Real logins and the preferred user (D240, D229, D231) #172
Open
opened 2026-10-11 17:25:55 +00:00 by kayg
·
303 comments
No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#172
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Build D240 (real PAM logins, one per person per account per host, reused by terminals, preopened for the preferred user, replacing the per-terminal systemd-run scope) together with D229/D231 (preferred user: global setting + per-host override; defaults to the owner's username, falls back to root with a note; the server's own host via the embedded infraternal agent). Benchmark before/after with scripts/bench/login (#159) on the perf VM. Branch
real-loginsfrom dev.Started real-logins from base
8e7467c07c; merged origin/bench-login at c31fa1c63a92dc7a315532cea3faa49300ca6d07. Read all comments on #172 and benchmark prerequisite #159 (neither lists a parent). First step: reproduce and fix root-owned benchmark scratch fixtures with a failing test, then baseline and PAM integration measurements. D229/D230/D231/D235/D240 apply. Push only real-logins; benchmark host explicitly authorized by brief: 10.69.69.208.Finding: production Rust has no PAM binding (rg pam across crates/Cargo.lock). A minimal libc dlopen/dlsym probe built with the pinned Rust 1.99.0 confirms the D7 static musl target cannot load host PAM: PAM_LOAD unavailable reason=Dynamic loading not supported. Native GNU on infraternal-dev reports libpam.so.0 unavailable. Source: evidence/real-logins/pam-binding-probe.rs. Measuring GNU ABI behavior on the authorized perf host next. This is a D7/D240 delivery constraint, not a binding-crate preference.
Completed scratch fix: scripts/bench/test_login.py reproduced the missing measured-user scratch API; now 2 tests pass, including 40.000 ms stage self-test. Root runs create/chown new private parents and repair the private leaf for the measured account, refusing symlinks/unexpected leaf owners. The --all --json baseline is running on 10.69.69.208 under /var/lock/perf-bench.lock with disposable user infra-login172.
PAM delivery blocker requiring owner decision (D7/D40/D240): current production links no libpam; minimal libc FFI in a static x86_64-unknown-linux-musl executable returns "Dynamic loading not supported" on both hosts. A native GNU helper can dlopen the host PAM stack, but requires a new glibc-linked artifact/runtime ABI outside D7's single static binary contract. No PAM binding crate/dependency or production login worker has been selected.
Measurements on authorized infraternal-perf-test (4 vCPU, Linux 6.12.69+deb13-amd64), flock /var/lock/perf-bench.lock, CPUWeight=10000, load 0.292/0.347/0.155 before/after; N=200: GNU libpam dlopen+dlsym p50/p95/p99 0.230392/0.371208/0.434637 ms; process spawn+load 1.259540/1.866595/2.088706 ms. At 50 idle processes, baseline RSS/PSS 105748/7957 KiB, libpam-loaded 116416/9718 KiB (increment 213.36 KiB RSS and 35.22 KiB PSS per process; 10668/1761 KiB total). These are binding-only figures, not full login worker RSS. GNU/musl probe sizes before stripping: 4576136/4729616 bytes. Source and complete JSON: evidence/real-logins/pam-binding-probe.rs, measure_binding.py, binding.json.
Options for owner: authorize a minimal native PAM helper (host-ABI delivery exception to D7; measured above), or choose a host-native login-program backend (requires separate worker/privilege/recording design and cannot be silently substituted). Vendoring musl libpam alone would not load the host's glibc PAM modules. A new PAM wrapper crate would not solve this ABI limitation. Backend implementation is stopped at this explicit foundational-choice boundary per the brief; benchmark/gate evidence and scratch fix are being finalized.
Baseline completed: scripts/bench/login --all --user infra-login172 --json, N=200 per condition, authorized 10.69.69.208 (4 vCPU, Linux 6.12.69+deb13-amd64), flock /var/lock/perf-bench.lock, CPUWeight=10000 and loopback-only. Load before 0.125/0.291/0.145, after 1.899/1.010/0.442. Disposable zsh account has no personal rc files; real_rc includes system startup files only. Full report evidence/real-logins/before.json; stage table and reproduction evidence/real-logins/README.md.
current-production all end-to-prompt p50/p95/p99 ms 39.161/58.375/65.883. Stage p50 request→process / process→setup / setup→exec / exec→prompt ms: 35.115 / 0.62 / 1.383 / 2.032
pam-login all end-to-prompt p50/p95/p99 ms 50.307/66.208/70.521. Stage p50 request→process / process→setup / setup→exec / exec→prompt ms: 0.543 / 43.653 / 2.856 / 3.647
pam-session-reuse first-terminal end-to-prompt p50/p95/p99 ms 20.608/25.084/26.681. Stage p50 request→process / process→setup / setup→exec / exec→prompt ms: 0.559 / 13.313 / 3.035 / 3.683
pam-session-reuse later-terminals end-to-prompt p50/p95/p99 ms 6.493/8.423/8.887. Stage p50 request→process / process→setup / setup→exec / exec→prompt ms: 0.657 / 0.0 / 2.118 / 3.649
pam-session-preopened later-terminals end-to-prompt p50/p95/p99 ms 6.197/9.056/9.884. Stage p50 request→process / process→setup / setup→exec / exec→prompt ms: 0.634 / 0.0 / 2.005 / 3.507
su-login all end-to-prompt p50/p95/p99 ms 13.262/15.911/17.051. Stage p50 request→process / process→setup / setup→exec / exec→prompt ms: 2.328 / None / None / 1.995
shell-startup all end-to-prompt p50/p95/p99 ms 4.711/6.616/8.182. Stage p50 request→process / process→setup / setup→exec / exec→prompt ms: 0.446 / None / None / 2.799
Scratch fix head
1d4ce805: 4 unittest tests PASS; cargo fmt --all --check and git diff --check PASS. No product code changed, so no after-performance claim. Full verify fast continues on infraternal-dev under shared load (about 33 at latest check). D7/PAM artifact choice still needs the owner; implementation remains stopped at that boundary as required by the brief.Completed and pushed atomic steps:
61078b95benchmark merge;1d4ce805scratch ownership regression fix (4 tests);0684b80dminimal-FFI feasibility measurements;ef6130e1baseline/decision handoff evidence;88940b7dprivileged path-race fix;237fa24bdescriptor-based review documentation.Additional finding: scripts/bench/test_login.py replacement-symlink regression failed before
88940b7d, showing unrelated-directory mode 0700 instead of 0755. Fix holds O_NOFOLLOW directory fds for all components and uses fchown/fchmod on the validated inode. All 5 tests pass (0.403 s), fmt and diff check pass. Production/auth behavior is unchanged.Disposable infra-login172 removed after benchmark; no real account on infraternal-dev was touched. D7 host-PAM artifact choice remains blocked on the owner. Full gate is still compiling dependencies under load; final output will be posted before handoff.
Final scratch setup smoke on authorized perf VM (root, disposable infra-login172): 5 unittest tests PASS in 0.099 s; current-production and pam-session-preopened, N=1 × cold/warm × norc/real_rc, produced 8 result rows and zero unavailable paths. The test user was removed after its short logind cleanup grace. Full gate on infraternal-dev is still in native dependency compilation; no further product changes are planned pending owner selection of the D7/PAM delivery mechanism.
Gate finding corrected: the full debug test executable was mode 0775 under the runner umask, so restart_binary::Opened::open rejected it (metadata.mode() & 06022 != 0), leaving two restart tests awaiting an accepted request. The lane scratch directory also had no private boundary. Earlier run was stopped. Normalized only this lane scratch to 0700 and its executable test artifact to 0755; rerunning full verify on head
237fa24bwith umask 022. The unchanged main-binary suite now passes 64/64 in 4.12 s; isolated default_restart_opens_the_receiver_target_exactly_once passed in 0.00 s. No restart code or test expectation was changed, and no baseline exception was used. Integration gates continue.Handoff blocked on owner PAM delivery choice; product D240/D229/D231 behavior remains unimplemented. Pushed real-logins head
237fa24b86. Atomic steps and reproduction: evidence/real-logins/README.md; full baseline before.json and ABI/memory binding.json. No foundational dependency was selected and no decision was changed.Harness fixes: 5 tests PASS. Root perf smoke produced 8 timing rows, zero unavailable paths. Warm real_rc baseline p50/p95/p99 ms: production 39.161/58.375/65.883; reuse later 6.493/8.423/8.887; preopened 6.197/9.056/9.884. Disposable account has system rc files only. Full stage breakdown was posted above. GNU PAM loading p50/p95/p99 0.230392/0.371208/0.434637 ms; loaded-library PSS increment at 50 helpers 1761 KiB. Static musl dlopen reports Dynamic loading not supported.
Final scripts/verify fast on this head (umask 022; private job scratch; CPUWeight=10000), exit 1: 75 completed test suites, 709 passed, zero failed, 66 ignored. Output verbatim:
Static output verbatim:
The static row is failing, not accepted as green. This lane changes no production Rust, TypeScript, dependency graph or size limit; #159 already records the base's exceeded static budget. TypeScript rows are not reached after the Rust gate returns 1.
Perf cleanup verified: infra-login172 absent; /root mode 0700 and /root/infraternal-bench mode 0755. The first exploratory home under the perf artifact directory temporarily used mode 0711 on those parents for traversal; it also exceeded sun_path. Parent modes were restored before the reported baseline, which used the short disposable home /home/i172. The disposable account and home were removed. Removing only this lane's remaining temporary artifacts and local build targets after this comment.
Remaining implementation: owner selects PAM delivery consistent with D7 (native helper exception or host login-program backend); then real login lifecycle/person isolation/records/session scope, preferred-user persistence and actions/access seam, preopening, revocation/restart/fallback tests and product after benchmarks. Issue stays open.
Cleanup complete: worktree clean; local real-logins scratch/build targets and its target symlink removed; only the real-logins perf artifact directory removed under the shared lock. Disposable user absent and perf parent modes verified above. Pushed head remains
237fa24b86. The D7/PAM owner decision and the failing static size row remain the handoff blockers; no real-login/preferred-user product behavior is claimed.Round 2 started on real-logins at base
237fa24b86; merged origin/devf2810b94at 706b8d8f. Read all #172 comments and prerequisite #159 comments (neither names a parent). D7/D229/D231/D240/D241/D247 apply. Step 1 only: static socket shell worker under system-manager User=bench PAMName=login on explicitly authorized 10.69.69.208; shared perf lock, N=200, same prompt fixture as scripts/bench/login. No product changes before D247 latency condition passes.D247 Step 1: STOP before product implementation. N=200 per path, 1600 timing samples PASS / 0 FAIL, interleaved on authorized infraternal-perf-test (4 CPUs, Linux 6.12.69+deb13-amd64), shared /var/lock/perf-bench.lock, CPUWeight=10000. Account bench, zsh actual rc files (personal .zshrc is empty; system startup files run). Load before 0.095/0.028/0.008; after 0.807/0.229/0.078.
First systemd terminal includes system-manager transient service start (User=bench, PAMName=login), static musl worker readiness and Unix socket shell request through the first prompt byte. Reuse/preopened samples omit unit startup. Same scripts/bench/login real-rc wrappers/prompt boundary as earlier evidence; helper comparison repeats the existing ctypes/libpam prototype, not a new production helper. No startup files modified, no terminal text retained. A bench background logind session is visible for the worker (leader 84061); login record correctness is not claimed.
Systemd first p50 58.511 ms exceeds production in this run (41.154 ms) by 17.357 ms and the prior 39.161 ms by 19.350 ms. Later/preopened are faster than helper, but the brief explicitly stops if first terminal exceeds production 39 ms. D247 condition therefore fails for this prototype. Owner decision is needed before Step 2; no product login/session/preferred-account code or dependency changed. Evidence: evidence/real-logins/round2/comparison.json, worker.rs, measure.py and benchmark.log. Full verify fast on merged dev is still running on infraternal-dev under high shared load (122.47/89.01/63.98 at 06:20 UTC).
D247 Step 1 final repeat (same worker and timing boundary; first-stage bookkeeping corrected). N=200 per path, 1600 PASS / 0 FAIL. Load before 0.028/0.112/0.059; after 0.769/0.292/0.121 on authorized 4-CPU perf VM, shared lock and CPUWeight=10000.
STOP remains: systemd first p50 44.579 ms exceeds current production 33.793 ms by 10.786 ms and the prior 39.161 ms baseline by 5.418 ms; helper first is 12.141 ms. Prior full run also failed (58.511 ms versus production 41.154 ms). Both reports are retained: evidence/real-logins/round2/comparison-first.json and comparison.json. Later/preopened systemd shells are faster, but do not satisfy the first-terminal condition. No Step 2 product changes. Remote units and lane scratch directories cleaned; bench account and its rc files preserved. Owner reconsideration of D247 is needed before implementation.
Completed/pushed atomic measurement steps: merge
653e8cc3(amended message explains D7/D247; supersedes initial merge SHA 706b8d8f), static scratch worker8d719106, interleaved driver739825a4, measurement/stop evidenced9879a52e7. Both full perf runs: N=200 per path, 1600 timing samples each, zero errors. Validated 3200 rows/48 quantiles and corrected first-terminal stage sums; five existing harness tests PASS, standalone musl build/no PT_INTERP/rustfmt/workspace fmt PASS. Evidence and limits: evidence/real-logins/round2/README.md. Product Step 2 not started because D247 condition failed. Final repository gate still running under high shared load; its output will be posted separately.Verification progress after the D247 stop: full scripts/verify fast has completed fmt, VT native fmt and CLI plugin compile-out; clippy is still building vendored native crypto dependencies. Started in CPUWeight=10000 scope with private lane target and umask 022. Current host load 06:41:47 up 11:52, 0 users, load average: 88.58, 86.25, 80.01. Product crates/manifests match
f2810b94(git diff --statf2810b94HEAD -- crates Cargo.toml Cargo.lock packages apps is empty). No gate failure is being accepted as green; final output remains pending. UTC timestamp 2026-10-12T04:41:47.086870+00:00.Repository gate finding (separate from D247): cargo test --workspace fails real_binary_preserves_input_and_output_across_24_abrupt_stops in crates/infraternal/tests/agent_daemon.rs:18, at scripts/verify-agent.py:34 (idle < 15*1024 KiB). The 65 main-binary tests and 24 CLI compile-out tests passed; the failing integration test stops later workspace suites. No budget exception is applied: this is not one of #118's listed timeout/credit failures.
Focused diagnostic using the unchanged Binary fixture, same debug executable and 0.25 s startup interval, under CPUWeight=10000: idle RSS 15696 KiB versus 15360 KiB budget, FAIL (+336 KiB). Host infraternal-dev currently reports 12 logical CPUs (earlier progress comments used the brief's 8); load before 47.651/65.423/79.578, after 50.722/65.765/79.612. Evidence: evidence/real-logins/round2/idle-rss.log and verify-fast.log. git diff --stat
f2810b94HEAD -- crates Cargo.toml Cargo.lock packages apps is empty; no product code or dependency changes belong to this lane. This source comparison is not a green baseline gate or a waiver. No product fix or budget change is attempted after the D247 stop. Full gate continues through static builds; final failed rows/output will be posted verbatim.Round 2 stopped at the D247 condition; Step 2 not implemented. Pushed atomic merge/prototype/driver/evidence commits; final head
70a1d14a19. Author measurement checklist: evidence/real-logins/round2/README.md. N=200 per path, each of two interleaved perf runs 1600 timing samples / 0 errors. Final first p50 44.579 ms versus production 33.793 ms (prior 39.161 ms); later/preopened 3.266/3.288 ms. Owner reconsideration is required before product work. No new crate/dependency or login/preferred-account implementation.Targeted: five harness tests PASS; static worker compilation/no PT_INTERP/rustfmt/workspace fmt PASS; 3200 timing rows and 48 quantiles validate, 200 corrected first-terminal stage sums match. Corrected a documentation extraction error (zero summary rows before, all seven rows after); full raw log was always intact. Perf units and lane directories removed, real bench account/rc files and existing production artifact preserved. Local build scratch cleanup follows this comment.
Final scripts/verify fast, exit 1, CPUWeight=10000/umask 022/private target/TRACER_TEST_PORT=4372; output verbatim:
Static output verbatim:
Test failure: agent_daemon real_binary_preserves_input_and_output_across_24_abrupt_stops at scripts/verify-agent.py:34, idle < 15360 KiB; focused reproduction 15696 KiB (+336). CLI compile-out 24/24 and main binary 65/65 pass; later workspace suites, aarch64 size and TypeScript gate are not reached. Host reports 12 logical CPUs in the diagnostic, as corrected above. Product crates/manifests match
f2810b94; no source comparison or #118 exception is accepted as a green gate. Full output and measured evidence are committed under evidence/real-logins/round2/. Issue remains open.Cleanup complete: removed only this job's local 15 GiB build scratch, diagnostic state and target symlink, using checked directory ownership/path assertions. Worktree is clean. Remote real-logins head verified equal to local
70a1d14a19. Perf cleanup was already verified in committed cleanup.log; bench account/rc files and shared production artifact preserved. D247 condition failed, no Step 2 product implementation, final verify fast remains failed as quoted above. Issue stays open.Round 3 started on real-logins at base
70a1d14a19. Read all 17 comments on #172 and all prerequisite #159 comments; neither names a parent. Owner round-3 brief authorizes D247 Step 2 despite +10.786 ms cold first-terminal p50. Merging origin/dev first. Scope: host login path, person/account isolation, reuse/preopening/adoption/cleanup/records, D241 compatibility, D229/D231 preferred-account persistence/actions. No dependency addition. Perf host 10.69.69.208 is explicitly named in this brief; local measurements use CPUWeight=10000.Implementation seam (additive to contracts/shim.md, D7/D13/D240/D247): retain the privileged shim and existing root-owned rendezvous/exit records unchanged. A private login-worker socket receives only terminal slave descriptors plus a fixed session identifier from authenticated local shim children. The worker runs as the account under the system manager PAMName=login and starts/reaps shells there; a shim child waits for that shell exit. This preserves the frozen PTY/shim framing and restart discovery rather than moving authoritative sockets into account-writable directories. Unit identity includes the trusted person UUID and account UID; adopt via that exact endpoint before starting a unit. Cleanup is a worker-owned one-shot grace, with no infraternal agent polling. No new dependency/library: use the existing nix/libc process/socket boundary.
Merged confirmed D247 origin/dev as
e9a48807and pushed. Merge checks: workspace fmt PASS, harness 5 tests PASS (1.422 s), diff check PASS. Production work in progress: root-owned frozen shim rendezvous retained; bounded descriptor handoff/login worker and deterministic person/account unit adoption implemented locally, not yet committed or claimed verified. Initial clippy hit pinned native VT source download failure HttpConnectionClosing; retry queued. Shared host load observed 70.96/56.93/54.25. Preferred-account server/actions and D241 startup compatibility being implemented in independent delegated domains under the dispatching-parallel-agents skill. No new library/dependency added; existing nix uio feature exposes its existing descriptor transport API.D229/D231 persistence and adapter finding: the SSH provisioning descriptor was not registered as a server socket feature. Preferred login actions are declared once in the SSH domain (
ssh.accounts.get/set), with a removable server adapter (ssh.accounts) rather than new core control specials. Global preferences default dynamically to the person's infraternal username; per-host preferences override them, including an empty host key for the embedded host. Writer transactions acquire SQLite admission before rechecking the exact session hash and host ownership/nonrevocation; browser JSON cannot choose a person or numeric uid.Real terminal opens now carry the authenticated person UUID and resolved account name over the trusted infraternal-agent leg, retain uid from the admitted host connection, and preserve returned account/fallback/note metadata in the browser result. One bounded login preparation runs at authenticated socket connection, before terminal input; no idle polling is introduced. Added persistence/reopen, precedence/reset, foreign/revoked host, mismatched/ended session, malformed input and real Unix-socket identity/metadata tests. Focused checks are compiling with the shared lane target; no passing gate or timing claim yet.
Preferred-account slice gates on the shared real-logins worktree: migration-only atomic commit
64708ff2pushed. SQLite schema checks pass foreign-key enforcement/check, account bounds, embedded/remote host key bounds, and person deletion cascade. Focused preferred-account tests: 4 passed, 0 failed (0.13 s on repeat). Embedded real Unix-socket regressions: 17 passed, 0 failed, 1 ignored (2.02 s), including authenticated person/account with connection uid, fallback metadata retention, and login preparation without a terminal. Server + SSH all-target clippy with warnings denied passes; scoped rustfmt and diff checks pass.SSH package tests: 22 suites, 81 passed, 0 failed, 8 ignored tests requiring the existing real-sshd harness. Explicit
--features tokio/test-utilsupplies the existing dependency's fixture feature; standalone package testing without feature unification exposed the existingstart_pausedtest requirement. No manifest/dependency change. Full repository verification and product timing evidence remain owned by the root lane; these scoped checks are not a full-gate claim. Logs: evidence/real-logins/round3/preferred-tests.log, preferred-embedded-tests.log, preferred-clippy.log, preferred-ssh-tests.log.Adapter test path: call ssh.accounts.get with {} for the embedded host; call ssh.accounts.set with {"scope":"global","account":""}, then with {"scope":"host","host_id":"","account":""}. Null account resets a scope. Terminal action results preserve account/requested_account/fallback/note; UI rendering of the returned note is not part of this backend slice.
Preferred-account domain and server-adapter atomic commit
d74112f9pushed after migration64708ff2. Scoped gate evidence remains: preferred persistence 4 passed/0 failed; embedded regressions 17 passed/0 failed/1 ignored; server+SSH all-target clippy PASS; SSH 81 passed/0 failed/8 ignored (existing fixture feature enabled); rustfmt and diff checks PASS.Post-build readthrough found a concrete responsiveness defect in the still-uncommitted transport wiring: authenticated socket login preparation waited on the 60-second terminal-connect timeout before reading browser frames. A stalled preparation could delay Ping and unrelated features. Adding a real WebSocket/Unix-socket regression that withholds the preparation response, then moving the one preparation future beside the normal socket loop so incoming frames and authority revocation stay responsive. Transport commit remains deferred until core trusted login fields land; no timing or full-repository gate claim.
Preferred-account namespace correction before integration: contracts/plugin.md §2 specifies lowercase plugin ids containing letters, digits and hyphens. The new, unpublished account subfeature will use descriptor id
ssh-accountsand actionsssh-accounts.get/set, matching that contract and the existing descriptor/action-prefix validator. Domain implementation stays in the SSH crate; no dependency, permission, storage or feature-selection change. This is an additive naming correction before any release, not a foundational choice or decision change.Namespace correction
f643d063pushed: plugin idssh-accounts, actionsssh-accounts.get/set, matching schema references. Targeted preference tests 4/0, exact CLI descriptor command-path test 1/0, server+SSH all-target clippy PASS, scoped rustfmt/diff checks PASS.Validation finding: the SSH preference API currently accepts a leading dot in an account name, while the authenticated host resolver accepts only an alphanumeric character or underscore first. Thus setting
.usercan report success but later terminal opening refuses the value as invalid. Adding a failing pure-domain prefix regression and persistence refusal case, then aligning the API validator with the host resolver. The 32-byte preference bound stays as established; no new dependency or permission change.Preferred account validation fix
2cec7004pushed after namespace correctionf643d063. The new pure-domain regression reproduced.useracceptance before the fix (0 passed, 1 failed); matching the host resolver prefix rule makes domain/CLI tests pass (2 passed, 0 failed). Persistence tests pass (4 passed, 0 failed, 0.13 s), including refusing.userthrough the setter while leaving durable state unchanged. Server+SSH all-target clippy with warnings denied PASS; scoped rustfmt and diff checks PASS. Logs: evidence/real-logins/round3/preferred-prefix-{red,green,storage-tests,clippy}.log.Final declared API: plugin
ssh-accounts; readssh-accounts.getwith optionalhost_id; setssh-accounts.setwith required scopeglobalorhost, optionalhost_id, and account string or null (null resets). A missing host selects the embedded host for host scope; global scope refuses a supplied host. Returned account, global_account and host_account preserve override precedence. The pure descriptor adapts to exact CLI command pathsssh-accounts get/setthrough the existing hosted adapter, whose authenticated CLI transport is still unavailable. Root lane wires its registry. Transport person/account/fallback metadata and asynchronous preopening remain uncommitted pending core integration. Full repository verification and product benchmark evidence remain pending; no overall completion claim.Transport cancellation finding before mutation: a timed-out or dropped login preparation leaves a generic pending action entry in EmbeddedAgent. Repeating 64 unanswered preparations can exhaust the bounded control-call capacity; blindly removing those entries would make late replies appear unknown and restart unrelated terminals.
Planned additive compatibility detail: Call/Result framing and their opaque u32 call ids stay unchanged. The server privately reserves the high call-id bit for opportunistic
terminal.login.preparerequests and records them separately from ordinary calls. Closed preparation receivers are pruned only at control admission (no idle timer or keystroke scan); untracked replies in that preparation namespace are discarded. Unknown ordinary call results still fail the protocol. Pending tracking remains bounded by the existing capacity. Legacy id-only fixture opens retain their exact old JSON; real person/account opens remain explicit and fail closed against older strict agents that reject those additive fields, rather than silently reverting to a bare uid login. Core rollout stays lockstep per D17.Round 3 progress: pushed
ebf841dc(existing nix descriptor-passing feature),3d9bd73b(atomic person/account login-record reservation), and5a507646(root-controlled account-readable immutable executable cache). No new dependency or lockfile change. Local weighted scope on infraternal-dev: shim 74 passed/14 ignored; agent 48 passed/6 ignored; touched-crate clippy passed before latest PID-pinning followup. Logs: evidence/real-logins/round3/{shim-tests-all,agent-tests,core-clippy-final}.log. Load at 09:34: 62.76/63.02/54.86.Findings: deterministic suspended publication exposed incomplete record mappings (records-paused-red.log); atomic inode publication passes (records-green.log, 3 tests). Proxy reconnect must verify the authenticated worker PID as well as UID; fix under test. Timed-out preopen calls can retain control slots; regression/fix in progress. Existing host revocation retires transport but deliberately retains shims; no person-login revoke hook exists yet. D240 immediate login cleanup therefore needs a new trusted controller action, serialized against opens, plus authorized server integration. These are incomplete work, not final results. Production build and full milestone gate are running; no deployment.
Additive D240 contract proposal for implementation: trusted leg-B terminal.login.revoke accepts only {person: UUID}; it retires all that person's account login paths on this host and returns {revoked: true}. It never accepts a browser-supplied OS uid. Serialize with login creation using the existing host-private per-login locks; authenticate worker PID against the root-created systemd unit, terminate its owned logind scope (including descendants/retained PTYs), then stop its service. Ordinary disconnect/Close keeps existing resume semantics; only explicit authority removal invokes revoke. No new dependency. Offline hosts cannot acknowledge cleanup, so server must retain factual reachability status instead of claiming process termination. Non-systemd fallback cleanup of exited orphan descendants remains under investigation; not yet verified.
Initial product-path benchmark N=200, four-condition rotating interleave: 800 passed/0 failed. Medians cold135.957ms, later51.971ms, preopened52.894ms, production48.851ms; p99 respectively197.808/78.785/77.570/75.213ms. Host infraternal-perf-test, kernel6.12.69+deb13-amd64,4CPUs, weighted scope, load0.00/0.008/0.106 before,1.664/0.714/0.362 after. Artifact21,906,672bytes. Raw rows evidence/real-logins/round3/comparison-initial.json; method explicitly excludes account lookup/cache/reservation/controller/server costs. One logind session with same worker PID across later terminals verified.
This does not meet the intended latency improvement. Per-terminal root system-manager MainPID lookup keeps request-to-process median42ms, almost the old scope's42ms. Removing that repeated query using a root-validated worker cache plus pinned kernel process-directory identity; initial creation/adoption will still validate the unit, and actual proxy connection will verify the original process is alive after connecting. Will measure again. Cold latency is also substantially above the approved round2 comparison; no success claim.
Record identity finding: person-only ut_line collides across that person's accounts. 31-byte fullUUID+reservedidentifier formatting preserves both. Exact-source regression fails old formatting, passes three tests after; pushed separate fix. Immediate revoke/descendant cleanup and final gates remain in progress.
Server transport findings and scoped evidence: canceled login preparations exhausted the 64-call control bound in a failing regression (0 passed, 1 failed). Distinct preparation tracking and the private high-bit call-id namespace free canceled entries at control admission, without timers or keystroke scans; late preparation replies do not restart terminals, while unknown ordinary results still fail protocol. Full embedded regressions after that fix: 19 passed, 0 failed, 1 ignored. The real-socket stalled-preopen Ping regression passes (1 passed, 0 failed, 0.97 s). Remote-feature all-target server clippy passed before the subsequent authorized host-cleanup hook.
Host cleanup hook now routes a dedicated fixed
terminal.login.revokerequest with person UUID read from the already-authorized host writer transaction, through a weak actor registration before quiesce. Foreign owners cannot initiate cleanup. ACK wait is capped at 100 ms; offline, old or unresponsive hosts are unconfirmed and authority revocation continues. Non-UUID legacy fixtures have no D240 login context and retain the existing path. No public descriptor exposes this trusted-only action, no arbitrary-action bypass is added, and weak routing cannot retain a host actor.Real TCP/mTLS regression first failed because the channel retired without any person cleanup request. After the hook: 2 passed, 0 failed; correct person payload before retirement and foreign-owner refusal verified. Unit-test authority cut: 3.433 ms with a peer reply, 104.623 ms with no ACK (local loaded build host, not perf acceptance). The server does not claim physical login cleanup on timeout. An accepted revoke must be owned independently of channel retirement on the host; that controller implementation and physical PAM/record tests belong to the root lane. Additional invalid-ACK and final transport lint checks are compiling. Transport/hook files remain uncommitted pending core integration; full repository verification is still pending.
Server slices are committed and pushed on
real-logins:662ba6ea: authenticated person/preferred account and host fallback metadata on real terminal opens; concurrent embedded login preparation; bounded cancellation tracking without an idle cleanup timer. Legacy fixture opens preserve their uid/size input.140800b9: authorized host revocation sends person-login cleanup through weak actor routing before retirement, including no-uninstall removal. A foreign owner cannot submit cleanup. ACK wait is capped at 100ms; unavailable/false/malformed ACKs remain unconfirmed and do not block authority retirement. Accepted cleanup is owned independently by the infraternal agent; unwritten cleanup cannot be claimed complete.Evidence in
evidence/real-logins/round3/preferred-*.log:The latest command above was server remote all-target clippy with
-D warnings, exit 0. Scoped rustfmt and staged diff checks passed for each commit. The held-preparation websocket Ping regression passed (1 test, 0.97s). Cancellation exhaustion, blocked Ping, missing revoke routing and positional[true]cleanup ACK each reproduced before its fix. Timings are local TLS regression evidence, not the VM performance acceptance benchmark. Overallscripts/verify fastand performance gates remain in the coordinating slice; backend note fields are carried, with no UI change in these commits.Real controller validation found two integration constraints beyond direct worker timing. First, tar retained local UID1001 on the root executable; the controller correctly refused that non-root-owned source. Corrected only the job's staged artifact ownership. Then actual terminal.login.prepare failed resource_unavailable: exact owned service journal reports203/EXEC, and mount evidence confirms /run tmpfs rw,nosuid,nodev,noexec. Existing direct harness executes the account copy under/home and did not exercise product image staging. Fixing product image cache to/var/cache (root-controlled executable filesystem) and checking ST_NOEXEC before launch; host mounts stay unchanged. RED: perf-controller-root-owned.log +controller-unit-diagnostic.log +cache-mount-policy.log.
Pinned identity portability: a nondumpable infraternal agent's external/proc/PID/fd path needs ptrace permission. Replacing the cross-process path with inherited read-only process-directory fd5 through the audited descriptor boundary, without granting capabilities. Isolated nondumpable-parent regression denied the old path and passes inheritedself/fd5 (0.09s). D198 compile-out regression also failed old worker flags when plugin-agent disabled; gating worker/descriptor bridge through existing role feature is under test.
Cached preliminary N200 still800passed: cold88.042/later9.985/preopened10.683/production40.707ms median. PAM moved worker into a separate session scope with default CPUweight100 despite service weight10000; harness now verifies the actual scope weight10000 to match production before final rerun. Full lifecycle harness exposed missing last utility and a closed-log cleanup bug; fixed harness, no package/dependency additions. Final controller/cleanup/memory/idle/gates remain pending.
Capacity continuation started on real-logins at
140800b930. Read all 33 comments on #172 and prerequisite #159 (no parent named). Reviewing inherited uncommitted cache-mount, descriptor-pin, feature-removal, lifecycle/fuzz and benchmark changes before atomic commits. Fetching and merging current origin/dev first; D229/D231/D240/D241/D247 apply. Explicit brief authorizes benchmarks on 10.69.69.208 and branch pushes; no deployment or new dependency. Final lifecycle, N200 rotating interleave, scale/idle delta and verify-fast evidence remain pending.Continuation commits pushed:
b505648dmerges current dev;b8388e63fixes the observed /run noexec 203/EXEC failure by staging immutable worker images in /var/cache and refusing ST_NOEXEC (6 image tests PASS);d126786eremoves the whole host-login worker/descriptor/CLI boundary when plugin-agent is compiled out (default CLI metadata 8 PASS, role-free metadata 7 PASS, removed programmatic bridge 1 PASS, default and role-free clippy/fmt PASS). Logs: evidence/real-logins/round3/continuation-feature-cache-gates.log. No new dependency or lockfile change.Further finding: ready socket source fd5 is overwritten by the process-pin pre-exec callback. New isolated real-descriptor regression FAILS with readiness source was replaced by the process pin (continuation-ready-pin-red.log). Duplicating both source descriptors above the reserved slots passes that case and the nondumpable-parent case (2 PASS); final crate tests/build are in progress. The earlier vanished-session test failure was fixture SUN_LEN, caused by the added long TMPDIR. Removing that override passes all 54 infraternal-agent tests (6 ignored); original short runtime test paths preserved, build targets remain in lane scratch. continuation-pin-gates.log also has 66 CLI tests PASS.
