No Branch/Tag specified
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".
No due date set.
Dependencies
No dependencies set
Reference
kayg/infraternal#188
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Prebuilt gated dev-head static releases and tracer bundle; capacity-aware user builder; verified CA-preserving handoff deployment with backup, automatic rollback, health and unlocked-CA checks, production tags and main fast-forward. Staging proof only on perf VM. Parents: #154 and #157. Decisions D186/D217/D244/D250.
Started #188 on deploy-pipeline, base
c0d01d2285. Read #154 and #157 histories and D186/D217/D244/D250 plus architecture/process. Round4 missing from base: integrating origin/release-pipeline5f74c655. No production deployment. Existing stop/start deploy cold-locks CA. Signing remains external; no provider or credential-store access.Finding: scripts/release/deploy_remote.py requires signed MANIFEST/MANIFEST.sig/VERSION for both successor and retained rollback image. Builder does not sign or publish, per the brief. Perf VM is reachable, but this worktree has no signed A/B bundles whose bytes match the compiled release trust anchors; the orchestrator must supply publication receipts/bundles before real A->B acceptance. No credential/provider access or production deploy.
Focused script suite: 8 tests passed (real committed-WAL backup, real Unix control framing, functional rollback/web-only checks, load backoff/prune/status ordering). These are functional tests, not performance evidence. Round4 merge has one restart_tests.rs conflict: retained signed/private fixtures, bounded waits, sealed inode assertion, null stdin. Native compilation continues.
Native merge gate first run: cargo test -p infraternal restart: 22 passed, 4 failed, 1 ignored. The failures are bounded child tests (6/9 second startup and compiler bounds), not waived by #118. Full output evidence/deploy-pipeline/merge-tests.log. Repeating serially under CPUWeight10000, retaining all assertions/bounds. Public Forgejo status endpoint for base
c0d01d22returns an empty list, so builder defaults to running the exact-head fast gate in its isolated checkout rather than trusting a guessed status context; status mode is opt-in for a configured full-gate context.Completed and pushed round4 integration
6354fb9f: signed/private stripped restart fixture, unchanged 6/9s bounds, source/sealed inode checks and null stdin. Serial focused gate: 26 passed/0 failed/1 ignored plus 3 restart-filtered integrations. CLI all-target Clippy/fmt and tracer TypeScript check pass.Completed builder/service
c8c1f28f: exact-head gate, pinned static outputs plus tracer, CPUQuota200%/CPUWeight10000/two Cargo jobs, admission threshold8 on8cores, single lifetime lock, keep10 plus durable completion receipts. Unit suite10PASS; systemd validation and Python compilation pass. Full milestone gate continues. No service installation, signing/publication or deploy.Completed/pushed remote transaction
6877e47f, transport/ref entry pointa97c3d47and functional gate wiringddca4f7c. Ten original functional cases pass. Found and reproduced redirect cookie forwarding with a real HTTP fixture (redirect-red.log); fixedb9441036with a no-redirect, proxy-free local opener, eleven cases pass. Streaming artifact transfer adds exact-archive validation, twelve cases pass. No operator session is read from stores/files/argv or printed. Perf-VM lock probe now reports LOCK_BUSY; no staging files/processes were changed. Real A/B acceptance still also requires official signed matching bundles. Full milestone gate has completed native phases and is compiling static artifacts; final-head gate will be captured separately.Milestone gate finding: native test phase failed real_cli_unlocks_an_encrypted_synthetic_key_on_private_pipes at crates/infraternal/tests/ssh_askpass.rs:94, Failure kind Auth / private key or passphrase refused. The fixture uses generated synthetic material through private pipes; no real credential investigation. No #118 waiver asserted for this case. Complete output is retained in verify-milestone.log; static compilation continues. Final-head gate will rerun the unchanged SSH test. Perf VM still returns LOCK_BUSY. Thirteen deploy functional checks pass after streamed transport and metadata-boundary coverage.
