kayg/infraternal
Watch
1
0
Fork
You've already forked infraternal
 0
Code Issues 356 Pull requests Projects Releases Packages Wiki Activity Actions

D251 edge auto-update #211

New issue
Open
opened 2026-10-13 23:09:30 +00:00 by kayg · 679 comments
kayg commented 2026-10-13 23:09:30 +00:00
Owner
Copy link

Backend implementation of D251: gate + structured MERGE admission before edge publication, verified quiet-window server handoff and rollback, update state/events, and host lockstep. Parent: #157; related CA handoff: #154. Backend only; UI states/copy and measured staging proof will be recorded here. No production deployment or signer Worker deployment.

Backend implementation of D251: gate + structured MERGE admission before edge publication, verified quiet-window server handoff and rollback, update state/events, and host lockstep. Parent: #157; related CA handoff: #154. Backend only; UI states/copy and measured staging proof will be recorded here. No production deployment or signer Worker deployment.
admission-functional.log
183 B
source-publication-tests.log
103 B
postponed-before.log
1.2 KiB
postponed-after.log
3 KiB
postponed-clippy.log
340 B
update-cli.log
267 B
machine-parser-green.log
2.1 KiB
api-capability-tests.log
3 KiB
local-update-fuzz.log
34 KiB
binary-attribution.txt
5.9 KiB
base-bloat-crates.json
803 B
update-engine-tests2.log
3.6 KiB
restart-tests.log
5.5 KiB
shared-format-tests2.log
3.9 KiB
verify-final.log
271 KiB
head-bloat-crates.json
818 B
shared-futures-isolated-gate.log
6.7 KiB
signing-prerequisite-isolated-gate.log
876 B
staging-typescript-check-green.log
36 B
ephemeral-signer.log
98 B
verify-head.log
161 KiB
skill-tests.log
5.5 KiB
skill-clippy.log
1.6 KiB
pending-staging.patch
32 KiB
update-staging-first.log
996 B
update-staging-eighth.log
5.6 KiB
alias-after.log
822 B
update-staging-ninth.log
997 B
alias-before.log
2.2 KiB
alias-clippy2.log
199 B
perf-vm-machine.log
73 B
channel-switch-ready-red.log
1.2 KiB
channel-switch-isolated-gate.log
4 KiB
size-boundary-red.log
454 B
size-boundary-green.log
287 B
terminal-diagnostic-clippy.log
1.3 KiB
terminal-diagnostic-tests.log
2.3 KiB
patched-size-boundary-tests.log
287 B
patched-staging-build-and-run.log
2.2 KiB
final-ratchet-order-map.json
2 KiB
shipping-size-candidate.txt
351 B
managed-update-proof.txt
1.1 KiB
profile-echo-results.log
853 B
postprobe-production-artifacts.json
853 B
postprobe-production-builds.log
966 B
process-mode-update-proof.txt
3.8 KiB
owned-io-update-proof.txt
4 KiB
route-probe-backpressure-red.log
1.1 KiB
final-production-artifacts.json
853 B
postprobe-stable-boundaries.log
287 B
postprobe-edge-boundaries.log
287 B
final-production-builds.log
966 B
final-edge-size-boundary-tests.log
287 B
final-static-recipe-tests.log
499 B
postprobe-recipe-admission.log
333 B
iterate-after-io.log
303 KiB
staging-close-diagnostic-final-tests.log
934 B
staging-kill-mode-green.log
100 B
final-stable-size-boundary-tests.log
287 B
probe-fenced-update-proof.txt
3.7 KiB
patched-update-attempt.txt
3.4 KiB
image-io-scheduler-red.log
1.1 KiB
owned-image-io-clippy.log
199 B
owned-image-io-tests.log
3.6 KiB
staging-close-diagnostic-final-clippy.log
200 B
staging-kill-mode-red.log
828 B
staging-kill-mode-clippy.log
1.1 KiB
staging-kill-mode-tests.log
2.3 KiB
final-static-recipe-tests.log
333 B
postprobe-fast.log
307 KiB
iterate.log
288 KiB
compact-profile-gate.log
18 KiB
image-io-scheduler-green.log
644 B
deploy-source-red.log
966 B
feed-metadata-red.log
1,011 B
feed-metadata-green.log
101 B
pump-probe-fence-red.log
2.2 KiB
configured-update-proof.txt
7.5 KiB
deploy-source-green.log
245 B
complete-metadata-update-proof.txt
8.4 KiB
probe-authority-pool-red.log
1.3 KiB
storage-free-probe-update-proof.txt
7.7 KiB
rustls-patch-gate.log
128 KiB
history-map.json
11 KiB
history-boundary-4e68641a.log
3.9 KiB
history-boundary-9dfb1d0b.log
9.1 KiB
history-boundary-633908ac.log
6 KiB
local-control-fuzz-run.log
20 KiB
pump-probe-fence-green.log
1 KiB
pump-probe-fence-clippy.log
1.1 KiB
probe-authority-pool-green.log
4.9 KiB
pump-output-credit-red.log
1.4 KiB
lifecycle-serial-diagnostic.log
1.1 KiB
history-boundary-734dc14d.log
4 KiB
local-control-fuzz-no-lto.log
182 KiB
final-fast.log
306 KiB
pump-nodelay-tests.log
1.1 KiB
fresh-settings-red.log
1.3 KiB
fresh-settings-green.log
1.4 KiB
fresh-settings-clippy.log
199 B
probe-authority-pool-clippy.log
200 B
active-streams-tests.log
1.4 KiB
active-streams-packaging-tests.log
101 B
socket-work-diagnostic-final-shape-clippy.log
199 B
one-route-update-proof.txt
1.2 KiB
history-listener-runtime-tests.log
875 B
pump-nodelay-clippy.log
254 B
route-probe-safe-update-proof.txt
3.8 KiB
distributed-pump-tests.log
1 KiB
distributed-pump-clippy.log
200 B
prestage-input-tests.log
2.4 KiB
prestage-input-clippy.log
1.1 KiB
prestage-repeat-1-proof.txt
2.5 KiB
prestage-repeat-2-proof.txt
2.7 KiB
prestage-repeat-3-proof.txt
2.9 KiB
live-follow-boundary-status.txt
319 B
poststorage-production-artifacts.json
853 B
static-recipe-red.log
483 B
static-recipe-final.log
333 B
stable-size-boundary-tests.log
287 B
distributed-update-proof.txt
7.5 KiB
pump-output-credit-green.log
1.6 KiB
pump-output-credit-clippy.log
199 B
one-route-repeat-update-proof.txt
1.3 KiB
edge-size-boundary-tests.log
287 B
compact-profile.patch
729 B
runtime-count-update-proof.txt
5.1 KiB
diagnosed-update-proof.txt
11 KiB
one-route-third-update-proof.txt
2.5 KiB
final-iterate.log
258 KiB
host-slots-slice.log
3.9 KiB
host-slots-clippy.log
3.6 KiB
sender-exact-slice.log
5.5 KiB
local-control-exact-slice.log
4.4 KiB
live-cli-red.log
2.8 KiB
live-cli-green.log
531 B
live-cli-exact-slice.log
5.5 KiB
readiness-red.log
1.2 KiB
readiness-exact-slice.log
5.6 KiB
listener-runtime-exact-slice.log
6.2 KiB
startup-plan-exact-slice.log
5.9 KiB
catalog-exact-slice.log
4.8 KiB
startup-engine-exact-slice.log
5 KiB
startup-stdin-red.log
3.1 KiB
startup-cli-exact-slice.log
11 KiB
route-probe-backpressure-green.log
3.6 KiB
route-probe-backpressure-clippy.log
254 B
install-cache-red.log
1.6 KiB
install-selector-red.log
1.3 KiB
install-pending-red.log
1,010 B
install-exact-slice.log
5.2 KiB
host-wiring-exact-slice.log
24 KiB
staging-ack-tests.log
769 B
poststorage-ratchet-order-map.json
2.9 KiB
merge-iterate-4.log
398 KiB
checkpoint-owned-root.log
500 B
poststorage-stable-size-gates.log
287 B
poststorage-edge-size-gates.log
287 B
follow-progress-fixture-tests.log
2.4 KiB
host-progress-update-proof.txt
5.3 KiB
follow-retry-red.log
1.1 KiB
follow-retry-green.log
1.6 KiB
follow-and-runtime-clippy.log
1.1 KiB
watchdog-live-state.txt
20 KiB
watchdog-diagnostic-update-proof.txt
5.7 KiB
runtime-unit-fixture-tests.log
2.4 KiB
retry-runtime-update-proof.txt
6.2 KiB
merge-iterate-5.log
288 KiB
runtime-lock-short-root.log
383 B
native-pending-v6.patch
32 KiB
legacy-preparation-v6.tar.gz
45 KiB
retry-iterate.log
302 KiB
postretry-ratchet-order-map.json
1.7 KiB
postretry-stable-size-gates.log
287 B
postretry-edge-size-gates.log
287 B
final-head-fast.log
262 KiB
final-control-queue-rerun.log
323 B
final-head-fast-retry.log
303 KiB
final-gate-summary.txt
572 B
cleanup-final.txt
344 B
final-gate-completion.json
149 B
retry-full-routes-update-proof.txt
10 KiB
profile-patched-echo-results.log
2.8 KiB
full-route-vm.log
4.5 KiB
native-latency-vm.log
1.6 KiB
retention-functional.log
751 B
backup-admission.log
2 KiB
migration-rollback.log
314 B
retention-vm-fenced.log
705 B
native-latency-repeat-vm.log
1.6 KiB
postretry-production-artifacts.json
853 B
reconnect-isolated-vm.log
1.4 KiB
verify-fast.log
342 KiB
production-x86-sections.txt
2.8 KiB
production-arm-sections.txt
2.2 KiB
merge-status-tone-red.log
1.2 KiB
merge-status-tone-green.log
622 B
merge-release-agent-check.log
353 B
current-resume.txt
3 KiB
retention-functional.txt
200 B
pending-review-fixes.patch
48 KiB
review-fixes-functional.txt
9.3 KiB
touched-gate.log
6 KiB
merge-iterate-2.log
207 KiB
merge-control-red.log
3.3 KiB
control-codes-red.log
2.5 KiB
control-codes-green.log
5 KiB
collection-and-control-final.log
419 B
native-preflight.log
61 B
listener-compatibility-gate.log
6 KiB
listener-note-red.log
1.4 KiB
listener-note-green.log
255 B
review-fixes-bloat-diff.txt
834 B
native-diagnostic-pair.log
4 KiB
ready-collection-red.log
993 B
writer-gate.log
4.6 KiB
merge-server-check-2.log
207 B
pool-churn-short-root.log
213 B
protected-recovery-resource-tests-gate.log
1.2 KiB
writer-only-size.txt
550 B
transport-sharing-gate.log
1.1 KiB
merge-control-green.log
547 B
transport-profile-harness-gate.log
4 KiB
server-z-artifact.json
179 B
server-z-size-build.log
303 B
transport-profile-s-vm.log
923 B
sqlite-prototype-functional.log
4.2 KiB
sqlite-backup-prototype-source.zip
16 KiB
sqlite-backup-prototype-source.json
428 B
musl-listener-red.log
1.6 KiB
sqlite-prototype-gate.log
7.2 KiB
native-sharing-ten-pairs.zip
23 KiB
native-sharing-pairs-summary.json
9 KiB
native-sharing-pairs-artifacts.json
441 B
musl-listener-green.log
891 B
backup-dependencies-gate.log
14 KiB
control-static-sizes.txt
616 B
d301-caps.log
2.6 KiB
listener-backlog-gate.log
16 KiB
listener-backlog-websocket-supplement.log
429 B
listener-note-fuzz.log
27 KiB
delta-trust-x86_64-unknown-linux-musl.log
56 B
shared-cipher-draft.zip
3.5 KiB
sealed-bytes-prototype-gate.log
460 B
sqlite-changed-geometry-red.log
1,001 B
sqlite-changed-geometry-green.log
825 B
sqlite-changed-geometry-clippy.log
199 B
key-copy-prototype-gate.log
698 B
listener-fixed-port-gate.log
2.6 KiB
sqlite-backup-bridge-gate.log
11 KiB
backup-database-snapshot-gate.log
2.1 KiB
merge-iterate-6.log
458 KiB
merge-feature-sets.txt
155 B
backup-authority-unwired-draft.zip
22 KiB
snapshot-cancellation-wipe-gate.log
1.2 KiB
snapshot-cancellation-red.log
1.2 KiB
backup-database-tests-gate.log
1.2 KiB
handoff-fuzz-observability-gate.log
687 B
staging-startup-receipts-gate.log
2.3 KiB
staging-fixture-preparation-gate.log
720 B
custody-host-dispatch-unwired-draft.zip
61 KiB
primitive-iterate-gate.log
164 KiB
encrypted-checkpoint-and-custody-draft.zip
83 KiB
gone-fixture-short-state-root-gate.log
6.5 KiB
key-copy-readonly-red-gate.log
1.2 KiB
expanded-custody-prototype-gate.log
4.4 KiB
expanded-custody-prototype-source.json
4.1 KiB
primitive-iterate-second-fixture-root-failure.log
139 KiB
primitive-iterate-third-failure.log
263 KiB
recovery-integration-draft-checkpoint.zip
138 KiB
poisoned-browser-cleanup-selected-gate.log
2.4 KiB
poisoned-browser-writer-red-gate.log
1.3 KiB
poisoned-browser-writer-fix-gate.log
4.1 KiB
owned-short-tmpdir.json
179 B
initial-browser-probe-gate.log
8.9 KiB
recovery-integration-continuation-draft.zip
175 KiB
recovery-control-barrier-prototype-gate.log
7.1 KiB
recovery-integration-64-qualified-drafts.zip
192 KiB
recovery-integration-next.txt
3.9 KiB
primitive-iterate-restart-lock-failure.log
262 KiB
restart-runtime-fixture-ownership-gate.log
12 KiB
primitive-iterate-control-output-budget-failure.log
261 KiB
edge-recovery-continuation-01fe0793e.zip
216 KiB
native-control-isolation-functional-gate.log
13 KiB
control-fifo-budget-artifact.json
541 B
protected-draft-independent-qualification-gate.log
7.4 KiB
protected-draft-independent-qualification-source.json
8.7 KiB
edge-recovery-continuation-01fe0793e-broker.zip
313 KiB
primitive-iterate-gate.log
305 KiB
key-authority-prototype-rerun-gate.log
7.3 KiB
protected-key-identity-prototype-source.json
8.7 KiB
backup-encryption-dependencies-gate.log
7.5 KiB
shared-sealed-bytes-gate.log
4 KiB
ca-copy-wire-compatibility-gate.log
2.5 KiB
ca-shared-cipher-gate.log
8.1 KiB
backup-key-copy-gate.log
1.7 KiB
backup-resource-encryption-gate.log
1.6 KiB
backup-key-memory-gate.log
2.2 KiB
shared-key-administrator-authority-gate.log
8.7 KiB
backup-parser-fuzz-dependency-gate.log
1.6 KiB
backup-key-copy-fuzz-target-gate.log
332 B
private-action-interface-gate.log
5.8 KiB
ca-private-body-codec-gate.log
12 KiB
private-key-proof-host-gate.log
1.7 KiB
encrypted-primitives-iterate-gate.log
311 KiB
native-control-isolation-functional-gate.log
13 KiB
native-control-budget-static-harness-gate.log
355 KiB
control-fifo-budget-artifact.json
541 B
control-fifo-budget-vm.log
8.6 KiB
shared-owned-io-gate.log
3.8 KiB
edge-recovery-continuation-92ac89d0c.zip
327 KiB
shared-private-state-reads-gate.log
2.2 KiB
shared-encrypted-copy-publication-gate.log
8 KiB
backup-authority-dependencies-gate.log
2.4 KiB
backup-authority-tests-gate.log
7.9 KiB
backup-key-authority-gate.log
3.6 KiB
post-fence-checkpoint-admission-gate.log
8.2 KiB
foreground-during-recovery-preparation-gate.log
10 KiB
foreground-during-preparation-red-gate.log
1.3 KiB
input-cancels-pending-preparation-gate.log
8.4 KiB
input-cancels-pending-preparation-red.log
1.4 KiB
shared-protected-intake-gate.log
2.9 KiB
recovery-scope-functional-observations.json
1.3 KiB
private-plugin-host-dispatch-gate.log
3.4 KiB
backup-custody-descriptor-gate.log
1.4 KiB
backup-private-runtime-dependencies-gate.log
3 KiB
backup-custody-service-gate.log
2.8 KiB
server-backup-feature-dependencies-gate.log
1.3 KiB
bounded-backup-record-framing-gate.log
1.3 KiB
backup-record-parser-fuzz-target-gate.log
1.6 KiB
encrypted-consistent-checkpoint-bundle-gate.log
2.2 KiB
merge-progress.patch.gz
1.4 MiB
current-resume.txt
785 B
native-proxy-and-first-event-diagnostics.zip
16 KiB
legacy-preparation-current.tar.gz
50 KiB
backup-inventory-fuzz-dependency-gate.log
1.1 KiB
backup-inventory-parser-fuzz-target-gate.log
333 B
encrypted-point-filesystem-tests-gate.log
1.8 KiB
internal-cli-worker-binding-gate.log
3 KiB
single-owner-admission-fixture-gate.log
1.1 KiB
849476024-pending-push.patch
2.8 KiB
generic-internal-cli-dispatch-gate.log
11 KiB
generic-internal-cli-dispatch-gate.log
11 KiB
merge-progress.patch.gz
1.4 MiB
merge-server-remote-check-2.log
207 B
generic-exec-resource-contract-gate.log
3.4 KiB
rebase-browser-adapter-red.log
7 KiB
rebase-shipping-fixture-adapters-gate.log
7.3 KiB
generic-elf-capability-adapter-gate.log
1 KiB
plugin-exec-resource-host-gate.log
10 KiB
backup-recovery-control-protocol-gate.log
4.3 KiB
pinned-parent-termination-gate.log
1 KiB
recovery-startup-barrier-tests-gate.log
2.5 KiB
private-resource-visitor-feature-gate.log
4.9 KiB
private-resource-visitor-contract-gate.log
3.8 KiB
backup-private-resource-capability-gate.log
4.2 KiB
shared-private-resource-labels-gate.log
3.7 KiB
server-private-resource-capability-gate.log
2.5 KiB
shared-protected-ca-snapshot-gate.log
9.3 KiB
confirmed-server-resource-host-gate.log
4 KiB
same-socket-foreground-red.log
1.9 KiB
merge-help-green.log
446 B
legacy-preparation-v3.tar.gz
39 KiB
rebased-dependency-identities.json
217 B
recovery-continuation-221964e26.zip
72 KiB
bounded-foreground-admission-wait-gate.log
3.5 KiB
same-socket-foreground-continuity-gate.log
7.7 KiB
ca-inventory-capacity-red.log
3.3 KiB
capture-encrypted-ca-administrator-state-gate.log
5.5 KiB
receiver-bound-image-admission-gate.log
1.1 KiB
sealed-image-pair-receiver-gate.log
9.5 KiB
release-final-activation-feature-gate.log
2.6 KiB
shared-opened-image-digest-gate.log
2 KiB
preflight-recovery-database-validation-gate.log
4.7 KiB
release-host-epoch-followup-gate.log
1.1 KiB
remove-obsolete-staging-liveness-diagnostic-gate.log
3.2 KiB
staging-failed-image-migration-gate.log
1.9 KiB
authenticated-host-restore-boundary-gate.log
4.3 KiB
optional-private-recovery-interface-gate.log
4.2 KiB
typed-private-recovery-admission-gate.log
2 KiB
shared-handoff-replies-gate.log
8.7 KiB
fuzz-private-handoff-replies-gate.log
2.1 KiB
public-recovery-waiting-state-schema-gate.log
4 KiB
optional-recovery-waiting-consumer-gate.log
4.3 KiB
event-driven-recovery-waiting-gate.log
4.4 KiB
event-driven-recovery-waiting-red.log
1.1 KiB
private-host-recovery-boundary-gate.log
4.3 KiB
backup-owned-recovery-service-gate.log
4.9 KiB
generic-process-lifecycle-contract-gate.log
2.9 KiB
factory-process-lifecycle-dispatch-gate.log
14 KiB
release-recovery-transition-gate.log
1.4 KiB
checkpoint-writer-input-red.log
2.9 KiB
recovery-integration-next-20261016.txt
13 KiB
recovery-drafts-c9ba05ec4.zip
38 KiB
checkpoint-writer-input-continuity-gate.log
7.6 KiB
merge-feature-followup.log
75 KiB
private-recovery-channel-tests-gate.log
2.1 KiB
owned-recovery-worker-tests-gate.log
1.1 KiB
owned-recovery-guardian-tests-gate.log
1.7 KiB
recovery-startup-contracts-gate.log
4.3 KiB
memory-only-warm-backup-custody-gate.log
4.6 KiB
optional-recovery-runtime-composition-gate.log
5 KiB
release-startup-health-and-checkin-gate.log
5 KiB
configured-identity-role-associations-gate.log
3.3 KiB
configured-identity-preflight-gate.log
2.2 KiB
configured-identity-preflight-red.log
1.1 KiB
exact-server-startup-ownership-gate.log
2.6 KiB
release-final-activation-reservation-gate.log
6.1 KiB
recovery-runtime-drafts-f59d67a8d.zip
38 KiB
recovery-runtime-ordered-continuation-f59d67a8d.zip
52 KiB
original-host-recovery-admissions-gate.log
2.6 KiB
commit-file-inventory.txt
44 KiB
retained-point-identities-after-collection-gate.log
1.1 KiB
recovery-transition-coordinates-gate.log
1.4 KiB
release-engine-readiness-preflight-gate.log
1.7 KiB
release-engine-readiness-preflight-red.log
1.3 KiB
follow-progress-fixture-clippy.log
199 B
d295-uncompiled-continuation.tar.gz
72 KiB
d295-red.log
6 KiB
d295-green.log
1.8 KiB
d295-green-source-pending-lint.tar.gz
73 KiB
d295-followup-green-red.log
2.6 KiB
d295-followup-cli-tests-red.log
11 KiB
d295-api-tests.log
4.6 KiB
d295-green.log
1.7 KiB
d295-release-tests.log
4.6 KiB
d295-cli-tests.log
7.8 KiB
d295-clippy.log
72 B
d295-cancellation-red.log
3.3 KiB
d295-edge-admission.log
183 B
d295-staging-artifacts.log
101 B
d295-baseline-socket.log
2.5 KiB
d295-iterate.log
291 KiB
d295-cancellation-green.log
3.1 KiB
d295-runtime-short-root.log
29 KiB
d295-iterate-clean.log
336 KiB
d295-integrity-red.log
21 KiB
d295-shipping-artifacts.json
931 B
d295-integrity-green.log
26 KiB
d295-integrity-clippy.log
417 B
d295-staging-full-vm.log
9.1 KiB
d295-staging-routes-vm.log
8.2 KiB
d295-staging-transport-vm.log
7.3 KiB
resume-recovery.log
3.2 KiB
resume-idle-red-remote.log
2.7 KiB
resume-fixed-pump-tests.log
1.2 KiB
resume-fixed-clippy.log
1.2 KiB
resume-staging-routes-vm.log
18 KiB
resume-staging-full-vm.log
2.7 KiB
resume-listener-vm.log
1.7 KiB
resume-staging-combined2-vm.log
11 KiB
resume-iterate.log
309 KiB
resume-staging-convergence-vm.log
11 KiB
resume-transport-vm.log
8.1 KiB
resume-locale-isolated.log
556 B
resume-writer-red.log
1.1 KiB
resume-writer-green.log
2.8 KiB
resume-redundant-copy-red.log
1.1 KiB
resume-writer-green.log
3.1 KiB
fmt3-managed-vm.log
29 KiB
fmt3-transport-vm.log
16 KiB
resume-fence-red.log
2 KiB
resume-fence-final-tests.log
14 KiB
resume-fence-final-clippy.log
72 B
final-transport-vm.log
8.4 KiB
final-writer-cost-vm.log
1.8 KiB
final-managed-vm.log
23 KiB
final-retention-vm.log
1.2 KiB
final-routes-vm.log
18 KiB
final-reconnect-vm.log
1.7 KiB
resume-final-iterate.log
340 KiB
resume-final-production-artifacts.json
672 B
resume-final-fast-initial-red.log
172 KiB
resume-census-fixture-tests.log
13 KiB
resume-census-fixture-clippy.log
197 B
resume-final-fast.log
340 KiB
resume-final-gate-artifacts.json
534 B
final-native-pairs.tar.gz
11 KiB
resume-native-pairs-summary.json
14 KiB
final-native-manifest.json
794 B
d295-fast.log
348 KiB
d295-native-summary.json
2.4 KiB
d295-original-native-raw-audit.json
86 KiB
d295-size-vm.log
456 B
d295-clock-red.log
693 B
recovery-target-capacity-gate.log
3.9 KiB
ea-06-clock.patch
2.2 KiB
delta-clock-red.log
4.5 KiB
delta-clock-green.log
563 B
delta-clippy.log
72 B
delta-server-update_recovery__.log
3.1 KiB
delta-server-remote_.log
13 KiB
delta-agent-tests.log
18 KiB
delta-release-tests.log
6.6 KiB
delta-server-initial.log
68 KiB
delta-server-runtime__tests__.log
6.4 KiB
delta-server-restart_open_liveness_review__.log
1.3 KiB
delta-static-recipe-red.log
627 B
delta-static-recipe-green.log
333 B
delta-ssh-config-isolation-retry.log
949 B
delta-ssh-workspace-retry.log
24 KiB
delta-pacing-clippy.log
1.2 KiB
delta-pacing-unit.log
2.8 KiB
delta-pacing-socket.log
1.3 KiB
delta-iterate-retry.log
305 KiB
delta-dev-profile-native.json
274 B
delta-profile-removal.patch
831 B
delta-production-artifacts.json
1.1 KiB
delta-trust-aarch64-unknown-linux-musl.log
56 B
delta-iterate-pacing.log
305 KiB
delta-control-queue-remote-rerun.log
3.8 KiB
delta-profile-00-output-dev.log
2.6 KiB
delta-profile-00-output-dev.log
417 B
delta-profile-00-output-compact.log
417 B
delta-profile-00-payload-dev.log
371 B
delta-profile-00-payload-compact.log
374 B
server-repair-pending-v8.patch
41 KiB
legacy-preparation-v8.tar.gz
43 KiB
delta-candidate-reconnect-vm.log
1.7 KiB
delta-candidate-reconnect-driver.log
2.1 KiB
n-nm-diff.txt
5.7 KiB
n-branch-bloat-crates.json
4.7 KiB
n-dev-bloat-crates.json
4.7 KiB
merge-check.log
13 KiB
merge-release-tests.log
106 B
merge-staging-tests.log
101 B
recovery-control-barrier-prototype-source.json
8.9 KiB
merge-progress.patch.gz
1.4 MiB
merge-release-check.log
2 KiB
pre-legacy-sizes.txt
616 B
baseline-static-x86.log
50 KiB
cache-reclaim.log
773 B
server-backup-custody-adapter-gate.log
5 KiB
merge-iterate-green.log
402 KiB
merge-checkpoint-green.log
500 B
merge-ts.log
71 KiB
capability-collision-red.log
999 B
capability-collision-green.log
6 KiB
receiver-isolated-red.log
1.5 KiB
daemon-receiver-bit8-red.log
616 B
receiver-green-bit8.log
169 KiB
request-coverage-gate.log
7.4 KiB
request-features.txt
126 B
inventory-harness-gate.log
2.1 KiB
staging-root-red.log
1.3 KiB
staging-root-green.log
1.1 KiB
host-docs-gate.log
0 B
static-sizes.txt
636 B
static-recipe.json
3.3 KiB
warm-path-bound.txt
346 B
warm-path-functional.txt
243 B
author-review-current.txt
2.8 KiB
merge-admission-tests.log
183 B
warm-handoff-prepare.log
10 KiB
inventory-harness-trust.txt
702 B
final-cap-gate.log
1.1 KiB
static-sizes.txt
1.9 KiB
final-size-comparison.json
215 B
perf-archive.txt
220 B
MANIFEST.json
22 KiB
perf-archive.txt
220 B
MANIFEST.json
22 KiB
run-inventory.py.txt
3 KiB
run-warm.py.txt
5.9 KiB
baseline-inventory.patch.txt
5.1 KiB
updater-only.patch.txt
353 KiB
physical-root-probe.log
416 B
first-fast-symlink.log
236 KiB
static-recipe-fixture-red.log
633 B
static-recipe-fixture-green.log
333 B
second-fast-long-tmp.log
403 KiB
compact-tmp-probes.log
602 B
final-fast.log
499 KiB
final-fast-summary.txt
1.1 KiB
final-cleanup.txt
1.2 KiB
author-review-current.txt
3.9 KiB
static-format-checks.txt
736 B
disk-full-red.log
826 B
logout-red.log
724 B
selector-red.log
2.7 KiB
final-fast.log
310 KiB
final-ts.log
71 KiB
baseline-build.log
19 KiB
source-comparison.json
480 B
final-sizes.json
1.6 KiB
reused-recovery.log
1.1 KiB
final-bootstrap.log
15 KiB
disk-full-red.log
826 B
dev-auth-audit.json
3.4 KiB
union-sequence.log
490 B
merge-clippy.log
7.9 KiB
baseline-build.log
20 KiB
selector-red.log
2.7 KiB
selector-lock-red.log
1 KiB
recovery-green.log
3.8 KiB
disk-full-green.log
306 B
recovery-clippy.log
186 B
release-green.log
6.7 KiB
release-clippy.log
1.6 KiB
recovery-green.log
3.8 KiB
disk-full-green.log
306 B
recovery-clippy.log
187 B
arm-shared-build.log
558 B
disk-full-green.log
306 B
recovery-clippy.log
187 B
final-size-comparison.json
653 B
cap-boundaries.log
287 B
static-recipe-tests.log
333 B
exact-static-gates.log
654 B
author-review.txt
2 KiB
final-fast-first.log
419 KiB
baseline-watchdog.log
1.9 KiB
final-fast-cache-collision.log
177 KiB
final-fast.log
512 KiB
cleanup-proof.json
306 B
preserved-final-images.json
458 B
native-clean.log
474 B
watchdog-blocks.log
1.3 KiB
watchdog-inodes.log
1.4 KiB
stale-screen.log
966 B
run-union.txt
1.1 KiB
server-inodes.log
883 B
server-inodes-trace.log
1.2 KiB
source-comparison.json
3.3 KiB
stale-screen-dev.log
283 B
union-1.log
6.8 KiB
union-2.log
6.8 KiB
union-3.log
6.8 KiB
union-4.log
6.8 KiB
union-5.log
6.8 KiB
recovery.log
3.6 KiB
server-blocks.log
306 B
setup-short-root.log
375 B
repair-full.log
1.2 KiB
release-agent.log
6.9 KiB
ssh-repair.log
7.5 KiB
server-inodes-head.log
883 B
final-fast.log
435 KiB
size-review-first.log
1.1 KiB
baseline-static.log
11 KiB
baseline-static-retry.log
184 B
size-review.log
2 KiB
static-comparison.json
1.3 KiB
target-x86_64-unknown-linux-musl.log
8.8 KiB
target-aarch64-unknown-linux-musl.log
8.8 KiB
head-fast.log
425 KiB
busy-isolated.log
248 B
last-check-sequence.log
621 B
dev-busy-1.log
248 B
dev-busy-2.log
248 B
dev-busy-3.log
248 B
dev-busy-4.log
248 B
dev-busy-5.log
248 B
tracer-check.log
495 B
tracer-check-installed.log
36 B
plan.pdf
122 KiB
plan.pdf
122 KiB
plan.pdf
124 KiB
plan.pdf
122 KiB
verify-fast.log
242 KiB
replay-size-short-root.log
322 B
verify-fast-final.log
468 KiB
verify-fast.log
483 KiB
storage-primitives-35b2234b7b79.tar.gz
147 MiB
package-gates.log
5.8 KiB
subscription-baseline-default.log
3.2 KiB
subscription-branch-default.log
2.7 KiB
foreground-server-suite.log
47 KiB
foreground-server-remote-suite.log
78 KiB
socket-240-summary.txt
1 KiB
readonly-auth-single-red.log
783 B
readonly-auth-gates.log
1.4 KiB
readonly-auth-suite.log
28 KiB
readonly-runtime-single-red.log
1.7 KiB
readonly-runtime-recheck.log
978 B
readonly-runtime-suite.log
14 KiB
readonly-plugins-single-red.log
1.2 KiB
readonly-plugins-shipping-gates.log
1.8 KiB
readonly-plugins-api-suite.log
3.9 KiB
readonly-plugins-inventory-suite.log
4 KiB
readonly-plugins-server-suite.log
1.4 KiB
readonly-sockets-single-red.log
1.4 KiB
readonly-sockets-recheck.log
1.4 KiB
readonly-sockets-server-suite.log
79 KiB
lock-descriptor-single-red.log
1.2 KiB
lock-descriptor-single-green.log
657 B
retained-binding-single-red.log
1.2 KiB
retained-binding-single-green.log
549 B
lock-descriptor-release-suite.log
4.5 KiB
listener-gates.log
5.7 KiB
listener-remote-runtime-suite.log
6.5 KiB
listener-restart-suite.log
4.5 KiB
listener-cli-remote-suite.log
880 B
warm-handoff-31c23dce5971.tar.gz
186 MiB
package-warm-proof.log
1.8 KiB
cancellable-backup-single-red.log
539 B
cancellable-backup-single-green.log
529 B
cancellable-backup-suite.log
951 B
cancellable-backup-gates.log
817 B
blocking-copy-single-red.log
783 B
blocking-copy-gates.log
3.3 KiB
generation-lock-transfer-red.log
579 B
descriptor-transfer-gates.log
3.6 KiB
descriptor-transfer-dev-research-clippy.log
4.7 KiB
descriptor-transfer-research-clippy.log
4.7 KiB
watchdog-transport-800910486.tar.gz
4 KiB
owner-checkpoint-sizes.txt
628 B
owner-checkpoint-static.log
35 KiB
owner-checkpoint-size-boundaries.log
387 B
writer-floor-red.log
1.6 KiB
writer-floor-green.log
1.6 KiB
writer-floor-gates.log
6.4 KiB
writer-floor-cancellation-red.log
1.2 KiB
writer-240-6585e7b8b.tar.gz
3.2 KiB
writer-milestone-fast-interrupted.log
7.3 KiB
writer-floor-cancellation-green.log
1.7 KiB
writer-floor-cancellation-queued-rollback.log
2.4 KiB
writer-floor-cancellation-gates.log
6 KiB
writer-240-c66e24296.tar.gz
45 B
writer-240-c66e24296.tar.gz
3.3 KiB
writer-c66e24296-fast-size-failure.log
418 KiB
writer-checkpoint-size-red.log
1.1 KiB
writer-checkpoint-size-green.log
387 B
startup-order-red.log
1.1 KiB
startup-order-green.log
3.8 KiB
pinned-state-root-red.log
1.2 KiB
pinned-state-root-green.log
3.9 KiB
pinned-state-root-clippy-first.log
4.5 KiB
adoption-original-red.log
1.2 KiB
adoption-original-first-green.log
551 B
adoption-original-pinned-path-first.log
5.8 KiB
adoption-original-parser-gates.log
8.6 KiB
adoption-original-server-gates.log
4.9 KiB
runtime-wal-red.log
2.1 KiB
runtime-wal-red-explicit-close.log
1.1 KiB
runtime-wal-green.log
643 B
runtime-wal-gates.log
83 KiB
fixture-red.log
3.1 KiB
verify-fast-6ef72af939c4a604fcb03cc4bc619d3c979c00d1.log
265 KiB
verify-fast-54e730f2afe61113f5fe6ec501d1c2a997b18910.log
261 KiB
verify-fast-7d8ea8959df9b123aa33cdbc2ef9cca448e71904.log
414 KiB
verify-fast-acd7b780c97242787b28076bbc8a690fdd9d3625.log
412 KiB
verify-fast-fa875f0b3733ef997b6299d55478b90173b4286b.log
525 KiB
EVIDENCE.json
5.9 KiB
proofs-fa875f0b3733ef997b6299d55478b90173b4286b.log
12 KiB
ATTRIBUTION.json
34 KiB
size-attribution.tar.gz
1.7 MiB
QUALIFICATION.json
17 KiB
qualification-receipts.tar.gz
6.4 KiB
qualification-receipts-with-cleanup.tar.gz
6.6 KiB
recovery-green.log
3.8 KiB
checkpoint-single-decode.log
2.6 KiB
candidate-before-trim.log
18 KiB
kayg commented 2026-10-13 23:09:44 +00:00
Author
Owner
Copy link

Started edge-autoupdate at base/head 57b0c3ddca, from origin/dev. Parents #157 and #154 histories retrieved; reviewed release pipeline is already integrated. No origin/deploy-pipeline ref exists, but scripts/release/dev_builder.py and verified deployment are present. Scope D186/D226/D244/D250/D251, backend only. No production or Worker deployment.

Started edge-autoupdate at base/head 57b0c3ddca8e190f674071e39dcc0aed1ca76cf6, from origin/dev. Parents #157 and #154 histories retrieved; reviewed release pipeline is already integrated. No origin/deploy-pipeline ref exists, but scripts/release/dev_builder.py and verified deployment are present. Scope D186/D226/D244/D250/D251, backend only. No production or Worker deployment.
kayg commented 2026-10-13 23:10:16 +00:00
Author
Owner
Copy link

D251 additive contract proposal before implementation: orchestrator writes one bounded private REVIEW JSON receipt per full dev SHA, with schema=1, sha, verdict=MERGE, p0=0, p1=0 and bundle_sha256 binding the completed bundle SHA256SUMS. Builder admission separately requires exact SOURCE and GATE.sha/result=passed; no review prose or --review-clear attestation. Opt-in publication calls the existing immutable publisher, with credentials supplied only by the operator environment; this job never obtains credentials or deploys the Worker. Receipt absence/HOLD/nonzero counts/mismatch fails closed and may be retried without rebuilding. Updater will retain signed previous image and route through round-4 admission. Finding: checked-in Worker/public verifier still emit/read SHA256SUMS, while round-4 replacement requires identity-bearing MANIFEST/MANIFEST.sig; publication must require both formats from the externally deployed hardened signer rather than silently admit legacy-only releases.

D251 additive contract proposal before implementation: orchestrator writes one bounded private REVIEW JSON receipt per full dev SHA, with schema=1, sha, verdict=MERGE, p0=0, p1=0 and bundle_sha256 binding the completed bundle SHA256SUMS. Builder admission separately requires exact SOURCE and GATE.sha/result=passed; no review prose or --review-clear attestation. Opt-in publication calls the existing immutable publisher, with credentials supplied only by the operator environment; this job never obtains credentials or deploys the Worker. Receipt absence/HOLD/nonzero counts/mismatch fails closed and may be retried without rebuilding. Updater will retain signed previous image and route through round-4 admission. Finding: checked-in Worker/public verifier still emit/read SHA256SUMS, while round-4 replacement requires identity-bearing MANIFEST/MANIFEST.sig; publication must require both formats from the externally deployed hardened signer rather than silently admit legacy-only releases.
kayg commented 2026-10-13 23:14:32 +00:00
Author
Owner
Copy link

Completed publish-admission steps, all pushed: b894c660 (admission module), f7263429 (refusal tests), c12e2154 (existing publisher adapter + round-4 metadata), fe6cb35d (builder late-review publication), 9afb4efd (ordering/admission tests). Functional results: 14 admission/publication tests, 15 existing deployment tests and 5 existing release tests pass; bash -n and git diff --check pass. No signing keys, credentials, live upload or Worker deployment. Newer successful dev publication fences off late older reviews, preventing channel rewind. Quiet-window runtime and hosts are not implemented yet.

Completed publish-admission steps, all pushed: b894c660 (admission module), f7263429 (refusal tests), c12e2154 (existing publisher adapter + round-4 metadata), fe6cb35d (builder late-review publication), 9afb4efd (ordering/admission tests). Functional results: 14 admission/publication tests, 15 existing deployment tests and 5 existing release tests pass; bash -n and git diff --check pass. No signing keys, credentials, live upload or Worker deployment. Newer successful dev publication fences off late older reviews, preventing channel rewind. Quiet-window runtime and hosts are not implemented yet.
kayg commented 2026-10-13 23:18:23 +00:00
Author
Owner
Copy link

Backend/UI contract for the later design pass (runtime implementation still pending):

  • Current: "Current version · "; "Channel · Edge" / "Channel · Stable". Edge explanation: "Edge builds pass their gates and review, but may still break." Stable never falls back to edge.
  • Checking: "Checking for updates…". Downloading/verifying/staging: "Preparing …"; no ready notification before all checks pass.
  • Ready: Inbox "Update ready · ", notes link "Release notes", action "Update now". One toast per newly verified version: "Update ready · " with "Update now"; reconnect does not repeat the toast.
  • Waiting: "Updates after minutes without typing or a connection in progress." Default N=5. Next window = last input/completed attach/handshake + N; show "Waiting for connections to finish" while attach/handshake is active. Typing resets the window.
  • Applying: "Updating to …". Successful result: "Updated to ". Failure with warm recovery: "Update failed · Restored ". Verification failure: "Update could not be verified"; retain current image.
  • Rollback control: "Roll back to "; unavailable copy "No previous verified version". Applying rollback: "Restoring …". Result: "Restored ".
  • Settings → Server → Updates: current version/channel, quiet-window minutes, next window, ready release/notes/Update now, previous verified version/Roll back, last result, newest-first bounded history.
  • Hosts: "Updating infraternal agent to …", success "Up to date", failure "Update failed · Previous version restored". The source is the exact server version, never the public latest pointer.
    No UI or server-state API is shipped by the publish-admission commits.
Backend/UI contract for the later design pass (runtime implementation still pending): - Current: "Current version · <version>"; "Channel · Edge" / "Channel · Stable". Edge explanation: "Edge builds pass their gates and review, but may still break." Stable never falls back to edge. - Checking: "Checking for updates…". Downloading/verifying/staging: "Preparing <version>…"; no ready notification before all checks pass. - Ready: Inbox "Update ready · <version>", notes link "Release notes", action "Update now". One toast per newly verified version: "Update ready · <version>" with "Update now"; reconnect does not repeat the toast. - Waiting: "Updates after <N> minutes without typing or a connection in progress." Default N=5. Next window = last input/completed attach/handshake + N; show "Waiting for connections to finish" while attach/handshake is active. Typing resets the window. - Applying: "Updating to <version>…". Successful result: "Updated to <version>". Failure with warm recovery: "Update failed · Restored <previous version>". Verification failure: "Update could not be verified"; retain current image. - Rollback control: "Roll back to <previous version>"; unavailable copy "No previous verified version". Applying rollback: "Restoring <version>…". Result: "Restored <version>". - Settings → Server → Updates: current version/channel, quiet-window minutes, next window, ready release/notes/Update now, previous verified version/Roll back, last result, newest-first bounded history. - Hosts: "Updating infraternal agent to <server version>…", success "Up to date", failure "Update failed · Previous version restored". The source is the exact server version, never the public latest pointer. No UI or server-state API is shipped by the publish-admission commits.
kayg commented 2026-10-13 23:26:02 +00:00
Author
Owner
Copy link

Publish admission is complete at pushed 7822f34b (including direct uploader ancestry/pinning checks, both signed formats, functional tests and operations contract). 14 admission/publication + 5 signed script fixtures pass; full native gate was preliminary and stopped before editing runtime, not claimed as final. Next additive backend contract: plugin API exposes optional server-start work under the same abort/join ownership as node/socket work; disable leaves no updater work. A generic process foreground-activity primitive coordinates input and in-progress attaches/handshakes with an exclusive handoff window; signing remains round-4 image admission. Current WebSocket input is websocket.rs:1568, attach :1446; browser handshake run_socket; remote TLS/QUIC handshakes remote_accept.rs. No existing backend Inbox store was found (only frontend Inbox models), and the existing wire Hello reports protocol version, not binary version; host upgrade must implement the reserved frozen UpgradeOffer/Accept/chunk/CheckIn/Result contract rather than pretend Hello already supplies it.

Publish admission is complete at pushed 7822f34b (including direct uploader ancestry/pinning checks, both signed formats, functional tests and operations contract). 14 admission/publication + 5 signed script fixtures pass; full native gate was preliminary and stopped before editing runtime, not claimed as final. Next additive backend contract: plugin API exposes optional server-start work under the same abort/join ownership as node/socket work; disable leaves no updater work. A generic process foreground-activity primitive coordinates input and in-progress attaches/handshakes with an exclusive handoff window; signing remains round-4 image admission. Current WebSocket input is websocket.rs:1568, attach :1446; browser handshake run_socket; remote TLS/QUIC handshakes remote_accept.rs. No existing backend Inbox store was found (only frontend Inbox models), and the existing wire Hello reports protocol version, not binary version; host upgrade must implement the reserved frozen UpgradeOffer/Accept/chunk/CheckIn/Result contract rather than pretend Hello already supplies it.
kayg commented 2026-10-14 00:25:09 +00:00
Author
Owner
Copy link

Rollback finding: SQLx validates applied migration versions; adding release state as core migration 0026 would make the previous image reject the newer journal even though the tables are additive. Moved the uncommitted schema into the release plugin (src/schema.sql), installed idempotently when enabled. Core migration history remains byte-for-byte unchanged. This permits earlier verified images to start against the extra plugin-owned tables; no database restore occurs during rollback. Runtime final admission now obtains a feature-provided configuration/authority snapshot after sealed-image verification and probe, then atomically fences foreground work. Core handoff does not interpret release settings or schema.

Rollback finding: SQLx validates applied migration versions; adding release state as core migration 0026 would make the previous image reject the newer journal even though the tables are additive. Moved the uncommitted schema into the release plugin (src/schema.sql), installed idempotently when enabled. Core migration history remains byte-for-byte unchanged. This permits earlier verified images to start against the extra plugin-owned tables; no database restore occurs during rollback. Runtime final admission now obtains a feature-provided configuration/authority snapshot after sealed-image verification and probe, then atomically fences foreground work. Core handoff does not interpret release settings or schema.
kayg commented 2026-10-14 01:08:38 +00:00
Author
Owner
Copy link

Completed and pushed shared contracts: fbaa7cdd (overflow-safe release ordering), e164b0fc (bounded version-bound private request + removable final-admission lease), dcbe2f52 (release-owned additive schema). Earlier ce1718ed supplies foreground coordination and server-start hook. Current touched-crate clippy passed for API/release/server/binary; 26 API unit + 2 routing and 14 release unit + 3 review integration tests pass, with benchmark/helper rows ignored. Two daemon lifecycle tests pass. Exact queued versions and requester session hashes are stored; final admission rechecks owner/freshness, feature enable, selected channel and current quiet duration after sealed-image verification/probe, while a writer reservation prevents settings from changing during the foreground fence. Pending runtime implementation remains uncommitted until its final focused gates pass. No production/Worker deployment or provider credentials.

Completed and pushed shared contracts: fbaa7cdd (overflow-safe release ordering), e164b0fc (bounded version-bound private request + removable final-admission lease), dcbe2f52 (release-owned additive schema). Earlier ce1718ed supplies foreground coordination and server-start hook. Current touched-crate clippy passed for API/release/server/binary; 26 API unit + 2 routing and 14 release unit + 3 review integration tests pass, with benchmark/helper rows ignored. Two daemon lifecycle tests pass. Exact queued versions and requester session hashes are stored; final admission rechecks owner/freshness, feature enable, selected channel and current quiet duration after sealed-image verification/probe, while a writer reservation prevents settings from changing during the foreground fence. Pending runtime implementation remains uncommitted until its final focused gates pass. No production/Worker deployment or provider credentials.
kayg commented 2026-10-14 01:17:08 +00:00
Author
Owner
Copy link

Host follow-up contract: move the existing release-verification implementation behind an optional release-verify feature in infraternal-plugin-api, preserving server re-exports. Reuse the same OpenSSL/SHA engines and both trust anchors; no new foundational library or cryptographic implementation. This avoids a node depending on the complete server crate or a duplicated verifier. Node upgrade control stays machine-only on the already-authenticated server connection, with exact signed version/architecture/size/hash, resumable bounded chunks, explicit downgrade and a temporary 30-second check-in watchdog. A/B image slots and public metadata are fsynced before atomic selection. No key or provider credential is introduced.

Host follow-up contract: move the existing release-verification implementation behind an optional release-verify feature in infraternal-plugin-api, preserving server re-exports. Reuse the same OpenSSL/SHA engines and both trust anchors; no new foundational library or cryptographic implementation. This avoids a node depending on the complete server crate or a duplicated verifier. Node upgrade control stays machine-only on the already-authenticated server connection, with exact signed version/architecture/size/hash, resumable bounded chunks, explicit downgrade and a temporary 30-second check-in watchdog. A/B image slots and public metadata are fsynced before atomic selection. No key or provider credential is introduced.
kayg commented 2026-10-14 01:53:42 +00:00
Author
Owner
Copy link

Authority audit finding at e6a95cf4: postponed explicit handoffs cleared requested_user/requested_token_hash before requeuing. The retry then appeared locally authorized. Regression postponed_manual_request_retains_its_owner_proof_on_retry failed before the fix (0 passed, 1 failed; updater_tests.rs:300). Fix retains both original proof fields when requeuing; final admission still checks owner and session freshness. Receipts: evidence/postponed-before.log and postponed-after.log under edge-autoupdate scratch. D251.

Authority audit finding at e6a95cf4: postponed explicit handoffs cleared requested_user/requested_token_hash before requeuing. The retry then appeared locally authorized. Regression postponed_manual_request_retains_its_owner_proof_on_retry failed before the fix (0 passed, 1 failed; updater_tests.rs:300). Fix retains both original proof fields when requeuing; final admission still checks owner and session freshness. Receipts: evidence/postponed-before.log and postponed-after.log under edge-autoupdate scratch. D251.
kayg commented 2026-10-14 01:55:58 +00:00
Author
Owner
Copy link

Completed retry-authority correction in 7deb11f8 (pushed). Regression failed before the fix; release tests now pass (15 unit tests passed, 1 ignored; review_pool 1 passed; review_restart 2 passed, 2 ignored), formatting and touched release clippy pass. Requeued explicit requests retain the original owner proof. Full branch gate and local-update fuzz build remain running. Host lockstep and perf VM quiet-window acceptance are still outstanding.

Completed retry-authority correction in 7deb11f8 (pushed). Regression failed before the fix; release tests now pass (15 unit tests passed, 1 ignored; review_pool 1 passed; review_restart 2 passed, 2 ignored), formatting and touched release clippy pass. Requeued explicit requests retain the original owner proof. Full branch gate and local-update fuzz build remain running. Host lockstep and perf VM quiet-window acceptance are still outstanding.
kayg commented 2026-10-14 02:09:23 +00:00
Author
Owner
Copy link

Milestone gate finding: x86 static image is 22,536,848 bytes, cap 22,204,304, delta +332,544; no cap changed. Workspace test stopped at an obsolete release skill assertion requiring unreviewed wording (75 passed, 1 failed, 1 ignored). Updating the assertion to require each declared instruction and covering all update commands. Parser sanitizer fuzz target completed 100,000 inputs without failure. Perf VM quiet-window fixture is being prepared; host lockstep is still outstanding.

Milestone gate finding: x86 static image is 22,536,848 bytes, cap 22,204,304, delta +332,544; no cap changed. Workspace test stopped at an obsolete release skill assertion requiring unreviewed wording (75 passed, 1 failed, 1 ignored). Updating the assertion to require each declared instruction and covering all update commands. Parser sanitizer fuzz target completed 100,000 inputs without failure. Perf VM quiet-window fixture is being prepared; host lockstep is still outstanding.
kayg commented 2026-10-14 02:11:11 +00:00
Author
Owner
Copy link

Compiled update controls completed in ef9e25dd (pushed): default quiet window 5, configured 12, two invalid bounds refused, stale selection refused, concurrent request refused, exact manual and rollback snapshots persisted.

Compiled CLI receipt

Admission tests: 14 passed
Signed SOURCE/publication tests: 5 passed
Retry regression before fix: 1 failed
Release tests after retry fix
Release clippy receipt

Compiled update controls completed in ef9e25dd (pushed): default quiet window 5, configured 12, two invalid bounds refused, stale selection refused, concurrent request refused, exact manual and rollback snapshots persisted. [Compiled CLI receipt](https://git.kayg.org/attachments/ee7acd68-33e7-4fb9-b572-0cb26347d72e) [Admission tests: 14 passed](https://git.kayg.org/attachments/1f755da4-e47a-46e0-bafe-3588cacae18e) [Signed SOURCE/publication tests: 5 passed](https://git.kayg.org/attachments/09f887ba-c4b2-4d16-85e7-c2be8ad4c750) [Retry regression before fix: 1 failed](https://git.kayg.org/attachments/54b3b304-0e07-489d-aaff-efc880ef8581) [Release tests after retry fix](https://git.kayg.org/attachments/b4e506b7-d3fe-4b2e-bd74-5e70c4fc8441) [Release clippy receipt](https://git.kayg.org/attachments/dfd6079d-bc6a-4a11-8e0b-b9562cad9aae)
kayg commented 2026-10-14 02:16:08 +00:00
Author
Owner
Copy link

Completed skill contract checks in 607e57d5 (pushed): previously failing test now passes and checks every instruction on all seven operator paths; fmt and all-target binary clippy pass. Ephemeral SSHSIG fixture helper 0176e612 and interoperability test 129eacf8 pushed: original bytes verify and changed bytes refuse; private authority is retained only in anonymous memory and closed before transfer.

Functional sanitizer receipt: 100,000 inputs, no failure
Signed engine tests
Real sealed-exec/recovery tests
Shared verifier/API tests

The sanitizer receipt is functional parser coverage, not a host performance measurement. Timing evidence remains pending the exclusive VM run.

Completed skill contract checks in 607e57d5 (pushed): previously failing test now passes and checks every instruction on all seven operator paths; fmt and all-target binary clippy pass. Ephemeral SSHSIG fixture helper 0176e612 and interoperability test 129eacf8 pushed: original bytes verify and changed bytes refuse; private authority is retained only in anonymous memory and closed before transfer. [Functional sanitizer receipt: 100,000 inputs, no failure](https://git.kayg.org/attachments/4e8e79a3-1668-4088-af81-9c04da071f7e) [Signed engine tests](https://git.kayg.org/attachments/9c0eb44e-0aea-4b29-b7ca-0ebcb4e2d625) [Real sealed-exec/recovery tests](https://git.kayg.org/attachments/732a4d98-9117-4c81-b7a2-3c43d4ab66e9) [Shared verifier/API tests](https://git.kayg.org/attachments/194d4ed9-1de7-4bcc-9f47-40b935325656) The sanitizer receipt is functional parser coverage, not a host performance measurement. Timing evidence remains pending the exclusive VM run.
kayg commented 2026-10-14 02:30:09 +00:00
Author
Owner
Copy link

Milestone scripts/verify fast completed with failures, not final acceptance. Both static budgets failed: x86 22,536,848 B / 22,204,304 B cap (+332,544); ARM 19,941,576 B / 19,638,744 B cap (+302,832). No budget changed. The failing skill assertion is corrected in 607e57d5; focused test and clippy pass.