Independent source review found two P1 defects and production regressions reproduce both. (1) canceled readiness/start ACK propagates EPIPE out of the whole worker; paused-worker real-PTY regression fails with BrokenPipe/ConnectionReset before the fix.
f7461f8fcontains per-request reply failures and reaps only the unacknowledged newly started shell; all 7 lifecycle cases PASS in 6.20s, shim clippy/fmt PASS. (2) Detached/User adoption accepts a same-account R responder without proving host su opened a login, and passes no worker pin to the proxy. New regression logins::tests::fallback_refuses_a_same_account_socket_without_a_host_login_parent FAILS before identity checks.Chosen additive private-launch detail for D240/D247: authenticate the original su parent via a pinned process directory, root-owned host-su executable, privileged UID record and exact public person/account/endpoint argv; retain that parent pin through cache/launch. Pass its original PID to the proxy, which checks the pinned worker kernel PPid before terminal transfer (reparenting cannot retain that PID). Adopt old immutable cache images across infraternal-agent restart. Reject UID-only adoption, capabilities, and bare process switching; a host policy that prevents authenticating su fails closed. No dependency or frozen transport/frame changes. The fake-listener regression now passes; final integration and lint remain pending. Evidence: round3/{fallback-identity-red,canceled-worker-reply-red,canceled-worker-reply-green}.log.
Pushed atomic slices
d07dc9c5(original su-parent proxy guard),96df0c82(fallback host-su authentication),9dde5066(fixed-header fuzz target),4b8b4dd0(actual controller harness). Local gates: agent 55 PASS/6 ignored; shim login/descriptor 14 PASS; CLI 66 PASS and role-free25 PASS; touched-crate/default-role clippy/fmt PASS. Parent mismatch guard adds1 PASS. Fuzzer 100000 assertion-smoke iterations without coverage instrumentation; production-unified all-target clippy PASS. New-source same-account responder reproduction is refused by independent review.Actual authorized perf-host smoke on artifact SHA256 5fcf3222dfb19cb19bfae44390acf5be9d207517386deb40314a26fcdde7f0ce (22079376bytes): systemd and host-su both PASS separate person/preopened login reuse, actual infraternal-agent restart adoption and terminal resume, explicit person revocation/fenced reopen, other person survives; zero cleanup failures. Each records0 scheduled infraternal-agent slices over5s. Fallback keeps two root su utilities with observed PSS1007/990KiB in addition to workers; all numbers are smoke, not scale acceptance. Evidence round3/{controller-final-smoke,fallback-controller-final}.log.
N200 rotating production comparison, real records/grace/descendant lifecycle, and 50-person idle/memory now running under the shared perf lock and weighted scopes. Local current-dev native RSS comparison and final verify-fast remain pending. No dependencies, limits, owner fixtures or deployment changed.
Sign-in continuation started on real-logins at
4b8b4dd0. Read all 37 comments on #172 and all 22 prerequisite #159 comments; neither names a parent. Pending files include completed N200 comparison, 50-person zero-idle evidence and legacy-record build-flag correction. Fetched origin/dev and preserving pending evidence before merge. D229/D231/D240/D241/D247; explicit brief permits branch pushes and perf host 10.69.69.208 only. No dependency or deployment changes.Continuation findings: origin/dev
5db9d82fintroduced readiness commands, locale propagation and event-driven terminal census; merge preserves them with person-login launch paths. Fresh-server regression failed auth initialization: both branches allocate migration 0022. Unpublished preference migration moved to0023; scoped suite rerun pending. Inherited perf evidence: N200 rotating comparison 800rows/0failures, cold/later/preopened/production p50=90.297/10.428/11.345/41.958ms; current binary 22079376bytes. 50prepared logins:0scheduled infraternal-agent slices/10.0007s; worker aggregate PSS and RSS retained in controller-scale50.json. Real lifecycle-final.json:9checks/0failures; natural grace30.0366/30.0174s, first detached descendant gone and other person survives. Host systemd257 reports -UTMP; legacy wtmp4608bytes is not maintained login evidence, lastlog0bytes unchecked. Scope of existing preopening is embedded-host only; connected remote-host preopening remains to wire. No final completion/gate claim.Merge finding: the new pending_host_facts_read_keeps_control_ping_responsive real WebSocket/Unix-socket regression stalls after Welcome on the one-connection SQLite fixture. Diagnostic reached fixture and Welcome but no leg-B Call, then exceeded60s. Root cause: select-polled preparation holds a preference-read transaction connection, while a selected browser frame awaits authority on the same pool; that await prevents polling preparation to release it. Replaced the select-owned future with socket-owned JoinSet task (abort-on-drop, no idle timer) so preparation progresses during authority awaits. Facts fixture replies only to optional preparation and retains its stalled facts request/Pong assertion. Green rerun pending; this is a branch integration defect, no baseline exception.
Usage-limit continuation started on real-logins at
4b8b4dd008. Read all 40 comments on #172 and all 22 prerequisite #159 comments; neither names a parent. Current origin/dev merge (5db9d82f) remains in progress, with reviewed migration collision and socket-owned preparation correction pending. Inherited N200/per-person scale/lifecycle evidence preserved. No new dependency or deployment. Continuing scoped gates, atomic commits and final verify fast. D229/D231/D240/D241/D247.Completed/pushed merge
cafd2f93(dev5db9d82f). Preserves login identity with readiness/locale/event-driven census; unpublished preferred migration moved to0023. Socket-owned JoinSet fixes reproduced single-connection preparation deadlock. Scoped evidence: host-facts Ping regression1PASS; preference persistence4PASS; migration compatibility7PASS; workspace fmt and remote server all-target clippyPASS; tracer bun run checkPASS after frozen-lockfile install (first run had missing node types). Full milestone gate has passed main66/66, agent restart24-abrupt-stop scenario and other integration suites so far; still running, no green overall claim. Connected remote-host preparation is the next separate module slice. No dependencies changed.Pushed
c8105b19remote preparation module: owned/unrevoked/live-session targets, four concurrent attempts with5s per-host bound, persisted host override via admitted actor, cancellation on socket drop/revocation, no idle polling. Authority-selection1PASS; held-response Ping1PASS; real mTLS remote preparation1PASS with exact person UUID and deploy override; remote all-target clippy/default-role-free check/fmtPASS.Milestone reproduced review3 backend-deadline and review4 open/revocation fixture failures because positional leg-B reads consumed the preparation call as terminal.open. Detached dev5db9d82f baseline deadline1PASS (0.99s), so no #118 waiver. Corrected fixture reader ACKs only preparation and synchronizes on terminal.open; both fixed cases1PASS each (0.96/2.10s), remote clippy/fmtPASS. Separate fixture commit follows
c8105b19. Source gate output and measurements continue; no overall green claim.Pushed atomic fixes94f20229 (plugin lookup by declared Mesh id; RED ssh-accounts!=mesh, GREEN1PASS),67eec081 (shared terminal-open fixture reader; refusal RED expected authenticated terminal open, GREEN1PASS),a39e5388 (remove duplicated preparation authority watchdog; idle socket RED90s closed, detached dev5db9d82f GREEN1PASS/1.01s, fixed branch GREEN1PASS/0.91s). Refusal/deadline0.92/0.80s PASS, remote server all-target clippy14.53s PASS, fmtPASS. Main socket watches expiry/revocation and aborts its JoinSet; targets retain exact durable session/host authorization. No #118 waiver. Owner-only TASTE update merged next; no UI changes. Final static artifact/benchmark/native RSS comparison and head verify-fast pending.
D240/D247 documentation reconciliation proposal before editing: contracts/shim.md section2 still states that every systemd terminal uses a separate transient scope. Preserve this as the legacy uid-only fixture path and document authenticated person/account logins as the confirmed exception: one PAMName=login service/session per person/account, privileged shim remains the root-owned rendezvous and joins that login cgroup, shells run via the account worker, wire v1 unchanged. Update ARCHITECTURE process overview accordingly. This records the implementation seam already proposed on this issue; no framing, library, permission or owner-decision change.
Final measured artifact8b5f46443c9c564f4f9636b3517d7a184f30b14300204da4c176857816f06a28 (22251408bytes), product code
c599c7b1. Pushed5fb4c3e2 native delta observer/evidence;c045f17dtiming evidence;bb49336clifetime/scale evidence. N200 rotating interleave800rows/0errors, cold/preopened/later/production p50=77.728/9.449/8.765/35.953ms, p99=124.454/52.356/13.655/66.630ms. Cold penalty41.775ms exceeds prototype penalty; controller/browser/cache/record admission outside timing explicitly listed.Actual controller50separate logins, preopen reuse, real daemon restart adoption/resume, revoke/fenced reopen/other-person survival PASS; zero scheduled slices10.000545s; workers aggregateRSS/PSS264856/56856KiB, daemon8308/4695KiB. Fallback2people PASS/zero slices5.000603s, workers10472/6288KiB, su utilities8960/1730KiB. Lifecycle9checks/0failures, grace30.036958s, logindgone30.042547s, detached descendantgone. Native debug
c599c7b1median15768KiB versus mergeddev5db9d82f14824KiB (+944KiB); this is not waived by the brief's earlier dev warning. Host/machine/load and raw rows committed.Final perf cleanup is queued behind the shared lock held by another workload; only exact owned identities/paths will be removed. Baseline artifact/bench account/rc are preserved. Final full head verify-fast next; unchanged static maximum16404816bytes already exceeded. D241/browser/rootless/legacy-record/restored-access limits are listed in evidence/real-logins/round3/README.md. No dependencies, budgets, decision edits or deployment.
Final head gate at42e4a60d: real infraternal-agent24-abrupt-stop integrationPASS; server library384PASS/30ignored and no socket failures. Remaining test failure is tests/plugin_settings_review.rs:78: first registry entry ssh-accounts stays enabled while the test toggles mesh. The reopen assertion reads entry0 instead of the feature it mutates. Correcting all four compiled-registry persistence assertions to select the declared id; preserve the direct SQL and worker-count checks. This is a fixture defect, not failed setting persistence; no baseline waiver or registry ordering change. Full gate still has unchanged static failure22251408>16404816bytes. Separately full TypeScript checks/build/transfer/protocol testsPASS. Perf cleanup completed:257owned registry/cache files removed, final stage/account-copy directories removed; existing bench account/rc and production baseline preserved. Exact cleanup log retained.
Correction to preceding gate finding: the exact server-library result is343passed,0failed,39ignored, finished211.09s, not384/30. The sole failed test in that head gate is plugin_settings_review plugin_switches_survive_database_reopen; its assertion selects registry entry0 (ssh-accounts) after toggling mesh. No source persistence failure or #118 exception is claimed. Final focused correction and full rerun remain in progress.
Final continuation result: pushed real-logins head
fcd1c95a88. Backend Step2 is built and benchmarked; no deployment or main/dev merge. The issue remains open for independent review and the static-size failure. Preferred-account browser UI and broader D241 controls remain unwired; rootless policy, +UTMP record writes and explicit authority restoration remain the documented validation/integration limits (evidence/real-logins/round3/README.md).N200 four-condition interleave800rows/0errors: cold/preopened/later/production p50=77.728/9.449/8.765/35.953ms; cold penalty41.775ms.50actual person/account logins, preopen reuse, real daemon restart adoption/resume, immediate revoke/fenced reopen/other-person survival PASS.0scheduled infraternal-agent slices/10.000545s; worker aggregatePSS56856KiB. Real host-su fallback2people passes with0slices/5.000603s. Nine real lifetime checks pass, grace30.036958s and tested detached descendant gone. Native debug median15768KiB vs dev5db9d82f14824KiB (+944KiB), reported as own delta without waiver. Raw final/intermediate evidence committed.
Final scripts/verify fast on this branch head, umask022/private target/CPUWeight10000/TRACER_TEST_PORT4372, exit1.98completed Rust test summaries:885passed/0failed/105ignored (includes the separate25-test CLI compile-out invocation). The actual agent idle/restart gate passes in this workspace build; the separate native debug sample above is retained, not substituted. Output verbatim:
Static output verbatim:
No size exception or raised budget. Aarch64 and the built-in TypeScript phase are not reached after x86 size fails. Full TypeScript profile was run separately and PASS: compiler, production build/precompression/transfer budgets, frontend tests, Rust stream oracle and protocol36tests/34462expectations. No TypeScript changed after that run. Gate log: evidence/real-logins/round3/verify-fast-head.log; separate TypeScript log is committed.
Perf cleanup confirmed257owned registry/cache files removed, final owned artifact and account-copy directories removed, bench account/rc and production comparison artifact preserved. Author backend checklist recorded. Local baseline/build scratch cleanup now follows; all source/evidence commits already pushed. No dependency, foundational engine, owner fixture, decision or budget changes. No issue close.
Cleanup complete: removed this job's68GiB local scratch, clean detached dev baseline and target symlink after final verification; worktree clean. Local and origin/real-logins both
fcd1c95a88. Final gate remains fmt/VTfmt/CLIcompile-out/clippy/test/cargo-denyPASS, staticFAIL22251408>16404816bytes; no waiver. Full gate output and backend/UI/platform limits are in the preceding finish comment, final measurements/checklist in committed evidence/real-logins/round3/. Perf final artifacts/owned identities cleaned and benchmark account/rc/production artifact preserved as recorded. Nothing deployed; issue remains open.Round 4 started on real-logins at base
fcd1c95a88. Read #172 and prerequisite #159; neither names a parent. D235/D240/D247/D250 apply. Perf VM 10.69.69.208 and branch pushes explicitly authorized; no deployment.Round 3 N=200 stage p50 ms (request→process / process→setup / setup→exec / exec→prompt; medians do not sum): cold 71.165/2.617/1.444/1.997; later 2.597/2.558/1.393/1.992; preopened 3.215/2.617/1.469/2.031; production 31.747/0.628/1.368/2.016. Totals cold/later/preopened/production 77.728/8.765/9.449/35.953. Prototype later/preopened/cold 3.266/3.288/44.579. Source comparison points to proxy fresh exec/metadata construction and worker startup logind query; profiling before any fix. Final targets later/preopened≤4ms, cold≤45ms, idle delta≤200KiB and zero idle activations.
Round 4 diagnostic on authorized perf VM, CPUWeight=10000/shared lock, old round3 artifact 22079376 bytes (the final
fcd1c95aartifact is rebuilding). Numeric-only syscall profiles: every terminal includes 3 forks (detach twice, proxy launch) and a second binary exec; proxy repeats 34 mmap/30 munmap calls at startup. 10-sample boundary diagnostic: manager identity+scope preparation median14.727ms; readiness exchange0.062ms, cached terminal identity0.423ms. This noisy smoke is diagnostic, not target acceptance. Files round4/{profile-before,trace-before}/.Real PAM regression reproduces unnecessary startup logind query: round4/retirement-query-red.log records ready_operations=[show-session], retirement_operations=[show-session,--no-ask-password], then FAIL logind query blocks login readiness. Move leader validation to retirement; still authenticate the worker as the current logind leader immediately before termination. Reject deleting the leader validation, relying on inherited session ids, or changing the host PAM path. No dependency or framing changes.
D240/D247 private handoff refinement proposed before implementation: retain root-owned shim sockets and v1 frames. Move terminal descriptor transfer from an execed privileged proxy into the existing privileged shim, calling the same socket UID/PID/pinned-worker/original-su-parent authenticator. The shim retains the existing worker connection as its output-retention lease and uses poll readiness on that connection for the existing fixed exit status; no timer, new transport or dependency. Legacy proxy CLI remains for compatibility and its security tests remain. Local PTYs still use std::process::Child. Reject deleting connection checks, adopting a same-account responder, or polling for remote shell exit. A real-worker PTY regression uses a test executable with no proxy CLI, proving that a new executable/process is not required; before-fix run pending native compilation.
Pushed measurement modules15e29fcc/da4c7c5b; metadata selection484bb058; retirement leader validation214b07bc. Metadata RED: hidden_shim_materializes_only_its_declared_action saw4actions; GREEN:26role-free CLI tests, all-target clippy/fmt PASS. Retirement existing login/lifetime suite17PASS, shim clippy/fmtPASS; real PAM red observes show-session before readiness; green awaits rebuilt artifact.
Direct handoff RED reproduces extra executable dependency: actual worker+PTY fails login shell did not confirm startup because fixture executable has no proxy CLI. GREEN direct transfer1PASS. Host-login shim suite96PASS/14ignored, removed-host-login suite78PASS/14ignored, both all-target clippyPASS (round4/direct-handoff-tests.log). Connection authenticator remains shared with original UID/PID/dead-pin/su-parent tests; exit-status socket adds readiness, not a timer. Extended status parser/cancellation tests and release perf measurements pending. No latency or idle acceptance claim yet.
Further D240/D247 refinement before edits: untraced direct20 has p50 cold/later/preopened/production69.091/7.073/7.572/34.837ms; zero failures80rows. Unit admission61.079ms includes10.588ms manager identity lookup. Numeric syscall sequence shows the shim cgroup write precedes authenticated descriptor transfer; overlap that placement with shell initialization, preserving placement before Hello. Record-property omission is diagnostic only and did not improve cold (69.106ms); keep all record properties.
Fresh launches can prove their original worker through systemd-run --pipe: a private controller-owned stdout pipe, passed by the root manager to the exact immutable executable in the requested PAMName=login unit, carries one fixed PID/UID readiness record. Pin the original process before checking the worker socket PID/UID and cached cgroup; no account-controlled socket alone authenticates a login. Existing-worker/restart adoption still queries the manager MainPID and keeps all original fallback-parent checks. Reject UID-only proof, removing PAM/records, or retaining a systemd-run process per login. Kill/reap only the owned launcher after its readiness record; service lifetime stays with the manager. A real pipe lifecycle proof is running before implementation. This adds only a bounded private startup record, no dependency or frozen shim framing change.
Perf-VM debug idle comparison now runs both exact native artifacts with their identical pinned native runtime staged under the job directory (ELF interpreter/runpath relocation only; source and instructions unchanged). Eleven alternating real leg-B greetings: current medianRSS16960KiB vs mergeddev5db9d82f14872KiB, delta2088KiB. PSS16952/14864; private clean14200/12176KiB (delta2024); anonymous2752/2688 (delta64); VmStk132KiB and1thread both. This exceeds the own-lane200KiB target. The added working set is executable code rather than per-login buffers or stack residency. Evidence: perf idle-before-relocated.json, packaging script round4/package_debug.py.
Hypothesis to verify: keep creation of large cold open/revocation futures out of the dispatcher poll function, so an idle connection need not touch that code. Admission, cancellation and result tracking remain unchanged; no timer and no eagerly allocated task/buffer. Measure the change before accepting it.
Private launch pipe real proof PASS: worker login remains active after owned launcher kill/reap. Original readiness regression FAILS on old artifact (launch-red.log: missing original-worker readiness record); worker/CLI sender and controller integration are now under scoped gates. Original/restart adoption retains MainPID authentication.
Review of the uncommitted startup handshake found a numeric-PID reuse interval between readiness and /proc pinning (logins.rs launch_identity; code schedule, not reproduced). Replaced it with original private launch socket + SCM_RIGHTS transfer of the worker-opened /proc/self directory; dead original descriptors cannot resolve to replacement PIDs. Descriptor count/truncation/CLOEXEC/death-before-receipt tests pass (3). Also restoring manager query stdout capture and releasing Command-owned launch writer for failed-launch adoption. No account socket supplies startup identity. Perf VM run is queued behind the shared lock.
Startup sender committed/pushed as
621090cc(D235,D240,D247): fixed private record + original /proc/self descriptor; legacy worker path preserved. Three startup codec/descriptor tests pass; all touched-crate clippy passes. Full parallel shim run: 98 pass, 1 fail, 14 ignored; malformed_descriptor_requests_leave_an_existing_terminal_alive reported worker fd count7 versus6. Its isolated rerun passes; full serial run is in progress. Earlier commit body overstates that full-suite gate, and this comment records the actual result. No leak conclusion yet. Independent review confirms original descriptor closes numeric-PID reuse gap; query-capture and failed-launch writer fixes are uncommitted consumer changes. Perf lock remains occupied; queued actual-PAM and idle comparisons.Full parallel and serial shim suites exposed a preexisting live-worker fd-count race: malformed_descriptor_requests_leave_an_existing_terminal_alive sampled7 vs6. Diagnostic reread found the extra enumerated descriptor already closed (empty read_link target); evidence round4/descriptor-count-diagnostic.log. Replaced total fd sampling with counts of aliases of the injected malformed-request PTY, retaining EOF/readiness/existing-shell checks. Full suite/clippy rerun in progress. Failed-launch writer regression reproduces TimedOut without drop(command), passes after writer release; agent suite67pass/7ignored.
Perf measurements blocked: /var/lock/perf-bench.lock still held in perf session-c989.scope by bash PID504804 and bun PID510496 (fd9). Recorded lock owner PID504809 has exited. This is not this job’s Python benchmark scope; no process, lock or other job was changed. Original-descriptor PAM test and idle comparisons are queued. Orchestrator/current lock owner must release it normally before N=200 acceptance can run. Native build/gates continue.
Committed/pushed consumer7d2a7c0e: original process-descriptor startup admission, existing-worker manager authentication retained; failed-launch writer regression red/green, agent67pass/7ignored, fmt/clippy pass. Test fixee6b9446: malformed-request PTY descriptor count avoids transient unrelated fds; full shim99pass/14ignored, fmt/clippy pass. Review found no remaining defects in descriptor admission, placement order or revised leak invariant.
Committed/pushed
6100cdc4(shim placement hook),9b1eb6c9(CLI uses overlap),53a0992b(startup decoder fuzz invariant),9b6a0596(cold-task creation isolation). Security review confirms PTY connection authentication precedes migration and migration precedes Hello. Scoped gates: shim99pass/14ignored; compiled-out shim78pass/14ignored; CLI67pass; agent67pass/7ignored; fmt/touched clippy pass. Fuzz assertion smoke100000inputs, no coverage instrumentation; production-default clippy passes (minimal-server feature warnings recorded, unchanged). Full scripts/verify fast on9b6a0596 running; actual-PAM/per-stage/idle measurements queued on shared perf lock. Performance targets are not yet established.Final error-path review found that the new group-placement hook can accept local startup or a readiness probe, both of which use std::process::Child. A placement write failure after spawn would drop that child without kill/reap; old CLI ordering failed before spawn. Real daemon callers supply a login endpoint, but hidden CLI/public helper combinations are reachable. Require a login endpoint and reject readiness before opening placement (D240/D247); do not migrate local/probe children through the login-only hook. A safe invalid-path regression checks both startup-mode refusals before any kernel cgroup or child is touched; red run is in progress. No owner decision/feature/protocol change.
Latest perf-VM diagnostic, N20 per condition, rotating interleave80rows/0failures: cold63.076ms, later7.006ms, preopened7.133ms, production34.068ms; loadbefore0.579/0.722/0.871, after0.853/0.777/0.888. Artifact is the descriptor-probe candidate, not final
cd02e9b1. Targets remain unmet. Fresh original-descriptor PAM regression now passes; first failure was fixture socket beneath /root(mode0700), fixed to account-private scratch. Scope-name rejection also fixed to required isolated harness scope.Native idle11alternating samples: cold-helper candidate delta656KiB (15480 vs14824; load0.769/0.604/0.631 before), reviewed descriptor artifact delta1916KiB (16780 vs14864; load2.208/1.333/0.937 before). Private clean remains the added working set (14028 vs12168KiB), anonymous2736 vs2688KiB, one thread and132KiB stack both. Resident-page profile running; no acceptance claim.
Guard
cd02e9b1committed/pushed: reject local startup/readiness in login-only placement before any group open or spawn. Regression red/green; shim100pass/14ignored, fmt/clippy pass; review clear. Full9b6a0596 gate: all Rust rows PASS except inherited static-size FAIL22132016 vs16404816; rawlog round4/verify-fast-head.log. Final head gate will rerun after remaining changes.84ba10a7: committed/pushed startup-stage evidence wrapper, preserving the round-three rotating prompt boundaries and authenticating the original worker descriptor. Fifteen unchanged harness tests and Python compilation pass; fmt passes. Added launch/announcement/endpoint/scope/reap boundaries and corrected inherited proxy/MainPID metadata. Diagnostic boot probe and cold-layout RSS probe remain queued behind the perf-VM lock; no acceptance result yet. Full gate is running oncd02e9b1production code.Perf VM cold-layout diagnostic:11 alternating idle samples, current15488KiB vs dev14864KiB, delta624KiB (target200 unmet); privateclean12748 vs12164, anonymous2736 vs2688, one thread/132KiB stack both. Load0.324/0.188/0.380 before and0.231/0.174/0.371 after. Candidate adds only #[cold] to two previously extracted non-inlined task constructors; no eager buffers or periodic work. Removes1320KiB vs reviewed descriptor artifact delta1916KiB. Original ELF program headers/PT_LOAD bytes beyond header are asserted unchanged after removing unmapped debug sections before identical interpreter/runpath relocation. Probe raw idle-cold.json will be retained.
a3aa0414committed/pushed bounded numeric syscall-order evidence; all eight traced shims transfer descriptors before placement. Cold startup-stage probe remains queued; no target acceptance.Full gate at
cd02e9b1: unexpected uninstall_handoff_runs_only_after_a_successful_real_socket_write failure (successful write after fixture peer drop), plus static22132400>16404816 size failure. Focused original test passes. Controlled reproduction retaining one try_clone of its reader fails deterministically with the same assertion: dropping the fixture reader does not break the socket while another alias survives, as can happen between concurrent fork and exec. Proposed fixture-only fix shuts down its own reader before dropping it; no transport/callback production behavior changes. Full-feature agent tests/clippy are running. This is not treated as an allowed host-load exception.9ccecd77and25700afa committed/pushed. Socket fixture alias regression red/green;91full-feature agent tests/12ignored and fmt/clippy pass. Cold helper annotations reduce idle delta1916→624KiB on perf VM, still above200. Boot probe80valid/0failure: later5.535/preopened5.905/cold48.246/production27.530ms N20; synchronous diagnostic flush makes these non-acceptance. Boot stage medians rejectpaths.032/registry.046/tree.066/parse.112/dispatch.008/detach.298ms. Launch announcement39.900, endpointauth.247, scopeauth+weight.225, reap1.126ms. Load1.075/.663/.527 before,1.525/.773/.565 after. Next additive optimization: direct exec replaces shell-only fd3 exclusion, preserving it with pre-exec CLOEXEC; controller-owned login shims establish sessions before exec and omit double-fork detachment. Independent review finds no must-block issue provided original authentication/cgroup/stdio/signal behavior and standalone mode remain. Real fd3 exclusion red/green, missing-exec reporting and owned-session identity tests pass; fullshim tests running.c046c361,35f95947,2ed5cde4 committed/pushed: syscall-only fd3 CLOEXEC/session preparation; direct exec replaces shell-only fd3 closure; controller-owned login shims use pre-exec setsid without double-fork. Standalone/other detached launches unchanged; signal reset/null stdio/original fd5 authentication/cgroup-before-Hello retained. Real helper fd3 exclusion red/green, missing executable and parent/child session tests pass; shim102pass/14ignored fmt/clippy pass. Agent91pass/12ignored+2integration under serial scheduling, fmt/clippy pass. Earlier parallel TCP-spacing test failed; no test threshold or relay code changed. Current release build, full head gate (serial test scheduling) and perf owned-path diagnostic underway. Final controller restart/revocation/scale50/preferred reuse/zeroidle and N200 acceptance remain outstanding.
24936720committed/pushed owned-harness and fd-driven launcher reap; actualPAM80rows/0failures. N20 owned diagnostic9b artifact rose to later12.059/preopened11.543/cold88.284ms with production49.681ms; load1.355/1.539/1.085→1.528/1.571/1.101. No causal speed claim. Exact2ed5cde4 artifact SHA25600b10d71de3849987eab72e918ef1b46adf865990f67b099912e4ebc3e81a728 now queued for controller50/restart/revocation/preferred reuse/zeroidle, fallback2 andN200 owned interleave.Next additive candidate for remaining latency: overlap shell startup with privileged shim startup. Controller prepares the same PTY using already-resolved account UID/GID, async-authenticates the original live worker/socket/parent and sends the existing session+slave request before spawning the root shim. Child receives owned master and SAME lease through captured dynamic descriptors (avoid stdCommand exec-error pipe collisions), revalidates worker/pin/parent, consumes existing bounded A acknowledgment, then runs normal retention/status/placement-before-Hello. Existing Config and wire formats/local/readiness/standalone APIs remain. No new engine/service/thread or idle buffers. Review confirms worker authorizes root UID rather than shim PID. Required checks: FD collisions/exec failures, cancellation before/after transfer/spawn, ack+status coalescing, dead/replaced worker/fallbackparent, malformed descriptors, retained output/ExitAck, revoke during handoff and restart survival. Parent Command/FD copies must drop immediately after spawn; inherited Tokio O_NONBLOCK must be handled during ack. Prototype and measured review required before acceptance.
Controller50 and fallback2 now pass preferred reuse, actual restart adoption/resumed terminal, revocation/reopen fence, other-person survival and zero scheduled slices, no cleanup failures. Initial controller rejection was fixture rootartifact tar owner1001, corrected to0; immutable source gate correctly failed before launch. N2002ed5cde4 interleave running.
Prestarted design review exposed a pre-existing fixed-pin fd5 spawn-error collision too. Deterministic private child with slots4/5 closed and process pin held reproduces: dup2 of pin onto5 overwrites Command exec-error writer; missing executable is reported as successful spawn. Red log round4/pin-error-red.log. Fix in progress: keep captured duplicate descriptor occupied through spawn, clear its child CLOEXEC in place, return child-local descriptor path and protect that dynamic path at shim entry. No fixed destination; no parent descriptor inspection; original live process authentication unchanged. Existing readiness and nondumpable-parent tests use returned path. Parser tests/fuzz and scoped gates due before commit.
Exact2ed5cde4 N200 rotating interleave:800valid/0failures; p50 later5.024ms/preopened5.357ms/cold46.660ms/production28.540ms. Load0.121/.190/.545 before,1.754/.637/.681 after; perf VM4CPUs kernel6.12.69. Targets4/4/45 still unmet. Idle native2ed eleven alternating samples15484 vsdev14868KiB, delta616KiB (target200 unmet), anonymous2740 vs2688(+52), one thread/132KiB stack both. Load.027/.370/.541→.021/.351/.532; file-backed pages explain remaining working set.
Full2ed production-code gate, serial test scheduling, exits1 only static-size22133904>16404816. Verbatim summary:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| CLI plugin compile-out | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Raw round4/verify-fast-owned-head.log. ARM/TypeScript are not reached. Dynamic-pin exec-error fix and overlapped-start candidate continue; no acceptance claim.
Resumed real-logins at
249367206fafter disk-full interruption. Read #172 and prerequisite #159 history (no parent listed), contracts, round2/round3 evidence. Six modified source files contain the unfinished dynamic-pin exec-error fix; no truncation found in diff. Available disk now 168 GiB. Reusing one real-logins-r4/target. Latest exact2ed N200 p50 later/preopened/cold/production5.024/5.357/46.660/28.540ms; idle delta616KiB. Earlier diagnostic stages cold/later/preopened: request→rendezvous58.501/2.568/2.638ms, rendezvous→Hello.841/.881/.839, Hello→entry1.487/1.472/1.483, entry→prompt2.085/2.002/2.138. These observer stages overlap. Targets remain unmet. First finish scoped gates and atomic commits for the spawn-error regression; then resume startup overlap and perf-VM measurement.8a2c7f62committed/pushed: dynamic occupied process-pin inheritance fixes fixedfd5 exec-error collision; original pin/socket/parent authentication unchanged. Earlier RED pin-error-red.log reports missing executable as successful spawn. Fresh shim105passed/14ignored, compiledout80/14, CLI67, agent91/12, alltarget touched clippy/fmt pass. Logs dynamic-pin-resume-{shim,consumers,clippy}.log. No latency benefit claimed. Full verify fast still running; perf shared lock nonblocking checks refuse acquisition, so no new performance measurements yet.Recovered modules committed/pushed separately:4421d9a9 idle sampling;d3766fe6 exact debug runtime relocation;384101da executable-page metadata;d6807d45 retirement-query proof;3c3caae0 launcher lifetime proof;39d73be9 descriptor-announcement fixture;ff1f0c17 actual-manager announcement check. All Python syntax/module docs pass; unchanged base harness5 and measurement harness15 tests pass. Historical perf results apply only to their recorded artifacts.
ee984730committed/pushed dynamic-pin parser fuzz invariants: production-feature alltarget fuzz/CLI clippy passes;100000 assertion-smoke inputs pass without coverage instrumentation. Reduced server feature graph has four existing warnings at embedded.rs321,remote_http.rs95/114,websocket.rs604; recorded, not fixed here.eed27574committed/pushed128 recovered raw JSON artifacts, all parse. Exact2ed interleave800rows/0failures; controller50/fallback2 zero cleanup failures and zero scheduled slices. Latest targets remain unmet (5.024/5.357/46.660ms, idle+616KiB). Repeated authorized NetBird checks report PERF_LOCK_BUSY; orchestrator/current benchmark owner must release the shared lock normally before new measurements can run. No other job/lock changed. Full current-source gate still running.New perf measurements remain blocked on the shared lock. Nonblocking flock repeatedly reports PERF_LOCK_BUSY. Read-only fuser identifies holders724933,740691,741703; all are in session-c1409.scope, not this lane's named driver scope. No holder, unit or lock was changed. Orchestrator/current benchmark owner must release normally before final artifact lifetime, N200 and idle-delta measurements. Full repository gate continues.