Final-head gate:
f913a69fa0. scripts/verify fast exit 1. Verbatim output part 1/3. Mandatory build-host diagnostics are not perf-VM evidence.Final-head gate:
f913a69fa0. scripts/verify fast exit 1. Verbatim output part 2/3. Mandatory build-host diagnostics are not perf-VM evidence.Final-head gate:
f913a69fa0. scripts/verify fast exit 1. Verbatim output part 3/3. Mandatory build-host diagnostics are not perf-VM evidence.Follow-up to the failed
f913a69fgate: exact synthetic-key test on detached origin/devc0d01d22passes (ssh-baseline.log); no waiver. Round4 adds whole-helper SHA256/inode verification (crates/plugins/ssh/src/prompt_image.rs), while the native fixture executable is365361936bytes. The integration fixture now privately copies/strips the real CLI before opening the credential scope, retaining parent/inode/digest/one-use authorization and deadlines. Preliminary focused test2PASS/1explicitTTYignore; rebuilding current workspace after invalidating project debug artifacts to avoid shared-target baseline reuse. Full final-head gate will be repeated after this test-only fix. Official signed A/B cache still absent; perf lock remains busy.Completed/pushed
be46a1eb: optimize the existing sha2 dependency for dev/test only, matching shipping opt-level3. Current-workspace original SSH fixture passes2/0 with1explicitTTYignore; CLI all-target Clippy/fmt pass. No fixture change, dependency, hash algorithm, authorization predicate or deadline change. Evidence00344cd0 retains dev-baseline green, current-workspace red diagnostic and original-fixture green. Final fast gate now runs on00344cd057d77acd85ebb7d45618811872e5f3c1 and supersedes the earlierf913a69freceipts; CLI73PASS/0FAIL/1explicitmeasurementignore so far. No authorization/load waiver. Full output will follow. Prebuilt cache still absent and perf lock busy, so no signed A/B proof or deployment.Final head
d7c6e38ff5. scripts/verify fast exit1, verbatim part 1/7. Supersedes prior interim receipts; mandatory build-host diagnostics are not perf evidence.Final head
d7c6e38ff5. scripts/verify fast exit1, verbatim part 2/7. Supersedes prior interim receipts; mandatory build-host diagnostics are not perf evidence.Final head
d7c6e38ff5. scripts/verify fast exit1, verbatim part 3/7. Supersedes prior interim receipts; mandatory build-host diagnostics are not perf evidence.Final head
d7c6e38ff5. scripts/verify fast exit1, verbatim part 4/7. Supersedes prior interim receipts; mandatory build-host diagnostics are not perf evidence.Final head
d7c6e38ff5. scripts/verify fast exit1, verbatim part 5/7. Supersedes prior interim receipts; mandatory build-host diagnostics are not perf evidence.Final head
d7c6e38ff5. scripts/verify fast exit1, verbatim part 6/7. Supersedes prior interim receipts; mandatory build-host diagnostics are not perf evidence.Final head
d7c6e38ff5. scripts/verify fast exit1, verbatim part 7/7. Supersedes prior interim receipts; mandatory build-host diagnostics are not perf evidence.Implementation handoff, acceptance INCOMPLETE. Branch deploy-pipeline, pushed head
d7c6e38ff5; round4 ancestor5f74c655 is included. Builder/service, warm deploy transaction and transport/ref recorder are committed under scripts/release/; operator contract docs/operations/deploy-pipeline.md; reviewer checklist/evidence evidence/deploy-pipeline/README.md.Final scripts/verify fast exits1:14deployment cases PASS; fmt/VT fmt/CLI compile-out/Clippy/workspace tests/cargo-deny PASS; sole failure static x86 size21882448B versus16404816B. No budget change or waiver. ARM and TS full-gate phases are skipped after that failure; independent tracer type check passes. Complete output posted verbatim above. SHA256 dev/test optimization preserves the existing helper digest/parent/deadline checks; child subprocesses explicitly retain the builder flock.
Remaining: owner/orchestrator must resolve the dev static-size gate and supply officially signed matching A/B bundles; the named perf lock was busy at every subsequent probe. No A->B, listener-gap, unlocked-root-CA or bad-image rollback acceptance numbers were collected. Unit/mocked checks do not substitute. Service installation is a separate operator action under the worktree-only brief. Lost CA custody/dead successor needs explicit recovery; no successful unlocked rollback claim. No production deployment, provider/credential-store access, signing, tag or main change occurred. Issue stays open. Task-owned baseline removed; target cleanup follows.
Cleanup complete: task-owned detached dev baseline, build targets and fixture/receipt scratch removed; worktree clean at pushed
d7c6e38ff5. Final gate transcript posted verbatim in7parts, sole failure static size21882448B versus16404816B. Fourteen deploy cases and native Rust rows pass. Acceptance remains incomplete: signed A/B perf-VM CA/listener/rollback proof absent, service uninstalled; no production deploy, signing/provider access, tag or main change. No issue closure.Owner decision D1 (2026-10-12): handoff-deploy acceptance uses (a) a separate test trust key compiled only into staging builds; a release gate fails any production build containing it. There is no permanent staging environment: the staging server is a throwaway instance on the perf VM per test run (own data, own CA, own port, not public), torn down after.
Resuming #188 on deploy-pipeline at base/head
d7c6e38ff5. Read repository contracts, issue and parent histories, existing evidence, and owner D1. Implementing per-run staging-only compiled trust, production exclusion gate, and throwaway perf-VM signed A/B/C proof with existing passkey fixture. No production deploy. Existing static size failure remains recorded; no budget change. D217/D226/D250/D251.Completed/pushed
0f0106c6: same-release retries within one second now retain distinct backups; fixed-clock regression fails before the fix (backup-collision-red.txt), all15 deploy cases pass (deploy-tests-staging.txt). Repeated staging handoffs exposed this naming collision during fixture preparation. D217/D244/D250. Perf VM reachable; timed lock probe acquired successfully. Implementing isolated real-passkey/128-PTY acceptance and production trust exclusion next.Completed/pushed staging trust
7d2b1b2band production ELF gate6939cc43. Non-default feature compiles only a per-run public key from scratch; production ignores it. Same fresh SSHSIG fixture: staging accepted (4 verifier cases PASS/1explicit ignored measurement); production Untrusted (1PASS). Touched CLI/server all-target Clippy/fmt pass. Static release gate rejects the staging marker before binary-size checks; binary-padding regression RED then GREEN retained. No permanent test key, runtime trust override or new dependency. Static staging build now running; VM lock previously acquired successfully. D1/D217/D226/D250.Completed/pushed reusable test helpers
a3531494and authentication-only preparation590b0622. Remote-feature server Clippy/fmt pass;23 real CA administration cases pass,5explicit shipping cases ignored in the build-host functional run (passkey-fixture-tests.txt). Staging fixture uses those helpers without writing a plaintext HTTPS key; its unit has a private runtime mount. Staging static build completed; production gate rejects that actual stripped ELF (staging-image-production-gate.txt). A/B/C packaging passes the real SSHSIG/verifier checks (staging-artifacts.txt). Perf-VM scale acceptance is starting after native harness packaging; production untouched.Staging artifacts and native harness are packaged; the ephemeral private signing key was deleted before transport. The run is queued through flock -w1800 /var/lock/perf-bench.lock and holds that lock for extraction, test and teardown. No permanent staging instance or production changes. Starting a milestone fast gate while the VM slot is pending; its mandatory build-host diagnostic durations are not performance evidence. Production cut-over documentation also records that channel selection exists, while D251 quiet-window automatic application is a separate implementation prerequisite.
