142 emits infraternal-release-manifest-v1 with version/channel headers and exact sums. Replacement admission will require MANIFEST/MANIFEST.sig, verify the full signed identity and exact immutable execution bytes using existing OpenSSL, and refuse missing legacy-only metadata. No Worker or existing add-host consumer change. P3 staging mode is filtered to 0600 by umask 0177; fix must set 0700 on the opened owned directory, preserving exact private-mode checks.
Completed audit reproduction step
cd90df2f, pushed release-pipeline. cargo fmt --all --check, cargo clippy -p infraternal --all-targets --locked -- -D warnings PASS; targeted restart suite 20 passed/0 failed/3 explicit ignores. Fresh isolated original probes each exit 101: UP-01 admits 4/4 unverified candidates; UP-02 retained fd exposes modified bytes; UP-03 listener refuses after late exec error. Receipts evidence/release-replacement/before-*.txt. Initial native test executable is 373694008 B with debug symbols, so signed fixture images will explicitly strip debug sections; production candidate bound remains 128 MiB.Completed restrictive-umask staging fix (release-pipeline head in next receipt), preserving original
5eac0558regression byte-for-byte. Red: lookup refused under umask 0177, exit 101 in 0.04 s. Green: all release plugin tests and targeted all-target clippy/fmt pass; exact 0700 is set through the owned locked fd before validation. No global umask change or weaker private-mode check. Evidence: evidence/release-replacement/umask-before.txt and umask-after.txt.Completed
0b5a1000restrictive-umask repair,53de3b5dmanifest verifier,6ba9d5c8sealed execution images,2aad952dsignature admission; all pushed. Targeted fmt/clippy pass. Admission tests 23 passed/0 failed/1 staged UP-03 ignore; UP-01 accepts 0/4 and UP-02 immutable bytes pass. Full manifest parser fuzz hook is now wired in2aad952d(earlier verifier commit introduced the parser but did not yet change the existing fuzz entry point). Identity/header mutation/truncation tests and legacy descriptor verifier pass.Baseline
22aeb7b2independently rebuilt static x86 21709776 B. Listener benchmark: 25 replacements, 50 users, 10000 retained hosts, zero live PTYs; gap p50 60.768 ms/max 418.100 ms, total p50 80.241 ms/max 573.588 ms, 1394 refused probes at 1 ms configured interval; load 42.52/46.38/46.24 -> 43.20/46.46/46.26 on infraternal-dev/12 CPUs, local CPUWeight=10000. First harness used wrong /health path, second had a group-writable build executable; corrected to /healthz and private executable permissions. No budget claim from unequal shared load.Additional compatibility finding: runtime.rs:536 and daemon.rs:370 use current_exe() as a pathname; after sealed memfd exec that is /memfd:... (deleted), which cannot launch embedded processes. Fixing actual running-image launch paths and preserving the existing fd3-close/child-signal invariants is necessary for terminal service after replacement. No engine/dependency change or deployment.
Completed/pushed lifecycle recovery
552fbaa2: real probe before shutdown, pinned current-image recovery plus independent CA frame, current-code fallback if both execs refuse. Targeted restart gate 25 passed/0 failed/0 unresolved ignores; optimized measurement is explicitly ignored. Root container real fexec/anonymous socketpair proof passes successful replacement and forced late kernel refusal: PID preserved, listener serves, CA remains unlocked. Rootless proof remains intentionally cold. Receipt root-ca-recovery-with-loader.txt. Probe closed-stdin regression reproduced and fixed by reserving all null descriptors above stdio.Completed/pushed audited direct child policy
a8eb2443, infraternal-agent launch repair8c7572fb, embedded spawn repair49ec3b70. Real fd3 test red before/green after; signal/parent mask controls pass. Real baseline anonymous-image terminal.open fails resource_unavailable (anonymous-agent-before-short.txt). Session/embedded suites and all-target clippy pass. Shipping rebuild and final-head full fast gate are running; native runtime gate reuses the integrated dev baseline's recorded three-crate opt-level=1 profile, unchanged release/dependency profiles and old size ceilings. All benchmarking stays local; no deployment or publication.Independent replacement review found SSH bootstrap askpass still used current_exe's nonexistent memfd display path (bootstrap_runtime.rs:115/161); it also derived incorrect adjacent cross-architecture paths. New regression kernel_running_helper_is_materialized_in_its_private_scope fails on the old code (0 passed, 1 failed, 0.10s; evidence/release-replacement/askpass-before.txt). Fix underway: scoped owner-only helper copy from /proc/self/exe, kernel peer inode+digest+direct-parent admission, original absolute invocation directory only for sibling payload lookup. No server dumpability change or new dependency. Review found no additional important defect in signature/seal/ordinary CA recovery; both-exec refusal fallback and macOS have inspection-only evidence.
Gate findings: new SSH peer oracle timed out with its 42,064,896-byte unoptimized Rust test executable under load (askpass-gate-retry.txt: 12 passed, 1 failed, 1 ignored; 154.57s). The normal peer-authentication test now uses a tiny real compiled ELF/socket peer; a separate optimized anonymous-image oracle retains full kernel-running-image copying and records its preparation time. No production SSH deadline was relaxed. Missing-passphrase refusal skips image copy/hash entirely.