5b16a4a9/cb3da9ba/e2e7c76e committed/pushed separately: additive shim prestarted-PTY adoption, schema-driven paired CLI capabilities and actual controller request-before-shim-exec. Same authenticated original lease and PTY, occupied child slots, worker/pin/parent revalidation, one bounded ACK byte, placement before Hello, parent copies dropped after spawn. No new process/service/dependency/idle buffer. Real local worker produces startup marker before owner exec; timeout/cancel isolation, actual exec/copy-release and coalesced ACK/status/identity refusals pass. Full shim109/0/14 plus updated5handoff tests; compileoutshim80/0/14; CLI67 and agent91/0/12; touchedalltargetclippy/fmt pass. Read-only independent review finds no concrete blocker.
The CLI commit body prematurely includes new compiled-out metadata cases: that dedicated new-source invocation is running now (earlier80-pass compileout result is shim only). No passing claim until its output is inspected.
Milestone verify fast fails1 server test at auth/tests.rs1734 (session_gone: unexpected WebSocket Close), server342passed/1failed/39ignored. Isolated reduced-feature1PASS and production-feature1PASS; not an accepted #118 exception. Static22146608>16404816 remains FAIL. Source changed during later milestone rows, so this is not final head verification. Exact current-head static build and new full head gate follow.
Perf lock is now available; staging exact committed overlap artifact and adapting only Popen to that product path while retaining round3 rotating prompt boundaries. N200, actual controller50/fallback2 and debug idle delta still required; no target claim.
New-source compiled-out CLI26PASS (completes the earlier premature body claim); production-feature session_gone isolated1PASS; no baseline waiver. Independent handoff/harness reviews find no concrete blockers.
d4d0db1ewrapper and87cd9a6a functional fixture committed/pushed;a6f64e2bfixes actual VM fixture-parent absence via existing INFRATERNAL_TEST_STATE_ROOT. Harness1 and unchangedmeasurement15PASS; original observer boundaries and baseline unchanged.Exacte2e7c76e static SHA2562cd61244d23ee698a6412d1ffe085282fe9226dfa96926cf97cfef301992de44; scope/shared lock perf smoke5perpath20rows/0failures, later3.830/preopened4.010/cold55.574/production32.947ms p50. Load.004/.136/.510 before/after, VM4CPUs/kernel6.12.69. Diagnostic only. First smoke failed before timing because state-root produced109-byte socket; shortened only own state path, no product/harness boundary change, units_not_confirmed_stopped=[] both reports.
N200 rotating interleave now running, then actualcontroller50/fallback2/zeroidle and11alternatingnative-debug samples. Native packaging asserts unchanged program headers/allloadablebytes beyondELFheader before relocating only identical-runtime interpreter/runpath. Fresh fullheadgate running under CPUWeight10000/TRACER_TEST_PORT4372. Targets not yet established.
Exacte2e N200800rows/0failures: later3.944/preopened4.199/cold46.313/production29.395ms p50. Actualcontroller50/fallback2 pass withzero scheduledslices10s/no cleanupfailures. Debug idle15504vsdev14832KiB, delta672; anonymous2744vs2688(+56), file-backed+616. Load/machine/raw outputs to retain. Targets exceptlater remain unmet.
Next measured candidates: mark only three hidden shim/worker startup entry functions cold (keep steady-state pumps unchanged) to reduce idle executable-page spill; native diagnostic running. Also resolve account shell/home once while opening the already-authenticated worker login rather than User::from_uid on every terminal; that snapshot lasts only until login retirement. Worker effectiveUID, original pin/socket/parent and root authority checks remain. This follows D247 persistent login context and brief validate-per-login guidance; host account changes take effect on next login, not by replacing an active login's shell metadata. No PAM/record properties or foundational library changes. Functional snapshot/refusal tests precede cache implementation.
c8dcb5f2committed/pushed: resolve account snapshot once before login readiness (D235/D247), keep effective UID and original kernel peer/process checks per terminal. Account database changes apply at next login; immediate removal retires the existing login. Regression red before change; host-login112PASS/14ignored, host-login all-target clippy/fmtPASS. No dependency added.Exacte2e7c76e N200:800valid/0failures; p50 later3.944/preopened4.199/cold46.313/production29.395ms. Later meets4ms; preopened/cold still miss. Observer request→rendezvous43.900/1.957/2.102ms (cold/later/preopened), rendezvous→Hello .118/.118/.117, Hello→shellentry .219/.126/.198, entry→prompt1.710/1.678/1.687. Overlapping observer stages, not exclusive CPU stages. PerfVM4CPUs/kernel6.12.69; load .015/.067/.392→1.373/.429/.499. controller50/fallback2 pass zero scheduled slices over10s, no cleanup failures. Native idle delta+672KiB;
f5c3e0d0coldCLIentry delta+468KiB, still above200. Raw evidence fetched to evidence/real-logins/round4/prestarted-results.Milestone verify-fast-prestarted-head:fmt/VTfmt/compileout/clippy/test/cargo-denyPASS; staticFAIL22143088>16404816 bytes. Not final head: coldentry source changed during later rows. No size-budget waiver. Cold dispatcher parsing/future extraction now measured before acceptance; independent read-only review reports preserved trust/admission/census/retirement semantics.
5bc6efff/e78ae862/5f2bce94 committed/pushed raw e2eN200/controller/native results, enabled account regression/gate logs and exact compressed page metadata.
Account-snapshot static artifact SHA256ba0b6af75593f7d01ff9604b0c2e0f8b6c2c9691fa63ac2ea60bf4cc29539082: N200 rotating interleave800valid/0failures. p50 later3.868/preopened4.142/cold44.239/production28.149ms; later and cold meet targets, preopened misses. Cold-layout source experiments occurred during the build, so this artifact is a measured milestone, not a certified final source tree. Raw snapshot-results preserve hash metadata/stages/tails/load.
Native debug RSS experiments: account snapshot+752KiB; cold handoff+572; startuphelpers+544; splitsetup/pump+576; cold PTY constructors+588. All experimental hints and pump extraction reverted, retaining committed coldCLIentry only. No budget waived. Fullgate remains static-size blocked.
Now preparing immutable shell Command once per login (home/environment/callbacks), fresh stdio+marker per spawn, clearing all cached slave copies on success or failure. Red compile regression before implementation; real sequential shell markers/EOF pass; independent review finds no blocker and confirms retained UID/fork/environment semantics. Full enabled tests, exact native idle and weighted static build running. Targets still pending.
0aa4193ecommitted/pushed immutable shell Command setup per login; fresh per-terminal marker/stdio and parent copy release on success/failure. New two-shell marker+EOF+missingexec regression red then green; host-login112PASS/14ignored, compileout80PASS/14ignored; both all-targetclippy/fmtPASS; independent read-only review no blocker. Root-account group lookup now once per login, matching D247 context lifetime.Native exact command-cache debug idle delta+708KiB (still misses200); load .431/.299/.406→.335/.284/.398; one thread,132KiBstack, anonymous+52. Cold PTY/control/pump experiments reverted. Weighted static command-cache build running. A small cold public-CLI extraction is tested67PASS/alltargetclippyPASS and awaits RSS validation before retention. VMstage/idle job is queued on shared perf-bench lock; current holder must release it. No deployment, budget/decision change or waiver.
62a102c8committed/pushed command-cache N200 and full frozen-source milestone gate. Every reached Rust rowPASS except static size22143152>16404816; CLI experiment included in that milestone was reverted after RSS worsened+796. Gate is not finalhead.PAM environment snapshot plus one borrowed-descriptor callback: perfVM nativeidle+516KiB (still>200), load .061/.077/.171→.046/.072/.168; anonymous+48. Snapshot occurs before readiness; account/terminal overrides still win. Descriptor helper takes&dynAsFd only until duplication; callback owns fresh occupied slot. Enabled112PASS/14ignored and touchedalltargetclippyPASS. Independent review no blocker. Separating process isolation measured+564KiB and was reverted.
Static milestone hash8b824a27ebc3d68ad58ea3c08a9054e1b58f95cfa4e085ecfb301643daa58ca4: N200800valid/0failures; later/preopened/cold/production p50 3.768/3.997/44.417/27.208ms. All three latency targets met by this measured artifact, but source build overlapped layout edits: not finalhead certification. Now measuring full cold open/revoke parsing, validation and construction outside all channel poll bodies, preserving census/trust/admission/retirement; productionagent91PASS/12ignored/alltargetclippyPASS. Final exact source artifacts andRSS≤200 still pending.
1467f5b0/613cff07 committed/pushed one audited descriptor callback and immutable PAM environment snapshot (D235/D247). All memory-only source experiments, including full handler (+580KiB), process separation (+564) and transfer body (+524), reverted. Source now frozen at613cff07; independent review found no eager idle login work, only executable fault-around and small generated code duplication. No library/engine/build flags/budget changed.
Fresh exact default native debug final idle11alternating samples vsdev5db:15600/14864KiB,+736KiB (FAIL200). Private clean12848/12168 (+680), anonymous2736/2688 (+48), one thread/132KiBstack. This overrides the +516 diagnostic milestone. Final static artifact now staged for N200 and realcontroller50/fallback2 plus zeroidle. Full frozen-source verify fast running; final result will report unmet limits, no waiver/complete claim.
Exact source613cff07, static SHA25625353706c6c7f295cad69536f4032a0bba963c679de973d6e5e082c1e193dc3f: N200 rotating interleave800valid/0 failures later3.826ms/pre-opened4.039ms/cold44.941ms/production28.709ms p50. Pre-opened misses4ms; native idle11alternating vsdev5db +736KiB misses200. Controller50/fallback2 actual preferred preopening, restart/resume, independent revocation PASS;0 scheduled slices over10s and no cleanup failures. Root controller initially refused group-writable staging (0775), correctly; chmod0755 retry passed. No product security change. Raw records evidence/real-logins/round4/frozen-results/. Full gate fmt/VTfmt/compileout/clippy/test/deny PASS; static22,143,792>16,404,816 FAIL, no waiver. Testing queued-ACK fast path retaining all identity checks and bounded slow path; this is not completion.
d97c2abcqueued one-byte login ACK now reads nonblocking after the unchanged socket/live-process authentication; only WouldBlock installs the existing2sec blocking fallback, successful adoption stays nonblocking. No status byte consumed, no extra polling or idle task. Shim113unit PASS/14ignored and integration suites PASS with pinned Zig PATH; initial scoped mouse harness failed solely missing Zig PATH, corrected rerun passed. fmt/clippy PASS; read-only review no blocker (delayed-ACK sleep is not a deterministic branch proof; missing-ACK timeout separately exercises absent byte). Source frozen for exact static/native N200/RSS/controller/lifetime runs and head verify. Logs evidence/real-logins/round4/ack-fastpath-*.log. No completion claim.Second independent read-only review of current idle path found no executed inefficiency plausibly reclaiming the remaining536KiB clean RSS excess. Idle invocation bypasses expanded CLI metadata; Prepared runs only for terminals; LoginShell/PAM snapshot only for login startup. Measured excess680KiB private-clean/48KiB anonymous, not eager login buffers or idle tasks. Executable page presence is not execution evidence. Further cold/extraction changes would be unsupported layout experiments; all earlier rejected candidates reverted.
d97c2abcstatic SHA2563df600eb7160a21e3f7cb5362f0261d5588f857d9dd99811c5c3799ee9c32751 staged0755; exact N200/nativeRSS/controller queued behind shared perf lock. No budget/build flag change or completion claim.5b7de716retains exactd97c2abcscoped113unit+integration PASS, clippy PASS and complete head gate. Source unchanged sinced97c2abc; performance/lifetime records still queued behind shared perf lock. Static binary22,144,176 bytes exceeds16,404,816, no waiver; downstream ARM/TypeScript/browser stages not reached. Complete log: evidence/real-logins/round4/verify-fast-ack-head.log. Verbatim final gate table:+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| CLI plugin compile-out | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Operational blocker at2026-10-13 00:26CEST: authorized perf VM lock /run/lock/perf-bench.lock remains held byPID996128; our exact
d97c2abcnative idle/N200/controller50/fallback2/lifecycle/retirement commands are waiting, not measured. Do not infer acceptance from the613 checkpoint (preopened4.039ms and idle+736KiB both miss). Source/artifacts fixed, defaultflags unchanged; static SHA2563df600eb7160a21e3f7cb5362f0261d5588f857d9dd99811c5c3799ee9c32751 at/root/infraternal-bench/real-logins-r4/infraternal-d97c2abc and/home/bench/.cache/codex-scratch/d247-r4/infraternal-d97c2abc; native debug-ack-relocated uses same native-libs/dev5db. Current head5b7de716 has complete gate evidence; all functional Rust rows PASS/static sizeFAIL. Needed: normal release of shared lock by its holder; no lock/process interference or alternate host is authorized. Waiters remain active.Incomplete handoff, head
e92208b471pushed. Production source remainsd97c2abc; later commits are evidence only. Exactd97c2abcN200/nativeRSS/controller50/fallback2/lifetime/retirement waiters remain active behind shared perf lock (holderPID996128). No latest-build performance claim. Artifact identities/output paths and resumption instructions: evidence/real-logins/round4/README.md. Collect queued results before launching replacement runs.Latest certified exact source613cff07, N200 per path rotating with production800valid/0failures, perf VM4CPUs/kernel6.12.69:
| boundary | round3 | exact613 | target |
| later p50 ms |8.765|3.826|<=4|
| pre-opened p50 ms |9.449|4.039|<=4 FAIL|
| cold p50 ms |77.728|44.941|<=45|
| production p50 ms |35.953|28.709|comparison|
| native debug idle delta KiB |944|736|<=200 FAIL|
Actual controller50/fallback2 preferred preopening/reuse, restart/adoption/resume, independent revocation PASS, zero idle scheduled slices10s, no cleanup failures. Initial root fixture refused0775 staging correctly;0755 retry passed. Current queued-ACK source113unit+integration and clippy PASS; identity fences unchanged. No decision/library/engine/budget/buildflags changed. Unsupported RSS layout experiments reverted; no substantive eager idle login path found. Remaining engineering problem is clean resident executable excess; current latency is unmeasured.
Removed obsolete own build targets and copies; one34GiB CARGO_TARGET_DIR retained for continuation, plus final artifacts/driver logs while VM waiters run. Gate output is retained complete in evidence/real-logins/round4/verify-fast-ack-head.log. Static size22,144,176>16,404,816; no waiver. ARM/TypeScript/browser downstream not reached. Verbatim final table:
+---------------------------+--------------+
| Rust gate | Result |
+---------------------------+--------------+
| fmt | PASS |
| VT native fmt | PASS |
| CLI plugin compile-out | PASS |
| clippy | PASS |
| test | PASS |
| cargo-deny | PASS |
| static builds | FAIL (1) |
+---------------------------+--------------+
Round 5 resumed real-logins at
e92208b471. Worktree has only generated scripts/pycache and the existing target symlink; no partial source writes. Read every #172/#159 comment (no parent named), contracts and retained round2/3/4 evidence. Latest certified p50 ms later/pre-opened/cold/production = 3.826/4.039/44.941/28.709; stages cold/later/pre-opened request→rendezvous 43.144/1.958/2.049, rendezvous→Hello .122/.120/.122, Hello→entry .127/.120/.127, entry→prompt 1.633/1.610/1.641 (overlapping observer boundaries). Native idle delta +736 KiB: private-clean +680, anonymous +48, one thread/132 KiB stack. Exact ACK outputs are absent on VM; earlier waiters have not produced results. Shared lock still occupied. Queueing flock -w 3600 and inspecting per-mapping RSS; security/PAM/D247 preserved. No deployment or budget changes.Completed
eb9a41dbpaired-artifact benchmark extension anda00856f1regression: current/previous root+account artifacts rotate eight conditions with unchanged prompt boundaries and two production comparison conditions. New test RED before helper; all16 harness tests PASS after. Current exact hashes remain d97 ACK 3df600eb7160a21e3f7cb5362f0261d5588f857d9dd99811c5c3799ee9c32751 and613 snapshot25353706c6c7f295cad69536f4032a0bba963c679de973d6e5e082c1e193dc3f. Both account copies exist0755. ACK N200, paired N200 and eleven-sample per-mapping smaps queued with flock-w3600. Latest frozen launch-stage603samples median original announcement38.984ms, launcher spawn.347, endpoint authentication.239, scope authentication/weight.194, launcher reaping.344; total login-start40.185. These are overlapping observer diagnostics from613, not new performance evidence. Product code unchanged. Fresh fast gate underway; reached main/CLI/real restart checks PASS.Committed/pushed
f24908bbper-mapping idle accounting andcd20b7cbparser tests. Eleven alternating snapshots at the unchanged .25s greeting boundary classify binary text/data, heap, stack, anonymous pages and libraries. Read only public smaps metadata, never process contents. Two classification/total/truncation tests PASS, diff check PASS. Output queued at /root/infraternal-bench/real-logins-r4/mappings-ack.json under flock-w3600/CPUWeight10000. Perf tools (perf/gdb/strace/bpftrace) are absent on authorized VM; no host package or kernel setting changed. Product source unchanged. Current functional gate continues in server suites. No current measurement or acceptance claim.Exact ACK d97 N200 collected:800rows/0failures/no unconfirmed worker stop. p50 later/pre-opened/cold/production=3.829/3.967/43.069/27.127ms. VM4CPUs,6.12.69+deb13-amd64, load .772/.600/.468→1.637/.872/.569. Current first mapping run N11 alternatingdebug median14908vsdev14836KiB,+72KiB. Mapping RSS deltas binary-text-12,binary-data+84,anonymous+4,heap0,stack0,library-text-4,library-data0; medians do not sum. No eager pre-opened login exists at this idle boundary. This differs materially from frozen613 +736; queued original idle.py repeat and previous-source mapping attribution before treating it as confirmed. PairedACK/613N200 still running. Fresh verify-fast passes all functional Rust rows/static size FAIL22144176>16404816, raw round5/verify-fast-head.log. No budget waiver.
Paired ACK/613 N2008-condition interleave1600rows/0failures collected. Current/previous p50ms: later3.810/3.837,pre-opened3.991/4.015,cold47.235/43.049; production28.454/30.312. Current cold FAIL45 despite first unchanged4-condition run43.069 PASS: do not select only favorable run. Delay sits before worker readiness: cold login-start42.948vs39.151ms; terminal request stage44.745vs41.493. Current preopened login preparation median38.862vs38.680, so variation is condition dependent, not uniform ACK startup cost. Raw paths round5/paired-ack200 and ack200. Currentcontroller50 restart/adoption/preopen/revoke passes,0scheduledslices/10.000478s/no cleanupfailures. Testing only manager Type=simple in scratch while retaining PAMName/original descriptor/endpoint checks; no production change before measurement. Original idle.py repeat and frozen613 mapping queued.
Confirmed exact ACK native memory at11alternating samples, original idle.py:14824vsdev14852KiB, delta-28; private-clean delta-80,anonymous+52,one thread/132KiBstack. Range current14692–15156,dev14760–14984. Independent per-mapping sampling gives+72KiB. Frozen613 repeat mappings gives+520KiB, concentrated+520 in executable text; heap0/stack-4; ACK text-12vsdev,data+84,anonymous+4,heap0/stack0. This is resident-code/layout reduction, not a claim of freeing allocated prelogin state. Source/artifacts unchanged. Cold startup still varies: first43.069PASS, paired47.235FAIL; manager exec/simple paired45.398/44.172, but identical production labels28.446/31.820 expose predecessor sensitivity. New a6e3dfae/e38a5331 preserve original four-condition quartets and rotate all positions per artifact;17tests PASS after RED. Quartet A/B reruns underway; no product Type change. Actual controller50 and fallback2 bothPASS,0scheduledslices10s/no cleanupfailures; lifetime9checks/0failures. Initial lifecycle command was rejected before running for wrong scope prefix; corrected to required infraternal-rl3-lifecycle prefix.
f6ed921f/496f22fa committed/pushed Type=simple admission and successful-launch-without-worker-record refusal test. Agent92PASS/12ignored, alltargetclippy/fmtPASS. Same-artifact original-quartetN200 exec/simple cold46.634/43.751ms; later3.814/3.821,pre-opened4.014/4.002 (stillmisses4), production27.776/28.731. Current native explicit-simple RSS15380vsdev14856,+524KiB (FAIL200), anonymous+52/one thread. Do not trade memory for cold gain. VM installed systemd-run manpage explicitly says service type defaults to simple sincev211; now testing removal of the redundant type argument, keeping original descriptor/readiness and all PAM/identity checks. If new RSS fails, revert admission change. Source certificate pending; no acceptance claim.
c81c3fe4records explicit per-artifact type for accurate final measurements. ACK quartetN200 current/613 cold43.996/44.905,later3.804/3.764,pre-opened4.021/3.997; all1600rowsvalid.Redundant-type removal candidate also FAILS idle:15464vsdev14856KiB,+608, anonymous+52/one thread. Explicit simple+524; originalACK-28. Reverted production admission code to exactd97 preamble, retaining the successful-launch/no-record refusal test; no memory trade is accepted. Next concrete repeated-terminal cost found at sessions.rs628: Prepared::new performs User::from_uid before connecting, although caller already resolved the account and worker kernel credentials supply the login GID. Measuring an additive authenticated-peer PTY constructor using the pinned worker uid/gid context, retaining all PID/UID/live-process/parent checks and fresh caller account resolution. GID changes already apply at next login under the established D247 snapshot. No new cache/thread/buffer or foundation choice. Performance/memory remain pending; goal not achieved.
New peer ownership path: caller retains fresh account resolution; Prepared::from_peer reads socket UID/GID, enforces UID/rootless bounds and shares the existing PTY implementation. request still performs original PID/live-pin/fallback-parent authentication immediately before transfer; adoption does so again after exec. No additional auth/proc read or cache/thread/buffer. Initial new-API regression compile failed before implementation. Fresh shim114PASS/14ignored; agent92PASS/12ignored; compiled-out shim80PASS/14ignored; final touched alltarget clippy/fmtPASS. New ownership-boundary fixture simulates620PTY creation: old ordering fails400vs384(permission decimal); mode600beforefchown passes. Native final peer artifact packaged with unchanged load-byte assertion and queued N11 RSS versus dev. Admission variants reverted for+524/+608RSS; no budget waiver or acceptance claim. Python pre-exec wrapper mirrors kernelGID and removes its second passwd lookup, keeping prompt boundaries and every original process/socket fence.
Admission tests retained; all failed runtime candidates reverted. Current crates diff versus e922 is only the15-line successful-launch/no-record unit test in logins.rs. Peer ownership +612KiB and isolated permission-order fix +900KiB both FAIL200; earlier explicit/simple defaults +524/+608 also rejected. Raw idle JSON and patches retain reproduction. Portable permission-boundary fixture (simulated620creation) demonstrates old ordering400vs384; existing host ordinaryPTY600does not reproduce it, so no claim of a scheduled exploit. New caller/NSS and permission runtime changes are not shipped. Root currentSource source of truth restoredACK runtime; final original N200 repeat and fresh nativeRSS queued. Required head verify-fast running. The earlier ACK measured native-28 / mapped+72 versusdev, but rebuilding even small source variants changes clean code residency materially; this remains the practical working-set limit, not eager login allocations. No global linker/profile/budget change, foundation selection or deployment.
Key correction: load-byte-comparison.json proves ACK and restored native images have identical program headers and ALL four PT_LOAD byte ranges after ELFheader (including text SHA1912fafa307c675fde1730841f327f5a468cfaf48dd49af1f54c5bdde8f0be45). Rebuilt source differs only by a cfg(test) case. Earlier -28/+72 ACK RSS versus restored+560 therefore cannot be attributed to a runtime code/heap saving. Clean residency is file/cache/mapping-state dependent; explicit warm per-file comparisons (restored vs byte-identical ACK; restored vs dev) are queued under shared lock. No global cache drop/hostsetting/buildflag change. Final original quartetN200800rows/0failures:later3.807/pre-opened3.993/cold45.333/production27.542ms; cold FAIL45 and aim40. Exact restored native idle15424vsdev14864,+560 FAIL200, anonymous+56,one thread. Do not infer acceptance from older favorable samples. New current-source fullgate continues. Next outputs cache-identical-warm.json and cache-dev-warm.json; source frozen.
Round 5 handoff: NOT accepted. Head
49fc20399c, pushed to real-logins. Runtime restored tod97c2abc; only regression/EOF fixtures and measurement/evidence changes retained. No deployment or dependency/profile/budget change.Perf VM, original N200 quartet, 800 valid rows / 0 failures, interleaved production:
Identical PT_LOAD bytes and matched per-file cache disprove initial apparent RSS saving. Private-clean +504 KiB, anonymous +52 KiB; one thread, 132 KiB stack. No memory optimization accepted. Controller50/fallback2/lifetime9 pass; actual restart, preferred preopening, revocation fencing and other-person survival retained. Zero scheduled slices in both idle windows. Exact rebuilt static SHA256 matches measured ACK: 3df600eb7160a21e3f7cb5362f0261d5588f857d9dd99811c5c3799ee9c32751.
Final scripts/verify fast functional rows pass; static size fails unchanged, 22144176 bytes > 16404816. No waiver. Full raw output and reviewer checklist: evidence/real-logins/round5/. Cleanup removed 257 owned registry/cache files, both VM job staging directories and 38 GiB local scratch; existing comparison/account/startup files preserved. Issue stays open. Remaining work: cold margin, cache-controlled code residency, static binary size.
Verbatim final gate summary:
Round 6 started on real-logins at
49fc20399c; worktree clean. Read all 101 comments on #172 and all 22 prerequisite #159 comments; neither names a parent. D235/D240/D243/D247 apply. Round-five matched warm-cache idle delta +556 KiB: private-clean +504, anonymous +52, one thread/132 KiB stack. Latest original N200 later/pre-opened/cold/production p50 3.807/3.993/45.333/27.542 ms; cold/RSS targets fail. Prior frozen stages request→rendezvous cold/later/pre-opened 43.144/1.958/2.049 ms, rendezvous→Hello .122/.120/.122, Hello→entry .127/.120/.127, entry→prompt 1.633/1.610/1.641 (overlapping observer boundaries). Trace startup page faults and resident-symbol overlap, defer actual eager work if found, measure matched-cache RSS and original N200 on authorized perf VM only. Perf tools absent; lock currently occupied. No dependency, deployment, budget or foundation change. One private scratch target will be reused.Completed/pushed
57b1161efault-address profiler andc21e6247numeric decoder tests: 2 PASS; workspace fmt PASS. VM root perf_event_open accepts the minor-fault event (fd >= 0); perf/strace remain absent. Fault ring reads only numeric IP/TID/address, public maps/pagemap/smaps and offline executable symbols; no process memory bytes. Eager startup call found at daemon.rs:580: Manager::detect invokes systemctl show-environment before serving the channel. Login cache OnceLock, login ensure and worker/PAM shell state already run only on requests. New real-binary regression fences startup with Pong then checks a fixed probe marker, before deferral. Unchanged native build and VM profiling queued; no new memory/latency result yet.Fault profile on authorized perf VM (4 CPUs, kernel 6.12.69, shared lock, CPUWeight=10000, matched warm file): 925 minor-fault samples after final executable replacement, 203 IPs in native executable text, 181 sampled functions, 2437 resident executable pages. No fault IP falls in login ensure/account/auth/worker functions; their resident symbols overlap pages brought in by other startup instructions (1107 logins-related and 159 login_auth-related symbols overlap resident pages; symbol overlap is not execution). Startup regression independently proves Manager::detect executes before first request. First diagnostic accidentally selected the adjacent major-fault event (0); retained as residency-only and corrected; empty profiles now refuse attribution. Full numeric/public-metadata report: round6/faults-before-minor.json.gz. Instrumented RSS is not the matched idle acceptance measurement. Native dev-baseline build still running; lazy backend candidate awaits correctness and matched-cache validation.
Completed/pushed
8cd48162: backend detection moves from startup into admitted open/prepare and independently owned revocation tasks. Shared async cell serializes first use, cancellation remains retryable, no background task/thread/probe. RED real-binary idle startup regression before change; GREEN no startup probe and two actual terminals share one probe. Agent 92 PASS/12 ignored; all-target agent clippy/fmt PASS; focused CLI integration 1 PASS. Warm-cache VM N11 alternating idle: before +636 KiB (private-clean +584, anonymous +52), lazy +368 KiB (private-clean +312, anonymous +52), one thread/132 KiB stack both. Target +200 still unmet. Fault profile executable samples 203→174 and resident text pages 2437→2341; instrumented snapshots are attribution only. Source security checks unchanged. Testing cold hints on backend detection, new-login launch/fallback and revocation constructors; no steady terminal pump changes. Static size and final latency gates still pending.53c9c1d1committed/pushed first-use synchronization allocation: agent 92 PASS/12 ignored, all-target clippy/fmt and real two-terminal oracle PASS. Default native N11 warmed idle remains +420 KiB; target not met. Rejected cold annotations: executable text is byte-identical at opt-level=0, so +116/+216 reports cannot establish code-layout savings. Hint patch retained, runtime hints reverted. A sampled-symbol LLD ordering experiment on the same source measured current/dev 14156/14876 KiB, delta -720; private-clean -772, anonymous +56, one thread/132 KiB stack. Public page-fault profile and exact loaded-symbol selection replace unsupported residency-as-execution inference. Porting the list from compiler hashes to demangled names resolved from actual link inputs, with the same bundled LLD; distribution/static links unchanged. Native/static builds and final N200/controller/zero-idle/source gate still pending; experimental artifact is not final acceptance.D243 finding: the first-use manager source at53c9c1d1 builds static x86_64 musl to22145104bytes, +928 vs exact ACK22144176. Required fast milestone functional rows PASS/static FAIL22145104>16404816; unchanged budget not waived. Factoring the large manager-initialization poll body into one cold shared future instead of duplicating it inside both open/revocation tasks. Only concurrent first uses allocate; cached manager reads remain atomic and allocation-free; no idle state or thread added. New static measurement pending. Portable native startup ordering resolves demangled names against actual input objects with bundled LLD; expected GC-discarded aliases handled by its dedicated ordering-warning switch. Three resolver tests PASS; functional and memory artifact validation still pending.
Portable ordering correction: c++filt default verbose mode retains crate hashes, so the initial list matched only6live symbols, not the Rust startup set; its +204/+248 idle reports do not validate portable ordering. Five resolver tests now include the real demangler, hash normalization and crate-local generic context; actual match157/158. Corrected native matched-warm N11:14024vs14860KiB, delta-836; private-clean-888, anonymous+52, one thread/132KiBstack. Initial unrelated-generic hypothesis was not causal evidence; retain the failed reports. Static size candidates failed D243: shared initialization22146416(+2240), mutex22145552(+1376), unreachable branches/argument batching22145296(+1120); all reverted. Current source remains original first-use cache plus portable native layout, testing only cold hints on account resolution, retirement, immutable staging and fallback authentication for static no-growth. Security/PAM/units/fallback unchanged. Final static/N200/scale/zero-idle/head gate pending.
Additional cold-path redundancy at logins.rs: ensure receives the original immutable worker announcement after login.rs:153 account/shell setup, bound private endpoint, subreaper/signals and grace are initialized. It then independently checks endpoint UID/PID, live original process pin and cgroup, caches identity, but repeats a readiness socket exchange. Return after that complete original proof; launcher-race/adoption without an announcement still takes the bounded readiness loop. Actual open/prepare continues its unchanged cgroup/peer/live-pin validation before reply/PTY transfer. No PAM, record, fallback or privilege check removed. Targeted agent93 tests pass for typed reply compatibility; current original-readiness optimization and static no-growth validation are running. Failed cache/cold/batching experiments remain reverted. Current DTO static milestone22144944 still +768 versus22144176; not accepted under D243.