First real VM attempt reached the exclusive slot but failed at fixture startup before any handoff (staging-startup-failure.txt). Code evidence: remote_startup.rs legacy_service refuses behind_proxy and requires the legacy TLS leaf/key layout; the fixture had only legacy issuer.pem. Correcting the fixture to reuse ca_bootstrap::publish_first's retained active/ layout under its own data/remote-ca, then unlock through the real passkey HTTP flow. No production behavior/validation is relaxed. Failed attempt torn down by the transient-unit guard and remote cleanup trap; no acceptance timing claim.
Second VM attempt cold-started and completed the real passkey unlock; failed before first handoff (staging-runtime-path-failure.txt). Fixture physical Unix-socket path was 120 bytes vs Linux maximum107; the daemon namespace /run path was short but the outside PID oracle path was not. Moved only this run runtime mount source to its shorter run root (101 bytes), reused the shared shim PID oracle through an explicit runtime path, and added source-location-only panic reporting (no credential payloads). Production behavior unchanged. D217/D250.
Real staging acceptance PASS on infraternal-perf-test, kernel6.12.69+deb13-amd64, exclusive perf lock; load before0.20/0.51/0.87, after0.44/0.67/0.84 (exact raw context in staging-proof.txt). Twelve signed A/B handoffs: listener-gap conservative brackets p50=24.432ms,p99=204.674ms (nearest rank; n12), worst actual probe interval101.625ms. This tail is a conservative upper bound, not precise blackout duration; nominal1ms sampling uses bounded connect waits. One real passkey unlock; CA stayed unlocked through every verified image replacement. All128 real shims preserved PIDs and all128 resumed fresh input/output, at50users/10000retainednodes. Signed unusable C refused before shutdown with endpoint/image unchanged; actual deploy transaction automatically warmed back to B, CA unlocked. Signed retained image verifies; backup integrity OK,10000nodes/50users retained. Private signer deleted before transport; unit/data/CA/artifacts/runtime removed, teardown_directory_absent=true. No production deployment. Raw evidence evidence/deploy-pipeline/staging-proof.txt; initial fixture failures retained separately. D1/D217/D226/D250.
Correction to the acceptance comment's load-before transcription: raw staging-proof.txt records0.21/0.64/0.84 before,0.44/0.67/0.84 after. The raw VM transcript is authoritative. Handoff/session/CA/rollback/backup values above match that transcript.
Completed/pushed45c5e138 (real deploy driver),b3d2bd58 (real passkey/128-PTY VM fixture),6c1e42c6 (fresh-key build/sign/locked runner and packaging gate),a4da1436 (raw acceptance and orchestrator cut-over documentation). Real VM proof1PASS/0FAIL;12A/B handoffs,128/128shim PIDs and resumed IO,1unlock; C pre-shutdown refusal and automatic verified B rollback; backup10000nodes/50users and integrity OK. Packaging actual-signature test1PASS; remote server all-target Clippy/fmt pass. Sampler qualification remains p50/p99 brackets24.432/204.674ms,worst interval101.625ms. Milestone native rows/cargo-deny PASS; actual production x86 ELF excludes staging trust and is21882448B vs16404816B ceiling (unchanged from inherited head). Final scripts/verify fast runs on
a4da143696; raw output will follow verbatim. Production untouched; D251 automatic application remains separate from its existing channel setting.Final head
a4da143696. scripts/verify fast exit1. Verbatim part1/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part2/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part3/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part4/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part5/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part6/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part7/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part8/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part9/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part10/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part11/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part12/13. Mandatory build-host diagnostics are not performance evidence.Final head
a4da143696. scripts/verify fast exit1. Verbatim part13/13. Mandatory build-host diagnostics are not performance evidence.Finished staging-proof work; pushed deploy-pipeline head
a4da143696. Real VM12signed handoffs PASS; CA stayed unlocked after1real passkey unlock;128/128shims and resumed IO survive; signed C refused before shutdown, actual rollback retains signed B and unlocked CA; backup integrity and10000nodes/50users verified. Conservative listener brackets p50/p99=24.432/204.674ms,worst probe spacing101.625ms; no precise blackout/reconnect-budget claim. Raw evidence and two failed fixtures committed under evidence/deploy-pipeline; own unit/data/CA/artifacts/runtime torn down under lock. Production cut-over documented, never executed. Author security/deployment checklist completed. Final scripts/verify fast exit1:15deploy cases plus1actual-signature packaging case PASS; fmt/VTfmt/compile-out/Clippy/workspace tests/cargo-deny PASS; production trust PASS; sole failure x86static21882448B vs16404816B unchanged ceiling. ARM/TS full-gate phases skipped after that failure; no touched TS. Full final output posted verbatim immediately above. No limit change, waiver, production signing/deploy, tag/main change or issue closure. Production remains blocked on size gate and independent review; D251 automatic quiet-window application is separate. Job scratch cleanup follows.Cleanup complete: task-owned build targets, signing/fixture scratch and generated bytecode removed. Worktree clean at pushed
a4da143696. Perf-VM run transcript confirms teardown_directory_absent=true under the exclusive lock. Final gate output is preserved verbatim in13issue comments and locally evidence/deploy-pipeline/verify-staging-final.log. Staging acceptance passes; production remains blocked by unchanged21882448B vs16404816B static ceiling and independent review. No production deploy or issue closure.Independent review started on review-deploy-pipeline at