Full milestone gate receipt
Corrected skill test
Binary clippy
Ephemeral fixture signature interoperability

Verbatim milestone gate table:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+
Milestone scripts/verify fast completed with failures, not final acceptance. Both static budgets failed: x86 22,536,848 B / 22,204,304 B cap (+332,544); ARM 19,941,576 B / 19,638,744 B cap (+302,832). No budget changed. The failing skill assertion is corrected in 607e57d5; focused test and clippy pass. [Full milestone gate receipt](https://git.kayg.org/attachments/d6d53ea9-a165-4d25-ab8b-827089b78aad) [Corrected skill test](https://git.kayg.org/attachments/9c8dfba8-dccf-4b81-a870-88cfb96be7d8) [Binary clippy](https://git.kayg.org/attachments/916f5f74-c4a9-46cf-bb4b-6bfd0f1cc960) [Ephemeral fixture signature interoperability](https://git.kayg.org/attachments/8c394bf5-a327-4b53-ab6f-3d759f0d5f46) Verbatim milestone gate table: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ```
kayg commented 2026-10-14 02:59:41 +00:00
Author
Owner
Copy link

First exclusive VM attempt reached real passkey unlock and 128 real PTYs, then failed during browser reattachment (ca_handoff_shipping_tests.rs:622). It is not a successful acceptance or listener-gap measurement. The unit and unique VM directory were removed. Adding bounded close-code diagnostics and retaining public-only signed fixture artifacts for retries.

Separate deployment-path regression: current-image metadata was looked up beside the launcher alias rather than its signed target. installed_alias_resolves_its_signed_metadata_directory failed before the fix; four signed-engine tests pass after canonicalizing metadata discovery while still authenticating /proc/self/exe bytes.

First exclusive VM attempt reached real passkey unlock and 128 real PTYs, then failed during browser reattachment (ca_handoff_shipping_tests.rs:622). It is not a successful acceptance or listener-gap measurement. The unit and unique VM directory were removed. Adding bounded close-code diagnostics and retaining public-only signed fixture artifacts for retries. Separate deployment-path regression: current-image metadata was looked up beside the launcher alias rather than its signed target. installed_alias_resolves_its_signed_metadata_directory failed before the fix; four signed-engine tests pass after canonicalizing metadata discovery while still authenticating /proc/self/exe bytes.
kayg commented 2026-10-14 03:45:58 +00:00
Author
Owner
Copy link

Continuation record; incomplete, not MERGE-ready. Pushed head 0ae7eae76d on edge-autoupdate, clean worktree. Completed reviewed publication admission, plugin-owned server updater/schema/state/control/events, activity fencing, shared signature verifier, sealed warm handoff integration, and CLI controls. No production or Worker deployment. Hosts following the server is NOT implemented.

Signed launcher-alias fix 0ae7eae7: regression failed before and four real signed-engine tests pass after; server clippy passes. Before, after, clippy. Metadata discovery follows the installed alias; actual running bytes remain authenticated through /proc/self/exe.

Perf staging remains FAILED. Real passkey unlock and 128 PTYs succeeded, then attachment failed before any quiet application. No listener-gap/time-to-apply result is claimed. First run, pumped fixture attempt, latest attempt. Latest failed at update_staging_tests.rs:126. VM units/directories were torn down; lock was released. Machine receipt: infraternal-perf-test, kernel 6.12.111+deb13-amd64, 4 CPUs, MemTotal 8,069,112 kB.

Uncommitted staging work is preserved as pending-staging.patch, removed from the worktree because acceptance failed. It extends the existing shipping fixture with --updates, public-only fixture caching/--reuse, a loopback signed bucket, one-minute typing/quiet case, manual/rollback/late-exec cases and a browser pump for D265 liveness. Preserve public fixtures under scratch/public-transfer-25449ad0 if resuming before cleanup. The earlier reuse failure was readonly shared-library replacement; the patch unlinks those public copies before replacing them. Public fixture helpers 0176e612/129eacf8 are committed; no private signing material is persisted.

Remaining: resolve staging attachment failure (D265 liveness is a candidate, not proven cause); complete VM quiet/manual/rollback acceptance and measurements; implement removable host update path using shared verifier and the authenticated node transport; reduce static images below both existing caps; repair historical slice dependency ordering. Specifically 4e68641a includes tests calling with_updates/UPDATE_NOW introduced later in 734dc14d/9dfb1d0b; move dependent tests after those prerequisites. The reviewed-edge wording fixture corrections also belong with the declaration change. Do not treat current history as passing each commit.

Final scripts/verify fast is now running on the clean pushed head; its result will follow verbatim. Prior milestone failed both size caps (+332,544 B x86 and +302,832 B ARM) and the obsolete skill assertion; the assertion is fixed in 607e57d5. No size cap was raised.

Continuation record; incomplete, not MERGE-ready. Pushed head 0ae7eae76d95082b0d81bbc27f6a10323df30cda on edge-autoupdate, clean worktree. Completed reviewed publication admission, plugin-owned server updater/schema/state/control/events, activity fencing, shared signature verifier, sealed warm handoff integration, and CLI controls. No production or Worker deployment. Hosts following the server is NOT implemented. Signed launcher-alias fix 0ae7eae7: regression failed before and four real signed-engine tests pass after; server clippy passes. [Before](https://git.kayg.org/attachments/07be1b67-ce35-4052-8c1b-bb3834bae15b), [after](https://git.kayg.org/attachments/ee8b609c-1824-439a-8cfb-29aa35ee1570), [clippy](https://git.kayg.org/attachments/7969dc16-7821-4a3f-9a2e-1598f7b84967). Metadata discovery follows the installed alias; actual running bytes remain authenticated through /proc/self/exe. Perf staging remains FAILED. Real passkey unlock and 128 PTYs succeeded, then attachment failed before any quiet application. No listener-gap/time-to-apply result is claimed. [First run](https://git.kayg.org/attachments/30256024-a79f-4009-ab01-de8dc58637b7), [pumped fixture attempt](https://git.kayg.org/attachments/5d03c703-1505-4981-824d-5ca0ab1e99e4), [latest attempt](https://git.kayg.org/attachments/d5ab7a6d-674b-487c-9078-55e9d8f40c2b). Latest failed at update_staging_tests.rs:126. VM units/directories were torn down; lock was released. [Machine receipt](https://git.kayg.org/attachments/f49cc6aa-eeaf-4289-bffe-264ae554a3b8): infraternal-perf-test, kernel 6.12.111+deb13-amd64, 4 CPUs, MemTotal 8,069,112 kB. Uncommitted staging work is preserved as [pending-staging.patch](https://git.kayg.org/attachments/0802b27e-ad65-42f0-87cf-a8ffd7051fce), removed from the worktree because acceptance failed. It extends the existing shipping fixture with --updates, public-only fixture caching/--reuse, a loopback signed bucket, one-minute typing/quiet case, manual/rollback/late-exec cases and a browser pump for D265 liveness. Preserve public fixtures under scratch/public-transfer-25449ad0 if resuming before cleanup. The earlier reuse failure was readonly shared-library replacement; the patch unlinks those public copies before replacing them. Public fixture helpers 0176e612/129eacf8 are committed; no private signing material is persisted. Remaining: resolve staging attachment failure (D265 liveness is a candidate, not proven cause); complete VM quiet/manual/rollback acceptance and measurements; implement removable host update path using shared verifier and the authenticated node transport; reduce static images below both existing caps; repair historical slice dependency ordering. Specifically 4e68641a includes tests calling with_updates/UPDATE_NOW introduced later in 734dc14d/9dfb1d0b; move dependent tests after those prerequisites. The reviewed-edge wording fixture corrections also belong with the declaration change. Do not treat current history as passing each commit. Final scripts/verify fast is now running on the clean pushed head; its result will follow verbatim. Prior milestone failed both size caps (+332,544 B x86 and +302,832 B ARM) and the obsolete skill assertion; the assertion is fixed in 607e57d5. No size cap was raised.
kayg commented 2026-10-14 04:17:21 +00:00
Author
Owner
Copy link

Stopped incomplete at pushed head 0ae7eae76d, edge-autoupdate. Final scripts/verify fast exited 1. Every reported non-size row passes; both existing static caps fail. No cap changed and no load waiver used.

Full final gate transcript, verbatim

Verbatim size output:

PT_INTERP: absent; size: 22537488 bytes; cap: 22204304 bytes; delta: +333184 bytes
binary exceeds the 22204304-byte size budget: 22537488 bytes
PT_INTERP: absent; size: 19942088 bytes; cap: 19638744 bytes; delta: +303344 bytes
binary exceeds the 19638744-byte size budget: 19942088 bytes
PT_INTERP: absent; size: 22537488 bytes; cap: 22204304 bytes; delta: +333184 bytes
binary exceeds the 22204304-byte size budget: 22537488 bytes

Verbatim final gate table:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Not MERGE-ready: host lockstep remains unimplemented; VM acceptance failed before quiet application, so listener-gap/time-to-apply proof is missing; historical test slices still need prerequisite ordering repaired (details in continuation record above). The pending staging patch and failed VM receipts are attached above. Owned build targets, fuzz corpus and public fixture caches are being removed; attached evidence remains. No production/Worker deployment, no live owner fixture changes, and no issue closure.

Stopped incomplete at pushed head 0ae7eae76d95082b0d81bbc27f6a10323df30cda, edge-autoupdate. Final scripts/verify fast exited 1. Every reported non-size row passes; both existing static caps fail. No cap changed and no load waiver used. [Full final gate transcript, verbatim](https://git.kayg.org/attachments/affd4ae5-ac7e-4aa6-bd72-6082308f2236) Verbatim size output: ``` PT_INTERP: absent; size: 22537488 bytes; cap: 22204304 bytes; delta: +333184 bytes binary exceeds the 22204304-byte size budget: 22537488 bytes PT_INTERP: absent; size: 19942088 bytes; cap: 19638744 bytes; delta: +303344 bytes binary exceeds the 19638744-byte size budget: 19942088 bytes PT_INTERP: absent; size: 22537488 bytes; cap: 22204304 bytes; delta: +333184 bytes binary exceeds the 22204304-byte size budget: 22537488 bytes ``` Verbatim final gate table: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ``` Not MERGE-ready: host lockstep remains unimplemented; VM acceptance failed before quiet application, so listener-gap/time-to-apply proof is missing; historical test slices still need prerequisite ordering repaired (details in continuation record above). The pending staging patch and failed VM receipts are attached above. Owned build targets, fuzz corpus and public fixture caches are being removed; attached evidence remains. No production/Worker deployment, no live owner fixture changes, and no issue closure.
kayg commented 2026-10-14 04:19:38 +00:00
Author
Owner
Copy link

Cleanup completed: owned target/fuzz-target directories, fuzz corpus and both public fixture caches removed; issue-attached evidence and pending patch retained. Worktree is clean. HEAD and origin/edge-autoupdate both equal 0ae7eae76d. VM runs reported unique-directory teardown, and no job-owned test server is left running. Task remains incomplete as recorded above.

Cleanup completed: owned target/fuzz-target directories, fuzz corpus and both public fixture caches removed; issue-attached evidence and pending patch retained. Worktree is clean. HEAD and origin/edge-autoupdate both equal 0ae7eae76d95082b0d81bbc27f6a10323df30cda. VM runs reported unique-directory teardown, and no job-owned test server is left running. Task remains incomplete as recorded above.
kayg commented 2026-10-14 04:22:34 +00:00
Author
Owner
Copy link

Resumed edge-autoupdate at head 0ae7eae76d, merge base 57b0c3ddca. Continuing #211 (existing D251 edge auto-update issue), parents #157/#154. First step: cargo-bloat and dependency attribution vs merge base; unchanged D243 caps. Remaining host lockstep, historical slice prerequisite repair, perf-VM-only staging acceptance. No production or Worker deployment.

Resumed edge-autoupdate at head 0ae7eae76d95082b0d81bbc27f6a10323df30cda, merge base 57b0c3ddca8e190f674071e39dcc0aed1ca76cf6. Continuing #211 (existing D251 edge auto-update issue), parents #157/#154. First step: cargo-bloat and dependency attribution vs merge base; unchanged D243 caps. Remaining host lockstep, historical slice prerequisite repair, perf-VM-only staging acceptance. No production or Worker deployment.
kayg commented 2026-10-14 04:30:37 +00:00
Author
Owner
Copy link

Attribution inventory vs 57b0c3dd: Cargo.lock adds 0 crate versions (only existing base64/OpenSSL/SHA2/thiserror/uuid edges to plugin-api); server release_http remains the only release downloader; release_verify/release_manifest server modules now re-export the shared implementation. No new HTTP/TLS/JSON stack. Potential codegen cost: verifier moved out of the server package opt-level=s into plugin-api opt-level=3, and updater async SQL futures are retained in background, socket and CLI paths. Exact cargo-bloat static comparison is compiling, not yet a measured attribution.

Historical audit confirms 4e68641a tests need helpers/declarations first introduced in 9dfb1d0b/734dc14d. Final channel assertions and skill metadata checks must move with 9dfb1d0b; remove the intermediate may-break assertion from 9927df5a.

Staging harness defect identified: pending Pump uses one last-Ack watch for every terminal stream, allowing a sibling backend Ack to overwrite a successfully received target Ack before its waiter observes it. Deterministic regression and per-stream tracking are being prepared. This establishes a harness defect, not yet the exact cause of the earlier VM receipt. VM access to the named staging host succeeds.

Attribution inventory vs 57b0c3dd: Cargo.lock adds 0 crate versions (only existing base64/OpenSSL/SHA2/thiserror/uuid edges to plugin-api); server release_http remains the only release downloader; release_verify/release_manifest server modules now re-export the shared implementation. No new HTTP/TLS/JSON stack. Potential codegen cost: verifier moved out of the server package opt-level=s into plugin-api opt-level=3, and updater async SQL futures are retained in background, socket and CLI paths. Exact cargo-bloat static comparison is compiling, not yet a measured attribution. Historical audit confirms 4e68641a tests need helpers/declarations first introduced in 9dfb1d0b/734dc14d. Final channel assertions and skill metadata checks must move with 9dfb1d0b; remove the intermediate may-break assertion from 9927df5a. Staging harness defect identified: pending Pump uses one last-Ack watch for every terminal stream, allowing a sibling backend Ack to overwrite a successfully received target Ack before its waiter observes it. Deterministic regression and per-stream tracking are being prepared. This establishes a harness defect, not yet the exact cause of the earlier VM receipt. VM access to the named staging host succeeds.
kayg commented 2026-10-14 04:49:57 +00:00
Author
Owner
Copy link

D17/D198/D251 host prerequisite proposal (before code): preserve Hello.version=protocol1 and all existing fields. Negotiate a release-control capability and use reserved 0xF0..0xFF only on authenticated active leg-B stream0, through generic plugin-owned control-frame plumbing; browser and parked-standby paths cannot offer or commit images. Release plugin owns all transfer/slot/watchdog logic and leaves no work when disabled or compiled out.

Freeze bounded identity/offer/accept/decline/chunk/ack/commit/check-in/result layouts in wire contract. Offer binds canonical signed MANIFEST+signature, exact version, architecture, size, digest and explicit downgrade. Manifest <=65536B, signature <=1024B, chunk <=16384B; one chunk outstanding, contiguous offsets, resume keyed by signed transfer identity; no request-selected filesystem paths. Reuse shared OpenSSL/SHA/SSHSIG verifier and existing exact-server-version payload path; never public latest or development fallback. Bound simultaneous transfer workers globally (initial bound8: chunk storage8x16384=131072B, excluding declared transport/metadata/task reserves).

Managed-layout transition must preserve original current->live installation until verification completes, then fsync inactive image+public metadata+journal before atomically selecting an A/B slot. Extend existing bootstrap/uninstall ownership validation for that safe layout. Independent old-image watchdog owns the 30s exact-image authenticated check-in deadline, survives daemon replacement, restores previous verified image on failure and exits after success/rollback; no idle watchdog remains. Exact running-image verification precedes check-in confirmation. Human host states remain those recorded earlier on this issue; result reasons are fixed public codes, not raw service logs.

The reserved byte range currently has no implementation/layout, and current managed installs use live rather than a/b; these gaps are explicitly recorded rather than treating old Hello as an existing binary-version proof. No new foundational library, provider credential or production deployment.

D17/D198/D251 host prerequisite proposal (before code): preserve Hello.version=protocol1 and all existing fields. Negotiate a release-control capability and use reserved 0xF0..0xFF only on authenticated active leg-B stream0, through generic plugin-owned control-frame plumbing; browser and parked-standby paths cannot offer or commit images. Release plugin owns all transfer/slot/watchdog logic and leaves no work when disabled or compiled out. Freeze bounded identity/offer/accept/decline/chunk/ack/commit/check-in/result layouts in wire contract. Offer binds canonical signed MANIFEST+signature, exact version, architecture, size, digest and explicit downgrade. Manifest <=65536B, signature <=1024B, chunk <=16384B; one chunk outstanding, contiguous offsets, resume keyed by signed transfer identity; no request-selected filesystem paths. Reuse shared OpenSSL/SHA/SSHSIG verifier and existing exact-server-version payload path; never public latest or development fallback. Bound simultaneous transfer workers globally (initial bound8: chunk storage8x16384=131072B, excluding declared transport/metadata/task reserves). Managed-layout transition must preserve original current->live installation until verification completes, then fsync inactive image+public metadata+journal before atomically selecting an A/B slot. Extend existing bootstrap/uninstall ownership validation for that safe layout. Independent old-image watchdog owns the 30s exact-image authenticated check-in deadline, survives daemon replacement, restores previous verified image on failure and exits after success/rollback; no idle watchdog remains. Exact running-image verification precedes check-in confirmation. Human host states remain those recorded earlier on this issue; result reasons are fixed public codes, not raw service logs. The reserved byte range currently has no implementation/layout, and current managed installs use live rather than a/b; these gaps are explicitly recorded rather than treating old Hello as an existing binary-version proof. No new foundational library, provider credential or production deployment.
kayg commented 2026-10-14 05:18:22 +00:00
Author
Owner
Copy link

Paired x86_64 static cargo-bloat attribution vs merge base57b0c3dd (head0ae7eae7): .text17,153,332 ->17,372,628B (+219,296). Crate text: release44,136->157,980 (+113,844), server+36,835, std+27,283, plugin-api+17,202, SQLx+10,496, Tokio+5,730, serde_json+5,427. Signed verifier moved rather than duplicated; old verifier functions disappear, and no new crate versions/HTTP/TLS/JSON stack are added. Crate attribution includes LTO/inlining; full function grouping is attached.

Largest increases: status has two compiled futures totalling30,452B; service call group+21,101B; restart request+20,038B; updater run18,001B; check9,065B; apply8,936B. Whole stripped shipping deltas remain the prior final gate +333,184B x86 / +303,344B ARM; bloat measures code sections separately and is not substituted for the shipping size gate.

Next reduction: reuse the existing Operation boxed-future boundary for public updater/service calls so CLI, socket and background paths share one compiled implementation. Verification, persisted authority and foreground fencing remain required. No cap changed.

binary-attribution.txt
head-bloat-crates.json
base-bloat-crates.json

Paired x86_64 static cargo-bloat attribution vs merge base57b0c3dd (head0ae7eae7): .text17,153,332 ->17,372,628B (+219,296). Crate text: release44,136->157,980 (+113,844), server+36,835, std+27,283, plugin-api+17,202, SQLx+10,496, Tokio+5,730, serde_json+5,427. Signed verifier moved rather than duplicated; old verifier functions disappear, and no new crate versions/HTTP/TLS/JSON stack are added. Crate attribution includes LTO/inlining; full function grouping is attached. Largest increases: status has two compiled futures totalling30,452B; service call group+21,101B; restart request+20,038B; updater run18,001B; check9,065B; apply8,936B. Whole stripped shipping deltas remain the prior final gate +333,184B x86 / +303,344B ARM; bloat measures code sections separately and is not substituted for the shipping size gate. Next reduction: reuse the existing Operation boxed-future boundary for public updater/service calls so CLI, socket and background paths share one compiled implementation. Verification, persisted authority and foreground fencing remain required. No cap changed. [binary-attribution.txt](https://git.kayg.org/attachments/dc084057-67a2-4719-bf94-8bec61f55e29) [head-bloat-crates.json](https://git.kayg.org/attachments/fa02199d-08b5-479a-84cf-b338f3d6e72e) [base-bloat-crates.json](https://git.kayg.org/attachments/6a5e08e4-3a47-4a10-92b6-e4f720ef2c49)
kayg commented 2026-10-14 05:47:48 +00:00
Author
Owner
Copy link

First reduction candidate: shared Operation boundaries cut x86 cargo-bloat .text61,184B (17,372,628->17,311,444), release plugin157,980->115,241B. Comparable GNU-stripped bloat image22,539,400->22,470,536B (-68,864), still266,232B above shipping cap. Shipping cap unchanged; bloat stripping differs from final gate recipe by section layout and is not final acceptance. Next candidate reuses existing server opt-level=s for CLI/plugin API/release orchestration only, pending VM nonregression before retention. Crypto, transport and terminal engine profiles unchanged.

Staging acknowledgement regression actual red0passed/3failed; corrected per-stream maximum actual green3passed/0failed, same3tests. Python/Bun/TS anonymous-fixture migration functional checks pass; final default-timeout gates still required. No VM acceptance yet.

First reduction candidate: shared Operation boundaries cut x86 cargo-bloat .text61,184B (17,372,628->17,311,444), release plugin157,980->115,241B. Comparable GNU-stripped bloat image22,539,400->22,470,536B (-68,864), still266,232B above shipping cap. Shipping cap unchanged; bloat stripping differs from final gate recipe by section layout and is not final acceptance. Next candidate reuses existing server opt-level=s for CLI/plugin API/release orchestration only, pending VM nonregression before retention. Crypto, transport and terminal engine profiles unchanged. Staging acknowledgement regression actual red0passed/3failed; corrected per-stream maximum actual green3passed/0failed, same3tests. Python/Bun/TS anonymous-fixture migration functional checks pass; final default-timeout gates still required. No VM acceptance yet.
kayg commented 2026-10-14 06:03:16 +00:00
Author
Owner
Copy link

Second size candidate: retain opt-level=3 for engines; apply the existing server orchestration opt-level=s to CLI, plugin API and release orchestration (D243/D251). Matched cargo-bloat .text is 15,847,060 B versus 17,372,628 B original head (-1,525,568 B). GNU-stripped candidate is 20,864,840 B, below the original x86 cap 22,204,304 B by 1,339,464 B. This is a candidate, not final gate evidence: normal shipping recipe, ARM artifact, paired perf-VM runtime comparison and final lockstep footprint remain pending. No dependency versions or crypto/HTTP implementations were added for the size cut.

Second size candidate: retain opt-level=3 for engines; apply the existing server orchestration opt-level=s to CLI, plugin API and release orchestration (D243/D251). Matched cargo-bloat .text is 15,847,060 B versus 17,372,628 B original head (-1,525,568 B). GNU-stripped candidate is 20,864,840 B, below the original x86 cap 22,204,304 B by 1,339,464 B. This is a candidate, not final gate evidence: normal shipping recipe, ARM artifact, paired perf-VM runtime comparison and final lockstep footprint remain pending. No dependency versions or crypto/HTTP implementations were added for the size cut.
kayg commented 2026-10-14 06:19:12 +00:00
Author
Owner
Copy link

Host lockstep integration review: a daemon child watchdog would inherit the service cgroup and could die with the process it must recover; interrupted transfer initially left an exclusive receiving file that blocked retries; seed copying changes selected inode before daemon replacement, so check-in must distinguish selected bytes from executing bytes. These are being corrected before admission: independent transient supervision, transaction-bound check-in, persisted signed-identity/contiguous-offset journal, and exact /proc/self/exe proof. Relevant work-in-progress modules: release/host_watchdog.rs, host_slots.rs, host_receiver.rs. No host-update acceptance or completion claim yet. Generic reserved parser regression observed red: identity request decode 0 passed/1 failed before implementation; frozen raw frame bounds and active authenticated leg-B routing now under test. ARM candidate stripped size 18,512,776 B versus old cap 19,638,744 B (-1,125,968 B); raw normal Cargo artifact still carried symbols, so final gate must independently check the shipping recipe after all feature integration.

Host lockstep integration review: a daemon child watchdog would inherit the service cgroup and could die with the process it must recover; interrupted transfer initially left an exclusive receiving file that blocked retries; seed copying changes selected inode before daemon replacement, so check-in must distinguish selected bytes from executing bytes. These are being corrected before admission: independent transient supervision, transaction-bound check-in, persisted signed-identity/contiguous-offset journal, and exact /proc/self/exe proof. Relevant work-in-progress modules: release/host_watchdog.rs, host_slots.rs, host_receiver.rs. No host-update acceptance or completion claim yet. Generic reserved parser regression observed red: identity request decode 0 passed/1 failed before implementation; frozen raw frame bounds and active authenticated leg-B routing now under test. ARM candidate stripped size 18,512,776 B versus old cap 19,638,744 B (-1,125,968 B); raw normal Cargo artifact still carried symbols, so final gate must independently check the shipping recipe after all feature integration.
kayg commented 2026-10-14 06:31:55 +00:00
Author
Owner
Copy link

Completed and pushed two atomic prerequisites: 5e2bf4ef shares boxed release control futures (matched stripped image -68,864 B; exact isolated snapshot fmt, all-target clippy, 18 tests passed and 3 subprocess helpers ignored). bda5df77 reuses anonymous ephemeral signing authority for staging/package/review fixtures (signature 1/1, packaging 1/1, default Bun review 3/3; touched TypeScript and full tracer check passed). Receipts:
shared-futures-isolated-gate.log
signing-prerequisite-isolated-gate.log
staging-typescript-check-green.log

Legacy hosts lacking the newly reserved handshake capability fail closed: the existing binaries had no upgrade frames, so adoption requires installing one capable verified binary first; forward lockstep then uses the machine-only protocol. Host signed identity is verified MANIFEST plus exact running-image digest, independent of package metadata, matching the server verifier.

Completed and pushed two atomic prerequisites: 5e2bf4ef shares boxed release control futures (matched stripped image -68,864 B; exact isolated snapshot fmt, all-target clippy, 18 tests passed and 3 subprocess helpers ignored). bda5df77 reuses anonymous ephemeral signing authority for staging/package/review fixtures (signature 1/1, packaging 1/1, default Bun review 3/3; touched TypeScript and full tracer check passed). Receipts: [shared-futures-isolated-gate.log](https://git.kayg.org/attachments/daf105cf-267b-4f6f-b291-fa3ec6b87db9) [signing-prerequisite-isolated-gate.log](https://git.kayg.org/attachments/906b2478-e768-459b-b4bf-126f23acdbef) [staging-typescript-check-green.log](https://git.kayg.org/attachments/a64e9c82-0067-4c53-afce-2dd0d91f254a) Legacy hosts lacking the newly reserved handshake capability fail closed: the existing binaries had no upgrade frames, so adoption requires installing one capable verified binary first; forward lockstep then uses the machine-only protocol. Host signed identity is verified MANIFEST plus exact running-image digest, independent of package metadata, matching the server verifier.
kayg commented 2026-10-14 06:40:32 +00:00
Author
Owner
Copy link

Staging acceptance fixture choice: use existing VM UID1000 with a fake HOME physically inside our unique /root/infraternal-bench/edge-autoupdate run; expose only that home through our short /run/user/1000/e bind mount. Start the previously inactive user manager and an absent canonical user infraternal-agent.service as our fixture; stop our unit/manager and unmount our runtime path on teardown. This preserves production managed-layout validation and independent supervisor access without changing /root permissions or existing home files.

Additive recovery contract: a host watchdog records the failed signed version on rollback; the same image stays paused until explicit release.up retry. The staging-only feature may deliberately exit during release-plugin startup for one selected verified signed image (D), after real kernel exec, so the isolated test can prove failed-startup rollback to B rather than only supervisor process isolation. Production has no such environment hook; compiled staging authority remains forbidden by check-production-trust. Existing server C proof exercises late kernel exec refusal separately. No production instance or signer Worker is deployed.

Staging acceptance fixture choice: use existing VM UID1000 with a fake HOME physically inside our unique /root/infraternal-bench/edge-autoupdate run; expose only that home through our short /run/user/1000/e<nonce> bind mount. Start the previously inactive user manager and an absent canonical user infraternal-agent.service as our fixture; stop our unit/manager and unmount our runtime path on teardown. This preserves production managed-layout validation and independent supervisor access without changing /root permissions or existing home files. Additive recovery contract: a host watchdog records the failed signed version on rollback; the same image stays paused until explicit release.up retry. The staging-only feature may deliberately exit during release-plugin startup for one selected verified signed image (D), after real kernel exec, so the isolated test can prove failed-startup rollback to B rather than only supervisor process isolation. Production has no such environment hook; compiled staging authority remains forbidden by check-production-trust. Existing server C proof exercises late kernel exec refusal separately. No production instance or signer Worker is deployed.
kayg commented 2026-10-14 07:16:05 +00:00
Author
Owner
Copy link

Completed/pushed prerequisites: fabe9c36 frozen F0–F8 bounded machine envelopes (11 protocol tests, all-target clippy/fmt); 8d9c6eca existing-parser dependency edge; 9be151a1 generic enabled-feature machine dispatch (23 API unit + 2 routing tests, clippy/fmt). Core transport mTLS tests verify delivery only with capability negotiation and no deferred effect after a failed write.

Finding/fix ff802173: changing edge to stable retained the edge ready image, Inbox item and queued manual request. Regression failed 0/1 before the fix. The channel transaction now retires both selections before final owner/freshness validation; authority-trigger regression proves all changes roll back together. Exact isolated fmt/clippy and 20 tests passed. Existing verified image files/history/toast receipts remain retained.
channel-switch-ready-red.log
channel-switch-isolated-gate.log
machine-parser-green.log
api-capability-tests.log

Contract review caught nonzero offsets encoded big-endian; sender/receiver are corrected to the existing wire §2 little-endian rule before freezing the release codec, with an independent nonzero golden vector.

Completed/pushed prerequisites: fabe9c36 frozen F0–F8 bounded machine envelopes (11 protocol tests, all-target clippy/fmt); 8d9c6eca existing-parser dependency edge; 9be151a1 generic enabled-feature machine dispatch (23 API unit + 2 routing tests, clippy/fmt). Core transport mTLS tests verify delivery only with capability negotiation and no deferred effect after a failed write. Finding/fix ff802173: changing edge to stable retained the edge ready image, Inbox item and queued manual request. Regression failed 0/1 before the fix. The channel transaction now retires both selections before final owner/freshness validation; authority-trigger regression proves all changes roll back together. Exact isolated fmt/clippy and 20 tests passed. Existing verified image files/history/toast receipts remain retained. [channel-switch-ready-red.log](https://git.kayg.org/attachments/dc5a40f9-b2a7-4410-b238-085d36b3ae65) [channel-switch-isolated-gate.log](https://git.kayg.org/attachments/bf0554ab-8663-4845-870e-9cf70d9667bc) [machine-parser-green.log](https://git.kayg.org/attachments/13e0dce8-73a6-417e-b908-3df12ff7ef10) [api-capability-tests.log](https://git.kayg.org/attachments/e68d5e04-ada6-4952-8b4f-07ebbb01580d) Contract review caught nonzero offsets encoded big-endian; sender/receiver are corrected to the existing wire §2 little-endian rule before freezing the release codec, with an independent nonzero golden vector.
kayg commented 2026-10-14 07:17:18 +00:00
Author
Owner
Copy link

Contract reconciliation proposed before the docs change: contracts/bootstrap.md is marked draft for #10 and describes binary identity inside Hello plus universal old-version upgrade support, while the existing frozen implementation has Hello.version=protocol1 and no prior reserved upgrade frames. Document the new negotiated F0 identity separately and incapable legacy peers requiring one verified bootstrap install.

Its draft failure paragraph also claims restricted read-only mode, which no current runtime implements. This D251 slice preserves the previous verified executable and live PTYs after failure, exposes Rolled back plus the failed version/reason, and pauses that exact image until explicit release.up retry. Document that implemented continuity behavior rather than claiming read-only enforcement or automatic repeated crashes. D17 and D251 stay unchanged; the new reserved handshake remains bounded/frozen and explicit signed downgrades remain mandatory. This reconciliation is limited to the draft documentation; there is no production deployment.

Contract reconciliation proposed before the docs change: contracts/bootstrap.md is marked draft for #10 and describes binary identity inside Hello plus universal old-version upgrade support, while the existing frozen implementation has Hello.version=protocol1 and no prior reserved upgrade frames. Document the new negotiated F0 identity separately and incapable legacy peers requiring one verified bootstrap install. Its draft failure paragraph also claims restricted read-only mode, which no current runtime implements. This D251 slice preserves the previous verified executable and live PTYs after failure, exposes Rolled back plus the failed version/reason, and pauses that exact image until explicit release.up retry. Document that implemented continuity behavior rather than claiming read-only enforcement or automatic repeated crashes. D17 and D251 stay unchanged; the new reserved handshake remains bounded/frozen and explicit signed downgrades remain mandatory. This reconciliation is limited to the draft documentation; there is no production deployment.
kayg commented 2026-10-14 07:58:53 +00:00
Author
Owner
Copy link

#211 daemon-owned CLI update slice starts on edge-autoupdate, base ff802173e0ce593f37a8ca386684f1613782a109.

Read-only findings: release_cli.rs:136 constructs a fresh service/Updater for each CLI call; updater.rs:63,143 uses that process's activity clock. The private wake endpoint accepts only w; no live-status delegation exists. CLI status therefore cannot report the daemon's pending connections or actual quiet-window deadline (D251).

updates check also inserts the persisted notification receipt in updater.rs:210, then emits only on its local broadcast channel. It calls notify, not the cross-process committed wake; the daemon can miss the ready notification and remain on its thirty-minute poll until another wake.

Fix scope: bounded additive requests on the existing same-UID private restart control endpoint, executing the same daemon-owned ReleaseService handlers for the five update actions. Existing channel settings stay on their current path. Separate-process CLI regressions will precede implementation; no new dependency, frontend change, VM run or deployment.

#211 daemon-owned CLI update slice starts on `edge-autoupdate`, base `ff802173e0ce593f37a8ca386684f1613782a109`. Read-only findings: `release_cli.rs:136` constructs a fresh service/Updater for each CLI call; `updater.rs:63,143` uses that process's activity clock. The private wake endpoint accepts only `w`; no live-status delegation exists. CLI status therefore cannot report the daemon's pending connections or actual quiet-window deadline (D251). `updates check` also inserts the persisted notification receipt in `updater.rs:210`, then emits only on its local broadcast channel. It calls `notify`, not the cross-process `committed` wake; the daemon can miss the ready notification and remain on its thirty-minute poll until another wake. Fix scope: bounded additive requests on the existing same-UID private restart control endpoint, executing the same daemon-owned ReleaseService handlers for the five update actions. Existing channel settings stay on their current path. Separate-process CLI regressions will precede implementation; no new dependency, frontend change, VM run or deployment.
kayg commented 2026-10-14 08:08:34 +00:00
Author
Owner
Copy link

Normal production x86_64 build now produces a stripped static PIE without a post-build strip step: 21,037,392 B, delta -1,166,912 B against the 22,204,304 B merge-base cap. Cargo rustc flags are opt-level=s strip=symbols with explicit package profile settings. This is a candidate with host transport included, before the live CLI-state fix; final head and ARM shipping sizes still need verification and D243 cap ratcheting. No shipping-size claim is based on the cargo-bloat image.

shipping-size-candidate.txt

Normal production x86_64 build now produces a stripped static PIE without a post-build strip step: 21,037,392 B, delta -1,166,912 B against the 22,204,304 B merge-base cap. Cargo rustc flags are opt-level=s strip=symbols with explicit package profile settings. This is a candidate with host transport included, before the live CLI-state fix; final head and ARM shipping sizes still need verification and D243 cap ratcheting. No shipping-size claim is based on the cargo-bloat image. [shipping-size-candidate.txt](https://git.kayg.org/attachments/9137b068-7df1-4de3-9908-f543b8fb0aaf)
kayg commented 2026-10-14 08:15:25 +00:00
Author
Owner
Copy link

Committed and pushed 6f65a3ef: explicit public trust adapter reuses canonical signed-manifest/artifact validation; normal shipping wrapper remains compiled-trust pinned. Exact staged source tree a91e0b433a13d74fa4e053b12204d47f63059350.

Gates (verbatim):

test action::tests::command_result_schema_has_required_stable_fields_and_optional_next_step ... ok
test action::tests::command_result_schema_keeps_action_data_typed_inside_stable_envelope ... ok
test action::tests::only_hidden_internal_routes_may_use_the_reserved_prefix ... ok
test action::tests::registry_keeps_plugin_ownership_and_exact_command_paths ... ok
test component_tests::component_declarations_cannot_create_servers ... ok
test admission::tests::memory_refusal_round_trips_without_losing_legacy_error ... ok
test action::tests::registry_rejects_inconsistent_json_schemas ... ok
test action::tests::registry_rejects_missing_action_guidance_and_command_collisions ... ok
test component_tests::destructive_actions_require_a_dry_run_and_every_action_has_instructions ... ok
test release_verify::tests::compiled_authorities_keep_production_and_isolate_staging ... ok
test release_verify::tests::per_run_signature_obeys_the_compiled_feature_boundary ... ok
test release_verify::tests::verification_twenty_megabytes_fifty_runs ... ignored, run release-profile measurements in a weighted scope
test release_version::tests::accepts_only_worker_version_forms ... ok
test action::tests::any_of_permissions_are_machine_readable_and_empty_authority_is_rejected ... ok
test routing::tests::topic_is_borrowed_and_other_filter_fields_are_left_to_the_plugin ... ok
test routing::tests::invalid_or_oversized_topics_are_refused ... ok
test release_manifest::tests::noncanonical_or_cross_channel_identity_is_refused ... ok
test tests::operator_presentation_cannot_follow_a_private_control_action ... ok
test tests::deferred_plugin_effect_waits_for_successful_reply_and_drops_on_cancellation ... ok
test tests::public_dispatch_cannot_call_a_machine_control_action ... ok
test tests::registry_rejects_oversized_json_before_plugin_dispatch ... ok
test tests::registry_routes_only_declared_actions ... ok
test release_version::tests::ordered_updates_never_compare_stable_numbers_lexically_or_overflow ... ok
test tests::machine_actions_are_declared_without_entering_human_discovery ... ok
test tests::machine_dispatch_bounds_both_input_and_plugin_reply ... ok
test tests::machine_dispatch_refuses_disabled_or_ambiguous_handlers_before_effects ... ok
test tests::notifications_are_declared_json_bounded_and_drained_once ... ok
test release_verify::tests::openssh_signatures_preserve_descriptor_and_reject_every_byte_mutation ... ok
test release_manifest::tests::signed_identity_and_exact_bytes_are_required ... ok
test release_verify::tests::trust_namespace_hash_trailing_data_and_manifest_ambiguity_are_refused ... ok

test result: ok. 29 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.11s
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 27.49s

Touched rustfmt check passed.

Committed and pushed `6f65a3ef`: explicit public trust adapter reuses canonical signed-manifest/artifact validation; normal shipping wrapper remains compiled-trust pinned. Exact staged source tree `a91e0b433a13d74fa4e053b12204d47f63059350`. Gates (verbatim): ``` test action::tests::command_result_schema_has_required_stable_fields_and_optional_next_step ... ok test action::tests::command_result_schema_keeps_action_data_typed_inside_stable_envelope ... ok test action::tests::only_hidden_internal_routes_may_use_the_reserved_prefix ... ok test action::tests::registry_keeps_plugin_ownership_and_exact_command_paths ... ok test component_tests::component_declarations_cannot_create_servers ... ok test admission::tests::memory_refusal_round_trips_without_losing_legacy_error ... ok test action::tests::registry_rejects_inconsistent_json_schemas ... ok test action::tests::registry_rejects_missing_action_guidance_and_command_collisions ... ok test component_tests::destructive_actions_require_a_dry_run_and_every_action_has_instructions ... ok test release_verify::tests::compiled_authorities_keep_production_and_isolate_staging ... ok test release_verify::tests::per_run_signature_obeys_the_compiled_feature_boundary ... ok test release_verify::tests::verification_twenty_megabytes_fifty_runs ... ignored, run release-profile measurements in a weighted scope test release_version::tests::accepts_only_worker_version_forms ... ok test action::tests::any_of_permissions_are_machine_readable_and_empty_authority_is_rejected ... ok test routing::tests::topic_is_borrowed_and_other_filter_fields_are_left_to_the_plugin ... ok test routing::tests::invalid_or_oversized_topics_are_refused ... ok test release_manifest::tests::noncanonical_or_cross_channel_identity_is_refused ... ok test tests::operator_presentation_cannot_follow_a_private_control_action ... ok test tests::deferred_plugin_effect_waits_for_successful_reply_and_drops_on_cancellation ... ok test tests::public_dispatch_cannot_call_a_machine_control_action ... ok test tests::registry_rejects_oversized_json_before_plugin_dispatch ... ok test tests::registry_routes_only_declared_actions ... ok test release_version::tests::ordered_updates_never_compare_stable_numbers_lexically_or_overflow ... ok test tests::machine_actions_are_declared_without_entering_human_discovery ... ok test tests::machine_dispatch_bounds_both_input_and_plugin_reply ... ok test tests::machine_dispatch_refuses_disabled_or_ambiguous_handlers_before_effects ... ok test tests::notifications_are_declared_json_bounded_and_drained_once ... ok test release_verify::tests::openssh_signatures_preserve_descriptor_and_reject_every_byte_mutation ... ok test release_manifest::tests::signed_identity_and_exact_bytes_are_required ... ok test release_verify::tests::trust_namespace_hash_trailing_data_and_manifest_ambiguity_are_refused ... ok test result: ok. 29 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.11s Finished `dev` profile [unoptimized + debuginfo] target(s) in 27.49s ``` Touched rustfmt check passed.
kayg commented 2026-10-14 08:17:17 +00:00
Author
Owner
Copy link

Committed and pushed 476307c5: Declare host release feature and existing fixture dependency prerequisites. Gates run against the exact staged tree, not the shared dirty checkout.

host-deps-slice-check.log (verbatim):

Running as unit: run-p3519806-i41262318.scope; invocation ID: ea3c0aa77b53444eb9e33f4c3d401e34
   Compiling libc v0.2.190
   Compiling autocfg v1.5.1
   Compiling cfg_aliases v0.2.2
   Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api)
    Checking infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol)
   Compiling nix v0.30.1
   Compiling memoffset v0.9.1
    Checking openssl-sys v0.9.117
    Checking getrandom v0.4.3
    Checking uuid v1.27.0
    Checking openssl v0.10.81
    Checking infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 17.85s

host-deps-slice-clippy.log (verbatim):

Running as unit: run-p3524169-i41266678.scope; invocation ID: 6c5ed7ade33f438685389e7b90507d72
   Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api)
    Checking infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol)
    Checking infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 3.40s
Committed and pushed `476307c5`: Declare host release feature and existing fixture dependency prerequisites. Gates run against the exact staged tree, not the shared dirty checkout. host-deps-slice-check.log (verbatim): ``` Running as unit: run-p3519806-i41262318.scope; invocation ID: ea3c0aa77b53444eb9e33f4c3d401e34 Compiling libc v0.2.190 Compiling autocfg v1.5.1 Compiling cfg_aliases v0.2.2 Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api) Checking infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol) Compiling nix v0.30.1 Compiling memoffset v0.9.1 Checking openssl-sys v0.9.117 Checking getrandom v0.4.3 Checking uuid v1.27.0 Checking openssl v0.10.81 Checking infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release) Finished `dev` profile [unoptimized + debuginfo] target(s) in 17.85s ``` host-deps-slice-clippy.log (verbatim): ``` Running as unit: run-p3524169-i41266678.scope; invocation ID: 6c5ed7ade33f438685389e7b90507d72 Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api) Checking infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol) Checking infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release) Finished `dev` profile [unoptimized + debuginfo] target(s) in 3.40s ```
kayg commented 2026-10-14 08:17:50 +00:00
Author
Owner
Copy link

Finding / additive recovery proposal: restart.rs Replacement::exec restores pinned previous bytes only when fexecve returns an error. A successfully executed successor that exits during startup cannot answer deploy rollback IPC; the existing VM C fault proves kernel refusal only. D168/D217 classify a real crash as cold, so this job will not extend unlocked-CA custody across a process death.

Complete autonomous startup-failure rollback by reusing the installed service Restart=on-failure, release-owned persisted startup intent and existing signed-image admission. Before server startup imports authority or binds listeners, the release bootstrap must identify pending attempt versus verified actual image, restore its exact signed predecessor after a failed attempt, and let the normal updater reconcile/pause the failed version. A normal service restart must also select the persisted verified current version instead of silently returning to the original ExecStart image. Add bounded additive startup-attempt receipt/schema where needed; keep configuration, compiled trust, same-PID happy handoff and CA format unchanged. Fault proof must execute a signed image, exit after real exec, then observe autonomous previous-image startup and cold CA. Happy quiet/manual/rollback transitions must retain unlocked CA.

UI failure copy: Update failed · Restored . After a fatal startup crash: Unlock the CA to reconnect hosts. This is a crash recovery boundary, not a new CA lifetime decision. Evidence/code paths: evidence/server-postexec-recovery-audit.txt; crates/infraternal/src/restart.rs:359; crates/infraternal/src/install.rs:171.

Finding / additive recovery proposal: restart.rs Replacement::exec restores pinned previous bytes only when fexecve returns an error. A successfully executed successor that exits during startup cannot answer deploy rollback IPC; the existing VM C fault proves kernel refusal only. D168/D217 classify a real crash as cold, so this job will not extend unlocked-CA custody across a process death. Complete autonomous startup-failure rollback by reusing the installed service Restart=on-failure, release-owned persisted startup intent and existing signed-image admission. Before server startup imports authority or binds listeners, the release bootstrap must identify pending attempt versus verified actual image, restore its exact signed predecessor after a failed attempt, and let the normal updater reconcile/pause the failed version. A normal service restart must also select the persisted verified current version instead of silently returning to the original ExecStart image. Add bounded additive startup-attempt receipt/schema where needed; keep configuration, compiled trust, same-PID happy handoff and CA format unchanged. Fault proof must execute a signed image, exit after real exec, then observe autonomous previous-image startup and cold CA. Happy quiet/manual/rollback transitions must retain unlocked CA. UI failure copy: Update failed · Restored <previous version>. After a fatal startup crash: Unlock the CA to reconnect hosts. This is a crash recovery boundary, not a new CA lifetime decision. Evidence/code paths: evidence/server-postexec-recovery-audit.txt; crates/infraternal/src/restart.rs:359; crates/infraternal/src/install.rs:171.
kayg commented 2026-10-14 08:18:44 +00:00
Author
Owner
Copy link

Committed and pushed aebdf0d4: Bound signed host offers and frozen little-endian transfer offsets; touched rustfmt check passed. Gates run against the exact staged tree, not the shared dirty checkout.

host-wire-slice-tests.log (verbatim):

Running as unit: run-p3532409-i41274918.scope; invocation ID: 944bf9bd780d4785a87ca392eeb0a7b1
   Compiling libc v0.2.190
   Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api)
   Compiling memoffset v0.9.1
   Compiling infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol)
   Compiling openssl-sys v0.9.117
   Compiling getrandom v0.4.3
   Compiling nix v0.30.1
   Compiling uuid v1.27.0
   Compiling openssl v0.10.81
   Compiling infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 26.55s
     Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/edge-autoupdate/native-host-exact/debug/deps/infraternal_plugin_release-280f60aa864ce339)

running 1 test
test host_wire::tests::nonzero_frozen_offset_golden ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

host-wire-slice-clippy.log (verbatim):

Running as unit: run-p3530846-i41273355.scope; invocation ID: 9d30ed4f8c6d41bcbe3eb174693cbbfb
   Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api)
    Checking infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol)
    Checking infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.90s
Committed and pushed `aebdf0d4`: Bound signed host offers and frozen little-endian transfer offsets; touched rustfmt check passed. Gates run against the exact staged tree, not the shared dirty checkout. host-wire-slice-tests.log (verbatim): ``` Running as unit: run-p3532409-i41274918.scope; invocation ID: 944bf9bd780d4785a87ca392eeb0a7b1 Compiling libc v0.2.190 Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api) Compiling memoffset v0.9.1 Compiling infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol) Compiling openssl-sys v0.9.117 Compiling getrandom v0.4.3 Compiling nix v0.30.1 Compiling uuid v1.27.0 Compiling openssl v0.10.81 Compiling infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release) Finished `test` profile [unoptimized + debuginfo] target(s) in 26.55s Running unittests src/lib.rs (/home/kayg/.cache/codex-scratch/edge-autoupdate/native-host-exact/debug/deps/infraternal_plugin_release-280f60aa864ce339) running 1 test test host_wire::tests::nonzero_frozen_offset_golden ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` host-wire-slice-clippy.log (verbatim): ``` Running as unit: run-p3530846-i41273355.scope; invocation ID: 9d30ed4f8c6d41bcbe3eb174693cbbfb Compiling infraternal-plugin-api v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-plugin-api) Checking infraternal-protocol v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/infraternal-protocol) Checking infraternal-plugin-release v0.1.0 (/home/kayg/.cache/codex-scratch/edge-autoupdate/exact-host/crates/plugins/release) Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.90s ```
kayg commented 2026-10-14 08:21:50 +00:00
Author
Owner
Copy link

Perf VM staging resource wait: the first signed fixture build/upload completed, then flock -w 3600 expired without measurement_lock_acquired. Safe transcript contains only artifacts_prepared=true lock_held=false and teardown_directory_absent=true; no staging service or managed runtime started and no performance result exists. The independent 128-PTY profile comparison is still queued on the same lock. Final acceptance will use a fresh signed source build after CLI live-state/startup-recovery fixes, not the older closed-signing fixture. Source work and exact-slice gates continue. Evidence: $HOME/.cache/codex-scratch/edge-autoupdate/evidence/managed-update-proof-first.txt.

Perf VM staging resource wait: the first signed fixture build/upload completed, then flock -w 3600 expired without measurement_lock_acquired. Safe transcript contains only artifacts_prepared=true lock_held=false and teardown_directory_absent=true; no staging service or managed runtime started and no performance result exists. The independent 128-PTY profile comparison is still queued on the same lock. Final acceptance will use a fresh signed source build after CLI live-state/startup-recovery fixes, not the older closed-signing fixture. Source work and exact-slice gates continue. Evidence: $HOME/.cache/codex-scratch/edge-autoupdate/evidence/managed-update-proof-first.txt.
kayg commented 2026-10-15 02:02:19 +00:00
Author
Owner
Copy link

Resumed edge-autoupdate at HEAD 85f1da2ad; merge base 57b0c3ddca. Preserving uncommitted host lockstep, runtime CLI/staging work and profile candidate after disk-full interruption. Prior #211/#157/#154 records retrieved. Rebuilding focused functional gates; remaining startup recovery, exact-slice commits, final size/perf-VM acceptance and historical ordering repair. No production or Worker deployment.

Resumed edge-autoupdate at HEAD 85f1da2ad; merge base 57b0c3ddca8e190f674071e39dcc0aed1ca76cf6. Preserving uncommitted host lockstep, runtime CLI/staging work and profile candidate after disk-full interruption. Prior #211/#157/#154 records retrieved. Rebuilding focused functional gates; remaining startup recovery, exact-slice commits, final size/perf-VM acceptance and historical ordering repair. No production or Worker deployment.
kayg commented 2026-10-15 02:13:35 +00:00
Author
Owner
Copy link

Committed and pushed 56cb9f2f: verified resumable host A/B image storage, exact signed offers and executing-image retention (D17/D251). Exact staged tree passes fmt, touched release all-target clippy, 22 unit tests and 3 integration tests. No VM lockstep/size acceptance claim yet.

host-slots-slice.log
host-slots-clippy.log

Committed and pushed 56cb9f2f: verified resumable host A/B image storage, exact signed offers and executing-image retention (D17/D251). Exact staged tree passes fmt, touched release all-target clippy, 22 unit tests and 3 integration tests. No VM lockstep/size acceptance claim yet. [host-slots-slice.log](https://git.kayg.org/attachments/939d1677-00ee-480e-89f3-17f4c1b31062) [host-slots-clippy.log](https://git.kayg.org/attachments/4d079d08-9cbb-40b1-ba9b-aadc436feb33)
kayg commented 2026-10-15 02:14:52 +00:00
Author
Owner
Copy link

Committed and pushed add442f6: durable host update on/off and failed-image pause (D17/D251). Exact staged tree fmt and touched release all-target clippy pass, 23 unit plus 3 integration tests pass. Runtime disable retires partial artifacts, refuses pending replacement, and explicit up clears the paused failed image.

Committed and pushed add442f6: durable host update on/off and failed-image pause (D17/D251). Exact staged tree fmt and touched release all-target clippy pass, 23 unit plus 3 integration tests pass. Runtime disable retires partial artifacts, refuses pending replacement, and explicit up clears the paused failed image.
kayg commented 2026-10-15 02:17:05 +00:00
Author
Owner
Copy link

Committed and pushed 53ed219f: independent bounded host replacement supervision, transaction-bound check-in, persisted failed-version pause and preselection recovery. Exact staged tree passes fmt/all-target clippy, 28 unit plus 3 integration tests, including real transient supervision surviving launcher stop. CLI behavioral regression now reproduced at restart_update_control_tests.rs:165: active daemon foreground operation but CLI waiting_for_connections=false; fix is being gated.

Committed and pushed 53ed219f: independent bounded host replacement supervision, transaction-bound check-in, persisted failed-version pause and preselection recovery. Exact staged tree passes fmt/all-target clippy, 28 unit plus 3 integration tests, including real transient supervision surviving launcher stop. CLI behavioral regression now reproduced at restart_update_control_tests.rs:165: active daemon foreground operation but CLI waiting_for_connections=false; fix is being gated.
kayg commented 2026-10-15 02:18:19 +00:00
Author
Owner
Copy link

Committed and pushed 1b648e8f: signed host receiver and declared release status/up/down controls. Exact staged tree passes fmt/all-target clippy, 30 unit plus 3 integration tests. Rechecks installation marker, compiled signature trust, downgrade authority and deferred-reply generation before replacement. Off/on cannot revive an old prepared reply. No VM acceptance claimed.