Round 6 resumed real-logins at
3c1669c9. Read all109 comments on #172 and22 on prerequisite #159; neither names a parent. Uncommitted native linker activation, typed reply serialization and original-announcement readiness candidate preserved for verification. Own target symlink is dangling; rebuilding one scratch target. Last recorded warmed N11 ordered native delta -752KiB (private-clean -804, anonymous +52); source certification/N200/static no-growth pending. Baseline round5 later/pre-opened/cold/production p50 3.807/3.993/45.333/27.542ms; idle +556KiB. No deployment/budget/foundation changes.Completed
e9ad0cb6: explicit --ready-announcement profiler mode mirrors fresh-worker readiness proof while adoption/default retain response exchange. Real socket UID/no-response regression RED before helper, GREEN1; original interleave/framing17PASS. No product framing, trust checks or timing boundaries changed. Local target was absent; static/native rebuild queued in one target.Shadow review of
real-logins@3c1669c9(base: merge-base with devc0d01d22)Red tests are on branch
shadow-real-logins@1b8558bd(3 commits on top of3c1669c9). Only targeted tests were run, as a non-root account. No sudo, no timing.P1: rootless hosts can no longer open terminals
daemon.rssends every person open throughlogins::ensure. When the agent is not root,Manager::UserandManager::Detachedboth takefallback(), which runssu --login … -- <own account>with stdin set to/dev/null. A standard su PAM stack lets that through without a password only for root. On this host/etc/pam.d/suispam_rootokthencommon-auth(pam_unix). So every rootless open is refused, including the server's own host when the server runs without root. Readiness probes still pass, because they use the old path, so a host looks healthy while its terminals fail. D18 andcontracts/shim.mdstill promise that a rootless agent opens its own account.logins::tests::rootless_self_account_login_does_not_depend_on_su_authentication. Asuthat refuses is put first on PATH, so no real auth attempt is made. Expected Ok; actualhost login path refused the account.cargo test -p infraternal-agent --lib -- logins::tests::rootless_self_account_login_does_not_depend_on_su_authenticationP1 (round-6 acceptance): the startup-ordering RSS saving does not reach the shipped binary
c4d4793dreports -836/-752 KiB idle RSS from.cargo/native-linker.py. That wrapper passes everyreleasedestination and every static link through unchanged (lines 47-51). No.cargo/config.tomltarget selects it either: the only linker set isrust-lld.sh, for musl. The static musl release binary, which production andscripts/bench/loginuse (D213), keeps the old layout. The ≤200 KiB idle target therefore has to be measured on that artifact. A native dev build does not count. The commit trailers say the idle delta is still +420 KiB without this change.scripts/test-native-linker.py ShippedBinary.test_cargo_configuration_selects_the_ordering_linkerandShippedBinary.test_static_release_link_receives_the_startup_order. As a control, the same mock with a debug destination does get--symbol-ordering-file.P2: the login image cache grows without a bound
login_binary::stagedkeys each copy on inode/size/mtime/ctime under/var/cache/infraternal-login-bin, and nothing ever removes old copies. Production updates itself (D251), so every update leaves one more full binary on disk. A fix must keep images that adoptedsufallback workers still run from:login_auth::fallbackchecks that path.login_binary::tests::upgraded_binary_does_not_accumulate_stale_login_images. Expected 1 image after an update; actual 2.P2 (no test): the revocation tombstone has no way back
revoke_atwrites<runtime>/infraternal-login-locks/<person>.revoked, whichpermitted()refuses forever (until reboot for/run). Nothing clears it. If someone removes a host and re-adds the same machine without a reboot, the owner stays locked out of every login there. The error maps toOpenRefusal::Invalidand says nothing else. The tombstone is keyed per person, not per host enrollment. I did not write a test because there is no restore API to call.P3
valid_usernameallows a leading-(for example-ops), butlogins::accountandaccounts::valid_accountreject it. With the default preferred account (the username), every terminal for that person is refused with Invalid instead of the D231 "No user … here, opened as root" fallback.remote_guard::revoke_logingives the agent 100 ms to acknowledge, then the host channel is cut. If theterminal.login.revokeframe is not yet written by then, the logins on that host stay open until their shells exit. The log line says "unconfirmed". Nothing retries.Checked, no defect found
/procdirectory, and System units also againstMainPID. A replaced same-account socket is refused. Cgroup migration out of a system unit is not possible for the account.systemd-rundoes not forward the agent environment, andsu --loginclears it. The worker snapshot is the PAM environment. Inherited descriptors are CLOEXEC, the announce socket is replaced by/dev/null, and the child signal mask and dispositions are reset before exec.systemd-runis kill_on_drop, and an orphaned unit retires after the 30 s grace. A pendingsugets SIGTERM, so it closes its PAM session. Revocation takes the person lock, then the account lock, in the same order asensure, so they cannot deadlock. A shim launched after revocation fails on the missing endpoint or is caught bycgroup.kill.Not verified
systemd-run PAMName=loginpath as root (utmp/who, logind session leader,TTYPathwith a non-existent device), thesufallback as root, and behaviour on hosts without/etc/pam.d/login.--pipetogether with-p StandardInput=nullbehaves as intended across systemd versions.Completed
d634ffc2typed reply serialization and0f061747 original-ready acceptance: current default-feature agent69unitPASS/7ignored plus2transportPASS, alltargetclippy/fmtPASS. Exact missing/null/prepared/fallback reply shapes preserved. Original private launch record, socketPID/UID, live process pin and cgroup checks precede fresh success; adoption still takes bounded readiness exchange; prepare/open retain later identity checks. N200/current nativeRSS/static size pending. No protocol/PAM/units/fallback changes.Completed/pushed865d8166: enable sampled hash-free startup ordering for native GNU debug links using the same bundledLLD. Release/static recipe unchanged. Five resolver testsPASS; linked default-agent69unit+2transportPASS, touchedclippy/fmtPASS. Final current-artifact idleRSS/first-use oracle/N200 pending. Current static/native rebuilding from scratch because prior target was missing; final verify-fast started at865d8166.
Current865d8166 native rebuilt/certified: warm-cache N11 alternating VM median14000vsdev14872KiB, delta-872PASS200; private-clean11244vs12172 (-928), anonymous2744vs2688 (+56), one thread/132KiBstack. VM4CPUs/Linux6.12.69, load .65/.48/.38→.666/.521/.406 (raw idle-current.json authoritative). Original source hash9c283d5a6243ecc650072a1adf0a25dc1f66f07a2e1b22ee9da46eb943fbdfa0; only interpreter/rpath relocated for same fixed VM native libs, hash3a7bf48a2b94bf4bc09b66682040d061f824791ef3f2a6fb63a799035853e39c. Real-binary first-use oraclePASS; startup has no probe and two terminals share one. No claim that debug file-size change is executable growth; loaded mappings are measured. Static size/N200/scale/headgate pending.
Current865d8166 native rebuilt/certified: warm-cache N11 alternating VM median14000vsdev14872KiB, delta-872PASS200; private-clean11244vs12172 (-928), anonymous2744vs2688 (+56), one thread/132KiBstack. VM4CPUs/Linux6.12.69, load .65/.48/.38→.666/.521/.406 (raw idle-current.json authoritative). Original source hash9c283d5a6243ecc650072a1adf0a25dc1f66f07a2e1b22ee9da46eb943fbdfa0; only interpreter/rpath relocated for same fixed VM native libs, hash3a7bf48a2b94bf4bc09b66682040d061f824791ef3f2a6fb63a799035853e39c. Real-binary first-use oraclePASS; startup has no probe and two terminals share one. No claim that debug file-size change is executable growth; loaded mappings are measured. Static size/N200/scale/headgate pending.
Current865d8166 native rebuilt/certified: warm-cache N11 alternating VM median14000vsdev14872KiB, delta-872PASS200; private-clean11244vs12172 (-928), anonymous2744vs2688 (+56), one thread/132KiBstack. VM4CPUs/Linux6.12.69, load .724/.531/.408→.666/.521/.406 (raw idle-current.json authoritative). Original source hash9c283d5a6243ecc650072a1adf0a25dc1f66f07a2e1b22ee9da46eb943fbdfa0; only interpreter/rpath relocated for same fixed VM native libs, hash3a7bf48a2b94bf4bc09b66682040d061f824791ef3f2a6fb63a799035853e39c. Real-binary first-use oraclePASS; startup has no probe and two terminals share one. No claim that debug file-size change is executable growth; loaded mappings are measured. Static size/N200/scale/headgate pending.
Correction: exact idle load before .724/.531/.408, after .666/.521/.406; prior comment approximated before incorrectly. Zero idle activations confirmed: one thread, zero scheduled slices over10.000410s; idle-zero-current.json. Current fault samples 873, executable IPs 155, resident text pages 2006; instrumented attribution only, not RSS acceptance.
Current865d8166 static source builds22145072bytes, +896 vsACK22144176. It still fails unchanged16404816 global gate and own D243 no-growth condition, so not accepted. Fresh nativeRSS -872KiB/zeroidle succeeds; original-ready optimization alone saves32staticbytes versus first-use source22145104. Testing only cold placement of account resolution (validation/NSS error branches are login admission, not data path); prior debug cold hints were ineffective and are not memory evidence. Existing static source retained until this candidate is measured; no budget waiver.
Rejected account #[cold] candidate:22145136bytes (+960vsACK), worse than current22145072(+896). Reverted that annotation. Testing only argv iteration reuse in logins.rs: nine host-utility args calls use slices rather than distinct fixed-array IntoIterator instantiations; identical argument bytes/order, no security/host login changes. This differs from the earlier argument-batching experiment, which changed grouping. Native idle -872KiB/zeroidle is current865d8166 only; future changed artifact must be remeasured.
Slice-only argv candidate22144816bytes, saves256 vs865d8166 but remains+640vsACK. Full resume milestone: all functional Rust rowsPASS/staticFAIL22144816>16404816; raw verify-fast-resume-milestone.log. No no-growth waiver. Testing exhaustive manager dispatch for fresh login setup: User/Detached return through unchanged authenticated host-su fallback; only System reaches unit creation, so remove dead user-manager/detached conditions and require all system PAM/unit properties directly. No actual backend branch/security check is removed. This isolates the invariant instead of earlier combined batching/remove-branches experiment. Final artifact still pending.
Exhaustive fresh-manager dispatch22144688bytes, saves128 vs slice-only but still+512vsACK. Keeping it as an uncommitted candidate and extending shared argv slice iteration to the two existing terminal/scope constructor lists in sessions.rs; no argument value/order or handoff change. This is measured constructor reuse, not a new primitive. Current candidate touched remote-feature agent clippy/tests/fmt and native artifact rebuild queued. Last accepted nativeRSS snapshot remains865d8166; new artifact must be remeasured.
Extending shared argv slices to sessions.rs gives no static saving:22144688 unchanged (+512vsACK); reverted sessions.rs to HEAD. Agent remote93unitPASS/12ignored+2transportPASS, alltargetclippy/fmtPASS. Testing a direct existing SerializeMap for the fixed OpenReply DTO: unknown map length avoids derived optional-field length predicate computation followed by a second set of predicates for content. Library retains escaping/null handling; existing exact JSON-shape regression is unchanged. This is a code-size candidate, not accepted performance evidence. Required N200/scale/static no-growth/final sourcegate still pending.
Map serializer saves192bytes:22144496, still+320vsACK. Current remote93unit/2transport/alltargetclippy/fmtPASS; JSON missing/null/prepared/fallback shapes remain exact. Source kept as candidate. Reconsidering round5 default-service admission only through a same-binary N200 original-quartet comparison (exec vs manager default); its former rejection was clean native code residency, now fixed by ordering. Real ready-announcement, pinned original process, PAM/unit and cgroup checks retained; no production admission change yet. Contracts do not require Type=exec. No new engine/host/deployment or budget waiver.
Same e230d5f0 static artifact, N200 per label/original artifact quartets:1600rows/0failures/units all confirmed stopped. Exec/default p50ms later3.761/3.739,pre-opened3.992/3.996,cold44.480/44.303; production26.650/27.069. VM4CPUs/Linux6.12.69, load .676/.649/.767→2.074/1.110/.921. Default provides only.177ms cold difference and no40ms margin; retain production exec admission. Initial wrong driver scope refused before measuring; corrected infraternal-rl3-driver-r6-service passes. Map native warmedN11:13980vs14884KiB,-904; private-clean-968/anonymous+60, one thread132KiBstack. Outcome enum gives0size saving22144496(+320); reverted it. Testing explicit first-use cache match in place of generic get_or_insert_with, sameArc/cancellation/init semantics. Final code/images/gates not certified yet.
Explicit cache match gives0static saving22144496(+320); reverted. Outcome enum also0saving; reverted. Current new candidate removes only nested requested-account storage: a resolved account discriminates person replies (explicit null requested account permitted); no account discriminates legacy replies (field absent). Every successful person constructor already sets account; expected JSON-shape regression values remain unchanged. Existing map serializer owns escaping. No wire/schema/permission change; static and targeted gates pending.
Read-only independent security review: no defects found in lazy backend detection, original-announcement authentication, direct terminal reply serialization or harness staging. Admission precedes probe; original worker UID/PID, live pin and cgroup remain checked; adoption and final terminal cgroup/readiness checks remain. Size review identified duplicate fresh-fallback cgroup validation: fallback() checks before PendingLogin release and open_requested checks before prepare/PTY. Removed only the intervening ensure check; reused existing runtime_root(). Static size and real-engine gates are pending. Mandatory person metadata representation saved zero bytes (22,144,496), so reverted that experiment.
Completed
c550c2c1(pushed): single-pass optional terminal reply serialization, preserving exact bytes and explicit null/field absence. Previous static candidate saved 192 bytes (22,144,496); current combined login cleanup linking pending. fmt, remote clippy, 93 unit + 2 transport tests and real first-use Pong oracle pass (evidence/real-logins/round6/auth-once-*.log). Independent security review found no defects, including the fallback-check removal; User and Detached share non-system cgroup authentication.Completed
b03e82ab(pushed): share argv iterator instantiations, dispatch fresh fallback exhaustively, reuse runtime_root and remove duplicate fresh-fallback authentication. Launcher and terminal admission checks retained. Static x86_64 musl is 22,143,728 bytes: 448 smaller than ACK 22,144,176 (D243 no growth), still exceeds inherited global 16,404,816 budget. fmt, remote clippy, 93 unit + 2 transport tests, greeting/Pong oracle pass. First full gate additionally hit daemon gone-close expected 4404 but received shim-disconnected on stream 4 (daemon_gone_tests.rs159); isolated and full repeat underway, not waived. Frozen artifacts shipped for final N200/controller50/fallback/lifetime and N11 matched warm idle measurements.Frozen
b03e82abstatic SHA e3f62dc84a02e86dcc78fe25bf84436ee19c362c34ce4be8d023b29a8c551d8f: N200 original interleaved quartet, 800 valid/0 failures, later 3.740 ms, pre-opened 3.936, cold 43.970, production 26.663; all units stopped. Cold meets45, not40 aim. Controller50, fallback2, lifetime9 pass with zero idle slices/cleanup failures. Default native warm-cache N11 RSS13,944 vs dev14,840 KiB (-896), privateclean -960, anonymous+56, one thread132KiB stack, zero idle activations. Earlier head copy+1156 was workspace test-util feature binary: fingerprints prove ab4cb6 source copy transitive Tokio test-util versus default8dd481. Wrong-feature data retained in idle-head.json; accepted default artifact patched84d5daf5 in idle-default.json. Full gate retry pending; first isolated gone-close test passes.Completed
b1f71a92(pushed): before-first-login scheduler canary reuses the real greeting fixture. Actual default artifact zero activations over10s, Python harness tests and linker tests pass. Wrong-feature native copy definitively traced to transitive Tokio test-util via Cargo fingerprints; unchanged dev baseline and accepted default binary both lack its clock mutex symbols (native-feature-check.txt). No production/core dependency changed.Completed
b7d10f64(pushed): round6 README plus frozen N200/controller50/fallback/lifetime, warm-cache mappings, public page-fault attribution, native feature fingerprints and verbatim gate outputs. Perf staging/account artifacts and257 owned registry files removed, shared baseline/account/rc preserved. Required latency/RSS/zero-activation limits met; cold40 aim remains unmet; global static16,404,816 budget still fails. Full gate repeat: fmt/VTfmt/CLIcompile-out/clippy/test/cargo-deny PASS; static FAIL(1). A final invocation on the pushed evidence head is running; no runtime changes sinceb03e82ab.Round six measurements finished; head
b7d10f6477pushed. No deployment. Full repository static size budget remains a blocker; no budget changed.Same-harness N200 p50, interleaved with production:
800 valid/0 failures; all units stopped. Final request/process/setup/exec/prompt stage p50: cold41.937/0.114/0.152/1.656 ms; later1.903/0.110/0.119/1.591; pre-opened1.980/0.119/0.140/1.655. Stages overlap; do not sum medians. First-use controller/backend detection remains outside canonical harness boundary.
Matched warm-cache idle delta vs fixed dev: RSS+556 -> -896 KiB; privateclean+504 -> -960; anonymous+52 ->+56. N11 alternating; default native RSS13,944/dev14,840 KiB, one thread132KiB stack; zero scheduler slices over10s. Wrong test-util binary +1156 retained/diagnosed by Cargo fingerprints; fixed baseline and accepted default artifact lack clock mutex symbols.
Static22,143,728 bytes, 448 belowACK, PT_INTERP absent. SHA e3f62dc84a02e86dcc78fe25bf84436ee19c362c34ce4be8d023b29a8c551d8f. Cold40 aim remains unmet; host launch/PAM boundary dominates. Controller50, fallback2, lifetime9 pass; zero idle activations/cleanup failures. Independent read-only security review found no defects; automated independent review still required. Full evidence: evidence/real-logins/round6/README.md. Perf fixtures/cache/account copies and257 owned registry files removed; shared baseline/account/rc preserved. Own 24GB build target, staged native images and local test-state scratch removed.
Final scripts/verify fast on pushed head (verbatim summary and size failure):
Resumed real-logins at
b7d10f6477, clean worktree. Read all 132 #172 and 22 prerequisite #159 comments; neither names a parent. Port shadow tests from1b8558bdfor rootless own-account admission, stale image cleanup and shipped linker. Round6 -896 KiB RSS was native development ONLY, not the production static recipe; that claim does not certify shipped RSS. Frozen static N200 later/pre-opened/cold/production 3.740/3.936/43.970/26.663 ms; request/process/setup/exec/prompt observer intervals cold 41.937/.114/.152/1.656 ms, later 1.903/.110/.119/1.591, pre-opened 1.980/.119/.140/1.655 (overlapping, do not sum). Correct rootless/readiness, explicit restoration, revocation confirmation and D231 fallback; then measure exact shipped static recipe on perf VM. No deployment or budget change.Completed
9d5d669c: both static musl targets select the startup ordering resolver, using the unchanged bundled LLD/CRT recipe and release profile. Shadow shipped-link test RED before fix; seven linker tests GREEN and workspace fmt PASS. Native cache-directory side effect removed. Static size and exact shipped idle RSS remain pending; -896 KiB from round6 is native development only.Additive contract clarification for D18/D247: rootless person terminals inherit the already authenticated daemon account context and use the existing own-account shim launch/readiness path; they cannot switch accounts or create a second PAM login without interactive credentials. Rootful PAM/systemd and authenticated su remain unchanged. Add a trusted server control action terminal.login.restore, serialized with person revocation, to clear a validated revocation marker after confirmed renewed host authority. Opens never clear markers implicitly. Restoration failures must remain explicit; no wire-v1 change.
Completed/pushed
aceba43e: rootless person opens inherit only the daemon's own host-authenticated account, retain person revocation fencing, and use the same own-account shim path as readiness. Refusing-su shadow test RED then GREEN; remote tests (excluding separately red cache test), all-target clippy/fmt PASS. Completed/pushed3995b9a6: reclaim stale executable images on new publication; shared launch locks and two executable censuses preserve running/adoptable images and the launch transition. Shadow upgrade test RED then GREEN; running-image and in-flight-launch tests PASS. Remote agent 97 PASS/13 ignored, clippy/fmt PASS. No idle work, no process argv/memory inspected. Exact static recipe rebuilding in one scratch target.Completed/pushed
64c2c328: D231 leading-dash person names reach absent-account fallback, preference API accepts matching syntax. Both regressions RED then GREEN; agent 98 PASS/13 ignored on serial repeat (initial parallel TCP-spacing row failed), SSH library14 PASS/1 ignored, clippy/fmt PASS. Completed82287a0f: explicit trusted restoration validates and removes only this person's marker, serialized with open/revoke; unsafe markers refused, repeats idempotent. Agent99 PASS/13 ignored, clippy/fmt PASS. Server enrollment completion now requires exact restored=true before returning success; reconnect/open never restore implicitly. Bootstrap30 PASS/1 ignored, server clippy/fmt PASS. Host removal now retries up to3 short idempotent attempts; new delayed/refused ACK tests RED then GREEN, all6 login-revocation regressions PASS including unchanged real-mTLS authority-cut test. Initial shipped link failed because rustc inferred C-driver args;6191e737declares direct LLD flavor for both musl targets, 8 linker tests PASS. Exact shipped static rebuild pending.Readiness finding: rootless terminals now use the inherited own-account path, but installation's fixed PTY canary alone still bypasses rootful PAM/preferred-login admission (bootstrap_remote.rs canary_registered; daemon.rs readiness branch). A successful PTY is insufficient health evidence if the preferred PAM path refuses. Add an authority-checked preferred-account resolution and terminal.login.prepare to confirmed enrollment completion, after explicit restoration, before reporting installation ready. Reuse existing preparation/admission checks and keep the fixed PTY command rather than trusting shell startup output. New refused-prepare regression is being reproduced; no shell/PAM or protocol change.
Production recipe audit: scripts/release/build sets INFRATERNAL_RELEASE_BUILD=1 and stamps INFRATERNAL_RELEASE_VERSION before scripts/package-release's default-feature musl builds. Verifier-only static builds omit those markers. Provisional current static c95490d8 is 22,164,176 bytes/no PT_INTERP; its rootless actual terminal/readiness/account-switch/revoke/restore oracle passes, but it is NOT production-recipe RSS evidence. Rebuilding fixed dev5db9d82f, round6
b7d10f64and current with identical pipeline markers/version, compiler/profile/default features and target, each from its own checkout directory/configuration. Reuse one target; Cargo archive inputs refreshed to prevent older checkout timestamps from reusing an unrelated executable. Required RSS/latency measurements remain pending. D262 receipts will be stored on #172; no new evidence README or raw logs will be committed. fj exposes comments but no attachment command, so lossless receipt data will be posted in numbered issue comments through the prescribed logged-in command, with hashes and decoder instructions; no credentials accessed.Follow-up cache defect reproduced: a launch guard used a publicly readable executable inode, which any account can flock exclusively; public directory publication locks had the same issue. The regression public_image_locks_cannot_serialize_login_admission was RED. Final fix moves both to validated0700 private sibling locks/0600 empty files and uses Linux ETXTBSY probes to protect running images without cross-account process inspection; no byte writes or new capabilities. Remote agent102 PASS/13 ignored, all-target clippy/fmt PASS, including public image/directory locks, unsafe private directory, running-image preservation and launch transition. Final production artifact rebuild uses matching release markers/version; full gate and VM certificates pending. Historical round6 -896 KiB remains GNU native development only. D262 receipts will stay on #172.
Production-stamped static certificate on
de956383(no deployment): default-feature x86_64 musl, pinned Rust1.99/LLD, release profile unchanged, INFRATERNAL_RELEASE_BUILD=1, matching edge-20261013T101500Z version. Current SHA80a2498eb62916347a9be30eb4bef7257220e9439dd3348aa38d02573b62fab5; 22,167,888 bytes, no PT_INTERP. Rebuilt b7 production recipe22,143,760; +24,128 bytes from correctness/cache/access fixes. D243/global16,404,816 budget remains FAILED, no waiver.Perf VM4CPUs/Linux6.12.69, shared lock/CPUWeight10000. Original rotating quartet N200 per condition:800 valid/0 failures/all units stopped. Same-harness p50ms:
Correction: historical -896KiB RSS was GNU native development, NOT shipped static. New matching pipeline/marked builds compare old b7 and current to fixed dev5db9d82f. Warm-cache N11 alternating, files fsynced before final current measurement: b7 RSS4432/dev4568 KiB (-136), anonymous1104/1104 (+0), privateclean3324/3460(-136). Current4388/dev4564 (-176), anonymous1104/1100(+4), file-backed3284/3464(-180), privateclean3280/3460(-180); one thread/132KiB stack. Current idle load .189/.296/.366 ->.174/.291/.363. Zero slices before first login over10.000367s. Initial current files were still dirty from transfer; preserved unsynced mapping diagnostic but final split uses synced receipt. Historical e3f62dc8 verifier file was removed in round6 cleanup; rebuilt b7 is32bytes larger from the new checkout/build identity and is not claimed byte-identical.
Controller50 PASS/restart-adoption/preferred reuse/revoke fencing/other-person survival; zero slices10s, zero cleanup failures. DaemonRSS/PSS8304/5335KiB; worker aggregate224912/54562KiB, PSS1091.24KiB per login x50. Fallback2 PASS, workers8988/5508KiB, utilities8848/1952KiB. Lifetime9 checks/0 failures; grace30.038s, tested descendant gone. Root cache-upgrade proof PASS: live old su/PAM image retained, actual new daemon adopts same old worker, retired old image reclaimed on next publication. -UTMP/lastlog validation limits unchanged. All receipt files will be stored losslessly on this issue per D262; final head gate is still running.
D262 receipt archive round7-receipts.tgz, part 1/7, head
e5732e783d. Gzip tar bytes=122733, SHA256=aa80bb31b69cf119016ccd09e134dc8a12d6f9f49c64ecfa86f000b4af12efff. Includes full VM N200/stages/idle/controller/fallback/lifetime/cache-upgrade receipts, provenance, scoped red/green gates and author checklist. No new evidence is committed. Final verify-fast transcript follows separately.Concatenate the base64 blocks in numerical order, base64-decode to round7-receipts.tgz, verify SHA256, then extract with tar. fj has no attachment subcommand; these lossless issue receipts use the authorized logged-in comment interface.
Lossless receipt data 1/7
D262 receipt archive round7-receipts.tgz, part 2/7, head
e5732e783d. Gzip tar bytes=122733, SHA256=aa80bb31b69cf119016ccd09e134dc8a12d6f9f49c64ecfa86f000b4af12efff. Includes full VM N200/stages/idle/controller/fallback/lifetime/cache-upgrade receipts, provenance, scoped red/green gates and author checklist. No new evidence is committed. Final verify-fast transcript follows separately.Concatenate the base64 blocks in numerical order, base64-decode to round7-receipts.tgz, verify SHA256, then extract with tar. fj has no attachment subcommand; these lossless issue receipts use the authorized logged-in comment interface.
Lossless receipt data 2/7
D262 receipt archive round7-receipts.tgz, part 3/7, head
e5732e783d. Gzip tar bytes=122733, SHA256=aa80bb31b69cf119016ccd09e134dc8a12d6f9f49c64ecfa86f000b4af12efff. Includes full VM N200/stages/idle/controller/fallback/lifetime/cache-upgrade receipts, provenance, scoped red/green gates and author checklist. No new evidence is committed. Final verify-fast transcript follows separately.Concatenate the base64 blocks in numerical order, base64-decode to round7-receipts.tgz, verify SHA256, then extract with tar. fj has no attachment subcommand; these lossless issue receipts use the authorized logged-in comment interface.
Lossless receipt data 3/7
D262 receipt archive round7-receipts.tgz, part 4/7, head
e5732e783d. Gzip tar bytes=122733, SHA256=aa80bb31b69cf119016ccd09e134dc8a12d6f9f49c64ecfa86f000b4af12efff. Includes full VM N200/stages/idle/controller/fallback/lifetime/cache-upgrade receipts, provenance, scoped red/green gates and author checklist. No new evidence is committed. Final verify-fast transcript follows separately.Concatenate the base64 blocks in numerical order, base64-decode to round7-receipts.tgz, verify SHA256, then extract with tar. fj has no attachment subcommand; these lossless issue receipts use the authorized logged-in comment interface.
Lossless receipt data 4/7
D262 receipt archive round7-receipts.tgz, part 5/7, head
e5732e783d. Gzip tar bytes=122733, SHA256=aa80bb31b69cf119016ccd09e134dc8a12d6f9f49c64ecfa86f000b4af12efff. Includes full VM N200/stages/idle/controller/fallback/lifetime/cache-upgrade receipts, provenance, scoped red/green gates and author checklist. No new evidence is committed. Final verify-fast transcript follows separately.Concatenate the base64 blocks in numerical order, base64-decode to round7-receipts.tgz, verify SHA256, then extract with tar. fj has no attachment subcommand; these lossless issue receipts use the authorized logged-in comment interface.
Lossless receipt data 5/7
D262 receipt archive round7-receipts.tgz, part 6/7, head
e5732e783d. Gzip tar bytes=122733, SHA256=aa80bb31b69cf119016ccd09e134dc8a12d6f9f49c64ecfa86f000b4af12efff. Includes full VM N200/stages/idle/controller/fallback/lifetime/cache-upgrade receipts, provenance, scoped red/green gates and author checklist. No new evidence is committed. Final verify-fast transcript follows separately.Concatenate the base64 blocks in numerical order, base64-decode to round7-receipts.tgz, verify SHA256, then extract with tar. fj has no attachment subcommand; these lossless issue receipts use the authorized logged-in comment interface.
Lossless receipt data 6/7
D262 receipt archive round7-receipts.tgz, part 7/7, head
e5732e783d. Gzip tar bytes=122733, SHA256=aa80bb31b69cf119016ccd09e134dc8a12d6f9f49c64ecfa86f000b4af12efff. Includes full VM N200/stages/idle/controller/fallback/lifetime/cache-upgrade receipts, provenance, scoped red/green gates and author checklist. No new evidence is committed. Final verify-fast transcript follows separately.Concatenate the base64 blocks in numerical order, base64-decode to round7-receipts.tgz, verify SHA256, then extract with tar. fj has no attachment subcommand; these lossless issue receipts use the authorized logged-in comment interface.
Lossless receipt data 7/7
Full gate
de956383found stale -root rejection in preferred_accounts_tests.rs181; runtime D231 accepts that name.e5732e78corrects only the fixture and adds a positive durable-name case; malformed dotted/space/foreign-person/positional/scope rejection remains. Preferred5 PASS, all-target server clippy/fmt PASS.Full
e5732e78gate then reproduced a real readiness bug: rootless oracle sees shim-disconnected before marker. Deterministic readiness_exit_waits_for_a_real_output_cursor reaps the fixed command with only a control peer, then attaches output; RED missing socket. session.rs retirement treated empty all() as delivered exit. New guard requires an actual output cursor with exited_sent; ten-second private-probe abandonment and normal terminal retention unchanged. GREEN real-child marker/exit and rootless oracle; host-login shim113 PASS/14 ignored, touched shim/CLI clippy/fmt PASS. Runtime fix committed/pushed; new pipeline artifact/N200/RSS and full final-head gate rebuilding. Earlier 80a2498e certificates are retained as prior-artifact receipts, not final-source acceptance. No host-load waiver or budget change.D262 FINAL receipt archive round7-final-receipts.tgz, part 1/7, head
8d1f6c77. Bytes=110426, SHA256=d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064. Final pipeline artifact f334e77c, matched warm/fsynced static RSS, N200/stages, lifecycle/controller/fallback, red/green readiness correction, full final-head verify-fast transcript and checklist. Earlier archive remains prior-artifact evidence.Concatenate these FINAL base64 blocks in numerical order, decode, verify SHA256, extract tar. Stored on #172 through the authorized logged-in comment interface; no evidence committed.
Final lossless receipt data 1/7
D262 FINAL receipt archive round7-final-receipts.tgz, part 2/7, head
8d1f6c77. Bytes=110426, SHA256=d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064. Final pipeline artifact f334e77c, matched warm/fsynced static RSS, N200/stages, lifecycle/controller/fallback, red/green readiness correction, full final-head verify-fast transcript and checklist. Earlier archive remains prior-artifact evidence.Concatenate these FINAL base64 blocks in numerical order, decode, verify SHA256, extract tar. Stored on #172 through the authorized logged-in comment interface; no evidence committed.
Final lossless receipt data 2/7
D262 FINAL receipt archive round7-final-receipts.tgz, part 3/7, head
8d1f6c77. Bytes=110426, SHA256=d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064. Final pipeline artifact f334e77c, matched warm/fsynced static RSS, N200/stages, lifecycle/controller/fallback, red/green readiness correction, full final-head verify-fast transcript and checklist. Earlier archive remains prior-artifact evidence.Concatenate these FINAL base64 blocks in numerical order, decode, verify SHA256, extract tar. Stored on #172 through the authorized logged-in comment interface; no evidence committed.
Final lossless receipt data 3/7
D262 FINAL receipt archive round7-final-receipts.tgz, part 4/7, head
8d1f6c77. Bytes=110426, SHA256=d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064. Final pipeline artifact f334e77c, matched warm/fsynced static RSS, N200/stages, lifecycle/controller/fallback, red/green readiness correction, full final-head verify-fast transcript and checklist. Earlier archive remains prior-artifact evidence.Concatenate these FINAL base64 blocks in numerical order, decode, verify SHA256, extract tar. Stored on #172 through the authorized logged-in comment interface; no evidence committed.
Final lossless receipt data 4/7
D262 FINAL receipt archive round7-final-receipts.tgz, part 5/7, head
8d1f6c77. Bytes=110426, SHA256=d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064. Final pipeline artifact f334e77c, matched warm/fsynced static RSS, N200/stages, lifecycle/controller/fallback, red/green readiness correction, full final-head verify-fast transcript and checklist. Earlier archive remains prior-artifact evidence.Concatenate these FINAL base64 blocks in numerical order, decode, verify SHA256, extract tar. Stored on #172 through the authorized logged-in comment interface; no evidence committed.