a4da143696; merge base with dev8e7467c07c. Reading #188 and parents #154/#157; verifying functional deployment boundaries and recording failing tests. No push, deploy or perf VM under this review brief.R1 P1: remote signed-bundle admission does not authenticate infraternal-x86_64-musl. deploy_remote.py:66-70 substitutes the server image for that manifest entry; apply later publishes the separately stored x86 file (274-277). The client reuses an existing remote SHA directory (deploy:95-100), so local verification does not verify retained remote bytes. Real ephemeral SSHSIG fixture: original complete bundle accepted; changed x86 payload with matching unsigned SHA256SUMS also accepted (REMOTE_ADMISSION unsigned_x86_payload=true refused=false). Failing Bun test committed
a87c33b6on review-deploy-pipeline: scripts/release/deploy-review.test.ts, remote admission refuses an x86 payload outside the signed manifest. No implementation fix or push.Completed recovery-boundary check, commit
602ae108on review-deploy-pipeline. R2 P2: deploy_remote.py:280-295 lets an alias-restoration error escape before requesting warm rollback or restoring web. Real filesystem fixture publishes the server alias, then ENOSPC refuses the next alias and restoration; only 1 restart request occurs, expected 2. Failing test: alias restoration failure still requests the retained warm rollback in scripts/release/deploy-review.test.ts. Daemon boundaries mocked; no VM/performance claim. Full head gate still compiling in the isolated review target. No implementation fix, push or deploy.Completed production-record boundary check on review-deploy-pipeline. R3 P2: scripts/release/deploy:125-135 tags and pushes candidate B to main even with --web-only, while binary A remains running. This conflicts with D250 production identity. Failing test: web-only deployment does not record the candidate as the running binary, scripts/release/deploy-review.test.ts. Transport/ref stand-in reports WEB_ONLY_RECORD candidate_binary_recorded=true; existing functional web-only case separately verifies no restart. No external commands, implementation fix, push or deploy. Fast gate still running on original
a4da1436source.Confirmed inherited parent #157 review R7 remains on target
a4da1436; recorded as R4 P2 here. Reusedefaf7e3freal-exec regression with bounded child cleanup in crates/infraternal/src/restart_path_review_tests.rs. Workspace-filtered test: 0 passed/1 failed; after memfd recovery current_binary() picks scratch review-recovery-path directory/infraternal instead of the original target/debug/deps executable. Location restart_binary.rs:27-40 and restart.rs:199-216. Original-head workspace tests/cargo-deny already passed; static gate still running. This is one inherited P2 in addition to new R1 P1/R2 P2/R3 P2. No implementation fix, push or deploy.Review checkpoint:
a87c33b6(R1 P1 unsigned remote x86 payload),602ae108(R2 P2 restoration error skips process rollback),3c69a8ba(R3 P2 web-only production ref mismatch),02e69589(R4 P2 inherited #157 R7 PATH recovery). Combined new Bun regressions: 0 pass/3 fail; inherited real memfd exec: 0 pass/1 fail. Existing deploy suite: 15 pass/0 fail. Formatting and workspace all-target Clippy pass after added Rust test. Originala4da1436fast gate native test row and cargo-deny pass; static build is pending. Findings are committed separately; no implementation fix, push, deploy or perf VM. Evidence report under evidence/deploy-pipeline-review is assembled and will be committed after final gate output. Current verdict HOLD: P0=0 P1=1 P2=3 P3=0.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 1/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 2/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 3/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 4/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 5/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 6/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 7/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 8/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 9/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 10/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 11/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 12/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 13/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 14/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 15/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 16/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 17/18; build-host diagnostics are not performance evidence.Independent review
4c30bb42of targeta4da143696. scripts/verify fast exit 1. Verbatim part 18/18; build-host diagnostics are not performance evidence.HOLD — do not merge. P0=0, P1=1, P2=3, P3=0. Independent review target
a4da143696; local review-deploy-pipeline head4c30bb42e9.R1 P1: remote complete-bundle admission hashes the server instead of the separately installed x86 payload (deploy_remote.py:67). Real SSHSIG regression accepts changed payload bytes with a valid server and matching unsigned checksums. Test
a87c33b6. This must be fixed before merge.R2 P2: alias restoration error skips the retained warm process rollback; ENOSPC fixture records one restart instead of two. Test
602ae108.R3 P2: --web-only keeps the current binary but tags/moves main to the candidate. Test
3c69a8ba.R4 P2: inherited #157 R7 still loses the installed path after sealed recovery from a relative invocation. Real memfd exec regression
02e69589; parent P2, not newly discovered. P2 cases follow the owner's fix-forward rule.Four failing tests committed separately: new Bun suite 0 pass/3 fail; inherited Rust regression 0 pass/1 fail. Original deployment suite 15/15. Added Rust formatting/workspace all-target Clippy pass. No implementation fixes or production binary size growth; no push, deploy or perf VM. Timing claims were not independently re-measured under this brief. Evidence: evidence/deploy-pipeline-review/README.md; full gate verify-head.log. Findings appended to the prescribed review state file. Task build targets and temporary fixtures removed; worktree clean.