Committed and pushed 1b648e8f: signed host receiver and declared release status/up/down controls. Exact staged tree passes fmt/all-target clippy, 30 unit plus 3 integration tests. Rechecks installation marker, compiled signature trust, downgrade authority and deferred-reply generation before replacement. Off/on cannot revive an old prepared reply. No VM acceptance claimed.
kayg commented 2026-10-15 02:21:02 +00:00
Author
Owner
Copy link

Committed and pushed 0583cc64: bounded exact-server host sender (34 unit + 3 integration tests), and c2a58883: bounded generic private-control parser/registration. Exact staged-tree fmt/all-target clippy and touched tests pass for both. CLI regression red: daemon foreground active, waiting_for_connections=false; new live routing green: shared clock, one-time ready toast, quiet/manual/rollback writes, disabled/stopped refusals. Runtime routing is still uncommitted pending its exact-slice gate.

sender-exact-slice.log
local-control-exact-slice.log
live-cli-red.log
live-cli-green.log

Committed and pushed 0583cc64: bounded exact-server host sender (34 unit + 3 integration tests), and c2a58883: bounded generic private-control parser/registration. Exact staged-tree fmt/all-target clippy and touched tests pass for both. CLI regression red: daemon foreground active, waiting_for_connections=false; new live routing green: shared clock, one-time ready toast, quiet/manual/rollback writes, disabled/stopped refusals. Runtime routing is still uncommitted pending its exact-slice gate. [sender-exact-slice.log](https://git.kayg.org/attachments/9891ed88-7776-477c-a866-68d6c3e23e03) [local-control-exact-slice.log](https://git.kayg.org/attachments/7d0c276e-2f90-4d58-b1c6-38988dc4fab7) [live-cli-red.log](https://git.kayg.org/attachments/a05814f8-3aa7-42bd-a37a-b1890a7f8f5c) [live-cli-green.log](https://git.kayg.org/attachments/5978f9f2-8f27-4658-9723-d6e1fad7de1e)
kayg commented 2026-10-15 02:24:35 +00:00
Author
Owner
Copy link

Startup-recovery finding: runtime.rs:282 starts the plugin runtime inside build_router_core before HTTP bind at :305/:311; updater.rs reconcile therefore can mark a successor applied before listener admission succeeds. Additive D198 contract: a generic plugin server_listening notification after the real socket is bound, retained by the runtime for features enabled later. The release feature waits for this notification before reconciling applying history; tests using injected engines keep explicit readiness requirements. This keeps crash recovery feature-owned and avoids declaring healthy startup before bind. No new dependency or CA custody extension. Persisted startup selection restores only canonically verified retained images before CA import.

Startup-recovery finding: runtime.rs:282 starts the plugin runtime inside build_router_core before HTTP bind at :305/:311; updater.rs reconcile therefore can mark a successor applied before listener admission succeeds. Additive D198 contract: a generic plugin server_listening notification after the real socket is bound, retained by the runtime for features enabled later. The release feature waits for this notification before reconciling applying history; tests using injected engines keep explicit readiness requirements. This keeps crash recovery feature-owned and avoids declaring healthy startup before bind. No new dependency or CA custody extension. Persisted startup selection restores only canonically verified retained images before CA import.
kayg commented 2026-10-15 02:31:07 +00:00
Author
Owner
Copy link

Committed and pushed 00f84284: server release ownership of bounded per-node senders; f8a8476e: live removable release operator handler for the five update controls. Each exact staged tree passed fmt, 34 unit + 3 integration tests and all-target clippy. Runtime CLI slice has 20 restart/control tests passing, lint correction pending. New readiness regression observed red (0 passed, 1 failed): loaded image reconciled before listener admission. Fix waits on the generic listener-ready notification before reconciliation; focused green is queued. No VM or final size acceptance yet.

Committed and pushed 00f84284: server release ownership of bounded per-node senders; f8a8476e: live removable release operator handler for the five update controls. Each exact staged tree passed fmt, 34 unit + 3 integration tests and all-target clippy. Runtime CLI slice has 20 restart/control tests passing, lint correction pending. New readiness regression observed red (0 passed, 1 failed): loaded image reconciled before listener admission. Fix waits on the generic listener-ready notification before reconciliation; focused green is queued. No VM or final size acceptance yet.
kayg commented 2026-10-15 02:36:12 +00:00
Author
Owner
Copy link

Completed and pushed 7c57c50a: live CLI routing (exact fmt, 20 restart/control tests, all-target binary clippy). 50a12f2c: generic optional listener-ready hook (exact API gates). 2b44e419: plugin-owned startup-entry schema (exact release gates). 049f0d12: wait for listener readiness before success reconciliation (regression red 0/1, green; exact fmt/clippy, 35 unit + 3 integration passed). Runtime notification delivery, verified cold selection, final host wiring and staging proof remain pending.

live-cli-exact-slice.log
readiness-red.log
readiness-exact-slice.log

Completed and pushed 7c57c50a: live CLI routing (exact fmt, 20 restart/control tests, all-target binary clippy). 50a12f2c: generic optional listener-ready hook (exact API gates). 2b44e419: plugin-owned startup-entry schema (exact release gates). 049f0d12: wait for listener readiness before success reconciliation (regression red 0/1, green; exact fmt/clippy, 35 unit + 3 integration passed). Runtime notification delivery, verified cold selection, final host wiring and staging proof remain pending. [live-cli-exact-slice.log](https://git.kayg.org/attachments/6a7da4dc-74da-4905-8d93-c8b60095e403) [readiness-red.log](https://git.kayg.org/attachments/9bb85961-6e0f-493f-9d1b-2f5262ee0bd9) [readiness-exact-slice.log](https://git.kayg.org/attachments/1d1a3b92-9451-4929-a54d-148a5bdc0728)
kayg commented 2026-10-15 02:48:32 +00:00
Author
Owner
Copy link

Completed/pushed 633908ac: generic listener delivery (2 lifecycle + 9 runtime tests); afde2f20: verified cold selection/rollback planner (39 unit + 3 integration); e5545a20: existing download/verification host catalog (20 release-related server tests); e1e27385: retained-image startup adapter/readiness (22 release-related tests); f5fdc79f: sealed startup selection in CLI (78 binary tests). Each exact staged tree passed fmt and touched all-target clippy.

Startup-path security regression red: unsafe release storage returned while fd0 still named a socket. Correction preserves the existing protected stdin disposal before configuration I/O and installs inherited authority only after retained trust/selection. Real subprocess regression and all binary tests green. No secret material persisted; fatal-crash recovery stays cold. VM access check succeeded with no host-key changes. VM acceptance, final size/profile proof and historical ordering repair remain pending.

listener-runtime-exact-slice.log
startup-plan-exact-slice.log
catalog-exact-slice.log
startup-engine-exact-slice.log
startup-stdin-red.log
startup-cli-exact-slice.log

Completed/pushed 633908ac: generic listener delivery (2 lifecycle + 9 runtime tests); afde2f20: verified cold selection/rollback planner (39 unit + 3 integration); e5545a20: existing download/verification host catalog (20 release-related server tests); e1e27385: retained-image startup adapter/readiness (22 release-related tests); f5fdc79f: sealed startup selection in CLI (78 binary tests). Each exact staged tree passed fmt and touched all-target clippy. Startup-path security regression red: unsafe release storage returned while fd0 still named a socket. Correction preserves the existing protected stdin disposal before configuration I/O and installs inherited authority only after retained trust/selection. Real subprocess regression and all binary tests green. No secret material persisted; fatal-crash recovery stays cold. VM access check succeeded with no host-key changes. VM acceptance, final size/profile proof and historical ordering repair remain pending. [listener-runtime-exact-slice.log](https://git.kayg.org/attachments/d4034c12-0c79-4fd6-8244-96b7c216c5ee) [startup-plan-exact-slice.log](https://git.kayg.org/attachments/35491d64-0811-4ec5-96ea-82653175f575) [catalog-exact-slice.log](https://git.kayg.org/attachments/b60c8f0d-b362-427d-8368-a71776f96a4e) [startup-engine-exact-slice.log](https://git.kayg.org/attachments/104e7ebf-18a8-4e3b-ad8c-71b19190c47c) [startup-stdin-red.log](https://git.kayg.org/attachments/24a193d6-b2f4-4899-9643-a9decd3da840) [startup-cli-exact-slice.log](https://git.kayg.org/attachments/0848b0ed-b5fb-4526-be2e-901b723c59e3)
kayg commented 2026-10-15 03:33:01 +00:00
Author
Owner
Copy link

Completed/pushed 570a6fd3 managed A/B layout validation; 57c8bac8 bootstrap compatibility (three regressions red, all 50 installer tests green); 16bc57fa optional host/staging feature edges; 452247fb managed receiver + CLI registration (103 agent + 78 binary tests, fmt/clippy). No load waiver: initial legacy test ENOENT failures were missing scratch target state; external target link and two test threads pass.

90d93217 adds real staging updater/managed-host/failure harness: three acknowledgement regressions + 23 release-related tests + remote all-target clippy pass. c3be3851 packages/streams public signed fixtures under the VM lock; functional artifact test passes. a719fea2 extends local request fuzzing (codec test/check/qualified clippy pass; sanitizer running). 60828e4e reconciles implemented wire/bootstrap docs with the prior issue proposal.

Normal candidate x86 static production image: 21,084,496 B, SHA256 1413a2128d9c71b56fa9958d524e8a059d61b42e51699a3a869b7203e9781daa, production-trust check PASS. Existing cap 22,204,304 B, delta -1,119,808 B. Same source opt-level=3 comparison image: 22,767,504 B, SHA256 e975cdc88ec4c58cc691c567c5586c507b77d03e57f7561e32ce081302262fae. Candidate profile saves 1,683,008 B. Profile not committed yet: paired VM evidence and ARM/final-head sizes remain pending. No cap changed. Staging image rebuilt; native harness and ARM production build now running.

install-cache-red.log
install-selector-red.log
install-pending-red.log
install-exact-slice.log
host-wiring-exact-slice.log
staging-ack-tests.log

Completed/pushed 570a6fd3 managed A/B layout validation; 57c8bac8 bootstrap compatibility (three regressions red, all 50 installer tests green); 16bc57fa optional host/staging feature edges; 452247fb managed receiver + CLI registration (103 agent + 78 binary tests, fmt/clippy). No load waiver: initial legacy test ENOENT failures were missing scratch target state; external target link and two test threads pass. 90d93217 adds real staging updater/managed-host/failure harness: three acknowledgement regressions + 23 release-related tests + remote all-target clippy pass. c3be3851 packages/streams public signed fixtures under the VM lock; functional artifact test passes. a719fea2 extends local request fuzzing (codec test/check/qualified clippy pass; sanitizer running). 60828e4e reconciles implemented wire/bootstrap docs with the prior issue proposal. Normal candidate x86 static production image: 21,084,496 B, SHA256 1413a2128d9c71b56fa9958d524e8a059d61b42e51699a3a869b7203e9781daa, production-trust check PASS. Existing cap 22,204,304 B, delta -1,119,808 B. Same source opt-level=3 comparison image: 22,767,504 B, SHA256 e975cdc88ec4c58cc691c567c5586c507b77d03e57f7561e32ce081302262fae. Candidate profile saves 1,683,008 B. Profile not committed yet: paired VM evidence and ARM/final-head sizes remain pending. No cap changed. Staging image rebuilt; native harness and ARM production build now running. [install-cache-red.log](https://git.kayg.org/attachments/77405773-9b49-4cbc-baf0-d63ee6653a7c) [install-selector-red.log](https://git.kayg.org/attachments/eebeafa3-12e2-463f-8452-482d803f48d2) [install-pending-red.log](https://git.kayg.org/attachments/1d718b57-ed17-4db0-b9e6-ca151203d91b) [install-exact-slice.log](https://git.kayg.org/attachments/6ec19bff-5750-471b-b787-d71e1ce23ee8) [host-wiring-exact-slice.log](https://git.kayg.org/attachments/5d223a6e-361c-480c-bc87-e280acf57195) [staging-ack-tests.log](https://git.kayg.org/attachments/5b04f063-a7f5-4544-af78-a86a9fb5f979)
kayg commented 2026-10-15 03:52:09 +00:00
Author
Owner
Copy link

Pushed staging harness/driver (90d93217, c3be3851), bounded local-control fuzz coverage (a719fea2), and implemented-wire/bootstrap documentation (60828e4e). The staging driver closed its in-memory signer before transferring public fixtures; run /root/infraternal-bench/edge-autoupdate/71b9 and the separate paired real-PTY profile comparison are waiting for the shared perf lock. No production access or Worker deployment. ARM static build, sanitizer fuzz run and scripts/verify iterate are running. History repair preview moves prerequisite-dependent tests to their admitting commits and preserves the final tree exactly; boundary validation is next.

Pushed staging harness/driver (90d93217, c3be3851), bounded local-control fuzz coverage (a719fea2), and implemented-wire/bootstrap documentation (60828e4e). The staging driver closed its in-memory signer before transferring public fixtures; run /root/infraternal-bench/edge-autoupdate/71b9 and the separate paired real-PTY profile comparison are waiting for the shared perf lock. No production access or Worker deployment. ARM static build, sanitizer fuzz run and scripts/verify iterate are running. History repair preview moves prerequisite-dependent tests to their admitting commits and preserves the final tree exactly; boundary validation is next.
kayg commented 2026-10-15 03:53:40 +00:00
Author
Owner
Copy link

00969ea87 repairs a pre-existing static-size test parser: scripts/test-static-size.py expected "max N" but scripts/verify.d/rust.sh prints "cap: N bytes". The existing fixture failed with TypeError before the boundary checks; after the fix both target labels pass exact-cap, +1-byte refusal, -1-byte ratchet and unsupported-target checks. This isolated parser test uses the same public x86 ELF for both labels; native ARM shipping size/linkage remains a separate final gate. Python compilation and workspace fmt pass.

size-boundary-red.log
size-boundary-green.log

00969ea87 repairs a pre-existing static-size test parser: scripts/test-static-size.py expected "max N" but scripts/verify.d/rust.sh prints "cap: N bytes". The existing fixture failed with TypeError before the boundary checks; after the fix both target labels pass exact-cap, +1-byte refusal, -1-byte ratchet and unsupported-target checks. This isolated parser test uses the same public x86 ELF for both labels; native ARM shipping size/linkage remains a separate final gate. Python compilation and workspace fmt pass. [size-boundary-red.log](https://git.kayg.org/attachments/2e9f6c19-184a-402c-b8ce-e252439a94ca) [size-boundary-green.log](https://git.kayg.org/attachments/4ff76052-2f2e-47ca-9dc4-ecd54f86c4f4)
kayg commented 2026-10-15 04:04:01 +00:00
Author
Owner
Copy link

Normal production-trust ARM static candidate: 18,710,016 bytes; SHA-256 8934a55de0b678b7c2b8058ca504b05271b349f612dac0be4bb895122a756747. This is 928,728 bytes below dev cap 19,638,744, with no staging authority. The corresponding x86 candidate is 21,084,496 bytes (-1,119,808 vs cap). These are artifact byte counts, not build-host performance evidence. Profile adoption remains pending the queued paired VM comparisons. Checking actual edge-stamped artifact size before ratcheting the gate.

Normal production-trust ARM static candidate: 18,710,016 bytes; SHA-256 8934a55de0b678b7c2b8058ca504b05271b349f612dac0be4bb895122a756747. This is 928,728 bytes below dev cap 19,638,744, with no staging authority. The corresponding x86 candidate is 21,084,496 bytes (-1,119,808 vs cap). These are artifact byte counts, not build-host performance evidence. Profile adoption remains pending the queued paired VM comparisons. Checking actual edge-stamped artifact size before ratcheting the gate.
kayg commented 2026-10-15 04:08:31 +00:00
Author
Owner
Copy link

scripts/verify iterate: fmt, VT native fmt, CLI plugin compile-out, clippy and all workspace tests PASS; cargo-deny FAIL for rustls 0.23.45 advisories RUSTSEC-2026-0346/0347/0348/0349. The diagnostic names 0.23.46 as the fixed patch for all four. No advisory waiver added. Updating only the locked existing D176 library from 0.23.45 to 0.23.46; no new engine/provider/features. Direct transport fmt/clippy/tests and cargo-deny are running. Queued pre-patch fixtures will be labelled preliminary; final static artifacts and VM acceptance must include the patched graph.

iterate.log

scripts/verify iterate: fmt, VT native fmt, CLI plugin compile-out, clippy and all workspace tests PASS; cargo-deny FAIL for rustls 0.23.45 advisories RUSTSEC-2026-0346/0347/0348/0349. The diagnostic names 0.23.46 as the fixed patch for all four. No advisory waiver added. Updating only the locked existing D176 library from 0.23.45 to 0.23.46; no new engine/provider/features. Direct transport fmt/clippy/tests and cargo-deny are running. Queued pre-patch fixtures will be labelled preliminary; final static artifacts and VM acceptance must include the patched graph. [iterate.log](https://git.kayg.org/attachments/609dae2e-89a6-4023-b0d3-072a8df83dbf)
kayg commented 2026-10-15 04:09:51 +00:00
Author
Owner
Copy link

2bf702aa: locked rustls 0.23.46, retaining D176 stack/features. Workspace fmt PASS; direct transport all-target clippy PASS; 11 transport tests PASS; cargo-deny: "advisories ok, bans ok, licenses ok, sources ok". No waiver or new engine. Final workspace gate and static artifact qualification remain.

rustls-patch-gate.log

2bf702aa: locked rustls 0.23.46, retaining D176 stack/features. Workspace fmt PASS; direct transport all-target clippy PASS; 11 transport tests PASS; cargo-deny: "advisories ok, bans ok, licenses ok, sources ok". No waiver or new engine. Final workspace gate and static artifact qualification remain. [rustls-patch-gate.log](https://git.kayg.org/attachments/06936f47-e1f3-423d-8c76-9c2375e73fd9)
kayg commented 2026-10-15 04:22:07 +00:00
Author
Owner
Copy link

Pre-patch VM fixtures acquired the lock on infraternal-perf-test (kernel 6.12.111+deb13-amd64). Update proof FAILED before update operations: real passkey CA unlock passed, then terminal.open returned a refused result at ca_handoff_shipping_tests.rs:705. Own server unit, UID1000 manager, bind and run directory were removed. Added fixed-enum-only refusal diagnostics; a public-fixture reuse retry is building to identify the refusal without logging arbitrary reply/panic data.

Pre-patch profile probe completed: 128 real PTYs, 1000 typing samples per image, RTT 0; baseline/candidate echo p99 2.9566/2.5421 ms, ACK p99 2.6518/2.1470 ms, daemon RSS 8892/8904 KiB. Load before 2.59 1.72 1.38; after 2.54 1.77 1.41. These qualify only the pre-rustls-patch artifacts; final patched comparison and full update acceptance remain required.

managed-update-proof.txt
profile-echo-results.log

Pre-patch VM fixtures acquired the lock on infraternal-perf-test (kernel 6.12.111+deb13-amd64). Update proof FAILED before update operations: real passkey CA unlock passed, then terminal.open returned a refused result at ca_handoff_shipping_tests.rs:705. Own server unit, UID1000 manager, bind and run directory were removed. Added fixed-enum-only refusal diagnostics; a public-fixture reuse retry is building to identify the refusal without logging arbitrary reply/panic data. Pre-patch profile probe completed: 128 real PTYs, 1000 typing samples per image, RTT 0; baseline/candidate echo p99 2.9566/2.5421 ms, ACK p99 2.6518/2.1470 ms, daemon RSS 8892/8904 KiB. Load before 2.59 1.72 1.38; after 2.54 1.77 1.41. These qualify only the pre-rustls-patch artifacts; final patched comparison and full update acceptance remain required. [managed-update-proof.txt](https://git.kayg.org/attachments/acd6151b-df61-429a-bfa4-01feb18df71d) [profile-echo-results.log](https://git.kayg.org/attachments/ede5ca38-c6de-4569-acf6-8add85b259c3)
kayg commented 2026-10-15 04:39:09 +00:00
Author
Owner
Copy link

Ordering repair pushed: 2bf702aa15 → b43fb891ac; final tree identical. Prerequisite-dependent updater tests plus their helper now enter with with_updates; channel TTY/skill expectations enter with their action-copy change; remote tuple destructuring enters with listener readiness. Two later correction-only commits became empty. Full old→new map attached.

All four affected boundary snapshots pass workspace fmt, touched all-target clippy and tests, using fresh archive mtimes: updater/declaration 12 unit + 3 integration each; authority 14 unit + 3 integration; CLI skill 1 plus real-TTY channel test; listener 2 lifecycle + 7 runtime integration + 1 node-lifecycle unit. No lint bypass. The archived-source timestamp fixture initially reused stale Cargo output; corrected and reran every boundary before applying the repair.

AddressSanitizer local_update parser fuzz: 100,000 inputs, no failure. Production fat LTO caused unresolved sanitizer coverage symbols; disabled LTO only in the external fuzz invocation. Shipping profile unchanged. This is functional parser evidence, not a build-host performance claim.

history-map.json
history-boundary-4e68641a.log
history-boundary-9dfb1d0b.log
history-boundary-734dc14d.log
history-boundary-633908ac.log
local-control-fuzz-no-lto.log
local-control-fuzz-run.log
history-listener-runtime-tests.log

Ordering repair pushed: 2bf702aa15704f2cb339c9a25aad405bb3626dbf → b43fb891ac55923e3bd4bbb08db851e8d4391a0a; final tree identical. Prerequisite-dependent updater tests plus their helper now enter with with_updates; channel TTY/skill expectations enter with their action-copy change; remote tuple destructuring enters with listener readiness. Two later correction-only commits became empty. Full old→new map attached. All four affected boundary snapshots pass workspace fmt, touched all-target clippy and tests, using fresh archive mtimes: updater/declaration 12 unit + 3 integration each; authority 14 unit + 3 integration; CLI skill 1 plus real-TTY channel test; listener 2 lifecycle + 7 runtime integration + 1 node-lifecycle unit. No lint bypass. The archived-source timestamp fixture initially reused stale Cargo output; corrected and reran every boundary before applying the repair. AddressSanitizer local_update parser fuzz: 100,000 inputs, no failure. Production fat LTO caused unresolved sanitizer coverage symbols; disabled LTO only in the external fuzz invocation. Shipping profile unchanged. This is functional parser evidence, not a build-host performance claim. [history-map.json](https://git.kayg.org/attachments/08be995e-54cc-4692-8357-60f2c4ec8771) [history-boundary-4e68641a.log](https://git.kayg.org/attachments/b1655f9b-533c-4a6a-9e73-76c4b8efbad0) [history-boundary-9dfb1d0b.log](https://git.kayg.org/attachments/8224e4c2-c89d-4be3-9d7f-144c38863e57) [history-boundary-734dc14d.log](https://git.kayg.org/attachments/ceca181d-1b84-4991-b86e-7df72e4214db) [history-boundary-633908ac.log](https://git.kayg.org/attachments/a6c54269-0b24-4a1e-8fb6-99bf9ae70f50) [local-control-fuzz-no-lto.log](https://git.kayg.org/attachments/a1807129-af7b-4ee8-aeeb-40cda33dc175) [local-control-fuzz-run.log](https://git.kayg.org/attachments/24984503-8b0f-4701-9479-7244021d5016) [history-listener-runtime-tests.log](https://git.kayg.org/attachments/75d25738-5477-42e1-ab1b-ef94ac2ee4a8)
kayg commented 2026-10-15 04:47:06 +00:00
Author
Owner
Copy link

6132ee46: fixed-enum-only staging terminal refusal diagnostics pushed; fmt, remote server all-target clippy and 10 real CA handoff tests PASS. Only the profile candidate remains uncommitted pending patched VM qualification. Patched normal x86 21,083,824 B SHA-256 6eaf33b299d7b22cba16db38624b9b7aba252070c8292a6a1e3f6e8d68ea5bbf; ARM 18,710,288 B SHA-256 d2c599c6bb650ed7817668e7b15ea09a1ffc9f0ed955810f5746127a6fcf5b0e. Corresponding candidate cap fixtures pass exact, +1-byte refusal, -1-byte ratchet, unknown target; real ARM ELF used. Edge-stamped ARM matches normal ARM size.

Shared perf lock has a substantial queue. Own waiting runs: /root/infraternal-bench/edge-autoupdate/8e3c (pre-patch image, updated refusal diagnostic); peb46 (six alternating patched normal baseline/candidate probes, 128 PTYs each, ACK/echo plus owned daemon/shim/shell PSS); b1a9 (fresh patched full acceptance). All wait with flock -w 3600 and own teardown. Fresh public-only signed fixture cache: $HOME/.cache/codex-scratch/edge-autoupdate/proof/public-transfer-78e88c20; reusable for harness-only retries after its signer was closed. Source/targets/evidence remain in the same edge-autoupdate worktree/scratch. Full acceptance and final scripts/verify fast remain pending; no production or Worker deployment.

terminal-diagnostic-clippy.log
terminal-diagnostic-tests.log
patched-size-boundary-tests.log
patched-staging-build-and-run.log

6132ee46: fixed-enum-only staging terminal refusal diagnostics pushed; fmt, remote server all-target clippy and 10 real CA handoff tests PASS. Only the profile candidate remains uncommitted pending patched VM qualification. Patched normal x86 21,083,824 B SHA-256 6eaf33b299d7b22cba16db38624b9b7aba252070c8292a6a1e3f6e8d68ea5bbf; ARM 18,710,288 B SHA-256 d2c599c6bb650ed7817668e7b15ea09a1ffc9f0ed955810f5746127a6fcf5b0e. Corresponding candidate cap fixtures pass exact, +1-byte refusal, -1-byte ratchet, unknown target; real ARM ELF used. Edge-stamped ARM matches normal ARM size. Shared perf lock has a substantial queue. Own waiting runs: /root/infraternal-bench/edge-autoupdate/8e3c (pre-patch image, updated refusal diagnostic); peb46 (six alternating patched normal baseline/candidate probes, 128 PTYs each, ACK/echo plus owned daemon/shim/shell PSS); b1a9 (fresh patched full acceptance). All wait with flock -w 3600 and own teardown. Fresh public-only signed fixture cache: $HOME/.cache/codex-scratch/edge-autoupdate/proof/public-transfer-78e88c20; reusable for harness-only retries after its signer was closed. Source/targets/evidence remain in the same edge-autoupdate worktree/scratch. Full acceptance and final scripts/verify fast remain pending; no production or Worker deployment. [terminal-diagnostic-clippy.log](https://git.kayg.org/attachments/92e99687-a43f-4e8d-9e1b-142050b42e2b) [terminal-diagnostic-tests.log](https://git.kayg.org/attachments/68873031-78f7-4989-8c51-aa73fb45dbea) [patched-size-boundary-tests.log](https://git.kayg.org/attachments/06bd5e08-12a5-4f91-9f94-74c8acf41f77) [patched-staging-build-and-run.log](https://git.kayg.org/attachments/7252436e-d26f-428f-81d1-0243a8f078e6)
kayg commented 2026-10-15 04:54:11 +00:00
Author
Owner
Copy link

Publish-gate finding: patched x86 normal/default build is 21,083,824 B, but the actual pipeline recipe (INFRATERNAL_RELEASE_BUILD=1, edge-20261015T040000Z) is 21,083,888 B; production trust PASS. The exact-byte shrink guard would reject the builder if only the default artifact were ratcheted. ARM edge-stamped/default are both 18,710,288 B. This is a 64-byte identity/production-recipe difference, not growth allowance.

Proposed gate repair before implementation (PROCESS §2): make static shipping checks build the explicit D225 production recipe, preserving the supplied D226 release identity, and ratchet exact measured production ceilings. If stable/edge differ, record both exact recipe ceilings rather than adding slack or padding. Both remain >0.9 MB below the old architecture caps. Measuring stable-production variants next; D243 remains unchanged, with no waiver or automatic ceiling increase.

Publish-gate finding: patched x86 normal/default build is 21,083,824 B, but the actual pipeline recipe (INFRATERNAL_RELEASE_BUILD=1, edge-20261015T040000Z) is 21,083,888 B; production trust PASS. The exact-byte shrink guard would reject the builder if only the default artifact were ratcheted. ARM edge-stamped/default are both 18,710,288 B. This is a 64-byte identity/production-recipe difference, not growth allowance. Proposed gate repair before implementation (PROCESS §2): make static shipping checks build the explicit D225 production recipe, preserving the supplied D226 release identity, and ratchet exact measured production ceilings. If stable/edge differ, record both exact recipe ceilings rather than adding slack or padding. Both remain >0.9 MB below the old architecture caps. Measuring stable-production variants next; D243 remains unchanged, with no waiver or automatic ceiling increase.
kayg commented 2026-10-15 05:02:01 +00:00
Author
Owner
Copy link

Author review note for break-it review: server Engine::stage/retain_current publishes verified images under updates/images/ (crates/infraternal-server/src/release_update.rs); the bounded 100-row update history does not currently collect old image directories. At the measured stable x86 recipe, each retained executable is 21,083,824 B plus small signed metadata. Manual rollback selects only previous_version/path. No image-retention rule has been added in this pass. Host managed storage is A/B, and HostCatalog retains only the running version’s two architectures plus transfer-owned temporary historical seeds. Automated edge publication frequency makes server cache retention a concrete review point; it is not covered by the binary-size ceiling.

Author review note for break-it review: server Engine::stage/retain_current publishes verified images under updates/images/<version> (crates/infraternal-server/src/release_update.rs); the bounded 100-row update history does not currently collect old image directories. At the measured stable x86 recipe, each retained executable is 21,083,824 B plus small signed metadata. Manual rollback selects only previous_version/path. No image-retention rule has been added in this pass. Host managed storage is A/B, and HostCatalog retains only the running version’s two architectures plus transfer-owned temporary historical seeds. Automated edge publication frequency makes server cache retention a concrete review point; it is not covered by the binary-size ceiling.
kayg commented 2026-10-15 05:13:41 +00:00
Author
Owner
Copy link

3ee281ae9: explicit production compiler recipe pushed; regression failed before fix and now passes default/disabled/stable/edge callers for both static targets, preserving exact identity. Shell syntax, Python compilation and workspace fmt pass.

Measured production recipes are now complete: stable x86 21,083,824 B; edge x86 21,083,888 B; stable/edge ARM each 18,710,288 B. Prepared exact per-channel ratchets in scripts/verify.d/rust.sh and docs/PROCESS.md; no growth allowance, padding or decision change. Both channels independently pass real-ELF exact, +1-byte refusal, -1-byte ratchet and unsupported-target checks. Their largest ceilings remain 1,120,416 B (x86) / 928,456 B (ARM) below the old architecture caps.

Working tree currently contains the compact profile plus prepared cap/table edits, pending patched VM profile qualification. Profile patch attached so the state can be resumed from this issue alone. Shared VM lock still blocks the diagnostic (8e3c), profile (peb46) and patched acceptance (b1a9) runs; waits and teardown remain active. No final acceptance or fast-gate claim.

static-recipe-red.log
static-recipe-final.log
stable-size-boundary-tests.log
edge-size-boundary-tests.log
compact-profile.patch

3ee281ae9: explicit production compiler recipe pushed; regression failed before fix and now passes default/disabled/stable/edge callers for both static targets, preserving exact identity. Shell syntax, Python compilation and workspace fmt pass. Measured production recipes are now complete: stable x86 21,083,824 B; edge x86 21,083,888 B; stable/edge ARM each 18,710,288 B. Prepared exact per-channel ratchets in scripts/verify.d/rust.sh and docs/PROCESS.md; no growth allowance, padding or decision change. Both channels independently pass real-ELF exact, +1-byte refusal, -1-byte ratchet and unsupported-target checks. Their largest ceilings remain 1,120,416 B (x86) / 928,456 B (ARM) below the old architecture caps. Working tree currently contains the compact profile plus prepared cap/table edits, pending patched VM profile qualification. Profile patch attached so the state can be resumed from this issue alone. Shared VM lock still blocks the diagnostic (8e3c), profile (peb46) and patched acceptance (b1a9) runs; waits and teardown remain active. No final acceptance or fast-gate claim. [static-recipe-red.log](https://git.kayg.org/attachments/52b70e46-1d4d-4d9b-8dec-67e61a962b86) [static-recipe-final.log](https://git.kayg.org/attachments/d240718d-08fd-43bd-b225-d2aaa0603b14) [stable-size-boundary-tests.log](https://git.kayg.org/attachments/a482821b-4b31-480c-8943-22e223caa46a) [edge-size-boundary-tests.log](https://git.kayg.org/attachments/25e9280c-16b3-44a9-aa1d-4f3b052933ff) [compact-profile.patch](https://git.kayg.org/attachments/2cf1719e-9741-42af-a65f-449eae2f4392)
kayg commented 2026-10-15 05:44:36 +00:00
Author
Owner
Copy link

bc5384ba pushed: compact CLI/API/release profiles. Locked VM, 128 real PTYs, 258 owned daemon/shim/shell processes, six alternating runs (3000 typing samples per variant), RTT 0. Baseline/candidate median run echo p50 0.356/0.317 ms; echo p99 1.773/1.675 ms; ACK p99 1.599/1.201 ms. Median owned process-set PSS 448,995/450,214 KiB (+1219 KiB, +0.27% at 128 PTYs); daemon RSS 9212/8952 KiB (-260 KiB). Matched normal binary cut 1,685,184 B. Load before 0.46 0.96 1.63, after 1.10 1.06 1.62. Accept the measured memory tradeoff; no claim of causal speedup from overlapping latency ranges. Fmt, touched all-target clippy, API 29 unit + 2 integration, release 27 unit + 3 integration, CLI 78 binary tests PASS.

Patched pre-fix full proof failed before update operations: 128 PTYs created and managed rootless host A enrolled/reattached, then browser 1 disconnected at stream 49 during attachment (update_staging_tests.rs:213); own resources were removed. Same earlier retry failed at stream 47. No acceptance claim.

a4f955a9 pushed: whole-image verification/retention/publication and host-offer hashing hand off the serving scheduler core while remaining inside the owned future. Deterministic sole-worker regression failed before fix (control could not progress), then passes with cancellation ownership; cold current-thread startup test also passes. Fmt, remote server all-target clippy and 25 release-related tests PASS. No liveness deadline change or detached verification work. Attachment causality remains to be checked on fresh VM images; adding staging-only fixed-label close diagnostics before that retry. Previous prepared size caps must be remeasured after this fix before final ratchet/fast gate.

profile-patched-echo-results.log
compact-profile-gate.log
patched-update-attempt.txt
image-io-scheduler-red.log
image-io-scheduler-green.log
owned-image-io-clippy.log
owned-image-io-tests.log

bc5384ba pushed: compact CLI/API/release profiles. Locked VM, 128 real PTYs, 258 owned daemon/shim/shell processes, six alternating runs (3000 typing samples per variant), RTT 0. Baseline/candidate median run echo p50 0.356/0.317 ms; echo p99 1.773/1.675 ms; ACK p99 1.599/1.201 ms. Median owned process-set PSS 448,995/450,214 KiB (+1219 KiB, +0.27% at 128 PTYs); daemon RSS 9212/8952 KiB (-260 KiB). Matched normal binary cut 1,685,184 B. Load before 0.46 0.96 1.63, after 1.10 1.06 1.62. Accept the measured memory tradeoff; no claim of causal speedup from overlapping latency ranges. Fmt, touched all-target clippy, API 29 unit + 2 integration, release 27 unit + 3 integration, CLI 78 binary tests PASS. Patched pre-fix full proof failed before update operations: 128 PTYs created and managed rootless host A enrolled/reattached, then browser 1 disconnected at stream 49 during attachment (update_staging_tests.rs:213); own resources were removed. Same earlier retry failed at stream 47. No acceptance claim. a4f955a9 pushed: whole-image verification/retention/publication and host-offer hashing hand off the serving scheduler core while remaining inside the owned future. Deterministic sole-worker regression failed before fix (control could not progress), then passes with cancellation ownership; cold current-thread startup test also passes. Fmt, remote server all-target clippy and 25 release-related tests PASS. No liveness deadline change or detached verification work. Attachment causality remains to be checked on fresh VM images; adding staging-only fixed-label close diagnostics before that retry. Previous prepared size caps must be remeasured after this fix before final ratchet/fast gate. [profile-patched-echo-results.log](https://git.kayg.org/attachments/61773776-c64c-427a-a731-b059f04bbc63) [compact-profile-gate.log](https://git.kayg.org/attachments/a2390e20-5fe4-4953-8602-946ce25569df) [patched-update-attempt.txt](https://git.kayg.org/attachments/0c444e6b-c710-4c92-909f-cae2ab8d699f) [image-io-scheduler-red.log](https://git.kayg.org/attachments/19ba6ab8-8071-4c2c-b05e-74d299f21a97) [image-io-scheduler-green.log](https://git.kayg.org/attachments/46ab5940-6a97-4ce2-9c47-b6221300e990) [owned-image-io-clippy.log](https://git.kayg.org/attachments/c07b13a4-df2c-4f2d-98a7-220993c162cf) [owned-image-io-tests.log](https://git.kayg.org/attachments/31a18f29-c4b4-4980-88a7-3991ae73535b)
kayg commented 2026-10-15 06:25:39 +00:00
Author
Owner
Copy link

6df8f104: staging-only fixed-label/count browser-close receipts; no raw frame/auth/panic logging. Strict staging remote server clippy and 4 liveness tests PASS.

b4ea99b8: fixture now matches shipping server KillMode=process (install.rs:171), so the deliberate post-exec process crash can preserve PTYs. A real user-manager test failed before fix: original child exited during restart. Same test passes afterward, using pidfds for lifetime observation and cleanup; signed packaging test also passes. Reused same-UID fixture-socket PID cleanup. Fmt, staging remote all-target clippy and 10 CA handoff tests PASS.

All scripts/verify iterate rows now PASS on b4ea99b8 with prepared cap/table edits (static build checks excluded as designed), including cargo-deny and TypeScript/bundle checks. Final fast remains required and not yet run. Current production x86 stable/edge measurements after owned image I/O: 21,100,176 / 21,100,240 B; ARM stable 18,726,528 B. Final ARM edge build is running. The bounded scheduler fix adds 16,352 B x86 / 16,240 B ARM versus the prior compact snapshot, with no new crate/stack or relaxed liveness deadline. Final ceilings will still drop over 0.9 MB below the original caps.

Own waiting VM runs: efc3 (owned-I/O image, old fixture process-lifetime setting) and 4327 (same signed images, corrected fixture). Reusable public cache public-transfer-48b11f93 under the job scratch. Acceptance is pending; no warm/manual/rollback timing claim.

iterate-after-io.log
staging-close-diagnostic-final-clippy.log
staging-close-diagnostic-final-tests.log
staging-kill-mode-red.log
staging-kill-mode-green.log
staging-kill-mode-clippy.log
staging-kill-mode-tests.log

6df8f104: staging-only fixed-label/count browser-close receipts; no raw frame/auth/panic logging. Strict staging remote server clippy and 4 liveness tests PASS. b4ea99b8: fixture now matches shipping server KillMode=process (install.rs:171), so the deliberate post-exec process crash can preserve PTYs. A real user-manager test failed before fix: original child exited during restart. Same test passes afterward, using pidfds for lifetime observation and cleanup; signed packaging test also passes. Reused same-UID fixture-socket PID cleanup. Fmt, staging remote all-target clippy and 10 CA handoff tests PASS. All scripts/verify iterate rows now PASS on b4ea99b8 with prepared cap/table edits (static build checks excluded as designed), including cargo-deny and TypeScript/bundle checks. Final fast remains required and not yet run. Current production x86 stable/edge measurements after owned image I/O: 21,100,176 / 21,100,240 B; ARM stable 18,726,528 B. Final ARM edge build is running. The bounded scheduler fix adds 16,352 B x86 / 16,240 B ARM versus the prior compact snapshot, with no new crate/stack or relaxed liveness deadline. Final ceilings will still drop over 0.9 MB below the original caps. Own waiting VM runs: efc3 (owned-I/O image, old fixture process-lifetime setting) and 4327 (same signed images, corrected fixture). Reusable public cache public-transfer-48b11f93 under the job scratch. Acceptance is pending; no warm/manual/rollback timing claim. [iterate-after-io.log](https://git.kayg.org/attachments/4c5ef501-91d9-4c2c-a63b-0be905ca8b18) [staging-close-diagnostic-final-clippy.log](https://git.kayg.org/attachments/6bc6d8fb-5f65-4dee-9340-90c4e937dda8) [staging-close-diagnostic-final-tests.log](https://git.kayg.org/attachments/3845721a-1f34-4f73-8f85-7ab88c545040) [staging-kill-mode-red.log](https://git.kayg.org/attachments/6a3a9c4b-b1af-4e52-8813-16ece0920305) [staging-kill-mode-green.log](https://git.kayg.org/attachments/6d26652e-4f40-4506-b356-1adb24f3a80f) [staging-kill-mode-clippy.log](https://git.kayg.org/attachments/eefdab35-a5eb-457f-8186-65067ee09dcd) [staging-kill-mode-tests.log](https://git.kayg.org/attachments/8dedfe0b-ffa0-4b6e-9c10-0bc30ebfd6a0)
kayg commented 2026-10-15 06:35:28 +00:00
Author
Owner
Copy link

VM attempts efc3 and 4327: real passkey CA unlock and managed host A succeeded; both failed during browser 1 attachment at 22 streams, before any update was published. Safe server diagnostics identify browser_liveness_expired, not an updater failure. Owned image-I/O fix did not resolve this separate attach/liveness interaction. Both runs removed owned manager/runtime/directory. Receipts: process-mode, owned-I/O.

The fixture queues the next attach immediately on its ACK, which can race the reader enqueueing a control Pong. Adding an explicit successful control-probe reply fence between fixture attaches, with a deterministic WebSocket regression first. The target remains 128 simultaneous PTYs, 50 users and 10,000 inventory rows; production liveness deadlines remain unchanged. This separates the update qualification workload from burst attachment admission; the burst failure remains a break-it review finding, not a passing capacity claim.

VM attempts efc3 and 4327: real passkey CA unlock and managed host A succeeded; both failed during browser 1 attachment at 22 streams, before any update was published. Safe server diagnostics identify browser_liveness_expired, not an updater failure. Owned image-I/O fix did not resolve this separate attach/liveness interaction. Both runs removed owned manager/runtime/directory. Receipts: [process-mode](https://git.kayg.org/attachments/6dcbb465-3257-476a-b798-33814ccb7980), [owned-I/O](https://git.kayg.org/attachments/6aadcb17-ddb1-43b6-ba0b-0e680a51cf81). The fixture queues the next attach immediately on its ACK, which can race the reader enqueueing a control Pong. Adding an explicit successful control-probe reply fence between fixture attaches, with a deterministic WebSocket regression first. The target remains 128 simultaneous PTYs, 50 users and 10,000 inventory rows; production liveness deadlines remain unchanged. This separates the update qualification workload from burst attachment admission; the burst failure remains a break-it review finding, not a passing capacity claim.
kayg commented 2026-10-15 06:39:12 +00:00
Author
Owner
Copy link

Completed production size ratchet bc953e4a7 (pushed). Four real production builds with rustls 0.23.46 and owned image-I/O: x86 stable 21,100,176 B, edge 21,100,240 B; ARM stable/edge 18,726,528 B. Largest x86 is 1,104,064 B below the prior dev ceiling; ARM is 912,216 B below. No growth allowance: exact equality, +1 rejection, -1 requires ratchet, unsupported-target rejection pass for both channels. Production-marker admission has four passing caller-environment cases; shell syntax/fmt/diff checks pass.

Hashes/recipes, builds, stable boundaries, edge boundaries, recipe admission. Runtime/PSS tradeoffs remain in the prior six-run measured profile comment. This is the size step, not completion of staging acceptance.

Completed production size ratchet bc953e4a7 (pushed). Four real production builds with rustls 0.23.46 and owned image-I/O: x86 stable 21,100,176 B, edge 21,100,240 B; ARM stable/edge 18,726,528 B. Largest x86 is 1,104,064 B below the prior dev ceiling; ARM is 912,216 B below. No growth allowance: exact equality, +1 rejection, -1 requires ratchet, unsupported-target rejection pass for both channels. Production-marker admission has four passing caller-environment cases; shell syntax/fmt/diff checks pass. [Hashes/recipes](https://git.kayg.org/attachments/9e497f6d-e355-4a8f-8430-8f69878d5afe), [builds](https://git.kayg.org/attachments/2feaf859-58c2-4feb-b5cd-a4cb4dd027c0), [stable boundaries](https://git.kayg.org/attachments/5078a230-17e1-48da-8f3e-148bd061b9d4), [edge boundaries](https://git.kayg.org/attachments/a33e3128-6e45-4e5d-8634-b24d522487a4), [recipe admission](https://git.kayg.org/attachments/9bcf6746-e612-4822-beeb-4ba1aa100045). Runtime/PSS tradeoffs remain in the prior six-run measured profile comment. This is the size step, not completion of staging acceptance.
kayg commented 2026-10-15 06:40:37 +00:00
Author
Owner
Copy link

Completed fixture-only reply fence 2553917d8 (pushed). Each attach now waits for a new successfully written control Pong before issuing the next mutation. Deterministic real WebSocket regression fails before and passes after; all four staging-driver unit tests, workspace fmt and staging remote server all-target clippy pass. Red, green, clippy.

Acceptance run 7cee waits under the shared perf lock, using the unchanged public signed image 48b11f93 and current process-mode fixture. Final scripts/verify fast running on head 2553917d8. No production/server image changed by the fixture fence.

Completed fixture-only reply fence 2553917d8 (pushed). Each attach now waits for a new successfully written control Pong before issuing the next mutation. Deterministic real WebSocket regression fails before and passes after; all four staging-driver unit tests, workspace fmt and staging remote server all-target clippy pass. [Red](https://git.kayg.org/attachments/94c52128-4e5f-43a4-8aa1-fdbeb8ae92d0), [green](https://git.kayg.org/attachments/ad9e83fa-c985-4c62-ab04-3804739e8bdc), [clippy](https://git.kayg.org/attachments/9584384b-2a34-45e5-9cf9-67dcdcc904bd). Acceptance run 7cee waits under the shared perf lock, using the unchanged public signed image 48b11f93 and current process-mode fixture. Final scripts/verify fast running on head 2553917d8. No production/server image changed by the fixture fence.
kayg commented 2026-10-15 07:00:47 +00:00
Author
Owner
Copy link

Author security/lifecycle review at 2553917d8, following PROCESS §2 and the CA update audit checklist (independent review still required): structured MERGE admission binds immutable source/gate/bundle; no free-text verdict parsing. Existing SSHSIG/OpenSSL/HTTP paths reused; production ELF excludes the per-run staging authority. Same-file verified images, sealed exec admission and exact signed version checks cover server and managed hosts. Manual mutations retain and recheck fresh owner/session authority at commit and final admission. Quiet work has an atomic foreground fence; disable aborts/joins owned work. Host transfers share an eight-permit pool; disabled metadata/help do not install machine handlers. No production access, Worker deployment, credential lookup, new crypto engine or owner fixture modification.

D168 cold-start lock semantics remain explicit: healthy warm updates must retain the unlocked CA; a deliberately fatal post-exec process restart recovers the previous verified image with a cold/locked CA, never a timer unlock. Parser fuzz (100,000 cases) and real protocol/exec/SQLite/passkey tests are attached in earlier steps.

Open review findings remain visible: (1) the original unpaced attachment burst expired browser liveness at 22 streams; the update qualification driver now fences attaches on written control Pongs and will not claim burst capacity; (2) server version-image retention has no garbage collector, although history is bounded and host slots are A/B. No retention policy was invented inside this job. Full fast gate and VM acceptance are still running/pending; this comment is not a completion claim.

Author security/lifecycle review at 2553917d8, following PROCESS §2 and the CA update audit checklist (independent review still required): structured MERGE admission binds immutable source/gate/bundle; no free-text verdict parsing. Existing SSHSIG/OpenSSL/HTTP paths reused; production ELF excludes the per-run staging authority. Same-file verified images, sealed exec admission and exact signed version checks cover server and managed hosts. Manual mutations retain and recheck fresh owner/session authority at commit and final admission. Quiet work has an atomic foreground fence; disable aborts/joins owned work. Host transfers share an eight-permit pool; disabled metadata/help do not install machine handlers. No production access, Worker deployment, credential lookup, new crypto engine or owner fixture modification. D168 cold-start lock semantics remain explicit: healthy warm updates must retain the unlocked CA; a deliberately fatal post-exec process restart recovers the previous verified image with a cold/locked CA, never a timer unlock. Parser fuzz (100,000 cases) and real protocol/exec/SQLite/passkey tests are attached in earlier steps. Open review findings remain visible: (1) the original unpaced attachment burst expired browser liveness at 22 streams; the update qualification driver now fences attaches on written control Pongs and will not claim burst capacity; (2) server version-image retention has no garbage collector, although history is bounded and host slots are A/B. No retention policy was invented inside this job. Full fast gate and VM acceptance are still running/pending; this comment is not a completion claim.
kayg commented 2026-10-15 07:04:05 +00:00
Author
Owner
Copy link

Full scripts/verify fast completed with exit 0 on pushed head 2553917d89. Complete output, verbatim. Summary output verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Final TypeScript suite output verbatim:


 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [3.09s]

Static production outputs: x86 21,100,176 B and ARM 18,726,528 B, both exact caps, PT_INTERP absent, production trust PASS, key-heap checks PASS. SHA-256 exactly matches both previously attached stable artifacts. No load waiver or baseline failure exemption used. Final acceptance run 7cee remains queued under the perf lock; not reporting task completion yet.

Full scripts/verify fast completed with exit 0 on pushed head 2553917d89c1ebafde2dc3bccb5c0ceb575d33fe. [Complete output, verbatim](https://git.kayg.org/attachments/2e7d94a0-fefa-489c-8106-4882700fe7a9). Summary output verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Final TypeScript suite output verbatim: ```text 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [3.09s] ``` Static production outputs: x86 21,100,176 B and ARM 18,726,528 B, both exact caps, PT_INTERP absent, production trust PASS, key-heap checks PASS. SHA-256 exactly matches both previously attached stable artifacts. No load waiver or baseline failure exemption used. Final acceptance run 7cee remains queued under the perf lock; not reporting task completion yet.
kayg commented 2026-10-15 07:10:12 +00:00
Author
Owner
Copy link

Acceptance 7cee remains queued. Read-only perf-VM lock metadata shows one WRITE holder and five WRITE* waiters on /run/lock/perf-bench.lock (the canonical /var/lock path); holder PID 2548483 has an active timeout child. No other job was interrupted or inspected beyond lock/PID/state/working-directory metadata. Our lock wait remains -w 3600. Final fast on 2553917d8 is green and attached; VM acceptance remains required.

Acceptance 7cee remains queued. Read-only perf-VM lock metadata shows one WRITE holder and five WRITE* waiters on /run/lock/perf-bench.lock (the canonical /var/lock path); holder PID 2548483 has an active timeout child. No other job was interrupted or inspected beyond lock/PID/state/working-directory metadata. Our lock wait remains -w 3600. Final fast on 2553917d8 is green and attached; VM acceptance remains required.
kayg commented 2026-10-15 07:19:25 +00:00
Author
Owner
Copy link

Perf run 7cee acquired the lock at load 0.30/0.98/1.82. Real passkey unlock, 128 PTYs and managed A reattach passed; browser 1 liveness expired at 20 attachments despite the control-reply fence, before publishing any update. This disproves the fixture fence as a sufficient explanation. Receipt; owned manager/runtime/directory teardown passed.

Code finding: websocket.rs tick fanout awaits AttachmentHandle::send_frame for every route. The per-route input queue has four slots; a full route can suspend browser control progress, including receiving browser Pongs. Adding a failing bounded-queue regression before changing probes to opportunistic enqueue: a saturated route may skip a Ping, never displace ordered input/credit or extend liveness without a real Pong. Existing expiry/rebind deadlines remain unchanged. This is a candidate cause to verify on the VM, not an acceptance claim. Full gate at 2553917d8 remains recorded; any new head will rerun its required gates.

Perf run 7cee acquired the lock at load 0.30/0.98/1.82. Real passkey unlock, 128 PTYs and managed A reattach passed; browser 1 liveness expired at 20 attachments despite the control-reply fence, before publishing any update. This disproves the fixture fence as a sufficient explanation. [Receipt](https://git.kayg.org/attachments/0f44cee3-bd2d-4c33-867f-ea20cfd9caf9); owned manager/runtime/directory teardown passed. Code finding: websocket.rs tick fanout awaits AttachmentHandle::send_frame for every route. The per-route input queue has four slots; a full route can suspend browser control progress, including receiving browser Pongs. Adding a failing bounded-queue regression before changing probes to opportunistic enqueue: a saturated route may skip a Ping, never displace ordered input/credit or extend liveness without a real Pong. Existing expiry/rebind deadlines remain unchanged. This is a candidate cause to verify on the VM, not an acceptance claim. Full gate at 2553917d8 remains recorded; any new head will rerun its required gates.
kayg commented 2026-10-15 07:24:39 +00:00
Author
Owner
Copy link

Completed 9341764f3 (pushed): opportunistic enqueue for route Ping probes only. Saturated queues retain ordered credit/input and do not block the browser fanout; no lease is renewed without a real Pong. Closed queues still fail. Failing bounded-queue regression, 31 actor regressions pass, all-target remote clippy. Workspace fmt/diff checks pass. Fresh signed staging image building; no claim yet that this resolves the at-scale expiry. Production artifacts and final full gate will be rebuilt for this new head.

Completed 9341764f3 (pushed): opportunistic enqueue for route Ping probes only. Saturated queues retain ordered credit/input and do not block the browser fanout; no lease is renewed without a real Pong. Closed queues still fail. [Failing bounded-queue regression](https://git.kayg.org/attachments/92db7266-e0c1-4187-9025-1801f2c00332), [31 actor regressions pass](https://git.kayg.org/attachments/08773d8a-a387-4b62-85ad-910b0026360b), [all-target remote clippy](https://git.kayg.org/attachments/e6fb67a7-a7e0-4df5-b774-fc1923d3a62d). Workspace fmt/diff checks pass. Fresh signed staging image building; no claim yet that this resolves the at-scale expiry. Production artifacts and final full gate will be rebuilt for this new head.
kayg commented 2026-10-15 07:31:46 +00:00
Author
Owner
Copy link

Completed 052509dab (pushed), fixture only: explicitly enable TCP_NODELAY before the staging pump splits its local WebSocket. Verified installed tokio-tungstenite 0.29.0 src/connect.rs:37 calls connect_async_with_config(..., false); lines 93–94 set TCP_NODELAY only when requested. This is a second concrete fixture issue, not proof that it alone caused the earlier expiry. Existing VM acceptance is the failing test before this change. Four pump tests pass, remote all-target clippy, workspace fmt/diff checks pass.

Fresh image/public fixture aa300625 contains the production route-probe fix; harness contains process-mode teardown, reply fencing and TCP_NODELAY. Run 5c01 is prepared and queued under -w 3600. Production recipes are rebuilding separately with new postprobe receipt names, preserving earlier artifacts. Any passing combined run will qualify the workflow, not attribute the old failure exclusively to either change.