Final lossless receipt data 5/7
D262 FINAL receipt archive round7-final-receipts.tgz, part 6/7, head
8d1f6c77. Bytes=110426, SHA256=d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064. Final pipeline artifact f334e77c, matched warm/fsynced static RSS, N200/stages, lifecycle/controller/fallback, red/green readiness correction, full final-head verify-fast transcript and checklist. Earlier archive remains prior-artifact evidence.Concatenate these FINAL base64 blocks in numerical order, decode, verify SHA256, extract tar. Stored on #172 through the authorized logged-in comment interface; no evidence committed.
Final lossless receipt data 6/7
D262 FINAL receipt archive round7-final-receipts.tgz, part 7/7, head
8d1f6c77. Bytes=110426, SHA256=d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064. Final pipeline artifact f334e77c, matched warm/fsynced static RSS, N200/stages, lifecycle/controller/fallback, red/green readiness correction, full final-head verify-fast transcript and checklist. Earlier archive remains prior-artifact evidence.Concatenate these FINAL base64 blocks in numerical order, decode, verify SHA256, extract tar. Stored on #172 through the authorized logged-in comment interface; no evidence committed.
Final lossless receipt data 7/7
Round7 result: real-logins head
8d1f6c777b, atomic commits pushed; no deployment. Six shadow findings fixed: rootless own-account path/readiness, shipped static ordering, bounded image reclamation, explicit confirmed-enrollment restoration, leading-dash fallback and bounded cleanup retries. Additional real private-readiness race fixed: empty output-peer all() retired the command before a viewer attached; deterministic real-child RED/GREEN, rootless oracle and shim113 tests pass. Runtime invariants/checklist and step evidence are in preceding comments.Final production-stamped x86_64 musl/default-feature release (Rust1.99, existing LLD/CRT/LTO/one codegen unit/strip), INFRATERNAL_RELEASE_BUILD=1 and matching edge-20261013T101500Z. SHA f334e77c04cffa5d38c5f6ab81ea66e062932b4e20dbaab5421466af42a3981a; 22,167,888 bytes/no PT_INTERP, +24,128 vs matched rebuilt b7. D243/global size remains FAILED; no waiver.
Perf VM4CPUs/Linux6.12.69, shared lock/CPUWeight10000, original rotating quartet N200 per path:800 valid/0 failures/all units stopped. Load .042/.350/.364 ->1.641/.724/.491:
Correction: -896KiB was GNU native development, NOT shipped static. Rebuilt b7 production recipe is -136KiB vs fixed dev5db (anonymous0/file-backed-136). Final N11 alternating matched warm/fsynced static RSS4388/dev4564KiB, delta-176 PASS200; anonymous1104/1100(+4), file-backed3284/3464(-180), one thread/132KiBstack. Idle load .056/.369/.372 ->.051/.362/.369; zero slices before first login10s and in controller50/fallback2. Historical e3f62dc8 verifier artifact was removed in round6; new-checkout b7 rebuild differs32bytes and byte identity is not claimed.
Controller50 PASS/preferred reuse/restart-adoption/revoke fencing/other-person survival: daemonRSS/PSS8312/5343KiB; workers224916/54566KiB, PSS1091.32KiB per login x50. Fallback2 PASS, daemon8264/6201KiB, workers8988/5508KiB. Lifetime9 checks/0 failures, grace30.013584s/logind30.017683s, tested descendant gone. Root cache-upgrade proves live old su/PAM image retained/adopted and retired image reclaimed. -UTMP/lastlog limits unchanged. Eight linker/config tests and author checklist pass. Full raw receipts and final gate transcript are stored in numbered FINAL D262 issue comments; earlier archive is prior-artifact evidence. No new repo evidence/report file.
Perf cleanup removed267 prior-run and258 final-run owned registry/cache files plus staging/account copies, preserving shared baseline/account/rc. Own scratch/generated local caches are being removed. No decision, engine, dependency, license, secret, price, owner fixture, UI, deployment or dev/main merge changed. Cold40 aim and size budget remain unmet; no green-gate/merge-ready claim. Issue stays open.
Final scripts/verify fast on head (verbatim):
Aarch64/TypeScript downstream rows not reached after the Rust static-size failure; no TypeScript touched.
Cleanup complete on real-logins
8d1f6c777b. Worktree clean; local HEAD equals origin/real-logins. Removed own27GiB target/scratch, own temporary source checkouts and receipt staging, target symlink and generated bytecode; .cargo/pycache absent. All raw final gate/VM receipts are already stored on #172 in FINAL receipt parts. VM cleanup267 prior/258 final owned files, shared baseline/account/rc preserved. No deployment; final functional gate PASS/static-size FAIL as posted.Independent review started on review-real-logins at target
8d1f6c777b; merge base with dev8e7467c07c. Reviewing #172 and prerequisite #159 history, contracts, prior shadow findings and final report. No implementation edits, pushes, deploys or perf VM use under review brief. Performance claims will be checked against retained receipts only; functional tests and head verify fast run locally.Review step: eight shipped-linker/config tests PASS. Decoded all seven FINAL receipt parts: 110426 bytes, SHA256 d8899635022618aebeabdc892db96591a28608ea54120f5216547dbfb23e4064 matches #172. Provenance identifies target
8d1f6c77and pipeline artifact f334e77c. No independent timing claim. Local dev is stale at8e7467c; additionally reviewed the focused diff against merge-base with origin/devc0d01d22(65 non-evidence paths). Head gate is running on unchanged source. Real binary diagnostic with explicit --state and XDG_RUNTIME_DIR absent accepts fixed readiness but refuses preferred-login preparation with resource_unavailable; normal-location regression pending. Testing connected-host cleanup at ordinary control capacity next.RLR-1 P2, committed
be77b05eon review-real-logins (local only): a rootless daemon with valid explicit --state and no XDG_RUNTIME_DIR accepts fixed readiness, but terminal.login.prepare for its own account returns resource_unavailable. logins.rs:103/400 always requires the default runtime root even though explicit state already admits shims. Real-binary failing oracle scripts/test-rootless-explicit-state.py; normal Rust test real_binary_rootless_person_preparation_honors_explicit_state_without_runtime_environment in crates/infraternal/tests/agent_daemon.rs. Assertion reproduced on the unchanged head executable; Rust wrapper run pending. No implementation fix.RLR-2 P1: connected-host login revocation depends on the full ordinary control-call pool. embedded.rs:1157 rejects RevokeLogin at 64 pending calls before writing terminal.login.revoke; remote_guard.rs retries the same admission three times, then remote_authority.rs:168 continues authority retirement without cleanup. Active host logins can remain running despite D240 immediate access removal. Failing test committed
8f58a6a7on review-real-logins (local only): remote_guard::login_revocation_tests::connected_host_cleanup_is_admitted_when_ordinary_control_calls_are_full. Real Unix socket positive control with 63 pending calls confirms cleanup; 64 calls fail. Focused cargo test --locked -p infraternal-server --features remote: 0 passed, 1 failed; assertion "all three cleanup attempts were refused by ordinary control capacity on a connected host". No implementation edits. HOLD under the no-P0/P1 verdict rule.RLR-3 P2, committed
5365de64on review-real-logins (local only): interrupted image publication leaves .pending-PID-counter copies when Temporary::drop cannot run. login_binary.rs:240 prunes only infraternal-* names, retaining abandoned staging files across future publications. Normal Rust regression login_binary::tests::interrupted_publication_does_not_retain_abandoned_binary_copies seeds an abandoned complete copy in a private fixture, invokes real publication, and FAILS (0 passed/1 failed): "a subsequent publication retained an abandoned binary copy". This models crash state rather than scheduling an abrupt stop during copying; no host cache or implementation changed.Independent review receipts, part 1/3, review-real-logins
5365de64; target8d1f6c77. Archive review-receipts.tgz bytes=50696, SHA256=70d5f684dd59171f643e8fe5535599ebd34db78c56b5d3e9ff6e4fe3a36d2ed6. Contains full unchanged-head verify-fast output, all three red tests, fmt/clippy, parser/linker checks, provenance and findings. Concatenate base64 blocks in numerical order, decode, verify SHA256, and extract tar. No implementation changes or push.Review receipt data 1/3
Independent review receipts, part 2/3, review-real-logins
5365de64; target8d1f6c77. Archive review-receipts.tgz bytes=50696, SHA256=70d5f684dd59171f643e8fe5535599ebd34db78c56b5d3e9ff6e4fe3a36d2ed6. Contains full unchanged-head verify-fast output, all three red tests, fmt/clippy, parser/linker checks, provenance and findings. Concatenate base64 blocks in numerical order, decode, verify SHA256, and extract tar. No implementation changes or push.Review receipt data 2/3
Independent review receipts, part 3/3, review-real-logins
5365de64; target8d1f6c77. Archive review-receipts.tgz bytes=50696, SHA256=70d5f684dd59171f643e8fe5535599ebd34db78c56b5d3e9ff6e4fe3a36d2ed6. Contains full unchanged-head verify-fast output, all three red tests, fmt/clippy, parser/linker checks, provenance and findings. Concatenate base64 blocks in numerical order, decode, verify SHA256, and extract tar. No implementation changes or push.Review receipt data 3/3
HOLD (P0/P1 present) — do not merge. Independent real-logins review target
8d1f6c77; final local review-real-logins head5365de64e6. Counts: P0=0, P1=1, P2=2, P3=0.RLR-2 P1: cleanup confirms at 63 ordinary pending calls, refuses at 64; all three retries reuse full control admission, so connected-host removal may retire authority without sending login cleanup. Red test commit
8f58a6a7. RLR-1 P2: explicit-state rootless readiness succeeds without XDG_RUNTIME_DIR but own-account preparation refuses (be77b05e). RLR-3 P2: seeded abandoned .pending binary remains after real publication (5365de64; modeled crash state). All three normal Rust tests FAIL as expected. Implementation unchanged.Workspace all-target clippy -D warnings PASS; fmt PASS; Python syntax PASS. Eight linker/config tests and five functional harness tests PASS. Parser assertion smoke 100000 inputs/9 boundary vectors PASS; libFuzzer 100000 runs without coverage instrumentation, not a coverage-guided fuzz claim. Final author archive hash and 200 rows per condition/zero failures checked. No independent performance measurements, rootful PAM run, perf VM access, push or deployment under this brief.
Full logs/provenance/findings preserved in preceding review receipt parts; archive SHA256 70d5f684dd59171f643e8fe5535599ebd34db78c56b5d3e9ff6e4fe3a36d2ed6. Findings also appended to /home/kayg/.local/state/codex-jobs/infraternal/review-real-logins/findings.md.
Unchanged job head scripts/verify fast, exit 1, verbatim output:
Aarch64/TypeScript rows are not reached after static-size failure. No budget waiver. P2s may be fixed forward under the owner rule; RLR-2 P1 requires a repair before merge. Issue remains open. Build scratch is being removed; only the local review branch and requested findings file remain.
RLR-1 — P2 — Explicit rootless state does not cover login admission
be77b05e4c(review-real-logins; local only).8d1f6c77fast functional rows PASS; static size FAIL. Thin Rust wrapper verification pending.RLR-2 — P1 — Connected-host login revocation is refused by ordinary control capacity
8f58a6a7a7(review-real-logins; local only). Implementation unchanged.RLR-3 — P2 — Interrupted image publication retains full staging copies
5365de64e6(review-real-logins; local only). Implementation unchanged.Verification update: RLR-1 normal Rust integration wrapper also reproduced: 0 passed, 1 failed, at own-account preparation (resource_unavailable). All-target workspace clippy with -D warnings PASS, cargo fmt --all --check PASS, Python helper syntax PASS. Review commits change tests only; runtime implementation remains
8d1f6c77.Final verification and verdict
HOLD / do not merge: P0=0, P1=1, P2=2, P3=0. Local branch head
5365de64e6; no push/deploy/implementation fixes. Committed P1 test repeats with ordinary_pending=63 cleanup_confirmed=true and ordinary_pending=64 cleanup_confirmed=false. All three normal Rust regressions fail. Workspace all-target clippy and fmt PASS. No perf VM use or independent timing claim.Full receipt archive on #172: SHA256 70d5f684dd59171f643e8fe5535599ebd34db78c56b5d3e9ff6e4fe3a36d2ed6. Author FINAL receipt hash matches; four condition lists each contain 200 rows and no failures. Review scope and unverified rootful/performance boundaries are in review-metadata.json.
Unchanged
8d1f6c77scripts/verify fast output (verbatim):Cleanup verified: removed only the review target symlink, generated scripts/pycache, and real-logins-review scratch/build directory after #172 receipt and verdict comments succeeded. Worktree is clean; local review head remains
5365de64. No push or deploy.Repair round start (RLR-1/2/3 from the HOLD review). Branch
real-logins, base8d1f6c777b. Porting the three failing tests from review-real-logins (be77b05e,8f58a6a7,5365de64) and fixing: RLR-2 P1 cleanup/revocation admission under a full control queue (reserved bounded slots), RLR-1 P2 explicit--statewins for rootless login preparation, RLR-3 P2 safe reclamation of abandoned.pending-*login binary copies. Will report size delta vs8d1f6c77and re-measure on the perf VM only if a hot path changes.Repair round: findings fixed (pushed, head
dccb8f45).ed946679(RLR-1),8c37e3b4(RLR-2),993be3ba(RLR-3), unchanged except a umask-independent 0755 on RLR-3's fixture directory (under this host's umask 002 publication refused the group-writable dir before reaching the assertion).436c0a02: connected-host cleanup gets its own bounded reserve of 16 pending control slots (LOGIN_REVOKE_RESERVE). Ordinary admission still counts every pending call, so it never uses the reserve and keeps its O(1) check; the table is bounded by 64+16.connected_host_cleanup_is_admitted_when_ordinary_control_calls_are_full: ordinary_pending=63 cleanup_confirmed=true, ordinary_pending=64 cleanup_confirmed=true. Newcleanup_reserve_is_bounded_at_and_beyond_its_limit: 64 unanswered ordinary + 16 unanswered cleanups on a real Unix socket peer; ordinary call 65 → Unavailable at once, cleanup 17 → Unavailable at once and never reaches the host. All 8 login_revocation tests pass.1a14be71: rootless person locks / revocation markers now live in the daemon's resolved state directory (explicit--statewins, else$XDG_RUNTIME_DIR/infraternal); ensure/revoke/restore take it from the daemon and never re-read the environment. Root keeps the host-wide/runregistry because login units are host-wide service manager objects (RuntimeDirectory=under /run). The registry is new on this branch, so no shipped marker is stranded.real_binary_rootless_person_preparation_honors_explicit_state_without_runtime_environmentpasses.530c7a07: publication removes.pending-*regular files owned by the cache owner before making its own copy, under the exclusive publisher lock (no live writer can exist). Workers exec onlyinfraternal-*names; a hard-linked staging name is a second name for the published inode, so unlinking it never touches a running login. Runs only on the publication path, not on adopt (later terminals). Review test + new hard-linked-staging-name test pass; both fail with the cleanup call removed.dccb8f45:cleanup_preserves_running_images_for_fallback_adoptionread /proc/PID/exe before the child's exec switched it (2/6 failures on unchanged8d1f6c77under load ~22); now polls bounded 10 s; 10/10 pass.Finding (pre-existing, not fixed here):
real_binary_rootless_readiness_and_person_terminal_use_own_account(scripts/test-rootless-logins.py) fails intermittently under host load at the readiness leg withAssertionError: (15, b'\x01\x00terminal shim disconnected')(line 60until(b'infraternal-ready')or line 61wait_event('terminal.exited')). Interleaved in one load window (load avg 22–27): unchanged8d1f6c77debug binary 11/12 pass, this branch 11/12 pass; a separate baseline run failed on run 3 with the same message. Same failure family as 8d1f6c77's own readiness fix; needs its own job.Perf: no measured path changed (ordinary open admission, adopt-existing-image, root
/runregistry are byte-for-byte the same logic; rootless root no longer reads the environment). Not re-measured on the perf VM for this reason.Continuation start: real-logins at
ab4dd6af29. Read #172 history and resumed already-pushed RLR-1/2/3 fixes; no WIP commit or partly written tracked files. Verifying the three review tests, reserve bound and final fast gate. Re-measuring shipped static N200 and matched warm idle RSS on authorized perf VM because final code layout may affect round-7 numbers. No deployment; hand off for break-it review after receipts.Continuation finding: inherited final optimizations
89b968b6(single O(1) reserve length check),98738367(reclaim staging in existing publication-only prune pass),ab4dd6af(borrow resolved registry root) are already pushed; head equals origin/real-logins. First fresh full gate hit the documented rootless readiness flake at scripts/test-rootless-logins.py:60, terminal shim disconnected. Explicit-state regression passes. Unmodified-head rerun passes all four agent_daemon tests; full suite continues. Eight native linker/config tests pass. Measuring stamped static head and rebuilt round7 rather than assuming identical code residency. Raw logs will be attached at finish; no gate waiver.Fresh checks on unchanged
ab4dd6af: requested RLR-1/2/3 regressions PASS, plus reserve-bound PASS (63 and64 ordinary pending both cleanup_confirmed=true;64+16 rejects overflow). Publication suite14 passed/1 ignored. Eight linker/config tests and21 measurement/lifecycle harness tests PASS. Default-concurrency full gate rerun passes rootless readiness but hits unchanged shim locale oracle pty.rs:1156; isolated locale test PASS. First gate also retained documented readiness disconnect. Neither failure is waived. Starting a full final head gate with RUST_TEST_THREADS=2; static release link and matched5db baseline rebuild share one target directory. Source has no additional changes.Rootless readiness disconnect has a concrete cause, not just host load: private readiness shims advertise SESSION_OWNER (session.rs:639), but retire after flushing output/Exited without an .ended record (session.rs:495). terminal_run concurrently watches the ownership socket (daemon.rs:1388); owner EOF can win before queued output/Exited is read, recorded_end returns false, and the relay sends terminal shim disconnected. The second/third full-gate runs expose it again. Repairing the prerequisite for a reliable final functional gate: private readiness will omit durable-owner capability and use its ordered output link; ordinary terminal ownership remains. Retaining a real-shim Hello regression before the fix, then repeating the existing real rootless readiness oracle. D13/D18/D247, additive capability negotiation, no new protocol fields. Final artifact will be rebuilt and remeasured.
Completed regression step
0db0f61e, pushed: real readiness Hello rejects durable SESSION_OWNER advertisement. Normal Rust test RED on unchanged source: caps & SESSION_OWNER =8, expected0. fmt and infraternal all-target clippy PASS. Fix now omits only that capability for private probes; ordinary terminal owner tests remain. Checking real shim suite and rootless end-to-end oracle before the fix commit.Completed prerequisite repair
5e87be79, pushed (regression0db0f61e). Private readiness omits SESSION_OWNER, preventing ownership EOF from overtaking buffered output/Exited; ordinary capabilities and ownership are unchanged. Normal regression GREEN; all15 real shim tests PASS, both rootless integration tests PASS, existing rootless oracle12/12 PASS with no su calls, wrong-account refusal, revocation fence and explicit restoration intact. fmt/shim all-target clippy PASS. Final head fast gate running with RUST_TEST_THREADS=2; production-stamped static final artifact and matched5db baseline rebuild share one target. No deploy.Repair complete; stopping for break-it review.
real-loginshead5e87be791eequals origin; atomic commits pushed, no deployment or merge. RLR-1 explicit-state, RLR-2 cleanup at full ordinary control capacity, and RLR-3 abandoned staging copies all PASS. Reserve bound64+16 PASS; overflow refused. Existing publication tests14 active PASS. Latest added regression0db0f61e and fix5e87be79 remove durable ownership only from private readiness, preventing ownership EOF overtaking output/Exited. Real shim15/15, rootless2/2, repeated own-account/readiness/revoke/restore oracle12/12 PASS. Earlier readiness and locale failures are retained; final head functional gate passes with RUST_TEST_THREADS=2, no failure waiver.Exact shipped x86_64 musl release recipe: pipeline marker1, version edge-20261013T101500Z, default features, pinned Rust1.99/LLD/CRT, existing release/LTO/one codegen/strip/server-size profile. Artifact SHA256 ce55127d90d545820f2a988a05d62597b1966a1be3d73486849898da088380d5;22,167,184 bytes/no PT_INTERP,704 bytes smaller than round7. D243 global limit remains FAILED, no waiver. This is static release evidence; round6 GNU -896KiB remains explicitly unsuitable as shipped evidence.
Perf VM infraternal-perf-test,4 CPUs/kernel6.12.111, shared flock/CPUWeight10000, original rotating quartet N200 per path:800 valid/0 failures/all units stopped. Load .018/.204/.508 ->1.547/.582/.624. Historical round7 used kernel6.12.69; no causal speedup claim.
Stage p50 request/process/setup/exec/prompt intervals ms: cold42.152/.120/.123/1.625; later1.937/.117/.112/1.587; pre-opened1.968/.118/.123/1.648. Independent medians, do not sum. Canonical harness still omits remaining ensure/adoption, account/cache/server/browser costs; controller separately proves actual preparation/reuse.
N11 alternating matched warm/fsynced static idle: final RSS4384/dev5db4564KiB, delta-180 PASS200 (round7-176). Anonymous1104/1100(+4); file-backed3280/3464(-184), one thread/132KiB stack. Rebuilt5db baseline matches prior byte count but has a different hash; byte identity not claimed. Idle scheduled slices0 before first login10s, controller50 and true fallback2. Controller50 PASS/restart adoption/revoke fencing/other-person survival/preferred reuse: daemonRSS/PSS8292/5327KiB; workers224700/54550KiB, PSS1091KiB per login x50. Actual host-su fallback2 PASS: daemon8260/6200KiB; workers8980/5504KiB, cleanup0. Extra system-manager scale2 control retained separately.
Fixture correction retained transparently: initial tar preserved uid1001 and rootful cache correctly refused the source. Corrected ownership to root and repeated the entire definitive locked N200/RSS/controller run; no source/security relaxation. Preliminary receipts preserved. No parser, dependency, engine, decision, license, prices, owner fixture or UI change.
D262 raw receipt archive: real-logins-repair-receipts.tgz
Bytes324031, SHA25664ac4fef4aabf8de9ab2a01634fb5f8a5c65f67455fa6b8c8c414f88a25c3581. Includes full head gate, earlier failures, red/green, before/after/stages, exact harness/provenance, raw800 rows, RSS/canary/controller/fallback, author checklist and VM cleanup. Perf cleanup removed268 definitive owned registry/cache files and100 initial failed-controller markers; existing bench account/rc and comparison artifact preserved. Local own scratch/generated caches cleanup follows; no evidence committed. Issue remains open.
Final scripts/verify fast, head5e87be79, exit1;101 completed suites,938 passed,0 failed,106 ignored. Verbatim:
Aarch64/TypeScript downstream rows not reached after static-size failure; no TypeScript touched. Required repair tests and speed/RSS targets pass; global size gate and cold40 aim remain unmet. Ready for independent break-it review, no green-gate or merge-ready claim.
Cleanup complete at5e87be791ef8f0b139011ca806787f5201229229. Removed own29.8GiB active target, prior6.5GiB unused target, detached8d baseline, archive source checkout and remaining real-logins scratch. Removed generated scripts/pycache; .cargo/pycache absent. VM cleanup268 definitive owned registry/cache files plus100 initial failed-controller markers; shared bench account/rc/comparison preserved. Raw receipts already attached with archive SHA64ac4fef4aabf8de9ab2a01634fb5f8a5c65f67455fa6b8c8c414f88a25c3581. Removing untracked local receipt staging now; no report/evidence commit, no deployment. Branch head equals origin. Stopping for break-it review; static-size failure and cold40 aim remain as recorded.
Independent repair verification started on review-real-logins; target
5e87be791e, merge base with local dev8e7467c07c. Prior review history retained by merging target; review tree exactly matches target. Rechecking RLR-1/2/3 and probing repair boundaries. No implementation fixes, push, deployment or perf VM access. #172 and prerequisite #159 have no named parent.RLR-4 P1, local commit
d6dbc484: ### RLR-4 — P1 — Rootless revocation retains existing person shells5e87be791e.d6dbc484b5(local review-real-logins; no implementation change).Review completed step, target
5e87be79: RLR-5 P2 failing test committed locally at4a5205e9.RLR-5 — P2 — Reused publisher PID refuses abandoned staging name
4a5205e9b1(local review-real-logins; implementation unchanged).Verification update at review head4a5205e9: RLR-4 normal Rust integration wrapper also FAILS (0passed/1failed), with revoked=true/new_open_refused=true/existing_shell_stopped=false/other_person_survives=true. RLR-5 normal Rust unit FAILS (0passed/1failed), AlreadyExists on stale .pending-PID-0. Review cargo fmt --all --check and workspace all-target clippy -D warnings PASS. Initial target-tree fast gate continues; existing explicit-state/readiness and interrupted-publication regressions PASS so far. No implementation edits, push, deployment or VM access.
Repair verification at local review head4a5205e9: target-tree fast gate confirms RLR-1 explicit-state rootless admission PASS, RLR-2 cleanup at ordinary capacity plus cleanup reserve bound PASS, RLR-3 interrupted publication PASS. New RLR-4 P1 and RLR-5 P2 normal Rust regressions remain red. Seeded login_request assertion smoke100000 executions/12 seed vectors PASS; no coverage instrumentation, so no coverage-guided claim. Eight linker tests and five harness tests PASS. Full fast gate continues in remote-host tests.
Independent repair-review receipts 1/3, review-real-logins4a5205e9, target5e87be79. Archive repair-review-receipts.tgz bytes=56717, SHA256=7f57477e6fbe2c3a9d0e4d934c2ea30148bb2bfa0aa587dac555cd4a313da7e1. Full target gate, both new red tests, fmt/clippy, parser smoke, linker/harness, test patch, findings and provenance. Concatenate base64 blocks in order, decode, verify SHA256, extract tar. No implementation changes or push.
Lossless review receipt 1/3
Independent repair-review receipts 2/3, review-real-logins4a5205e9, target5e87be79. Archive repair-review-receipts.tgz bytes=56717, SHA256=7f57477e6fbe2c3a9d0e4d934c2ea30148bb2bfa0aa587dac555cd4a313da7e1. Full target gate, both new red tests, fmt/clippy, parser smoke, linker/harness, test patch, findings and provenance. Concatenate base64 blocks in order, decode, verify SHA256, extract tar. No implementation changes or push.
Lossless review receipt 2/3
Independent repair-review receipts 3/3, review-real-logins4a5205e9, target5e87be79. Archive repair-review-receipts.tgz bytes=56717, SHA256=7f57477e6fbe2c3a9d0e4d934c2ea30148bb2bfa0aa587dac555cd4a313da7e1. Full target gate, both new red tests, fmt/clippy, parser smoke, linker/harness, test patch, findings and provenance. Concatenate base64 blocks in order, decode, verify SHA256, extract tar. No implementation changes or push.
Lossless review receipt 3/3
HOLD (P0/P1 present) — do not merge. Independent repair review target5e87be791ef8f0b139011ca806787f5201229229; final local review-real-logins head4a5205e9b1132398466b8f7f324fb4b665049325. Counts: P0=0, P1=1, P2=1, P3=0.
RLR-4 P1: rootless person revocation acknowledges success and fences new opens while its existing real shell remains alive on a pinned pidfd; another person's terminal survives. Failing normal Rust test and real-PTY oracle committed
d6dbc484.RLR-5 P2: a restarted publisher reusing a prior PID refuses the abandoned .pending-PID-0 with AlreadyExists before prune runs. Isolated normal Rust failing test committed4a5205e9; crash/PID-reuse state is modeled, not an actual PID recycle experiment.
Prior RLR-1/2/3 regressions now PASS, including63/64 ordinary control occupancy and64+16 bounded cleanup admission. Both new normal Rust tests FAIL (one each). Workspace fmt and all-target clippy-Dwarnings PASS;8 linker tests and5 harness tests PASS. Login parser seeded assertion smoke100000 executions/12 vectors PASS; no coverage instrumentation. Author receipt SHA64ac4fef4aabf8de9ab2a01634fb5f8a5c65f67455fa6b8c8c414f88a25c3581 matches and4x200 timing rows/zero reported failures checked. No independent timings/RSS, rootful PAM run or perf VM use under this brief.
Target-tree scripts/verify fast, exit1:101 completed suites;938 passed,0 failed,106 ignored. Compiled target tests before adding the deliberately failing review regressions; runtime remains unchanged. Stripped static22167184 bytes matches the author target gate's byte count; no byte-identity claim. No production/dependency changes from review commits. Aarch64/TypeScript downstream rows not reached after static-size failure; no waiver. Verbatim:
Full gate/red tests/lint/parser/linker/provenance receipts are preserved in numbered issue receipt comments. Findings appended to /home/kayg/.local/state/codex-jobs/infraternal/review-real-logins/findings.md. No implementation fixes, push, deployment, issue close or other-worktree edits. Own build scratch cleanup follows after the receipts and verdict are stored.
Cleanup complete: removed this review job scratch/build target, target symlink and generated scripts bytecode. Local review-real-logins remains4a5205e9b1132398466b8f7f324fb4b665049325; worktree clean. Full gate/new red tests and HOLD verdict already stored on #172, receipt SHA2567f57477e6fbe2c3a9d0e4d934c2ea30148bb2bfa0aa587dac555cd4a313da7e1. Requested findings file retained. No implementation fixes, push, deploy or issue close.
r9 repair start: branch real-logins, base
5e87be791e; clean worktree, no WIP. Read #172 and prerequisite #159 history (no named parent). Ported RLR-4d6dbc484and RLR-54a5205e9as 66dfe4f3/95c3f51f. Rootless revoke currently records only a tombstone; existing own-account shells have no durable person association. Staging create_new precedes prune and collides on reused PID. Will retain red receipts, fix separately, run requested iterate/final fast, and stop for review. Proposed additive shim capability: authenticated local cleanup terminates the owned shell and acknowledges only after wait confirms exit; existing Signal foreground semantics unchanged. Rootless person/session records persist across daemon restart; launches serialize with revocation. Rootful PAM/fallback remains unchanged. Round8 shipped p50 later3.784/pre-opened3.948/cold44.161ms; matched idle delta-180KiB (anonymous+4/file-backed-184). Re-measure if code layout/hot path affects these numbers; no deploy.r9 finding: RLR-5 independently reproduced on retained review test: reused .pending-PID-0 returns AlreadyExists, 0 passed/1 failed (red-cache.log). New staging UUID is publication-only; create_new and exclusive publisher lock remain. Rootless original oracle now passes on the current working source; expanded oracle also passes across daemon restart with two revoked-person terminals and a detached HUP/TERM-ignoring sleeping descendant, preserving the other person. Tightening the expanded assertion to require every pinned process dead immediately on acknowledgement. Frozen pre-fix snapshot95c3f51f is running the original RLR-4 oracle for a separate red receipt. Existing scripts/verify has no iterate mode: requested invocation exited2 with unknown verification mode; using scoped fmt/clippy/tests followed by final fast. No timing/RSS claims from build-host runs. Review-test ports66dfe4f3/95c3f51f pushed; implementation remains uncommitted until scoped gates pass.
r9 completed parser step91033b7c: additive cleanup-only capability16 and no-payload frames0x22/0x23, preserving foreground Signal. Golden/fragmented/borrowed/trailing-payload tests7 passed/1 ignored; scoped all-target clippy and fmt PASS. Existing fuzz target assertion smoke100000 executions with eight new cleanup seeds PASS (no coverage instrumentation claim). Eight shipped-linker/config tests PASS. Both pre-fix regressions have independent red receipts: RLR-4 existing_shell_stopped=false on frozen95c3f51f; RLR-5 AlreadyExists on PID-reuse fixture. Raw receipts retained for D262 attachment. No deployment.
r9 completed shim stepf33eccc7, pushed: cleanup targets the owned shell rather than only its foreground group; inherited-account shims adopt and retire detached descendants with the existing worker helper. ShellStopped follows reaping and bypasses output credit; normal ended sealing also follows descendant retirement. No account-wide scan or idle task. Shim library114 passed/14 ignored; original and expanded real rootless oracles PASS, including two revoked-person terminals, restart, foreground job, detached HUP/TERM-ignoring descendant and other-person survival. Immediate pidfd checks after acknowledgement PASS. fmt/scoped all-target clippy PASS. Shipped release build and perf comparison are pending; no new timing claims yet.
r9 completed cache stepe271bc21, pushed: publication staging names now use fresh UUIDs instead of PID-local counters. create_new, exclusive private directory ownership, immutable source checks and publication-only prune remain. RLR-5 RED AlreadyExists before; GREEN after. All15 active image-cache tests PASS (one ignored), including stale staging reclamation, hard-linked staging safety, in-flight launch retention, concurrent publication and running-image adoption. No cache scan added to existing-image adoption. fmt/scoped all-target clippy PASS; release/perf receipts pending.
r9 completed ownership step835403a5, pushed: rootless terminal reservations are durable before spawn under the person lock and survive cancellation/restart. Revoke fences opens first, authenticates cleanup peers and requires reaping proof;3s per peer and5s total, with false/error on unsupported, missing or unattributed older terminals. Retains identity while an ended shim remains viewed, so retries are idempotent. No account-wide termination or startup allocation/thread/timer. Public entrypoint selects rootless mode; existing unprivileged rootful-worker fixtures remain rootful simulations explicitly. Agent library84 passed/8 ignored (including all3 refusal tests); real daemon6/6 PASS; scoped all-target clippy/fmt PASS. First shipped static build finished; final source/hash confirmation and matched perf comparison follow. No deploy.
r9 completed regression stepf81e6b82 and contract stepd030d0a9, pushed. Expanded oracle covers restart, two revoked-person terminals, foreground and detached jobs, immediate reaping before acknowledgement, idempotent retry and preservation of the other person. All6 real-daemon tests PASS on835403a5 code, agent library84/8 ignored and shim114/14 ignored PASS. All-target scoped clippy/fmt PASS; parser assertion smoke100000/eight new seeds and8 linker tests PASS. Implementation frozen for final gate/perf atd030d0a9. First shipped static working artifact22187568 bytes, +20384 vs prior22167184: global D243 limit16404816 still fails; no waiver or budget change. Confirming final build recipe/hash before N200 and matched warm idle RSS on authorized perf VM. Existing iterate invocation is unsupported by this branch dispatcher (exit2), retained in receipts.