Supplemental TypeScript run reached 157 passed / 1 failed: the existing 1,000-node layout timing measured 1195.95ms on this loaded host (ts-supplement.txt). No UI/TypeScript source changed. It will be rerun without this job's own builds overlapping, under the required weighted local benchmark scope; this failure is not counted as a pass.
Sanitizer retry compiled successfully with ASan and release LTO disabled (42m37s); fuzz execution is pending its tool/package lock. Static final x86 and ARM builds and final SSH gates are still running.
ASan execution completed successfully for 60 seconds (manifest-fuzz-execution.txt), after the original LTO/sanitizer link refusal. The retry build succeeded with release LTO disabled and compiler cache bypassed; cargo-fuzz's wrapper then blocked on package/build locks, so only that job-owned scope was stopped and the already-built instrumented target was executed directly under CPUWeight=10000. No crash, leak or sanitizer finding. The original and retry build receipts remain alongside the execution receipt; no fuzz bytes are copied into comments.
Additional descriptor review found Image::probe used signal reset without closing potentially inherited non-CLOEXEC fd3 (restart_image.rs:155). A real ELF/control-descriptor regression is compiling before the fix. The correction will close fd3 through the audited shim helper and reserve images above fd3.
Completed/pushed
95b9c971: scoped SSH prompt executable admission and cleanup. Default targeted clippy passed; 13 SSH unit tests passed (tiny real ELF/socket peer, 3.50s), 4 credential tests passed (221.24s in unoptimized native profile), path/in-place identity mutations refused. Existing config-isolation timeout row passed fresh under CPUWeight=10000 (1 passed, 0 failed, 0.06s; config-isolation-retry.txt). Separate optimized anonymous-image prompt oracle is queued; its memory/disk staging is bounded by the existing global eight-host SSH bootstrap semaphore (bootstrap.rs:89/115), not eight per request.Probe-control original red: 0 passed, 1 failed, 3.14s (probe-control-before.txt). Correction closes inherited fd3 using the audited shim policy and keeps image/null descriptors >=4; clippy passed, real runtime tests running (probe-control-after.txt).
ASan execution: 3,657,436 runs in 61 seconds, no finding (manifest-fuzz-execution.txt).
Completed/pushed
1170380c(bootstrap helper kernel-image path and correct sibling payload lookup),1d78a002(probe control-fd isolation),6ec9e1b5(separate fixture/admission preparation from unchanged 30-second recovery observation),b63b05f5(operations documentation). Server bootstrap tests: 15 passed, 0 failed, 61.14s; image/seal/control tests: 2 passed, 0 failed, 0.51s; real unoptimized same-PID replacement + late recovery passed in 24.04s.Optimized anonymous-image prompt oracle passed: 1,260,800-byte complete running fixture snapshot, preparation 16.355ms, authorized reply from the exact named copy. This is fixture timing, not a 20 MB shipping-image benchmark. Server dumpability policy remains unchanged. Native unoptimized debug-image preparation timed out in the earlier broad restart run; no production deadline was increased, and the fresh oracle separates preparation from actual recovery.
Supplemental TS compiler/build/transfer/protocol checks now pass under CPUWeight=10000 (ts-supplement-retry.txt). The final full fast gate is running on
b63b05f5with the integrated baseline's explicitly recorded native RSS profile; release profiles and size ceilings are unchanged. Both static targets are being measured; a fresh root CA recovery proof is also running.ARM static head build completed: 19,246,960 bytes, no PT_INTERP (static-final-both.txt). Delta from the integrated #157 baseline 19,224,296: +22,664 bytes. Restored ceiling 13,817,816 is exceeded by 5,429,144 bytes; it remains unchanged. Final x86 gate/link and current-head optimized verifier benchmark build are still running. Fresh root-container cases both report same_pid=true ca_unlocked=true serving=true (17.32s). Final independent read-only recheck found no material issue in bootstrap paths, fd3 isolation, recovery observation or docs.