Completed 052509dab (pushed), fixture only: explicitly enable TCP_NODELAY before the staging pump splits its local WebSocket. Verified installed tokio-tungstenite 0.29.0 src/connect.rs:37 calls connect_async_with_config(..., false); lines 93–94 set TCP_NODELAY only when requested. This is a second concrete fixture issue, not proof that it alone caused the earlier expiry. Existing VM acceptance is the failing test before this change. [Four pump tests pass](https://git.kayg.org/attachments/b42ef8be-6a44-4a18-a413-516e7dbae774), [remote all-target clippy](https://git.kayg.org/attachments/67d1bb0a-e600-42d1-b78c-bc5aedfdac96), workspace fmt/diff checks pass. Fresh image/public fixture aa300625 contains the production route-probe fix; harness contains process-mode teardown, reply fencing and TCP_NODELAY. Run 5c01 is prepared and queued under -w 3600. Production recipes are rebuilding separately with new postprobe receipt names, preserving earlier artifacts. Any passing combined run will qualify the workflow, not attribute the old failure exclusively to either change.
kayg commented 2026-10-15 07:39:27 +00:00
Author
Owner
Copy link

Post-probe production measurement: edge x86 21,100,368 B, production trust PASS, SHA-256 11a6ba477c31d5386750760d4aee06c88e07e472d15d24a9b441ecb812a65bde. The independently reproduced route-queue fix adds 128 B over the earlier unmerged candidate, still 1,103,936 B below dev’s original 22,204,304-B cap. Other three recipes are rebuilding.

Ordering repair for the final unmerged lane: move the size-ratchet commit after the late production fix and fixture commits, then record the final measured stable/edge floors there. This preserves a single downward ratchet from dev and rejects all subsequent growth; no allowance or owner exception is introduced. Preserve the old chain and post an old/new SHA map, assert the final tree differs only by the newly measured cap/table values, and force-push with an exact lease. Final fast will run on that final head. This is the already-authorized commit-ordering repair, not a production publication.

Post-probe production measurement: edge x86 21,100,368 B, production trust PASS, SHA-256 11a6ba477c31d5386750760d4aee06c88e07e472d15d24a9b441ecb812a65bde. The independently reproduced route-queue fix adds 128 B over the earlier unmerged candidate, still 1,103,936 B below dev’s original 22,204,304-B cap. Other three recipes are rebuilding. Ordering repair for the final unmerged lane: move the size-ratchet commit after the late production fix and fixture commits, then record the final measured stable/edge floors there. This preserves a single downward ratchet from dev and rejects all subsequent growth; no allowance or owner exception is introduced. Preserve the old chain and post an old/new SHA map, assert the final tree differs only by the newly measured cap/table values, and force-push with an exact lease. Final fast will run on that final head. This is the already-authorized commit-ordering repair, not a production publication.
kayg commented 2026-10-15 07:49:35 +00:00
Author
Owner
Copy link

Run 5c01 failed before updates: with the route-probe fix, reply fence and TCP_NODELAY, browser 1 still expired at 21 streams. Receipt. Real passkey unlock, 128 PTYs and managed A reattach passed; owned teardown passed. The combination is not a sufficient fix for the concentrated-socket case.

Completed ab9b88bc1 (pushed), fixture distribution only: retain all 128 simultaneous routes across thirteen browser sockets (ten each, final eight), below the sixteen-socket account bound with room for managed-host checks. Same 50 users, 10,000 inventory rows, verified images and liveness deadlines. This distinguishes the updater workload from concentrated-socket admission; the 25-stream failure remains an unresolved review finding, never a capacity pass. Four tests, clippy, fmt/diff checks pass. Fresh run uses unchanged signed image aa300625 and rebuilt harness.

Run 5c01 failed before updates: with the route-probe fix, reply fence and TCP_NODELAY, browser 1 still expired at 21 streams. [Receipt](https://git.kayg.org/attachments/15b6c1c0-6573-4185-9aad-92746563d73a). Real passkey unlock, 128 PTYs and managed A reattach passed; owned teardown passed. The combination is not a sufficient fix for the concentrated-socket case. Completed ab9b88bc1 (pushed), fixture distribution only: retain all 128 simultaneous routes across thirteen browser sockets (ten each, final eight), below the sixteen-socket account bound with room for managed-host checks. Same 50 users, 10,000 inventory rows, verified images and liveness deadlines. This distinguishes the updater workload from concentrated-socket admission; the 25-stream failure remains an unresolved review finding, never a capacity pass. [Four tests](https://git.kayg.org/attachments/3acb408e-2adc-4fd3-b87f-106cd9c4a18a), [clippy](https://git.kayg.org/attachments/feb9e969-8f72-46be-b4ec-8bc6e75966d5), fmt/diff checks pass. Fresh run uses unchanged signed image aa300625 and rebuilt harness.
kayg commented 2026-10-15 07:57:00 +00:00
Author
Owner
Copy link

Completed final ordering repair: ab9b88bc1 → 257d9b0085, force-pushed with an exact lease. Only the final unmerged tail was reordered: route fix → probe fence → TCP_NODELAY → distributed fixture → final size ratchet. Earlier history remains unchanged. A preserved backup ref and old/new map retain the old chain. Preview tree equality passed; the final source differs from ab9 only by the measured cap/table numbers.

Final production recipes: x86 stable 21,100,304 B / edge 21,100,368 B; ARM stable/edge 18,726,656 B. Largest x86 is 1,103,936 B below dev’s old ceiling; ARM 912,088 B below. No slack or growth allowance introduced. Hashes/recipes, four trust-checked builds. Stable boundaries, edge boundaries, production recipe admission all pass; fmt, shell syntax and diff checks pass.

Full scripts/verify fast running on 257d9b008. Distributed VM acceptance 413c remains queued using unchanged signed fixture aa300625. Not reporting completion until those results are recorded.

Completed final ordering repair: ab9b88bc1 → 257d9b008510121fb2b6d5aa1fdc89793af584cd, force-pushed with an exact lease. Only the final unmerged tail was reordered: route fix → probe fence → TCP_NODELAY → distributed fixture → final size ratchet. Earlier history remains unchanged. A preserved backup ref and [old/new map](https://git.kayg.org/attachments/7a794bd7-8e53-4388-a23c-4ac553943eb7) retain the old chain. Preview tree equality passed; the final source differs from ab9 only by the measured cap/table numbers. Final production recipes: x86 stable 21,100,304 B / edge 21,100,368 B; ARM stable/edge 18,726,656 B. Largest x86 is 1,103,936 B below dev’s old ceiling; ARM 912,088 B below. No slack or growth allowance introduced. [Hashes/recipes](https://git.kayg.org/attachments/024bf7dd-47c4-47d4-9841-ec9970d8fcff), [four trust-checked builds](https://git.kayg.org/attachments/360d9efc-6a7c-4abe-a78a-0ff71f949c4a). [Stable boundaries](https://git.kayg.org/attachments/7ca500a0-4ed8-427a-aa67-f267b5ebc5da), [edge boundaries](https://git.kayg.org/attachments/70fc0b60-4d7a-437f-a936-354c5af37938), [production recipe admission](https://git.kayg.org/attachments/4234a2dd-d6ba-478c-8163-ba1bf95f2b12) all pass; fmt, shell syntax and diff checks pass. Full scripts/verify fast running on 257d9b008. Distributed VM acceptance 413c remains queued using unchanged signed fixture aa300625. Not reporting completion until those results are recorded.
kayg commented 2026-10-15 08:06:44 +00:00
Author
Owner
Copy link

VM 413c, load 1.28/1.67/2.00: real passkey unlock and managed A reattach passed, and all 128 routes attached across thirteen browsers without browser_liveness_expired. The test then failed at update_staging_tests.rs:446 (quiet_minutes expected 1), before publishing B. Receipt. Owned manager/runtime/directory teardown passed. This demonstrates the distributed attachment setup, not update acceptance or a fix for the separate 25-stream case.

Fixture finding: deploy_staging_tests.rs:114 uses UPDATE plugin_settings before first server boot. shipping_auth_fixture creates/migrates a fresh Auth database but does not insert a release plugin row; the UPDATE affects zero rows, leaving stable/five-minute production defaults. Preparing a real fresh-schema regression and an insert-or-update fixture correction. Production defaults remain unchanged. Current full gate on 257d9b008 is finishing before applying the prepared test patch, to keep that transcript tied to one source tree.

VM 413c, load 1.28/1.67/2.00: real passkey unlock and managed A reattach passed, and all 128 routes attached across thirteen browsers without browser_liveness_expired. The test then failed at update_staging_tests.rs:446 (quiet_minutes expected 1), before publishing B. [Receipt](https://git.kayg.org/attachments/28517af2-c22f-48d7-8c5a-3b9cfd765ebf). Owned manager/runtime/directory teardown passed. This demonstrates the distributed attachment setup, not update acceptance or a fix for the separate 25-stream case. Fixture finding: deploy_staging_tests.rs:114 uses UPDATE plugin_settings before first server boot. shipping_auth_fixture creates/migrates a fresh Auth database but does not insert a release plugin row; the UPDATE affects zero rows, leaving stable/five-minute production defaults. Preparing a real fresh-schema regression and an insert-or-update fixture correction. Production defaults remain unchanged. Current full gate on 257d9b008 is finishing before applying the prepared test patch, to keep that transcript tied to one source tree.
kayg commented 2026-10-15 08:19:27 +00:00
Author
Owner
Copy link

scripts/verify fast completed with exit 0 on pushed head 257d9b0085. Full output, verbatim. Summary output verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Final TypeScript suite output verbatim:


 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [3.46s]

Both production stable binaries exactly match the previously attached postprobe hashes (x86 db3fcc3dafaf2d4e55c7ced3ac7641dd9de23dcac8dc149b8abde230688c6abb; ARM 67fec187b63ddd44c31b02ffa5dcbcb1c6b296a132d00c613c10c59e3ea3ad00). No load waiver used. This is a milestone, not completion: the fresh-schema fixture correction is now being regression-tested; VM update acceptance remains outstanding. The final gate will run on the final head after acceptance.

scripts/verify fast completed with exit 0 on pushed head 257d9b008510121fb2b6d5aa1fdc89793af584cd. [Full output, verbatim](https://git.kayg.org/attachments/73439f80-875d-4e00-b86d-0c700fb1a5c2). Summary output verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Final TypeScript suite output verbatim: ```text 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [3.46s] ``` Both production stable binaries exactly match the previously attached postprobe hashes (x86 db3fcc3dafaf2d4e55c7ced3ac7641dd9de23dcac8dc149b8abde230688c6abb; ARM 67fec187b63ddd44c31b02ffa5dcbcb1c6b296a132d00c613c10c59e3ea3ad00). No load waiver used. This is a milestone, not completion: the fresh-schema fixture correction is now being regression-tested; VM update acceptance remains outstanding. The final gate will run on the final head after acceptance.
kayg commented 2026-10-15 08:45:48 +00:00
Author
Owner
Copy link

Completed/pushed d850828d5: fresh-fixture edge/one-minute settings are upserted before first boot. Fresh-schema red, five fixture tests green, clippy. VM 012b passed all 128 attachments and initial version/quiet assertions, then refused the check action before staging. Receipt; teardown passed.

Finding: latest.rs requires SHA256SUMS.sig, absent from all five old update-feed fixtures; only MANIFEST.sig was supplied. Separately, deployment verification rejected D251’s signed SOURCE field. Completed/pushed ba8c9d37b: accept only that optional fixed name, authenticate/parse its same bounded non-following descriptor and retain it in backups. Real SSHSIG red, 16 deployment tests green, including changed bytes, malformed signed source and symlink refusal.

Completed/pushed 4f2939877: update fixtures now sign both formats over the same sorted fixed public payload list, exactly manifest header plus checksum bytes. Existing deployment-only fixture recipe is preserved. Missing-signature red, three packaging/lifetime tests green, both actual SSHSIG verifications occur after the anonymous key closes. fmt/diff checks pass. Fresh authority/image rebuilding; old closed keys are not reused. No normal Rust production changes, Worker source/deployment or credentials. The externally deployed hardened round-4 signer remains the prerequisite recorded at the start of #211. VM acceptance and final-head full gate remain outstanding.

Completed/pushed d850828d5: fresh-fixture edge/one-minute settings are upserted before first boot. [Fresh-schema red](https://git.kayg.org/attachments/717e3d02-3715-40ae-ac59-f14b0673fa2c), [five fixture tests green](https://git.kayg.org/attachments/c55b4086-431e-49b5-a121-720b699bf3e0), [clippy](https://git.kayg.org/attachments/c0265b4c-5945-4dbc-822a-3c6338d7f117). VM 012b passed all 128 attachments and initial version/quiet assertions, then refused the check action before staging. [Receipt](https://git.kayg.org/attachments/54280237-a1e3-4693-9a9e-4d5af8f6a7d0); teardown passed. Finding: latest.rs requires SHA256SUMS.sig, absent from all five old update-feed fixtures; only MANIFEST.sig was supplied. Separately, deployment verification rejected D251’s signed SOURCE field. Completed/pushed ba8c9d37b: accept only that optional fixed name, authenticate/parse its same bounded non-following descriptor and retain it in backups. [Real SSHSIG red](https://git.kayg.org/attachments/53b97fbe-d810-44ee-8a6e-d3f20ebfe90a), [16 deployment tests green](https://git.kayg.org/attachments/1713c154-e10c-4b30-8f20-ecc282eb92f4), including changed bytes, malformed signed source and symlink refusal. Completed/pushed 4f2939877: update fixtures now sign both formats over the same sorted fixed public payload list, exactly manifest header plus checksum bytes. Existing deployment-only fixture recipe is preserved. [Missing-signature red](https://git.kayg.org/attachments/f94adbcb-3437-4ebb-9f14-0384d0418da0), [three packaging/lifetime tests green](https://git.kayg.org/attachments/56d02fb4-ca14-45c6-aadc-282c24c76a10), both actual SSHSIG verifications occur after the anonymous key closes. fmt/diff checks pass. Fresh authority/image rebuilding; old closed keys are not reused. No normal Rust production changes, Worker source/deployment or credentials. The externally deployed hardened round-4 signer remains the prerequisite recorded at the start of #211. VM acceptance and final-head full gate remain outstanding.
kayg commented 2026-10-15 09:13:32 +00:00
Author
Owner
Copy link

VM 82c2 verified/staged B successfully with complete signed metadata, then failed waiting for typing acknowledgement at update_staging_tests.rs:190; multiple browser_liveness_expired/probe_refused labels followed. Receipt. All 128 routes attached; owned teardown passed. Quiet apply/manual/rollback acceptance is still missing.

Reproduced a concrete storage/probe coupling with a real SQLite/Unix/WebSocket ordering test: retain the only pool lease until three server probes arrive. Existing tick auth queries park that loop and the test fails. Red. Completed/pushed 61529ed1c: pure proof frames no longer query authority storage. Data/mutations retain all checks; revocation and expiry watchers remain. D28 sliding sessions are preserved by one independently runnable owned renewal task at the existing minute-scale write cadence; abort/join on exit, no renewal timer without attachments. No lease is renewed by ordinary traffic and no liveness budget is widened.

35 socket regressions pass, including revoke/pending/input/scale cases, all-target remote clippy, fmt/diff pass. Fresh signed image building. This fixes the reproduced coupling; VM causality and final footprint still require measurement.

VM 82c2 verified/staged B successfully with complete signed metadata, then failed waiting for typing acknowledgement at update_staging_tests.rs:190; multiple browser_liveness_expired/probe_refused labels followed. [Receipt](https://git.kayg.org/attachments/dc5d664b-3330-44d0-82c6-3a5c76c584cb). All 128 routes attached; owned teardown passed. Quiet apply/manual/rollback acceptance is still missing. Reproduced a concrete storage/probe coupling with a real SQLite/Unix/WebSocket ordering test: retain the only pool lease until three server probes arrive. Existing tick auth queries park that loop and the test fails. [Red](https://git.kayg.org/attachments/c32e11e8-5de0-4866-aa8d-10596aef7893). Completed/pushed 61529ed1c: pure proof frames no longer query authority storage. Data/mutations retain all checks; revocation and expiry watchers remain. D28 sliding sessions are preserved by one independently runnable owned renewal task at the existing minute-scale write cadence; abort/join on exit, no renewal timer without attachments. No lease is renewed by ordinary traffic and no liveness budget is widened. [35 socket regressions pass](https://git.kayg.org/attachments/14120543-40e3-472a-b5e1-cfbfbcbd69cb), including revoke/pending/input/scale cases, [all-target remote clippy](https://git.kayg.org/attachments/d408797c-5164-4969-8b3b-f86d3bb92ff0), fmt/diff pass. Fresh signed image building. This fixes the reproduced coupling; VM causality and final footprint still require measurement.
kayg commented 2026-10-15 09:17:04 +00:00
Author
Owner
Copy link

Fresh signed fixture 6d286815 prepared from 61529ed1c, including storage-independent probes plus owned minute-scale session renewal. Perf run 95eb queued under -w 3600. Same 128 live routes / thirteen sockets, 50 users, 10,000 inventory rows and one real managed UID1000 host; complete legacy/canonical metadata and explicit edge/one-minute settings. No liveness deadline change. The candidate CLI status comparator remains the explicitly printed retained db3fcc3d artifact; actual server acceptance uses the new 6d286815 image. VM qualification and final four-recipe footprint/head gate still pending.

Fresh signed fixture 6d286815 prepared from 61529ed1c, including storage-independent probes plus owned minute-scale session renewal. Perf run 95eb queued under -w 3600. Same 128 live routes / thirteen sockets, 50 users, 10,000 inventory rows and one real managed UID1000 host; complete legacy/canonical metadata and explicit edge/one-minute settings. No liveness deadline change. The candidate CLI status comparator remains the explicitly printed retained db3fcc3d artifact; actual server acceptance uses the new 6d286815 image. VM qualification and final four-recipe footprint/head gate still pending.
kayg commented 2026-10-15 09:36:54 +00:00
Author
Owner
Copy link

VM 95eb progressed: B verified/staged; typing offsets 27/54/81 were acknowledged and current A remained through the configured one-minute ready window. It then timed out at offset 108 with highest ACK 81. No browser_liveness_expired labels occurred in this run. Receipt; all owned teardown passed. Quiet application/manual/rollback acceptance is not yet complete.

Fixture finding: Pump returns no credit for consumed Output/Snapshot frames after its initial 65,536-byte grant. A real WebSocket regression requiring exact same-stream credit for a 4,096-byte output and a 70,000-byte snapshot fails before the correction. Red. Adding normal consumed-byte replenishment; deadline/input assertions remain unchanged. Reusing signed server image 6d286815, rebuilding harness only.

VM 95eb progressed: B verified/staged; typing offsets 27/54/81 were acknowledged and current A remained through the configured one-minute ready window. It then timed out at offset 108 with highest ACK 81. No browser_liveness_expired labels occurred in this run. [Receipt](https://git.kayg.org/attachments/ad615faa-be7a-49b9-a3da-e768dbfd65d2); all owned teardown passed. Quiet application/manual/rollback acceptance is not yet complete. Fixture finding: Pump returns no credit for consumed Output/Snapshot frames after its initial 65,536-byte grant. A real WebSocket regression requiring exact same-stream credit for a 4,096-byte output and a 70,000-byte snapshot fails before the correction. [Red](https://git.kayg.org/attachments/a151da24-4b7e-44f0-92fa-6f990963cb10). Adding normal consumed-byte replenishment; deadline/input assertions remain unchanged. Reusing signed server image 6d286815, rebuilding harness only.
kayg commented 2026-10-15 10:10:38 +00:00
Author
Owner
Copy link

Continuation: ddb028fe3 is pushed. Staging diagnostics are restricted to the test-trust feature and record counts/durations only. The default 128-attached-route run still fails: runtime reports four workers/four CPUs; an attach took 86,422 us and browser lease age reached 86,690 us against its 50,000 us budget. The prior run recorded simultaneous 109–156 ms probe gaps across sockets. Output credit was not exhausted (380 bytes per 10-route browser). No update acceptance claim. Both runs cleaned their owned VM manager/bind/directory.

Receipts: four-worker run, simultaneous probe gaps.

1f068654 adds an explicit one-attached-route functional mode while preserving all 128 live PTYs and keeping 128 routes as default. Counts are printed in receipts. Six fixture tests, three artifact tests, fmt and server clippy pass. Running that separate sequence now; it will not qualify the unresolved full-route workload.

Continuation: ddb028fe3 is pushed. Staging diagnostics are restricted to the test-trust feature and record counts/durations only. The default 128-attached-route run still fails: runtime reports four workers/four CPUs; an attach took 86,422 us and browser lease age reached 86,690 us against its 50,000 us budget. The prior run recorded simultaneous 109–156 ms probe gaps across sockets. Output credit was not exhausted (380 bytes per 10-route browser). No update acceptance claim. Both runs cleaned their owned VM manager/bind/directory. Receipts: [four-worker run](https://git.kayg.org/attachments/372bc545-4e63-423e-bbe8-48326299aaf3), [simultaneous probe gaps](https://git.kayg.org/attachments/c9aad4f9-5c87-4cee-b20f-3c6af7f233a8). 1f068654 adds an explicit one-attached-route functional mode while preserving all 128 live PTYs and keeping 128 routes as default. Counts are printed in receipts. Six fixture tests, three artifact tests, fmt and server clippy pass. Running that separate sequence now; it will not qualify the unresolved full-route workload.
kayg commented 2026-10-15 10:21:15 +00:00
Author
Owner
Copy link

VM acceptance remains failing, including the explicit one-route mode. Run 1 closed during PTY setup; run 2 refused terminal.open 112 with the fixed public Unavailable enum; run 3 created all 128 PTYs and the real managed host, staged B, then timed out waiting for input offset 27 (seen 0). That third run has no recorded liveness-expiry close, so the concentrated-route pause alone does not explain it. All owned manager/bind/directories cleaned.

Receipts: setup close, open refusal, staged then input timeout.

ea94fdc2 adds a durable-input assertion BEFORE publication/staging, preserving the same writer offset afterward. This will distinguish pre-existing input failure from an updater transition defect. Six fixture tests, fmt and touched-server clippy pass. No deadline relaxation or acceptance waiver.

Previous fixture-mode gates: six tests, three packaging tests, clippy.

VM acceptance remains failing, including the explicit one-route mode. Run 1 closed during PTY setup; run 2 refused terminal.open 112 with the fixed public Unavailable enum; run 3 created all 128 PTYs and the real managed host, staged B, then timed out waiting for input offset 27 (seen 0). That third run has no recorded liveness-expiry close, so the concentrated-route pause alone does not explain it. All owned manager/bind/directories cleaned. Receipts: [setup close](https://git.kayg.org/attachments/11b37fc0-717d-4268-a8b4-b950155a46f1), [open refusal](https://git.kayg.org/attachments/ea8f70e7-c7c4-45a3-bf46-79c9d9943f2c), [staged then input timeout](https://git.kayg.org/attachments/bfbb11e4-3acf-41cf-9785-1edbc2f0e1b9). ea94fdc2 adds a durable-input assertion BEFORE publication/staging, preserving the same writer offset afterward. This will distinguish pre-existing input failure from an updater transition defect. Six fixture tests, fmt and touched-server clippy pass. No deadline relaxation or acceptance waiver. Previous fixture-mode gates: [six tests](https://git.kayg.org/attachments/b0520efb-306e-4c4b-acda-0d14f40a491c), [three packaging tests](https://git.kayg.org/attachments/25a1604e-f598-491a-a49d-85294d75c4c8), [clippy](https://git.kayg.org/attachments/6c533bfd-7df1-4a94-a691-b4ec50dc793b).
kayg commented 2026-10-15 10:35:15 +00:00
Author
Owner
Copy link

Partial VM acceptance, NOT a full pass: the third bounded repeat completed A→B through the one-minute quiet window after continued acknowledged input. ready_to_apply_ms=123040.914, typing_observed_until_ms=60909.224, last_input_to_apply_ms=62131.691. Workload: 50 users, 10,000 inventory rows, 128 real PTYs, ONE attached server route plus the managed-host route. The host executed B with the same daemon PID/shim PID and reattached its PTY; all 128 server shim PIDs survived and CA status remained unlocked. It then returned the server to A but failed the fixture host-A check after 30 seconds. No Update now / failed-image / final listener-gap claim yet.

Full partial-run receipt. Other preserved attempts: host-B check timeout, single-route liveness expiry. A read-only snapshot during transfer showed server B/applied while host A was verified, enabled and active_work=true: snapshot. Next fixture records durable received bytes and elapsed transfer time; its functional wait is bounded at 90 seconds. Production post-exec watchdog remains 30 seconds.

All four final production recipes pass trust inspection: x86 stable 21,111,920 B, edge 21,116,080 B; ARM both 18,738,416 B. Largest x86 is 1,088,224 B BELOW the original dev cap; ARM is 900,328 B below it. Hashes and identities. Moving the unmerged final ratchet after late correctness fixes; exact tree equality is asserted and an exact remote lease is used.

Iteration gate: 433 server tests passed, two socket lifecycle rows failed under parallel execution (one Elapsed, one action refusal). All other iterate rows passed. The five lifecycle tests pass serially. No baseline waiver or final-gate claim: iterate transcript, serial diagnostic. Final fast will run serially on the final head.

Partial VM acceptance, NOT a full pass: the third bounded repeat completed A→B through the one-minute quiet window after continued acknowledged input. ready_to_apply_ms=123040.914, typing_observed_until_ms=60909.224, last_input_to_apply_ms=62131.691. Workload: 50 users, 10,000 inventory rows, 128 real PTYs, ONE attached server route plus the managed-host route. The host executed B with the same daemon PID/shim PID and reattached its PTY; all 128 server shim PIDs survived and CA status remained unlocked. It then returned the server to A but failed the fixture host-A check after 30 seconds. No Update now / failed-image / final listener-gap claim yet. [Full partial-run receipt](https://git.kayg.org/attachments/13612b5b-ff3b-4533-9829-7a0de828adbe). Other preserved attempts: [host-B check timeout](https://git.kayg.org/attachments/0e520c87-1011-4bd3-95bb-06479acf1d5c), [single-route liveness expiry](https://git.kayg.org/attachments/45fc0a7a-77c0-4966-bf38-dc6512709b91). A read-only snapshot during transfer showed server B/applied while host A was verified, enabled and active_work=true: [snapshot](https://git.kayg.org/attachments/53156376-7fd7-42fe-87e6-a260c1ff405f). Next fixture records durable received bytes and elapsed transfer time; its functional wait is bounded at 90 seconds. Production post-exec watchdog remains 30 seconds. All four final production recipes pass trust inspection: x86 stable 21,111,920 B, edge 21,116,080 B; ARM both 18,738,416 B. Largest x86 is 1,088,224 B BELOW the original dev cap; ARM is 900,328 B below it. [Hashes and identities](https://git.kayg.org/attachments/f16d0fe0-1cf5-4a33-8254-115839420277). Moving the unmerged final ratchet after late correctness fixes; exact tree equality is asserted and an exact remote lease is used. Iteration gate: 433 server tests passed, two socket lifecycle rows failed under parallel execution (one Elapsed, one action refusal). All other iterate rows passed. The five lifecycle tests pass serially. No baseline waiver or final-gate claim: [iterate transcript](https://git.kayg.org/attachments/fe7d51e0-decd-40c6-a9ec-3c1be7e6b64f), [serial diagnostic](https://git.kayg.org/attachments/53e978f9-e11e-46fa-992a-ff30ccce545c). Final fast will run serially on the final head.
kayg commented 2026-10-15 10:42:51 +00:00
Author
Owner
Copy link

Author review on f68060253: publish admission consumes a private structured MERGE/gate/bundle-digest record, not prose. Signer access remains external; no Worker deploy, keys or credentials. Warm handoff verifies the same pinned image and retains CA custody; cold failure recovery remains locked under D168. Activity fences cover input and open/attach handshakes. Host updates use bounded machine frames, eight shared senders, independent file offsets, A/B images, exact running-image check-in and a separate supervisor. Component-off joins/removes owned work; metadata discovery stays inert. Parser fuzz and signature/path/admission regressions are recorded earlier on this issue. No new foundational engine.

Limits still requiring review: default 128-attached-route VM case fails its 50 ms route lease; no capacity-pass claim. Server image retention has no GC policy (history is bounded to 100, host slots to two); no disk bound is claimed for server images. Deployed hardened signer remains an external prerequisite. Legacy hosts need one capable verified installation.

Latest VM run passed quiet apply (61,950.723 ms from last accepted input), managed B follow (16,342.273 ms), manual rollback including host A (19,194.627 ms), Update now including host B (18,399.183 ms), and late kernel exec refusal restoring B with warm custody. Workload: 50 users / 10,000 inventory rows / 128 real PTYs / one active server route plus the managed-host route. It then timed out in the host D failed-start/watchdog assertion. Thus this is NOT full acceptance and has no final listener-gap, host-D rollback or fatal-E recovery measurement yet. A read-only public-state diagnostic is running alongside the next isolated attempt.

History repair is pushed: final measured cap follows correctness fixes; final tree equality asserted. Map, stable boundaries, edge boundaries. Current fixture: six tests, clippy. Final serial scripts/verify fast is in progress, not yet claimed.

Latest VM receipt, including failure.

Author review on f68060253: publish admission consumes a private structured MERGE/gate/bundle-digest record, not prose. Signer access remains external; no Worker deploy, keys or credentials. Warm handoff verifies the same pinned image and retains CA custody; cold failure recovery remains locked under D168. Activity fences cover input and open/attach handshakes. Host updates use bounded machine frames, eight shared senders, independent file offsets, A/B images, exact running-image check-in and a separate supervisor. Component-off joins/removes owned work; metadata discovery stays inert. Parser fuzz and signature/path/admission regressions are recorded earlier on this issue. No new foundational engine. Limits still requiring review: default 128-attached-route VM case fails its 50 ms route lease; no capacity-pass claim. Server image retention has no GC policy (history is bounded to 100, host slots to two); no disk bound is claimed for server images. Deployed hardened signer remains an external prerequisite. Legacy hosts need one capable verified installation. Latest VM run passed quiet apply (61,950.723 ms from last accepted input), managed B follow (16,342.273 ms), manual rollback including host A (19,194.627 ms), Update now including host B (18,399.183 ms), and late kernel exec refusal restoring B with warm custody. Workload: 50 users / 10,000 inventory rows / 128 real PTYs / one active server route plus the managed-host route. It then timed out in the host D failed-start/watchdog assertion. Thus this is NOT full acceptance and has no final listener-gap, host-D rollback or fatal-E recovery measurement yet. A read-only public-state diagnostic is running alongside the next isolated attempt. History repair is pushed: final measured cap follows correctness fixes; final tree equality asserted. [Map](https://git.kayg.org/attachments/21e7798e-b6c7-4fbb-a83c-d0b95d22c562), [stable boundaries](https://git.kayg.org/attachments/84014330-0718-45b5-b40a-0da4094c9714), [edge boundaries](https://git.kayg.org/attachments/fd24fca5-ba2d-4151-bb85-b05cee6c4a71). Current fixture: [six tests](https://git.kayg.org/attachments/5ba0da22-7c0b-46e0-b0b8-694e7a189007), [clippy](https://git.kayg.org/attachments/86abc2d8-6e76-441b-8e3a-8b6bad5cc290). Final serial scripts/verify fast is in progress, not yet claimed. [Latest VM receipt, including failure](https://git.kayg.org/attachments/c711e128-6b34-461c-be1a-3fa9dc951226).
kayg commented 2026-10-15 10:47:17 +00:00
Author
Owner
Copy link

New lockstep finding: the read-only VM probe shows a verified/enabled host remains A, receiving_bytes=0 and pending=false for >40 seconds after the server Update now transition to B. No image transfer is progressing. Sender::connected discards every follow error and waits only for channel.changes; a transient machine exchange failure can therefore strand an otherwise live connection indefinitely. Plan: internal transient/refusal distinction; bounded exponential backoff only after transient failures, eight existing shared admissions, no timer after successful convergence/refusal, cancellation owned by the existing plugin future. No new transport/engine/action contract. Add a failing no-new-event regression before the fix; then repeat VM acceptance and the final head gate.

New lockstep finding: the read-only VM probe shows a verified/enabled host remains A, receiving_bytes=0 and pending=false for >40 seconds after the server Update now transition to B. No image transfer is progressing. Sender::connected discards every follow error and waits only for channel.changes; a transient machine exchange failure can therefore strand an otherwise live connection indefinitely. Plan: internal transient/refusal distinction; bounded exponential backoff only after transient failures, eight existing shared admissions, no timer after successful convergence/refusal, cancellation owned by the existing plugin future. No new transport/engine/action contract. Add a failing no-new-event regression before the fix; then repeat VM acceptance and the final head gate.
kayg commented 2026-10-15 10:54:21 +00:00
Author
Owner
Copy link

Pushed d91588426 (fixture) and 8bd28582f (sender). The public-state probe captured D selected/pending with its independent supervisor active; the supervisor later restored B and wrote update-failed, but the canonical daemon unit was absent/inactive. The collected transient fixture unit had disappeared; the isolated HOME unit file was outside the user manager search path. The fixture now runtime-links its owned real unit into the exclusively created manager, then starts it. No owner-home unit or existing manager is modified. Probe, full diagnostic attempt, six fixture tests.

The same attempt showed a >60 s zero-byte host follow stall before a later node event finally resumed it. Sender regression with no new event failed before the fix. Transport/catalog failures now retry with 1–30 s exponential backoff; the existing eight-worker admission releases before waiting. Successful convergence, invalid ACKs and authenticated image refusal retain no retry timer. Plugin cancellation cancels retry. Red, seven green sender tests, server/release clippy.

Stopped the in-flight old-head fast gate with SIGTERM to its verified job-owned process group before static builds, because this correction changes source and artifact sizes. No final-gate claim. Fresh staging-trust image is rebuilding; normal four-recipe measurements and final head fast gate follow. All failed attempts remain evidence, not acceptance passes.

Pushed d91588426 (fixture) and 8bd28582f (sender). The public-state probe captured D selected/pending with its independent supervisor active; the supervisor later restored B and wrote update-failed, but the canonical daemon unit was absent/inactive. The collected transient fixture unit had disappeared; the isolated HOME unit file was outside the user manager search path. The fixture now runtime-links its owned real unit into the exclusively created manager, then starts it. No owner-home unit or existing manager is modified. [Probe](https://git.kayg.org/attachments/dc2316e2-4896-4443-9755-ac84fe7a664e), [full diagnostic attempt](https://git.kayg.org/attachments/b8b0fd9d-8d59-4e0e-b1c8-9f81f385cdb2), [six fixture tests](https://git.kayg.org/attachments/8a81e8e2-4584-4a09-b272-554d3f5c4496). The same attempt showed a >60 s zero-byte host follow stall before a later node event finally resumed it. Sender regression with no new event failed before the fix. Transport/catalog failures now retry with 1–30 s exponential backoff; the existing eight-worker admission releases before waiting. Successful convergence, invalid ACKs and authenticated image refusal retain no retry timer. Plugin cancellation cancels retry. [Red](https://git.kayg.org/attachments/0229a8ba-20b7-40d5-964f-80ebd497e498), [seven green sender tests](https://git.kayg.org/attachments/92c78143-3a1a-4fe8-9cbd-07a0db576bcf), [server/release clippy](https://git.kayg.org/attachments/ac038f74-6f88-42a8-ae45-dd82910bb5b2). Stopped the in-flight old-head fast gate with SIGTERM to its verified job-owned process group before static builds, because this correction changes source and artifact sizes. No final-gate claim. Fresh staging-trust image is rebuilding; normal four-recipe measurements and final head fast gate follow. All failed attempts remain evidence, not acceptance passes.
kayg commented 2026-10-15 11:06:26 +00:00
Author
Owner
Copy link

VM functional acceptance PASS on 8bd28582f staging-trust image: 50 users, 10,000 inventory rows, 128 real server PTYs, ONE active server route plus one real managed-host route. Machine infraternal-perf-test, kernel 6.12.111+deb13-amd64; load before 0.48/0.41/0.64, after 1.25/0.86/0.76; exclusive perf lock. All 128 server shim PIDs survived.

Quiet apply: ready→server B 122588.095 ms; continued typing until 60720.601 ms; last input→server B 61867.495 ms (configured quiet=60 s). CA remained unlocked. Healthy host A→B→A→B transitions retained daemon PID and PTY shim PID and reattached real PTY output. Manual rollback including host convergence 15943.028 ms; Update now including host convergence 16376.398 ms with quiet=5 min configured. Late kernel exec refusal automatically restored B with warm CA custody. Host signed-D post-exec startup refusal was observed; its independent watchdog restored B, restarted the daemon, retained the same shim PID and paused D.

Warm listener gap: observed maximum conservative bracket 882.680 ms; maximum probe interval 103.238 ms; 1603 failed TCP listener probes across the warm transitions. Fatal server post-exec E separately recovered the verified previous image in 3719.722 ms; CA correctly cold-locked under D168, all 128 shim PIDs survived. One run, not a percentile distribution. This uses an isolated already-signed fixture feed and atomic edge pointer; it does not publish an unreviewed branch through the external Worker.

Complete raw receipt and cleanup. Ancillary CLI metric in this receipt used the retained normal CLI hash 209fe269… (printed by the driver), not the new final shipping CLI; no fresh-CLI performance claim is made from it. Current shipping images are being measured separately.

The default 128-attached-route test is now rerunning against the rebuilt image with the new normal CLI. Its earlier failures remain unresolved until that result; this one-route functional pass does not waive them. No production or Worker deployment. Final head gate still pending.

VM functional acceptance PASS on 8bd28582f staging-trust image: 50 users, 10,000 inventory rows, 128 real server PTYs, ONE active server route plus one real managed-host route. Machine infraternal-perf-test, kernel 6.12.111+deb13-amd64; load before 0.48/0.41/0.64, after 1.25/0.86/0.76; exclusive perf lock. All 128 server shim PIDs survived. Quiet apply: ready→server B 122588.095 ms; continued typing until 60720.601 ms; last input→server B 61867.495 ms (configured quiet=60 s). CA remained unlocked. Healthy host A→B→A→B transitions retained daemon PID and PTY shim PID and reattached real PTY output. Manual rollback including host convergence 15943.028 ms; Update now including host convergence 16376.398 ms with quiet=5 min configured. Late kernel exec refusal automatically restored B with warm CA custody. Host signed-D post-exec startup refusal was observed; its independent watchdog restored B, restarted the daemon, retained the same shim PID and paused D. Warm listener gap: observed maximum conservative bracket 882.680 ms; maximum probe interval 103.238 ms; 1603 failed TCP listener probes across the warm transitions. Fatal server post-exec E separately recovered the verified previous image in 3719.722 ms; CA correctly cold-locked under D168, all 128 shim PIDs survived. One run, not a percentile distribution. This uses an isolated already-signed fixture feed and atomic edge pointer; it does not publish an unreviewed branch through the external Worker. [Complete raw receipt and cleanup](https://git.kayg.org/attachments/536ed9d5-4bdd-4e34-b4b0-520750fa2e00). Ancillary CLI metric in this receipt used the retained normal CLI hash 209fe269… (printed by the driver), not the new final shipping CLI; no fresh-CLI performance claim is made from it. Current shipping images are being measured separately. The default 128-attached-route test is now rerunning against the rebuilt image with the new normal CLI. Its earlier failures remain unresolved until that result; this one-route functional pass does not waive them. No production or Worker deployment. Final head gate still pending.
kayg commented 2026-10-15 11:10:43 +00:00
Author
Owner
Copy link

Current default full-route result: FAIL on rebuilt 8bd28582f image with runtime-linked managed unit and current normal CLI. All 128 routes attached across 13 sockets, then input offset 2 timed out; control lease expiries were recorded at 52,569–65,195 us against the 50,000 us budget, with output work around 31 ms. This remains an unresolved transport-capacity limitation; no claim that the one-route functional pass qualifies 128 attached routes, and no attribution to baseline without a matched baseline run. Raw receipt and cleanup. No production settings changed. Final shipping gate/size records will follow.

Current default full-route result: FAIL on rebuilt 8bd28582f image with runtime-linked managed unit and current normal CLI. All 128 routes attached across 13 sockets, then input offset 2 timed out; control lease expiries were recorded at 52,569–65,195 us against the 50,000 us budget, with output work around 31 ms. This remains an unresolved transport-capacity limitation; no claim that the one-route functional pass qualifies 128 attached routes, and no attribution to baseline without a matched baseline run. [Raw receipt and cleanup](https://git.kayg.org/attachments/58aa6748-655a-4f7e-a99a-78a2475b8523). No production settings changed. Final shipping gate/size records will follow.
kayg commented 2026-10-15 11:11:44 +00:00
Author
Owner
Copy link

Correction to the preceding full-route comment: I misread the failure location. The raw receipt explicitly has durable_input_before_stage=true; the pre-stage two-byte input WAS acknowledged. The later failure is ack.changed().await returning a closed channel at update_staging_tests.rs:245 after browser transports closed. It is not a reported offset-2 timeout. All 128 routes attached, and the recorded 50 ms lease expiries/output-work durations remain as stated. The complete full-route update acceptance still fails; the one-route full-sequence receipt is the successful functional proof.

Correction to the preceding full-route comment: I misread the failure location. The raw receipt explicitly has durable_input_before_stage=true; the pre-stage two-byte input WAS acknowledged. The later failure is ack.changed().await returning a closed channel at update_staging_tests.rs:245 after browser transports closed. It is not a reported offset-2 timeout. All 128 routes attached, and the recorded 50 ms lease expiries/output-work durations remain as stated. The complete full-route update acceptance still fails; the one-route full-sequence receipt is the successful functional proof.
kayg commented 2026-10-15 11:21:22 +00:00
Author
Owner
Copy link

Pushed final head 6ae065677f. The final measured ratchet now follows the runtime-unit fixture repair and transient host-follow correction; exact final-tree equality and an exact remote lease both passed. New SHAs: fixture 669d0007f, retry 9561d12dc, cap 6ae065677. Ordering map.

Four real production recipes: x86 stable 21,116,016 B, edge 21,116,080 B; ARM both 18,739,104 B. Largest x86 is 1,088,224 B below original dev cap; ARM 899,640 B below. Retry correction changed stable x86 by one 4096-B layout page, edge x86 by 0 B, ARM by 688 B. No new dependency. Full identities/hashes. Exact cap, plus-one refusal, downward-ratchet enforcement and unsupported-target refusal pass for both channels: stable, edge.

Serial iterate PASS, all Rust rows plus TypeScript and 37/0 script tests: full transcript. Final scripts/verify fast is now running on this exact head; no source changes planned. Functional VM acceptance and separate failed full-route stress receipt are linked in the preceding comments. No production/Worker deployment; no issue closure.

Pushed final head 6ae065677fe434d3c47037c49c9e59b43a9a5c47. The final measured ratchet now follows the runtime-unit fixture repair and transient host-follow correction; exact final-tree equality and an exact remote lease both passed. New SHAs: fixture 669d0007f, retry 9561d12dc, cap 6ae065677. [Ordering map](https://git.kayg.org/attachments/e0c7701c-c332-453d-9c55-fe37099509b8). Four real production recipes: x86 stable 21,116,016 B, edge 21,116,080 B; ARM both 18,739,104 B. Largest x86 is 1,088,224 B below original dev cap; ARM 899,640 B below. Retry correction changed stable x86 by one 4096-B layout page, edge x86 by 0 B, ARM by 688 B. No new dependency. [Full identities/hashes](https://git.kayg.org/attachments/edb5ebc6-a1a9-4623-892f-3677fad0e428). Exact cap, plus-one refusal, downward-ratchet enforcement and unsupported-target refusal pass for both channels: [stable](https://git.kayg.org/attachments/408c4ca8-8ba9-477d-949e-3e76e56d7d14), [edge](https://git.kayg.org/attachments/605735a7-4d37-49cc-b0cb-837c3bb6e613). Serial iterate PASS, all Rust rows plus TypeScript and 37/0 script tests: [full transcript](https://git.kayg.org/attachments/d01577c1-0e45-47e9-8fc4-2f7c445137e6). Final scripts/verify fast is now running on this exact head; no source changes planned. Functional VM acceptance and separate failed full-route stress receipt are linked in the preceding comments. No production/Worker deployment; no issue closure.
kayg commented 2026-10-15 11:41:03 +00:00
Author
Owner
Copy link

Final-head fast attempt 1 failed one late transport test: saturated_native_control_queue_does_not_hide_primary_terminal_output, remote_control_queue_tests.rs:216, assert live_connection.close_reason().is_none(). Server suite: 434 passed / 1 failed / 45 ignored. All other Rust rows, including both static shipping builds/linkage/production trust/exact size boundaries, passed. No green final-gate claim. Full failed attempt.

The exact same compiled test binary passes the test directly, and it passed in the complete serial iterate run. Direct rerun. Cause is not attributed to load without a matched baseline. No waiver, skipped test or source change. Full scripts/verify fast is rerunning on unchanged 6ae065677 with RUST_TEST_THREADS=1.

Final-head fast attempt 1 failed one late transport test: saturated_native_control_queue_does_not_hide_primary_terminal_output, remote_control_queue_tests.rs:216, assert live_connection.close_reason().is_none(). Server suite: 434 passed / 1 failed / 45 ignored. All other Rust rows, including both static shipping builds/linkage/production trust/exact size boundaries, passed. No green final-gate claim. [Full failed attempt](https://git.kayg.org/attachments/c33a830d-71b0-4b76-b679-5487dd63c451). The exact same compiled test binary passes the test directly, and it passed in the complete serial iterate run. [Direct rerun](https://git.kayg.org/attachments/99dda794-1e7f-47ab-9f51-98d0a3a958e0). Cause is not attributed to load without a matched baseline. No waiver, skipped test or source change. Full scripts/verify fast is rerunning on unchanged 6ae065677 with RUST_TEST_THREADS=1.
kayg commented 2026-10-15 11:56:19 +00:00
Author
Owner
Copy link

Finish / handoff for independent break-it review. Branch edge-autoupdate, base 57b0c3ddca, pushed head 6ae065677f. Worktree clean; remote matches. Own build/fixture directories removed; evidence retained. Issue stays open. No production/Worker deployment.

Backend publish admission, quiet updater/API/Inbox events and host lockstep are built. VM functional acceptance PASS: 50 users, 10,000 inventory rows, 128 real server PTYs, ONE active server route plus the managed-host route. Typing postpones quiet apply; warm CA custody/PTYs survive; Update now/Roll back work; late exec refusal restores B; signed host startup refusal triggers independent watchdog recovery to B with the same PTY shim and paused D. Fatal server post-exec recovery restores D and correctly cold-locks CA (D168). Full receipt. Warm listener-gap bracket max 882.680 ms, max probe interval 103.238 ms. Last input→apply 61867.495 ms for quiet=60 s. Rollback / Update now INCLUDING host convergence: 15943.028 / 16376.398 ms. One run, not percentiles.

Final production caps: x86 stable/edge 21,116,016 / 21,116,080 B; ARM both 18,739,104 B. Max x86 / ARM are 1,088,224 / 899,640 B below original dev caps. Final-gate stable binaries match measured digests and sizes. Four recipes, ordering map / exact tree equality, cleanup.

Author checklist completed: signature/path/admission, exact running image, activity/handoff ordering, retry quiescence/refusal/cancellation and eight-worker bound reviewed/tested; module role docs present; no new foundational engine. UI remains the separate pass; states/copy are earlier on this issue.

Review limits: default 128-ATTACHED-route acceptance still fails after lease expiry/channel close; the one-route pass does not waive it. Current failure. Server image retention remains unbounded (history=100, host A/B bounded). External hardened signer deployment and production edge selection remain rollout prerequisites; fixture feed is not real Worker publication. ARM runtime key-heap execution is not checked by this x86 gate. Prior intermittent control-queue gate failure is preserved above. No waiver or author MERGE verdict.

Final scripts/verify fast on this exact head: exit 0. Full verbatim transcript. Verbatim output excerpts:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [2.92s]
Finish / handoff for independent break-it review. Branch edge-autoupdate, base 57b0c3ddca8e190f674071e39dcc0aed1ca76cf6, pushed head 6ae065677fe434d3c47037c49c9e59b43a9a5c47. Worktree clean; remote matches. Own build/fixture directories removed; evidence retained. Issue stays open. No production/Worker deployment. Backend publish admission, quiet updater/API/Inbox events and host lockstep are built. VM functional acceptance PASS: 50 users, 10,000 inventory rows, 128 real server PTYs, ONE active server route plus the managed-host route. Typing postpones quiet apply; warm CA custody/PTYs survive; Update now/Roll back work; late exec refusal restores B; signed host startup refusal triggers independent watchdog recovery to B with the same PTY shim and paused D. Fatal server post-exec recovery restores D and correctly cold-locks CA (D168). [Full receipt](https://git.kayg.org/attachments/536ed9d5-4bdd-4e34-b4b0-520750fa2e00). Warm listener-gap bracket max 882.680 ms, max probe interval 103.238 ms. Last input→apply 61867.495 ms for quiet=60 s. Rollback / Update now INCLUDING host convergence: 15943.028 / 16376.398 ms. One run, not percentiles. Final production caps: x86 stable/edge 21,116,016 / 21,116,080 B; ARM both 18,739,104 B. Max x86 / ARM are 1,088,224 / 899,640 B below original dev caps. Final-gate stable binaries match measured digests and sizes. [Four recipes](https://git.kayg.org/attachments/edb5ebc6-a1a9-4623-892f-3677fad0e428), [ordering map / exact tree equality](https://git.kayg.org/attachments/e0c7701c-c332-453d-9c55-fe37099509b8), [cleanup](https://git.kayg.org/attachments/b19800f8-1ae0-4aff-9d32-dba794124fb8). Author checklist completed: signature/path/admission, exact running image, activity/handoff ordering, retry quiescence/refusal/cancellation and eight-worker bound reviewed/tested; module role docs present; no new foundational engine. UI remains the separate pass; states/copy are earlier on this issue. Review limits: default 128-ATTACHED-route acceptance still fails after lease expiry/channel close; the one-route pass does not waive it. [Current failure](https://git.kayg.org/attachments/58aa6748-655a-4f7e-a99a-78a2475b8523). Server image retention remains unbounded (history=100, host A/B bounded). External hardened signer deployment and production edge selection remain rollout prerequisites; fixture feed is not real Worker publication. ARM runtime key-heap execution is not checked by this x86 gate. Prior intermittent control-queue gate failure is preserved above. No waiver or author MERGE verdict. Final scripts/verify fast on this exact head: exit 0. [Full verbatim transcript](https://git.kayg.org/attachments/408cf039-8c80-44f4-bbb6-07c8a6e2ab5a). Verbatim output excerpts: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [2.92s] ```
kayg commented 2026-10-15 11:58:36 +00:00
Author
Owner
Copy link

Independent verification started on review-edge-autoupdate, detached target 6ae065677f; merge base with local dev 8e7467c07c. Read #211 and parent #157 histories and author report. Scope includes 128-route failure, server image retention, binary size attribution and D259/D265 restart gap. Tests/evidence only; no implementation fixes, push or deployment.

Independent verification started on review-edge-autoupdate, detached target 6ae065677fe434d3c47037c49c9e59b43a9a5c47; merge base with local dev 8e7467c07cd2ec1668a775a846076b278f68ef38. Read #211 and parent #157 histories and author report. Scope includes 128-route failure, server image retention, binary size attribution and D259/D265 restart gap. Tests/evidence only; no implementation fixes, push or deployment.
kayg commented 2026-10-15 12:02:01 +00:00
Author
Owner
Copy link

Review support step a41b2634: existing signed staging driver can select route or retention regressions; production code unchanged. Existing staging_artifacts_test.py passes (receipt evidence/driver-tests.log). Full fast gate is queued on an isolated exact target-head checkout; reviewer tests will not contaminate its output. New review regressions and VM reproduction remain pending host build slots.

Review support step a41b2634: existing signed staging driver can select route or retention regressions; production code unchanged. Existing staging_artifacts_test.py passes (receipt evidence/driver-tests.log). Full fast gate is queued on an isolated exact target-head checkout; reviewer tests will not contaminate its output. New review regressions and VM reproduction remain pending host build slots.
kayg commented 2026-10-15 12:08:36 +00:00
Author
Owner
Copy link

Size/source audit checkpoint: default Cargo feature graph still contains release, remote, SSH, host-facts, mesh, relay and backup, plus both existing TLS engines (evidence/default-features.txt; cargo-tree-duplicates.txt). Normalized old server verifier vs new API verifier differs only in checksum visibility; signatures/digest logic is preserved (evidence/verifier-move.diff). Baseline 57b0c3dd already had release strip=true and panic=unwind; final profile retains both. bc5384baa changes only CLI/API/release package opt-level to s and redundant package strip flags. Its matched author artifacts save 1,685,184 B; this is source attribution, not an independent performance remeasurement. Exact-head fast gate remains queued; signed staging build is now compiling.

Size/source audit checkpoint: default Cargo feature graph still contains release, remote, SSH, host-facts, mesh, relay and backup, plus both existing TLS engines (evidence/default-features.txt; cargo-tree-duplicates.txt). Normalized old server verifier vs new API verifier differs only in checksum visibility; signatures/digest logic is preserved (evidence/verifier-move.diff). Baseline 57b0c3dd already had release strip=true and panic=unwind; final profile retains both. bc5384baa changes only CLI/API/release package opt-level to s and redundant package strip flags. Its matched author artifacts save 1,685,184 B; this is source attribution, not an independent performance remeasurement. Exact-head fast gate remains queued; signed staging build is now compiling.
kayg commented 2026-10-15 12:11:16 +00:00
Author
Owner
Copy link

Review harness cc257026 adds a reconnect selector, exact-test existence check, measurement owner receipt and 20-minute test timeout inside the shared flock. Existing staging artifact tests: 3 passed. Signed staging compilation continues; exact-target fast remains queued. No runtime implementation changes or findings claimed yet.

Review harness cc257026 adds a reconnect selector, exact-test existence check, measurement owner receipt and 20-minute test timeout inside the shared flock. Existing staging artifact tests: 3 passed. Signed staging compilation continues; exact-target fast remains queued. No runtime implementation changes or findings claimed yet.
kayg commented 2026-10-15 12:48:02 +00:00
Author
Owner
Copy link

Additional review check: D155 U2/U4 still requires a pre-upgrade backup and automatic restore; D186 only supersedes channel/distribution clauses, D217 changes CA custody, and D251 does not waive backups. Runtime Updater.apply currently commits applying intent then calls engine.handoff; Engine and cold startup planner retain/select executable images only. Added review_update_refuses_handoff_without_pre_upgrade_backup (pending reproduction) and a real-SQLite diagnostic proving an earlier migration list refuses a successor core migration. Separate script deployment has backups; this is verification of the new automatic path.

