Evidence on issues, not in the repo; slim the repo (D262)

kayg commented

2026-10-13 05:39:06 +00:00

Owner

Owner, 2026-10-13: "i think evidence should belong to fj issues and not to the repo?" — yes (D262).

Measured on origin/dev 85368c7f: .git 594 MB (packs 529 MiB). Current tree 205 MB: apps/tracer/captures/ 95 MB (673 PNGs total in tree, 100 MB), evidence/ 77 MB. History blobs: PNG 187.5 MB, .gz 29 MB, .log 27 MB (despite *.log in .gitignore: force-added).

Plan:

Done by the orchestrator: job rules now say evidence goes to the issue; helper issue-attach <N> <file>… uploads attachments and prints Markdown links (token read from fj's key store, never in argv/output). Tested on #186.
Repo job: remove evidence/ and apps/tracer/captures/ from the tree; fix every script/test/doc that writes or reads them (write to $HOME/.cache/codex-scratch/<job>/evidence/ instead); .gitignore them; add a scripts/verify fast check that fails on new files over 200 KB or of evidence types (png/jpg/webp/mp4/gz/log/trace) outside an allowlist (fonts, vendored libs, test fixtures); update PROCESS.md and CLAUDE.md wording.
History rewrite (owner approved): at a quiet moment with no jobs running, filter-repo removes those paths from all branches; force-push all refs; recreate worktrees; Forgejo gc. Measured before/after sizes reported here.

Owner, 2026-10-13: "i think evidence should belong to fj issues and not to the repo?" — yes (D262). Measured on origin/dev 85368c7f: `.git` 594 MB (packs 529 MiB). Current tree 205 MB: `apps/tracer/captures/` 95 MB (673 PNGs total in tree, 100 MB), `evidence/` 77 MB. History blobs: PNG 187.5 MB, `.gz` 29 MB, `.log` 27 MB (despite `*.log` in .gitignore: force-added). Plan: 1. Done by the orchestrator: job rules now say evidence goes to the issue; helper `issue-attach <N> <file>…` uploads attachments and prints Markdown links (token read from fj's key store, never in argv/output). Tested on #186. 2. Repo job: remove `evidence/` and `apps/tracer/captures/` from the tree; fix every script/test/doc that writes or reads them (write to `$HOME/.cache/codex-scratch/<job>/evidence/` instead); .gitignore them; add a `scripts/verify fast` check that fails on new files over 200 KB or of evidence types (png/jpg/webp/mp4/gz/log/trace) outside an allowlist (fonts, vendored libs, test fixtures); update PROCESS.md and CLAUDE.md wording. 3. History rewrite (owner approved): at a quiet moment with no jobs running, filter-repo removes those paths from all branches; force-push all refs; recreate worktrees; Forgejo gc. Measured before/after sizes reported here.

final-fast.log

289 KiB

audit-test-rerun.log

238 B

kayg commented

2026-10-13 05:43:21 +00:00

Author

Owner

D262 recorded on dev at 6afc910c. Job rules updated; issue-attach helper live (tested on #186).

Dry-run history rewrite on a mirror (264 refs), removing evidence/, apps/tracer/captures/, *.log, *.trace: 505 MB → 57 MB (pack 55.05 MiB), rewrite 3.3 s.

Order: (1) repo-slim job (queued, Luna max) moves writers, keeps any real test fixtures, adds the gate, and posts the final path list; (2) orchestrator rewrites history with that list when no job is running, force-pushes all refs, recreates worktrees.

D262 recorded on dev at 6afc910c. Job rules updated; `issue-attach` helper live (tested on #186). Dry-run history rewrite on a mirror (264 refs), removing `evidence/`, `apps/tracer/captures/`, `*.log`, `*.trace`: **505 MB → 57 MB** (pack 55.05 MiB), rewrite 3.3 s. Order: (1) `repo-slim` job (queued, Luna max) moves writers, keeps any real test fixtures, adds the gate, and posts the final path list; (2) orchestrator rewrites history with that list when no job is running, force-pushes all refs, recreates worktrees.

kayg commented

2026-10-13 08:50:31 +00:00

Author

Owner

Started repo-slim on branch repo-slim. Worktree is clean at base/HEAD c75c362b4e9279545b1f7e2a433f8b1455df016e (current origin/dev); the issue records D262 at 6afc910c, so I’m proceeding from the branch state actually present. Read all 1 comment on #200; the issue body has no parent issue reference.