Continuing round 4 final reporting on
release-pipeline(base22aeb7b2d8ed331f21564523b2fe633d4810e31e, current headd9770cbac8c0d6a64000979ce7d8cce1c3d0bb37). Read the #157/#154 history and reviewed the committed evidence and operations note. I am filling the missing perf-VM listener and 20 MiB verification measurements, then will run the final gate and report.Perf-VM listener attempt: no timing sample was emitted. The harness inserted
mode='rootless'fixture rows while running as UID 0 and SQLite rejected them withCHECK constraint failed: mode != 'rootless' OR execution_uid != 0. The harness cleanup removed the test state. I am making its fixture mode reflect the effective UID before retrying both sides under the perf lock.Perf-VM retry after correcting the fixture UID got the baseline server healthy, but its local control reply did not begin with
RESTARTING; the harness then aborted at the replacement assertion before collecting a gap sample. I am exposing the bounded reply bytes and checking the restart refusal cause before counting any measurement.Harness finding on the perf VM: the baseline refusal assertion raised while its non-daemon TCP probe thread remained active, so the
measure_listener.pyprocess did not exit and a diagnostic retry queued behind the benchmark lock. Both runs are mine; I am stopping them and adding failure-path thread cleanup before continuing. No timing samples were emitted.The diagnostic reply was
REFUSED. The uploaded baseline and head directories retained the local archive ownerbench(UID 1000) under the root benchmark directory;Opened::open_reloadrefuses a candidate whose parent is owned by neither the service UID nor root. I am correcting ownership only under/root/infraternal-bench/release-r4and then rerunning the comparison.Perf-VM listener comparison completed under
/var/lock/perf-bench.lockoninfraternal-perf-test(4 vCPU), load average 0.020/0.043/0.006 at start and end. The corrected harness ran 25 replacements per binary, 50 fixture users, 10,000 retained hosts, zero live PTYs and 1 ms TCP probes. Base22aeb7b2(21,709,776 B): listener gap p50 9.105 ms, max 17.466 ms; full replacement p50 10.281 ms. Round-4 head (21,736,368 B): gap p50 10.693 ms, max 14.593 ms; full replacement p50 50.204 ms. Both runs preserved the PID. The earlier root-mode/schema and archive-owner failures emitted no timing samples; the harness now uses rootful fixture rows and joins its sampler on failure. I am measuring 20 MiB verification separately.Completed and pushed
633f1cdecd5f85bb6f9cbfeb4d14903cdf3626f9(listener harness UID-aware fixtures and failure-path sampler cleanup). Python compile check and the perf-VM harness passed. The recorded 25-sample comparison remains: before gap p50/max 9.105/17.466 ms, after 10.693/14.593 ms; full replacement p50 10.281/50.204 ms. Both same-PID checks passed.Perf-VM verification measurement completed under
/var/lock/perf-bench.lockoninfraternal-perf-test(x86_64, 4 vCPU). The release-profilerelease_verifytest verified a 20 MiB / 20,971,520-byte payload 50 times: p50 79.029 ms. Load average was 0.00/0.03/0.00 before and 0.08/0.04/0.01 after. The test passed 1/1 (0 failed); output is inverify-20m-perf-vm.txtpending the evidence commit. The harness binary was built from this branch's verifier tests, copied to the perf VM, and executed there under the locked job directory.Static-size review found two x86 receipts:
static-final-both.txtreports 21,736,368 B, while the olderfast-final.txtreports 21,729,136 B. The artifact named bystatic-final-both.txthas a 07:35 timestamp, before the production commits1170380cand1d78a002at 07:41. I am rebuilding both musl targets from the current branch code before finalizing the deltas; no size ceiling will be changed.Static-size discrepancy resolved: rebuilding the current branch (code unchanged since
b63b05f5) confirms x86_64-musl at 21,736,368 B and aarch64-musl at 19,246,960 B; both are static with no PT_INTERP. The 21,729,136 B fast-gate artifact was stale. The evidence report uses the rebuilt sizes.Committed and pushed report/evidence at
5f74c655. Perf-VM receipts: listener gap p50 9.105 ms base / 10.693 ms round 4 (25 samples each); 20 MiB verification p50 79.029 ms (50 samples). UP-01/02/03 now pass in the 25-test restart suite; the root replacement oracle reports same_pid=true ca_unlocked=true serving=true after success and late refusal. Static deltas are +26,592 B x86_64 and +22,664 B aarch64; historical ceilings remain unchanged.Gate finding at head
5f74c655f9: the workspace test row did not complete. The output markedearly_hangup_is_queued_until_control_installs_its_handler,restart_requests_use_the_servers_binary_and_reject_untrusted_paths, andrestart_request_logs_kernel_peer_target_and_cold_outcomefailed. One-thread focused reruns reproduced the first two as 0 passed / 1 failed (Elapsed(())andowner restart request deadline); the restart-log child timed out after 30 seconds. In the full run it remained futex-blocked for over six minutes, so I terminated only this gate run's test process to return. No source changes were made in this report-only task.Static-size reconciliation: the final fast gate's x86_64-musl artifact is 21,736,240 B (SHA256 69dbbb312db0f5c435c753fc72b402b98e2ddb03998b05bd16597f2e6ee75721), static with no PT_INTERP. It exceeds the unchanged 16,404,816 B ceiling by 5,331,424 B. The earlier static/listener artifact is 21,736,368 B (SHA256 9ce861fe7114340d4c03018bec2b3e8aa1744a8aab5536d791016be402b6c19b), 128 B larger. Against the 21,709,776 B integrated base, those deltas are +26,464 B and +26,592 B respectively. The ARM receipt is 19,246,960 B versus 19,224,296 B (+22,664 B); the final gate stopped at x86 and did not reach ARM. No ceiling was changed.
Round 4 report and perf receipts are complete and pushed. Final branch head:
5f74c655f9.UP-01/02/03 each failed against
b0cf61efand now pass in the 25-test recovery suite; UP-01 ends at unverified_replacements_accepted=0, candidates=4, executed=0. On the perf VM, listener-gap p50 was 9.105 ms base / 10.693 ms round 4; the 20 MiB verifier p50 was 79.029 ms over 50 runs. Successful replacement and late exec refusal both reported same_pid=true ca_unlocked=true serving=true. The static size deltas and the 128 B x86 build-artifact variation are recorded in the preceding finding comments.Final scripts/verify fast output (verbatim summary):
/home/kayg/.cache/codex-scratch/release-pipeline-r4/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 21736240 bytes (baseline 16142672 + allowance 262144 = max 16404816)
binary exceeds the 16404816-byte size budget: 21736240 bytes
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| CLI plugin compile-out | PASS |
| clippy | PASS |
| test | FAIL (101) |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
The command exited 1. The workspace test process was terminated after a restart-log child remained blocked; focused reruns reproduced the two named failures and the restart-log timeout. The unchanged static size ceiling also fails. No source code was changed in this report-only lane.