Additional review check: D155 U2/U4 still requires a pre-upgrade backup and automatic restore; D186 only supersedes channel/distribution clauses, D217 changes CA custody, and D251 does not waive backups. Runtime Updater.apply currently commits applying intent then calls engine.handoff; Engine and cold startup planner retain/select executable images only. Added review_update_refuses_handoff_without_pre_upgrade_backup (pending reproduction) and a real-SQLite diagnostic proving an earlier migration list refuses a successor core migration. Separate script deployment has backups; this is verification of the new automatic path.
kayg commented 2026-10-15 12:49:27 +00:00
Author
Owner
Copy link

EA-01 P1 confirmed; failing test committed locally in 884f92e4 on review-edge-autoupdate. Locked perf VM, load 0.07/0.02/0.19: 128 real PTYs created, 52 attachment entries across thirteen planned browser sockets before the control-probe fence fails (update_staging_tests.rs:312). This is BEFORE publication and BEFORE the listener monitor starts; omitting its probe workload does not resolve the continuity failure. Output work 94,466 us; browser lease expires at age 99,782 us / budget 50,000 us. Test review_128_attached_routes_preserve_input_during_staging: 0 passed / 1 failed. Own unit/run teardown confirmed.

Cause visible in websocket.rs:482/:831 and liveness.rs:46: awaited output/authority work shares the browser-control loop; a local operation can exceed the learned lease, and later Pongs cannot renew an expired lease. Exact storage vs scheduler attribution remains unmeasured. This is a continuity/capacity blocker below D170’s 200 sessions; no lost PTY bytes or update-specific causality is claimed.

full-route-vm.log

EA-01 P1 confirmed; failing test committed locally in 884f92e4 on review-edge-autoupdate. Locked perf VM, load 0.07/0.02/0.19: 128 real PTYs created, 52 attachment entries across thirteen planned browser sockets before the control-probe fence fails (update_staging_tests.rs:312). This is BEFORE publication and BEFORE the listener monitor starts; omitting its probe workload does not resolve the continuity failure. Output work 94,466 us; browser lease expires at age 99,782 us / budget 50,000 us. Test review_128_attached_routes_preserve_input_during_staging: 0 passed / 1 failed. Own unit/run teardown confirmed. Cause visible in websocket.rs:482/:831 and liveness.rs:46: awaited output/authority work shares the browser-control loop; a local operation can exceed the learned lease, and later Pongs cannot renew an expired lease. Exact storage vs scheduler attribution remains unmeasured. This is a continuity/capacity blocker below D170’s 200 sessions; no lost PTY bytes or update-specific causality is claimed. [full-route-vm.log](https://git.kayg.org/attachments/7c6c7daa-3146-437e-95b1-ab9efbf4e4d1)
kayg commented 2026-10-15 12:55:45 +00:00
Author
Owner
Copy link

Additional qualification result, committed bf6d9e9d: the existing native echo/flood gate fails on the locked perf VM (three real PTYs, RTT 300 ms, 100 samples/phase). Baseline echo p99 322.75 ms; same-PTY flood 350.04 ms against 334 ms; growth 27.29 ms against 16.67 ms. Other-PTY p99 308.24 ms and ACK phases pass. One run, attribution pending; currently recorded EA-02/P2, not a proven source/profile regression. No implementation changes.

native-latency-vm.log

Additional qualification result, committed bf6d9e9d: the existing native echo/flood gate fails on the locked perf VM (three real PTYs, RTT 300 ms, 100 samples/phase). Baseline echo p99 322.75 ms; same-PTY flood 350.04 ms against 334 ms; growth 27.29 ms against 16.67 ms. Other-PTY p99 308.24 ms and ACK phases pass. One run, attribution pending; currently recorded EA-02/P2, not a proven source/profile regression. No implementation changes. [native-latency-vm.log](https://git.kayg.org/attachments/9175b1e2-5227-4028-acee-772a42081cc8)
kayg commented 2026-10-15 12:57:45 +00:00
Author
Owner
Copy link

EA-03 P1 confirmed; failing test committed locally in 0a7d0d0b. With a ready local functional feed, the real downloader/signature verifier/SQLite updater prepares five releases but retains five executable images (105,760,036 B), with one selectable ready candidate and no stored current/previous in this fixture. 0 passed / 1 failed at the storage assertion. This is functional file-retention evidence, not a build-host timing/RSS benchmark. The initial VM run failed during feed preparation; a fenced VM repetition follows.

release_update.rs publishes updates/images/, and updater.rs replaces ready_path without retiring superseded images. History=100 does not bound executable retention. At the final production edge size, 1000 retained images alone consume 21,116,080,000 B; filling the same state volume threatens journal writes and recovery. P1 for shipping default automatic edge preparation. No implementation changes.

retention-functional.log

EA-03 P1 confirmed; failing test committed locally in 0a7d0d0b. With a ready local functional feed, the real downloader/signature verifier/SQLite updater prepares five releases but retains five executable images (105,760,036 B), with one selectable ready candidate and no stored current/previous in this fixture. 0 passed / 1 failed at the storage assertion. This is functional file-retention evidence, not a build-host timing/RSS benchmark. The initial VM run failed during feed preparation; a fenced VM repetition follows. release_update.rs publishes updates/images/<version>, and updater.rs replaces ready_path without retiring superseded images. History=100 does not bound executable retention. At the final production edge size, 1000 retained images alone consume 21,116,080,000 B; filling the same state volume threatens journal writes and recovery. P1 for shipping default automatic edge preparation. No implementation changes. [retention-functional.log](https://git.kayg.org/attachments/f7dd3b5f-0c3b-4a75-a35b-359b0b1b73e9)
kayg commented 2026-10-15 13:00:08 +00:00
Author
Owner
Copy link

EA-04 P1 confirmed; tests committed locally in 35d11662. D155 U2/U4 requires pre-upgrade backup and restore; D186 only supersedes distribution/channel clauses, and D217/D251 do not waive database recovery. Runtime updater.rs:367 commits applying intent then hands off with no backup service, destination or key. review_update_refuses_handoff_without_pre_upgrade_backup fails (0 passed / 1 failed).

The real-SQLite companion passes: after additive successor core migration 26, predecessor Auth startup refuses VersionMissing(26). startup.rs selects an executable but does not restore a pre-upgrade journal. Thus a signed successor that migrates and later fails cannot be recovered by this binary-only path. Existing administrative deploy backups do not protect the automatic path. The same-source A–E fixture does not test different migration sets. No implementation changes or validation relaxation.

backup-admission.log
migration-rollback.log

EA-04 P1 confirmed; tests committed locally in 35d11662. D155 U2/U4 requires pre-upgrade backup and restore; D186 only supersedes distribution/channel clauses, and D217/D251 do not waive database recovery. Runtime updater.rs:367 commits applying intent then hands off with no backup service, destination or key. review_update_refuses_handoff_without_pre_upgrade_backup fails (0 passed / 1 failed). The real-SQLite companion passes: after additive successor core migration 26, predecessor Auth startup refuses VersionMissing(26). startup.rs selects an executable but does not restore a pre-upgrade journal. Thus a signed successor that migrates and later fails cannot be recovered by this binary-only path. Existing administrative deploy backups do not protect the automatic path. The same-source A–E fixture does not test different migration sets. No implementation changes or validation relaxation. [backup-admission.log](https://git.kayg.org/attachments/8523f5ce-3d97-48fc-97c5-4906c39aac96) [migration-rollback.log](https://git.kayg.org/attachments/cfe22c40-534b-43eb-9457-824152f7de9f)
kayg commented 2026-10-15 13:02:43 +00:00
Author
Owner
Copy link

EA-03 VM confirmation: after adding only an HTTP fixture readiness fence (62605138), the storage assertion also fails on the locked perf VM at load 1.04/0.50/0.39. Five retained executable images / 105,760,036 B / one selectable ready candidate. 0 passed / 1 failed; owned run cleanup confirmed. This replaces the earlier preparation-only VM failure as the resource-retention receipt.

retention-vm-fenced.log

EA-03 VM confirmation: after adding only an HTTP fixture readiness fence (62605138), the storage assertion also fails on the locked perf VM at load 1.04/0.50/0.39. Five retained executable images / 105,760,036 B / one selectable ready candidate. 0 passed / 1 failed; owned run cleanup confirmed. This replaces the earlier preparation-only VM failure as the resource-retention receipt. [retention-vm-fenced.log](https://git.kayg.org/attachments/62982281-016b-4690-a1d9-99fa4c55bfe2)
kayg commented 2026-10-15 13:08:37 +00:00
Author
Owner
Copy link

EA-02 promoted to P1 after the mandatory native latency gate fails a second time on the locked perf VM, load 0.88/0.43/0.37. Same-PTY flood echo p99 437.05 ms and ACK p99 436.81 ms vs 334 ms; echo growth 110.00 ms vs 16.67 ms. Baseline echo p99 327.04 ms; other-PTY flood 304.19 ms. Three real PTYs, RTT 300 ms, 100 samples/phase. Test bf6d9e9d remains the committed reproduction.

This is a repeated D41/latency qualification failure, not a proven regression introduced by the orchestration profile or updater. No matched baseline attribution is claimed. The fixture body/budgets are unchanged; the repeat adds only a 110-second outer cleanup deadline, finishes normally at 92.07 seconds, and cleans its own state.

native-latency-repeat-vm.log

EA-02 promoted to P1 after the mandatory native latency gate fails a second time on the locked perf VM, load 0.88/0.43/0.37. Same-PTY flood echo p99 437.05 ms and ACK p99 436.81 ms vs 334 ms; echo growth 110.00 ms vs 16.67 ms. Baseline echo p99 327.04 ms; other-PTY flood 304.19 ms. Three real PTYs, RTT 300 ms, 100 samples/phase. Test bf6d9e9d remains the committed reproduction. This is a repeated D41/latency qualification failure, not a proven regression introduced by the orchestration profile or updater. No matched baseline attribution is claimed. The fixture body/budgets are unchanged; the repeat adds only a 110-second outer cleanup deadline, finishes normally at 92.07 seconds, and cleans its own state. [native-latency-repeat-vm.log](https://git.kayg.org/attachments/4547203f-d5fe-47d4-81ba-6de5f02a0656)
kayg commented 2026-10-15 13:12:52 +00:00
Author
Owner
Copy link

Review checkpoint at f79c50c5 (local review-edge-autoupdate, no push): four P1 findings recorded and receipts attached: EA-01 browser lease/capacity failure; EA-02 repeated native latency gate failure (regression attribution unproven); EA-03 unbounded server images, confirmed on VM; EA-04 missing D155 backup admission plus real SQLite migration diagnostic. Failing tests are committed in 884f92e4, bf6d9e9d, 0a7d0d0b, 35d11662. Full scripts/verify fast on exact target 6ae065677 continues in an isolated gate-head checkout; current phase static builds. Healthy warm-gap measurement is being isolated from browser lease failures; its two test-file changes remain uncommitted in pending-review-tests.patch and its harness rebuild waits through build-slot. Public signed fixtures/test executable remain under edge-autoupdate-review/staging/public-transfer-c632a856; no private signer material exists there. No implementation changes, production deployment, credentials lookup or owner live fixture modification. Final verdict/complete gate still pending.

Review checkpoint at f79c50c5 (local review-edge-autoupdate, no push): four P1 findings recorded and receipts attached: EA-01 browser lease/capacity failure; EA-02 repeated native latency gate failure (regression attribution unproven); EA-03 unbounded server images, confirmed on VM; EA-04 missing D155 backup admission plus real SQLite migration diagnostic. Failing tests are committed in 884f92e4, bf6d9e9d, 0a7d0d0b, 35d11662. Full scripts/verify fast on exact target 6ae065677 continues in an isolated gate-head checkout; current phase static builds. Healthy warm-gap measurement is being isolated from browser lease failures; its two test-file changes remain uncommitted in pending-review-tests.patch and its harness rebuild waits through build-slot. Public signed fixtures/test executable remain under edge-autoupdate-review/staging/public-transfer-c632a856; no private signer material exists there. No implementation changes, production deployment, credentials lookup or owner live fixture modification. Final verdict/complete gate still pending.
kayg commented 2026-10-15 13:47:00 +00:00
Author
Owner
Copy link

EA-05 P1 confirmed; failing healthy-handoff test committed locally in b278db99. Exclusive perf VM, load 0.35/0.85/0.78: signed manual A→B with 128 live PTYs, ZERO attached browser routes, no crash/refusal injection. All 128 shim PIDs survive and CA stays unlocked. Listener bracket 849.287 ms; max sample interval 12.889 ms; 343 failed probes. Removing both boundary intervals still gives at least 823.510 ms unavailable, exceeding the generous measured four-RTT + 50 ms allowance (92.227 ms). 0 passed / 1 failed; owned cleanup confirmed.

Thus a nearly one-second restart gap is not acceptable as D259/D265/D267 reconnect qualification: listener absence alone exceeds the budget before TLS/session resume. This is a lower-bound disproof, not a full TLS percentile, and does not assess the separate client-copy screen budget. It isolates healthy update availability from the earlier browser lease failures and from the author’s aggregate 882.680 ms across multiple warm/failure transitions.

reconnect-isolated-vm.log

EA-05 P1 confirmed; failing healthy-handoff test committed locally in b278db99. Exclusive perf VM, load 0.35/0.85/0.78: signed manual A→B with 128 live PTYs, ZERO attached browser routes, no crash/refusal injection. All 128 shim PIDs survive and CA stays unlocked. Listener bracket 849.287 ms; max sample interval 12.889 ms; 343 failed probes. Removing both boundary intervals still gives at least 823.510 ms unavailable, exceeding the generous measured four-RTT + 50 ms allowance (92.227 ms). 0 passed / 1 failed; owned cleanup confirmed. Thus a nearly one-second restart gap is not acceptable as D259/D265/D267 reconnect qualification: listener absence alone exceeds the budget before TLS/session resume. This is a lower-bound disproof, not a full TLS percentile, and does not assess the separate client-copy screen budget. It isolates healthy update availability from the earlier browser lease failures and from the author’s aggregate 882.680 ms across multiple warm/failure transitions. [reconnect-isolated-vm.log](https://git.kayg.org/attachments/2bcad30c-5c71-4688-b5c1-99a869dd64e9)
kayg commented 2026-10-15 13:58:17 +00:00
Author
Owner
Copy link

Final independent review: HOLD — do not merge. P0=0, P1=5, P2=0, P3=0. Target: 6ae065677f; review head: a141238906, local review-edge-autoupdate. Each finding has a committed failing test; no implementation fixes, push or deployment.

EA-01: 128-route qualification stops during attachment before publication: local output work 94.466 ms exceeds the 50 ms browser lease; replies processed after expiry cannot recover the socket. This confirms a session-continuity gap, not lost PTY bytes or an updater-specific regression.
EA-02: mandatory native latency gate fails twice (same-PTY echo p99 350.04 / 437.05 ms vs 334 ms; repeat ACK 436.81 ms). Regression attribution is unproven; this is not a matched replication of the author's zero-RTT profile benchmark.
EA-03: five signed prepared candidates retain five executable files / 105,760,036 B. No image bound or capacity refusal: disk-exhaustion risk makes this P1.
EA-04: handoff proceeds without the D155 pre-upgrade backup. Real SQLite companion proves predecessor startup refuses successor migration 26; binary-only rollback cannot restore it.
EA-05: isolated healthy warm transition retains all 128 shim PIDs and CA custody but listener gap is at least 823.510 ms (849.287 ms bracket), exceeding even four RTTs + 50 ms = 92.227 ms. The reported nearly-one-second gap is not acceptable for typability. Client-screen restoration is a separate, unmeasured budget.

Size: matched author profile artifacts save 1,685,184 B; later correctness adds 32,192 B. Final edge x86 21,116,080 B is 1,088,224 B below former 22,204,304 B cap. Independent stable builds confirm x86 21,116,016 B / ARM 18,739,104 B. Features, verification and unwind tables remain; stripping predates the lane. Separate crash-symbol archives remain absent. Different embedded build timestamp/compiler path prevents a byte-for-byte reproduction claim. External hardened signer rollout remains a prerequisite.

Exact target-head scripts/verify fast: exit 0. Verbatim gate summary:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Verbatim final TypeScript summary:

 37 pass
 0 fail
 34463 expect() calls
Ran 37 tests across 10 files. [2.66s]

Full output, including every Rust test and static/security check: verify-fast.log. Build-host durations are operational logs, not performance evidence. Native x86 key-memory check passes; ARM runtime check was not run. No load-related baseline waiver needed. Review-source fmt and targeted all-target Clippy pass.

Report: docs/verification/edge-autoupdate-review.md at a141238906. Findings and raw receipts already attached above; external ledger updated. Reviewer checklist covers admission, storage bounds, migration recovery, continuity, reconnect, trust, size and compile-out. Raw receipts remain outside checkout; owned build/fixture scratch is being removed. Issue remains open.

Final independent review: HOLD — do not merge. P0=0, P1=5, P2=0, P3=0. Target: 6ae065677fe434d3c47037c49c9e59b43a9a5c47; review head: a1412389063d2acea04850b164c1f957654a51fa, local review-edge-autoupdate. Each finding has a committed failing test; no implementation fixes, push or deployment. EA-01: 128-route qualification stops during attachment before publication: local output work 94.466 ms exceeds the 50 ms browser lease; replies processed after expiry cannot recover the socket. This confirms a session-continuity gap, not lost PTY bytes or an updater-specific regression. EA-02: mandatory native latency gate fails twice (same-PTY echo p99 350.04 / 437.05 ms vs 334 ms; repeat ACK 436.81 ms). Regression attribution is unproven; this is not a matched replication of the author's zero-RTT profile benchmark. EA-03: five signed prepared candidates retain five executable files / 105,760,036 B. No image bound or capacity refusal: disk-exhaustion risk makes this P1. EA-04: handoff proceeds without the D155 pre-upgrade backup. Real SQLite companion proves predecessor startup refuses successor migration 26; binary-only rollback cannot restore it. EA-05: isolated healthy warm transition retains all 128 shim PIDs and CA custody but listener gap is at least 823.510 ms (849.287 ms bracket), exceeding even four RTTs + 50 ms = 92.227 ms. The reported nearly-one-second gap is not acceptable for typability. Client-screen restoration is a separate, unmeasured budget. Size: matched author profile artifacts save 1,685,184 B; later correctness adds 32,192 B. Final edge x86 21,116,080 B is 1,088,224 B below former 22,204,304 B cap. Independent stable builds confirm x86 21,116,016 B / ARM 18,739,104 B. Features, verification and unwind tables remain; stripping predates the lane. Separate crash-symbol archives remain absent. Different embedded build timestamp/compiler path prevents a byte-for-byte reproduction claim. External hardened signer rollout remains a prerequisite. Exact target-head `scripts/verify fast`: exit 0. Verbatim gate summary: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Verbatim final TypeScript summary: ``` 37 pass 0 fail 34463 expect() calls Ran 37 tests across 10 files. [2.66s] ``` Full output, including every Rust test and static/security check: [verify-fast.log](https://git.kayg.org/attachments/cb61591f-8a3a-45a8-a289-5802609a81e4). Build-host durations are operational logs, not performance evidence. Native x86 key-memory check passes; ARM runtime check was not run. No load-related baseline waiver needed. Review-source fmt and targeted all-target Clippy pass. Report: docs/verification/edge-autoupdate-review.md at a1412389063d2acea04850b164c1f957654a51fa. Findings and raw receipts already attached above; external ledger updated. Reviewer checklist covers admission, storage bounds, migration recovery, continuity, reconnect, trust, size and compile-out. Raw receipts remain outside checkout; owned build/fixture scratch is being removed. Issue remains open.
kayg commented 2026-10-15 13:59:03 +00:00
Author
Owner
Copy link

Review cleanup complete: detached gate checkout and owned build targets, staging executables, downloaded fixtures and functional-test state removed. Raw evidence retained outside checkout. Local review-edge-autoupdate is clean at a14123890; no push or implementation changes. Final verdict and exact-head gate transcript are in the preceding comment.

Review cleanup complete: detached gate checkout and owned build targets, staging executables, downloaded fixtures and functional-test state removed. Raw evidence retained outside checkout. Local review-edge-autoupdate is clean at a14123890; no push or implementation changes. Final verdict and exact-head gate transcript are in the preceding comment.
kayg commented 2026-10-15 14:00:55 +00:00
Author
Owner
Copy link

Resumed edge-autoupdate at base/head 6ae065677f, clean worktree. Read #211 and parent #157 histories and review a14123890. Imported review failing-test commits through b278db991 as 65ea8cc48..49351251f. Addressing EA-01..EA-05; no production or signer deployment. Existing size caps remain mandatory.

Resumed edge-autoupdate at base/head 6ae065677fe434d3c47037c49c9e59b43a9a5c47, clean worktree. Read #211 and parent #157 histories and review a14123890. Imported review failing-test commits through b278db991 as 65ea8cc48..49351251f. Addressing EA-01..EA-05; no production or signer deployment. Existing size caps remain mandatory.
kayg commented 2026-10-15 14:06:18 +00:00
Author
Owner
Copy link

EA-04 prerequisite finding at 49351251f: crates/plugins/backup/src/lib.rs:1 and Cargo.toml explicitly declare metadata-only backup actions; no backup key store, administrator wraps, snapshot or restore runtime exists (repository search for backup_key, backup.*wrap, SQLite backup and VACUUM INTO finds none). D147/D186 require a dedicated administrator-wrapped key, encrypted consistent snapshot and restore before predecessor startup. A CA-derived key or plaintext database copy would violate that contract. Adding fail-closed update admission while this runtime is absent; complete EA-04 recovery/VM acceptance remains dependent on that runtime. No claim that refusing updates implements recovery.
EA-03 implementation in progress: durable selection and check-in invoke image collection; current/previous/ready and all in-flight target/recovery paths are retained; stale directories atomically rename before recursive deletion. Added 20-check-in storage assertion. Listener inheritance draft keeps TCP descriptors across same-PID exec and validates SO_ACCEPTCONN before adoption. Targeted tests/clippy are queued through build-slot; all four slots currently occupied. No new timing claims.

EA-04 prerequisite finding at 49351251f: crates/plugins/backup/src/lib.rs:1 and Cargo.toml explicitly declare metadata-only backup actions; no backup key store, administrator wraps, snapshot or restore runtime exists (repository search for backup_key, backup.*wrap, SQLite backup and VACUUM INTO finds none). D147/D186 require a dedicated administrator-wrapped key, encrypted consistent snapshot and restore before predecessor startup. A CA-derived key or plaintext database copy would violate that contract. Adding fail-closed update admission while this runtime is absent; complete EA-04 recovery/VM acceptance remains dependent on that runtime. No claim that refusing updates implements recovery. EA-03 implementation in progress: durable selection and check-in invoke image collection; current/previous/ready and all in-flight target/recovery paths are retained; stale directories atomically rename before recursive deletion. Added 20-check-in storage assertion. Listener inheritance draft keeps TCP descriptors across same-PID exec and validates SO_ACCEPTCONN before adoption. Targeted tests/clippy are queued through build-slot; all four slots currently occupied. No new timing claims.
kayg commented 2026-10-15 14:12:34 +00:00
Author
Owner
Copy link

Build validation blocked on shared build-slot capacity: targeted Rust tests/clippy have waited since 16:02 CEST with an empty retention-gate.log. Slot receipts show slot 1 mesh-autoswitch build-probe-o.sh (16:01), slot 2 addhost-instant measure-command-future.py (15:47), slot 3 designer-version-pill serve-loop.sh (16:01), slot 4 history-audit verify fast (15:56). The dev-server loop holds a build slot for its lifetime. Orchestrator capacity management is needed; I will not stop another job or bypass the slot limit. Source work continues. Imported review reproductions are pushed at 49351251f. No implementation test or timing success claimed yet.

Build validation blocked on shared build-slot capacity: targeted Rust tests/clippy have waited since 16:02 CEST with an empty retention-gate.log. Slot receipts show slot 1 mesh-autoswitch build-probe-o.sh (16:01), slot 2 addhost-instant measure-command-future.py (15:47), slot 3 designer-version-pill serve-loop.sh (16:01), slot 4 history-audit verify fast (15:56). The dev-server loop holds a build slot for its lifetime. Orchestrator capacity management is needed; I will not stop another job or bypass the slot limit. Source work continues. Imported review reproductions are pushed at 49351251f. No implementation test or timing success claimed yet.
kayg commented 2026-10-15 14:22:18 +00:00
Author
Owner
Copy link

EA-03 functional regression now passes in the worktree: image_store_remains_bounded_across_twenty_check_ins, 1 passed / 0 failed. Across 20 check-ins it asserts one initial image then exactly current+previous, at most 8,192 executable bytes (two 4,096-byte fixture images); an interrupted .retired directory is reclaimed on the next pass. This is functional storage coverage, not a timing/memory benchmark. Current/previous/ready/requested and applying target/recovery paths are protected by persisted selections. Collection also runs before another download to reclaim canceled candidates. Implementation remains uncommitted pending touched-crate Clippy/tests.
retention-functional.txt

EA-03 functional regression now passes in the worktree: image_store_remains_bounded_across_twenty_check_ins, 1 passed / 0 failed. Across 20 check-ins it asserts one initial image then exactly current+previous, at most 8,192 executable bytes (two 4,096-byte fixture images); an interrupted .retired directory is reclaimed on the next pass. This is functional storage coverage, not a timing/memory benchmark. Current/previous/ready/requested and applying target/recovery paths are protected by persisted selections. Collection also runs before another download to reclaim canceled candidates. Implementation remains uncommitted pending touched-crate Clippy/tests. [retention-functional.txt](https://git.kayg.org/attachments/08932a3f-28cc-40b4-8555-6ea431def202)
kayg commented 2026-10-15 14:25:53 +00:00
Author
Owner
Copy link

Resumable draft while Rust validation rebuilds caches: pending-review-fixes.patch, applies over pushed 49351251f and includes new files. Contains EA-03 collection + 20-transition storage test, EA-04 default refusal without a recovery provider, EA-01 independent bounded browser control I/O + real-WebSocket fence regression, EA-05 same-PID TCP listener inheritance (browser and native fallback) + real-exec queue regression and audited descriptor duplication. No claim of final correctness, VM acceptance or passing size gate. Default refusal means automatic/manual update application remains unavailable until the missing D147/D186 backup runtime is supplied; it does not implement backup/restore. Head remains 49351251f. Build/test receipts are under edge-autoupdate/evidence; targeted Clippy is active, focused tests queued, native baseline build queued through build-slot. No production/Worker deployment.

Resumable draft while Rust validation rebuilds caches: [pending-review-fixes.patch](https://git.kayg.org/attachments/0d2eedb8-0cda-48fc-97fe-889d7091acbb), applies over pushed 49351251f and includes new files. Contains EA-03 collection + 20-transition storage test, EA-04 default refusal without a recovery provider, EA-01 independent bounded browser control I/O + real-WebSocket fence regression, EA-05 same-PID TCP listener inheritance (browser and native fallback) + real-exec queue regression and audited descriptor duplication. No claim of final correctness, VM acceptance or passing size gate. Default refusal means automatic/manual update application remains unavailable until the missing D147/D186 backup runtime is supplied; it does not implement backup/restore. Head remains 49351251f. Build/test receipts are under edge-autoupdate/evidence; targeted Clippy is active, focused tests queued, native baseline build queued through build-slot. No production/Worker deployment.
kayg commented 2026-10-15 14:32:53 +00:00
Author
Owner
Copy link

Functional draft checks pass: release plugin 31 passed / 0 failed / 1 ignored, including review_update_refuses_handoff_without_pre_upgrade_backup; real exec retains a pre-exec queued TCP connection and restores CLOEXEC (1 passed); a real browser WebSocket answers ten probe cycles while application processing is fenced (1 passed); invalid inherited descriptors refuse (1 passed); CLI binary suite 78 passed / 0 failed / 1 ignored. Initial Clippy identified three local style/async issues; corrected, retry queued. Full iterate/fast and original VM review cases remain pending.
review-fixes-functional.txt
Additive later-UI copy for refusal before any swap: "Update blocked · Pre-upgrade backup unavailable". Existing API returns error="pre-upgrade backup unavailable", retains the verified ready image and records last_result.result="refused"; it must not claim that an image was applied or restored. This is a safety refusal until the absent dedicated-key backup/restore runtime is implemented, not completed EA-04 recovery.

Functional draft checks pass: release plugin 31 passed / 0 failed / 1 ignored, including review_update_refuses_handoff_without_pre_upgrade_backup; real exec retains a pre-exec queued TCP connection and restores CLOEXEC (1 passed); a real browser WebSocket answers ten probe cycles while application processing is fenced (1 passed); invalid inherited descriptors refuse (1 passed); CLI binary suite 78 passed / 0 failed / 1 ignored. Initial Clippy identified three local style/async issues; corrected, retry queued. Full iterate/fast and original VM review cases remain pending. [review-fixes-functional.txt](https://git.kayg.org/attachments/b73fa8df-3bed-41be-8a97-8426d44486ed) Additive later-UI copy for refusal before any swap: "Update blocked · Pre-upgrade backup unavailable". Existing API returns error="pre-upgrade backup unavailable", retains the verified ready image and records last_result.result="refused"; it must not claim that an image was applied or restored. This is a safety refusal until the absent dedicated-key backup/restore runtime is implemented, not completed EA-04 recovery.
kayg commented 2026-10-15 14:41:00 +00:00
Author
Owner
Copy link

Completed atomic guard/policy steps (pushed): f0badae39 refuses release handoff when the engine cannot prepare D147/D186 recovery; 40c55055 adds plugin-owned retained-path collection after durable selection/check-in and before another download. These are separate commits; the disk implementation follows. Guard semantics intentionally make application unavailable until the missing backup runtime exists. No recovery claim.
Validation: workspace fmt and all-target Clippy for server/release/CLI/shim pass; release unit suite 31 passed / 0 failed / 1 ignored; CLI binary suite 78 passed / 0 failed / 1 ignored. Real exec listener regression and both native listener reservation regressions also pass on the draft integration. touched-gate.log

Completed atomic guard/policy steps (pushed): f0badae39 refuses release handoff when the engine cannot prepare D147/D186 recovery; 40c55055 adds plugin-owned retained-path collection after durable selection/check-in and before another download. These are separate commits; the disk implementation follows. Guard semantics intentionally make application unavailable until the missing backup runtime exists. No recovery claim. Validation: workspace fmt and all-target Clippy for server/release/CLI/shim pass; release unit suite 31 passed / 0 failed / 1 ignored; CLI binary suite 78 passed / 0 failed / 1 ignored. Real exec listener regression and both native listener reservation regressions also pass on the draft integration. [touched-gate.log](https://git.kayg.org/attachments/2d000e03-4646-4dad-944e-27ade4de5ed7)
kayg commented 2026-10-15 14:45:57 +00:00
Author
Owner
Copy link

Completed and pushed 0e91fdaca (audited F_DUPFD_CLOEXEC ownership boundary; invalid-descriptor test passes) and b9a7cc5d7 (same-PID browser/native TCP listener inheritance). Real exec regression preserves a queued connection and verifies restored CLOEXEC/ordinary shutdown port release; 1 passed. Native listener reservation regressions: 2 passed, preserving explicit operator ports and releasing failed ephemeral reservations. Workspace fmt and all touched all-target Clippy pass. touched-gate.log
No listener-gap timing qualification yet: baseline musl image is linking, candidate build and final collection/control functional check await build slots. The missing backup runtime still blocks actual update application and the full original VM acceptance sequence. No budget or size cap changed.

Completed and pushed 0e91fdaca (audited F_DUPFD_CLOEXEC ownership boundary; invalid-descriptor test passes) and b9a7cc5d7 (same-PID browser/native TCP listener inheritance). Real exec regression preserves a queued connection and verifies restored CLOEXEC/ordinary shutdown port release; 1 passed. Native listener reservation regressions: 2 passed, preserving explicit operator ports and releasing failed ephemeral reservations. Workspace fmt and all touched all-target Clippy pass. [touched-gate.log](https://git.kayg.org/attachments/2d000e03-4646-4dad-944e-27ade4de5ed7) No listener-gap timing qualification yet: baseline musl image is linking, candidate build and final collection/control functional check await build slots. The missing backup runtime still blocks actual update application and the full original VM acceptance sequence. No budget or size cap changed.
kayg commented 2026-10-15 14:58:14 +00:00
Author
Owner
Copy link

New EA-05 compatibility finding before further implementation: b9a7cc5d7 exports listening descriptors unconditionally in restart.rs::execute_image. The predecessor can carry the existing CA-v1 ELF note while having no listener consumer; its inherited socket would keep the port occupied and make legacy rollback bind fail. Compatibility must be independent of CA custody.
Additive protocol proposal: retain CA-v1 unchanged; add a separate versioned ELF listener note using the existing bounded exact-note reader. Export the public descriptor manifest only to sealed images advertising that note. Legacy verified images use their existing close/rebind behavior, preserving rollback functionality without claiming its old listener gap meets the new target. Bind the descriptor manifest to the unchanged service PID so ambient metadata is not mistaken for handoff by a child process. No frozen host upgrade frame or CA stdin frame changes, no new engine/dependency. Add disjoint/malformed note tests and cover both note kinds in the existing fuzz target before wiring conditional export.

New EA-05 compatibility finding before further implementation: b9a7cc5d7 exports listening descriptors unconditionally in restart.rs::execute_image. The predecessor can carry the existing CA-v1 ELF note while having no listener consumer; its inherited socket would keep the port occupied and make legacy rollback bind fail. Compatibility must be independent of CA custody. Additive protocol proposal: retain CA-v1 unchanged; add a separate versioned ELF listener note using the existing bounded exact-note reader. Export the public descriptor manifest only to sealed images advertising that note. Legacy verified images use their existing close/rebind behavior, preserving rollback functionality without claiming its old listener gap meets the new target. Bind the descriptor manifest to the unchanged service PID so ambient metadata is not mistaken for handoff by a child process. No frozen host upgrade frame or CA stdin frame changes, no new engine/dependency. Add disjoint/malformed note tests and cover both note kinds in the existing fuzz target before wiring conditional export.
kayg commented 2026-10-15 15:12:26 +00:00
Author
Owner
Copy link

Completed and pushed e1bb18149 (filesystem image collection) and f2c5dd5bc (independent bounded browser-control I/O). Final focused run: 20-check-in storage regression 1 passed; browser-control fence regression 1 passed. Retention keeps exactly current+previous after check-in and reclaims interrupted tombstones; the control test answers ten real probe cycles before application work resumes. These are functional results, not build-host timing evidence. Original VM review cases and final full gate remain outstanding.
Native benchmark preflight on the locked perf VM now passes: three distinct real PTYs open through the retained dev baseline; owned state and remote run were removed. No timing result collected. Candidate static build finished, but capability edits occurred during that build; it will be rebuilt from frozen source before size/performance qualification.
collection-and-control-final.log
native-preflight.log

Completed and pushed e1bb18149 (filesystem image collection) and f2c5dd5bc (independent bounded browser-control I/O). Final focused run: 20-check-in storage regression 1 passed; browser-control fence regression 1 passed. Retention keeps exactly current+previous after check-in and reclaims interrupted tombstones; the control test answers ten real probe cycles before application work resumes. These are functional results, not build-host timing evidence. Original VM review cases and final full gate remain outstanding. Native benchmark preflight on the locked perf VM now passes: three distinct real PTYs open through the retained dev baseline; owned state and remote run were removed. No timing result collected. Candidate static build finished, but capability edits occurred during that build; it will be rebuilt from frozen source before size/performance qualification. [collection-and-control-final.log](https://git.kayg.org/attachments/a4e1c0f9-ebd0-433c-b0cf-47c0316c7ab8) [native-preflight.log](https://git.kayg.org/attachments/ffb6121e-ba25-4a83-bcc5-dc487b96e64b)
kayg commented 2026-10-15 15:21:07 +00:00
Author
Owner
Copy link

Completed and pushed 102c8fe61: independent listener-v1 ELF capability, same-PID descriptor manifests, exported copies above standard handles, conditional export for capable images, and legacy close/rebind fallback. CA-v1 and host wire stay unchanged. Added both note kinds to the existing parser fuzzer.
Validation: new note API red compile preserved; 2 exact-note mutation/truncation tests pass. Fmt and touched all-target Clippy pass. Two listener lifecycle tests cover capable adoption, legacy rebinding, closed stdin and child-PID isolation; 30 CLI restart tests pass / 1 measurement ignored. Legacy fallback is functional compatibility, not a claim that its old gap meets the new budget.
listener-compatibility-gate.log
listener-note-red.log
listener-note-green.log
Earlier candidate static x86 image was 21,164,624 B versus 21,116,016 B cap (+48,608); edits occurred during that build, so it is not final exact-source attribution. Comparing frozen 102c8fe61 against review head 6ae065677 with cargo-bloat before reducing overhead. Caps unchanged. Backup runtime, original VM acceptance, latency A/B and final fast gate remain outstanding.

Completed and pushed 102c8fe61: independent listener-v1 ELF capability, same-PID descriptor manifests, exported copies above standard handles, conditional export for capable images, and legacy close/rebind fallback. CA-v1 and host wire stay unchanged. Added both note kinds to the existing parser fuzzer. Validation: new note API red compile preserved; 2 exact-note mutation/truncation tests pass. Fmt and touched all-target Clippy pass. Two listener lifecycle tests cover capable adoption, legacy rebinding, closed stdin and child-PID isolation; 30 CLI restart tests pass / 1 measurement ignored. Legacy fallback is functional compatibility, not a claim that its old gap meets the new budget. [listener-compatibility-gate.log](https://git.kayg.org/attachments/6b2d7910-50b4-4680-8351-f8661887cf8c) [listener-note-red.log](https://git.kayg.org/attachments/b9ee6830-c8ba-4137-acbb-b3473bab0557) [listener-note-green.log](https://git.kayg.org/attachments/bf6c5c1e-0f98-46ba-8d71-cea89c760bbd) Earlier candidate static x86 image was 21,164,624 B versus 21,116,016 B cap (+48,608); edits occurred during that build, so it is not final exact-source attribution. Comparing frozen 102c8fe61 against review head 6ae065677 with cargo-bloat before reducing overhead. Caps unchanged. Backup runtime, original VM acceptance, latency A/B and final fast gate remain outstanding.
kayg commented 2026-10-15 16:01:12 +00:00
Author
Owner
Copy link

Size attribution at pushed 102c8fe61 versus reviewed 6ae065677, matched cargo-bloat x86_64-musl release recipes (strip disabled only for attribution): .text 16,042,134 → 16,079,958 B (+37,824). Crate attribution: server +24,759 B, std +7,819 B, CLI +3,860 B, release plugin +2,034 B, shim +117 B; Tokio -26 B. No dependency additions. This is symbol attribution, not a shipping cap measurement. Testing a shared dyn Sink writer behind the existing allocation to reduce generic adapter code; still uncommitted. Actual pre-upgrade encrypted backup/restore remains absent: production apply refuses with pre-upgrade backup unavailable; the safety guard is not claimed as completion of EA04.

Size attribution at pushed 102c8fe61 versus reviewed 6ae065677, matched cargo-bloat x86_64-musl release recipes (strip disabled only for attribution): .text 16,042,134 → 16,079,958 B (+37,824). Crate attribution: server +24,759 B, std +7,819 B, CLI +3,860 B, release plugin +2,034 B, shim +117 B; Tokio -26 B. No dependency additions. This is symbol attribution, not a shipping cap measurement. Testing a shared dyn Sink writer behind the existing allocation to reduce generic adapter code; still uncommitted. Actual pre-upgrade encrypted backup/restore remains absent: production apply refuses with `pre-upgrade backup unavailable`; the safety guard is not claimed as completion of EA04.
kayg commented 2026-10-15 16:04:05 +00:00
Author
Owner
Copy link

Matched bloat attribution receipt: review-fixes-bloat-diff.txt. Both JSON reports and build logs are retained in the same scratch evidence directory. No shipping-cap pass yet. The writer gate is queued through build-slot; stopped only my own waiting fuzz-slot wrapper (PID 103401) to avoid competing with this job's shipping build. No running build or other job was stopped.

Matched bloat attribution receipt: [review-fixes-bloat-diff.txt](https://git.kayg.org/attachments/84b81938-77da-4121-bf79-261a074753a3). Both JSON reports and build logs are retained in the same scratch evidence directory. No shipping-cap pass yet. The writer gate is queued through build-slot; stopped only my own waiting fuzz-slot wrapper (PID 103401) to avoid competing with this job's shipping build. No running build or other job was stopped.
kayg commented 2026-10-15 16:23:23 +00:00
Author
Owner
Copy link

Static follow-up finding in updater.rs: post-commit image collection currently precedes notify/toast delivery. A collection I/O failure after the ready row and per-version notification receipt commit returns early, permanently losing the ready event (a retry sees ready_version and returns without a toast). Added ready_notice_survives_post_commit_collection_failure, pending RED through build-slot. Proposed correction: deliver the durable-selection notifications before fallible post-commit collection; preserve the cleanup error and bounded retention behavior. No change to the publish or backup contract.

Static follow-up finding in updater.rs: post-commit image collection currently precedes notify/toast delivery. A collection I/O failure after the ready row and per-version notification receipt commit returns early, permanently losing the ready event (a retry sees ready_version and returns without a toast). Added `ready_notice_survives_post_commit_collection_failure`, pending RED through build-slot. Proposed correction: deliver the durable-selection notifications before fallible post-commit collection; preserve the cleanup error and bounded retention behavior. No change to the publish or backup contract.
kayg commented 2026-10-15 16:24:05 +00:00
Author
Owner
Copy link

One diagnostic A/B pair on the locked perf VM, 4 CPUs, MemTotal 8,069,112 kB, three real PTYs, RTT 300 ms, 100 samples/phase. Baseline source 8e7467c07 (reviewer's dev) uses the normal shipping recipe; candidate source 102c8fe61 uses the matched optimized symbol-attribution recipe (strip=none), so this is NOT final shipping qualification. Same-PTY flood echo p99 baseline/candidate 339.17/358.36 ms vs 334 ms; growth 13.86/31.08 ms vs 16.67 ms. Both fail the absolute echo gate; candidate also fails the growth and ACK gates. Load before/after baseline 1.81/0.84/0.67 → 1.56/0.96/0.72, candidate 1.30/0.95/0.73 → 0.50/0.78/0.69. No noise or regression-attribution claim from one pair. Own VM directory cleaned. Full receipt + candidate hash/recipe. The >=10 interleaved final-artifact pairs remain pending; the shipping writer build has waited for a shared build slot since 18:00 local time.

One diagnostic A/B pair on the locked perf VM, 4 CPUs, MemTotal 8,069,112 kB, three real PTYs, RTT 300 ms, 100 samples/phase. Baseline source 8e7467c07 (reviewer's dev) uses the normal shipping recipe; candidate source 102c8fe61 uses the matched optimized symbol-attribution recipe (strip=none), so this is NOT final shipping qualification. Same-PTY flood echo p99 baseline/candidate 339.17/358.36 ms vs 334 ms; growth 13.86/31.08 ms vs 16.67 ms. Both fail the absolute echo gate; candidate also fails the growth and ACK gates. Load before/after baseline 1.81/0.84/0.67 → 1.56/0.96/0.72, candidate 1.30/0.95/0.73 → 0.50/0.78/0.69. No noise or regression-attribution claim from one pair. Own VM directory cleaned. [Full receipt + candidate hash/recipe](https://git.kayg.org/attachments/b0a0cc30-3767-4477-8f38-30d61315e015). The >=10 interleaved final-artifact pairs remain pending; the shipping writer build has waited for a shared build slot since 18:00 local time.
kayg commented 2026-10-15 16:28:43 +00:00
Author
Owner
Copy link

Ready/cleanup regression confirmed RED before the fix: 0 passed / 1 failed at durable ready selection must wake observers (updater_tests.rs:537). Verbatim test output. The fix now delivers notifications after durable commit and before fallible collection. Selected-crate tests/clippy, the WebSocket fence regression and exact shipping size are running through build-slot (acquired after 27 minutes). No additional commit or completion claim yet.

Ready/cleanup regression confirmed RED before the fix: 0 passed / 1 failed at `durable ready selection must wake observers` (updater_tests.rs:537). [Verbatim test output](https://git.kayg.org/attachments/e7ce6f0d-e82d-42fc-b7e3-9c360f6483c7). The fix now delivers notifications after durable commit and before fallible collection. Selected-crate tests/clippy, the WebSocket fence regression and exact shipping size are running through build-slot (acquired after 27 minutes). No additional commit or completion claim yet.
kayg commented 2026-10-15 16:30:36 +00:00
Author
Owner
Copy link

d99e4817c pushed: notify observers and emit the ready toast after durable selection, before fallible image collection. Red regression previously failed on missing observer notification; now 32 release unit tests PASS / 1 ignored, selected server/CLI/release all-target Clippy PASS, fmt PASS, real WebSocket fence test PASS. The latter also compiles/tests the uncommitted writer sharing candidate; its size and VM qualification are still pending. Verbatim focused gate. No raw evidence committed.

d99e4817c pushed: notify observers and emit the ready toast after durable selection, before fallible image collection. Red regression previously failed on missing observer notification; now 32 release unit tests PASS / 1 ignored, selected server/CLI/release all-target Clippy PASS, fmt PASS, real WebSocket fence test PASS. The latter also compiles/tests the uncommitted writer sharing candidate; its size and VM qualification are still pending. [Verbatim focused gate](https://git.kayg.org/attachments/da708862-db22-4232-8007-1db77faf9b13). No raw evidence committed.
kayg commented 2026-10-15 16:48:29 +00:00
Author
Owner
Copy link

Writer-only optimization rejected: normal production stable x86_64 shipping image is 21,166,056 B versus cap 21,116,016 B (+50,040). Matched symbol .text is 16,080,022 B, only +64 B versus before that candidate and the notification correction; no useful cut. No profile, dependency or cap changed. Size receipt. Uncommitted next candidate reuses mpsc and JoinSet<()> already present in the server, polls reader/probes within one independently owned task, preserves frame/byte bounds and cancellation/join, and handles transport echoes in the reader. Focused tests/clippy and the normal shipping build are queued through build-slot. iterate has not run: the failed size candidate stopped before it.

Writer-only optimization rejected: normal production stable x86_64 shipping image is 21,166,056 B versus cap 21,116,016 B (+50,040). Matched symbol .text is 16,080,022 B, only +64 B versus before that candidate and the notification correction; no useful cut. No profile, dependency or cap changed. [Size receipt](https://git.kayg.org/attachments/f3cafbe6-ece0-4d3e-a9ad-adc9b10448f8). Uncommitted next candidate reuses mpsc<Bytes> and JoinSet<()> already present in the server, polls reader/probes within one independently owned task, preserves frame/byte bounds and cancellation/join, and handles transport echoes in the reader. Focused tests/clippy and the normal shipping build are queued through build-slot. `iterate` has not run: the failed size candidate stopped before it.
kayg commented 2026-10-15 16:54:00 +00:00
Author
Owner
Copy link

Qualification-driver correction before the >=10-pair run: the single diagnostic pair did not copy crates/infraternal/tests/profile/.zshrc (only PS1='shim-test% '). The final driver now includes the repository profile, matching the review harness, and uses the review's exception-based SIGALRM watchdog so timeouts execute the fixture's PTY cleanup. The diagnostic remains labelled non-qualification; neither diagnostic phase timed out. No product or gate test was weakened.

Qualification-driver correction before the >=10-pair run: the single diagnostic pair did not copy `crates/infraternal/tests/profile/.zshrc` (only PS1='shim-test% '). The final driver now includes the repository profile, matching the review harness, and uses the review's exception-based SIGALRM watchdog so timeouts execute the fixture's PTY cleanup. The diagnostic remains labelled non-qualification; neither diagnostic phase timed out. No product or gate test was weakened.
kayg commented 2026-10-15 16:59:45 +00:00
Author
Owner
Copy link

Task/channel sharing candidate passes fmt, all-target server/CLI Clippy and the real WebSocket fence regression (including transport echoes and byte-budget release). Normal stable x86_64 image 21,156,360 B: -9,696 versus the discarded writer-only candidate, still +40,344 over the 21,116,016 B cap. No cap/profile/dependency change; not committed yet. Adding a separate ignored staging transport case that reuses the real passkey/50-user/10,000-row/128-PTY fixture and measures durable input on all 128 attached routes, without attempting an update. This isolates EA01 qualification from the missing encrypted backup provider; original review cases stay unchanged. It will also allow measured server optimization candidates if further code sharing cannot meet the cap; no unmeasured profile adoption.

Task/channel sharing candidate passes fmt, all-target server/CLI Clippy and the real WebSocket fence regression (including transport echoes and byte-budget release). Normal stable x86_64 image 21,156,360 B: -9,696 versus the discarded writer-only candidate, still +40,344 over the 21,116,016 B cap. No cap/profile/dependency change; not committed yet. Adding a separate ignored staging transport case that reuses the real passkey/50-user/10,000-row/128-PTY fixture and measures durable input on all 128 attached routes, without attempting an update. This isolates EA01 qualification from the missing encrypted backup provider; original review cases stay unchanged. It will also allow measured server optimization candidates if further code sharing cannot meet the cap; no unmeasured profile adoption.
kayg commented 2026-10-15 17:04:59 +00:00
Author
Owner
Copy link

138c80eab pushed: one independently owned task polls both reader and probes; reuse the already-linked byte channel and unit-output task machinery. Frame and byte bounds, ordered application delivery, cancellation and join retained. Expanded real WebSocket regression also verifies transport echoes during the application fence and released byte budget. Fmt, selected all-target Clippy and that test PASS: focused output. Normal stable x86_64 shipping artifact 21,156,360 B; still +40,344 over cap. No final size/gate pass claimed. Isolated transport harness and a server-only opt-level=z measurement are queued; no profile adoption without VM evidence, no cap increase.

138c80eab pushed: one independently owned task polls both reader and probes; reuse the already-linked byte channel and unit-output task machinery. Frame and byte bounds, ordered application delivery, cancellation and join retained. Expanded real WebSocket regression also verifies transport echoes during the application fence and released byte budget. Fmt, selected all-target Clippy and that test PASS: [focused output](https://git.kayg.org/attachments/7a9773c7-d76e-4eb8-9fe3-3d2228f43cc5). Normal stable x86_64 shipping artifact 21,156,360 B; still +40,344 over cap. No final size/gate pass claimed. Isolated transport harness and a server-only opt-level=z measurement are queued; no profile adoption without VM evidence, no cap increase.
kayg commented 2026-10-15 17:35:22 +00:00
Author
Owner
Copy link

b734a419c pushed: separate transport-only VM case, 1,024 durable-input requests over all 128 attached routes, 110 s sampling deadline, same real passkey/50-user/10,000-row/128-PTY fixture. It reports ACK p50/p99/max and enforces the local 50 ms allowance; it does not claim glyph, fresh TLS reconnect or update-recovery coverage. Original review cases unchanged. Fresh staging builds can measure explicit server s/z overrides; reuse plus override is refused. Fmt, all-target server/CLI Clippy, five pump tests and three staging-artifact tests PASS. Focused gate. Server-only z shipping-size measurement now runs; no profile adoption or cap increase. SQLite backup/restore prototype in owned scratch is queued for real WAL/page-size/refusal tests, not wired or claimed as EA04 completion.

b734a419c pushed: separate transport-only VM case, 1,024 durable-input requests over all 128 attached routes, 110 s sampling deadline, same real passkey/50-user/10,000-row/128-PTY fixture. It reports ACK p50/p99/max and enforces the local 50 ms allowance; it does not claim glyph, fresh TLS reconnect or update-recovery coverage. Original review cases unchanged. Fresh staging builds can measure explicit server s/z overrides; reuse plus override is refused. Fmt, all-target server/CLI Clippy, five pump tests and three staging-artifact tests PASS. [Focused gate](https://git.kayg.org/attachments/67bfd4e1-6a61-4b5a-ad60-b8473d63b25c). Server-only z shipping-size measurement now runs; no profile adoption or cap increase. SQLite backup/restore prototype in owned scratch is queued for real WAL/page-size/refusal tests, not wired or claimed as EA04 completion.
kayg commented 2026-10-15 17:38:19 +00:00
Author
Owner
Copy link

Unadopted server-only z experiment: normal production stable x86_64 image 20,864,008 B, -292,352 versus the current s image (21,156,360 B), -252,008 versus cap (21,116,016 B). Production-trust check PASS; SHA-256 ed5971c3109eb75364bb8cd2eef4722a20d60f752a30d294aa6b56a99604b789. No dependency, terminal/transport/crypto-engine profile or cap change; Cargo.toml remains s. Artifact recipe/hash, build receipt. Fresh staging s build runs before paired VM transport qualification; profile adoption remains conditional on performance evidence. Backup primitive prototype reuses SQLx ownership and exclusive handle guards; only backup-copy and padded deserialization need the narrow existing SQLite FFI. No backup/restore integration or new library choice claimed.

Unadopted server-only z experiment: normal production stable x86_64 image 20,864,008 B, -292,352 versus the current s image (21,156,360 B), -252,008 versus cap (21,116,016 B). Production-trust check PASS; SHA-256 ed5971c3109eb75364bb8cd2eef4722a20d60f752a30d294aa6b56a99604b789. No dependency, terminal/transport/crypto-engine profile or cap change; Cargo.toml remains s. [Artifact recipe/hash](https://git.kayg.org/attachments/1931dc49-079e-4c17-9f2f-6cd224a6c37e), [build receipt](https://git.kayg.org/attachments/96c8331d-7a5d-4718-89e7-76107cb7ecb3). Fresh staging s build runs before paired VM transport qualification; profile adoption remains conditional on performance evidence. Backup primitive prototype reuses SQLx ownership and exclusive handle guards; only backup-copy and padded deserialization need the narrow existing SQLite FFI. No backup/restore integration or new library choice claimed.
kayg commented 2026-10-15 17:56:58 +00:00
Author
Owner
Copy link

Transport-only s VM run failed before server readiness; no route/ACK measurement was produced. Machine infraternal-perf-test, kernel 6.12.111+deb13-amd64, load 0.64/0.16/0.08. Safe failure location deploy_staging_tests.rs:329. --collect removed useful failed-unit status (observed inactive/dead with default zero exit fields). Own VM directory was removed. Verbatim receipt. A retry reuses the same signed S artifact (1a4e74b7ec2dc803e98bd3c07b6ae2a41affb74ac3aa4e940845ccc272edf1f0) and rebuilds only the harness: retain failed-unit status until owned teardown and record LoadState/Result/exit fields, without unfiltered application logs. z performance remains unqualified.