Started repo-slim on branch `repo-slim`. Worktree is clean at base/HEAD `c75c362b4e9279545b1f7e2a433f8b1455df016e` (current `origin/dev`); the issue records D262 at `6afc910c`, so I’m proceeding from the branch state actually present. Read all 1 comment on #200; the issue body has no parent issue reference.

kayg commented

2026-10-13 08:55:09 +00:00

Author

Owner

Inventory at c75c362b4e9279545b1f7e2a433f8b1455df016e: git ls-tree -r -l reports 6,919 files / 214,984,302 blob bytes. Tracked output trees: evidence/ 80,487,392 bytes / 4,405 files; apps/tracer/captures/ 83,431,379 bytes / 532 files; crates/infraternal-mesh/evidence/ 844,399 bytes / 16 files. No tracer test reads a committed capture image as a reference; the images are generated review outputs. docs/verification/ has 310 .log (3,874,763 B), 14 .png (2,604,527 B), 57 .json (311,222 B), 9 .jsonl (239,770 B), 5 .txt (5,729 B), and two *-observed.nft receipts (189,444 B). Method Markdown, source scripts, Dockerfiles, and baseline firewall inputs remain. The mesh fuzz corpus and CA probe/reproduction scripts are used by maintained docs, so I’m moving those out of evidence/ before deleting its tree.

Inventory at `c75c362b4e9279545b1f7e2a433f8b1455df016e`: `git ls-tree -r -l` reports 6,919 files / 214,984,302 blob bytes. Tracked output trees: `evidence/` 80,487,392 bytes / 4,405 files; `apps/tracer/captures/` 83,431,379 bytes / 532 files; `crates/infraternal-mesh/evidence/` 844,399 bytes / 16 files. No tracer test reads a committed capture image as a reference; the images are generated review outputs. `docs/verification/` has 310 `.log` (3,874,763 B), 14 `.png` (2,604,527 B), 57 `.json` (311,222 B), 9 `.jsonl` (239,770 B), 5 `.txt` (5,729 B), and two `*-observed.nft` receipts (189,444 B). Method Markdown, source scripts, Dockerfiles, and baseline firewall inputs remain. The mesh fuzz corpus and CA probe/reproduction scripts are used by maintained docs, so I’m moving those out of `evidence/` before deleting its tree.

kayg commented

2026-10-13 09:05:54 +00:00

Author

Owner

Finding: apps/tracer/captures/ contains no image read by a test as a reference fixture; its screenshots are generated review output. The retained mesh corpus is input data, not a receipt: moved crates/infraternal-mesh/evidence/2026-10-07/fuzz-corpus.hex to crates/infraternal-mesh/tests/fixtures/fuzz-corpus.hex (226 bytes). docs/verification/ has 310 .log files (3,874,763 B), 57 .json (311,222 B), 9 .jsonl (239,770 B), 14 .png (2,604,527 B), 5 .txt (5,729 B), and two *-observed.nft receipts (189,444 B); method scripts/config and baseline firewall inputs remain.

Finding: `apps/tracer/captures/` contains no image read by a test as a reference fixture; its screenshots are generated review output. The retained mesh corpus is input data, not a receipt: moved `crates/infraternal-mesh/evidence/2026-10-07/fuzz-corpus.hex` to `crates/infraternal-mesh/tests/fixtures/fuzz-corpus.hex` (226 bytes). `docs/verification/` has 310 `.log` files (3,874,763 B), 57 `.json` (311,222 B), 9 `.jsonl` (239,770 B), 14 `.png` (2,604,527 B), 5 `.txt` (5,729 B), and two `*-observed.nft` receipts (189,444 B); method scripts/config and baseline firewall inputs remain.

kayg commented

2026-10-13 09:06:35 +00:00

Author

Owner

Finding: the first touched TypeScript check failed before compiling because apps/tracer/node_modules lacked bun-types and @types/node (TS2688). Python syntax checks, Node syntax checks and git diff --check passed. I am installing the locked workspace packages and will rerun bun run check.