Original-target scripts/verify fast exit 1. All native rows pass, production trust passes; unchanged static x86 21882448B exceeds 16404816B ceiling, ARM/TS phases skipped. Full output posted verbatim in 18 immediately preceding comments. Verbatim summary:
Resuming round3 fixes on deploy-pipeline, base
a4da143696. Read #188 and parent #154/#157 histories, contracts and review evidence at local4c30bb42(named remote ref absent). Bringing in exact four failing review tests, then separate R1/R2/R3/R4 fixes. R4 touches sealed recovery; rerun throwaway staging proof on named perf VM. No production deploy. D217/D226/D244/D250.Completed and pushed
84a8d847(R1). Real fresh SSHSIG regression RED refused=false, GREEN refused=true. Complete remote admission now hashes actual x86 payload and server alias independently. 15 existing deployment cases and one signing/packaging case pass. Evidence evidence/deploy-pipeline/round3/admission-green.log. D226/D250.Completed and pushed
25750a87(R2). Exact ENOSPC regression RED one restart, GREEN two. Alias/web restoration errors no longer skip retained signed process rollback; incomplete restoration reports operator recovery. 15 existing deployment cases pass. Evidence evidence/deploy-pipeline/round3/alias-green.log. D217/D244/D250.Completed and pushed
ad067b38(R3). Exact web-only regression RED candidate_binary_recorded=true, GREEN false. No production tag/main update without executable replacement. All three review script regressions and 15 existing deployment cases pass. Evidence evidence/deploy-pipeline/round3/scripts-green.log. D250.Completed/pushed fast-gate regression wiring: exact three script reviewer tests now run in scripts/verify fast (3/3 PASS), shell syntax PASS. Rust path regression remains in workspace tests. Tracer bun run check PASS (round3/tracer-check.log). Cold/locked successor and filesystem restoration errors remain explicit operator recovery; no production actions.
R4 reproduced on deploy-pipeline after exact test cherry-pick
7bdd97c8: real memfd recovery test 0 PASS/1 FAIL, selects fixture cwd/infraternal instead of target/debug/deps/infraternal-924533e108296a83 (round3/path-red.log). Applying the already-recorded #157 fix-forward choice: preserve absolute service argv0, capture current_exe for relative invocation before sealing. Full restart/Clippy gate runs; staging reproof follows because recovery touches handoff. Gate wiring commit65c827b0 pushed. D217/D224/D250.Completed/pushed
bd83af23(R4). R4 fixed with preserved absolute service argv0 and kernel-resolved executable for relative invocation. Exact real memfd regression RED0/1 -> GREEN1/0; restart unit suite27PASS/0FAIL/1explicitmeasurementignore; fmt and CLI all-target Clippy PASS (round3/restart-green.log). Reuses parent #157 fix-forward choice, no test/deadline/authorization weakening. Staging static rebuild/signing in progress before exclusive VM acceptance. D217/D224/D250.Completed/pushed
edffaef5: avoid redundant retained-executable hashing without changing required signed entries (3review/15deployment/1packaging casesPASS). Completed/pushed4ce0f6f6 operator docs: authenticating both remote payloads and server, warm recovery despite filesystem errors, explicit operator repair for mixed aliases, binary-only production recording. D5/D217/D226/D244/D250. No production deployment.Completed/pushed016b8bef: exact unmodified reviewer-test RED receipts, matching GREEN script/memfd receipts,27restart cases/fmt/Clippy and tracer type check retained in evidence/deploy-pipeline/round3; author release/deployment checklist recorded. The raw transcripts retain three trailing diagnostic spaces for fidelity; production/source diff whitespace clean. Staging static LTO rebuild remains running; no VM instance or production change yet. D217/D226/D244/D250.
Staging rebuild complete on fixed source
bd83af23(static release and native real-passkey/128-PTY harness). Fresh A/B/C signed; private signer deleted before transport. Waiting via flock -w1800 on named perf VM; own throwaway run /root/infraternal-bench/deploy/r953087ad. No production change or timing claim until acceptance and teardown. D1/D217/D226/D250.Completed/pushed65a256c1: fresh locked staging acceptance on fixed source; full raw receipt retained evidence/deploy-pipeline/round3/staging-proof.txt, original receipt unchanged. Machine infraternal-perf-test/kernel6.12.69+deb13-amd64; load1.25/0.65/0.52 ->1.27/0.69/0.53. Twelve signed handoffs preserve CA after1real passkey unlock; all128shim PIDs and resumed IO,50users/10000nodes. Listener-gap conservative brackets p50/p99=18.576/102.768ms, worst actual probe spacing101.438ms (upper bracket, not precise blackout/reconnect-budget claim). Full deploy transaction p50/p99=677.560/802.080ms including backup and separate x86 authentication. Signed C refused before shutdown; actual verified warm B rollback, signed previous-image/backup integrity/counts pass. Private signer deleted before transport; own unit/processes/data/CA/runtime removed, directory absent before lock release. No production changes. Milestone fast gate native rows and production trust PASS; sole unchanged D243 size failure21882704B vs16404816B, +256B vs review target. Final fast gate runs on65a256c1; output will follow verbatim. D1/D217/D226/D244/D250.