Head
d030d0a994: final scripts/verify fast exited1. All101 completed Rust suites,945 passed/0 failed/106 ignored; fmt, VT fmt, CLI compile-out, workspace all-target clippy and cargo-deny PASS. Static x86_64 stripped musl22187248 bytes/no PT_INTERP: D243 maximum16404816 remains FAIL; no budget waiver. Downstream aarch64/TypeScript rows not reached; no TypeScript touched. Final explicit pipeline artifactSHAf8f9db396fb002694d21ca264382f61e59e6184028ecf156c410c462c846a6ac; versionedge-20261013T101500Z/build marker1/default features/pinned1.99+LLD+CRT/current shipped linker configuration. +20064 bytes vs historical round8, +18912 vs rebuilt preceding runtime. Rebuilt previous95c3f51f (only review tests beyond5e87be79)22168336 bytes/SHAe0216729..., not byte-identical to historicalce55127...; no claim of identity. Rebuilt5db dev21857264 bytes/SHAd6bcdcb3... . Initial perf run rejected my scope name before any samples; corrected required infraternal-rl3-driver prefix and restarted locked original N200 quartet comparison. No source or gate changes. Verbatim head gate:Raw complete output will be attached with D262 receipts.
Perf fixture finding, no source change: first correct-scope run completed1600/1600 timings with0 failures and idle/map/canary reports, then actual controller preparation refused Invalid. VM stat proves current artifact mode0775 and staging directory0775 inherited from build-host umask002; login_binary::publish correctly refuses a group-writable source. Corrected only own VM artifact modes to0555/root0 and own staging directory0755, fsynced all3 files; SHA bytes unchanged. Kept complete preliminary receipts and first scope-name rejection. Repeating the entire locked N200/RSS/canary/controller/fallback run for definitive evidence. No security relaxation or budget waiver; historical5e rebuilt reference differs1152 bytes and hash from round8, explicitly not claimed byte-identical.
Corrected locked paired N200 run complete:1600 valid/0 failures/all units stopped; actual controller50 and host-su fallback2 PASS, cleanup0, preferred reuse/restart adoption/revoke fencing/other-person survival retained. Daemon scheduled slices0 before login10s, aftercontroller50 and fallback2. Matched warm/fsynced static idle N11 current4336/dev4564KiB, delta-228 PASS200: anonymous1104/1100(+4), file-backed3232/3464(-232), one thread/132KiB stack. Exact shipped currentSHAf8f9db...22187248 bytes. Paired current/previous p50ms later3.980/3.984, pre-opened4.173/4.158, cold46.863/46.502, production28.436/32.203. Cold/pre-opened absolute limits MISS for both heads; not claiming preservation of historical round8 from this run. VM4CPUs/kernel6.12.111, load.340/1.363/1.681 ->2.112/1.673/1.761. Initial permission-invalid run separately had both heads
56ms cold and5ms warm with higher initial load2.79. Repeating original single-artifact rotating quartet800-row N200 workload as round8; paired run switches two artifacts after four rotations and remains comparative evidence. No source change, workload boundary change, omitted failure or budget waiver. Final head fast already recorded:945 tests PASS; static size FAIL.r9 repair handoff: real-logins head
d030d0a994equals origin; eight atomic commits pushed. No merge/deployment/issue closure. RLR-4 and RLR-5 review regressions independently RED before fixes and GREEN after. Rootless revocation now persists person/session attribution before spawn under the person lock, survives restart/cancellation, retires the owned shell plus foreground/detached descendants, and replies only after reaping. Three-second peer/five-second total limits; missing, unsupported or unattributed older terminals fail honestly. Another person's shell survives; immediate pidfd exit checks and idempotent retry PASS. Staging copies use fresh UUIDs with create_new/private publisher locking/immutable validation/publication-only prune intact.Six real-daemon tests,15 active cache tests,84 agent and114 shim library tests PASS; codec golden/fragmented/borrowed/malformed and100000-execution seeded assertion-fuzz smoke PASS (no coverage instrumentation claim). Eight shipped-linker/config tests PASS; author checklist completed with unmet budgets marked. scripts/verify iterate is absent in this branch: attempted invocation exited2; scoped fmt/clippy/tests used instead.
Exact shipped static x86_64 musl recipe: pinned Rust1.99/LLD/CRT/default features/release/LTO/strip/current target ordering, explicit pipeline marker1/versionedge-20261013T101500Z. Current22187248 bytes/SHAf8f9db396fb002694d21ca264382f61e59e6184028ecf156c410c462c846a6ac, +20064 vs historical round8. Rebuilt preceding runtime5e87be79 (archive95c3f51f changes only tests)22168336/SHAe0216729... is NOT byte-identical to historicalce55127...; rebuilt5db baseline21857264/SHAd6bcdcb3... . No size waiver. Round6 GNU-896KiB is still unsuitable as shipped evidence.
Perf VM infraternal-perf-test/4 CPUs/kernel6.12.111, shared flock/CPUWeight10000 including real PAM scopes; all timings N200 per condition, real rc/original prompt boundaries. Corrected paired1600 rows/0 failures/0 unconfirmed stops, load.340/1.363/1.681 ->2.112/1.673/1.761. LATENCY TARGETS NOT CERTIFIED:
Canonical800-row single-artifact repeats retained: head later/pre-opened/cold/production4.364/4.450/51.239/33.467; preceding runtime3.863/4.011/43.660/27.847; head confirmation5.423/5.363/57.686/36.781. Every run0 failures/0 unconfirmed stops. Frozen production varies with serial runs; environmental drift is an inference, cause not proved. Paired heads are close but both miss absolute cold/pre-opened limits. Not claiming historical numbers preserved or choosing a best run. Harness omits remaining controller ensure/adoption/account/cache/server/browser costs as before; all per-stage distributions are attached.
Matched warm/fsynced static idle N11: current4336/dev4564KiB, delta-228 PASS200. Anonymous1104/1100(+4); file-backed3232/3464(-232), one thread/132KiB stack. Zero scheduled slices before first login10s, controller50 and fallback2. Controller50 PASS/preferred reuse/actual restart/adoption/revocation/other-person survival: daemonRSS/PSS8316/5272KiB; workers228896/54796KiB, PSS1095.92 per login x50. Actual host-su fallback2 PASS/cleanup0: daemon8216/6145; workers9148/5592KiB. No new dependency/engine/budget/owner fixture/UI changed.
Fixture mistakes retained: initial scope name rejected before samples; first paired run had group-writable staging permissions and correctly failed actual image publication after completing timings. Corrected own artifact modes0555/root0 and directory0755; repeated entire locked run without relaxing security. VM cleanup removed only owned UUID-linked records/cache image+lock/directories; bench account/rc/comparison preserved. First cleanup receipt hit missing workers in the failed preliminary report after removing records; idempotent retry completed remaining cleanup. Local own scratch cleanup follows.
D262 complete receipts: real-logins-r9-receipts.tgz,558660 bytes/SHA256f93ec275bb905e77369fe58d7ca5c9abcb0bf3641465b3dece7d852604606355. Includes all5600 raw timing rows (including preliminary), rejected fixture logs, head gate/red-green/lint/fuzz/linker/provenance/checklist and cleanup. Full gate headd030d0a9 exited1;101 suites/945 passed/0 failed/106 ignored. Verbatim:
Aarch64/TypeScript downstream rows not reached after D243 size failure; no TypeScript touched. Stopping for break-it review with correctness fixes passing, idle target passing, latency certification unresolved and global static size failing. Not merge-ready.
Independent review continuation: review-real-logins at
0e5b700a, targetd030d0a994, dev merge base8e7467c07c. Read #172 and prerequisite #159 history; no parent named. Preserved previous local review commits and merged target; tree matches target exactly. Verifying RLR-4/5 repairs, rootless cleanup partial failure/concurrency, codecs and full target gate. No implementation fixes, push/deploy or perf VM access; performance audit is receipt-only under this review brief.RLR-6 P1, local failing-test commit
3ef58804: rootless person revocation has no reserved admission at the shim peer pool (session.rs:644). A real terminal with32 authenticated SESSION_OWNER links refuses the cleanup connection before Hello. Actual result: owner_links=32, cleanup_confirmed=false, shell_stopped=false, reason=resource_unavailable. Test real_binary_rootless_revocation_is_admitted_at_full_shim_peer_capacity, backed by scripts/test-rootless-revoke-capacity.py, reproduces on unchangedd030d0a9executable. Host removal still retires authority after unconfirmed retries, leaving existing shells active (D240). No implementation fix/push. Normal Rust wrapper verification follows.RLR-7 P2, separate failing-test commit: the new rootless subreaper retains completed adopted jobs until shell exit/cleanup. Four pidfd-confirmed completed grandchildren remain4 zombies after a further successful terminal input barrier (shell usable). Test real_binary_rootless_terminal_reaps_completed_adopted_children / scripts/test-rootless-adopted-children.py. No host account-wide scan or signal; fixtures clean only their pinned descendants.
Completed normal Rust verification on local review-real-logins
c5d51c8f: cargo test --locked -p infraternal --test agent_daemon real_binary_rootless_ -- --nocapture --test-threads=1 exits101;4 passed/2 failed/2 filtered. Both new findings reproduce: RLR-6 P1 owner_links32/cleanup_confirmedfalse/shell_stoppedfalse/resource_unavailable (commit3ef58804); RLR-7 P2 completed_jobs4/unreaped_jobs4/shell_usabletrue (commitc5d51c8f). Existing rootless live revoke and expanded restart/descendant repairs PASS, plus explicit-state/readiness. Eight linker tests and5 harness tests PASS; fmt/diff check PASS. Target-tree full gate still running from sources compiled before review regressions. Author r9 receipt SHA256f93ec275bb905e77369fe58d7ca5c9abcb0bf3641465b3dece7d852604606355 matches;5600 retained timing rows and zero reported sample failures verified. Reported absolute latency misses retained; no independent performance/rootful PAM validation or perf VM use.Target verification milestone on
d030d0a9runtime (local review head c5d51c8f):101 native suites/945 passed/0 failed/106 ignored. fmt/VTfmt/CLI compile-out/workspace clippy/test/cargo-deny PASS; static optimized compilation pending. All prior RLR-1/2/3/4/5 regressions PASS, including63/64 ordinary control occupancy,64+16 reserve bound, stale staging recovery and expanded rootless restart/descendant cleanup. Both new review oracles independently FAIL (RLR-6 P1, RLR-7 P2); scoped test clippy and fmt PASS. 100000 shim-codec assertion-smoke executions/10 seeds PASS, no coverage instrumentation. Native debug artifacts removed only after the target test phase finished to reclaim own17GiB; full logs and native executable hash retained. No implementation fix/push/deploy/perf VM access. Final complete transcript and HOLD verdict follow static result.Independent
d030d0a9review receipts 1/4; local review-real-loginsc5d51c8f. Archive r9-review-receipts.tgz: 62017 bytes; SHA256 c6b3a38d1c103f7e6ca1ca967a5bfb55fc685aef11784bb0573d3e0be28b89dc. Contains the complete target fast log, both new red tests, scoped lint, codec smoke, linker/harness, patch, findings and provenance. Concatenate base64 blocks in order, decode and verify SHA256 before extracting. No implementation fixes, push, deployment or perf VM use.Lossless review receipt 1/4
Independent
d030d0a9review receipts 2/4; local review-real-loginsc5d51c8f. Archive r9-review-receipts.tgz: 62017 bytes; SHA256 c6b3a38d1c103f7e6ca1ca967a5bfb55fc685aef11784bb0573d3e0be28b89dc. Contains the complete target fast log, both new red tests, scoped lint, codec smoke, linker/harness, patch, findings and provenance. Concatenate base64 blocks in order, decode and verify SHA256 before extracting. No implementation fixes, push, deployment or perf VM use.Lossless review receipt 2/4
Independent
d030d0a9review receipts 3/4; local review-real-loginsc5d51c8f. Archive r9-review-receipts.tgz: 62017 bytes; SHA256 c6b3a38d1c103f7e6ca1ca967a5bfb55fc685aef11784bb0573d3e0be28b89dc. Contains the complete target fast log, both new red tests, scoped lint, codec smoke, linker/harness, patch, findings and provenance. Concatenate base64 blocks in order, decode and verify SHA256 before extracting. No implementation fixes, push, deployment or perf VM use.Lossless review receipt 3/4
Independent
d030d0a9review receipts 4/4; local review-real-loginsc5d51c8f. Archive r9-review-receipts.tgz: 62017 bytes; SHA256 c6b3a38d1c103f7e6ca1ca967a5bfb55fc685aef11784bb0573d3e0be28b89dc. Contains the complete target fast log, both new red tests, scoped lint, codec smoke, linker/harness, patch, findings and provenance. Concatenate base64 blocks in order, decode and verify SHA256 before extracting. No implementation fixes, push, deployment or perf VM use.Lossless review receipt 4/4
HOLD (P0/P1 present) — do not merge. Independent review target
d030d0a994; final local review-real-logins headc5d51c8ffb. Counts: P0=0, P1=1, P2=1, P3=0.RLR-6 P1: 32 authenticated ordinary SESSION_OWNER links fill the shim peer pool; rootless person revocation returns resource_unavailable and the pinned existing shell stays alive. Admission fails before Hello/StopShell. Host removal continues after unconfirmed retries. Failing normal Rust test real_binary_rootless_revocation_is_admitted_at_full_shim_peer_capacity; commit
3ef5880468.RLR-7 P2: four controlled adopted grandchildren complete on pinned pidfds, but all four remain zombies after another successful terminal input barrier. The new rootless subreaper has no ordinary adopted-child reap path. Failing normal Rust test real_binary_rootless_terminal_reaps_completed_adopted_children; commit
c5d51c8ffb.Both new normal Rust tests FAIL (4 prior rootless tests PASS, 2 new failures). RLR-1/2/3/4/5 repairs PASS, including restart/descendant cleanup, explicit state, stale staging and 64+16 control capacity. Workspace target fmt/clippy/test/cargo-deny PASS; review integration clippy/fmt PASS; 8 linker and 5 harness tests PASS. Shim codec seeded assertion smoke 100000 executions / 10 seeds PASS without coverage instrumentation; no coverage-guided claim.
Target-tree scripts/verify fast exited 1: 101 native suites, 945 passed, 0 failed, 106 ignored. Native gate source compiled before deliberate review regressions; runtime and dependencies match
d030d0a9exactly. Static 22187248 bytes matches the author's byte count; no byte-identity or performance claim. Aarch64/TypeScript downstream rows not reached after static-size failure; no budget waiver. Review adds tests only.Author r9 archive SHA256 f93ec275bb905e77369fe58d7ca5c9abcb0bf3641465b3dece7d852604606355 matches; provenance and 5600 retained timing samples / zero reported sample failures validated. Author absolute cold/pre-opened latency misses remain. No independent timing/RSS/rootful PAM run, perf VM access, implementation fix, push, deployment or issue closure.
Complete target gate/red tests/lint/parser/linker/harness/patch/provenance receipts are preserved in the preceding four lossless issue comments: r9-review-receipts.tgz, 62017 bytes, SHA256 c6b3a38d1c103f7e6ca1ca967a5bfb55fc685aef11784bb0573d3e0be28b89dc. Findings appended to /home/kayg/.local/state/codex-jobs/infraternal/review-real-logins/findings.md. Only own scratch/generated caches will be removed after this comment succeeds.
Verbatim target gate:
Cleanup verified: review-real-logins remains
c5d51c8ffb; worktree clean. Removed only this review target symlink, generated scripts bytecode and real-logins-review scratch/build/receipt staging after all four lossless receipts and HOLD verdict were posted. Required findings file retained. Complete target fast transcript already preserved; 945 native tests PASS, static-size FAIL. No implementation fixes, push, deployment, perf VM access or issue closure.r10 repair start: branch real-logins, base
d030d0a994; clean worktree. Read latest HOLD RLR-6/RLR-7 and prerequisite #159 history. Porting review commits 3ef58804/c5d51c8f, retaining red receipts. Proposed additive dedicated inherited-account cleanup rendezvous (.cleanup): authenticated connection requests shell/descendant retirement, outside ordinary links/input/output/owner quotas; fixed proof follows reaping. Existing bit-4 cleanup stays compatible. Audit all bounded login structures and test ordinary queue, links and both at/beyond capacity. Ordinary SIGCHLD must reap adopted jobs without consuming main-shell status. Previous shipped paired p50 later/pre-opened/cold 3.980/4.173/46.863ms; idle delta -228KiB (+4 anonymous/-232 file-backed), zero scheduled slices; absolute pre-opened/cold limits already missed. Will pair shipped perf-VM measurements if code layout/hot path changes. No deploy or merge; stop for review after final head fast. Branch dispatcher lacks iterate; retain attempt and use scoped checks.r10 audit finding: embedded.rs:32/1168 reserves only16 cleanup pending calls, and WeakEmbeddedAgent::revoke_login uses the same bounded64 command sender as ordinary work. This is another instance of the reviewed starvation class; added a pre-fix test requiring cleanup17 through32 with64 ordinary pending. login.rs:221 drains accepts until empty before returning to lifecycle signals; each request can wait2s. Planned dedicated authenticated cleanup listener for both inherited terminals and account workers, checked before ordinary accepts; one replaceable proof recipient, no decoder/input/owner table. Ordinary32 links,512 writer cursors,1MiB input/decoder,ring/output backpressure,worker512leases,discovery32 handshakes,plugin8jobs,stream table and reply8 queues must not gate cleanup. Login identity cache256 overflow validates through slow path, not admission failure. Per-person/account flock is a correctness fence, not quota; blocking acquire currently shares Tokio blocking pool and will be changed to cancellable nonblocking acquisition so queued locks cannot consume its capacity. Host registration10000 cap checks existing registrations before capacity; revoke performs lookup only. Wire frame/JSON limits remain validation, not lifecycle capacity. Detailed completed audit and limit/beyond-limit evidence follow.
Completed/pushed reaping step11b3b4a7: inherited-account SIGCHLD reaps completed adopted jobs, excluding the main shell so its exit status remains owned. No idle scan/timer. Shim library115 passed/14 ignored; scoped all-target clippy/fmt PASS. Ported review oracles e1b32b6c/af047a4e. Review RLR-7 red receipt remains4 zombies/4 completed; first local build picked up the reaping change before compiling the shim library, so its5-pass/1-fail integration receipt is mixed source and not a pre-fix P2 reproduction. It independently reproduces capacity P1:32 links, cleanup_confirmed=false, shell_stopped=false. Added reserve-class regression also independently RED: with64 ordinary+16 unanswered cleanup calls, cleanup17 returns Unavailable instead of reaching the peer. Initial standalone server invocation omitted remote feature and ran0 tests; corrected --features remote ran1/failed1. iterate remains unsupported(exit2). Dedicated endpoint suffix changed from proposed.cleanup to.stop, preserving .sock pathname length; no contract weakening. Baseline shipped static rebuild
d030d0a9underway in own archive using one target directory.Completed/pushed shim readiness911acf40, rootless controller01d1ab32, worker readinessd0b1d16a, lock-fence29ddf6a0; reserve regressioncb14c0c5. Dedicated.stop uses a fixed ! byte AFTER kernel peer authentication (rather than connection itself), retaining D235 pinned-worker checks before retirement. New shims have one replaceable receipt recipient outside links/cursors/input; requested cleanup survives disconnect and proof follows complete reaping. Worker checks lifecycle readiness before each ordinary acceptance. No idle allocation/thread/timer in the daemon. Gates: shim116 passed/15 ignored; agent86/8 ignored; rootless6/6; server revocation4/4; combined real shell64 pending+64 queued+32 owners and32 owner overflow PASS; worker512 held leases, refused513th,64 stalled connects and S retirement proof PASS. Blocking-pool regression independently RED on d030 archive with one held pool slot; GREEN without that pool. Clean shipped d030 baseline independently RED4 adopted zombies/4 completed, confirming review P2. Earlier mixed-source/fixture failures retained, not waved away. Final stamped release/perf and head fast pending; no deployment.
Lifecycle admission audit
Author checklist
r10 implementation frozen and pushed: real-logins
d27fd50503. Review ports e1b32b6c/af047a4e; fixes split by reaping, shim readiness, rootless caller, worker readiness, lock fencing, worker caller, server mailbox, regressions, decoder reuse and contract. No merge/deployment or issue closure.All reviewed regressions pass. Dedicated authenticated .stop readiness bypasses ordinary owners/writers/input and worker leases/backlog; one replaceable recipient, fixed shared/fuzzed stop decoder, proof only after reaping. Typed server lifecycle mailbox bypasses command/pending quota and cancellation. Flock acquisition avoids the bounded shared blocking pool. Full bounded-structure audit already posted; legacy older bit4 capacity refusal and physical transport/FD failure remain honest errors.
Gates: six rootless cases pass; class limits are covered by combined real 64 pending + 64 queued + 32 owners (32 owner overflow), worker 512 leases + overflow + 64 stalled connects, 96 mailbox requests, cancellation/late proof, and blocking-pool saturation. Shim library 116 active / 15 ignored; agent 86 / 8; actor 26 / 3; revocation 4/4; shipped combined gate 1/1. Eight linker/config and 21 harness tests pass. Both parser assertion smokes 100,000 executions pass; no coverage instrumentation. Pre-fix red receipts retained for links, four adopted zombies, reserve overflow and blocking pool. Full final gate pending static link; 101 native suites / 952 passed / 0 failed / 108 ignored already complete; fmt/clippy/deny pass.
Shipped paired performance
Machine infraternal-perf-test,4 CPUs/Linux 6.12.111; shared flock and actual PAM CPUWeight10000. N=200 per condition/source,1,600 valid / 0 failures / 0 unconfirmed unit stops. Same r9 announced/prestarted/original rotating quartet harness, alternating sources after four rotations. Load [0.1103515625, 0.08984375, 0.45654296875] -> [1.845703125, 0.76025390625, 0.6630859375].
All three login paths are slightly faster than paired baseline in this run. Both artifacts miss all absolute latency limits; historical round7/8 values are not certified on this head. No best-run selection or budget waiver. The harness still omits remaining ensure/adoption/account/lock/image/server/browser costs; actual controller checks below cover functionality, not full UI latency.
Independent stage medians must not be summed.
Idle and scale
Matched warm/fsynced alternating N=11 static idle: head 4,420 / dev 4,564 KiB, delta −144 KiB, within200KiB growth. Anonymous 1,104 / 1,100(+4); non-anonymous 3,316 / 3,464(-148), including4KiB unchanged kernel mappings. ELF private clean3312/3460(-148). One thread,132KiB virtual stack/52KiB resident stack,4KiB heap. No prepared login state at this boundary. This is the production static recipe, not the round6 GNU -896KiB result.
controller scale50: checks PASS, cleanup_failures[], idle scheduled_slices0; daemonRSS/PSS8208/5207KiB, workerRSS/PSS229708/54658KiB; mean workerPSS1093.16KiB ×50. Workers only; total host memory including shims/shells/manager is not claimed.
fallback scale2: checks PASS, cleanup_failures[], idle scheduled_slices0; daemonRSS/PSS8100/6069KiB, workerRSS/PSS9184/5608KiB; mean workerPSS2804.00KiB ×2. Workers only; total host memory including shims/shells/manager is not claimed.
Before-first-login canary10s also has0 scheduled slices. After login, the daemon has2 idle threads in both measured paths, with0 slices. Real preparation reuse, restart adoption, revocation fencing and another person surviving all pass.
Provenance and limits
Exact artifacts/recipe/hashes are in artifact-provenance.json; VM hash preflight matches. Source d030/dev5db rebuild byte counts match prior receipts but hashes differ; no byte-identity claim. Head 22,204,784 bytes, +17536 vs rebuilt d03022187248; D243 maximum16404816 remains failed. No new dependency/engine/budget/deployment/merge.
Perf cleanup removed258 own registry/cache files plus own VM/account/fixture directories; shared comparison artifact, bench account and rc preserved.
r10 repair finished; stopping for break-it review. Branch real-logins head
d27fd50503equals origin/real-logins; 13 atomic commits pushed. Worktree clean, no merge/deployment or issue close.RLR-6/RLR-7 pass: independent authenticated lifecycle endpoints and typed server mailbox bypass ordinary command/pending/link/owner/writer/input/lease quotas; cleanup owns retirement through caller cancellation and acknowledges only after reaping. Main-shell status remains owned; completed adopted jobs are released on SIGCHLD. No extra idle thread or daemon polling; contended lock acquisition cannot consume the shared blocking pool. Full bounded-structure audit posted above.
Real simultaneous gate: 64 pending calls + 64 queued commands + 32 owner links; command65 and32 extra owners refused, pinned shell stopped before proof. Worker gate:512 ended-but-held leases + overflow513 refused +64 stalled connects; S proof/retirement pass. Six rootless regressions (restart, all shells/detached jobs, another person survives) pass; shipped static combined gate1/1. Shim116 active/15 ignored; agent86/8; actor26/3; revocation4/4. Both 100,000-input parser assertion smokes pass without coverage instrumentation. Eight shipped-linker tests and21 harness tests pass. Red receipts retained for all reviewed bugs plus reserve/pool starvation. Legacy older shims may honestly refuse at their old capacity; no fabricated success.
Exact shipped static recipe: pinned1.99/LLD/CRT/default features/LTO/strip/current target ordering, explicit pipeline marker1/versionedge-20261013T101500Z. Head22,204,784 bytes/SHA642d1ae8f9dec6c02e249b5f817cc51a7322a1a7811a59ad51ed1b7cd9cd9441; +17,536 vs rebuilt d03022,187,248/SHAf05ad3e...; dev5db21,857,264/SHA55bd4a... . Rebuilt references match prior byte counts but differ in hash; no byte-identity claim. Round6 GNU -896KiB was NOT this shipped recipe; latest shipped idle is -144KiB below dev.
Perf VM4CPUs/Linux6.12.111, shared flock and actual PAM CPUWeight10000; original r9 rotating quartets/N200 per source,1600 valid/0 failures/0 unconfirmed stops. Load0.110/0.090/0.457 ->1.846/0.760/0.663. Paired results preserve relative speed; absolute historical round7/8 targets remain NOT CERTIFIED:
Matched warm/fsynced static idle N11: head4420/dev4564KiB, delta-144 PASS200. Anonymous1104/1100(+4), non-anonymous3316/3464(-148; includes unchanged kernel4). One thread/132KiB virtual stack/52KiB resident stack, heap4KiB. Zero scheduled slices before first login10s, actual controller50 and host-su fallback2. Controller50 PASS/reuse/restart/adoption/revoke/other-person survival; daemonRSS/PSS8208/5207, workers229708/54658KiB, meanPSS1093.16KiB ×50. Fallback2 PASS/cleanup0; daemon8100/6069, workers9184/5608KiB. No full browser/API latency claim; original harness omissions and all stage distributions retained.
D262 complete receipts: real-logins-r10-receipts.tgz,269616 bytes/SHAb0f1538719cec87f4f06f057ac21e6f3f33e58236a7d61d16047e5e9c7bc9e1b. Contains complete final fast transcript, red/green/scoped/scale/fuzz/linker/harness gates, raw1600 timing rows and stages, RSS/maps/zero/controller/fallback, exact harness/provenance, audit/checklist, source patch/history and VM cleanup. Initial mixed-source red run, partial fixture reads, interrupted wrong-cwd dev build and read-only staging overwrite retained transparently; no measurements use incorrect artifacts.
VM cleanup removed258 own registry/cache files plus own VM/account/fixture directories; comparison artifact, bench account and rc preserved. Local generated bytecode removed; own build/scratch cleanup follows this receipt.
Final head scripts/verify fast exited1:101 suites/952 passed/0 failed/108 ignored; fmt/VTfmt/CLI compile-out/workspace clippy/cargo-deny PASS. Only D243 static-size FAIL; no waiver. Aarch64/TypeScript downstream rows not reached; no TypeScript touched. Full transcript attached. Verbatim:
Cleanup complete: real-logins head
d27fd50503equals origin; worktree clean. Removed own build target, source archives, artifact copies and receipt staging after D262 attachment/finish comment succeeded; generated scripts/.cargo bytecode absent. VM cleanup258 own registry/cache files and own paths recorded in receipts; shared bench/comparison/rc preserved. Archive b0f1538719cec87f4f06f057ac21e6f3f33e58236a7d61d16047e5e9c7bc9e1b already attached. Final fast952 tests PASS, only static sizeFAIL; paired absolute latency misses disclosed. Stopping for break-it review; no merge/deploy/issue close.Independent delta review started on review-real-logins at
226bfe3a; targetd27fd50503, merge base with dev8e7467c07c. Read #172 and prerequisite #159 history; no parent named. Preserved prior review commits and merged target; review tree exactly matches target. Recheck RLR-1 through RLR-7 and probe new independent lifecycle admission, cancellation and cleanup proof. No implementation fixes, push, deployment or perf VM use; performance verification is receipt-only under this brief. Prior findings file is absent despite prior cleanup comments; issue history remains the record.Independent review step at
226bfe3a: review tree matchesd27fd505; prior review history preserved. Author r10 receipt archive SHA b0f1538719cec87f4f06f057ac21e6f3f33e58236a7d61d16047e5e9c7bc9e1b matches, provenance points to target, all 8x200 rows/zero reported failures and rounded floor-index p50 values validate. Head later4.227/pre-opened4.314/cold49.268ms misses absolute limits; no independent timing claim. Eight shipped linker/config tests and five functional harness tests PASS. Target scripts/verify fast is building; preparing cancellation/stalled-handshake probes. No implementation changes, push, deploy or VM access.RLR-8 P2, local failing-test commit
9b621cba: ### RLR-8 — P2 — Disconnected lifecycle sender discards a complete admitted requestd27fd50503.9b621cba(local review-real-logins; implementation unchanged). Normal Rust wrapper verification pending.RLR-9 P2, local failing-test commit
ee391b2d: ### RLR-9 — P2 — Retired rootless terminal attribution accumulates without a boundd27fd50503.ee391b2d(local review-real-logins; implementation unchanged). Normal Rust wrapper verification pending.RLR-10 P2, local failing-test commit
aee92ccb: ### RLR-10 — P2 — Ordinary worker handshakes consume the independent cleanup deadlined27fd50503.aee92ccb(local review-real-logins; implementation unchanged).RLR-8 normal Rust wrapper independently FAILS:0 passed/1 failed, owned_shell_stopped=false.
Review completed step at
aee92ccb95(local review-real-logins): all three new normal Rust regressions FAIL independently, one each. RLR-8 P2 complete admitted !+EOF retains its shell; RLR-9 P2 eight sealed retired shells/zero live shims leave records1..8; RLR-10 P2 two incomplete ordinary handshakes consume the production cleanup proof deadline, with later S/retirement after release. No implementation changes.Scoped shim/integration all-target clippy-Dwarnings and fmt PASS. Combined real gate PASS:64 pending+64 queued+32 owners, command65 and32 owner overflow refused, cleanup/pinned shell proof true. Worker scale gate PASS:512 held leases/overflow513 refused/64 stalled connects/S proof in its existing five-second fixture window; new production-deadline regression stays red. Login and shim-codec assertion smokes each100000 executions/10 seeds PASS, no coverage instrumentation. Original head fast gate still running; six prior rootless cases already PASS. No push/deploy/VM access. Current new counts P0=0,P1=0,P2=3,P3=0; final verdict waits for complete target gate.
r11 started: real-logins base
d27fd50503; worktree clean. Read #172/prerequisite #159 history and RLR-8..10 findings; neither names a parent. Porting9b621cba,ee391b2d,aee92ccb, reproduce before repair. Minimal cleanup fixes: consume queued stop before EOF, release attribution only after sealed retirement, service accepted worker cleanup before another ordinary handshake. Earlier limit regressions stay enabled. Paired shipped perf run if login path changes. Latest r10 p50 later/pre-opened/cold4.227/4.314/49.268ms already miss absolute limits; idle delta-144KiB. No merge/deploy; atomic commits/push; final fast verbatim then stop for verification.Completed/pushed RLR-8 fix1aa694c05d550928aa28ecd71e39a727fa587c93; review ports d286486f/8570f9f0/6f5a0d00 preserved separately. Complete queued ! is consumed before disconnect retires only its recipient. Local pre-fix real-shell test independently FAILS owned_shell_stopped=false; fixed real-shell test1/1 and cleanup units2/2 PASS; scoped shim all-target clippy and fmt PASS. All three review failures reproduced locally: RLR-9 retained records1..8 with zero live shims; RLR-10 incomplete handshakes2 return WouldBlock before S. RLR-9 receipt includes the RLR-8-only repair, which does not change attribution. Initial standalone RLR-10 command omitted host-login; corrected explicit-feature regression ran1 and FAILED; no zero-test success claim. iterate unsupported(exit2); using scoped gates. Static baseline build/perf pairing pending.