Independent delta review started on local review-release-pipeline at
5f74c655f9; delta baseline8a26a73b, dev merge base8e7467c07c. Prior review retained as review-release-pipeline-prior-8a26a73b. R6 cherry-pick is empty because the implementation branch already imports the exact test. Scope excludes merged mesh work. Reading issue/related handoff history and canonical contracts; original-head fast gate and prior regressions follow. No implementation fixes, push, deployment or perf VM use; performance claims can only be inspected in supplied receipts in this brief.Independent delta step committed locally (review-release-pipeline, head from git): R1/R2 normal Bun review tests pass, 2 tests/5 assertions. R1 list_requests=1 uploads=4 replaced_objects=0; R2 ambiguous preflight exits 1. Raw receipt evidence/release-r4-review/prior-publication.log. R6 import is an empty cherry-pick because the exact source already exists in target. Fresh original-source Rust gate is still building pinned native VT. No implementation changes, push, live publication or performance claim.
Independent delta evidence commits:
58995b0brecords R1/R2 pass;4a9165ddrecords R4/R5/R6 pass. Native normal tests: 3 passed, 0 failed; two explicit child helpers ignored. R4 two process stops each retain 65536 bytes, restarted lookup retains 0. R5 eight writers/eight slots leave seven idle slots and authority read completes. R6 unchanged original umask 0177 regression succeeds. Receipts evidence/release-r4-review/{prior-publication.log,prior-native.log}. No new confirmed finding. Full fast gate remains in its first pinned native VT build; R3 and restart suite pending. No implementation fix, push, deploy or perf VM use.Independent R7 P2 confirmed on target
5f74c655: Opened::running retains short argv0 from a PATH invocation. After real sealed recovery exec, restart.rs::current_binary resolves it as /infraternal rather than the original installed executable, so later default restart/SIGHUP is refused or targets another file. New normal unit test restart::tests::path_review::late_recovery_from_path_invocation_keeps_install_target fails exit 101 in an exact-source harness using the real running/image/current_binary functions. Raw receipt evidence/release-r4-review/path-red.log. Test/evidence committed locally; SHA follows in next completed-step receipt. Implementation unchanged. P0=0/P1=0/P2=1/P3=0 new; all six earlier findings pass. Root-container successful replacement and late refusal preserve PID, unlocked CA and serving listener. Full head gate passed fmt/VT fmt/compile-out/clippy/deny; test row failed/stalled and was stopped; static build remains running. No push, deployment or perf VM.Independent evidence now at local
efaf7e3fon review-release-pipeline (no push). R7 P2 test is committed in crates/infraternal/src/restart_path_review_tests.rs, linked from normal restart tests. Real sealed recovery exec with short argv0 fails the subsequent install-target assertion; exact-source harness exit101, expected original executable, observed working-directory/infraternal. Receipt evidence/release-r4-review/path-red.log. Earlier findings R1–R6 and imported UP-01/02/03 pass in their recorded replays;db2c6fdepreserves root-container success/late-refusal cases with same_pid=true ca_unlocked=true serving=true, canonical manifest2/2, admission7/7, and limited uninstrumented fuzz smoke. No implementation fixes or performance remeasurement. The original head gate test process stalled and was stopped; its failed row remains, static compilation still running. Counts new P0=0/P1=0/P2=1/P3=0, so MERGE under the stated verdict rule, qualified by the failed full gate.Independent review: verbatim head
5f74c655scripts/verify fast output, part 1/4. Full output is also committed locally at667bdacdin evidence/release-r4-review/verify-fast.log. Exit1: failed/stalled default-artifact test row and unchanged static-size ceiling. No passing full-gate claim.Independent review: verbatim head
5f74c655scripts/verify fast output, part 2/4. Full output is also committed locally at667bdacdin evidence/release-r4-review/verify-fast.log. Exit1: failed/stalled default-artifact test row and unchanged static-size ceiling. No passing full-gate claim.Independent review: verbatim head
5f74c655scripts/verify fast output, part 3/4. Full output is also committed locally at667bdacdin evidence/release-r4-review/verify-fast.log. Exit1: failed/stalled default-artifact test row and unchanged static-size ceiling. No passing full-gate claim.Independent review: verbatim head
5f74c655scripts/verify fast output, part 4/4. Full output is also committed locally at667bdacdin evidence/release-r4-review/verify-fast.log. Exit1: failed/stalled default-artifact test row and unchanged static-size ceiling. No passing full-gate claim.MERGE (no P0/P1). Independent delta review of 8a26a73b..5f74c655, excluding imported dev/mesh changes. New findings P0=0/P1=0/P2=1/P3=0. R7 P2 is fixed forward under the owner verdict rule: a PATH invocation loses its original install target after sealed late recovery; subsequent default restart/SIGHUP resolves working-directory/infraternal. Failing normal test committed at
efaf7e3f; workspace confirmation exits101, 0 passed/1 failed/74 filtered. No implementation fix.Final local review-release-pipeline head
554f044060. Evidence: evidence/release-r4-review/README.md, path-workspace-red.log, root-recovery-retry.log, verify-fast.log. R1–R6 all pass; imported UP-01/02/03 pass. Root-container real successful replacement and late refusal each preserve PID, unlocked CA and serving listener. Reviewer fmt and touched-package/all-tests Clippy pass. Limited uninstrumented fuzz smoke2,156,104 inputs/no crash; no ASan/coverage claim. Performance/ARM supplied receipts inspected only; no perf VM use.Head fast gate exits1. Default artifacts are group-writable0775, which restart admission correctly refuses; the broad test run failed/stalled and its own stuck process was stopped. A byte-identical0700 restart-request test passes; broader private-copy runs remain incomplete and are not counted as a clean gate. Independent x86 static21736240B, no PT_INTERP, +26464B vs author's integrated21709776B base; unchanged ceiling16404816B fails. Complete verbatim fast output is posted above in four parts and committed. Rust failure skips TS and x86 size failure skips ARM. No passing full-gate claim, baseline waiver, push, deployment or implementation fix. Task-owned scratch cleanup follows.