Raw VM receipt:
Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 1/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 2/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 3/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 4/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 5/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 6/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 7/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 8/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 9/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 10/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 11/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 12/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 13/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 14/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 15/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 16/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 17/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 18/19. Mandatory build-host diagnostics are not performance evidence.Final head
65a256c1d1. scripts/verify fast exit 1. Verbatim output part 19/19. Mandatory build-host diagnostics are not performance evidence.Finished round3 fixes; deploy-pipeline pushed head 65a256c1d1158eadb812a5770d0cecb67be19822,13atomic commits, remote SHA confirmed and worktree clean. R1 P1 and all3P2s fixed; exact reviewer tests retained without weakening: three script cases PASS and real memfd regression PASS. Restart unit suite27PASS/0FAIL/1explicitmeasurementignore, tracer type check PASS. Fresh locked VM proof12signed handoffs,1unlock,128/128shim PIDs and resumed IO,50users/10000nodes; conservative listener brackets p50/p99=18.576/102.768ms, worst probe spacing101.438ms. C refusal, verified warm B rollback, signed backup integrity/counts and teardown PASS. Evidence/author checklist: evidence/deploy-pipeline/round3/README.md; raw VM receipt staging-proof.txt; operator cut-over docs updated but never executed.
Final scripts/verify fast exit1, complete240232-byte output quoted verbatim in19preceding comments. Every native row and production trust PASS; sole known D243 static-size failure21882704B vs16404816B (+256B vs review target), ceiling unchanged; ARM/TS full-gate stages skipped after failure. No baseline waiver or test weakening. Task build/signing/fixture scratch removed; VM own unit/processes/data/CA/runtime removed before lock release. Production untouched; no tag/main ref, production signer, provider/credential-store or issue-closure action. Ready for independent re-review; production prerequisites remain documented.
Verbatim final summary:
Independent delta review started on local review-deploy-pipeline at target
65a256c1d1; delta basea4da143696, merge base with dev8e7467c07c. Prior local review retained as review-deploy-pipeline-prior (4c30bb42). Exact R1-R4 tests already present byte-for-byte on target; rerunning rather than duplicating cherry-picks. Read #188 and parent #154/#157 history, report and prior findings. No push, deploy or perf VM.Delta checkpoint: target already contains byte-identical R1-R4 regressions (script suite and Rust PATH test). Exact script replays PASS 3/3 under CPUWeight=10000: unsigned_x86_payload=true refused=true, restart_requests=2, candidate_binary_recorded=false. An additional unweighted replay exceeded Bun default 5s bounds in two children; unchanged weighted replay passes, no waiver or assertion change. Full pristine-head fast gate compiling in isolated target. Prepared a new atomic-install/relative-invocation recovery test; not yet compiled or confirmed. No performance measurement or perf VM.
Earlier findings replay completed on
65a256c1: R1 P1, R2 P2 and R3 P2 exact Bun cases PASS 3/3; R4 P2 inherited #157 R7 exact real memfd PATH regression PASS in pristine workspace gate. Test sources match prior4c30bb42byte-for-byte; no cherry-pick needed. Full head test binary was built before linking the additional reviewer-only regression. New atomic-install/relative-invocation case is compiling; no confirmed new finding yet. Native Clippy PASS; full gate continues.R5 P2 confirmed and committed locally as
2dfce6e8. Delta location restart_binary.rs:36-40 captures current_exe() for relative invocation; after an atomic executable install its kernel path ends in " (deleted)". Real private-inode replacement + memfd exec test relative_recovery_after_atomic_install_keeps_live_install_path fails exit101 (0 passed/1 failed): actual /infraternal (deleted), expected live /infraternal. Subsequent default restart/SIGHUP picks the nonexistent path; explicit replacement remains available. Prior R1-R4 exact cases all PASS. No production implementation change or push. Full original-head gate still running; candidate counts P0=0/P1=0/P2=1/P3=0.Focused delta evidence committed locally as
b13ea14a, following failing-test commit2dfce6e8. Report/receipts: evidence/deploy-pipeline-review/delta-65a256c1/README.md. R1-R4 all pass; new R5 P2 real atomic-install/memfd assertion fails 0/1; reviewer fmt and workspace all-target Clippy pass. Counts P0=0/P1=0/P2=1/P3=0; MERGE under owner severity rule, qualified by pending full head gate. Receipt arithmetic checked against author VM transcript only; no independent timing claim. Pristine gate continues with no reported native failure so far. No push/deploy/perf VM.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 1/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 2/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 3/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 4/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 5/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 6/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 7/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 8/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 9/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 10/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 11/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 12/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 13/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 14/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 15/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 16/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 17/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 18/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 19/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 20/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 21/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 22/23. Build-host diagnostic durations are not performance evidence.Independent delta review
205f2cddof original target65a256c1d1. scripts/verify fast exit 1. Verbatim output part 23/23. Build-host diagnostic durations are not performance evidence.MERGE (no P0/P1). Verdict: merge under the owner severity rule. New findings P0=0, P1=0, P2=1, P3=0. Earlier R1-R4 all PASS on target
65a256c1d1; exact test files already present byte-for-byte. Scope only a4da1436..65a256c1; no intervening dev merge.R5 P2: relative invocation plus atomic executable installation leaves a kernel " (deleted)" label. The changed restart_binary.rs:36-40 preserves it as absolute recovery argv0; a subsequent default restart/SIGHUP selects the nonexistent label. Explicit replacement remains available. Actual private-inode swap and real memfd exec test relative_recovery_after_atomic_install_keeps_live_install_path fails 0 passed/1 failed, exit101; committed
2dfce6e8. Fix forward under the owner P2 rule; no implementation fix here.Final local review-deploy-pipeline head:
205f2cddc7. Focused receiptsb13ea14aand final gate205f2cdd. Report: evidence/deploy-pipeline-review/delta-65a256c1/README.md. Added reviewer fmt and workspace all-target Clippy PASS. Full original-head gate exit1: all native rows and production trust PASS; static x86 21882704B versus unchanged 16404816B ceiling FAIL, +256B versus previous review receipt. ARM/TS stages skipped after size failure. No new dependency/profile or shipping reviewer code. This merge verdict does not authorize production use of the size-failing receipt.Complete original-head gate output posted verbatim in the preceding23parts and committed as verify-head.log. Original test binary built before linking the new reviewer-only failure; production implementation stayed unchanged. Author VM receipt arithmetic checked, timing/scale claims not independently remeasured because this brief forbids perf VM. No push, deployment, credential search, perf VM or issue closure. Task-owned scratch, build targets and private fixtures removed; only committed evidence remains.