Transport-only s VM run failed before server readiness; no route/ACK measurement was produced. Machine infraternal-perf-test, kernel 6.12.111+deb13-amd64, load 0.64/0.16/0.08. Safe failure location deploy_staging_tests.rs:329. `--collect` removed useful failed-unit status (observed inactive/dead with default zero exit fields). Own VM directory was removed. [Verbatim receipt](https://git.kayg.org/attachments/9a28d0f1-d5c4-441a-91b5-bbecc03130c3). A retry reuses the same signed S artifact (1a4e74b7ec2dc803e98bd3c07b6ae2a41affb74ac3aa4e940845ccc272edf1f0) and rebuilds only the harness: retain failed-unit status until owned teardown and record LoadState/Result/exit fields, without unfiltered application logs. z performance remains unqualified.
kayg commented 2026-10-15 18:15:43 +00:00
Author
Owner
Copy link

Head b734a419c. The first S-profile VM transport attempt failed before TCP readiness, so it produced no transport/performance result. Source attribution: listener_handoff::bind calls nix Backlog::new(4096); pinned libc 0.2.190 defines SOMAXCONN=128 for musl but 4096 for GNU, and nix 0.30.1 rejects values above that constant. Existing GNU lifecycle tests therefore miss the shipping-target failure. A musl build of the production listener lifecycle test is queued through build-slot to capture red before repair. Planned repair uses existing nix Backlog::MAXALLOWABLE on Linux/FreeBSD (kernel-configured limit), with MAXCONN elsewhere; no new dependency or kernel tuning. A fresh signed fixture is required after repair. D147 recovery and final VM/size gates remain incomplete.

Head b734a419c. The first S-profile VM transport attempt failed before TCP readiness, so it produced no transport/performance result. Source attribution: listener_handoff::bind calls nix Backlog::new(4096); pinned libc 0.2.190 defines SOMAXCONN=128 for musl but 4096 for GNU, and nix 0.30.1 rejects values above that constant. Existing GNU lifecycle tests therefore miss the shipping-target failure. A musl build of the production listener lifecycle test is queued through build-slot to capture red before repair. Planned repair uses existing nix Backlog::MAXALLOWABLE on Linux/FreeBSD (kernel-configured limit), with MAXCONN elsewhere; no new dependency or kernel tuning. A fresh signed fixture is required after repair. D147 recovery and final VM/size gates remain incomplete.
kayg commented 2026-10-15 18:22:55 +00:00
Author
Owner
Copy link

D147 recovery implementation scope, before changing the private handoff contract: snapshot via the already-pinned SQLite engine/API into bounded process memory; encrypt persisted DB + CA/config state with an independent D186 backup key (never derive it from the CA signing key). Preparation must run after the foreground fence while retaining the configuration/SQLite writer lease, not before admission. Fatal-image recovery must restore before predecessor migrations and must not depend on a key surviving in the crashed process. The current backup plugin is metadata-only; the production prepare_recovery default remains refusing. A scratch real-WAL snapshot/restore prototype is compiling; no plaintext backup/provider has been integrated or claimed complete.

Native investigation: ten alternating A/B pairs are now running under the perf VM lock with the normal-production-recipe S artifact (runtime 138c80eab; source head b734a419c) and matched baseline 8e7467c07c. These are diagnostic, not final-head qualification; per-run artifacts, load and results will be retained.

D147 recovery implementation scope, before changing the private handoff contract: snapshot via the already-pinned SQLite engine/API into bounded process memory; encrypt persisted DB + CA/config state with an independent D186 backup key (never derive it from the CA signing key). Preparation must run after the foreground fence while retaining the configuration/SQLite writer lease, not before admission. Fatal-image recovery must restore before predecessor migrations and must not depend on a key surviving in the crashed process. The current backup plugin is metadata-only; the production prepare_recovery default remains refusing. A scratch real-WAL snapshot/restore prototype is compiling; no plaintext backup/provider has been integrated or claimed complete. Native investigation: ten alternating A/B pairs are now running under the perf VM lock with the normal-production-recipe S artifact (runtime 138c80eab; source head b734a419c) and matched baseline 8e7467c07cd2ec1668a775a846076b278f68ef38. These are diagnostic, not final-head qualification; per-run artifacts, load and results will be retained.
kayg commented 2026-10-15 18:26:58 +00:00
Author
Owner
Copy link

SQLite recovery primitive: 4 real-engine functional tests pass in owned scratch using the already-pinned sqlx 0.8.6 / libsqlite3-sys 0.30.1. WAL snapshot restores committed data in place; 8192-byte page geometry survives; malformed images leave live records intact; applying actual SQLx migration 26 makes the predecessor refuse VersionMissing(26), and restoring the snapshot permits predecessor migration/startup with earlier data. Source and immutable functional output attached below. Clippy remains running. No production provider, encryption/key custody, guardian or updater integration is claimed.

Functional output · Reproducible prototype source · Source hashes. Timings printed by the build-host test runner are operational output, not performance evidence.

SQLite recovery primitive: 4 real-engine functional tests pass in owned scratch using the already-pinned sqlx 0.8.6 / libsqlite3-sys 0.30.1. WAL snapshot restores committed data in place; 8192-byte page geometry survives; malformed images leave live records intact; applying actual SQLx migration 26 makes the predecessor refuse VersionMissing(26), and restoring the snapshot permits predecessor migration/startup with earlier data. Source and immutable functional output attached below. Clippy remains running. No production provider, encryption/key custody, guardian or updater integration is claimed. [Functional output](https://git.kayg.org/attachments/d2c02eca-1371-4e5b-9fb6-8e75a2950f7d) · [Reproducible prototype source](https://git.kayg.org/attachments/0d881238-55c1-435f-8b56-1383868f6833) · [Source hashes](https://git.kayg.org/attachments/783dbef8-56aa-4988-b10f-aeab7c921e07). Timings printed by the build-host test runner are operational output, not performance evidence.
kayg commented 2026-10-15 18:55:48 +00:00
Author
Owner
Copy link

EA-02 diagnostic: 10 interleaved A/B pairs complete (AB/BA alternating; 100 samples/phase, 3 real PTYs, configured RTT 300 ms, 4-vCPU perf VM, each run independently flock-locked in CPUWeight=10000 scope). Baseline 8e7467c07c vs normal-production-recipe S candidate runtime 138c80eab, source head b734a419c; artifact hashes attached.

Same-PTY echo p99 median: baseline 413.495 ms, candidate 413.270 ms; failures 10/10 vs 9/10 at 334 ms. Candidate lower in 6/10 pairs. Paired mean difference -0.889 ms, approximate 95% t interval [-24.710,22.932] ms. Same-PTY flood-growth median 86.750 vs 85.665 ms, failures 9/10 vs 8/10 at 16.67 ms; paired mean difference -1.016 ms, interval [-23.806,21.774] ms. ACK failures 9/10 on both.

The baseline failure is established; there is no detected candidate-specific slowdown, but this interval does not rule out a one-frame slowdown. This is neither an absolute latency pass nor final-head/size qualification. EA-02 stays open for final-artifact qualification. Machine/load and all 20 raw outputs: receipts and runner, paired summary, artifact identities. Owned remote fixture directory was removed by the runner.

Musl startup regression captured before repair: production lifecycle test returns EINVAL in bind, red receipt. Existing nix kernel-limit repair is uncommitted pending gates. SQLite prototype now passes all four functional cases and Clippy: complete prototype gate. Encrypted backup integration remains incomplete.

EA-02 diagnostic: 10 interleaved A/B pairs complete (AB/BA alternating; 100 samples/phase, 3 real PTYs, configured RTT 300 ms, 4-vCPU perf VM, each run independently flock-locked in CPUWeight=10000 scope). Baseline 8e7467c07cd2ec1668a775a846076b278f68ef38 vs normal-production-recipe S candidate runtime 138c80eab, source head b734a419c; artifact hashes attached. Same-PTY echo p99 median: baseline 413.495 ms, candidate 413.270 ms; failures 10/10 vs 9/10 at 334 ms. Candidate lower in 6/10 pairs. Paired mean difference -0.889 ms, approximate 95% t interval [-24.710,22.932] ms. Same-PTY flood-growth median 86.750 vs 85.665 ms, failures 9/10 vs 8/10 at 16.67 ms; paired mean difference -1.016 ms, interval [-23.806,21.774] ms. ACK failures 9/10 on both. The baseline failure is established; there is no detected candidate-specific slowdown, but this interval does not rule out a one-frame slowdown. This is neither an absolute latency pass nor final-head/size qualification. EA-02 stays open for final-artifact qualification. Machine/load and all 20 raw outputs: [receipts and runner](https://git.kayg.org/attachments/79f95bf0-df49-442e-af54-24fea241d99d), [paired summary](https://git.kayg.org/attachments/2039be31-ef51-4c2d-8f49-4081e284b103), [artifact identities](https://git.kayg.org/attachments/77194055-2408-47ce-aaeb-9c3e17db2f5d). Owned remote fixture directory was removed by the runner. Musl startup regression captured before repair: production lifecycle test returns EINVAL in bind, [red receipt](https://git.kayg.org/attachments/510b417e-e05f-419e-ba41-fc436619ed79). Existing nix kernel-limit repair is uncommitted pending gates. SQLite prototype now passes all four functional cases and Clippy: [complete prototype gate](https://git.kayg.org/attachments/5e18104a-2d20-4adf-8239-78fa9df2e05d). Encrypted backup integration remains incomplete.
kayg commented 2026-10-15 19:01:38 +00:00
Author
Owner
Copy link

Committed and pushed ed5d280b6e: optional backup/shim dependency edges to the existing SQLx/libsqlite3-sys engine, plus Tokio test support. No new package versions, active default runtime features or snapshot/provider behavior. Metadata-only dependency tree excludes SQLx and the shim crate.

Focused gate through build-slot: fmt passed; shim/backup all-target Clippy -D warnings passed; shim tests 80 passed / 13 ignored / 0 failed; backup metadata test 1 passed / 0 failed. Gate output.

The kernel-limit listener repair remains uncommitted pending crate checks. Its shipping-musl regression is red before repair and 2/2 green after it, including same-PID exec, closed stdin, queued connection, legacy fallback and ignored parent manifests: red, green. SQLite primitives/provider, updated signed VM acceptance, size/profile qualification and final iterate/fast remain outstanding; updates still refuse without recovery.

Committed and pushed ed5d280b6e6e97465030f679ea2be0b45f21103e: optional backup/shim dependency edges to the existing SQLx/libsqlite3-sys engine, plus Tokio test support. No new package versions, active default runtime features or snapshot/provider behavior. Metadata-only dependency tree excludes SQLx and the shim crate. Focused gate through build-slot: fmt passed; shim/backup all-target Clippy -D warnings passed; shim tests 80 passed / 13 ignored / 0 failed; backup metadata test 1 passed / 0 failed. [Gate output](https://git.kayg.org/attachments/03193f81-3b57-4194-8b72-2cc5a86d2893). The kernel-limit listener repair remains uncommitted pending crate checks. Its shipping-musl regression is red before repair and 2/2 green after it, including same-PID exec, closed stdin, queued connection, legacy fallback and ignored parent manifests: [red](https://git.kayg.org/attachments/510b417e-e05f-419e-ba41-fc436619ed79), [green](https://git.kayg.org/attachments/70b96d4d-7e03-4c07-ac77-d6e8f525da38). SQLite primitives/provider, updated signed VM acceptance, size/profile qualification and final iterate/fast remain outstanding; updates still refuse without recovery.
kayg commented 2026-10-15 19:03:16 +00:00
Author
Owner
Copy link

Listener author-review finding (source analysis, not yet a VM claim): bind adopts only an exact local_addr match. If the configured listener address has port 0, exec repeats that configuration, cannot match the inherited actual nonzero port, and can leave the old queue without an acceptor while binding a new port. The registry needs to preserve this configuration fact and either support unambiguous adoption or refuse export before shutdown. I will add a failing functional regression before changing that behavior; no port-zero continuity claim is made. Current backlog fix has 2/2 shipping-musl lifecycle tests green; package gate is queued.

Listener author-review finding (source analysis, not yet a VM claim): bind adopts only an exact local_addr match. If the configured listener address has port 0, exec repeats that configuration, cannot match the inherited actual nonzero port, and can leave the old queue without an acceptor while binding a new port. The registry needs to preserve this configuration fact and either support unambiguous adoption or refuse export before shutdown. I will add a failing functional regression before changing that behavior; no port-zero continuity claim is made. Current backlog fix has 2/2 shipping-musl lifecycle tests green; package gate is queued.
kayg commented 2026-10-15 19:33:35 +00:00
Author
Owner
Copy link

Committed and pushed 26c92a6e66: replace the rejected musl Backlog::new(4096) call with the existing kernel-limit API; no dependency or kernel-setting change. Shipping-libc lifecycle red/green receipts remain linked above.

Package gate through build-slot: fmt and four-package all-target Clippy -D warnings passed; native listener tests 2 passed; update-pump helpers 5 passed; staging artifacts 3 passed; shim tests 80 passed / 13 ignored; backup metadata 1 passed. The initial WebSocket module filter selected zero tests; the corrected function filter ran websocket::transport::tests::browser_probes_continue_while_application_processing_is_fenced and passed 1/1. Primary gate, corrected fence test.

The ASan Rust handoff/parser fuzzer completed 100000 inputs without a crash (coverage 134, features 223); both capability predicates are observable through black_box. Raw functional fuzz receipt. Build-host durations/RSS in these raw logs are operational, not performance evidence. The fuzz-target source change is pending its own Clippy/commit.

The port-zero export guard has a red shipping-libc regression and a three-test green draft in scratch, not yet applied. Snapshot primitive files are unwired in the worktree and pass five real-SQLite scratch tests plus pedantic Clippy. Encrypted provider integration, fresh signed VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 26c92a6e660b87da2c87e8b827f1fd1e6172f6ca: replace the rejected musl Backlog::new(4096) call with the existing kernel-limit API; no dependency or kernel-setting change. Shipping-libc lifecycle red/green receipts remain linked above. Package gate through build-slot: fmt and four-package all-target Clippy -D warnings passed; native listener tests 2 passed; update-pump helpers 5 passed; staging artifacts 3 passed; shim tests 80 passed / 13 ignored; backup metadata 1 passed. The initial WebSocket module filter selected zero tests; the corrected function filter ran websocket::transport::tests::browser_probes_continue_while_application_processing_is_fenced and passed 1/1. [Primary gate](https://git.kayg.org/attachments/3b4b36d9-c0fb-4501-9b05-8d6efd20cbc0), [corrected fence test](https://git.kayg.org/attachments/29e2afd1-980a-4a68-866c-9ea80b809609). The ASan Rust handoff/parser fuzzer completed 100000 inputs without a crash (coverage 134, features 223); both capability predicates are observable through black_box. [Raw functional fuzz receipt](https://git.kayg.org/attachments/82ae14ca-68f7-4b25-8b01-9c3b181f6a7c). Build-host durations/RSS in these raw logs are operational, not performance evidence. The fuzz-target source change is pending its own Clippy/commit. The port-zero export guard has a red shipping-libc regression and a three-test green draft in scratch, not yet applied. Snapshot primitive files are unwired in the worktree and pass five real-SQLite scratch tests plus pedantic Clippy. Encrypted provider integration, fresh signed VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 20:13:25 +00:00
Author
Owner
Copy link

Before additive custody API wiring: reuse the existing CA AES-256-GCM operations in one optional plugin-api helper, then make both CA and backup consumers call it. The CA encrypted-copy wire format stays unchanged. The unwired draft seals with fresh nonces and authenticates into caller-owned storage; errors/unwinding clear partial output, with no full-buffer clearing pass on success. Four functional/pedantic checks pass against the already-built pinned library, including existing-cipher interoperability and all-field tampering. Draft source, checks. No new cipher/library is selected.

Key-administration draft: share the existing explicit administrator-generation reads; preserve the CA facade and use independent backup pending-ceremony registries around Auth::login_start/verify_passkey. Ordinary login consumption cannot authorize a key operation. Owner flags are not a substitute for membership, and proof completion must recheck live session, credential, generation and time under the writer transaction before key installation. These helpers remain unwired and do not satisfy the encrypted-provider requirement.

Proof tooling will separate public fixture preparation from measurement so a host build slot is released before waiting on the independent VM lock. The queued atomic primitive sequence will gate/commit this small tool change separately; fresh S/Z transport measurements still return before publication or application.

Before additive custody API wiring: reuse the existing CA AES-256-GCM operations in one optional plugin-api helper, then make both CA and backup consumers call it. The CA encrypted-copy wire format stays unchanged. The unwired draft seals with fresh nonces and authenticates into caller-owned storage; errors/unwinding clear partial output, with no full-buffer clearing pass on success. Four functional/pedantic checks pass against the already-built pinned library, including existing-cipher interoperability and all-field tampering. [Draft source](https://git.kayg.org/attachments/822ccda8-59d9-4cd5-8bb6-b0c8fc392893), [checks](https://git.kayg.org/attachments/019b121f-50ae-4863-b5a2-65ccd9b6a1b7). No new cipher/library is selected. Key-administration draft: share the existing explicit administrator-generation reads; preserve the CA facade and use independent backup pending-ceremony registries around Auth::login_start/verify_passkey. Ordinary login consumption cannot authorize a key operation. Owner flags are not a substitute for membership, and proof completion must recheck live session, credential, generation and time under the writer transaction before key installation. These helpers remain unwired and do not satisfy the encrypted-provider requirement. Proof tooling will separate public fixture preparation from measurement so a host build slot is released before waiting on the independent VM lock. The queued atomic primitive sequence will gate/commit this small tool change separately; fresh S/Z transport measurements still return before publication or application.
kayg commented 2026-10-15 20:38:38 +00:00
Author
Owner
Copy link

Recovery primitive finding: a successor that changes the database from 4096-byte to 8192-byte pages in WAL mode prevented restoration of the predecessor snapshot. The new real-engine regression failed before the fix. Restore now leaves WAL only when geometry differs, requires the mode transition to succeed before copying, and restores WAL after the copy, including a failed copy. All serving connections must already be stopped.

Exact worktree source: crates/plugins/backup/src/database.rs; test predecessor_geometry_is_restored_after_successor_changes_it in the external prototype, queued for the repository integration-test slice. Six real-engine tests and pedantic Clippy pass. These are functional results; no build-host timings are performance evidence. The encrypted production recovery provider remains incomplete.

sqlite-changed-geometry-red.log
sqlite-changed-geometry-green.log
sqlite-changed-geometry-clippy.log

Recovery primitive finding: a successor that changes the database from 4096-byte to 8192-byte pages in WAL mode prevented restoration of the predecessor snapshot. The new real-engine regression failed before the fix. Restore now leaves WAL only when geometry differs, requires the mode transition to succeed before copying, and restores WAL after the copy, including a failed copy. All serving connections must already be stopped. Exact worktree source: crates/plugins/backup/src/database.rs; test predecessor_geometry_is_restored_after_successor_changes_it in the external prototype, queued for the repository integration-test slice. Six real-engine tests and pedantic Clippy pass. These are functional results; no build-host timings are performance evidence. The encrypted production recovery provider remains incomplete. [sqlite-changed-geometry-red.log](https://git.kayg.org/attachments/432b3490-186d-423d-9999-9364cde4c32c) [sqlite-changed-geometry-green.log](https://git.kayg.org/attachments/b416bdc0-6fc4-4da6-a4ea-b4989053cce2) [sqlite-changed-geometry-clippy.log](https://git.kayg.org/attachments/b763ab06-fd91-41b3-b4c5-9a76ea81a075)
kayg commented 2026-10-15 20:39:57 +00:00
Author
Owner
Copy link

D147/D186 implementation direction, before runtime/API wiring: reuse the existing AES-256-GCM engine through a shared optional sealed-bytes helper; retain CA encrypted-copy compatibility while removing its duplicate cipher invocation. The backup component owns a separate random key, encrypted per explicit current administrator generation with a backup-specific passkey derivation/ceremony domain. A retained public SHA-256 key identity prevents substituting an unrelated backup key. Copy installation still requires a fresh purpose-bound proof and serialized membership recheck; possession of encrypted metadata is never authority. Key plaintext is returned only into caller-owned protected storage.

Unwired draft crates/plugins/backup/src/key_copy.rs binds version, key identity, member, generation and derivation salt into authenticated data. Seven functional cipher/copy tests pass with strict pedantic Clippy against already-built pinned libraries, including altered bindings, wrong administrator/wrapping key, unknown fields, bounds and failure wiping. The draft is not a shipping provider.

Planned additive admission hook: checkpoint only after foreground activity is frozen and while the existing authority/configuration lease remains held; refusal releases the fence without stopping the serving runtime. A pre-admission snapshot is insufficient because later foreground mutations could otherwise be lost. Runtime recovery must finish before predecessor migrations and must remain fail-closed until encrypted DB/CA/config recovery is wired and tested. No decision or foundational engine change is proposed.

key-copy-prototype-gate.log

D147/D186 implementation direction, before runtime/API wiring: reuse the existing AES-256-GCM engine through a shared optional sealed-bytes helper; retain CA encrypted-copy compatibility while removing its duplicate cipher invocation. The backup component owns a separate random key, encrypted per explicit current administrator generation with a backup-specific passkey derivation/ceremony domain. A retained public SHA-256 key identity prevents substituting an unrelated backup key. Copy installation still requires a fresh purpose-bound proof and serialized membership recheck; possession of encrypted metadata is never authority. Key plaintext is returned only into caller-owned protected storage. Unwired draft crates/plugins/backup/src/key_copy.rs binds version, key identity, member, generation and derivation salt into authenticated data. Seven functional cipher/copy tests pass with strict pedantic Clippy against already-built pinned libraries, including altered bindings, wrong administrator/wrapping key, unknown fields, bounds and failure wiping. The draft is not a shipping provider. Planned additive admission hook: checkpoint only after foreground activity is frozen and while the existing authority/configuration lease remains held; refusal releases the fence without stopping the serving runtime. A pre-admission snapshot is insufficient because later foreground mutations could otherwise be lost. Runtime recovery must finish before predecessor migrations and must remain fail-closed until encrypted DB/CA/config recovery is wired and tested. No decision or foundational engine change is proposed. [key-copy-prototype-gate.log](https://git.kayg.org/attachments/9d6d0b18-45fd-4cf2-9836-5fce0e2b3982)
kayg commented 2026-10-15 20:49:12 +00:00
Author
Owner
Copy link

Resource wait: the owned build-slot wrapper (PID 1819305, queued about 21:35 local) still has not started its child at 22:51 local. Current pushed head remains 26c92a6e6. No other job was stopped, no slot configuration changed, and no priority bypass requested. The prepared gate/atomic-commit sequence remains queued; it will stop on any failure. In parallel, optional encrypted key/resource/protected-memory drafts and exact legacy CA interoperability tests have been prepared. Shipping update recovery remains fail-closed and incomplete. Need: a managed host build slot to become free; no owner decision or credential access is needed. Final fast and fresh VM acceptance have not run.

Resource wait: the owned build-slot wrapper (PID 1819305, queued about 21:35 local) still has not started its child at 22:51 local. Current pushed head remains 26c92a6e6. No other job was stopped, no slot configuration changed, and no priority bypass requested. The prepared gate/atomic-commit sequence remains queued; it will stop on any failure. In parallel, optional encrypted key/resource/protected-memory drafts and exact legacy CA interoperability tests have been prepared. Shipping update recovery remains fail-closed and incomplete. Need: a managed host build slot to become free; no owner decision or credential access is needed. Final fast and fresh VM acceptance have not run.
kayg commented 2026-10-15 20:49:17 +00:00
Author
Owner
Copy link

Timestamp correction to the preceding resource-wait note: observed local time was 22:49, not 22:51 (about 74 minutes queued). Other status is unchanged.

Timestamp correction to the preceding resource-wait note: observed local time was 22:49, not 22:51 (about 74 minutes queued). Other status is unchanged.
kayg commented 2026-10-15 20:51:25 +00:00
Author
Owner
Copy link

Additive host-adapter contract proposed before implementation (D16/D198): the backup component needs a private HTTP ceremony endpoint because a scoped wrapping key must never enter the ordinary plugin message/recording path. Reuse the existing bounded, protected CA request intake and real passkey verifier. Declare action names/permissions once; a generic optional plugin HTTP adapter supplies namespaced routes, and the host enforces enabled-generation admission, same-origin authenticated requests, bounded concurrency/deadlines and lifecycle cancellation. Disabled components must admit no new request and retain no key, worker or registration. Metadata inspection must create neither routes with authority nor background work. No additional HTTP, crypto or database engine is proposed.

The backup-specific ceremony registry will bind the current session hash, exact administrator generation, challenge expiry and operation purpose; a fresh ordinary browser session alone will not unlock a key. An encrypted copy remains public metadata, never a substitute for that proof. This is a proposed additive API direction, not a shipped endpoint or completed recovery provider. Existing CA wire compatibility must be preserved by tests before extracting request/cipher helpers.

Additive host-adapter contract proposed before implementation (D16/D198): the backup component needs a private HTTP ceremony endpoint because a scoped wrapping key must never enter the ordinary plugin message/recording path. Reuse the existing bounded, protected CA request intake and real passkey verifier. Declare action names/permissions once; a generic optional plugin HTTP adapter supplies namespaced routes, and the host enforces enabled-generation admission, same-origin authenticated requests, bounded concurrency/deadlines and lifecycle cancellation. Disabled components must admit no new request and retain no key, worker or registration. Metadata inspection must create neither routes with authority nor background work. No additional HTTP, crypto or database engine is proposed. The backup-specific ceremony registry will bind the current session hash, exact administrator generation, challenge expiry and operation purpose; a fresh ordinary browser session alone will not unlock a key. An encrypted copy remains public metadata, never a substitute for that proof. This is a proposed additive API direction, not a shipped endpoint or completed recovery provider. Existing CA wire compatibility must be preserved by tests before extracting request/cipher helpers.
kayg commented 2026-10-15 21:03:46 +00:00
Author
Owner
Copy link

Backend/private-adapter refinement before implementation: keep HTTP parsing, cookies and protected page ownership in the host; use an optional private-action interface with the existing ActionDef/SocketHost and task registry. The plugin API does not gain an HTTP engine or a dependency on the PTY implementation. The real host verifier supplies opaque proof metadata; the component retains purpose/session/generation binding. Shared administrator checks live beside the existing shared session query in infraternal-plugin-api, rather than forcing backup code to depend on the server crate.

Proposed additive recovery readiness states and exact deferred UI copy (not implemented UI):

  • needs_setup: “Set up backups to apply updates.”
  • locked: “Unlock backups to apply updates.”
  • missing_administrator_copies: “Finish backup access for all administrators to apply updates.”
  • preparing: “Preparing recovery backup…”
  • preparation_failed: “The recovery backup could not be prepared. Your server is still running.”
  • ready: existing “Update ready · {version}” Inbox item and one-time ready event remain per version; the notes link remains available while recovery is blocked.

These readiness blocks must not mark an otherwise valid image as failed/ignored. Preparation must run only after the foreground fence and under the existing configuration/authority lease. An earlier snapshot could omit later input-related state. The production provider and typed readiness/wake behavior remain unfinished; the current default refusal still protects serving state.

Backend/private-adapter refinement before implementation: keep HTTP parsing, cookies and protected page ownership in the host; use an optional private-action interface with the existing ActionDef/SocketHost and task registry. The plugin API does not gain an HTTP engine or a dependency on the PTY implementation. The real host verifier supplies opaque proof metadata; the component retains purpose/session/generation binding. Shared administrator checks live beside the existing shared session query in infraternal-plugin-api, rather than forcing backup code to depend on the server crate. Proposed additive recovery readiness states and exact deferred UI copy (not implemented UI): - needs_setup: “Set up backups to apply updates.” - locked: “Unlock backups to apply updates.” - missing_administrator_copies: “Finish backup access for all administrators to apply updates.” - preparing: “Preparing recovery backup…” - preparation_failed: “The recovery backup could not be prepared. Your server is still running.” - ready: existing “Update ready · {version}” Inbox item and one-time ready event remain per version; the notes link remains available while recovery is blocked. These readiness blocks must not mark an otherwise valid image as failed/ignored. Preparation must run only after the foreground fence and under the existing configuration/authority lease. An earlier snapshot could omit later input-related state. The production provider and typed readiness/wake behavior remain unfinished; the current default refusal still protects serving state.
kayg commented 2026-10-15 21:05:35 +00:00
Author
Owner
Copy link

Committed and pushed 0b1d75e09f: Refuse unidentifiable listener exports before shutdown (D128, D259).

Listener-v1 cannot map a configured port of zero to its inherited nonzero port. Retain the configured address with each live listener and refuse export before shutting down the serving runtime. Guessing by IP or descriptor order could adopt a different service socket; silently rebinding would leave clients on an unserved old queue. Fixed-port same-PID and legacy lifecycle behavior remains covered, with a reserved socket fixture that avoids a release/rebind race. The shipping-libc refusal regression was red before this change and the three lifecycle tests are green afterward.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.00s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 487 filtered out; finished in 0.03s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.26s

listener-fixed-port-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 0b1d75e09f6456643dff79fe117067aaf5cf447e: Refuse unidentifiable listener exports before shutdown (D128, D259). Listener-v1 cannot map a configured port of zero to its inherited nonzero port. Retain the configured address with each live listener and refuse export before shutting down the serving runtime. Guessing by IP or descriptor order could adopt a different service socket; silently rebinding would leave clients on an unserved old queue. Fixed-port same-PID and legacy lifecycle behavior remains covered, with a reserved socket fixture that avoids a release/rebind race. The shipping-libc refusal regression was red before this change and the three lifecycle tests are green afterward. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.00s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 487 filtered out; finished in 0.03s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.26s ``` [listener-fixed-port-gate.log](https://git.kayg.org/attachments/7678e1e6-a8af-42e4-8dd7-27b5e34f5ca5) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 21:06:58 +00:00
Author
Owner
Copy link

Committed and pushed a96b60be68: Audit guarded SQLite backup and memory import (D147, D186).

Expose the pinned engine online-backup API only behind sqlite-backup. SQLx handle guards exclude its workers, the backup handle finishes exactly once, and incomplete copies roll back. Bounded padded import transfers allocation ownership to SQLite and refuses persistent destinations before deserialization can detach their files. Plain file copies miss live WAL state; unchecked deserialization can replace the wrong connection storage. Six real-engine tests compile this exact worktree source, including red/green persistent-target refusal, changed WAL page geometry and predecessor migration recovery. This is a primitive, not an encrypted recovery provider.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 92 filtered out; finished in 0.01s
test result: ok. 80 passed; 0 failed; 13 ignored; 0 measured; 0 filtered out; finished in 59.37s
test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s

sqlite-backup-bridge-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed a96b60be68b2d2eef901938930bd842adb565a7f: Audit guarded SQLite backup and memory import (D147, D186). Expose the pinned engine online-backup API only behind sqlite-backup. SQLx handle guards exclude its workers, the backup handle finishes exactly once, and incomplete copies roll back. Bounded padded import transfers allocation ownership to SQLite and refuses persistent destinations before deserialization can detach their files. Plain file copies miss live WAL state; unchecked deserialization can replace the wrong connection storage. Six real-engine tests compile this exact worktree source, including red/green persistent-target refusal, changed WAL page geometry and predecessor migration recovery. This is a primitive, not an encrypted recovery provider. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 92 filtered out; finished in 0.01s test result: ok. 80 passed; 0 failed; 13 ignored; 0 measured; 0 filtered out; finished in 59.37s test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.62s ``` [sqlite-backup-bridge-gate.log](https://git.kayg.org/attachments/531ac5a9-e86b-4175-9983-4828a3842e38) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 21:07:11 +00:00
Author
Owner
Copy link

Committed and pushed 5ac74c0a67: Snapshot live WAL state and restore predecessor data in memory (D147).

Freeze a read transaction before page sizing and copy with the shared SQLite backup bridge into a matching in-memory page geometry. Bound images to 64 MiB, wipe serialized snapshots on drop, check imported integrity before touching persistent data, and restore transactionally in place. A raw database-file copy can omit committed WAL pages; replacing a live database inode bypasses existing connection ownership. Hosts must drive the synchronous engine step on an owned blocking worker. The optional module adds no enabled runtime or plaintext backup files.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.45s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

backup-database-snapshot-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 5ac74c0a67eb72d4eea79bff4551cb0cd19ba508: Snapshot live WAL state and restore predecessor data in memory (D147). Freeze a read transaction before page sizing and copy with the shared SQLite backup bridge into a matching in-memory page geometry. Bound images to 64 MiB, wipe serialized snapshots on drop, check imported integrity before touching persistent data, and restore transactionally in place. A raw database-file copy can omit committed WAL pages; replacing a live database inode bypasses existing connection ownership. Hosts must drive the synchronous engine step on an owned blocking worker. The optional module adds no enabled runtime or plaintext backup files. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.45s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [backup-database-snapshot-gate.log](https://git.kayg.org/attachments/40aff4f6-a9de-4627-b742-143e46d35605) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 21:12:14 +00:00
Author
Owner
Copy link

Recovery integration invariant identified during the D147 implementation: a manual rollback after healthy service has accepted auth changes must not revive revoked credentials, sessions or administrator generations from the pre-upgrade database. It also must retain currently valid browser authority needed for D128 session continuity. Automatic recovery of a failed image must occur before that image accepts foreground traffic.

Implementation direction: validate compatibility and the recovery plan before shutdown; preserve current security state where it is compatible with the predecessor schema, and refuse before swap when that cannot be established. Do not silently replay stale authorization rows or discard live sessions as a workaround. Add a real-engine revocation/continuity regression alongside migration recovery. The existing six SQLite tests prove engine consistency and predecessor migration restoration only; they do not yet establish this authorization invariant or full production recovery. No decision change or owner approval is requested.

Recovery integration invariant identified during the D147 implementation: a manual rollback after healthy service has accepted auth changes must not revive revoked credentials, sessions or administrator generations from the pre-upgrade database. It also must retain currently valid browser authority needed for D128 session continuity. Automatic recovery of a failed image must occur before that image accepts foreground traffic. Implementation direction: validate compatibility and the recovery plan before shutdown; preserve current security state where it is compatible with the predecessor schema, and refuse before swap when that cannot be established. Do not silently replay stale authorization rows or discard live sessions as a workaround. Add a real-engine revocation/continuity regression alongside migration recovery. The existing six SQLite tests prove engine consistency and predecessor migration restoration only; they do not yet establish this authorization invariant or full production recovery. No decision change or owner approval is requested.
kayg commented 2026-10-15 21:16:14 +00:00
Author
Owner
Copy link

Additional locked perf-VM diagnostics, separate from the earlier ten uninstrumented A/B pairs: normal baseline 8e7467c07 and candidate runtime 138c80eab (not final head; candidate S image remains over cap and is not a shipping result). VM: 4 CPUs, MemTotal 8069112 kB; each receipt records load; CPUWeight=10000, short separate measurement locks and owned cleanup.

Instrumented proxy pair, 100 samples per phase: same-PTY echo p99 baseline/candidate 464.72/468.17 ms; from-agent proxy maximum release lag 4.752/3.709 ms, maximum send blocking 1.140/2.252 ms, queue high water 1049651/1049631 B. These counters do not give a full end-to-end attribution.

Separate first-event diagnostic pair, 100 samples × three phases × two binaries: zero ACK or echo timestamp overwrites across all 600 keystroke samples. First-event and reported p99s were identical. Same-PTY echo p99 baseline/candidate 471.636/452.074 ms; corresponding growth 143.30/125.13 ms, both failing unchanged budgets. The timestamp-overwrite hypothesis did not reproduce; no gate code or thresholds were changed. Instrumentation can perturb scheduling, so these are diagnostics, not acceptance or equivalence proof. Native P1/final artifact qualification remains open.

native-proxy-and-first-event-diagnostics.zip

Additional locked perf-VM diagnostics, separate from the earlier ten uninstrumented A/B pairs: normal baseline 8e7467c07 and candidate runtime 138c80eab (not final head; candidate S image remains over cap and is not a shipping result). VM: 4 CPUs, MemTotal 8069112 kB; each receipt records load; CPUWeight=10000, short separate measurement locks and owned cleanup. Instrumented proxy pair, 100 samples per phase: same-PTY echo p99 baseline/candidate 464.72/468.17 ms; from-agent proxy maximum release lag 4.752/3.709 ms, maximum send blocking 1.140/2.252 ms, queue high water 1049651/1049631 B. These counters do not give a full end-to-end attribution. Separate first-event diagnostic pair, 100 samples × three phases × two binaries: zero ACK or echo timestamp overwrites across all 600 keystroke samples. First-event and reported p99s were identical. Same-PTY echo p99 baseline/candidate 471.636/452.074 ms; corresponding growth 143.30/125.13 ms, both failing unchanged budgets. The timestamp-overwrite hypothesis did not reproduce; no gate code or thresholds were changed. Instrumentation can perturb scheduling, so these are diagnostics, not acceptance or equivalence proof. Native P1/final artifact qualification remains open. [native-proxy-and-first-event-diagnostics.zip](https://git.kayg.org/attachments/4998c1e3-239f-41d4-948d-631dd3dbc1ae)
kayg commented 2026-10-15 21:47:46 +00:00
Author
Owner
Copy link

Resume record at pushed head 5ac74c0a67: an unwired backup authority now binds setup/enrollment/unlock to session hash, explicit administrator generation, purpose, challenge expiry and the original weak plugin admission epoch. It rechecks proof/session authority after durable publication, transfers the existing protected allocation into process state, and never auto-generates a replacement for an existing key identity. Record encryption also binds a unique authenticated manifest index to prevent per-file ciphertext substitution.

Eight component tests are prepared using real SQLite and encryption with a controlled proof source: setup/unlock/cold continuity, purpose/replay, membership revocation, credential deletion, superseded epoch, expiry during publication, non-owner explicit administrator, and re-enrollment preserving key identity. These are not yet green and do not substitute for the real host-verifier or HTTP/VM integration tests. A standalone source prototype and strict Clippy check are queued, alongside the already-queued primitive gates.

Owned queued command: build-slot python3 $HOME/.cache/codex-scratch/edge-autoupdate/resume-gated-slices.py (wrapper PID 2723400). Earlier workflow prefixes must not be rerun: they already committed exports. The current continuation begins with the captured snapshot-cancellation red/green slice, then six repository DB tests, remaining fixture/fuzz harness steps, iterate, fresh S/Z fixture preparation and optional key/interface commits. Production encrypted checkpoint storage, private HTTP routing, startup guardian/recovery, security-state continuity, full VM acceptance, final size/profile qualification and final fast remain unfinished.

Source receipt for the unwired work (no keys or credentials):
backup-authority-unwired-draft.zip

Resume record at pushed head 5ac74c0a67eb72d4eea79bff4551cb0cd19ba508: an unwired backup authority now binds setup/enrollment/unlock to session hash, explicit administrator generation, purpose, challenge expiry and the original weak plugin admission epoch. It rechecks proof/session authority after durable publication, transfers the existing protected allocation into process state, and never auto-generates a replacement for an existing key identity. Record encryption also binds a unique authenticated manifest index to prevent per-file ciphertext substitution. Eight component tests are prepared using real SQLite and encryption with a controlled proof source: setup/unlock/cold continuity, purpose/replay, membership revocation, credential deletion, superseded epoch, expiry during publication, non-owner explicit administrator, and re-enrollment preserving key identity. These are not yet green and do not substitute for the real host-verifier or HTTP/VM integration tests. A standalone source prototype and strict Clippy check are queued, alongside the already-queued primitive gates. Owned queued command: build-slot python3 $HOME/.cache/codex-scratch/edge-autoupdate/resume-gated-slices.py (wrapper PID 2723400). Earlier workflow prefixes must not be rerun: they already committed exports. The current continuation begins with the captured snapshot-cancellation red/green slice, then six repository DB tests, remaining fixture/fuzz harness steps, iterate, fresh S/Z fixture preparation and optional key/interface commits. Production encrypted checkpoint storage, private HTTP routing, startup guardian/recovery, security-state continuity, full VM acceptance, final size/profile qualification and final fast remain unfinished. Source receipt for the unwired work (no keys or credentials): [backup-authority-unwired-draft.zip](https://git.kayg.org/attachments/22964669-9adb-4c25-80c0-216405cadbf4)
kayg commented 2026-10-15 22:00:16 +00:00
Author
Owner
Copy link

Committed and pushed 8176713d0d: Wipe serialized database images when preparation is cancelled (D147, D244).

Take ownership in the existing Snapshot wipe guard immediately after serialization, before awaiting connection close. Previously cancellation or a close error dropped the unguarded SQLite allocation without wiping its database content. A real SQLite regression holds the close boundary, aborts preparation and observes both the wipe and cleared allocation before free; it failed before this correction. Guarding only successful returned images misses errors and cancellation. The controlled hook and observation exist only in library tests; successful runtime work keeps the same encryption-only ownership contract.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

snapshot-cancellation-wipe-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 8176713d0d2ddb30240227030a53c76df35b08ad: Wipe serialized database images when preparation is cancelled (D147, D244). Take ownership in the existing Snapshot wipe guard immediately after serialization, before awaiting connection close. Previously cancellation or a close error dropped the unguarded SQLite allocation without wiping its database content. A real SQLite regression holds the close boundary, aborts preparation and observes both the wipe and cleared allocation before free; it failed before this correction. Guarding only successful returned images misses errors and cancellation. The controlled hook and observation exist only in library tests; successful runtime work keeps the same encryption-only ownership contract. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s ``` [snapshot-cancellation-wipe-gate.log](https://git.kayg.org/attachments/b7bc1f95-6681-4ef4-be4d-65a7c1485c37) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 22:00:17 +00:00
Author
Owner
Copy link

Pre-fix real-engine cancellation regression for the preceding wipe fix: serialized image reached the close boundary, the task was cancelled, and the wipe count was zero instead of one. The committed fix passes and observes cleared bytes before allocation release. snapshot-cancellation-red.log

Pre-fix real-engine cancellation regression for the preceding wipe fix: serialized image reached the close boundary, the task was cancelled, and the wipe count was zero instead of one. The committed fix passes and observes cleared bytes before allocation release. [snapshot-cancellation-red.log](https://git.kayg.org/attachments/6ee917b9-bb23-40fa-88c9-bf0d0961662b)
kayg commented 2026-10-15 22:00:32 +00:00
Author
Owner
Copy link

Committed and pushed f203972515: Qualify backup primitives against WAL and real migrations (D147).

Add real SQLite tests for committed live WAL restoration, nondefault and successor-changed page geometry, malformed-image refusal, persistent-target deserialization refusal and actual SQLx migration-26 recovery. The predecessor first rejects the successor journal, then reopens after restoration with its earlier data. Fixtures create unique private leaves outside the checkout, own cleanup before file I/O can fail and never delete an existing leaf. The feature requirement keeps runtime dependencies out of metadata-only test builds. These tests qualify primitives, not encrypted update recovery or performance.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.85s

backup-database-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f2039725159495d18191ec4caab2e6ce3b49ad7b: Qualify backup primitives against WAL and real migrations (D147). Add real SQLite tests for committed live WAL restoration, nondefault and successor-changed page geometry, malformed-image refusal, persistent-target deserialization refusal and actual SQLx migration-26 recovery. The predecessor first rejects the successor journal, then reopens after restoration with its earlier data. Fixtures create unique private leaves outside the checkout, own cleanup before file I/O can fail and never delete an existing leaf. The feature requirement keeps runtime dependencies out of metadata-only test builds. These tests qualify primitives, not encrypted update recovery or performance. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.85s ``` [backup-database-tests-gate.log](https://git.kayg.org/attachments/665f0856-6824-4bdb-822e-61dfa218464f) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 22:19:35 +00:00
Author
Owner
Copy link

Committed and pushed 330e6a8f3b: Keep capability predicates observable during parser fuzzing (D217).

Feed both exact ELF capability predicates to black_box so optimized fuzz builds cannot discard their pure results. Ignoring the booleans permits dead-code elimination and would give misleading capability coverage. The combined CA-frame and independent note target completed 100000 ASan Rust inputs without a crash; raw receipts are attached to #211. This changes only the harness, not production parsers.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

handoff-fuzz-observability-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 330e6a8f3bf9ee31e9e51d0f697107443e1cd2f6: Keep capability predicates observable during parser fuzzing (D217). Feed both exact ELF capability predicates to black_box so optimized fuzz builds cannot discard their pure results. Ignoring the booleans permits dead-code elimination and would give misleading capability coverage. The combined CA-frame and independent note target completed 100000 ASan Rust inputs without a crash; raw receipts are attached to #211. This changes only the harness, not production parsers. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [handoff-fuzz-observability-gate.log](https://git.kayg.org/attachments/5532101b-18bc-4fe3-9b94-5f625860ea33) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 22:20:03 +00:00
Author
Owner
Copy link

Committed and pushed b59263583f: Retain failed staging-unit state until owned teardown (D251).

Eager systemd collection erased the failed signed server exit status, leaving default fields after TCP readiness timed out. Keep failed units until this fixture stops and resets them, and report only allowlisted lifecycle fields, including early MainPID-zero failure. Environment, command lines and application output remain excluded. Include CPU count, memory and the kernel accept-queue limit with locked VM receipts to make the listener and profile experiments reproducible.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 485 filtered out; finished in 0.05s

staging-startup-receipts-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed b59263583f76fca60cf3ce5dc34b614b3faf670e: Retain failed staging-unit state until owned teardown (D251). Eager systemd collection erased the failed signed server exit status, leaving default fields after TCP readiness timed out. Keep failed units until this fixture stops and resets them, and report only allowlisted lifecycle fields, including early MainPID-zero failure. Environment, command lines and application output remain excluded. Include CPU count, memory and the kernel accept-queue limit with locked VM receipts to make the listener and profile experiments reproducible. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 485 filtered out; finished in 0.05s ``` [staging-startup-receipts-gate.log](https://git.kayg.org/attachments/c0501944-118f-47ca-99b0-c85e761266e4) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 22:20:14 +00:00
Author
Owner
Copy link

Committed and pushed d66d735eae: Separate staging fixture builds from locked VM execution (D256).

Add prepare-only to retain the existing public signed fixture cache and close its ephemeral signer before returning. Reuse plus reuse-harness then runs measurement without rebuilding. A combined build/measurement command otherwise holds a host build slot while waiting on the independent VM lock. The fixture-only smoke test rejects any attempted measurement transport and requires the explicit preparation completion marker; existing artifact tests remain green. This does not publish or apply an update.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

staging-fixture-preparation-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed d66d735eae033cdbcf0ce7a773b809105b8c65b6: Separate staging fixture builds from locked VM execution (D256). Add prepare-only to retain the existing public signed fixture cache and close its ephemeral signer before returning. Reuse plus reuse-harness then runs measurement without rebuilding. A combined build/measurement command otherwise holds a host build slot while waiting on the independent VM lock. The fixture-only smoke test rejects any attempted measurement transport and requires the explicit preparation completion marker; existing artifact tests remain green. This does not publish or apply an update. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [staging-fixture-preparation-gate.log](https://git.kayg.org/attachments/26b7d11d-f71d-40e3-8eeb-f75f6a695d2a) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 22:21:30 +00:00
Author
Owner
Copy link

Private-action host refinement for D16/D168/D186/D198: the optional adapter will expose a default-deny authority preflight. The host checks the live session, declared action, original enabled epoch and adapter authority before reserving protected body pages; the component still rechecks current membership/proof at durable commit. Calls use the existing Entry.tasks registry and disable mutex, with weak original-epoch admissions rather than another lifecycle worker. Request cancellation aborts its owned task; feature disable joins it and its protected input. This is additive and does not mount a backup endpoint or enable updater recovery yet. Draft source: crates/infraternal-server/src/private_plugin_runtime{,_tests}.rs.

Private-action host refinement for D16/D168/D186/D198: the optional adapter will expose a default-deny authority preflight. The host checks the live session, declared action, original enabled epoch and adapter authority before reserving protected body pages; the component still rechecks current membership/proof at durable commit. Calls use the existing Entry.tasks registry and disable mutex, with weak original-epoch admissions rather than another lifecycle worker. Request cancellation aborts its owned task; feature disable joins it and its protected input. This is additive and does not mount a backup endpoint or enable updater recovery yet. Draft source: crates/infraternal-server/src/private_plugin_runtime{,_tests}.rs.
kayg commented 2026-10-15 22:26:41 +00:00
Author
Owner
Copy link

Resume receipt at d66d735eae: optional custody primitives and host-dispatch drafts are attached with SHA-256 identities and the ordered gate/commit scripts. The earlier authority prototype passed 27 tests and strict pedantic Clippy; new dispatcher/intake/lifecycle tests are not yet gated. One draft review finding is corrected: sensitive body collection must run inside Entry.tasks, so disable joins stalled intake as well as proof processing. Three deterministic lifecycle tests and two real-session HTTP tests are prepared.

Current managed build-slot process: 2988608 (child workflow 3071127), running resume-fixture-slices.py. It has pushed fuzz, staging diagnostics and fixture-preparation commits; scripts/verify iterate is in progress. On success it builds matched S/Z public transport fixtures, then gates and atomically pushes key primitives, shared storage, the post-fence hook and private host integration. Any mandatory failure stops that sequence for repair. Existing production prepare_recovery still refuses; recovery provider, real rollback/guardian, VM acceptance, final profile/caps and scripts/verify fast remain incomplete.

custody-host-dispatch-unwired-draft.zip

Resume receipt at d66d735eae033cdbcf0ce7a773b809105b8c65b6: optional custody primitives and host-dispatch drafts are attached with SHA-256 identities and the ordered gate/commit scripts. The earlier authority prototype passed 27 tests and strict pedantic Clippy; new dispatcher/intake/lifecycle tests are not yet gated. One draft review finding is corrected: sensitive body collection must run inside Entry.tasks, so disable joins stalled intake as well as proof processing. Three deterministic lifecycle tests and two real-session HTTP tests are prepared. Current managed build-slot process: 2988608 (child workflow 3071127), running resume-fixture-slices.py. It has pushed fuzz, staging diagnostics and fixture-preparation commits; scripts/verify iterate is in progress. On success it builds matched S/Z public transport fixtures, then gates and atomically pushes key primitives, shared storage, the post-fence hook and private host integration. Any mandatory failure stops that sequence for repair. Existing production prepare_recovery still refuses; recovery provider, real rollback/guardian, VM acceptance, final profile/caps and scripts/verify fast remain incomplete. [custody-host-dispatch-unwired-draft.zip](https://git.kayg.org/attachments/4647cb61-d458-407d-b2a6-3e62c3cbe7e5)
kayg commented 2026-10-15 22:43:00 +00:00
Author
Owner
Copy link

Iteration gate at d66d735eae stopped on one non-load fixture failure: daemon::gone_tests::a_vanished_session_gets_a_final_close_and_the_channel_stays_up, crates/infraternal-agent/src/daemon_gone_tests.rs:111. UnixListener::bind returned InvalidInput: "path must be shorter than SUN_LEN". The configured HOME-cache TMPDIR plus the 24-hex suffix generates 124 bytes. No timeout waiver applies.

Queued managed build-slot PID 3204691 runs fix-socket-fixture-and-resume.py: first reproduce the unchanged failing fixture, then reuse INFRATERNAL_TEST_STATE_ROOT with a private 48-bit create-new suffix (107 bytes under this job root), run targeted tests and agent Clippy, commit/push that isolated test fix, and resume the stopped iteration milestone. No latency budget or runtime transport change is proposed.

Rust summary, verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | FAIL (101)   |
| cargo-deny                | PASS         |
+---------------------------+--------------+

raw gate log

Iteration gate at d66d735eae033cdbcf0ce7a773b809105b8c65b6 stopped on one non-load fixture failure: daemon::gone_tests::a_vanished_session_gets_a_final_close_and_the_channel_stays_up, crates/infraternal-agent/src/daemon_gone_tests.rs:111. UnixListener::bind returned InvalidInput: "path must be shorter than SUN_LEN". The configured HOME-cache TMPDIR plus the 24-hex suffix generates 124 bytes. No timeout waiver applies. Queued managed build-slot PID 3204691 runs fix-socket-fixture-and-resume.py: first reproduce the unchanged failing fixture, then reuse INFRATERNAL_TEST_STATE_ROOT with a private 48-bit create-new suffix (107 bytes under this job root), run targeted tests and agent Clippy, commit/push that isolated test fix, and resume the stopped iteration milestone. No latency budget or runtime transport change is proposed. Rust summary, verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | FAIL (101) | | cargo-deny | PASS | +---------------------------+--------------+ ``` [raw gate log](https://git.kayg.org/attachments/4dc452e4-db3c-4ef0-a217-98d1d3396b4d)
kayg commented 2026-10-15 22:47:25 +00:00
Author
Owner
Copy link

Unwired draft receipt at d66d735eae: source identities and ordered gate/commit workflows are attached. Latest additions have passed rustfmt syntax/formatting only; they have not passed functional/Clippy gates and are not shipping claims.

Draft engine: crates/plugins/backup/src/checkpoint{,_tests}.rs owns a protected key lease, snapshots via the existing SQLite backup API, authenticates an ordered bounded inventory, and binds each record index plus both verified image digests. Private recovered resources use protected pages. Four tests are prepared: real SQLx migration 25→26→predecessor VersionMissing(26)→encrypted restore→25 reopens; record/image substitution; authenticated malformed database refusal; inventory bounds. record_wire.rs uses a constant 33-byte encrypted envelope, and backup_record_decode / backup_inventory_decode fuzz targets are prepared. The source prototype now includes these exact modules; its expanded rerun is pending (the earlier 27-test result applies to the earlier sources only).

Backup private-action descriptor/service and real host adapters are also drafted. No constructors create storage or start polling. All lifecycle and HTTP tests remain pending. The next managed wrapper is PID 3204691, fix-socket-fixture-and-resume.py. It first reproduces the iteration gate socket-path failure, then fixes/tests/commits that fixture and resumes the stopped milestone, matched public S/Z fixture builds, and sequential primitive/interface/runtime gates. Final updater checkpoint wiring, independently supervised recovery before startup database access, verified failed-image migration acceptance, VM measurements, cap/profile qualification and final fast remain incomplete.

encrypted-checkpoint-and-custody-draft.zip

Unwired draft receipt at d66d735eae033cdbcf0ce7a773b809105b8c65b6: source identities and ordered gate/commit workflows are attached. Latest additions have passed rustfmt syntax/formatting only; they have not passed functional/Clippy gates and are not shipping claims. Draft engine: crates/plugins/backup/src/checkpoint{,_tests}.rs owns a protected key lease, snapshots via the existing SQLite backup API, authenticates an ordered bounded inventory, and binds each record index plus both verified image digests. Private recovered resources use protected pages. Four tests are prepared: real SQLx migration 25→26→predecessor VersionMissing(26)→encrypted restore→25 reopens; record/image substitution; authenticated malformed database refusal; inventory bounds. record_wire.rs uses a constant 33-byte encrypted envelope, and backup_record_decode / backup_inventory_decode fuzz targets are prepared. The source prototype now includes these exact modules; its expanded rerun is pending (the earlier 27-test result applies to the earlier sources only). Backup private-action descriptor/service and real host adapters are also drafted. No constructors create storage or start polling. All lifecycle and HTTP tests remain pending. The next managed wrapper is PID 3204691, fix-socket-fixture-and-resume.py. It first reproduces the iteration gate socket-path failure, then fixes/tests/commits that fixture and resumes the stopped milestone, matched public S/Z fixture builds, and sequential primitive/interface/runtime gates. Final updater checkpoint wiring, independently supervised recovery before startup database access, verified failed-image migration acceptance, VM measurements, cap/profile qualification and final fast remain incomplete. [encrypted-checkpoint-and-custody-draft.zip](https://git.kayg.org/attachments/165c0c7c-f36b-40ae-9a15-60a986b46dc5)
kayg commented 2026-10-15 23:03:26 +00:00
Author
Owner
Copy link

Committed and pushed 8e0be3fd23: Keep the vanished-session fixture within the Unix socket path bound (D128).