Finding: the first touched TypeScript check failed before compiling because `apps/tracer/node_modules` lacked `bun-types` and `@types/node` (TS2688). Python syntax checks, Node syntax checks and `git diff --check` passed. I am installing the locked workspace packages and will rerun `bun run check`.

kayg commented

2026-10-13 09:07:44 +00:00

Author

Owner

Step (a) complete: commit 9ea76f3bb8ae9e922b84a6ed5804a7c154b63d72 routes Playwright results, screenshots, browser reports and proof-run receipts to job scratch, with shared Python/Node/TypeScript path helpers. Preserved the mesh fuzz corpus move for the tree-removal step. Gate evidence: bun run check PASS after bun install --frozen-lockfile; Python py_compile, Node --check, and git diff --check PASS. Pushed to repo-slim.

Step (a) complete: commit `9ea76f3bb8ae9e922b84a6ed5804a7c154b63d72` routes Playwright results, screenshots, browser reports and proof-run receipts to job scratch, with shared Python/Node/TypeScript path helpers. Preserved the mesh fuzz corpus move for the tree-removal step. Gate evidence: `bun run check` PASS after `bun install --frozen-lockfile`; Python `py_compile`, Node `--check`, and `git diff --check` PASS. Pushed to `repo-slim`.

kayg commented

2026-10-13 09:10:29 +00:00

Author

Owner

Step (b) complete: commit 65e4c288330520df7d3f29125b29c58fd25de902 adds the merge-base artifact gate to scripts/verify fast. It checks changed/new paths, catches ignored evidence/ and captures/ output, and allows fonts, vendored code and fixture trees. Direct gate: repository artifact gate: PASS (65 changed path(s), merge base c75c362b4e92). Python compilation, shell syntax and git diff --check PASS. Pushed to repo-slim.

Step (b) complete: commit `65e4c288330520df7d3f29125b29c58fd25de902` adds the merge-base artifact gate to `scripts/verify fast`. It checks changed/new paths, catches ignored `evidence/` and `captures/` output, and allows fonts, vendored code and fixture trees. Direct gate: `repository artifact gate: PASS (65 changed path(s), merge base c75c362b4e92)`. Python compilation, shell syntax and `git diff --check` PASS. Pushed to `repo-slim`.

kayg commented

2026-10-13 09:11:24 +00:00

Author

Owner

Finding: docs/verification/mesh-policy-verify/round3/performance/perf-run.py added the shared scratch helper but only placed its adjacent fixture scripts on sys.path. I added the repository scripts/ path after the local fixture path in 4e8e7f8ef857c503b2e8387581d84e0b6ebdbdc2. Python compilation and a focused import/path check pass; the runner itself was not executed.

Finding: `docs/verification/mesh-policy-verify/round3/performance/perf-run.py` added the shared scratch helper but only placed its adjacent fixture scripts on `sys.path`. I added the repository `scripts/` path after the local fixture path in `4e8e7f8ef857c503b2e8387581d84e0b6ebdbdc2`. Python compilation and a focused import/path check pass; the runner itself was not executed.

kayg commented

2026-10-13 09:15:33 +00:00

Author

Owner

Finding: docs/verification/production-batch-4.md identified evidence/prod4/perf-interleaved.sh as its reproducible runner. I preserved it at docs/verification/production-batch-4/perf-interleaved.sh in 09cf81e3cebe4e5ed3ef7cbd540e962f2293a0b1; bash -n passes. The runner writes receipts under /root/infraternal-bench/prod4 when run on the booked benchmark VM; it was not run here.