scripts/verify fast summary, verbatim:
Cleanup complete: task-owned scratch/build targets and target symlink removed, root test container gone, review-release-pipeline clean at554f0440608f2c199278b8fd775412bdf73f2f06. MERGE (no P0/P1), newP2=1 (R7), all earlier R1–R6 pass. No push, deployment or implementation fix. Full failed head gate and final verdict are posted above; evidence retained locally in evidence/release-r4-review.
Started #157 integration on branch dev-merge-r4 at base
2f3e0ba44a(origin/dev). Merge source is origin/release-pipeline5f74c655f9(round 4, reviewed MERGE). Independent review confirmed R7 P2 and committed the failing PATH-launch recovery regression atefaf7e3fon origin/review-release-pipeline. I will preserve the reviewed test, fix its install-target regression separately, and combine signed/private fixtures with sealed memfd expectations and the #174 bounded waits/stdin/inode assertions. No deploy.Merge conflict finding: the sole conflict is crates/infraternal/src/restart_tests.rs. #174's compatibility-marker-only fixture cannot pass round 4 signature admission; round 4's copy/strip path omitted #174's explicit 0700 private-copy and bounded child handling. Resolution uses signed stripped private fixtures, preserves the memfd executable-path check, asserts both retained-source and sealed-image inode identity, keeps /dev/null stdin checks and bounded process waits. Focused gate is running; no assertions removed.
Concurrent dev movement finding: origin/dev advanced during this lane from the recorded base
2f3e0ba4to5db9d82f(four commits, merge of settings-roundtrip #161). The release branch does not contain that head. I will merge the new dev head into dev-merge-r4 in a separate integration commit before final verification, so the pushed branch remains fast-forwardable; I will not push to dev.Restart fixture finding: the first captured
cargo test -p infraternal restartrun passed 25 cases, ignored the single optimized measurement, and timed out the boundedreal_fd_exec_pins_replacement_and_cold_rollback_uses_null_stdinchild at its 9 s bound. The test executable is 380,009,200 bytes; stripping and signing a fresh copy for the child made that path too slow. I will cache one private stripped source under this job's CARGO_TARGET_DIR, then keep each signed fixture copy at 0700 and retain the existing 9 s bound, memfd, retained-inode, and stdin assertions.Resuming #157 after the prior session interruption. Branch: dev-merge-r4. Current origin/dev base is
5db9d82f; the interrupted merge began from2f3e0ba4with origin/release-pipeline5f74c655. The merge is still in progress, with no unresolved index entries. The only resolved conflict is restart_tests.rs; its worktree update caches a private stripped source image after the earlier 9-second child timeout, while signed per-test copies, memfd/inode/stdin assertions, and bounded waits remain. I’m continuing the focused gates, then will merge the current dev head separately and apply review R7 as its own fix-forward commit.Focused gate finding:
cargo test -p infraternal restartrun 1/10 exited 101: 24 passed, 2 failed, 1 ignored.early_hangup_is_queued_until_control_installs_its_handlerexceeded its 6 s child bound andreal_fd_exec_pins_replacement_and_cold_rollback_uses_null_stdinexceeded 9 s; both children were SIGKILLed after printingrunning 1 test. The host had nine concurrent Cargo commands at the time. Full output: /home/kayg/.cache/codex-scratch/dev-merge-r4/restart-repeat/run-01.log. I’m retaining the bounds and assertions while separating host contention from a fixture issue before the required ten-run pass.Resuming #157 on
dev-merge-r4. Existing release-pipeline merge is in progress from base2f3e0ba44a7bf3b13dea764de40af11686f9c054with sourceorigin/release-pipeline5f74c655f966ed1a6e4ef5e74cd9f1768230abb9; currentorigin/devisc0d01d2285b92ea8e452f10a3d0b8d479fa1bff8(five commits ahead of the merge base). Prior focused run 1/10 failed only after two bounded children timed out while nine concurrent Cargo commands were active. The current test diff keepsSigned::new's 0700 private copy of stripped bytes and caches the stripped source; I’ll validate the ten-run suite with controlled build concurrency, then merge current dev and apply R7 as a separate test/fix pair. No deploy.Controlled confirmation on the resolved merge tree (base
2f3e0ba4+ release round 4):cargo test -p infraternal restartpasses with 26 passed, 0 failed, 1 ignored; restart-filtered agent/session integration tests add 3 passed. The previous 2 child timeouts do not reproduce withCARGO_BUILD_JOBS=1while the gate has CPU priority, and no bound/assertion changed. This is one clean run; the required 10 consecutive runs will be repeated on the final integrated head after R7.Finding: isolated