The iteration gate failed before its continuity assertions because a HOME-cache TMPDIR plus a 96-bit fixture suffix produced a 124-byte rendezvous path. Reproduce that failure first, then reuse INFRATERNAL_TEST_STATE_ROOT and a 48-bit create-new suffix; this job uses a 107-byte path under its owned scratch root. Preserve collision refusal and private directory permissions. Shortening global compiler scratch paths or waiving a non-load failure would hide the fixture bug. No runtime transport or deadline changes.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 116 filtered out; finished in 0.01s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 36 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 13 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 42 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 46 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 18 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 15 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 94 filtered out; finished in 0.00s
test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 116 filtered out; finished in 0.01s

gone-fixture-short-state-root-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 8e0be3fd2322c84c3fbe155fb50a666aa5adf0c5: Keep the vanished-session fixture within the Unix socket path bound (D128). The iteration gate failed before its continuity assertions because a HOME-cache TMPDIR plus a 96-bit fixture suffix produced a 124-byte rendezvous path. Reproduce that failure first, then reuse INFRATERNAL_TEST_STATE_ROOT and a 48-bit create-new suffix; this job uses a 107-byte path under its owned scratch root. Preserve collision refusal and private directory permissions. Shortening global compiler scratch paths or waiving a non-load failure would hide the fixture bug. No runtime transport or deadline changes. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 116 filtered out; finished in 0.01s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 36 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 13 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 42 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 46 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 18 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 15 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 11 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 94 filtered out; finished in 0.00s test result: FAILED. 0 passed; 1 failed; 0 ignored; 0 measured; 116 filtered out; finished in 0.01s ``` [gone-fixture-short-state-root-gate.log](https://git.kayg.org/attachments/cd83a681-5942-4391-9976-306a76e730bd) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-15 23:15:46 +00:00
Author
Owner
Copy link

Additive D16/D198/D202 integration proposal for the recovery process: an optional internal CLI worker binding carries a callback supplied by the declaring plugin. The core dispatches that generic binding; it contains no backup-specific command route. The hidden backup recovery action uses its existing backup factory, with an inherited anonymous channel for all private material and no key-bearing argv/environment/files. Its callback must refuse missing/invalid channels and absent existing server state. The installed server unit already declares KillMode=process (crates/infraternal/src/install.rs:171), so an owned child can survive its server parent while restoring a failed image; the actual startup barrier/check-in protocol and real-process tests are still to be implemented. No new library, engine or production service change is proposed.

Additive D16/D198/D202 integration proposal for the recovery process: an optional internal CLI worker binding carries a callback supplied by the declaring plugin. The core dispatches that generic binding; it contains no backup-specific command route. The hidden backup recovery action uses its existing backup factory, with an inherited anonymous channel for all private material and no key-bearing argv/environment/files. Its callback must refuse missing/invalid channels and absent existing server state. The installed server unit already declares KillMode=process (crates/infraternal/src/install.rs:171), so an owned child can survive its server parent while restoring a failed image; the actual startup barrier/check-in protocol and real-process tests are still to be implemented. No new library, engine or production service change is proposed.
kayg commented 2026-10-15 23:34:33 +00:00
Author
Owner
Copy link

Additive private exec-resource contract proposed for D147/D168/D198/D217: the existing admission lease may own a bounded list of plugin resources. Each resource declares its exact ELF compatibility note, one INFRATERNAL_ environment name and a borrowed live descriptor. The core constructs environment values from public PID/fd integers only and verifies the note on the already signed/sealed executable before private inheritance. Lifecycle callbacks arm recovery only after serving stops, distinguish a kernel-refused candidate from a started image, and cancel only when both exec syscalls failed without running new code. Key bytes stay in anonymous channels. CLI startup integration will restore CLOEXEC before any child spawn, using the existing audited shim duplicate_inherited_descriptor; no new unsafe borrowing or transport/library is proposed. Guardian, restoration-before-database-open barrier and actual process tests remain unfinished.

Additive private exec-resource contract proposed for D147/D168/D198/D217: the existing admission lease may own a bounded list of plugin resources. Each resource declares its exact ELF compatibility note, one INFRATERNAL_ environment name and a borrowed live descriptor. The core constructs environment values from public PID/fd integers only and verifies the note on the already signed/sealed executable before private inheritance. Lifecycle callbacks arm recovery only after serving stops, distinguish a kernel-refused candidate from a started image, and cancel only when both exec syscalls failed without running new code. Key bytes stay in anonymous channels. CLI startup integration will restore CLOEXEC before any child spawn, using the existing audited shim duplicate_inherited_descriptor; no new unsafe borrowing or transport/library is proposed. Guardian, restoration-before-database-open barrier and actual process tests remain unfinished.
kayg commented 2026-10-15 23:35:27 +00:00
Author
Owner
Copy link

Expanded unwired custody/checkpoint source prototype passed functional tests and strict pedantic Clippy. The prior read-only regression first failed because a missing administrator directory was recreated by read. Reads now use existing-only admission; an authorized publisher can repair encrypted copies under the same retained public key identity. Newly created administrator and backup root entries are synced through their parents before installation. Source hashes are attached; no production updater recovery path is enabled.

Verbatim test summary:

test result: ok. 39 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.08s

key-copy-readonly-red-gate.log
expanded-custody-prototype-gate.log
expanded-custody-prototype-source.json

Expanded unwired custody/checkpoint source prototype passed functional tests and strict pedantic Clippy. The prior read-only regression first failed because a missing administrator directory was recreated by read. Reads now use existing-only admission; an authorized publisher can repair encrypted copies under the same retained public key identity. Newly created administrator and backup root entries are synced through their parents before installation. Source hashes are attached; no production updater recovery path is enabled. Verbatim test summary: ```text test result: ok. 39 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.08s ``` [key-copy-readonly-red-gate.log](https://git.kayg.org/attachments/121f69d3-42b6-49f8-85e6-7386a85cb260) [expanded-custody-prototype-gate.log](https://git.kayg.org/attachments/c23f6593-38db-4abc-a289-5a830240ff2a) [expanded-custody-prototype-source.json](https://git.kayg.org/attachments/dcf2860d-9aa2-4c7a-877e-155770496333)
kayg commented 2026-10-15 23:42:57 +00:00
Author
Owner
Copy link

The second iterate attempt refused a Python fixture socket manifest at 108 bytes, above SUN_LEN. The agent fixture path guard correctly rejected it. The next run uses the owned short state root ~/.cache/codex-scratch/e211 rather than the longer job root; the abrupt-stop test now passes all 24 stops. No path limit or correctness assertion was relaxed. The current third iterate attempt is still running and has reported a distinct server_setup_terminal_echo_and_resume_preserve_offsets_once failure; its final diagnostic is not yet available.

primitive-iterate-second-fixture-root-failure.log

The second iterate attempt refused a Python fixture socket manifest at 108 bytes, above SUN_LEN. The agent fixture path guard correctly rejected it. The next run uses the owned short state root ~/.cache/codex-scratch/e211 rather than the longer job root; the abrupt-stop test now passes all 24 stops. No path limit or correctness assertion was relaxed. The current third iterate attempt is still running and has reported a distinct server_setup_terminal_echo_and_resume_preserve_offsets_once failure; its final diagnostic is not yet available. [primitive-iterate-second-fixture-root-failure.log](https://git.kayg.org/attachments/62dad13c-f96e-4b2d-bfa7-e1a34dddaa1f)
kayg commented 2026-10-15 23:46:12 +00:00
Author
Owner
Copy link

Iteration at 8e0be3fd23: fmt, VT native fmt, CLI compile-out, Clippy and cargo-deny PASS; workspace tests FAIL. Server: 438 passed, 4 failed, 48 ignored. server_setup_terminal_echo_and_resume_preserve_offsets_once panicked in futures-util sink/unfold.rs:65 (start_send after a failed unfold emptied its state), then failed inactive/resume cleanup. startup token fixture also exceeded SUN_LEN; TMPDIR is now an owned shorter scratch directory without changing any path guard. Held terminal.open and saturated native control queue tests failed separately and remain unwaived. A deterministic real-WebSocket poisoned-writer RED and narrow cleanup fix are queued through build-slot; no release/profile/VM acceptance is claimed.

primitive-iterate-third-failure.log

Iteration at 8e0be3fd2322c84c3fbe155fb50a666aa5adf0c5: fmt, VT native fmt, CLI compile-out, Clippy and cargo-deny PASS; workspace tests FAIL. Server: 438 passed, 4 failed, 48 ignored. server_setup_terminal_echo_and_resume_preserve_offsets_once panicked in futures-util sink/unfold.rs:65 (start_send after a failed unfold emptied its state), then failed inactive/resume cleanup. startup token fixture also exceeded SUN_LEN; TMPDIR is now an owned shorter scratch directory without changing any path guard. Held terminal.open and saturated native control queue tests failed separately and remain unwaived. A deterministic real-WebSocket poisoned-writer RED and narrow cleanup fix are queued through build-slot; no release/profile/VM acceptance is claimed. [primitive-iterate-third-failure.log](https://git.kayg.org/attachments/e954f6f9-f17c-48f5-8f79-a433d5a34117)
kayg commented 2026-10-15 23:56:45 +00:00
Author
Owner
Copy link

Resume checkpoint while build-slot is queued: new recovery-control, protected channel, parent guardian, pidfd termination and cold-start barrier sources remain UNWIRED and unqualified. The last qualified source prototype had 39 tests; the expanded prototype is queued after the deterministic browser-writer RED/GREEN. Archive includes source hashes, working diff, prototype adapters and ordered per-commit gate/push workflows. Next command: build-slot python3 ~/.cache/codex-scratch/edge-autoupdate/fix-poisoned-browser-writer.py (already queued, PID 3780013). It must reproduce the poisoned writer failure, fix cleanup, pass all four preceding failure filters, commit/push, then run the expanded prototype and iterate before building signed transport fixtures and continuing custody commits. No production updater recovery is enabled.

Contract detail: private resource variables use the reserved INFRATERNAL_PRIVATE_ prefix, always cleared by generic exec even when the declaring component is disabled. This avoids a stale same-PID fd manifest after a later manual reload. The worker waits on the pinned parent lifetime; socket EOF alone never authorizes restore, partial commands cannot extend the absolute startup deadline, and an unarmed child is cancelled/joined with only its exact marker removable. Real-process tests currently use a controlled point validator and are not database-recovery acceptance.

Still outstanding: actual point validator/restorer, backup-owned checkpoint worker/provider and CA/config capture, warm startup/key reconciliation before database/foreground accept, actual migration-26 failed-image restore, final signed VM acceptance, native pairs, normal four shipping recipes/caps, final scripts/verify fast.

recovery-integration-draft-checkpoint.zip

Resume checkpoint while build-slot is queued: new recovery-control, protected channel, parent guardian, pidfd termination and cold-start barrier sources remain UNWIRED and unqualified. The last qualified source prototype had 39 tests; the expanded prototype is queued after the deterministic browser-writer RED/GREEN. Archive includes source hashes, working diff, prototype adapters and ordered per-commit gate/push workflows. Next command: build-slot python3 ~/.cache/codex-scratch/edge-autoupdate/fix-poisoned-browser-writer.py (already queued, PID 3780013). It must reproduce the poisoned writer failure, fix cleanup, pass all four preceding failure filters, commit/push, then run the expanded prototype and iterate before building signed transport fixtures and continuing custody commits. No production updater recovery is enabled. Contract detail: private resource variables use the reserved INFRATERNAL_PRIVATE_ prefix, always cleared by generic exec even when the declaring component is disabled. This avoids a stale same-PID fd manifest after a later manual reload. The worker waits on the pinned parent lifetime; socket EOF alone never authorizes restore, partial commands cannot extend the absolute startup deadline, and an unarmed child is cancelled/joined with only its exact marker removable. Real-process tests currently use a controlled point validator and are not database-recovery acceptance. Still outstanding: actual point validator/restorer, backup-owned checkpoint worker/provider and CA/config capture, warm startup/key reconciliation before database/foreground accept, actual migration-26 failed-image restore, final signed VM acceptance, native pairs, normal four shipping recipes/caps, final scripts/verify fast. [recovery-integration-draft-checkpoint.zip](https://git.kayg.org/attachments/d8a6c659-f167-4c4c-94da-4989d9e5cbd5)
kayg commented 2026-10-16 00:06:43 +00:00
Author
Owner
Copy link

Recovery integration finding: crates/infraternal-server/src/plugins.rs::switch invalidates its epoch and joins tasks BEFORE waiting for the SQLite writer reservation. Therefore holding the release writer transaction alone cannot fence backup disable after a prepared resource has moved out of the backup worker. Proposed additive generic admission contract: after all cancellable preparation completes, acquire a retained commit reservation under the original entry task mutex. A concurrent disable wins before reservation (preparation cancels and its unarmed guardian is joined), or sees the committed reservation and returns a busy state until handoff/cancellation releases it. Ordinary private actions and pending intake retain their current abort/join semantics. A process shutdown can retain the admitted resource through exec without treating a newly enabled epoch as authority. This is an existing mutex/atomic lifetime fence, not a new foundational library or engine. It requires a deterministic disable-before/after-reservation race test and exact API copy before activation; no production provider is enabled yet.

Recovery integration finding: crates/infraternal-server/src/plugins.rs::switch invalidates its epoch and joins tasks BEFORE waiting for the SQLite writer reservation. Therefore holding the release writer transaction alone cannot fence backup disable after a prepared resource has moved out of the backup worker. Proposed additive generic admission contract: after all cancellable preparation completes, acquire a retained commit reservation under the original entry task mutex. A concurrent disable wins before reservation (preparation cancels and its unarmed guardian is joined), or sees the committed reservation and returns a busy state until handoff/cancellation releases it. Ordinary private actions and pending intake retain their current abort/join semantics. A process shutdown can retain the admitted resource through exec without treating a newly enabled epoch as authority. This is an existing mutex/atomic lifetime fence, not a new foundational library or engine. It requires a deterministic disable-before/after-reservation race test and exact API copy before activation; no production provider is enabled yet.
kayg commented 2026-10-16 00:12:12 +00:00
Author
Owner
Copy link

Committed and pushed 7c2feea81d: Keep failed browser writes out of resume cleanup (D128).

A failed async unfold sink is terminal; reusing it for best-effort close panicked before inactive/resume metadata was persisted. A real closed-WebSocket regression reproduced that panic before this fix. Drop the failed application adapter and perform bounded close writes directly through the retained serialized transport, both after handshake refusal and on established-socket cleanup. The successful frame path gains no allocation or branch, with one extra shared owner retained per connection only through cleanup. Reject swallowing application write errors or recreating the adapter for each frame. Fmt, all-target server Clippy, both real transport tests and the real passkey/setup/echo/resume test passed. The separate paused-clock terminal-open probe regression still fails and is tracked for the next atomic fix; the full iteration is not green.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.25s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.62s

poisoned-browser-cleanup-selected-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 7c2feea81dd7ad72f6c9f88e707ebfb10392772d: Keep failed browser writes out of resume cleanup (D128). A failed async unfold sink is terminal; reusing it for best-effort close panicked before inactive/resume metadata was persisted. A real closed-WebSocket regression reproduced that panic before this fix. Drop the failed application adapter and perform bounded close writes directly through the retained serialized transport, both after handshake refusal and on established-socket cleanup. The successful frame path gains no allocation or branch, with one extra shared owner retained per connection only through cleanup. Reject swallowing application write errors or recreating the adapter for each frame. Fmt, all-target server Clippy, both real transport tests and the real passkey/setup/echo/resume test passed. The separate paused-clock terminal-open probe regression still fails and is tracked for the next atomic fix; the full iteration is not green. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.25s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.62s ``` [poisoned-browser-cleanup-selected-gate.log](https://git.kayg.org/attachments/1df68eda-412b-4b16-a802-4ed4a8976588) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 00:12:14 +00:00
Author
Owner
Copy link

The cleanup commit passed its selected gate before the next independent test failed. restart_open_liveness_review::responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment still fails at line 210 after FrozenSocketTime releases its watchdog; the sibling authority-pool oracle passes. The transport activation branch resets its interval to a future tick. In a paused clock, initial scheduling can consume the immediate tick before watch activation and then wait indefinitely for another tick. Next fix will schedule the first active probe immediately and keep the existing lease/deadline assertions. No load waiver is applied.

poisoned-browser-writer-red-gate.log
poisoned-browser-writer-fix-gate.log

The cleanup commit passed its selected gate before the next independent test failed. restart_open_liveness_review::responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment still fails at line 210 after FrozenSocketTime releases its watchdog; the sibling authority-pool oracle passes. The transport activation branch resets its interval to a future tick. In a paused clock, initial scheduling can consume the immediate tick before watch activation and then wait indefinitely for another tick. Next fix will schedule the first active probe immediately and keep the existing lease/deadline assertions. No load waiver is applied. [poisoned-browser-writer-red-gate.log](https://git.kayg.org/attachments/d7eaf77d-d284-4424-bd50-b8ba2d363794) [poisoned-browser-writer-fix-gate.log](https://git.kayg.org/attachments/50e430b3-6873-4f05-b001-f6270e45449c)
kayg commented 2026-10-16 00:19:30 +00:00
Author
Owner
Copy link

Static fixture-path check before the queued gate: runtime.rs::temp_dir uses a 55-byte directory leaf (infraternal-server- plus UUID). Even e211/tmp would produce a 113-byte setup-token.sock path. The owned two-character scratch alias ~/.cache/codex-scratch/e2 produces 107 bytes, below SUN_LEN=108, and is now TMPDIR for the queued workflows. INFRATERNAL_TEST_STATE_ROOT remains the separate owned e211 root for the checked short daemon fixture. No limit, random UUID or assertion was relaxed; these are path lengths, not performance evidence. Both alias directories must be removed during final owned-scratch cleanup.

owned-short-tmpdir.json

Static fixture-path check before the queued gate: runtime.rs::temp_dir uses a 55-byte directory leaf (infraternal-server- plus UUID). Even e211/tmp would produce a 113-byte setup-token.sock path. The owned two-character scratch alias ~/.cache/codex-scratch/e2 produces 107 bytes, below SUN_LEN=108, and is now TMPDIR for the queued workflows. INFRATERNAL_TEST_STATE_ROOT remains the separate owned e211 root for the checked short daemon fixture. No limit, random UUID or assertion was relaxed; these are path lengths, not performance evidence. Both alias directories must be removed during final owned-scratch cleanup. [owned-short-tmpdir.json](https://git.kayg.org/attachments/3e99c758-edac-47ba-a959-4b5b1858dde7)
kayg commented 2026-10-16 00:20:19 +00:00
Author
Owner
Copy link

Additive recovery-resource contract proposed (D147/D168/D186/D198): a generic plugin binding receives the confirmed server host resource adapter without starting work. That adapter declares a bounded set of public file targets from the existing runtime configuration, independently of an encrypted point inventory. It visits signer/configuration resources synchronously one at a time through a borrowed-byte visitor inside owned I/O; capture seals each resource before returning, with protected private storage and no plaintext aggregate or serialization. Signer material is memory-only and can never select a file target. Labels share the existing checkpoint predicate, and configuration targets are bounded absolute paths without parent traversal. Default plugin binding is inert. The backend provider remains disabled until actual CA/config capture, complete preflight, consistent database restore and guarded startup integration are qualified. This adds an adapter to existing engines, not a foundational engine choice.

Additive recovery-resource contract proposed (D147/D168/D186/D198): a generic plugin binding receives the confirmed server host resource adapter without starting work. That adapter declares a bounded set of public file targets from the existing runtime configuration, independently of an encrypted point inventory. It visits signer/configuration resources synchronously one at a time through a borrowed-byte visitor inside owned I/O; capture seals each resource before returning, with protected private storage and no plaintext aggregate or serialization. Signer material is memory-only and can never select a file target. Labels share the existing checkpoint predicate, and configuration targets are bounded absolute paths without parent traversal. Default plugin binding is inert. The backend provider remains disabled until actual CA/config capture, complete preflight, consistent database restore and guarded startup integration are qualified. This adds an adapter to existing engines, not a foundational engine choice.
kayg commented 2026-10-16 00:30:10 +00:00
Author
Owner
Copy link

Committed and pushed c0973c400d: Send the first browser control probe when its route activates (D128, D265).

Transport activation reset its interval to a future tick. Which select branch consumed the initial tick could strand a sampled route during real I/O with paused deadlines, so the held terminal-open ordering test failed after its watchdog. Reset immediately on activation, preserving the periodic interval and every liveness budget. Reject extending the lease or advancing fixture time to hide the ordering dependency. The existing paused-clock oracle passes ten times, its authority-pool sibling and real WebSocket/control-queue tests pass, and Clippy remains strict. Functional counts are ordering evidence, not latency measurements; final VM measurements remain required.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 1.49s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.77s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.85s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.02s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.98s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.84s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.78s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.77s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.77s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.84s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.23s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.08s

initial-browser-probe-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed c0973c400d6abc975d0e9f57a2898bc6a5012a30: Send the first browser control probe when its route activates (D128, D265). Transport activation reset its interval to a future tick. Which select branch consumed the initial tick could strand a sampled route during real I/O with paused deadlines, so the held terminal-open ordering test failed after its watchdog. Reset immediately on activation, preserving the periodic interval and every liveness budget. Reject extending the lease or advancing fixture time to hide the ordering dependency. The existing paused-clock oracle passes ten times, its authority-pool sibling and real WebSocket/control-queue tests pass, and Clippy remains strict. Functional counts are ordering evidence, not latency measurements; final VM measurements remain required. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 1.49s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.77s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.85s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.02s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.98s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.84s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.78s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.77s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.77s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.84s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 0.23s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.08s ``` [initial-browser-probe-gate.log](https://git.kayg.org/attachments/969bda1c-84c7-42dd-a0ec-e820a9b30dbe) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 01:03:06 +00:00
Author
Owner
Copy link

Continuation on edge-autoupdate at c0973c400d. Browser writer cleanup and first control-probe fixes are pushed (7c2feea81, c0973c400); their selected gates are attached in the preceding comments. Expanded recovery source qualification is still waiting for a managed build slot; the previous 64-test functional pass had six strict Clippy failures, now corrected but not yet requalified. No production recovery provider is installed.

Following the recorded disable-ordering finding, prepared an optional release admission wrapper: it delegates receiver-owned image binding and post-fence preparation, then retains the original release activation. Disable during cancellable work refuses the final reservation; cancellation drops it. Source draft/workflow remain outside the checkout pending ordered prerequisite gates. The real host reservation test and controlled wrapper tests must pass before this wiring is committed. Final iterate, VM acceptance, native paired measurements, size recipes and fast remain outstanding.

Continuation on edge-autoupdate at c0973c400d6abc975d0e9f57a2898bc6a5012a30. Browser writer cleanup and first control-probe fixes are pushed (7c2feea81, c0973c400); their selected gates are attached in the preceding comments. Expanded recovery source qualification is still waiting for a managed build slot; the previous 64-test functional pass had six strict Clippy failures, now corrected but not yet requalified. No production recovery provider is installed. Following the recorded disable-ordering finding, prepared an optional release admission wrapper: it delegates receiver-owned image binding and post-fence preparation, then retains the original release activation. Disable during cancellable work refuses the final reservation; cancellation drops it. Source draft/workflow remain outside the checkout pending ordered prerequisite gates. The real host reservation test and controlled wrapper tests must pass before this wiring is committed. Final iterate, VM acceptance, native paired measurements, size recipes and fast remain outstanding.
kayg commented 2026-10-16 01:04:07 +00:00
Author
Owner
Copy link

Integration finding at c0973c400: crates/plugins/release/src/updater.rs:534-546 immediately continues the run loop after a postponed explicit request, while apply restores that same request at lines 409-416. There is no intervening wait, so a pending attach can cause repeated handoff attempts/history rows rather than waiting for foreground completion. Source evidence: requested_kind branch + unconditional continue; existing postponed_manual_request_retains_its_owner_proof_on_retry covers proof retention but not the running loop.

Required fix: add a failing running-worker test, retain the same request/proof, and wait for foreground completion or a relevant state/operator change before retrying; do not introduce an idle polling loop. Recovery readiness must likewise remain a typed waiting state rather than permanently ignoring a verified candidate or immediately retrying it. This is an additional integration finding; no runtime/performance measurement claimed.

Integration finding at c0973c400: crates/plugins/release/src/updater.rs:534-546 immediately continues the run loop after a postponed explicit request, while apply restores that same request at lines 409-416. There is no intervening wait, so a pending attach can cause repeated handoff attempts/history rows rather than waiting for foreground completion. Source evidence: requested_kind branch + unconditional continue; existing postponed_manual_request_retains_its_owner_proof_on_retry covers proof retention but not the running loop. Required fix: add a failing running-worker test, retain the same request/proof, and wait for foreground completion or a relevant state/operator change before retrying; do not introduce an idle polling loop. Recovery readiness must likewise remain a typed waiting state rather than permanently ignoring a verified candidate or immediately retrying it. This is an additional integration finding; no runtime/performance measurement claimed.
kayg commented 2026-10-16 01:07:14 +00:00
Author
Owner
Copy link

Resumable source/workflow snapshot at c0973c400d: recovery-integration-continuation-draft.zip. Contains 63 source/adapter/workflow files with per-file SHA-256 and explicit qualification limits; no generated build targets or production secrets. This supersedes the earlier draft snapshot.

Not a completion claim: the expanded source gate is queued; production recovery/provider/startup integration, real failed migration/rollback, VM acceptance, size recipes, native paired measurements and final fast are outstanding. The ordered workflow starts with resume-recovery-prototype.py through build-slot. Do not replay completed commit prefixes; stop on a failing gate and resume after correcting it. Current draft preserves independent commits for shared custody, host dispatch, checkpoint resources and receiver admission. New uncompiled continuations add release activation reservation, a required RED running-worker test for pending-attach retry, and shared SQLite recovery preflight.

Resumable source/workflow snapshot at c0973c400d6abc975d0e9f57a2898bc6a5012a30: [recovery-integration-continuation-draft.zip](https://git.kayg.org/attachments/fd303d80-766e-476f-9605-c7917fc64391). Contains 63 source/adapter/workflow files with per-file SHA-256 and explicit qualification limits; no generated build targets or production secrets. This supersedes the earlier draft snapshot. Not a completion claim: the expanded source gate is queued; production recovery/provider/startup integration, real failed migration/rollback, VM acceptance, size recipes, native paired measurements and final fast are outstanding. The ordered workflow starts with resume-recovery-prototype.py through build-slot. Do not replay completed commit prefixes; stop on a failing gate and resume after correcting it. Current draft preserves independent commits for shared custody, host dispatch, checkpoint resources and receiver admission. New uncompiled continuations add release activation reservation, a required RED running-worker test for pending-attach retry, and shared SQLite recovery preflight.
kayg commented 2026-10-16 01:08:44 +00:00
Author
Owner
Copy link

Acceptance-fixture finding at c0973c400: crates/infraternal-server/src/release_startup.rs:44-58 calls exit(78) before Auth::new runs the core migration journal (auth/mod.rs:195-196). The existing failed-image service restart therefore cannot prove restoration after a successor commits a newer schema.

Prepared a staging-trust-only fixture that reuses the real core Migrator, adds and commits version 26 plus a probe table/release-state mutation, then exits. The unchanged predecessor must return VersionMissing(26); an actual consistent snapshot restore must remove both the newer schema and mutation. A real-engine test and strict host gates are queued after the ordered recovery prerequisites. No production migration is added or compatibility check relaxed. Draft is not yet compiled; VM guardian acceptance remains outstanding.

Acceptance-fixture finding at c0973c400: crates/infraternal-server/src/release_startup.rs:44-58 calls exit(78) before Auth::new runs the core migration journal (auth/mod.rs:195-196). The existing failed-image service restart therefore cannot prove restoration after a successor commits a newer schema. Prepared a staging-trust-only fixture that reuses the real core Migrator, adds and commits version 26 plus a probe table/release-state mutation, then exits. The unchanged predecessor must return VersionMissing(26); an actual consistent snapshot restore must remove both the newer schema and mutation. A real-engine test and strict host gates are queued after the ordered recovery prerequisites. No production migration is added or compatibility check relaxed. Draft is not yet compiled; VM guardian acceptance remains outstanding.
kayg commented 2026-10-16 01:14:23 +00:00
Author
Owner
Copy link

Correction to my pending-attach retry finding: updater.rs:349-351 already calls self.activity.idle_after(Duration::ZERO).await inside apply for explicit requests. That existing wait blocks the next attempt while an attach remains active, so the unconditional continue alone does not establish the claimed attach spin. I withdrew the redundant extra wait and its planned regression before any repository change or commit. The drafted test would pass on the existing code and therefore would not supply a valid RED.

Typed backup readiness still needs an event-driven waiting path when integrated; that is a separate unfinished requirement. The release original-epoch reservation and real post-migration failure fixture remain valid independent work. The earlier attached draft archive includes the withdrawn manual-wait workflow; do not execute it. Updated ordered scripts no longer call it.

Correction to my pending-attach retry finding: updater.rs:349-351 already calls self.activity.idle_after(Duration::ZERO).await inside apply for explicit requests. That existing wait blocks the next attempt while an attach remains active, so the unconditional continue alone does not establish the claimed attach spin. I withdrew the redundant extra wait and its planned regression before any repository change or commit. The drafted test would pass on the existing code and therefore would not supply a valid RED. Typed backup readiness still needs an event-driven waiting path when integrated; that is a separate unfinished requirement. The release original-epoch reservation and real post-migration failure fixture remain valid independent work. The earlier attached draft archive includes the withdrawn manual-wait workflow; do not execute it. Updated ordered scripts no longer call it.
kayg commented 2026-10-16 01:19:36 +00:00
Author
Owner
Copy link

Expanded actual-source prototype passed functional tests and strict pedantic Clippy. Includes real anonymous channels, owned child cancellation, exact original-epoch default denial, filesystem barriers, protected configuration/file serialization, real SQLite/encryption and configuration capture against actual ServerConfig. Guardian point validation remains a controlled callback in its process tests, and the prototype excludes real CA capture; repository/VM qualification is still required. No production recovery provider is installed.

Verbatim test summaries:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 63 filtered out; finished in 0.06s
test result: ok. 64 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.63s

recovery-control-barrier-prototype-gate.log
recovery-control-barrier-prototype-source.json

Expanded actual-source prototype passed functional tests and strict pedantic Clippy. Includes real anonymous channels, owned child cancellation, exact original-epoch default denial, filesystem barriers, protected configuration/file serialization, real SQLite/encryption and configuration capture against actual ServerConfig. Guardian point validation remains a controlled callback in its process tests, and the prototype excludes real CA capture; repository/VM qualification is still required. No production recovery provider is installed. Verbatim test summaries: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 63 filtered out; finished in 0.06s test result: ok. 64 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.63s ``` [recovery-control-barrier-prototype-gate.log](https://git.kayg.org/attachments/c5be8f6e-ac1b-417b-89e5-8c9218c600cd) [recovery-control-barrier-prototype-source.json](https://git.kayg.org/attachments/0679ab8d-941c-4c43-a05c-71dfcc0d12af)
kayg commented 2026-10-16 01:19:52 +00:00
Author
Owner
Copy link

Draft integration refinement (not a shipped defect claim): post-fence checkpoint preparation must be cancellable when typing/attach arrives while it awaits storage. The earlier planned final interruption check prevents applying after typing, but by itself cannot release a still-awaiting automatic preparation. Prepared fix-early-preparation-input.py with a required RED pending-storage scenario in the existing single process-global admission test. It enables the existing activity notification before checking interruption, signals only the first foreground attempt against a frozen fence, races owned preparation against that event, and retains the final same-poll completion check. Ordinary accepted input gains no notification; explicit Update now semantics stay explicit. Provider cancellation must retain cleanup ownership and never detach retained-state writes.

The release reservation draft separately checks the original activation before preparation and reserves it after preparation; controlled tests now distinguish disable before work from disable during work. All remain uncompiled drafts pending the managed source gate and ordered prerequisite commits. Production prepare_recovery still refuses application.

Draft integration refinement (not a shipped defect claim): post-fence checkpoint preparation must be cancellable when typing/attach arrives while it awaits storage. The earlier planned final interruption check prevents applying after typing, but by itself cannot release a still-awaiting automatic preparation. Prepared fix-early-preparation-input.py with a required RED pending-storage scenario in the existing single process-global admission test. It enables the existing activity notification before checking interruption, signals only the first foreground attempt against a frozen fence, races owned preparation against that event, and retains the final same-poll completion check. Ordinary accepted input gains no notification; explicit Update now semantics stay explicit. Provider cancellation must retain cleanup ownership and never detach retained-state writes. The release reservation draft separately checks the original activation before preparation and reserves it after preparation; controlled tests now distinguish disable before work from disable during work. All remain uncompiled drafts pending the managed source gate and ordered prerequisite commits. Production prepare_recovery still refuses application.
kayg commented 2026-10-16 01:22:18 +00:00
Author
Owner
Copy link

Expanded actual-source prototype is now green: 64 passed, 0 failed; strict -D warnings -D clippy::pedantic passed. Source/gate receipts are attached in the preceding automated comment. Full scripts/verify iterate is running through the same held build slot; no final fast or VM claim.

Latest resumable snapshot: recovery-integration-64-qualified-drafts.zip. It contains 69 files with SHA-256 and explicit exclusions/uncompiled-draft status. Supersedes the earlier continuation ZIP and removes the withdrawn manual-wait change. Added draft continuations: cancellable pending automatic preparation, original release activation reservation, shared database preflight, real staging migration-26 failure, and closed host-target restore tests. The typed readiness interface is deliberately unchained pending its full consumer. Production recovery provider/startup wiring remains absent.

Expanded actual-source prototype is now green: 64 passed, 0 failed; strict -D warnings -D clippy::pedantic passed. Source/gate receipts are attached in the preceding automated comment. Full scripts/verify iterate is running through the same held build slot; no final fast or VM claim. Latest resumable snapshot: [recovery-integration-64-qualified-drafts.zip](https://git.kayg.org/attachments/8cc5920d-932c-468e-bea7-7b17d792e606). It contains 69 files with SHA-256 and explicit exclusions/uncompiled-draft status. Supersedes the earlier continuation ZIP and removes the withdrawn manual-wait change. Added draft continuations: cancellable pending automatic preparation, original release activation reservation, shared database preflight, real staging migration-26 failure, and closed host-target restore tests. The typed readiness interface is deliberately unchained pending its full consumer. Production recovery provider/startup wiring remains absent.
kayg commented 2026-10-16 01:25:47 +00:00
Author
Owner
Copy link

Continuation boundaries beyond the queued primitive commits: recovery-integration-next.txt. Records the remaining actual guardian/provider/startup wiring, typed waiting, original-epoch and authority rechecks, owned-child reaping, rollback security-state preservation, and final acceptance. No new library/engine choice or completion claim. The 64-test prototype is green; full iterate is still running.

Continuation boundaries beyond the queued primitive commits: [recovery-integration-next.txt](https://git.kayg.org/attachments/8efbb3e0-2082-4789-b979-9cd50148cc81). Records the remaining actual guardian/provider/startup wiring, typed waiting, original-epoch and authority rechecks, owned-child reaping, rollback security-state preservation, and final acceptance. No new library/engine choice or completion claim. The 64-test prototype is green; full iterate is still running.
kayg commented 2026-10-16 01:28:55 +00:00
Author
Owner
Copy link

Pre-integration D244 refinement: untracked key_copy.rs:34, key_copy.rs:124 and key_memory.rs:40 hash the master key with Sha256::digest. The pinned digest-0.10.7 CoreWrapper stores a BlockBuffer and has no clearing Drop; sha2-0.10.9 Sha256VarCore similarly has no clearing Drop. Do not rely on optimizer behavior to remove a secret-bearing ordinary digest buffer. This is not a claim about a measured shipping leak: these modules remain unwired.

Scheduled prepare-protected-key-identity.py before the next prototype/first key module gates. Reuse the already approved checked openssl:#️⃣:hash SHA-256 provider, cache only its public 32-byte commitment beside protected material, and copy that public commitment with protected leases. The pinned openssl-0.10 Hasher::drop invokes EVP_MD_CTX_free; the vendored OpenSSL SHA-256 provider uses IMPLEMENT_digest_functions and digestcommon.h:62-65 clears its context with OPENSSL_clear_free. Retain the exact existing SHA-256 wire identity, wipe caller output on digest failure, and remove the proposed unused backup sha2 dependency. Add a known public-fixture digest/bounds test; re-run all actual-source tests/pedantic Clippy and the key-module gates. No new engine, format or signing authority. Final memory audit and VM/size qualification still required.

Pre-integration D244 refinement: untracked key_copy.rs:34, key_copy.rs:124 and key_memory.rs:40 hash the master key with Sha256::digest. The pinned digest-0.10.7 CoreWrapper stores a BlockBuffer and has no clearing Drop; sha2-0.10.9 Sha256VarCore similarly has no clearing Drop. Do not rely on optimizer behavior to remove a secret-bearing ordinary digest buffer. This is not a claim about a measured shipping leak: these modules remain unwired. Scheduled prepare-protected-key-identity.py before the next prototype/first key module gates. Reuse the already approved checked openssl::hash::hash SHA-256 provider, cache only its public 32-byte commitment beside protected material, and copy that public commitment with protected leases. The pinned openssl-0.10 Hasher::drop invokes EVP_MD_CTX_free; the vendored OpenSSL SHA-256 provider uses IMPLEMENT_digest_functions and digestcommon.h:62-65 clears its context with OPENSSL_clear_free. Retain the exact existing SHA-256 wire identity, wipe caller output on digest failure, and remove the proposed unused backup sha2 dependency. Add a known public-fixture digest/bounds test; re-run all actual-source tests/pedantic Clippy and the key-module gates. No new engine, format or signing authority. Final memory audit and VM/size qualification still required.
kayg commented 2026-10-16 01:33:45 +00:00
Author
Owner
Copy link

scripts/verify iterate at c0973c400 failed one server test; 442 passed, 1 failed, 48 ignored. Failing-before-fix receipt: primitive-iterate-restart-lock-failure.log. Verbatim failure:

thread 'runtime::tests::restart_serves_fresh_setup_token_and_completes_owner_enrollment' panicked at crates/infraternal-server/src/runtime.rs:1162:10:
restart against existing database: Auth(Storage(Database(SqliteError { code: 5, message: "database is locked" })))

The fixture drops Router but leaves its first Tokio runtime alive. websocket.rs:143 spawns the inventory watcher with a pool clone, so this does not model process teardown; the first test peer was also retained until test-scope exit. Prepared a fixture-only change using two separately owned current-thread runtimes, closing the first peer and dropping the first runtime before reopening the retained database. It keeps stale socket, token rotation and real enrollment assertions, and uses the configured short scratch root. Strict Clippy and 20 full restart/enrollment repetitions are queued through build-slot, followed by a full iterate rerun. No SQLite timeout increase or sleep, no host-load waiver, no production behavior change.

scripts/verify iterate at c0973c400 failed one server test; 442 passed, 1 failed, 48 ignored. Failing-before-fix receipt: [primitive-iterate-restart-lock-failure.log](https://git.kayg.org/attachments/5c30c65c-8562-4b87-856e-a1bb149b2636). Verbatim failure: ```text thread 'runtime::tests::restart_serves_fresh_setup_token_and_completes_owner_enrollment' panicked at crates/infraternal-server/src/runtime.rs:1162:10: restart against existing database: Auth(Storage(Database(SqliteError { code: 5, message: "database is locked" }))) ``` The fixture drops Router but leaves its first Tokio runtime alive. websocket.rs:143 spawns the inventory watcher with a pool clone, so this does not model process teardown; the first test peer was also retained until test-scope exit. Prepared a fixture-only change using two separately owned current-thread runtimes, closing the first peer and dropping the first runtime before reopening the retained database. It keeps stale socket, token rotation and real enrollment assertions, and uses the configured short scratch root. Strict Clippy and 20 full restart/enrollment repetitions are queued through build-slot, followed by a full iterate rerun. No SQLite timeout increase or sleep, no host-load waiver, no production behavior change.
kayg commented 2026-10-16 01:37:12 +00:00
Author
Owner
Copy link

Committed and pushed 01fe0793e1: Isolate restart fixtures across real runtime teardown (D128, D147).

The full iteration gate exposed a locked database while the setup-token fixture recreated its router. Dropping only the first Router leaves its runtime-owned inventory watcher and database pool alive, unlike real process replacement. Give each startup phase its own current-thread runtime, drop the first transport peer and runtime before opening the second, and retain the stale socket pathname for the original rotation/enrollment assertions. Move these restart fixture paths to the configured short scratch root. Increasing the SQLite busy timeout or adding a sleep would hide task ownership and make the test depend on host scheduling. The failing full-gate receipt precedes this change; fmt, strict server Clippy, twenty complete setup-token restart/enrollment passes and the existing-owner stale-socket test qualify it.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.06s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.32s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.40s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.87s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.04s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.26s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.96s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.20s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.46s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.29s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.31s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.13s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.03s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.05s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.18s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.94s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.91s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.21s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.14s

restart-runtime-fixture-ownership-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 01fe0793e1c5724697a8ec2da4beca160db48e74: Isolate restart fixtures across real runtime teardown (D128, D147). The full iteration gate exposed a locked database while the setup-token fixture recreated its router. Dropping only the first Router leaves its runtime-owned inventory watcher and database pool alive, unlike real process replacement. Give each startup phase its own current-thread runtime, drop the first transport peer and runtime before opening the second, and retain the stale socket pathname for the original rotation/enrollment assertions. Move these restart fixture paths to the configured short scratch root. Increasing the SQLite busy timeout or adding a sleep would hide task ownership and make the test depend on host scheduling. The failing full-gate receipt precedes this change; fmt, strict server Clippy, twenty complete setup-token restart/enrollment passes and the existing-owner stale-socket test qualify it. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.06s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.32s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.40s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.87s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.04s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.26s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.96s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.20s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.46s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.29s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.31s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.13s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.03s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.05s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.18s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.94s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.91s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 1.21s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 490 filtered out; finished in 0.14s ``` [restart-runtime-fixture-ownership-gate.log](https://git.kayg.org/attachments/cd61864a-0fc4-48e7-8a76-5bb4b94aa6ee) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 01:52:00 +00:00
Author
Owner
Copy link

Iteration rerun at 01fe0793e passed the repaired restart fixture; again 442 server tests passed, 1 failed, 48 ignored. Failure is the control-FIFO fixture's hardware 100 ms Output delivery assertion (remote_control_queue_tests.rs:236), with active blocked control, queued Pong, live primary and no shadow Output. Raw receipt: primitive-iterate-control-output-budget-failure.log. No host-load waiver.

Applying the standing owner rule that hardware timing budgets run only on the perf VM: split one reused fixture into a mandatory functional isolation oracle (blocked Call remains unresolved while the primary delivers, bounded by a deadlock watchdog) and a separately ignored hardware case retaining exactly 100 ms. The VM case additionally measures from before Output send; no deadline, credit, transport or production behavior changes. Before committing, the queued workflow must pass strict Clippy, 20 host functional repetitions, and 20 strict budget repetitions of the exact new static test harness on the locked perf VM, with artifact/patch SHA-256, machine/load and every metric attached. Building/copying/hash verification happen outside the VM lock.

This specific control-FIFO oracle is separate from the original P1 native PTY latency finding: final >=10 interleaved baseline/candidate pairs and the full updater acceptance remain outstanding. The timing threshold will not be raised or waived.

Iteration rerun at 01fe0793e passed the repaired restart fixture; again 442 server tests passed, 1 failed, 48 ignored. Failure is the control-FIFO fixture's hardware 100 ms Output delivery assertion (remote_control_queue_tests.rs:236), with active blocked control, queued Pong, live primary and no shadow Output. Raw receipt: [primitive-iterate-control-output-budget-failure.log](https://git.kayg.org/attachments/0267f8c8-697f-4d5c-b73f-b2b11bbf5cbd). No host-load waiver. Applying the standing owner rule that hardware timing budgets run only on the perf VM: split one reused fixture into a mandatory functional isolation oracle (blocked Call remains unresolved while the primary delivers, bounded by a deadlock watchdog) and a separately ignored hardware case retaining exactly 100 ms. The VM case additionally measures from before Output send; no deadline, credit, transport or production behavior changes. Before committing, the queued workflow must pass strict Clippy, 20 host functional repetitions, and 20 strict budget repetitions of the exact new static test harness on the locked perf VM, with artifact/patch SHA-256, machine/load and every metric attached. Building/copying/hash verification happen outside the VM lock. This specific control-FIFO oracle is separate from the original P1 native PTY latency finding: final >=10 interleaved baseline/candidate pairs and the full updater acceptance remain outstanding. The timing threshold will not be raised or waived.
kayg commented 2026-10-16 01:55:05 +00:00
Author
Owner
Copy link

Latest resumable snapshot at 01fe0793e: edge-recovery-continuation-01fe0793e.zip. Contains 79 files, hashes, the uncommitted FIFO test split, all ordered workflows and explicit qualification limits. Active entry is fix-native-control-budget-location.py through build-slot; it requires 20 functional + 20 strict VM passes before committing. Do not replay committed prefixes.

Prepared typed readiness consumer has a mandatory failing running-worker test before changes: retain the ready version and original queued owner proof, expose public waiting state, suppress next_window while blocked, sleep on readiness/operator/state events, then retry once after unlock. The interface/consumer remain uncompiled and the production checkpoint provider remains absent.

Exact proposed backend states/copy for the later UI pass:

reason message
disabled Enable backups to apply updates.
needs_setup Set up backups to apply updates.
locked Unlock backups to apply updates.
missing_administrator_copies Finish backup access for all administrators to apply updates.
signer_locked Unlock signing authority to apply updates.

Proposed API waiting object: version, reason, message; next_window=null while waiting; update_ready remains version/notes link; requested public state stays kind/version only. Never expose requester hashes, image paths, key IDs or private resources in this object. Existing per-version Inbox/toast deduplication remains. These are backend contract drafts, not implemented UI or completed VM acceptance.

Latest resumable snapshot at 01fe0793e: [edge-recovery-continuation-01fe0793e.zip](https://git.kayg.org/attachments/8f7613f7-3f4d-4c4e-923f-a02e8197f642). Contains 79 files, hashes, the uncommitted FIFO test split, all ordered workflows and explicit qualification limits. Active entry is fix-native-control-budget-location.py through build-slot; it requires 20 functional + 20 strict VM passes before committing. Do not replay committed prefixes. Prepared typed readiness consumer has a mandatory failing running-worker test before changes: retain the ready version and original queued owner proof, expose public waiting state, suppress next_window while blocked, sleep on readiness/operator/state events, then retry once after unlock. The interface/consumer remain uncompiled and the production checkpoint provider remains absent. Exact proposed backend states/copy for the later UI pass: | reason | message | |---|---| | disabled | Enable backups to apply updates. | | needs_setup | Set up backups to apply updates. | | locked | Unlock backups to apply updates. | | missing_administrator_copies | Finish backup access for all administrators to apply updates. | | signer_locked | Unlock signing authority to apply updates. | Proposed API waiting object: version, reason, message; next_window=null while waiting; update_ready remains version/notes link; requested public state stays kind/version only. Never expose requester hashes, image paths, key IDs or private resources in this object. Existing per-version Inbox/toast deduplication remains. These are backend contract drafts, not implemented UI or completed VM acceptance.
kayg commented 2026-10-16 02:11:55 +00:00
Author
Owner
Copy link

Rollback contract clarification from re-reading D155: “a downgrade restores the pre-upgrade backup”; D147 defines that backup as the consistent database, CA key and configuration snapshot, and D186 refines its encryption key. The earlier continuation note's suggested current-authority overlay is not an owner decision and must not replace these restore semantics. No overlay has been implemented.

Implementation must use current fresh requester authority and the original enabled scope to authorize the transition before stopping, bind both exact verified images, authenticate the complete selected point, then perform the D155 restoration. Public metadata never supplies restore authority. Restored CA material must be installed only against its restored retained issuer through the existing private parser/source boundary; no plaintext signing key file. A kernel-refused exec ran no migration and is a separate fallback path. Existing decisions remain unchanged; this job does not choose a new rollback policy.

Rollback contract clarification from re-reading D155: “a downgrade restores the pre-upgrade backup”; D147 defines that backup as the consistent database, CA key and configuration snapshot, and D186 refines its encryption key. The earlier continuation note's suggested current-authority overlay is not an owner decision and must not replace these restore semantics. No overlay has been implemented. Implementation must use current fresh requester authority and the original enabled scope to authorize the transition before stopping, bind both exact verified images, authenticate the complete selected point, then perform the D155 restoration. Public metadata never supplies restore authority. Restored CA material must be installed only against its restored retained issuer through the existing private parser/source boundary; no plaintext signing key file. A kernel-refused exec ran no migration and is a separate fallback path. Existing decisions remain unchanged; this job does not choose a new rollback policy.
kayg commented 2026-10-16 02:20:19 +00:00
Author
Owner
Copy link

D147/D155 configuration completeness refinement: a checkpoint must capture the encrypted CA administrator envelopes alongside the protected signer frame and retained issuer/TLS files. Otherwise a restored signer/administrator generation can disagree with its retained envelope configuration after later changes. Prepared a bounded read-only inventory extension to the existing EncryptedCopies adapter, plus three actual-filesystem tests for canonical ordering/generation, limits, aliases, shared modes, unknown files and non-repair. Configured host paths are admitted before capture; inventory labels never select restore destinations. Publication stays under the existing writer reservation, and complete point authentication must reject missing/extra labels. This is queued after private-resource host binding; not yet compiled or active in production. No plaintext signing-key persistence and no new library/engine.

D147/D155 configuration completeness refinement: a checkpoint must capture the encrypted CA administrator envelopes alongside the protected signer frame and retained issuer/TLS files. Otherwise a restored signer/administrator generation can disagree with its retained envelope configuration after later changes. Prepared a bounded read-only inventory extension to the existing EncryptedCopies adapter, plus three actual-filesystem tests for canonical ordering/generation, limits, aliases, shared modes, unknown files and non-repair. Configured host paths are admitted before capture; inventory labels never select restore destinations. Publication stays under the existing writer reservation, and complete point authentication must reject missing/extra labels. This is queued after private-resource host binding; not yet compiled or active in production. No plaintext signing-key persistence and no new library/engine.
kayg commented 2026-10-16 02:21:32 +00:00
Author
Owner
Copy link

At 01fe0793e, the proposed FIFO oracle split passed fmt, strict server Clippy and all 20 mandatory functional repetitions. Functional gate, exact static artifact/patch identity. Harness SHA-256 e7a3b8412002fc0fa4902d23c81142e982b469d3c4fa1f9cd589e1a76f57872e; test-only artifact, not a shipping-size result.

The strict 100 ms command is submitted through NetBird SSH with flock -w 3600 /var/lock/perf-bench.lock; its transcript is still empty, so no VM timing result is claimed. The workflow must obtain 20 strict VM passes before committing this test change, then rerun iterate and continue the ordered integration. Functional isolation uses a 2 s deadlock guard while the control Call remains blocked; the unchanged 100 ms hardware requirement is kept separately on the VM and measured from before Output send. No threshold increase or load waiver.

Active managed workflow: fix-native-control-budget-location.py (host wrapper PID 516170, session 32131). No user action requested; wait for the shared measurement resource as instructed. Production recovery/provider and the original native PTY A/B acceptance remain unfinished.

At 01fe0793e, the proposed FIFO oracle split passed fmt, strict server Clippy and all 20 mandatory functional repetitions. [Functional gate](https://git.kayg.org/attachments/d97c5169-4382-4145-bec9-88edf0c5d37b), [exact static artifact/patch identity](https://git.kayg.org/attachments/2617f72b-1d9b-4ed8-b8d8-b5ebc8e2d99f). Harness SHA-256 e7a3b8412002fc0fa4902d23c81142e982b469d3c4fa1f9cd589e1a76f57872e; test-only artifact, not a shipping-size result. The strict 100 ms command is submitted through NetBird SSH with flock -w 3600 /var/lock/perf-bench.lock; its transcript is still empty, so no VM timing result is claimed. The workflow must obtain 20 strict VM passes before committing this test change, then rerun iterate and continue the ordered integration. Functional isolation uses a 2 s deadlock guard while the control Call remains blocked; the unchanged 100 ms hardware requirement is kept separately on the VM and measured from before Output send. No threshold increase or load waiver. Active managed workflow: fix-native-control-budget-location.py (host wrapper PID 516170, session 32131). No user action requested; wait for the shared measurement resource as instructed. Production recovery/provider and the original native PTY A/B acceptance remain unfinished.
kayg commented 2026-10-16 02:32:53 +00:00
Author
Owner
Copy link

Continuation at 01fe0793e: native FIFO strict test is waiting under flock -w 3600 on the perf VM; no measurement result yet. Twenty functional repetitions and targeted Clippy passed as previously attached. Recovery primitive qualification is queued through build-slot. Next managed sequence is now iterate -> ordered atomic recovery module gates; intermediate diagnostic S/Z fixture builds are preserved separately rather than delaying the missing recovery provider. Final production-recipe target/cap qualification, native A/B, real updater acceptance and final fast remain mandatory and incomplete.

Continuation at 01fe0793e: native FIFO strict test is waiting under flock -w 3600 on the perf VM; no measurement result yet. Twenty functional repetitions and targeted Clippy passed as previously attached. Recovery primitive qualification is queued through build-slot. Next managed sequence is now iterate -> ordered atomic recovery module gates; intermediate diagnostic S/Z fixture builds are preserved separately rather than delaying the missing recovery provider. Final production-recipe target/cap qualification, native A/B, real updater acceptance and final fast remain mandatory and incomplete.
kayg commented 2026-10-16 02:35:32 +00:00
Author
Owner
Copy link

Independent managed actual-source qualification after protected key commitment caching, checked existing-provider hashing, joined guardian cancellation I/O and backup-only storage compile-out preparation. This overlaps only the pending remote VM resource wait, not another source mutation. Verbatim test summaries:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 64 filtered out; finished in 0.07s
test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.81s

protected-draft-independent-qualification-gate.log
protected-draft-independent-qualification-source.json

No production recovery provider or final acceptance is claimed.