Verbatim final gate summary:
Started dev-merge-deploy-pipeline on base
efac27a598(current origin/dev). Read #188 and parent #154/#157 histories and repository contracts. Integrating reviewed origin/deploy-pipeline65a256c1, preserving round4 signed immutable replacement/anonymous image/PATH recovery; then exact R5 test2dfce6e8and fix forward. Final suites, staging-only perf VM reproof under short measurement lock, and fast gate follow. Push task branch only; no dev or production update. D217/D250/D256.Merge conflicts resolved: Cargo.toml retains both existing dev/test SHA256 optimizations; restart_binary.rs keeps identical absolute/PATH recovery behavior; restart_path_review_tests.rs retains bounded child cleanup from tooling branch; restart_tests.rs retains dev stripped-cache and source/sealed inode assertions plus incoming sealed-vs-source assertions; CA fixture supports explicit short staging root and private TMPDIR fallback; rust.sh runs both compiler-wrapper and production-trust tests, retaining D243 ceilings and both D244 provider checks. No test functions removed. Script gates: deployment 15/15, packaging 1/1, production trust 1/1, release Python 5/5 and combined Bun review/Worker/deploy 8/8 pass. Compiled CLI workflow pending native binary (initial invocation lacked INFRATERNAL_BIN; environment-only).
Finding: inherited scripts/release/staging-proof holds the shared VM flock around stdin tar transfer and extraction (old lines 132-149), and waits only 1800s. D256 requires measurement-only locking and flock -w 3600. Draft adjustment extracts this run before the lock, locks only the native acceptance command, and tears down the run afterward; --scratch/--evidence avoid using the earlier job's fixed directory/receipt. Python compilation and signed packaging/trust fixtures pass. No VM measurement or production action yet. Merge gate continues compiling pinned native VT.
Merge test setup finding: the initially launched shell retained the long fixture root and 13 restart cases refused at restart_tests.rs:22: Unix socket path 108 bytes (Linux requires <108); 14 passed/1 measurement ignored. This is setup, not a product or #118 failure. Short task-owned HOME-cache fixture alias /home/kayg/.cache/codex-scratch/dm now used for TMPDIR/state/CA roots. The complete failing output is merge-native.log; corrected suites run in merge-native-short.log. Strict touched-crate all-target Clippy and fmt pass. No path bound, test assertion or production permission changed.
Completed/pushed reviewed merge
73ce87a7b3(parentsefac27a5and65a256c1). All dev test functions retained. Fmt/strict touched-crate all-target Clippy PASS; restart main 27 passed/0 failed/1 measurement ignore, plus 3 restart-filtered integrations; server release and remote CA administration filters PASS (CA 27/0/6 explicit shipping ignores); release plugin and standalone SSH suites PASS. Scripts: 15 deployment, 1 signed packaging, 1 production trust, 5 release Python and 8 combined Bun review/Worker/deploy cases PASS. Initial 108-byte fixture socket refusal corrected only through short task root; no assertion/deadline/security change. Exact R5 test imported next asac7c1d72; RED reproduction running. D217/D244/D250.Imported/pushed exact R5 reviewer regression as ac7c1d729 (from
2dfce6e8; full SHA in branch history). Fmt and strict CLI all-target Clippy PASS. RED normal Cargo reproduction exits101: 0 passed/1 failed; actual private install path ends in "infraternal (deleted)", expected live "infraternal" (restart_deleted_path_review_tests.rs:16). Test uses real inode replacement and memfd exec; source/assertions/deadline unchanged. Fix strips only the kernel-added label for a zero-link current inode during relative-path capture, preserving absolute aliases and pathname bytes. Evidence deleted-path-red.log. D217/D250.Completed/pushed R5 fix
d633378325after exact testac7c1d72c7(correct full imported-test SHA). Unchanged real inode/memfd case RED0/1 -> GREEN1/0; restart main28PASS/0FAIL/1explicit measurement ignore, plus3filtered integrations; fmt/strict CLI all-target Clippy PASS. Extra actual exec replays with literal " (deleted)" filename pass for linked and atomically unlinked inodes. Absolute argv0, signed admission, sealed image, immutable-byte/probe/recovery tests unchanged. Evidence recovery-green.log/literal-suffix-green.log. Also pushed30bd461a measurement-only staging lock,680bb895 task-isolated fixtures and60a223ae matching operator docs; packaging/trust tests pass. Fresh static staging build and VM reproof are now running. No dev/production update. D217/D250/D256.Completed/pushed
f3de2d2areproducible literal-suffix driver, reusing unchanged original Rust regression bodies. Python compilation and two real exec replays PASS for linked/unlinked inodes (literal-suffix-driver.log). Compiled release CLI/real TTY workflow also PASS1/0: stable default, no preserves stable, yes persists edge, feature-off/absent-server refusal and action-derived skills (channel-cli.log). Milestone fast now runs server auth after CLI76/0/1ignore, real daemon/VT/askpass rows PASS; staging static image built and native harness packaging continues. Final exact-head gate follows evidence commit. No VM acceptance timing yet, no production or dev update.Fresh real perf-VM staging proof PASS on infraternal-perf-test/kernel6.12.69+deb13-amd64/4vCPU; load0.08/0.17/0.25 ->0.35/0.23/0.27. Twelve signed A/B handoffs preserve CA after1real passkey unlock, all128shim PIDs and all128fresh resumed IO at50users/10000nodes. Listener-gap conservative brackets p50/p99=18.159/26.088ms, worst actual probe spacing4.738ms; no precise blackout/reconnect-budget or causal speedup claim. Signed C refused before shutdown; actual verified warm B rollback keeps CA unlocked, backup integrity/counts and retained signature pass. Actual stripped staging ELF is refused by production-trust gate (expected exit1). Private signer deleted before transfer; raw receipt proves extraction before lock, measurement lock released, own unit/processes/data/CA/runtime removed and directory absent. Run r49dc8c39; raw evidence evidence/dev-merge-deploy-pipeline/staging-proof.txt. No production action. D217/D250/D256.