cargo test --locked -p infraternal-plugin-sshfails to compilecrates/plugins/ssh/tests/payload_source.rs:163withno method named start_pausedon Tokio's test runtime builder. The workspace Tokio declaration omitstest-util, and the SSH crate has no dev-only Tokio feature declaration; workspace test feature unification masked this. I’ll addtest-utilas an SSH-only dev feature in its own dependency commit, then rerun the package test. This has no production feature effect and avoids replacing the deterministic paused-time timeout test with wall-clock waiting.Dependency step committed as
a80a82bad3f7e481a807069c1a17ab56957ca641. Added SSH-only Tokiotest-utilin dev dependencies.cargo fmt --all --checkandcargo clippy -p infraternal-plugin-ssh --all-targets --locked -- -D warningspass;cargo test --locked -p infraternal-plugin-sshpasses, includingtests/payload_source.rs2/2. The prior standalone compile failure is fixed without changing production features.Release round 4 merge committed and pushed on
dev-merge-r4:db9ac1c38278884d9900a6031680f9425137dae1(parents:a80a82baand5f74c655). Therestart_tests.rsconflict keeps signed stripped fixtures at 0700, memfd path and inode assertions, bounded child waits and explicit stdin. Gates on the resolved tree: fmt PASS; workspace Clippy PASS; restart filter 26 passed/0 failed/1 ignored (plus 3 restart-filtered agent/session integration tests); server release filter 21 passed/0 failed/5 ignored; release plugin suite 10 passed/0 failed/3 ignored. The isolated SSH test compile issue is covered by dependency commita80a82baand a green package suite includingpayload_source2/2. Next: apply R7 test/fix separately, merge currentorigin/dev, then rerun final gates.R7 RED reproduced on commit
be0a938ausing the committed review test.cargo test --locked -p infraternal late_recovery_from_path_invocation_keeps_install_target -- --nocaptureexits 101: after sealed recovery,current_binary()returns/home/kayg/.cache/codex-scratch/dev-merge-r4/target/review-recovery-path-…/infraternal; the expected install target is/home/kayg/.cache/codex-scratch/dev-merge-r4/target/debug/deps/infraternal-2e24ea0d55fb72b1. Evidence:/home/kayg/.cache/codex-scratch/dev-merge-r4/path-recovery-red.log. The cause isOpened::running()retaining relative argv[0] after PATH resolution.R7 fix committed and pushed as
6d3ac72adf76140b11a10ec0da0e1f77c43a0866, following test commitbe0a938a. On the fix, the committedlate_recovery_from_path_invocation_keeps_install_targettest changes from RED (exit 101) to GREEN (1 passed/0 failed, output in/home/kayg/.cache/codex-scratch/dev-merge-r4/path-recovery-green.log).cargo fmt --all --checkandcargo clippy --locked -p infraternal --all-targets -- -D warningspass. Absolute service argv[0] remains verbatim; relative PATH argv[0] is captured fromcurrent_exe()before recovery.Current dev head
c0d01d22is integrated in separate merge commitca282f37307ac2048a161b1d6c0491c4e9138203and pushed ondev-merge-r4. This keeps the branch fast-forwardable fromorigin/dev; the merge adds 6 files (260 insertions, 22 deletions) from the five intervening dev commits. Starting final-head gates now: 10 consecutive restart runs, release and touched-crate tests, Clippy, thenscripts/verify fast.Final-head restart gate:
cargo test -p infraternal restartpassed 10/10 consecutive runs onca282f37withCARGO_BUILD_JOBS=1in a CPU-prioritized scope. Each run: main target 27 passed, 0 failed, 1 ignored; restart-filtered agent review 2 passed and session integration 1 passed. Logs:/home/kayg/.cache/codex-scratch/dev-merge-r4/restart-repeat/final-01.logthroughfinal-10.log. No waits or assertions were weakened.Final-head release gates pass on
ca282f37: server release filter 21 passed/0 failed/5 ignored; release plugin suite 10 passed/0 failed/3 ignored; the full SSH plugin suite passes, including payload-source 2/2 and prompt-image tests. Exact logs are in/home/kayg/.cache/codex-scratch/dev-merge-r4/{release-tests-final.log,release-plugin-tests-final.log,ssh-plugin-tests-final.log}. The Rust workspace Clippy and complete workspace test gates remain in the finalscripts/verify fastrun.Release checklist functional gates on
ca282f37:python3 scripts/release/test.pypassed 5/5; Bun review/worker tests passed 5/5; channel CLI stand-in passed 1/1 with stable default and both edge confirmations;release_latestpassed 3 (2 ignored measurements); plugin APIrelease_versionpassed 1/1. The documented local build and tests used/home/kayg/.cache/codex-scratch/dev-merge-r4/target; no live bucket, signer, Worker or deployment was used. Review/worker output includesPUBLICATION_ADMISSION same_host=true build_directories=2 list_requests=1 uploads=4 replaced_objects=0and duplicate storage preflight exit 1.Self-review of