Completed/pushed RLR-10 fix005e499ab2a90c922c7f7dc6ed8266d9a854d0c5. After kernel credential admission, Cleanup.accept consumes an already queued fixed stop request before a worker enters another ordinary receive. Explicit-feature pre-fix worker regression FAILS WouldBlock with2 incomplete requests; fixed regression PASS cleanup_confirmed=true/S and retirement. Cleanup units3/3, all-target shim clippy/fmt PASS; full shim run still finishing unchanged VT corpus. Rejected larger proof deadlines or weakening ordinary framing/identity. No new thread, quota, or idle polling. RLR-9 removal is next; it will require validated sealed proof and tolerate concurrent removal by revocation. Paired shipped baseline build is still pending; no performance claim yet.
Completed/pushed RLR-9 repair; SHA follows in the next receipt. Shim retirement seals .ended after complete descendant cleanup, then validates and removes only that session's person records before socket guard retirement. No daemon-only watcher, startup state, idle timer or extra thread. Revocation handles concurrent removal and requires sealed proof before accepting a present socket without attribution. Original eight-cycle review test was RED records[1..8]/live_shims0; now eight rootless regressions PASS, agent86/8ignored, cleanup4/4, scoped all-target clippy/fmt PASS. Unit safety preserves other/unsealed terminals and rejects symlink/nonempty records. RLR-10 full shim118/15ignored PASS. Existing rootless restart/descendant/other-person/capacity cases remain green. Shipped baseline/perf build still pending; no new timings claimed.
RLR-9 completed SHA
bc7d1ca759(pushed). Additional same-class finding on that head: replacing an unread authenticated cleanup peer drops a complete queued !+EOF before retirement owns it. Deterministic actual Unix-socket unit recipient_replacement_keeps_a_complete_queued_request_owned independently FAILS 0/1: replacement discarded admitted cleanup (cleanup.rs:250). Fix is to consume the old authenticated request before replacing its proof recipient; no new recipient capacity/queue. Red/green receipts retained. Static d27 baseline now built from its own archived source with the exact shipped pinned/LLD/musl/default-feature/LTO/strip production marker recipe; paired measurement waits for final head artifact.r11 code frozen/pushed56b67e98dc18e1ee2d5f51c2b9aa61c473637c58. Additional recipient-replacement regression independently RED0/1; consume old authenticated byte before replacing one proof recipient, now cleanup5/5 and production worker deadline1/1 GREEN. Final fmt/clippy PASS; initial fmt assertion-wrapping receipt retained/corrected. No new bounded lifecycle resource, idle activation, dependency, engine, wire field or owner decision. Dedicated request ownership is independent of recipient disconnect/replacement; proof remains after reaping. Full fast is running on frozen head; shipped head static build and paired N200 perf/idle/controller checks pending. Rebuilt d27 shipped baseline22204752bytes/SHA92089d3db3d0acd172147c885bed1521cc832d5b8b21397f86c309197a02dca2;32bytes smaller than historical r10 count22204784, hash differs. No byte-identity claim; paired inputs use explicit identical production marker/version and source-owned shipped target configuration. Absolute historical r10 latency misses remain disclosed, not waived.
Paired shipped-static measurement
Frozen head56b67e98, rebuilt baseline
d27fd505. Authorized infraternal-perf-test,4CPUs/Linux6.12.111+deb13-amd64; shared flock-w3600 held only for measurements; driver and actual PAM session CPUWeight10000. Identical explicit production marker/version, pinned1.99/LLD/musl/default features/LTO/strip/shipped ordering. Artifacts and exact hashes in artifact-provenance.json; VM preflight hashes match. Baseline differs from historical r10 by-32bytes and hash; no byte-identity claim.Original rotating quartet harness, switch source after4 rotations; N200 per condition/source,1600 valid samples/0 failures/0 unconfirmed stops. Actual bench zsh/system startup files; no rc modification or stored terminal transcript. Load1.185/1.185/0.715 ->3.413/2.056/1.091.
The later/pre-opened point estimates rose0.109/0.079ms; cold fell0.646ms. Paired four-rotation-block bootstrap95% intervals from VM samples,10000 resamples/seed17211: later[-0.078,0.227], pre-opened[-0.111,0.228], cold[-3.741,1.717]ms. Each includes0; no measured causal regression or speedup established. Keep exact raw values rather than choosing a faster repeat. Both inputs continue to miss all absolute login latency limits; historical round7/8 absolute success is NOT recertified. Reliability changes add no ordinary terminal-path operations; their measured trade is correctness with unchanged idle RSS and no resolved latency effect in this paired run.
Independent stage medians must not be summed. The original harness still omits remaining ensure/adoption, account/lock/image/server/browser costs. Actual controller checks below cover functionality, not full UI latency.
Idle and scale
Matched warm/fsynced alternating N11 static idle: head4420/baseline4420KiB, delta0. Anonymous1104/1104, non-anonymous3316/3316 (including unchanged kernel4); ELF private clean3312/3312. One thread,132KiB virtual stack, heap4KiB. Mapping study executable RSS2672/2672KiB. No prepared login state at this boundary. The unchanged harness names its second input dev and its boundary debug; in THIS run both inputs are shipped static release artifacts, and dev means the rebuilt d27 baseline. No new absolute-versus-dev claim; r10's actual dev comparison was-144KiB. This run proves no added idle RSS against that accepted source baseline.
Zero scheduled slices: before-first-login10s/1thread, actual controller50/2threads, real host-su fallback2/2threads. Controller50 checks PASS (preferred preparation reused, separate people, actual restart/adoption, revocation fences new opens, other person survives); cleanup_failures[]. DaemonRSS/PSS8340/5277KiB, workers229716/54666KiB; mean workerPSS1093.32KiB ×50. Fallback2 checks PASS/cleanup[]; daemon8296/6180KiB, workers9184/5608KiB; mean workerPSS2804KiB ×2. These are worker totals, not the complete host footprint with shims/shells/manager. All measurements are from the authorized VM, not build-host test durations.
Head artifact22208400bytes/SHA160038cbdf7edba44f8cde3c2029c40b716691892d0539824b4a7f07fee27403, baseline22204752/SHA92089d3db3d0acd172147c885bed1521cc832d5b8b21397f86c309197a02dca2; growth3648bytes. D243 max16404816 remains failed; no waiver or size-budget change.
r11 finished; stopping for verification. Branch real-logins head56b67e98dc18e1ee2d5f51c2b9aa61c473637c58 equals origin/real-logins;7 atomic commits pushed (3 unchanged review ports,4 reliability fixes). No merge/deployment/issue closure.
RLR-8 complete admitted cleanup survives sender EOF; RLR-9 sealed rootless retirement releases attribution instead of retaining records1..8; RLR-10 queued worker cleanup is read before another ordinary handshake consumes its proof deadline. Additional same-class recipient-replacement regression failed independently and now passes. Authenticated requests remain owned independently of one replaceable proof recipient; no new capacity, idle timer, thread or eager state. Peer credentials, D235 process/unit/parent pins, fixed shared/fuzzed stop decoder and proof after shell/descendant reaping remain. Live/unsealed/other-person records are preserved; unsafe linked/nonempty records refuse. Author checklist is in receipts.
Gates: all3 review failures reproduced before their fixes;8 real rootless regressions pass,5 cleanup safety units pass, worker production-deadline1/1, agent86/8ignored, linker8/8, harness5/5. Explicit limits PASS:512 leases+overflow513+64 stalled connects/S proof;64 ordinary pending+64 queued commands+32 owners, command65/32 owner overflow refused, pinned shell stopped before proof. Final head fast:101 native suites/959 passed/0 failed/108 ignored; only D243 static-size FAIL. No timeout baseline exception, tests weakened, budget waiver or new parser/fuzz coverage claim. Aarch64/TypeScript downstream rows not reached; no TypeScript changed.
Paired actual shipped-static artifacts, authorized4CPU perf VM/Linux6.12.111, shared flock-w3600 and actual PAM CPUWeight10000, original rotating quartet/N200 per source,1600 valid/0 failures/0 unconfirmed stops. Load1.185/1.185/0.715 ->3.413/2.056/1.091. Exact pipeline recipe/hashes in artifact-provenance.json; rebuilt d27 differs from historical count by-32bytes/hash, no byte-identity claim.
Later/pre-opened point changes+0.109/+0.079ms, cold-0.646ms; paired4-rotation bootstrap95% intervals [-0.078,0.227]/[-0.111,0.228]/[-3.741,1.717]ms each include0. No causal regression or speedup established; exact raw first run retained. Both sources still miss absolute latency targets; historical round7/8 success is NOT certified on head. Harness omissions (remaining controller/account/lock/image/server/browser costs) remain explicit; no full UI latency claim. All per-stage distributions retained.
Matched warm/fsynced N11 idle head4420/d274420KiB, delta0; anonymous1104/1104, non-anonymous3316/3316, ELF private clean3312/3312;1 thread/132KiB virtual stack/heap4. The raw harness field dev names the rebuilt d27 in THIS pair, not a new origin/dev sample. Historical r10 actual dev delta-144KiB is not a new r11 claim. Zero scheduled slices before first login10s, controller50 and host-su fallback2. Controller50 preferred preparation/reuse, separate people, real restart/adoption, revocation fencing/other-person survival PASS; cleanup[]. DaemonRSS/PSS8340/5277KiB, workers229716/54666KiB; mean workerPSS1093.32KiB ×50. Fallback2 PASS/cleanup[]/idle0; daemon8296/6180, workers9184/5608KiB. Worker totals exclude shims/shells/manager.
Shipped head22208400bytes/SHA160038cbdf7edba44f8cde3c2029c40b716691892d0539824b4a7f07fee27403, rebuilt d2722204752/SHA92089d3d...; growth3648bytes. Global D243 max16404816 remains failed, no waiver. Gate default-marker artifact has the same byte count and distinct hash9e90320b...; perf uses the explicit production pipeline artifact.
D262 complete receipts: real-logins-r11-receipts.tgz,254938bytes/SHA9a72fc6995037582d17e70d26fe6eddadebabed81f31de607d973b55c2522b0d. Full fast transcript, raw red/green/scoped/limits/linker/harness tests, source patch/history, audit, exact harness/provenance and1600 timing rows/stages/paired analysis/RSS/maps/zero/controller/fallback included. Initial zero-test missing-feature invocation, fmt assertion-wrap correction and scratch cleanup IsADirectoryError retained transparently; corrected before completion. VM52 own person records absent, own image/private lock/short roots and VM/account artifact directories removed; shared comparison/bench account/rc preserved. Local own scratch/bytecode cleanup follows successful finish comment.
Final scripts/verify fast exit1, verbatim:
Cleanup confirmed after D262 upload/finish: real-logins head56b67e98dc18e1ee2d5f51c2b9aa61c473637c58 equals origin; worktree clean, git diff --check clean. Removed only this run's known local build target, source archive, artifacts, receipt staging, failed-test fixture and generated scripts/.cargo bytecode. Own VM fixture/image/private lock/short roots and VM/account artifact directories were already removed;52 person records absent, shared bench/comparison/rc preserved. Uploaded complete receipt254938bytes/SHA9a72fc6995037582d17e70d26fe6eddadebabed81f31de607d973b55c2522b0d remains attached. Final head fast959 tests PASS; only static-size FAIL, absolute latency misses disclosed above. Stopping for verification; no merge/deploy/issue close.
Independent r11 verification started on review-real-logins at
a91f8c1e; target56b67e98dc, merge base with local dev8e7467c07c. Prior local review history preserved by merging target; tree matches target. Read #172 and prerequisite #159 comments (no parent named), contracts and report. Rechecking RLR-8/9/10 repairs and partial-failure boundaries; target fast gate running. No implementation fixes, push/deploy or perf VM access; performance audit is receipt-only.RLR-11 P2, local failing-test commit
0e03fb7792: rootless_sessions.rs:76-98 treats a live private readiness probe as an older unattributed person terminal. Real head binary: private_probe_present=true, person_terminals=0, cleanup_confirmed=false; revocation returns resource_unavailable. Complete the fixed canary and identical revocation succeeds. Test real_binary_rootless_private_readiness_does_not_refuse_person_revocation in crates/infraternal/tests/agent_daemon.rs, backed by scripts/test-rootless-revoke-readiness.py; normal Rust wrapper run pending. No implementation change, push or performance claim. Prior rootless repairs all PASS in the target gate so far; author r11 archive hash and target provenance verified, eight linker tests PASS.Review step at local head0e03fb77: RLR-11 normal Rust integration wrapper independently FAILS0/1, reason resource_unavailable while private_probe_present=true/person_terminals=0; same revocation succeeds after completing the real canary. Review fmt/all-target integration clippy-Dwarnings PASS. Worker production-deadline gate1/1 PASS (2 incomplete ordinary requests, S proof); scale gate1/1 PASS (512 leases, overflow513 refused,64 stalled connects). Eight linker tests PASS; login/shim assertion smokes each100000 inputs PASS without coverage instrumentation. Author archive SHA9a72fc6995037582d17e70d26fe6eddadebabed81f31de607d973b55c2522b0d matches, exact target provenance and all1600 rows/p50 summaries validate. Full unchanged-target fast gate still running; no implementation change/push/deploy/VM access.
Independent
56b67e98review receipts 1/3; local review-real-logins head0e03fb7792. Archive r11-review-receipts.tgz: 46239 bytes, SHA256 1c83e164326a2d6e97531dd707c20f6e0a33ccd3dfed06f9639a474aba12724b. Complete target fast log, new Rust/Python red test, worker deadline/scale/combined-capacity, lint, parser smokes, patch, findings and provenance. Concatenate base64 blocks in order, decode and verify SHA256 before extracting. No implementation fix, push, deployment or perf VM use.Lossless review receipt 1/3
Independent
56b67e98review receipts 2/3; local review-real-logins head0e03fb7792. Archive r11-review-receipts.tgz: 46239 bytes, SHA256 1c83e164326a2d6e97531dd707c20f6e0a33ccd3dfed06f9639a474aba12724b. Complete target fast log, new Rust/Python red test, worker deadline/scale/combined-capacity, lint, parser smokes, patch, findings and provenance. Concatenate base64 blocks in order, decode and verify SHA256 before extracting. No implementation fix, push, deployment or perf VM use.Lossless review receipt 2/3
Independent
56b67e98review receipts 3/3; local review-real-logins head0e03fb7792. Archive r11-review-receipts.tgz: 46239 bytes, SHA256 1c83e164326a2d6e97531dd707c20f6e0a33ccd3dfed06f9639a474aba12724b. Complete target fast log, new Rust/Python red test, worker deadline/scale/combined-capacity, lint, parser smokes, patch, findings and provenance. Concatenate base64 blocks in order, decode and verify SHA256 before extracting. No implementation fix, push, deployment or perf VM use.Lossless review receipt 3/3
MERGE (no P0/P1) — merge under the owner severity rule. Independent target56b67e98dc18e1ee2d5f51c2b9aa61c473637c58; local review-real-logins head0e03fb779262cc9cdfdb29eee349292c6ac39e60. Counts P0=0,P1=0,P2=1,P3=0.
RLR-11 P2: a live private readiness canary is mistaken for an older unattributed person terminal. Actual rootless person revocation refuses resource_unavailable with zero person terminals; complete the canary and the identical revocation succeeds. Normal Rust regression independently FAILS0/1; tests committed0e03fb77. Fix forward in the next run; implementation unchanged.
All prior rootless regressions PASS on target native gate; cleanup units and worker deadline1/1 PASS. Explicit worker512 leases+overflow513+64 stalled connects PASS; combined64 pending+64 queued+32 owner links with overflow refusals confirms cleanup and pinned shell retirement. Review fmt/all-target integration clippy-Dwarnings PASS; eight linker tests PASS. Login/shim assertion smokes each100000 inputs PASS without coverage instrumentation.
Target scripts/verify fast exited1:101 suites,959 passed,0 failed,108 ignored. Target Rust tests were compiled before adding the deliberate review regression; runtime/dependencies remain target head. Review adds only tests, no production size delta. Static22208400bytes exceeds16404816; no waiver. Aarch64/TypeScript downstream rows not reached. Author r11 archive hash and exact head provenance match; all1600 retained rows/p50 summaries validate. Absolute author latency limits remain unmet. No independent performance/rootful PAM claim, perf VM access, implementation fix, push/deploy or issue close.
Complete raw receipts stored in preceding three numbered issue comments: r11-review-receipts.tgz, 46239 bytes; SHA256 1c83e164326a2d6e97531dd707c20f6e0a33ccd3dfed06f9639a474aba12724b; 3 parts. Findings appended to /home/kayg/.local/state/codex-jobs/infraternal/review-real-logins/findings.md. Own build/generated scratch cleanup follows after this verdict is stored.
Verbatim target gate:
Cleanup confirmed: local review-real-logins head0e03fb779262cc9cdfdb29eee349292c6ac39e60; worktree clean. Removed only this review target link, generated scripts bytecode and real-logins-review scratch/build/receipt staging after all three lossless receipts and MERGE verdict were stored. Requested findings file retained. Complete target fast transcript archived on #172:959 tests PASS, static-size FAIL. No implementation fixes, push/deploy, perf VM use or issue closure.
r12 started: branch real-logins, clean base
56b67e98dc. Read #172 and prerequisite #159 histories (no parent named), latest review MERGE with RLR-11 P2. Port unchanged0e03fb77and reproduce live private readiness refusing person revocation; preserve earlier regressions and independent cleanup. Minimal fix; no ordinary login-path changes intended, no new performance claim. Final fast transcript and head follow; then stop for verification. Historical r11 later/preopened/cold p50 4.312/4.350/47.901ms remain misses, idle delta0 versus rebuilt d27; static-size failure remains unwaived.RLR-11 root cause confirmed in rootless_sessions.rs: revocation scans all .sock entries; private fixed readiness shims deliberately have neither person ownership nor sealed exit, so they are classified as legacy unattributed terminals. Proposed additive private-runtime detail (D18,D240,D247): readiness shims publish an empty mode0600 same-UID .readiness marker before admitting peers, remove it after unlinking their socket on every normal/error return. Revocation skips only a regular/private/empty same-UID marker; missing/unsafe markers retain refusal. No wire change, person-shell exemption, queue/peer admission or ordinary login-path operation. Unchanged review regression is compiling for local RED.
Ported/pushed review test unchanged as
5f036a7b(from0e03fb77). Local normal Rust wrapper independently RED: 0 passed/1 failed; private_probe_present=true, person_terminals=0, cleanup_confirmed=false, refusal=resource_unavailable. Positive control after fixed probe exits succeeds. Raw red.log retained for attachment. This reproduces the classification defect on unchanged runtime code. Additional marker safety/lifetime/stale-discovery regressions staged before repair; their scoped builds are running. iterate is unsupported (exit2); focused gates used instead.Completed/pushed test slice355d2ddb and shim publication
a61629fb. Three marker tests independently RED before repair; fmt and scoped agent/shim all-target clippy PASS. Fixed probe alone publishes empty0600 marker before serving peers; socket guard removes socket before its owned marker. Full host-login shim121 passed/0 failed/15 ignored, clippy/fmt PASS, earlier worker deadline and cleanup cases green. No wire/engine/dependency/thread/timer or ordinary terminal filesystem operation added. Author check found interruption between the two unlinks can leave an orphan marker: expanded stale regression independently RED after initial socket-paired cleanup; discovery now handles paired and orphan cases, gates running. Person revocation consumer remains the next module.Completed/pushed discovery slice
a9d82ae0: stale paired socket/marker and marker-only interruption cases now both pass; original paired and expanded orphan cases each reproduced RED before repair. Scoped remote-agent all-target clippy and workspace fmt PASS. Existing discovery collects these runtime artifacts with no timer/watcher; marker publication follows bind and socket identities remain single-use. RLR-11 consumer is now implemented locally: only regular empty same-UID mode0600 marker exempts an unattributed socket; known person terminals still require normal stop/reaping proof. Full agent and real-binary daemon regressions are running before its commit.r12 code frozen/pushed: consumer4a55b1ee, documentation/head
a92989f1. Strict marker safety case now GREEN; agent88 passed/8ignored plus transport2; daemon11/11 (all9 rootless cases, idle backend deferral,24 abrupt stops) PASS. Full host-login shim121/15ignored PASS; worker512 held leases + overflow refusal +64 stalled connections confirms S/retirement; linker8/8 and harness17/17 PASS. Scoped all-target clippy and fmt PASS. Four initial new tests independently RED; paired/orphan discovery also RED then GREEN. No new ordinary terminal filesystem work, bounded lifecycle admission, timer, thread, dependency, engine or wire field. No new timing/RSS claim: latest r11 absolute latency misses and D243 size failure remain unwaived. Final scripts/verify fast running ona92989f1, unique TRACER_TEST_PORT4378, private reused target, umask022, weighted user scope; receipt attachment and verbatim output follow. Removed only own completed incremental cache to limit disk use; generated bytecode will be cleaned after gates.Final head
a92989f1ecequals origin. Full fast fmt, VT native fmt, CLI compile-out, workspace clippy, workspace tests and cargo-deny PASS; no baseline exception. Static x86_64 musl release build is still running. Exact log: /home/kayg/.cache/codex-scratch/real-logins-r12/verify-fast.log. Fresh direct real-binary oracle: private_probe_present=true, person_terminals=0, cleanup_confirmed=true, result.revoked=true (before repair resource_unavailable). Fresh peer-capacity oracle: owner_links=32, refused_owner_links=32, cleanup_confirmed=true, shell_stopped=true. Explicit worker capacity also PASS:512 held leases/overflow refused/64 stalled connections/S proof. Raw receipts and final gate output will be attached on completion; no new performance claim, merge or deployment.Final fast attempt on unchanged
a92989f1exited1: fmt/VTfmt/CLI compile-out/clippy/tests/cargo-deny PASS, static builds FAIL(130). Static cargo build returned130 with no compiler diagnostic or size result; cause not established. Transcript preserved at /home/kayg/.cache/codex-scratch/real-logins-r12/verify-fast-interrupted.log. Retrying shipped x86_64 musl release build with the same pinned profile/config/source; no inferred size pass/failure and no waived gate. Code/functional regressions remain green, no source changes.r12 finished; stopping for verification. Branch real-logins head
a92989f1ecequals origin/real-logins. Six atomic commits pushed: unchanged review port5f036a7b, safety tests355d2ddb, probe publicationa61629fb, stale/orphan discoverya9d82ae0, revocation4a55b1ee, contracta92989f1. No merge, deploy or issue closure.RLR-11: only the fixed private readiness command publishes an empty same-UID mode0600 marker before serving peers. Revocation recognizes only regular/private/empty markers on otherwise unattributed sockets. Known person terminals still require the unchanged authenticated stop and shell/descendant-reaping proof; legacy unattributed terminals retain refusal. Linked, directory, permissive, nonempty and missing markers do not exempt terminals. Socket guard/discovery collect normal, stale paired and orphan markers; no extra daemon thread, watcher, timer, lifecycle capacity, parser, wire field, dependency or login backend.
The unchanged review regression and three initial marker regressions independently failed before repair; expanded orphan case also failed before its repair. Scoped tests: agent88 passed/8ignored plus transport2, host-login shim121/15ignored, daemon11/11 including all9 rootless cases and24 abrupt restarts, linker8/8, harness17/17. Explicit real worker512 held leases/overflow refused/64 stalled connections confirms S and retirement. Actual rootless owner32/overflow32 oracle confirms cleanup and pinned shell exit. Scoped fmt/all-target clippy and full workspace functional tests PASS. No baseline exception, weakened test or new parser-fuzz coverage claim.
Full scripts/verify fast exited1 on final head. Every other Rust row passed; its static cargo subprocess returned130 without a compiler diagnostic or size result. The unchanged-source retry then built the shipped x86_64 musl release binary successfully; running the exact rust_static_build_check function afterward fails1 only on D243 size. Both transcripts are attached. Actual full-gate summary, verbatim:
Focused static gate, verbatim:
Static-pie linked/stripped, PT_INTERP absent. Artifact SHA256 64b543ba5885b3fea2eb70b2268b00314a7c89739b3ff349b82ef2d094192c3f; source-owned shipped linker/config/default features and pinned release recipe in artifact-provenance.json. D243 remains failed without a waiver or budget change. Aarch64/TypeScript downstream were not reached; no TypeScript changed.
No new timing/RSS measurement in r12 and no performance recertification. Historical r11 later/preopened/cold p50 4.312/4.350/47.901ms remain recorded misses, not certified by this fix. The new filesystem work is confined to fixed readiness, revocation classification and stale discovery; ordinary terminal filesystem operations and PAM/systemd/fallback mechanics stay unchanged.
D262 receipts archive SHA256 dab4507c7205d17092d7e3c3efa7579545a1e5dd3ffa4a3b9be6eb209ba5651c (66464bytes): all raw red/green results, full gate, retry, strict marker cases, capacity proofs, source diff, commits, provenance and author checklist.
real-logins-r12-receipts.tgz
verify-fast-interrupted.log
static-check.log
Generated scripts/.cargo bytecode and this job's runtime/build scratch removed; receipt staging will be removed after this comment is stored. Owner live fixtures and unrelated worktrees untouched. Worktree clean; stopping for verification.
Cleanup confirmed: real-logins head
a92989f1ecequals origin; worktree clean. Removed only own real-logins-r12 build/receipt staging and rl12 runtime fixtures after D262 attachment and final comment succeeded. Generated scripts/.cargo bytecode absent. Full gate transcript remains attached verbatim (all non-static rows PASS; static130 without diagnostic); same-source retry build succeeds and exact static check fails D243 at22212176 versus16404816bytes. No merge/deploy/issue close. Stopping for verification.Resuming priority integration on real-logins, clean base/head
a92989f1ec; fetched origin/devc47a438be7. Read #172/#159 history and #221 latest dependency/Q14 report. RLR-11 is already fixed in six committed/pushed r12 steps; will rerun the full daemon regressions. Choosing merge of origin/dev into real-logins: 219 lane-only commits include six prior integration merges; replaying the reviewed history across 959 new dev commits would repeatedly resolve the same conflicts. Preserve dev behavior and atomic lane history; no merge into dev or deploy. Then current shipping-size comparison, exact mesh SSH gap list on both issues, final fast gate and branch push. Historical r11 latency misses remain disclosed; no new performance claim yet.Integration findings against origin/dev
c47a438be:Mesh SSH production dependency audit (D235 Q14), integration of real-logins with dev
c47a438be; compared origin/mesh-ssh and origin/process-per-userd48996b72:daemon.rs::open_requested,logins.rs).user_host.rs::run_host); explicitly owns no login authority.rootless_sessions.rs,logins.rs,cleanup.rs); app host-removal hook.Real-logins supplies the host login lifetime prerequisite; merging it alone does not meet Q14 or enable production SSH. SSH transport interfaces exist on mesh-ssh (
mesh_login.rs), with a test runtime; they are not production adapters. No second access store, privileged file substitute, deployment or enablement added. Functional integration gates pending; historical latency/RSS receipts are not recertified by this audit.D262 integration: archived the complete historical evidence tree before removing it from the merge result (43MB uncompressed; SHA256 5eca494539e6f697c7d2ff2348743cccdc730461a0fee56485791c45968d0d3f). Kept 39 executable harness sources under scripts/login-bench and scripts/login-bench-related paths, and updated the seven rootless regression imports to scripts/login-bench/round3/controller.py. No result/history was discarded; source tests stay in the repo, raw receipts on the issue.
historical-login-evidence.tgz
Integration progress: 16 textual conflicts resolved; production migration0023 retained, unpublished preferred settings moved to0026. Actual framing source compiled standalone: distinct-bit regression RED with cleanup16/shared16; GREEN with cleanup32/shared16,11 passed/1 ignored including frozen frame tests. Relocated harnesses:21 measurement/lifecycle +1 descriptor handoff +1 readiness announcement +2 mapping +3 fault parser tests PASS; linker8/8 PASS. Tracer compiler and213 tests PASS; remaining TS differential checks await Cargo. Full native compile awaits vendored OpenSSL; new native full-control-lane cleanup regression and daemon regressions queued, no inferred pass. Fresh current-dev static controls building both architectures using same scratch target; source caps21300016/19500376B retained unchanged. No performance recertification or deployment.
Additive integration detail before the native-control repair (D240/D247): preserve dev ordinary-control capacity/FIFO and its single ordered write owner. Give only the existing trusted terminal.login.revoke finalizer a separate mailbox; service its admitted cleanup before the next ordinary control flight. No extra idle task/thread/timer, no browser-selected action or identity, no framing change. Network failure still yields an honest unconfirmed result; success still requires host reaping proof. New real-transport regression currently builds against the pre-repair merge; existing96-retirement admission test also runs with ordinary writer admission disabled.
Q14 gap clarification for existing terminals: real-logins can adopt and retire terminals/logins that already carry a trusted person identity. Older terminals created without that identity are not automatically assigned to a person; person cleanup remains unconfirmed while an unattributed older terminal is live (fixed private readiness probes are exempt). Source: rootless_sessions::revoke and unsupported/unattributed cleanup regressions. Coordinated retirement or safe migration of those older terminals is still needed before all shell paths share Login access. The optional #205 batch runtime supplies no identity migration. This is an integration gap, not a claim that merging #172 alone enables production mesh SSH.
Integration commit31d73814a31908a1e9cb777d54886e384ef6b6b0 merges origin/dev
c47a438be; clean worktree, dev is now an ancestor. Existing219 lane commits/6 earlier merges retained rather than replaying repeated integration conflicts. No push yet; final head gate pending.Scoped evidence: workspace all-target Clippy-Dwarnings PASS; daemon11/11 including RLR-11 and24 restarts PASS; embedded60/60 (4 ignored) PASS including96 cleanup requests with full native control lane; worker512 held leases/overflow refused/64 stalled ordinary connections confirms cleanup; actual rootless32 owner links +32 refused links still confirm cleanup and pinned shell exit. Private readiness oracle: probe present/person terminals0/revoked=true. Framing11 PASS/1 ignored; linker8 PASS; relocated harness28 tests PASS.
Fresh dev static controls exactly21300016/19500376B (x86/ARM), both match source caps. Candidate builds underway. Initial default-parallel workspace run: server490 passed/2 failed/49 ignored (socket closed while creating the eight-socket pool fixture; an unrelated late-observation fixture PoolTimedOut). Eight-socket case passes isolated unchanged. Repeating complete scripts/verify iterate with RUST_TEST_THREADS=1, preserving every test/internal concurrency/deadline; no #118 waiver or changed assertion. Earlier parallel TS differential timeout waited on the shared Cargo build lock; it will run sequentially in the gate.
Upgrade-path audit before publication found two related integration gaps at31d73814a. daemon.rs:726 pre-seeds Manager::Detached for every anonymous image; on a root host that suppresses detection of the available system manager for D247 login units. Direct launch is needed for the shim, not for selecting the host login backend. Separately, login_binary.rs::publish uses opened(exe) with O_NOFOLLOW; the normalized kernel /proc/self/exe image path is itself a link, so root image publication refuses it. Rootless paths bypass publication and the11 daemon regressions do not exercise root publication. Preparing failing regressions for current-kernel-image publication and separation of host login backend from anonymous shim launch. Will retain arbitrary-link refusal, source ownership/mode/change checks and dev direct-exec behavior. No false real-host or timing claim; final push remains pending.
Committed0e12f3b11febdfb23479583fd73e073ddd9a900f: Linux kernel self-image publication after anonymous execution. Positive current-image and actual self-unlinked child regressions both reproduce ELOOP before repair. Exact kernel path now follows its kernel-bound image; arbitrary aliases/links and all inode ownership/mode/change checks stay strict. Actual module tests18 passed/1 private fixture ignored, including old cache/PID-reuse/stale-copy bounds; workspace all-target Clippy and fmt PASS. Red/green module source and receipts attached below. Host manager vs direct shim selection is the next separate repair; final fast/push pending. Complete iterate on preceding integration31d73814a passed all Rust/TS/artifact/release-functional checks with serialized test cases; no waiver.
cache-upgrade-receipts.tgz
Completed anonymous-image backend repair at
d334f9932(D18/D217/D247). Root anonymous execution now retains lazy real host login backend detection; its shim executes directly. Own-account rootless images keep inherited context without probing. Two new regressions failed before repair; all three now pass. Agent daemon unit tests: 26 passed, 4 ignored; session tests: 15 passed, 1 ignored. Workspace fmt and all-target Clippy passed. Finalscripts/verify fastis running on this head. No performance result is claimed from build-host test durations.Final-head shipping size finding (
d334f99323): controls are fresh builds from origin/devc47a438be7, same pinned static recipes/default features. This is a real increase, not the stale 16 MB comparison.Both exceed D243's 16 KiB allowance; caps remain unchanged. Added real-login worker/handoff, host-unit/fallback lifecycle, account preference metadata, person ownership and independent confirmed cleanup are retained for correctness. Section attribution: x86 .text +243,411 B, unwind frames/header +30,968 B, .rodata +12,288 B, .data.rel.ro +5,792 B; ARM .text +210,464 B, unwind frames/header +30,560 B, .rodata +8,192 B, .data.rel.ro +5,792 B. Both .bss deltas are zero. These are section-level attribution, not an exact function-by-function split. Cargo.lock has no delta vs dev and no new dependency package was introduced by integration. Final fast is still running; expected static-size failure will be quoted honestly. Size receipts and hashes will be attached with the final gate.