Completed/pushed evidence21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f: evidence/dev-merge-deploy-pipeline/README.md, reviewer checklist, exact R5 red/green and literal-suffix driver receipts, release/SSH/CA/CLI gates, raw fresh VM proof and production rejection of actual staging ELF. Receipt arithmetic independently checked:12brackets p50/p9918.159/26.088ms; full transaction635.844/681.098ms. Milestone native rows/cargo-deny PASS; production static builds continue. Final scripts/verify fast now runs on exact head21b37bca; final output follows verbatim. Current origin/dev
efac27a5is an ancestor, pushed task branch only. No production update or issue closure.Milestone production x86 static image: production-trust PASS (staging authority absent), no PT_INTERP,22465520B vs unchanged D243 max16404816B. D2448MiB native provider diagnostic PASS; ARM build continues because dev's gate retains both provider checks after a size refusal. Every milestone native row/cargo-deny passed; no waiver or ceiling change. Final exact-head gate21b37bca is rerunning full tests and both static targets; complete output follows verbatim. VM proof/raw receipt already committed.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part1/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part2/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part3/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part4/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part5/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part6/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part7/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part8/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part9/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part10/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part11/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part12/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part13/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part14/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part15/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part16/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part17/18. Build-host harness durations are diagnostics, not performance evidence.
Final head21b37bca7099c6a80ca0ddcdbfa2b6a73bc5d81f. scripts/verify fast exit1; verbatim output part18/18. Build-host harness durations are diagnostics, not performance evidence.
Finished #188 integration. Pushed only dev-merge-deploy-pipeline, head
21b37bca70; eight atomic commits after dev baseefac27a598. Current origin/dev is an ancestor, remote task head matches, worktree clean. Reviewed deploy tooling merged; exact R5 test retained and fixed forward (red 0/1 -> green 1/0). Signed immutable replacement, anonymous-image launch, PATH recovery, staging-only trust, production rejection and all tests retained. Restart 28/0/1 measurement ignore; release plugin 10/0/3 ignores; SSH 108/0/8 ignores; real CA 27/0/6 shipping ignores; deploy/review/packaging/CLI suites pass. Author checklist and raw evidence: evidence/dev-merge-deploy-pipeline/README.md.Fresh perf VM proof: 12 signed handoffs, one real passkey unlock, CA stays unlocked, all 128 shim PIDs and 128 fresh IO resumes survive at 50 users / 10000 nodes. Conservative listener brackets p50/p99 18.159/26.088 ms, worst actual spacing 4.738 ms. Signed bad image refused; actual verified warm rollback, backup integrity/counts and teardown pass. Upload/extraction outside shared lock, measurement under flock -w 3600, cleanup after release. No precise blackout, reconnect-budget or causal speedup claim. VM own unit/data/CA/runtime removed; both local task scratch roots and generated bytecode removed. No production deployment, production signer/provider access, service installation, dev/main/tag update or issue closure.
Final exact-head scripts/verify fast exits 1 solely for known D243 sizes: x86 22465520 bytes vs 16404816 maximum; ARM 19899080 vs 13817816. Every other Rust row passes; 95 passing test rows / 998 cases / 116 explicit ignores. Both static ELFs exclude staging trust and PT_INTERP; x86 8 MiB locked/dump-excluded key-memory check passes. ARM runtime memory protection is not claimed on x86. Separate tracer type check passes; full TS phase is skipped after the Rust size failure. No ceiling change or waiver. Complete final output is posted verbatim in 18 preceding numbered comments, 262162 bytes, SHA256 3d1d964a8db644d607047b7f1871b7c14b48b1d341ceac6e601edd4d550ca853. Local full receipt: evidence/dev-merge-deploy-pipeline/verify-final.log (also retained milestone/type-check logs); issue is the durable final transcript.
Final gate summary, verbatim:
Closed by the orchestrator during the 2026-10-28 handover (#254), on the owner's request to close finished issues. Evidence: Deploy pipeline merged into dev (
21b37bca7is in dev and release-prod-live) and used for the production releases. Reopen if anything is still missing.kayg referenced this issue2026-10-28 17:53:55 +00:00