docs/operations/release.mdcompleted againstrelease_verify.rs,release_payload.rs,release_http.rs, the removable release plugin, andscripts/release/*. Checked compiled trust anchors and strict SSHSIG parsing, descriptor-bound VERSION/payload checks and no-follow cache access, HTTPS/TLS and 90 s bounded downloads with byte ceilings/no redirects, plugin lifecycle, stdin-only token handoff, publisher locking/duplicate-response tests, stable defaults and explicit edge confirmation. The focused release/CLI tests above support these checks; the independent source review is indexed inevidence/release-replacement/review.md. R7 fix also retains absolute service argv0 and capturescurrent_exe()for a PATH-relative invocation; the committed regression passes. Existing perf VM receipts and scale qualifications are indexed inevidence/release-replacement/README.md; no timing was measured on this shared build host. No UI changed. No further checklist issue found.Final
scripts/verify fastfinding onca282f37: workspace test rowcrates/infraternal/tests/ssh_askpass.rs::real_cli_unlocks_an_encrypted_synthetic_key_on_private_pipesfailed withThe SSH private key or passphrase was refused.after the test target ran 44.45 s; all restart and agent rows preceding it passed. The run continued to cargo-deny and static builds. Full output:/home/kayg/.cache/codex-scratch/dev-merge-r4/verify-fast-final.log. The same test has a prior under-load failure and later pass inevidence/release-replacement/fast-head-retry.txtandfast-final.txt; I am reproducing it alone after this gate finishes before classifying it.SSH test diagnosis: the exact isolated
ssh_askpasstest failed three runs. Temporary diagnostics confirmed the peer passed direct-parent and executable identity checks, but hashing/proc/<pid>/exesynchronously inPromptImage::matchestook 30,828 ms for the 365,674,776-byte debug CLI artifact; the helper's 3 s socket read then expired (Resource temporarily unavailable), sossh-addreturned 1. This is an oversized debug test artifact, not a rejected peer or bad key. The diagnostics are reverted; I will rerun with debug info disabled for the test profile (same code/tests) and then repeat the full gate. Evidence:/home/kayg/.cache/codex-scratch/dev-merge-r4/ssh-askpass-timing-final.log.Resolved the fast-gate SSH test finding without changing source or assertions. The test's normal debug CLI was 365,674,776 bytes;
PromptImage::matchestook 30,828 ms and exceeded the helper's unchanged 3 s read bound. In the job scratch target I rebuilt withCARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0, stripped onlytarget/debug/infraternal(--strip-unneeded, 45,178,216 bytes), then reran the exact test (1/1 pass, 6.34 s) and fullssh_askpasstarget (2 passed, 1 ignored, 6.73 s). Cargo reused this scratch artifact. Production code, timeout, and assertions are unchanged. I will rerun the full fast gate with the same profile settings; the static size ceiling remains expected to fail per D243.Profile follow-up:
CARGO_PROFILE_DEV_DEBUG=0alone rebuilttarget/debug/infraternalat 80,644,456 bytes, and the workspacessh_askpasstest again failed within the 3 s bounded prompt. In the same scratch target, after stripping that binary to 45,178,216 bytes, the fullssh_askpasstarget passed (2 passed/1 ignored). Cargo rebuilt the binary before the workspace suite, so the manual strip did not persist. I will use Cargo'sstrip=symbolsprofile setting for the next full run to keep the actual test artifact small; no source or test assertions changed.The private stripped CLI fixture is 45,178,216 bytes, but the authorized prompt still failed: PromptImage::matches reported direct_parent=true, image_match=true and check_ms=5023.001. The peer identity was valid; the synchronous test-build digest exceeded the unchanged 3 s askpass read timeout, and ssh-add exited 1. No timeout or assertion changed. Reproduction used
cargo test --locked -p infraternal --test ssh_askpass real_cli_unlocks_an_encrypted_synthetic_key_on_private_pipes -- --nocapturewith the test state root under this job's scratch directory. The captured diagnostic output is in this turn's tool record; test fixture and temporary instrumentation remain uncommitted.Correction on the prior timing observation: it came from an instrumented functional-test run on the shared build host and is only evidence for the fixed test deadline being exceeded, not a performance benchmark or product-performance result. The normal-profile askpass suite now passes with the 45,178,216-byte private stripped real-CLI fixture and SHA-256 optimized only for dev/test profiles: 2 passed, 0 failed, 1 ignored. Full output: /home/kayg/.cache/codex-scratch/dev-merge-r4/ssh-askpass-profile-final.log. No timeout, peer check or assertion changed.