Finding: `docs/verification/production-batch-4.md` identified `evidence/prod4/perf-interleaved.sh` as its reproducible runner. I preserved it at `docs/verification/production-batch-4/perf-interleaved.sh` in `09cf81e3cebe4e5ed3ef7cbd540e962f2293a0b1`; `bash -n` passes. The runner writes receipts under `/root/infraternal-bench/prod4` when run on the booked benchmark VM; it was not run here.

kayg commented

2026-10-13 09:20:23 +00:00

Author

Owner

Step (c) complete and pushed: 902be3330f removes generated receipts; .gitignore now covers every directory named evidence or captures. Deleted paths/globs for the history rewrite: evidence/ (4,399 files, 80,470,625 B), apps/tracer/captures/ (531 files, 83,430,511 B), crates/infraternal-mesh/evidence/ (15 files, 77,809 B), and docs/verification/**/*.{json,jsonl,log,nft,png,txt} (397 files, 7,225,455 B: json 57/311,222 B; jsonl 9/239,770 B; log 310/3,874,763 B; nft 2/189,444 B; png 14/2,604,527 B; txt 5/5,729 B). No screenshot reference fixture was present in the removed captures tree. Retained the mesh corpus at crates/infraternal-mesh/tests/fixtures/fuzz-corpus.hex; preserved verification methods and the production batch runner. Artifact gate passes after removal: repository artifact gate: PASS (66 changed path(s), merge base c75c362b4e92).

Step (c) complete and pushed: 902be3330f807b08f06cac67f891ae018b735a9a removes generated receipts; .gitignore now covers every directory named evidence or captures. Deleted paths/globs for the history rewrite: `evidence/` (4,399 files, 80,470,625 B), `apps/tracer/captures/` (531 files, 83,430,511 B), `crates/infraternal-mesh/evidence/` (15 files, 77,809 B), and `docs/verification/**/*.{json,jsonl,log,nft,png,txt}` (397 files, 7,225,455 B: json 57/311,222 B; jsonl 9/239,770 B; log 310/3,874,763 B; nft 2/189,444 B; png 14/2,604,527 B; txt 5/5,729 B). No screenshot reference fixture was present in the removed captures tree. Retained the mesh corpus at `crates/infraternal-mesh/tests/fixtures/fuzz-corpus.hex`; preserved verification methods and the production batch runner. Artifact gate passes after removal: `repository artifact gate: PASS (66 changed path(s), merge base c75c362b4e92)`.

kayg commented

2026-10-13 10:27:42 +00:00

Author

Owner

Step (d) is committed and pushed at f754a2e2d578e6a04edb1c784c1faab8da16be11; repo-slim matches origin/repo-slim and the tracked worktree is clean. The docs review found no stale live references to removed capture trees, no missing relative links in edited docs, and no evidence or captures directory remains in the checkout.

Inventory and exact history-rewrite paths/globs:

evidence/ (also covered nested captures/ and evidence/ directories): 4,399 generated files / 80,470,625 B removed. Six verification method files (16,767 B) moved to docs/verification/.
apps/tracer/captures/: 531 generated capture files / 83,430,511 B removed. The 868 B session-bounds/README.md method note moved to docs/perf/session-bounds/production-captures.md. No committed reference screenshot fixture was found there.
crates/infraternal-mesh/evidence/: 15 generated files / 77,809 B removed. The fuzz corpus is retained at crates/infraternal-mesh/tests/fixtures/fuzz-corpus.hex.
docs/verification/**/*.{json,jsonl,log,nft,png,txt}: 397 receipts / screenshots / logs / output files / 7,225,455 B removed (57 json, 9 jsonl, 310 log, 2 nft, 14 png, 5 txt). The two source firewall .nft files and verification method docs remain.

git ls-tree -r -l: before removal (4e8e7f8ef857c503b2e8387581d84e0b6ebdbdc2), 6,923 blobs / 214,994,999 B; final (f754a2e2), 1,582 blobs / 43,798,669 B. Reduction: 5,341 blobs / 171,196,330 B.

Final scripts/verify fast output (exit 1):

repository artifact gate: PASS (111 changed path(s), merge base c75c362b4e92)

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

The full suite reported test result: FAILED. 418 passed; 1 failed; 46 ignored; 0 measured; 0 filtered out; finished in 436.05s; the failure at crates/infraternal-server/src/auth/ca_unlock_audit_tests.rs:97 observed 0 audit events where 4 were expected. The correctly selected isolated rerun passed: test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 464 filtered out; finished in 1.35s.