Integration finished at
d334f99323, ready for independent verification with the explicit size exception below. No merge into dev or deploy.Merged fetched dev
c47a438be7in31d73814a, rather than replaying 219 lane commits/six previous merges across 959 dev commits. This preserves the atomic reviewed history and dev behavior. Separate audited upgrade fixes:0e12f3b11publishes the actual anonymous kernel image with strict source checks;d334f9932separates direct shim launch from the root real-login backend. Red/green evidence attached. dev advanced another 12 commits while this run executed; the merge and matched controls deliberately refer to the fetched c47 snapshot, not the moving ref.Functional evidence on final head: all 11 daemon regressions pass, including RLR-11; agent library 171 passed/22 ignored; server 492 passed/49 ignored. All enabled workspace tests, fmt, all-target Clippy, cargo-deny and CLI compile-out pass. Exact TypeScript gate separately passes (213 tracer tests, 37 protocol tests, compiler/production build/transfer budgets). Dedicated cleanup proof: 96 admissions despite ordinary capacity; worker 512 leases plus 64 stalled clients; 32 rootless owner links; private readiness cannot refuse revocation. Native ordering linker 8/8 passes. Source/module tests and raw receipts are in the archive. Author checklist completed.
These are freshly built, matching default-feature shipping recipes, not the old 16 MB baseline. Both exceed D243's 16 KiB allowance; unchanged size caps correctly fail. Real-login worker/handoff, account preference, host-unit/fallback lifetime, ownership and independent confirmed cleanup add executable code. x86 .text +243,411 B and unwind +30,968 B; ARM .text +210,464 B and unwind +30,560 B. Both .bss deltas 0, Cargo.lock unchanged vs fetched dev. This is a functional increase requiring owner assessment, not a ratchet/cap edit. Static linkage, production trust, AES known vector, metadata and x86 key-memory checks pass; ARM key-memory runtime is explicitly skipped on x86.
The production SSH gap list and legacy-session qualification are posted on both #172 and #221. Present: real account login creation/reuse/adoption and person-owned cleanup. #205: optional already-authorized PTY host. Missing: shared current Login access enforcement, production SSH login adapter, files running as the selected account, SSH/file ownership registration and coordinated retirement of older unattributed sessions. Merging this branch alone does not meet Q14. Latency and idle RSS were not remeasured or recertified in this integration task; historical target misses are not claimed fixed.
Full final
scripts/verify fastexited 1 solely on the two static size overruns (and the size regression test rejecting the same x86 overrun); TypeScript was therefore run separately. Raw output: verify-fast.log. Complete receipts/checklist, artifact hashes/section deltas. Earlier parallel socket/SQL fixture failures passed unchanged in the complete serialized gate; no deadline/assertion waiver. An extra direct unit-binary invocation used the wrong working directory; the final Cargo workspace run uses the correct context and passes all enabled tests.Verbatim final gate summary:
Verbatim size failures:
Pushed real-logins successfully. Remote refs/heads/real-logins confirmed at
d334f99323; tracked/untracked worktree status clean. Final gate and evidence are in the preceding comment. Removing only this job’s scratch build output and stopping for independent review; no merge into dev or deploy.Started priority integration on branch real-logins at
d334f99323; fetched origin/dev isb231301396. The branch is 12 commits behind and 222 commits ahead by ancestry. Latest #172 history records the prior integration atc47a438beand its measured +311,040 B x86 / +274,712 B ARM size delta; the earlier production LoginAuthority/Q14 gap report is on #221. I am inspecting the merge topology and current shipping-size attribution before integrating, then will rerun the 11 daemon regressions and RLR-11, cut only behavior-free size, run the full gate and push this branch.Integration choice: merge fetched origin/dev
b231301396into real-logins. Rebase would replay 222 branch-only commits, including the 219 already-reviewed login commits and earlier merge integrations, against a 12-commit dev advance; that duplicates the prior conflict surface and risks rewriting the reviewed atomic history. The existing merge at31d73814aalready anchors the login work atc47a438be. A single new merge preserves dev behavior and the reviewed login commits; no merge to dev or deployment is planned.Merged-head regression finding: the requested 11-test agent_daemon suite returned 10 passed / 1 failed. RLR-11, real_binary_rootless_private_readiness_does_not_refuse_person_revocation, passed. real_binary_rootless_retirement_releases_person_terminal_records timed out awaiting terminal.exited in scripts/test-rootless-retired-records.py:39; scripts/agent_fixture.py's event read hit its 1-second child wait/socket timeout. Full log: $HOME/.cache/codex-scratch/real-logins/daemon-regressions.log. No code was changed; rerunning this case alone to distinguish a transient timeout from a regression.
Regression update: the isolated exact retirement-attribution case passed (1/1, 0.92 s), then the full serialized agent_daemon suite passed (11/11, 37.84 s), including RLR-11. The first full run's single 1-second event timeout did not reproduce; no source or test changed. Logs: $HOME/.cache/codex-scratch/real-logins/daemon-retired-isolated.log and daemon-regressions-rerun.log.
D235 Q14 remains NOT MET after integrating current dev (
b2313013). Production pieces needed by mesh SSH:SSH remains unavailable; this integration does not enable it.
The staged merge includes the exact current origin/dev DECISIONS.md (207,235 B); the prior
c47a438bemerge base had 204,964 B. scripts/verify iterate stopped at its repository artifact-size check before Rust/TypeScript: DECISIONS.md exceeded 200,000 B. This is inherited from current dev; no decision text or gate limit was changed. After the merge commit, origin/dev becomes the artifact gate base, so I will rerun the gate on the committed integration.Independent delta review started on review-real-logins; previous evidence head
0e03fb779, target39d9b647ee, merge base with origin/devb231301396. Preserve prior evidence via review-only integration; review tree matches target exactly. Scope: all integration remerge diffs, production default behavior, RLR-11 fix, exact target fast gate. No implementation fixes, deployment, timing claims or perf VM access. Push only review-real-logins. Prior author result.md absent; #172 history is the available report.Delta review step: review-real-logins
91d0e17072pushed; tree exactly matches target39d9b647e. Inspected remerge diffs for all8 lane-only merges; substantive resolutions arecafd2f938and31d73814a, final86045327b is conflict-free. Checked both parents/current source: dev shared-writer bit16 retained, new cleanup bit32; asynchronous terminal opens and account metadata retained; census-before-Result fence, readiness, locale, durable bootstrap completion and ordinary-control FIFO retained. All shipped migrations unchanged; preference migration is additive0026.d334f9932separates anonymous direct shim launch from lazy root backend detection;0e12f3b11 keeps source validation while permitting the exact kernel image. Linker/config tests8/8 PASS. Unchanged-target fast gate running, serialized test cases/unique4387 port; no performance claim. Rootful legacy-session cleanup reporting remains under investigation; no confirmed finding yet.Production defaults audit, target39d9b647e (functional verification still running):
Owner demo: keep an existing terminal open through upgrade and reconnect; open two new terminals and show selected Unix account plus one reused person login; test a missing account/root fallback and a rootless different-account refusal; add/re-add a host and show preferred-login failure is explicit; remove access and show only the correct person's new shells stop, with honest legacy-session cleanup status. Check fish startup/manual use separately. This audit does not certify performance or rootful PAM runtime on this host.
Independent functional step: target39d9b647e passes all11 real-binary agent_daemon regressions, including original RLR-11 private-readiness cleanup (now fixed),24 abrupt restarts, person/descendant cleanup and capacity. All28 relocated harness tests/6 suites and8 linker tests PASS. Target fmt/VTfmt/CLI compile-out27 tests/workspace all-target Clippy PASS. Native target executables finished compiling before adding the new review regression; target tree hash156cbfd7bf4e5d9f60e910f9e78ce2b47ab1bf5c matches review integration91d0e1707. Remaining target fast suites/static builds still running. New rootful legacy classification regression builds separately; no implementation fix, performance claim, deployment or VM use.
RLR-12 — P2 — Rootful cleanup confirms older unattributed terminals
39d9b647ee. Newly found during the production-upgrade audit; this logic predates the integration merges.c47e9186de(pushed review-real-logins). Normal Rust result: 0 passed, 1 failed; exit101.Review fmt PASS. Target native gate was compiled before adding the deliberate red regression. Restored the target version of the module declaration in the working tree for exact static builds; the failing test remains committed/pushed. No implementation fix or performance claim.
Independent capacity step at review headc47e9186d, target39d9b647e: real combined gate PASS1/1 with64 pending calls+64 queued commands+32 owner links, ordinary overflow refused, cleanup_confirmed=true and pinned_shell_stopped=true. Actual worker gate PASS1/1 with512 leases, overflow refused and64 stalled ordinary connections, cleanup_confirmed=true. Target agent library171 passed/22 ignored; RLR-11 and all11 daemon cases PASS. These are functional count/proof checks, not performance measurements or rootful PAM coverage. The complete target gate continues through server suites/static builds. Only new finding remains RLR-12 P2; no implementation fix.
Target fast first attempt: server491 passed/1 failed/49 ignored. Existing regression remote_runtime::tests::standby::control_queue::saturated_native_control_queue_does_not_hide_primary_terminal_output failed at remote_control_queue_tests.rs:236 after CONTROL_SATURATION active=true queued=1 native_primary_live=true shadow_output=0. It requires the expected terminal message within its100ms fixture window; the failure output does not distinguish timeout from another queued message. Exact unchanged compiled-target isolated rerun PASS1/1 with the same saturation proof. This is outside #118's allowed exceptions, so no baseline waiver or green gate claim. Retaining both logs, repeating the exact case and the complete target fast gate unchanged after static builds. Review source remains restored to target production input; RLR-12 stays test-only on pushed
c47e9186d.RLR-13 — P1 — Scheduled probes retire a healthy primary at full native control capacity
39d9b647ee. The timer/admission gap is also present in merged devb23130139(embedded.rs:945-948); not attributed to a textual merge resolution. No baseline execution or performance result is claimed.129eff2bc2(pushed review-real-logins). No implementation fix. HOLD under the owner severity rule; current counts P0=0,P1=1,P2=1,P3=0. Target static gate continues with original source restored; final gate transcript follows.RLR-13 verification at pushed review head129eff2bc: new scheduled_probe_preserves_primary_at_full_native_control_capacity independently FAILS3/3 additional isolated runs, exit101 each, after actual active-write+queued-frame saturation; application-close code0. Original target regression races probe scheduling (passes in some isolated runs, fails in target gate and repeat3). P1 remains confirmed; no #118 waiver, implementation fix or measured latency claim. Scope qualification: timer enqueue/retirement logic is also present in merged dev
b23130139, so this is an inherited target gap rather than a claimed textual conflict-resolution regression. Review verdict HOLD (P0=0,P1=1,P2=1,P3=0). Original target static builds continue; exact TypeScript gate dispatched separately because the Rust test failure prevents its normal downstream phase. Final transcript follows.Remaining functional checks at review129eff2bc/target39d9b647e: complete target shim library PASS129/0 failed/15 ignored, including codec/shared writer/readiness/cleanup/fidelity cases skipped after the original workspace server failure. Separate exact TypeScript gate PASS: compiler,213 frontend tests,production build/precompression/transfer checks,Rust stream oracle,37 protocol tests. x86_64 shipped static gate now PASS: PT_INTERP absent;21611056 bytes exactly equals D298 cap; crypto vector,production trust and locked/excluded key-memory check pass. ARM build still running. RLR-13 P1 and RLR-12 P2 remain committed red; HOLD. No new performance or rootful PAM certification.
D262 independent delta-review receipts 1/6; target39d9b647e, pushed review129eff2bc. Archive delta-review-receipts.tgz: 107416 bytes; SHA256 9121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07. Includes full target fast transcript, both red regressions/repeats, all scoped functional/lint/TS checks, remerge audit, source patch/defaults/checklist and findings. Concatenate base64 blocks in order, decode, verify SHA256, then extract tar. Verdict HOLD: P0=0,P1=1,P2=1,P3=0.
Lossless receipt data 1/6
D262 independent delta-review receipts 2/6; target39d9b647e, pushed review129eff2bc. Archive delta-review-receipts.tgz: 107416 bytes; SHA256 9121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07. Includes full target fast transcript, both red regressions/repeats, all scoped functional/lint/TS checks, remerge audit, source patch/defaults/checklist and findings. Concatenate base64 blocks in order, decode, verify SHA256, then extract tar. Verdict HOLD: P0=0,P1=1,P2=1,P3=0.
Lossless receipt data 2/6
D262 independent delta-review receipts 3/6; target39d9b647e, pushed review129eff2bc. Archive delta-review-receipts.tgz: 107416 bytes; SHA256 9121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07. Includes full target fast transcript, both red regressions/repeats, all scoped functional/lint/TS checks, remerge audit, source patch/defaults/checklist and findings. Concatenate base64 blocks in order, decode, verify SHA256, then extract tar. Verdict HOLD: P0=0,P1=1,P2=1,P3=0.
Lossless receipt data 3/6
D262 independent delta-review receipts 4/6; target39d9b647e, pushed review129eff2bc. Archive delta-review-receipts.tgz: 107416 bytes; SHA256 9121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07. Includes full target fast transcript, both red regressions/repeats, all scoped functional/lint/TS checks, remerge audit, source patch/defaults/checklist and findings. Concatenate base64 blocks in order, decode, verify SHA256, then extract tar. Verdict HOLD: P0=0,P1=1,P2=1,P3=0.
Lossless receipt data 4/6
D262 independent delta-review receipts 5/6; target39d9b647e, pushed review129eff2bc. Archive delta-review-receipts.tgz: 107416 bytes; SHA256 9121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07. Includes full target fast transcript, both red regressions/repeats, all scoped functional/lint/TS checks, remerge audit, source patch/defaults/checklist and findings. Concatenate base64 blocks in order, decode, verify SHA256, then extract tar. Verdict HOLD: P0=0,P1=1,P2=1,P3=0.
Lossless receipt data 5/6
D262 independent delta-review receipts 6/6; target39d9b647e, pushed review129eff2bc. Archive delta-review-receipts.tgz: 107416 bytes; SHA256 9121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07. Includes full target fast transcript, both red regressions/repeats, all scoped functional/lint/TS checks, remerge audit, source patch/defaults/checklist and findings. Concatenate base64 blocks in order, decode, verify SHA256, then extract tar. Verdict HOLD: P0=0,P1=1,P2=1,P3=0.
Lossless receipt data 6/6
HOLD (P0/P1 present) — do not merge under the owner severity rule. Counts P0=0,P1=1,P2=1,P3=0. Target39d9b647ee8666f6a0607c12a6ba8cda38a8408d; final pushed review-real-logins HEAD129eff2bc2d648046a8a2ec262590f1006f27fee.
RLR-13 P1 (commit129eff2bc): periodic Ping admission ignores a full native ordinary control FIFO and retires a healthy primary. A real mTLS QUIC fixture has one active control write+one queued frame, no shadow output; the new normal Rust regression and3/3 additional runs observe application close0 inside the configured reply/write allowance. The target fast gate independently fails the existing healthy-primary delivery test (server491 passed,1 failed,49 ignored). Locations embedded.rs:1106-1115,2745-2775. This timer gap also exists in merged dev
b23130139; not attributed to a textual conflict resolution, and no baseline execution/host-load waiver claimed.RLR-12 P2 (commitc47e9186d): rootful cleanup returns success while older unattributed terminal state remains live; both rootful modes confirm, rootless control refuses. The isolated default-runtime/real-listener model fails normally; no actual root/PAM/upgrade claim. Location agent/logins.rs:484-557. Fix forward remains allowed for this P2.
Earlier RLR-11 FIXED: original private-readiness regression PASS; all11 actual daemon cases including24 abrupt restarts PASS. Full agent171 active and shim129 active/15 ignored PASS. Functional capacity proofs PASS:512 worker leases+64 stalled connections;64 pending+64 queued+32 owner links and overflow refusal with pinned shell retirement. Linker8/harness28 PASS. Separate exact TypeScript compiler,213 frontend tests,production build/transfer,Rust oracle and37 protocol tests PASS. Review fmt and workspace all-target Clippy PASS after restoring both committed red tests. No implementation fix or new performance/rootful-PAM certification.
Merge/default audit completed:8 merges/26 textual conflicts; no dropped behavior found. All25 shipped migrations unchanged; preferred accounts only add0026. Cargo.lock unchanged. Default changes and the owner demo are recorded in the production-audit comment and defaults.txt in receipts: preferred username/account fallback, preopening on each authenticated socket, reusable real host logins, inherited rootless ownership/refusal, shell markers/fish startup, person cleanup before host removal, stricter add-host restoration/preparation, and anonymous-image adoption. Existing terminal owners are preserved; old shims are not migrated. SSH authority/files remain unwired by this prerequisite. Demo should keep an old terminal through upgrade/reconnect, show selected account/reused login for new terminals, exercise rootless/account refusal and missing-account fallback, add/re-add a host, then show per-person cleanup with honest legacy status.
Target scripts/verify fast exited1. Target native executables were compiled before deliberate review tests; target source restored for static compilation, then committed review declarations restored. Every non-test Rust row passes; D298 sizes now match both caps. Verbatim summary:
Verbatim static size output:
ARM key-memory runtime is explicitly skipped on x86; x86 locking/dump exclusion, linkage,trust and crypto vector checks pass. Rust test failure prevented the built-in downstream TS phase; the exact TS function was run separately and passed.
Complete raw target/scoped/failed/repeat/lint/TS evidence, source patch, remerge audit/defaults/checklist and findings are preserved in the preceding 6 numbered D262 receipt comments: delta-review-receipts.tgz, 107416 bytes, SHA256 9121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07. Findings appended to /home/kayg/.local/state/codex-jobs/infraternal/review-real-logins/findings.md. Review commits change tests only; shipping size delta from review is zero. Own build artifacts/generated bytecode will be removed after this finish record is stored. No dev/main push, deployment, perf VM, owner live-fixture changes or issue closure.
Cleanup confirmed: review-real-logins HEAD129eff2bc2d648046a8a2ec262590f1006f27fee equals origin/review-real-logins; worktree and diff check clean. Validated own scratch build target and generated scripts bytecode removed; .cargo bytecode absent. Logs/archive retained under $HOME/.cache/codex-scratch/review-real-logins/. Complete107416-byte D262 archive, SHA2569121bf47f1caf27350304e8a608200e77eac06bf9dea79acb70d9671a365fc07, already posted in6 numbered receipt comments; preceding finish comment contains verdict and verbatim target fast output. HOLD counts0P0/1P1/1P2/0P3. Both red tests remain committed/enabled, RLR-11 is green. No implementation fixes, deployment, VM use or issue closure.
RLR-12 continuation starts on real-logins at
39d9b647ee(clean worktree). Read latest review and issue history. Will cherry-pickc47e9186d, reproduce rootful cleanup acknowledgement with an older unattributed terminal, reuse existing ownership checks, and run daemon regressions, iterate and final fast gates. RLR-13 remains owned by ping-fifo-fix; no merge into dev or deployment. Prior D298 size approval retained.RLR-12 reproduced at cherry-picked test head
77d050675: rootful_cleanup_confirmed=true, system_cleanup_confirmed=true, rootless_cleanup_confirmed=false, legacy_socket_present=true, new_opens_fenced=true (0 passed, 1 failed). Source fix now reuses the existing unattributed-terminal/exit-proof/private-readiness check after stopping known rootful login sessions; passes the resolved state path separately from host-wide login locks. This reports uncertainty for any remaining rootful terminal lacking person attribution, including unrelated retained terminals; it never ends them or invents ownership. No terminal-open/startup/idle path changes, so no new performance claim or VM run. Added explicit-state, empty-state, ended-state and private-readiness controls for both rootful managers. Evidence: rlr12-before.log and rlr12-agent.log under $HOME/.cache/codex-scratch/real-logins/.RLR-12 implementation validation: login library 101 passed, 0 failed, 8 ignored. Both rootful regression cases pass, including explicit --state, retained exit proof, and safe/unsafe readiness markers. Initial extra fixture exceeded the Unix socket address limit; now uses the review fixture’s directory-FD address. Initial library run also correctly rejected a group-writable build executable produced by ambient umask 0002; own build artifact modes corrected and rerun under umask 022 passes without weakening source validation. Whole-workspace iterate gate continues; final shipping fast gate follows the atomic fix commit.
rlr12-before.log
Atomic fix committed at
6d8dee208(review test port77d050675). Reused ownership/exit/readiness proof; rootful cleanup checks the resolved state after retiring known workers. Before/after review model: rootful confirmed true -> false; system confirmed true -> false; rootless false -> false; old socket remains true; new opens fenced true. Login library 101 passed, 0 failed; both rootful proof controls pass. Workspace fmt/Clippy pass; full iterate still compiling test binaries. Final fast output and shipping sizes follow.At pushed head
6d8dee208, all 11 real-binary daemon regressions pass (11 passed, 0 failed), including RLR-11 private readiness, explicit state, 24 abrupt restarts, ownership/descendant cleanup, sender disconnect, saturated owner capacity and adopted-child reaping. CLI library 81 passed, 0 failed. Workspace iterate continues through remaining suites; final fast still required. No source changes since the fix commit.Iteration gate at
6d8dee208recorded one server-suite failure in auth::tests::socket_tests::fresh_delete::review_mesh_delete_requires_fresh_passkey_tap (crates/infraternal-server/src/auth/socket_tests/fresh_delete.rs). Same unchanged compiled binary passes that exact test in isolation: 1 passed, 0 failed; the first refused deletion retains its host and requires fresh confirmation. Full suite still running, so original failure details and final gate status remain pending. No server source or test changed. Logs: rlr12-iterate-rerun.log and rlr12-fresh-delete-rerun.log in job scratch. All 11 daemon regressions and both RLR-12 cases remain green.Iteration gate finished at
6d8dee208: fmt, VT fmt, CLI compile-out, Clippy and cargo-deny PASS; test FAIL (101) solely in fresh_delete::review_mesh_delete_requires_fresh_passkey_tap. Server 491 passed, 1 failed, 49 ignored. It expected successful call 83 at fresh_delete.rs:131 but the next frame did not match; this is not an elapsed-time assertion and no #118 waiver is claimed. Same unchanged compiled test passes isolated (1/1). All 11 daemon regressions and RLR-12 tests passed. Full scripts/verify fast now running on the pushed head with umask 022, serialized tests and unique port 4372; no source change or server fix.Final fast server suite at
6d8dee208: 491 passed, 1 failed, 49 ignored. Fresh-confirmation case passed in this full run. Sole failure is browser_input_overload_retires_only_the_terminal_stream at review_input_credit.rs:56: its first attach reply did not match Ack(0). This is an assertion failure, not a timeout; no #118 waiver. Unchanged compiled exact case passes isolated (1/1). The original full-queue control, preferred-account preparation, cleanup admission/retry and remote retirement regressions all pass. Static builds continue. Running the already-compiled shim suite and exact ts_verify_fast separately because Rust test failure otherwise skips them. RLR-13 remains assigned to ping-fifo-fix; no server source or test changed here.Takeover of RLR-12 on real-logins at
6d8dee208(clean, equal to origin). Finding before gate: the pushed fix checks every rootfulstate/sessions/*.sockwith an empty ownership list. Current rootful person terminals (shims started with--login-socket) write no ended record and no readiness marker, so with this fix any live new-format terminal on a rootful host, of any person, makes every person removal report unconfirmed. Only older pre-login-worker shims should count as unattributed.Plan: the shim publishes a private
<id>.loginrole marker after bind when it serves a login worker. It lives exactly as long as its socket, like the readiness marker. Rootful cleanup exempts sockets that carry this marker, because their login worker registry already accounts for them. Older shims never write it, so RLR-12 stays red→green. Add a regression for a live new-format rootful terminal next to the legacy one.Pushed
d007946b7on real-logins: rootful cleanup now tells new login-worker terminals from older ones.<id>.loginmarker (mode 0600, shim uid, empty) right after bind when it serves a login worker. It is removed together with its socket, and discovery sweeps stale ones, the same way as thereadinessmarker.Evidence (agent lib,
upgrade_review):rootful_cleanup_confirms_beside_login_worker_terminals_onlyat6d8dee208+ test only: FAILED,Unsupported: existing host login path has no person ownership recordwith only a login-marked terminal live (2 passed, 1 failed).d007946b7: 3 passed, 0 failed (the original RLR-12 review test, the explicit-state/proof controls, and the new one with legacy-beside-current, exposed-marker and rootless controls).role_marker_lives_only_as_long_as_its_socket: 1 passed.Full
scripts/verify fastis running now.Finish (RLR-12 follow-up), head
204161363on real-logins (pushed). No merge, no deploy. RLR-13 was not touched; it belongs to ping-fifo-fix.Commits:
d007946b7: the shim writes a private<id>.loginrole marker when it serves a login worker. Rootful cleanup exempts sockets that carry it. Older unattributed terminals still leave cleanup unconfirmed. Fixes the over-refusal in6d8dee208.204161363: Clippy nonminimal_bool fix for that expression. No behaviour change.Verbatim
scripts/verify fastat204161363(exit 1):Why each red row is red:
real_binary_rootless_revocation_after_restart_stops_every_owned_terminal. It failed in the test fixture's attach sequence checkAssertionError: (627, 0)(agent_fixture.py:359), not in cleanup classification. On the previous gate run it was a different rootless daemon test (..._retirement_releases_person_terminal_records, a 1 s read timeout). The wholeagent_daemonsuite run 3 times in a row on its own at this head: 11/11, 11/11, 11/11. My change has no rootless effect (rootless shims carry no login socket, so they get no marker). The flakiness under gate load is open and needs a separate look.loginrole marker adds +768 bytes (agent binary, 21611824 against 21611056) and +1152 bytes (19776240 against 19775088). I did not raise the caps, per job rules. Owner/orchestrator call: either allow +2 KiB on top of D298, or trim later as D298 already plans.RLR-12 evidence: the upgrade_review module is 3/3 green. The new regression fails on
6d8dee208and passes here. Agent lib: 102 passed, 0 failed.Break-it delta review r3 started (independent reviewer).
review-real-logins-r3, baseorigin/real-loginsat290ea53f90.129eff2bc:77d050675,6d8dee208,d007946b7(<id>.loginrole marker),204161363,290ea53f9.AssertionError: (627, 0), 1 s child wait). RLR-13 is out of scope (ping-fifo-fix).Break-it delta review r3, verdict: MERGE (no P0/P1). Target
real-logins290ea53f9. Review head8907ff41f, pushed asreview-real-logins-d3. The remotereview-real-logins-r3already held an older Oct 13 round, so I did not overwrite it.Counts: P0=0, P1=0 (RLR-13 left out, it is fixed on ping-fifo-fix), P2=0, P3=3.
<id>.loginmarker (d007946b7). I found no way to make cleanup report success while an older terminal is live:symlink_metadata,is_file, mode and length checks).create_new, and unlinked socket-first.private_dirrefuses it before bind.New regression
marker_review::unsafe_or_mismatched_login_markers_keep_rootful_cleanup_unconfirmedcovers 7 hostile cases × {Detached, System} plus a positive control. Result: PASS (all 14 cases refused, control confirmed). It is passing evidence, not a failing proof.What remains only causes false refusals, never false success: a login shim between bind and marker creation, and a dead older socket that discover has not yet removed.
RLR-12: fixed in both rootful modes. The original regression passes, and so do the author's explicit-state test and the login-worker-beside-legacy test. The scan does not depend on the manager.
Rootless: no change in result. Same path (
runtime_root == statewhen not root), and the login role is ignored (login_owned=false). The only difference is which error is reported when there are several problems: now the first one found instead of the last.Flaky daemon tests:
AssertionError: (627, 0): a test-harness ordering issue. The fixture closes stream 1, waits for a Pong as a "fence", then re-uses stream 1 for another session. But the daemon's writer isbiasedtoward control frames, and the relay cancelled by Close can still emit Output after that Pong. A real-binary probe reproduced late Output on a closed stream after the Pong in 1/5 trials (load ~50) and 1/20 (load ~26). 627 is the old session's cursor.Other P3s:
290ea53f9raises the D298 caps by +768 B / +1,152 B. That needs an orchestrator/owner OK under the no-size-growth merge bar.login_binary::tests::current_kernel_image_can_be_publishedfails under umask 002. The test executable is built 0775, andpublish()correctly refuses a group-writable source. Withchmod g-wit passes. The author's gate logs never reached this suite becausecargo test --workspacestopped at the agent_daemon failure first.Environment, not a product finding: the orchestrator's
disk-guard.shdeleted this review'starget/debugthree times. One deletion fell inside gate run 1 and causeddaemon exit 127 ... No such file.Gate run 2 (
scripts/verify fastat8907ff41f, umask 022, load ~9), exit 0, verbatim:115 suites, 1344 passed, 0 failed, 167 ignored. TS: 37 pass.
Full findings:
~/.local/state/codex-jobs/infraternal/review-real-logins/findings-r3.md. No fixes, no deploy, no perf VM.Owner demo video for real logins: starting.
real-loginsat290ea53f9(break-it r3 verdict MERGE). "Old" line:release-prod-liveat3048580c1.~/.cache/codex-scratch/demo-real-logins/.kayganddeploy(neither exists today) are created, then removed with the infraternal agent, its units,/var/lib/infraternal, any mesh device or nft table, at the end.netbird ssh -Lforward via monitor01. The infraternal agent on ash1 reaches the demo server through-Rreverse forwards over the same path (TCP fallback; QUIC/UDP cannot cross an SSH forward).kayg; (3) per-host logindeploy, then a missing account falls back to root with a note, then reset; (4) remove and re-add the host,whoamiiskaygagain.Owner demo video for real logins: done. real-logins-demo.webm (2:41, 1280×800, cut from a 9:51 continuous recording; on-screen captions are a demo overlay, not product UI).
Setup. Real server binaries on the build host, own TLS, fresh state. ash1 reached through monitor01 with
netbird ssh -L(SSH) and-R(HTTPS + infraternal agent TCP). Old line:release-prod-live3048580. New line:290ea53f9plus a cherry-pick of dev's072d29673(local commit b734a3f4a, not pushed). The reason is below.What each step showed
3048580, thentop. After that, the server was swapped to the branch build, and the agent binary on ash1 was swapped by hand (liverenamed over, unit restarted, KillMode=process) because this build has no automatic agent update. After a page reload and CA unlock, the same terminal was still runningtop, andhistorystill held the line typed before the upgrade.whoamireturnedkayg.ssh-accounts.set {scope:host, account:deploy},whoamireturneddeploy. Afternosuchuser, it returnedroot. Then reset."fallback":true,"note":"No user nosuchuser here, opened as root", but the UI never shows it (shown here with an overlay)./var/lib/infraternal/.bootstrap-lockwas left behind.whoamireturnedkaygDefects found
290ea53f9lacks dev's072d29673. Upgrading the server from the production line revoked the freshly added host on startup:remote_hosts.revoked_atequals the second the branch server started, with live terminals present. The production line keeps hosts with open sessions (bootstrap_retirement.rs:68). The production line leaves a retirement intent and.bootstrap-lockafter a "Ready" add. Merging dev fixes the revocation. Recorded with the cherry-pick for that reason.thread 'node-plugins' panicked at tokio-1.53.2/src/process/unix/mod.rs:373: there is no reactor running, thenrun-p…service: /var/lib/infraternal/bin/live --bootstrap-uninstall … status=1/FAILURE. Cause:plugins/remote/src/uninstall.rscallstokio::process::Command::spawnfrom the plainstd::thread"node-plugins" worker (plugin_control.rs), so the plan never reaches stdin. The same code is on the production line (removal there also left the agent running). Re-adding is then refused. Reproduced 2/2 on the branch.websocket.rs:1362sends it; the tracer ignores it).root@127.0.0.1for every ash1 window. The details card sayskayg@127.0.0.1, Login kayg, even for deploy or root-fallback shells.-test/shim-testfrom the build-host console session (kayg-testwhoami,root-testwhoami) until the screen was redrawn (screenshots 4 and 3b). Seen twice, after a reload and after the add flow. Not root-caused.ssh -M -N -S …bootstrap master outlived the server process (leaked twice, killed by hand).ssh-accounts.*action only).sshsends every-Rconnection of one session to the last-Rtarget. Each reverse forward needs its own session.Cleanup. Everything I added to ash1 is removed: agent, unit,
/var/lib/infraternal,/run/infraternal-login-*, theinfraternal0mesh device,kayg/deployaccounts and homes, and the temporary/root/.ssh/authorized_keys2(local file;/etc/pveuntouched). passwd, group, shadow, gshadow, subuid and subgid sha256 match the baseline. nft ruleset is empty, as before; 7 links, as before; 0 infraternal units. No VM or container touched. monitor01 known_hosts is identical toknown_hosts.pre-claude-20261017, with no forward listeners left. On the build host: all demo servers, drivers, forwards, leaked SSH masters, local session shims and one zellij session my console started (auspicious-duck) are stopped. State, TLS, temp key and worktrees are deleted. No push, no deploy.kayg referenced this issue2026-10-28 17:53:56 +00:00