Merged latest origin/dev
bb5219a4asc9fac3b5(D253/D254 only; no conflicts), preserving the release lane and keeping the branch fast-forwardable from the current dev line. Pushed onlydev-merge-r4. The separate askpass gate fix remains uncommitted while its focused lint and final integration gates run.Askpass gate fix committed as
e3a725f8and pushed todev-merge-r4. The real CLI prompt fixture is a private stripped copy;sha2uses opt-level 3 only in dev/test profiles, leaving the release profile unchanged.cargo fmt --all --checkpasses; Clippy passes forinfraternalandinfraternal-plugin-ssh;cargo test --locked -p infraternal --test ssh_askpasspasses 2/2, with 1 ignored controlling-terminal case. Logs:/home/kayg/.cache/codex-scratch/dev-merge-r4/ssh-askpass-profile-final.log. No prompt timeout, peer check or assertion changed.Final-head restart gate passed 10/10 consecutive runs on
e3a725f8. Each run: main target 27 passed/0 failed/1 ignored; restart-filtered agent review 2 passed and session integration 1 passed. No wait or assertion changed. Logs:/home/kayg/.cache/codex-scratch/dev-merge-r4/restart-repeat/final-01.logthroughfinal-10.log.Release filters passed on final source head
e3a725f8: server release tests 21 passed/0 failed/5 ignored; release plugin 10 passed/0 failed/3 ignored; SSH plugin suite 87 passed/0 failed/8 ignored across 20 test binaries, including the askpass path. Logs:/home/kayg/.cache/codex-scratch/dev-merge-r4/{release-tests-final.log,release-plugin-tests-final.log,ssh-plugin-tests-final.log}. The branch was based on current dev throughbb5219a4; the D253/D254 merge isc9fac3b5.Fetched and merged the latest
origin/devheadfc08ab0fas7c480c18; it contains D255 and two taste notes only, with no conflicts. Pushed onlydev-merge-r4. The prior fast gate covered source heade3a725f8; I am rerunning it on this updated head before handoff.On final head
7c480c18, the restart gate passed 10/10 again. TypeScript fast checks also pass: tracer suite 168 passed/0 failed, TS protocol suite 36 passed/0 failed, compilers and transfer budget passed. Largest on-demand JS chunk: gzip 15,180/20,480 bytes; Brotli 13,478/18,432. Logs:/home/kayg/.cache/codex-scratch/dev-merge-r4/restart-10-head-output.logand/home/kayg/.cache/codex-scratch/dev-merge-r4/ts-verify-final.log. Runningscripts/verify fastonce more on this head now.Finding: after the
7c480c18fast gate,origin/devadvanced fromfc08ab0ftoee104344(86 commits; current dev includes the D215 mesh-agent-transport merge). The incoming diff overlaps release/recovery paths includingcrates/infraternal/src/restart.rs,crates/infraternal/src/restart_tests.rs,crates/infraternal-server/src/release_verify.rs, and SSH prompt files. I will integrate the current dev head in a separate merge commit and rerun the gates on the resulting branch head.Merged origin/dev
ee104344into dev-merge-r4 as261e4499(merge commit; 0 conflicts). The incoming D215 update covered 775 paths. It did not alter the restart source files; the signed private fixtures, memfd assertions, bounded waits, stdin handling, and PATH recovery regression remain present. Running final gates next.On
261e4499,cargo test -p infraternal restartpassed 10/10 consecutive runs. Each run: main suite 27 passed, 0 failed, 1 ignored; restart review 2 passed; session integration 1 passed. Per-run logs: /home/kayg/.cache/codex-scratch/dev-merge-r4/restart-repeat/final-01.log through final-10.log.Release filters passed on
261e4499. infraternal-server: 22 passed, 5 ignored. infraternal-plugin-release: 10 passed, 3 ignored. infraternal-plugin-ssh: 87 passed, 8 ignored. Logs: /home/kayg/.cache/codex-scratch/dev-merge-r4/release-tests-final.log, release-plugin-tests-final.log, ssh-plugin-tests-final.log. Starting final scripts/verify fast now; it includes fmt and clippy.Finding on
261e4499:scripts/verify fastcompleted fmt, VT native fmt, CLI plugin compile-out, Clippy, all Rust tests, and cargo-deny successfully. Static builds failed only the known D243 x86 size ceiling: 22,345,648 bytes vs 16,404,816 maximum (baseline 16,142,672 + 262,144 allowance). Captured log: /home/kayg/.cache/codex-scratch/dev-merge-r4/verify-fast-final-261e4499.log.Exact gate summary:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| CLI plugin compile-out | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
TypeScript gate separately passed on
261e4499after the known Rust static-size failure stoppedscripts/verify fastbefore its TS stage. Tracer: 168 tests across 26 files. Protocol: 36 tests across 10 files; differential corpus 134 streams / 11,439 schedules / zero divergences. Largest on-demand JS chunk: gzip 15,179/20,480 bytes, Brotli 13,493/18,432 bytes. Captured log: /home/kayg/.cache/codex-scratch/dev-merge-r4/ts-verify-final-261e4499.log. No TypeScript source paths changed in the latest dev merge.Finding while checking the current dev merge:
git diff --check 7c480c18 261e4499reports 8,615 trailing-space/blank-at-EOF warnings in 12 imported D215 evidence/transcript files, underdocs/verification/mesh-agent-transport/andevidence/mesh-agent-transport-round2/. No Rust or TypeScript source paths are reported. I left upstream evidence files unchanged. Full output: /home/kayg/.cache/codex-scratch/dev-merge-r4/merge-whitespace-check.log.Finished and pushed branch dev-merge-r4 at
261e44999f. Remote branch matches this SHA; origin/devee104344is an ancestor. Worktree is clean.Gates on this head: restart 10/10 consecutive runs passed (27 passed / 1 ignored in each main suite); release server 22 passed / 5 ignored; release plugin 10 passed / 3 ignored; SSH plugin 87 passed / 8 ignored; Clippy passed; TypeScript gate passed (tracer 168 tests, protocol 36 tests, 134 streams / 11,439 schedules / zero divergences). Logs are in /home/kayg/.cache/codex-scratch/dev-merge-r4/.
scripts/verify fastfinal size diagnostic and summary, verbatim:kayg referenced this issue2026-10-28 17:53:56 +00:00