Static build checks reported x86_64 size 22,612,848 B against a 16,404,816 B budget, and aarch64 size 20,014,520 B against a 13,817,816 B budget. These unrelated Rust test and binary-size failures remain the DoD blocker; no Rust product code changed in this branch.

Full gate transcript: final-fast.log. Isolated audit test rerun: audit-test-rerun.log.

Step (d) is committed and pushed at `f754a2e2d578e6a04edb1c784c1faab8da16be11`; `repo-slim` matches `origin/repo-slim` and the tracked worktree is clean. The docs review found no stale live references to removed capture trees, no missing relative links in edited docs, and no `evidence` or `captures` directory remains in the checkout. Inventory and exact history-rewrite paths/globs: - `evidence/` (also covered nested `captures/` and `evidence/` directories): 4,399 generated files / 80,470,625 B removed. Six verification method files (16,767 B) moved to `docs/verification/`. - `apps/tracer/captures/`: 531 generated capture files / 83,430,511 B removed. The 868 B `session-bounds/README.md` method note moved to `docs/perf/session-bounds/production-captures.md`. No committed reference screenshot fixture was found there. - `crates/infraternal-mesh/evidence/`: 15 generated files / 77,809 B removed. The fuzz corpus is retained at `crates/infraternal-mesh/tests/fixtures/fuzz-corpus.hex`. - `docs/verification/**/*.{json,jsonl,log,nft,png,txt}`: 397 receipts / screenshots / logs / output files / 7,225,455 B removed (57 json, 9 jsonl, 310 log, 2 nft, 14 png, 5 txt). The two source firewall `.nft` files and verification method docs remain. `git ls-tree -r -l`: before removal (`4e8e7f8ef857c503b2e8387581d84e0b6ebdbdc2`), 6,923 blobs / 214,994,999 B; final (`f754a2e2`), 1,582 blobs / 43,798,669 B. Reduction: 5,341 blobs / 171,196,330 B. Final `scripts/verify fast` output (exit 1): ```text repository artifact gate: PASS (111 changed path(s), merge base c75c362b4e92) +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ``` The full suite reported `test result: FAILED. 418 passed; 1 failed; 46 ignored; 0 measured; 0 filtered out; finished in 436.05s`; the failure at `crates/infraternal-server/src/auth/ca_unlock_audit_tests.rs:97` observed 0 audit events where 4 were expected. The correctly selected isolated rerun passed: `test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 464 filtered out; finished in 1.35s`. Static build checks reported x86_64 size 22,612,848 B against a 16,404,816 B budget, and aarch64 size 20,014,520 B against a 13,817,816 B budget. These unrelated Rust test and binary-size failures remain the DoD blocker; no Rust product code changed in this branch. Full gate transcript: [final-fast.log](https://git.kayg.org/attachments/25e724e0-549d-4661-8cab-3af762fc9df3). Isolated audit test rerun: [audit-test-rerun.log](https://git.kayg.org/attachments/cd1b25d1-b47d-47f7-8f4f-aa687354664b).

kayg commented

2026-10-13 10:29:39 +00:00

Author

Owner

Blocked on the required final gate: the repo-slim slice is complete, but DoD needs the Rust audit test and static-size checks green. The isolated audit test passes; the full suite fails once, and x86_64/aarch64 binaries exceed their budgets. No Rust product files changed on this branch. Owner/orchestrator follow-up is needed to resolve or rebaseline those Rust gates before this slice can meet DoD.

kayg referenced this issue

2026-10-13 13:47:51 +00:00

dev gate: restart tests depend on CARGO_TARGET_DIR and wall-clock timeouts #207

kayg referenced this issue

2026-10-13 14:01:21 +00:00

dev gate: restart tests depend on CARGO_TARGET_DIR and wall-clock timeouts #207

kayg referenced this issue from a commit

2026-10-15 14:31:55 +00:00

Move generated evidence to job scratch

kayg referenced this issue from a commit

2026-10-15 14:31:55 +00:00

Gate repository artifact growth against dev