Independent managed actual-source qualification after protected key commitment caching, checked existing-provider hashing, joined guardian cancellation I/O and backup-only storage compile-out preparation. This overlaps only the pending remote VM resource wait, not another source mutation. Verbatim test summaries: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 64 filtered out; finished in 0.07s test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.81s ``` [protected-draft-independent-qualification-gate.log](https://git.kayg.org/attachments/f78094a3-4213-4302-8054-32afeced4cf7) [protected-draft-independent-qualification-source.json](https://git.kayg.org/attachments/5d0922b6-260e-4bcf-aa99-21cdb352f9de) No production recovery provider or final acceptance is claimed.
kayg commented 2026-10-16 02:41:03 +00:00
Author
Owner
Copy link

Resumable source/workflow snapshot at 01fe0793e (not a qualified production implementation): archive with per-file hashes and status.

Actual-source prototype now passes 65 tests and strict Clippy; separate receipts attached in the preceding qualification comment. Added the next uncompiled broker/host-boundary draft and a real-SQLite/key-ceremony cancellation/reservation scenario. It bounds preparation to one running plus one queued request, keeps the enabled original epoch and defaults host callbacks to refusal; it does not install a functioning checkpoint provider.

Stopped only the owned local gate coordinator to free an idle host build slot. That also ended its local VM client; checked the exact owned remote waiter was gone, removed only its q6ff457c fixture directory and restarted the unchanged 20-run strict VM test independently. No VM result or timing acceptance is claimed. The recovery chain is queued via build-slot; branch mutations remain serialized. Final native pairs, signed staging acceptance, size qualification and fast remain open.

Resumable source/workflow snapshot at 01fe0793e (not a qualified production implementation): [archive with per-file hashes and status](https://git.kayg.org/attachments/e9221b0d-de36-447a-ba6d-ed9877ad3f51). Actual-source prototype now passes 65 tests and strict Clippy; separate receipts attached in the preceding qualification comment. Added the next uncompiled broker/host-boundary draft and a real-SQLite/key-ceremony cancellation/reservation scenario. It bounds preparation to one running plus one queued request, keeps the enabled original epoch and defaults host callbacks to refusal; it does not install a functioning checkpoint provider. Stopped only the owned local gate coordinator to free an idle host build slot. That also ended its local VM client; checked the exact owned remote waiter was gone, removed only its q6ff457c fixture directory and restarted the unchanged 20-run strict VM test independently. No VM result or timing acceptance is claimed. The recovery chain is queued via build-slot; branch mutations remain serialized. Final native pairs, signed staging acceptance, size qualification and fast remain open.
kayg commented 2026-10-16 02:42:34 +00:00
Author
Owner
Copy link

Backend/UI handoff copy clarification (UI remains out of scope). Existing committed status exposes current_version, channel, quiet_minutes, update_ready {version,notes_url,automatic}, next_window, waiting_for_connections, requested {kind,version}, previous_version, last_result, history and error. Ready Inbox item: id release-{version}; title “Update ready · {version}”; action release.update.now. One-time toast: type update_ready, same title/version/action; persisted per-version notification receipt prevents re-emission on repeat checks.

Pending recovery-consumer draft adds waiting=null or {version,reason,message}, bound to the selected requested/ready version. While waiting, next_window=null; the verified image and original owner request are retained. Exact planned reason/message pairs:

  • disabled — “Enable backups to apply updates.”
  • needs_setup — “Set up backups to apply updates.”
  • locked — “Unlock backups to apply updates.”
  • missing_administrator_copies — “Finish backup access for all administrators to apply updates.”
  • signer_locked — “Unlock signing authority to apply updates.”

Keep controls “Update now” (release.update.now) and “Roll back” (release.rollback). Recovery waiting is retryable readiness, not a permanent rejected-image result. Disabled release remains unavailable through the existing feature boundary. No toast/Inbox/Settings UI is implemented by this backend job; recovery waiting is not yet production-wired or qualified.

Backend/UI handoff copy clarification (UI remains out of scope). Existing committed status exposes current_version, channel, quiet_minutes, update_ready {version,notes_url,automatic}, next_window, waiting_for_connections, requested {kind,version}, previous_version, last_result, history and error. Ready Inbox item: id release-{version}; title “Update ready · {version}”; action release.update.now. One-time toast: type update_ready, same title/version/action; persisted per-version notification receipt prevents re-emission on repeat checks. Pending recovery-consumer draft adds waiting=null or {version,reason,message}, bound to the selected requested/ready version. While waiting, next_window=null; the verified image and original owner request are retained. Exact planned reason/message pairs: - disabled — “Enable backups to apply updates.” - needs_setup — “Set up backups to apply updates.” - locked — “Unlock backups to apply updates.” - missing_administrator_copies — “Finish backup access for all administrators to apply updates.” - signer_locked — “Unlock signing authority to apply updates.” Keep controls “Update now” (release.update.now) and “Roll back” (release.rollback). Recovery waiting is retryable readiness, not a permanent rejected-image result. Disabled release remains unavailable through the existing feature boundary. No toast/Inbox/Settings UI is implemented by this backend job; recovery waiting is not yet production-wired or qualified.
kayg commented 2026-10-16 02:52:14 +00:00
Author
Owner
Copy link

Primitive milestone at 01fe0793e1: scripts/verify iterate passed through build-slot. primitive-iterate-gate.log

This is an iteration gate, not final scripts/verify fast or performance qualification. Encrypted update recovery integration, fresh signed VM acceptance, profile/cap qualification and final fast remain incomplete.

Primitive milestone at 01fe0793e1c5724697a8ec2da4beca160db48e74: scripts/verify iterate passed through build-slot. [primitive-iterate-gate.log](https://git.kayg.org/attachments/9502a096-2bf8-4c03-8e31-dae85b543f81) This is an iteration gate, not final scripts/verify fast or performance qualification. Encrypted update recovery integration, fresh signed VM acceptance, profile/cap qualification and final fast remain incomplete.
kayg commented 2026-10-16 02:52:43 +00:00
Author
Owner
Copy link

Fresh actual-source prototype after replacing secret-bearing Rust hash buffering with the existing checked provider/public commitment cache, and retaining synchronous guardian cancellation ownership while yielding the scheduler. Functional summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 64 filtered out; finished in 0.06s
test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.72s

key-authority-prototype-rerun-gate.log
protected-key-identity-prototype-source.json

This is prototype qualification only; production recovery/provider/startup and VM acceptance remain incomplete.

Fresh actual-source prototype after replacing secret-bearing Rust hash buffering with the existing checked provider/public commitment cache, and retaining synchronous guardian cancellation ownership while yielding the scheduler. Functional summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 64 filtered out; finished in 0.06s test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.72s ``` [key-authority-prototype-rerun-gate.log](https://git.kayg.org/attachments/de1594f4-af15-4c5a-8c20-3f3d968a064d) [protected-key-identity-prototype-source.json](https://git.kayg.org/attachments/8185aab7-41ff-4317-bc9e-d50af2b9c03a) This is prototype qualification only; production recovery/provider/startup and VM acceptance remain incomplete.
kayg commented 2026-10-16 02:52:55 +00:00
Author
Owner
Copy link

Iteration source clarification: the green iterate run recorded at 01fe0793e includes the still-uncommitted remote_control_queue_tests.rs functional/strict-VM split (patch hash 2db0c503b3810a7f6f17d37d69a628d0d622caee6e39f677ce5f412afe6e957a). Its production sources are at that head; this does not qualify the 100 ms assertion, which still requires the independent VM run. Server summary: 443 passed; 0 failed; 49 ignored. The final line is verbatim: “ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.” Subsequent actual-source prototype rerun again passed 65 tests and strict Clippy before manifest/module wiring. An obsolete diagnostic-fixture guard stopped the transition after the green gate; removed the stale guard and resumed module gates in the existing managed slot. No application gate threshold or production fallback changed.

Iteration source clarification: the green iterate run recorded at 01fe0793e includes the still-uncommitted remote_control_queue_tests.rs functional/strict-VM split (patch hash 2db0c503b3810a7f6f17d37d69a628d0d622caee6e39f677ce5f412afe6e957a). Its production sources are at that head; this does not qualify the 100 ms assertion, which still requires the independent VM run. Server summary: 443 passed; 0 failed; 49 ignored. The final line is verbatim: “ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.” Subsequent actual-source prototype rerun again passed 65 tests and strict Clippy before manifest/module wiring. An obsolete diagnostic-fixture guard stopped the transition after the green gate; removed the stale guard and resumed module gates in the existing managed slot. No application gate threshold or production fallback changed.
kayg commented 2026-10-16 02:54:28 +00:00
Author
Owner
Copy link

Committed and pushed 48b645ee90: Prepare optional shared encryption and protected backup keys (D186, D244).

Reuse the pinned OpenSSL, SHA-256, serialization, zeroization and anonymous protected-page implementations already in the workspace. Keep backup encryption and protected key memory separately removable, with no default runtime. The remote CA consumer opts into the shared encryption feature in preparation for removing its duplicate cipher invocation. Adding another crypto engine or enabling database/encryption work for metadata-only backup inspection would increase size and weaken compile-out boundaries. This dependency slice does not install or unlock a backup key.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 6 passed; 0 failed; 1 ignored; 0 measured; 485 filtered out; finished in 0.01s

backup-encryption-dependencies-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 48b645ee90c2902508e1aa941255d7dd06033850: Prepare optional shared encryption and protected backup keys (D186, D244). Reuse the pinned OpenSSL, SHA-256, serialization, zeroization and anonymous protected-page implementations already in the workspace. Keep backup encryption and protected key memory separately removable, with no default runtime. The remote CA consumer opts into the shared encryption feature in preparation for removing its duplicate cipher invocation. Adding another crypto engine or enabling database/encryption work for metadata-only backup inspection would increase size and weaken compile-out boundaries. This dependency slice does not install or unlock a backup key. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 6 passed; 0 failed; 1 ignored; 0 measured; 485 filtered out; finished in 0.01s ``` [backup-encryption-dependencies-gate.log](https://git.kayg.org/attachments/6f484e4e-7c8f-4826-8f70-22d712960570) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 02:54:49 +00:00
Author
Owner
Copy link

Committed and pushed f518a31134: Share authenticated encryption into caller-owned private storage (D168, D186).

Provide one optional existing-engine AES-256-GCM implementation for CA and backup consumers. Fresh random nonces and nonempty purpose-bound associated data are mandatory; lengths are bounded before entering the signed C cipher API. Decryption uses caller-owned output and an unwinding guard clears every unauthenticated byte on errors or panic. Successful output clears only its unused tail. A convenience decrypt-to-Vec API would leave unauthenticated allocator copies and force protected-memory callers to copy the key again. Four functional tests cover existing-engine interoperability, altered fields, short output, unwinding and arithmetic bounds.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 27 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

shared-sealed-bytes-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f518a31134aa0b209d59c3b9d3ad5afa943f288d: Share authenticated encryption into caller-owned private storage (D168, D186). Provide one optional existing-engine AES-256-GCM implementation for CA and backup consumers. Fresh random nonces and nonempty purpose-bound associated data are mandatory; lengths are bounded before entering the signed C cipher API. Decryption uses caller-owned output and an unwinding guard clears every unauthenticated byte on errors or panic. Successful output clears only its unused tail. A convenience decrypt-to-Vec API would leave unauthenticated allocator copies and force protected-memory callers to copy the key again. Four functional tests cover existing-engine interoperability, altered fields, short output, unwinding and arithmetic bounds. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 27 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [shared-sealed-bytes-gate.log](https://git.kayg.org/attachments/f94be4c7-66aa-44b0-9eb5-d982f9ca931e) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 02:55:53 +00:00
Author
Owner
Copy link

Committed and pushed 7cf4f97501: Preserve encrypted CA copy interoperability before cipher reuse (D168).

Check both directions against direct existing-engine encryption and decryption, including serialized administrator copies, before changing the production cipher adapter. Validate restored public-key identity without printing seed material. A roundtrip through only the replacement implementation could pass after an accidental wire-format change and strand existing administrator copies.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 7 passed; 0 failed; 1 ignored; 0 measured; 485 filtered out; finished in 0.01s

ca-copy-wire-compatibility-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 7cf4f97501eecf605db18580f1796fc0df33914d: Preserve encrypted CA copy interoperability before cipher reuse (D168). Check both directions against direct existing-engine encryption and decryption, including serialized administrator copies, before changing the production cipher adapter. Validate restored public-key identity without printing seed material. A roundtrip through only the replacement implementation could pass after an accidental wire-format change and strand existing administrator copies. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 7 passed; 0 failed; 1 ignored; 0 measured; 485 filtered out; finished in 0.01s ``` [ca-copy-wire-compatibility-gate.log](https://git.kayg.org/attachments/1a12ae9e-63d1-4d08-a9c1-aa9cb6fd3e3d) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 02:56:34 +00:00
Author
Owner
Copy link

Committed and pushed 3723a17648: Reuse the shared cipher without changing CA copy bindings (D168, D186).

Remove the independent CA encryption/decryption invocation and use the same optional AES-256-GCM helper as backup consumers. Preserve every existing JSON field, binding byte, nonce length and ciphertext/tag layout. Decrypt seed material directly into existing locked dump-excluded pages instead of an ordinary heap buffer. The direct legacy-engine interoperability regression and actual CA administration tests pass. Copying the cipher into the backup component would duplicate security-critical behavior and miss shared failure wiping; changing the persisted CA envelope is unnecessary.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 7 passed; 0 failed; 1 ignored; 0 measured; 485 filtered out; finished in 0.01s
test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 451 filtered out; finished in 17.13s

ca-shared-cipher-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 3723a17648a54b07464d3ec8407536c1afd6f536: Reuse the shared cipher without changing CA copy bindings (D168, D186). Remove the independent CA encryption/decryption invocation and use the same optional AES-256-GCM helper as backup consumers. Preserve every existing JSON field, binding byte, nonce length and ciphertext/tag layout. Decrypt seed material directly into existing locked dump-excluded pages instead of an ordinary heap buffer. The direct legacy-engine interoperability regression and actual CA administration tests pass. Copying the cipher into the backup component would duplicate security-critical behavior and miss shared failure wiping; changing the persisted CA envelope is unnecessary. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 7 passed; 0 failed; 1 ignored; 0 measured; 485 filtered out; finished in 0.01s test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 451 filtered out; finished in 17.13s ``` [ca-shared-cipher-gate.log](https://git.kayg.org/attachments/9e6d6044-3e3c-478c-b229-adea33eb72e8) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 02:56:45 +00:00
Author
Owner
Copy link

Committed and pushed e50cf38ea8: Bind encrypted backup keys to administrator generations (D186).

Seal the independent backup key for each explicit administrator using the shared cipher and a backup-specific authenticated domain. Bind public key identity, generation, member and derivation salt; the retained key identity is checked again against decrypted material. Decode is bounded and rejects unknown fields. Every refusal clears caller-owned output. An encrypted copy never supplies authority: runtime callers still need a fresh purpose-bound passkey proof and serialized live membership check. Reusing the CA key or a personal recovery secret conflicts with D186; accepting a self-described replacement key could orphan existing backups.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

backup-key-copy-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed e50cf38ea840596ebec224d2674b799ba8bd7fee: Bind encrypted backup keys to administrator generations (D186). Seal the independent backup key for each explicit administrator using the shared cipher and a backup-specific authenticated domain. Bind public key identity, generation, member and derivation salt; the retained key identity is checked again against decrypted material. Decode is bounded and rejects unknown fields. Every refusal clears caller-owned output. An encrypted copy never supplies authority: runtime callers still need a fresh purpose-bound passkey proof and serialized live membership check. Reusing the CA key or a personal recovery secret conflicts with D186; accepting a self-described replacement key could orphan existing backups. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [backup-key-copy-gate.log](https://git.kayg.org/attachments/d7f9dabd-f6c5-4c31-bd9e-c110e25556e4) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 02:56:53 +00:00
Author
Owner
Copy link

Committed and pushed c890d4d174: Bind encrypted recovery resources to verified handoff images (D147, D186).

Authenticate checkpoint identity, predecessor and successor image digests and a closed resource kind for every bounded encrypted record. The caller retains plaintext ownership and uses protected pages for CA material. Refuse empty, oversized, substituted or incorrectly authenticated records with output wiping. Open-ended paths from encrypted metadata could choose arbitrary restore targets; unbound ciphertext could mix an older configuration or CA record into a different checkpoint. These primitives do not publish a checkpoint or perform a persistent restore.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

backup-resource-encryption-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed c890d4d1742fdc67ccc2e94c3c4aa9ac1973b05b: Bind encrypted recovery resources to verified handoff images (D147, D186). Authenticate checkpoint identity, predecessor and successor image digests and a closed resource kind for every bounded encrypted record. The caller retains plaintext ownership and uses protected pages for CA material. Refuse empty, oversized, substituted or incorrectly authenticated records with output wiping. Open-ended paths from encrypted metadata could choose arbitrary restore targets; unbound ciphertext could mix an older configuration or CA record into a different checkpoint. These primitives do not publish a checkpoint or perform a persistent restore. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [backup-resource-encryption-gate.log](https://git.kayg.org/attachments/0fc154d3-4a2e-42df-bdf5-e9257f66aa4b) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 02:57:08 +00:00
Author
Owner
Copy link

Committed and pushed 405cdee568: Keep backup keys and admitted leases in protected pages (D186, D244).

Generate the independent key directly in existing anonymous locked, dump-excluded pages, and decrypt administrator copies directly into the same protected ownership. Cold state retains only a public identity and cannot unlock itself from encrypted files. A trusted fresh-proof adapter installs only the exact retained key; admitted checkpoints receive bounded protected leases without ordinary allocator copies. Disable drops process-owned material while existing admitted operations retain their own lease. Plain Vec ownership, automatic cold-start generation and CA-derived keys were rejected because they break key custody or make old backups unreachable.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

backup-key-memory-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 405cdee568221627b565bf3b423b72d00366bac2: Keep backup keys and admitted leases in protected pages (D186, D244). Generate the independent key directly in existing anonymous locked, dump-excluded pages, and decrypt administrator copies directly into the same protected ownership. Cold state retains only a public identity and cannot unlock itself from encrypted files. A trusted fresh-proof adapter installs only the exact retained key; admitted checkpoints receive bounded protected leases without ordinary allocator copies. Disable drops process-owned material while existing admitted operations retain their own lease. Plain Vec ownership, automatic cold-start generation and CA-derived keys were rejected because they break key custody or make old backups unreachable. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [backup-key-memory-gate.log](https://git.kayg.org/attachments/077345fe-4854-4cc1-a315-81a7d6c49c16) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 02:59:53 +00:00
Author
Owner
Copy link

Committed and pushed 9c9fc463f3: Share explicit key-administrator checks across key custody (D168, D186).

Move the unchanged session, credential and explicit administrator-generation queries behind one optional shared plugin-API authentication helper, alongside the existing shared session check. Keep the existing CA public functions and static error behavior through a thin adapter. The existing generation ledger remains the authority; owner flags remain bootstrap-only and no new administrator table is invented. This prepares backup key ceremonies to reuse the same serialized revocation checks instead of duplicating security SQL or treating app roles as key custody. Actual CA membership and ceremony tests plus the remote-disabled build remain green; backup runtime ceremonies are not yet wired.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 489 filtered out; finished in 1.96s
test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 451 filtered out; finished in 16.39s

shared-key-administrator-authority-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 9c9fc463f3b560f39a66e069a3cedf473572a55b: Share explicit key-administrator checks across key custody (D168, D186). Move the unchanged session, credential and explicit administrator-generation queries behind one optional shared plugin-API authentication helper, alongside the existing shared session check. Keep the existing CA public functions and static error behavior through a thin adapter. The existing generation ledger remains the authority; owner flags remain bootstrap-only and no new administrator table is invented. This prepares backup key ceremonies to reuse the same serialized revocation checks instead of duplicating security SQL or treating app roles as key custody. Actual CA membership and ceremony tests plus the remote-disabled build remain green; backup runtime ceremonies are not yet wired. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 489 filtered out; finished in 1.96s test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 451 filtered out; finished in 16.39s ``` [shared-key-administrator-authority-gate.log](https://git.kayg.org/attachments/1778aa25-02a9-466a-b5e1-9fba6ed05c5d) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:00:11 +00:00
Author
Owner
Copy link

Committed and pushed 2566c3be33: Expose optional backup metadata decoding to parser fuzzing (D12, D186).

Enable only the backup encryption metadata surface in the existing nonshipping fuzz package. Reuse the same optional crypto/serialization dependencies rather than invent a second decoder in a harness. This manifest step changes no shipping feature or runtime behavior and prepares the next bounded-copy corpus target.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

backup-parser-fuzz-dependency-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 2566c3be33a5e54a60289dc73369fe07af3566e8: Expose optional backup metadata decoding to parser fuzzing (D12, D186). Enable only the backup encryption metadata surface in the existing nonshipping fuzz package. Reuse the same optional crypto/serialization dependencies rather than invent a second decoder in a harness. This manifest step changes no shipping feature or runtime behavior and prepares the next bounded-copy corpus target. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [backup-parser-fuzz-dependency-gate.log](https://git.kayg.org/attachments/60de5efe-3818-4955-bf11-ca70c513f52f) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:00:17 +00:00
Author
Owner
Copy link

Committed and pushed a1cd0e59bb: Fuzz bounded backup-key copies and failed-unlock wiping (D12, D186).

Feed arbitrary bytes to the actual bounded encrypted-copy decoder. Accepted records must retain canonical encrypted serialization, public key identity and derivation salt through a roundtrip. An attempted unwrap with the public corpus wrapping key must clear all caller output on refusal. Keeping only example JSON tests would miss malformed nesting, duplicate fields and length interactions. This commit adds a target; an instrumented campaign remains part of final qualification and is not claimed here.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

backup-key-copy-fuzz-target-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed a1cd0e59bb67a8ffe0f452ce6f483d3b8d9679c3: Fuzz bounded backup-key copies and failed-unlock wiping (D12, D186). Feed arbitrary bytes to the actual bounded encrypted-copy decoder. Accepted records must retain canonical encrypted serialization, public key identity and derivation salt through a roundtrip. An attempted unwrap with the public corpus wrapping key must clear all caller output on refusal. Keeping only example JSON tests would miss malformed nesting, duplicate fields and length interactions. This commit adds a target; an instrumented campaign remains part of final qualification and is not claimed here. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [backup-key-copy-fuzz-target-gate.log](https://git.kayg.org/attachments/76bd3e51-e58b-4197-861a-33922bde97ef) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:04:16 +00:00
Author
Owner
Copy link

Committed and pushed 99f5c8a697: Define an optional protected-input path for sensitive plugin actions (D16, D186, D198).

Add an optional private-action interface using the same ActionDef and SocketHost types. The trusted host owns protected input and lifecycle admission; cookie/header parsing and the HTTP engine stay outside the plugin API. Default implementations expose no private actions and start no work. Share the existing strict key-proof JSON shape without granting authority on decode. Sending wrapping keys through ordinary plugin messages risks event/recording exposure; adding another HTTP stack or embedding the host engine in the API is unnecessary. This is an interface, not a mounted endpoint.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

private-action-interface-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 99f5c8a6979e8c56786c1b16d3d60305a6aae5a1: Define an optional protected-input path for sensitive plugin actions (D16, D186, D198). Add an optional private-action interface using the same ActionDef and SocketHost types. The trusted host owns protected input and lifecycle admission; cookie/header parsing and the HTTP engine stay outside the plugin API. Default implementations expose no private actions and start no work. Share the existing strict key-proof JSON shape without granting authority on decode. Sending wrapping keys through ordinary plugin messages risks event/recording exposure; adding another HTTP stack or embedding the host engine in the API is unnecessary. This is an interface, not a mounted endpoint. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [private-action-interface-gate.log](https://git.kayg.org/attachments/dc3feb41-8267-4af1-ac25-a9bf796762fa) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:06:30 +00:00
Author
Owner
Copy link

Committed and pushed 4f25538604: Reuse the strict private proof codec for CA unlock requests (D168, D186).

Replace the duplicate CA JSON body decoder with the shared bounded key-proof codec while preserving the existing public UnlockRequest name and static CaError adapter. Keep protected HTTP intake, origin/session admission and purpose-bound real passkey authorization in place. The old field shape and unknown-field/identifier bounds are unchanged; decoding still grants no key custody. A separate backup request decoder would duplicate the sensitive transient-key ownership and refusal rules. Existing CA HTTP, administration and parser-harness checks remain green.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 488 filtered out; finished in 2.02s
test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 451 filtered out; finished in 15.94s

ca-private-body-codec-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 4f2553860426765d98df9270fa2169530a46315a: Reuse the strict private proof codec for CA unlock requests (D168, D186). Replace the duplicate CA JSON body decoder with the shared bounded key-proof codec while preserving the existing public UnlockRequest name and static CaError adapter. Keep protected HTTP intake, origin/session admission and purpose-bound real passkey authorization in place. The old field shape and unknown-field/identifier bounds are unchanged; decoding still grants no key custody. A separate backup request decoder would duplicate the sensitive transient-key ownership and refusal rules. Existing CA HTTP, administration and parser-harness checks remain green. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 488 filtered out; finished in 2.02s test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 451 filtered out; finished in 15.94s ``` [ca-private-body-codec-gate.log](https://git.kayg.org/attachments/3641dce0-9bea-4199-9cb4-fb0a25b0f1b3) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:07:13 +00:00
Author
Owner
Copy link

Committed and pushed 3cf5e18165: Bridge private component proofs to the existing passkey verifier (D168, D186).

Implement the optional key-proof host interface with the existing single-use real verifier. Components receive only opaque verified identity/credential/timestamps; the host retains verifier state, and components still own their exact purpose registry and final membership check. The real software-passkey regression checks replay refusal, unchanged session count and unchanged stale session freshness through this adapter. Calling ordinary login completion here would create browser authority as a side effect; inventing a component-local verifier would duplicate security-sensitive state and validation.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 488 filtered out; finished in 3.63s

private-key-proof-host-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 3cf5e181653789630c4d97d20c88be87d74d3742: Bridge private component proofs to the existing passkey verifier (D168, D186). Implement the optional key-proof host interface with the existing single-use real verifier. Components receive only opaque verified identity/credential/timestamps; the host retains verifier state, and components still own their exact purpose registry and final membership check. The real software-passkey regression checks replay refusal, unchanged session count and unchanged stale session freshness through this adapter. Calling ordinary login completion here would create browser authority as a side effect; inventing a component-local verifier would duplicate security-sensitive state and validation. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 488 filtered out; finished in 3.63s ``` [private-key-proof-host-gate.log](https://git.kayg.org/attachments/f5ee5266-89c5-447d-a38c-7b8b447ff08f) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:17:38 +00:00
Author
Owner
Copy link

Optional encrypted primitives and private-action interface milestone at 3cf5e18165: scripts/verify iterate passed through build-slot. encrypted-primitives-iterate-gate.log

This is an iteration gate. Production checkpoint storage, backup key ceremonies, startup recovery/guardian, fresh VM update acceptance, final size qualification and final scripts/verify fast remain incomplete.

Optional encrypted primitives and private-action interface milestone at 3cf5e181653789630c4d97d20c88be87d74d3742: scripts/verify iterate passed through build-slot. [encrypted-primitives-iterate-gate.log](https://git.kayg.org/attachments/331abf66-f946-4711-9ee7-2b8c7c8ab960) This is an iteration gate. Production checkpoint storage, backup key ceremonies, startup recovery/guardian, fresh VM update acceptance, final size qualification and final scripts/verify fast remain incomplete.
kayg commented 2026-10-16 03:18:36 +00:00
Author
Owner
Copy link

Committed and pushed 110e2cba76: Separate native FIFO isolation from its unchanged VM timing budget (D128, D265).

The full shared-host gate failed a 100 ms hardware delivery assertion despite healthy independent native lanes. Reuse exactly one real QUIC/control-saturation fixture for two oracles: mandatory functional delivery under a deadlock watchdog while the control Call stays blocked, and the original 100 ms budget on the exclusively locked perf VM. The timing case additionally measures from before Output send, preserving and strengthening its acceptance boundary. No production code, credit, transport deadlines or budget changes. Twenty host functional repetitions and twenty strict VM budget repetitions must pass before this commit. Merely increasing the old timing threshold or waiving the failed row would discard the latency requirement.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.11s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s

native-control-isolation-functional-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 110e2cba7646d1882a84ebd6010bd5f9ec01dd46: Separate native FIFO isolation from its unchanged VM timing budget (D128, D265). The full shared-host gate failed a 100 ms hardware delivery assertion despite healthy independent native lanes. Reuse exactly one real QUIC/control-saturation fixture for two oracles: mandatory functional delivery under a deadlock watchdog while the control Call stays blocked, and the original 100 ms budget on the exclusively locked perf VM. The timing case additionally measures from before Output send, preserving and strengthening its acceptance boundary. No production code, credit, transport deadlines or budget changes. Twenty host functional repetitions and twenty strict VM budget repetitions must pass before this commit. Merely increasing the old timing threshold or waiving the failed row would discard the latency requirement. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.11s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.09s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.07s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.08s ``` [native-control-isolation-functional-gate.log](https://git.kayg.org/attachments/f0baf1c4-8f86-4c02-9f3b-9a71d7e4d89c) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:18:39 +00:00
Author
Owner
Copy link

Strict control-FIFO VM evidence for the preceding test split. Exact artifact/patch identity attached; no shipping-native or updater acceptance claim.

ENV {"artifact": {"artifact": "/home/kayg/.cache/codex-scratch/edge-autoupdate/target/x86_64-unknown-linux-musl/release/deps/infraternal_server-b8fc26df8b5f9ddb", "base_head": "01fe0793e1c5724697a8ec2da4beca160db48e74", "budget_ms": 100, "bytes": 29464040, "runs": 20, "sha256": "e7a3b8412002fc0fa4902d23c81142e982b469d3c4fa1f9cd589e1a76f57872e", "status": "static test harness for exact uncommitted budget/functional split, not a shipping artifact", "test_patch_sha256": "2db0c503b3810a7f6f17d37d69a628d0d622caee6e39f677ce5f412afe6e957a"}, "cpus": 4, "host": "infraternal-perf-test", "load_before": "0.05 0.12 0.53 1/2247 403098", "memory": "MemTotal:        8069112 kB"}
METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.110 budget_ms=100.000
METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.227 budget_ms=100.000
METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.317 budget_ms=100.000
METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.173 budget_ms=100.000
METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.149 budget_ms=100.000
CONTROL_FIFO_BUDGET passes=20 budget_ms=100 source=real-loopback-quic-primary-with-blocked-control shadow_output=0
ENV load_after=0.12 0.13 0.54 3/2248 403239

native-control-budget-static-harness-gate.log
control-fifo-budget-artifact.json
control-fifo-budget-vm.log

Strict control-FIFO VM evidence for the preceding test split. Exact artifact/patch identity attached; no shipping-native or updater acceptance claim. ```text ENV {"artifact": {"artifact": "/home/kayg/.cache/codex-scratch/edge-autoupdate/target/x86_64-unknown-linux-musl/release/deps/infraternal_server-b8fc26df8b5f9ddb", "base_head": "01fe0793e1c5724697a8ec2da4beca160db48e74", "budget_ms": 100, "bytes": 29464040, "runs": 20, "sha256": "e7a3b8412002fc0fa4902d23c81142e982b469d3c4fa1f9cd589e1a76f57872e", "status": "static test harness for exact uncommitted budget/functional split, not a shipping artifact", "test_patch_sha256": "2db0c503b3810a7f6f17d37d69a628d0d622caee6e39f677ce5f412afe6e957a"}, "cpus": 4, "host": "infraternal-perf-test", "load_before": "0.05 0.12 0.53 1/2247 403098", "memory": "MemTotal: 8069112 kB"} METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.110 budget_ms=100.000 METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.227 budget_ms=100.000 METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.317 budget_ms=100.000 METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.173 budget_ms=100.000 METRIC name=native_control_fifo_primary_delivery elapsed_ms=0.149 budget_ms=100.000 CONTROL_FIFO_BUDGET passes=20 budget_ms=100 source=real-loopback-quic-primary-with-blocked-control shadow_output=0 ENV load_after=0.12 0.13 0.54 3/2248 403239 ``` [native-control-budget-static-harness-gate.log](https://git.kayg.org/attachments/4a676a93-3dfc-4834-8c29-284388e26890) [control-fifo-budget-artifact.json](https://git.kayg.org/attachments/3d11f3e4-45ad-4727-b816-ef9216add941) [control-fifo-budget-vm.log](https://git.kayg.org/attachments/4c524f14-c803-49f2-ad47-bd1ec831c232)
kayg commented 2026-10-16 03:19:03 +00:00
Author
Owner
Copy link

Committed and pushed 110e2cba76 after 20/20 strict control-FIFO VM runs: min 0.082 ms, max 0.317 ms, unchanged 100.000 ms budget. Machine infraternal-perf-test, 4 CPUs, MemTotal 8069112 kB; VM load before 0.05/0.12/0.53, after 0.12/0.13/0.54. Exact base 01fe0793e, static test harness SHA e7a3b8412002fc0fa4902d23c81142e982b469d3c4fa1f9cd589e1a76f57872e and test patch SHA 2db0c503b3810a7f6f17d37d69a628d0d622caee6e39f677ce5f412afe6e957a are in the attached receipt. This is the isolated control-FIFO oracle, not EA-02 shipping-native A/B or final updater acceptance. Those remain open; final measurements must use final artifacts.

The encrypted-primitives iterate milestone also passed at production source 3cf5e1816 plus that then-pending test split: 445 server tests passed, 0 failed; TypeScript 37 pass, 0 fail. Verbatim ending:

ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.

The new test commit was serialized by briefly stopping only the owned module-coordinator PID, then resuming it in finally; the source index was empty before staging only the test file. The owned VM fixture was removed by its successful driver. Recovery module gates continue in the existing managed build slot. No final fast claim.

Committed and pushed 110e2cba7646d1882a84ebd6010bd5f9ec01dd46 after 20/20 strict control-FIFO VM runs: min 0.082 ms, max 0.317 ms, unchanged 100.000 ms budget. Machine infraternal-perf-test, 4 CPUs, MemTotal 8069112 kB; VM load before 0.05/0.12/0.53, after 0.12/0.13/0.54. Exact base 01fe0793e, static test harness SHA e7a3b8412002fc0fa4902d23c81142e982b469d3c4fa1f9cd589e1a76f57872e and test patch SHA 2db0c503b3810a7f6f17d37d69a628d0d622caee6e39f677ce5f412afe6e957a are in the attached receipt. This is the isolated control-FIFO oracle, not EA-02 shipping-native A/B or final updater acceptance. Those remain open; final measurements must use final artifacts. The encrypted-primitives iterate milestone also passed at production source 3cf5e1816 plus that then-pending test split: 445 server tests passed, 0 failed; TypeScript 37 pass, 0 fail. Verbatim ending: ~~~text ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done. ~~~ The new test commit was serialized by briefly stopping only the owned module-coordinator PID, then resuming it in finally; the source index was empty before staging only the test file. The owned VM fixture was removed by its successful driver. Recovery module gates continue in the existing managed build slot. No final fast claim.
kayg commented 2026-10-16 03:19:10 +00:00
Author
Owner
Copy link

Committed and pushed 92ac89d0c1: Share owned synchronous I/O without a release-feature dependency (D198).

Move the existing scheduler-yielding synchronous I/O boundary into the shared optional host API and retain the release adapter as a thin caller. Backup storage can now reuse the same cancellation ownership without depending on the release feature. A detached blocking task could outlive disable; duplicating the helper would create separate ownership rules. The multi-thread and startup/current-thread behavior is unchanged.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 487 filtered out; finished in 4.12s

shared-owned-io-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 92ac89d0c128fc77f5aacc0757467ce2cb5cce52: Share owned synchronous I/O without a release-feature dependency (D198). Move the existing scheduler-yielding synchronous I/O boundary into the shared optional host API and retain the release adapter as a thin caller. Backup storage can now reuse the same cancellation ownership without depending on the release feature. A detached blocking task could outlive disable; duplicating the helper would create separate ownership rules. The multi-thread and startup/current-thread behavior is unchanged. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 487 filtered out; finished in 4.12s ``` [shared-owned-io-gate.log](https://git.kayg.org/attachments/b6d85aff-23d0-45a4-9ed1-48efdec560bc) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:22:11 +00:00
Author
Owner
Copy link

Pushed head 92ac89d0c1: shared synchronous owned I/O helper, retaining cancellation ownership and existing scheduler behavior. Targeted release image-store tests pass, including twenty check-ins. Next private-state read extraction gate found that existing fixture permissions calls inherited their trait through the moved parent import. Added an explicit PermissionsExt test import; no access check is relaxed. The 60-second managed continuation window had expired before consuming the request, so the same current-slice resume was requeued through normal build-slot. No completed module prefix is replayed.

Current uncommitted source and exact resume scripts, including the full private-state file needed after its read-only slice: snapshot with hashes/status. The current source is a partial extraction, not another 65-test prototype claim. Earlier encrypted-primitives iterate is green; final provider/startup/recovery, final native A/B, caps, VM update acceptance, parser campaigns and fast remain incomplete.

Pushed head 92ac89d0c128fc77f5aacc0757467ce2cb5cce52: shared synchronous owned I/O helper, retaining cancellation ownership and existing scheduler behavior. Targeted release image-store tests pass, including twenty check-ins. Next private-state read extraction gate found that existing fixture permissions calls inherited their trait through the moved parent import. Added an explicit PermissionsExt test import; no access check is relaxed. The 60-second managed continuation window had expired before consuming the request, so the same current-slice resume was requeued through normal build-slot. No completed module prefix is replayed. Current uncommitted source and exact resume scripts, including the full private-state file needed after its read-only slice: [snapshot with hashes/status](https://git.kayg.org/attachments/4b1558c7-ee4a-4a9d-aa7b-73bbf214587d). The current source is a partial extraction, not another 65-test prototype claim. Earlier encrypted-primitives iterate is green; final provider/startup/recovery, final native A/B, caps, VM update acceptance, parser campaigns and fast remain incomplete.
kayg commented 2026-10-16 03:28:39 +00:00
Author
Owner
Copy link

Pending provider integration invariant (D155; no new rollback policy): preserve the release-authorized rollback intent beside the receiver-owned image commitments on the private, nonserialized provider path. UpdateEngine already carries this intent; draft private recovery/broker/host methods now carry it too. Do not infer it from version ordering or public request fields. A manual rollback needs two distinct authenticated points: its fresh pre-attempt snapshot restores the current image if the attempt fails, while the previous verified image must start against its own selected pre-upgrade database/CA/configuration point. Both points remain bound to the exact image pair and protected retention references. There is no revoked-authority overlay. These templates are not compiled or production-wired; actual ConfigurationLease preparation must also recheck owner freshness after awaited capture and before releasing exec resources. Current committed head remains 92ac89d0c and the private-state extraction resume is queued through normal build-slot.

Pending provider integration invariant (D155; no new rollback policy): preserve the release-authorized rollback intent beside the receiver-owned image commitments on the private, nonserialized provider path. UpdateEngine already carries this intent; draft private recovery/broker/host methods now carry it too. Do not infer it from version ordering or public request fields. A manual rollback needs two distinct authenticated points: its fresh pre-attempt snapshot restores the current image if the attempt fails, while the previous verified image must start against its own selected pre-upgrade database/CA/configuration point. Both points remain bound to the exact image pair and protected retention references. There is no revoked-authority overlay. These templates are not compiled or production-wired; actual ConfigurationLease preparation must also recheck owner freshness after awaited capture and before releasing exec resources. Current committed head remains 92ac89d0c and the private-state extraction resume is queued through normal build-slot.
kayg commented 2026-10-16 03:49:10 +00:00
Author
Owner
Copy link

Gate continuation is still queued through the provided normal build-slot helper at head 92ac89d0c. The private-state extraction and explicit fixture PermissionsExt import are ready; the next operation is resume-private-state-reads.py via run-recovery-private-state.py. No gate rerun result or new commit yet. Capacity is the current execution constraint; the queued process will continue automatically when the shared orchestrator frees a slot. No priorities, slot limits or other jobs were changed. Last qualified milestone remains encrypted-primitives iterate (445 server tests and 37 TypeScript tests), plus the separately qualified/pushed strict FIFO test split. Full recovery integration and final acceptance remain open.

Gate continuation is still queued through the provided normal build-slot helper at head 92ac89d0c. The private-state extraction and explicit fixture PermissionsExt import are ready; the next operation is resume-private-state-reads.py via run-recovery-private-state.py. No gate rerun result or new commit yet. Capacity is the current execution constraint; the queued process will continue automatically when the shared orchestrator frees a slot. No priorities, slot limits or other jobs were changed. Last qualified milestone remains encrypted-primitives iterate (445 server tests and 37 TypeScript tests), plus the separately qualified/pushed strict FIFO test split. Full recovery integration and final acceptance remain open.
kayg commented 2026-10-16 03:50:46 +00:00
Author
Owner
Copy link

Committed and pushed a789b9dd4d: Share existing bounded private-state reads across custody adapters (D168, D186).

Extract the existing ownership, private-mode, regular-file, no-follow/nonblocking and bounded-read checks from remote startup. Keep its public-to-the-crate wrappers and static TLS error behavior while allowing the backup host adapter to reuse the same boundary. The generic limit checks overflow and growth after stat. Copying these checks into every encrypted key store would allow divergent refusal behavior. This changes neither retained CA paths nor normal startup authority.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.01s
test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 490 filtered out; finished in 0.06s

shared-private-state-reads-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed a789b9dd4d25e68b62670bad1de1b597a4fecdad: Share existing bounded private-state reads across custody adapters (D168, D186). Extract the existing ownership, private-mode, regular-file, no-follow/nonblocking and bounded-read checks from remote startup. Keep its public-to-the-crate wrappers and static TLS error behavior while allowing the backup host adapter to reuse the same boundary. The generic limit checks overflow and growth after stat. Copying these checks into every encrypted key store would allow divergent refusal behavior. This changes neither retained CA paths nor normal startup authority. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 491 filtered out; finished in 0.01s test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 490 filtered out; finished in 0.06s ``` [shared-private-state-reads-gate.log](https://git.kayg.org/attachments/ebda7671-e16d-4bb8-8789-691cd273fe47) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:52:41 +00:00
Author
Owner
Copy link

Committed and pushed 023a623d76: Reuse one durable encrypted administrator-copy publisher (D168, D186).

Separate validated CA-envelope binding from the existing private byte-publication mechanism. One shared helper now owns bounded reads, leaf naming, private temporary creation, file sync, atomic replacement, directory sync and owned cleanup. Preserve existing administrator filename hashes, generation checks, envelope decoding and CaError behavior. The former CA byte-writer implementation is removed rather than copied into backup storage. Backup key publication remains separately gated before runtime wiring.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 490 filtered out; finished in 0.09s
test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 452 filtered out; finished in 21.06s

shared-encrypted-copy-publication-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 023a623d76c8e4004bbb0e45c20aa4f283443eda: Reuse one durable encrypted administrator-copy publisher (D168, D186). Separate validated CA-envelope binding from the existing private byte-publication mechanism. One shared helper now owns bounded reads, leaf naming, private temporary creation, file sync, atomic replacement, directory sync and owned cleanup. Preserve existing administrator filename hashes, generation checks, envelope decoding and CaError behavior. The former CA byte-writer implementation is removed rather than copied into backup storage. Backup key publication remains separately gated before runtime wiring. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 490 filtered out; finished in 0.09s test result: ok. 33 passed; 0 failed; 9 ignored; 0 measured; 452 filtered out; finished in 21.06s ``` [shared-encrypted-copy-publication-gate.log](https://git.kayg.org/attachments/942d3ae3-12ec-42d7-962d-9745e8d028fa) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:53:09 +00:00
Author
Owner
Copy link

Committed and pushed e08c516d20: Prepare removable backup key-authority runtime dependencies (D186, D198).

Add a server-only feature combining the existing pinned database, protected key, private-action and event-loop facilities. Tokio is already a test dependency and workspace foundation; no engine or version is added. Keep default metadata builds inert and free of this runtime. Enabling key-authority behavior globally or making backup depend on the server crate would break compile-out or layering.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

backup-authority-dependencies-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed e08c516d20a4b158e1478e41eacc376456a508cf: Prepare removable backup key-authority runtime dependencies (D186, D198). Add a server-only feature combining the existing pinned database, protected key, private-action and event-loop facilities. Tokio is already a test dependency and workspace foundation; no engine or version is added. Keep default metadata builds inert and free of this runtime. Enabling key-authority behavior globally or making backup depend on the server crate would break compile-out or layering. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [backup-authority-dependencies-gate.log](https://git.kayg.org/attachments/f315607d-b422-49cb-8746-16f5a6d0dfd6) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:53:44 +00:00
Author
Owner
Copy link

Committed and pushed 4257138867: Specify backup authority revocation and custody boundaries (D168, D186).

Prepare eight component tests against real SQLite and AES-GCM, with a controlled proof source distinct from the real host-verifier integration. Cover setup/unlock/cold continuity, purpose and replay, role revocation, credential deletion, superseded plugin admission, proof expiry during publication, explicit non-owner administrators and re-enrollment without key rotation. The source prototype compiles these tests against the exact forthcoming module; shipping wiring follows separately. A mock verifier is not claimed as passkey or HTTP acceptance.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 64 filtered out; finished in 0.06s
test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.56s

backup-authority-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 425713886736dfda1eb9ff2b720444be7aef7386: Specify backup authority revocation and custody boundaries (D168, D186). Prepare eight component tests against real SQLite and AES-GCM, with a controlled proof source distinct from the real host-verifier integration. Cover setup/unlock/cold continuity, purpose and replay, role revocation, credential deletion, superseded plugin admission, proof expiry during publication, explicit non-owner administrators and re-enrollment without key rotation. The source prototype compiles these tests against the exact forthcoming module; shipping wiring follows separately. A mock verifier is not claimed as passkey or HTTP acceptance. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 64 filtered out; finished in 0.06s test result: ok. 65 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.56s ``` [backup-authority-tests-gate.log](https://git.kayg.org/attachments/3466402c-34d4-4540-8a7a-91bb6c6e7765) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:54:00 +00:00
Author
Owner
Copy link

Committed and pushed 71fe7ed126: Bind backup key custody to fresh purpose and original plugin admission (D168, D186, D198).

Implement setup, enrollment and unlock using the shared explicit administrator ledger and trusted host proof interface. Bind the exact session hash, generation, purpose, expiry and original plugin admission. Recheck membership, credential and clock under the writer reservation after durable I/O, then move the same protected key allocation into process state inside the host epoch fence. Existing identity cannot silently regenerate; canceled publication remains recoverable by a fresh unlock. Ordinary session freshness, owner flags or a newer feature epoch cannot replace the proof. This module does not mount HTTP routes or install the updater recovery provider.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s
test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s

backup-key-authority-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 71fe7ed12640e027d3612862f9662ef9cf45b500: Bind backup key custody to fresh purpose and original plugin admission (D168, D186, D198). Implement setup, enrollment and unlock using the shared explicit administrator ledger and trusted host proof interface. Bind the exact session hash, generation, purpose, expiry and original plugin admission. Recheck membership, credential and clock under the writer reservation after durable I/O, then move the same protected key allocation into process state inside the host epoch fence. Existing identity cannot silently regenerate; canceled publication remains recoverable by a fresh unlock. Ordinary session freshness, owner flags or a newer feature epoch cannot replace the proof. This module does not mount HTTP routes or install the updater recovery provider. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.28s ``` [backup-key-authority-gate.log](https://git.kayg.org/attachments/1a9e2c42-3fb3-45e7-8dd7-8009b3e39474) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:55:43 +00:00
Author
Owner
Copy link

Committed and pushed f448ffc3fb: Prepare recovery only after foreground admission is frozen (D128, D147).

Add an optional asynchronous preparation hook to the existing owned configuration lease. Freeze foreground work under the registration check, release the registry mutex, then await preparation before returning admitted handoff ownership. Refusal or cancellation drops both leases before the serving runtime can stop. A pre-admission snapshot can omit later foreground mutations; holding a registry mutex across I/O would block lifecycle control. The default preserves existing consumers and the production updater recovery precheck still fails closed until its provider is wired. A deterministic ordering/refusal regression and existing release/control tests qualify this boundary.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 27 filtered out; finished in 0.00s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 79 filtered out; finished in 0.00s
test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.22s

post-fence-checkpoint-admission-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f448ffc3fbac0809ad01b73b61a4418c0deb2420: Prepare recovery only after foreground admission is frozen (D128, D147). Add an optional asynchronous preparation hook to the existing owned configuration lease. Freeze foreground work under the registration check, release the registry mutex, then await preparation before returning admitted handoff ownership. Refusal or cancellation drops both leases before the serving runtime can stop. A pre-admission snapshot can omit later foreground mutations; holding a registry mutex across I/O would block lifecycle control. The default preserves existing consumers and the production updater recovery precheck still fails closed until its provider is wired. A deterministic ordering/refusal regression and existing release/control tests qualify this boundary. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 27 filtered out; finished in 0.00s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 79 filtered out; finished in 0.00s test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.22s ``` [post-fence-checkpoint-admission-gate.log](https://git.kayg.org/attachments/7f526ac1-3f64-4047-bd5f-14ce377e56d5) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:57:19 +00:00
Author
Owner
Copy link

Committed and pushed 2f48feb082: Postpone automatic handoff when foreground work arrives during backup preparation (D128, D147, D251).

A consistent checkpoint runs after foreground admission freezes and may await storage. Record refused input/attach attempts during that interval and recheck after preparation; automatic work then drops its leases and starts a fresh quiet window while clients retain unacknowledged input. Explicit Update now keeps its requested behavior. The regression first failed because admitted handoff was returned after simulated typing in preparation. Ordinary accepted input retains its existing fast path and no wire framing changes. A pre-backup idle check alone leaves a long preparation race.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 30 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 79 filtered out; finished in 0.00s

foreground-during-recovery-preparation-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 2f48feb0821bdd1a903b1b916005ff6d786c0504: Postpone automatic handoff when foreground work arrives during backup preparation (D128, D147, D251). A consistent checkpoint runs after foreground admission freezes and may await storage. Record refused input/attach attempts during that interval and recheck after preparation; automatic work then drops its leases and starts a fresh quiet window while clients retain unacknowledged input. Explicit Update now keeps its requested behavior. The regression first failed because admitted handoff was returned after simulated typing in preparation. Ordinary accepted input retains its existing fast path and no wire framing changes. A pre-backup idle check alone leaves a long preparation race. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 30 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 79 filtered out; finished in 0.00s ``` [foreground-during-recovery-preparation-gate.log](https://git.kayg.org/attachments/e2dcafcb-e250-47d2-9c67-862117cb671a) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:57:21 +00:00
Author
Owner
Copy link

The prior commit gate contains the GREEN checks. Its before-fix regression receipt is attached separately: foreground-during-preparation-red-gate.log

The prior commit gate contains the GREEN checks. Its before-fix regression receipt is attached separately: [foreground-during-preparation-red-gate.log](https://git.kayg.org/attachments/7b80b32e-cd50-4ef0-867c-bdf8f7229bbc)
kayg commented 2026-10-16 03:57:50 +00:00
Author
Owner
Copy link

Committed and pushed 4f57adccac: Cancel awaiting automatic preparation when input arrives (D128, D147, D251).

Checking for interruption only after storage completes leaves foreground admission frozen while an automatic checkpoint awaits I/O. Wake only the interrupted frozen attempt and race its owned preparation against that event; typing or an attach then drops the unarmed attempt and reopens admission. Keep the final interruption check for a same-poll completion race, and preserve explicit Update now semantics. The first new foreground attempt signals once, with no notification added to ordinary accepted input. A pending-storage regression first fails because automatic admission never returns after input, then passes without completing storage or manually cancelling the task. Provider cancellation must retain ownership of cleanup and cannot detach retained-state writes.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 30 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s

input-cancels-pending-preparation-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 4f57adccac5ea58b52054ed385b1d19bee02374d: Cancel awaiting automatic preparation when input arrives (D128, D147, D251). Checking for interruption only after storage completes leaves foreground admission frozen while an automatic checkpoint awaits I/O. Wake only the interrupted frozen attempt and race its owned preparation against that event; typing or an attach then drops the unarmed attempt and reopens admission. Keep the final interruption check for a same-poll completion race, and preserve explicit Update now semantics. The first new foreground attempt signals once, with no notification added to ordinary accepted input. A pending-storage regression first fails because automatic admission never returns after input, then passes without completing storage or manually cancelling the task. Provider cancellation must retain ownership of cleanup and cannot detach retained-state writes. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 30 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s ``` [input-cancels-pending-preparation-gate.log](https://git.kayg.org/attachments/d3667fe5-79f8-4d77-bdaf-f3a92fe26181) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 03:57:51 +00:00
Author
Owner
Copy link

Required failing-before-fix pending-storage input regression receipt.
input-cancels-pending-preparation-red.log

Required failing-before-fix pending-storage input regression receipt. [input-cancels-pending-preparation-red.log](https://git.kayg.org/attachments/5f6f3cd7-1ccb-4e1f-ae08-6914a8c47725)
kayg commented 2026-10-16 03:59:32 +00:00
Author
Owner
Copy link

Committed and pushed 08a249d79c: Share the bounded protected HTTP intake without another plaintext body (D168, D186).

Move the existing admitted CA body collector into one host helper. Both consumers retain the same 32768-byte protected allocation, immediate transport-chunk copy, checked growth and wiping on drop. Existing real CA HTTP and chunk-bound tests qualify unchanged behavior. Duplicating the collector for each key ceremony would create separate memory and cancellation rules.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 2.07s

shared-protected-intake-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 08a249d79c1760cbe71dd25b1944100b0172b4dd: Share the bounded protected HTTP intake without another plaintext body (D168, D186). Move the existing admitted CA body collector into one host helper. Both consumers retain the same 32768-byte protected allocation, immediate transport-chunk copy, checked growth and wiping on drop. Existing real CA HTTP and chunk-bound tests qualify unchanged behavior. Duplicating the collector for each key ceremony would create separate memory and cancellation rules. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 489 filtered out; finished in 2.07s ``` [shared-protected-intake-gate.log](https://git.kayg.org/attachments/173b1a76-2610-4804-bdb8-22832f7bcc55) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:06:44 +00:00
Author
Owner
Copy link

Recovery integration constraint, still unimplemented: Guardian::start currently starts /proc/self/exe directly (draft recovery_guardian.rs), which does not itself move the child outside a managed server service. Before claiming automatic recovery, qualify actual parent-service group cleanup and ensure the owned guardian survives it; do not rely on a staging Python launcher alone. Reuse the existing host supervision mechanism rather than choosing another engine.

Two short-lived public-fixture functional probes on the named VM show the existing systemd-run scope launcher execs in the spawned child PID, preserves its original parent PID, and preserves both a passed public descriptor and socket stdin with SO_PEERCRED pointing to that original parent. Normalized observed outputs and limits. These were functional probes with no timing acceptance; they do not prove survival after a managed-service failure. No keys or server state were used. A real provider must still launch the exact pinned helper image without temporarily making parent descriptors inheritable or sending keys through an unverified executable path, and join/cancel only its owned child/scope.

Restore admission also must not depend on candidate-modified backup identity/configuration files after the parent exits. Validate and retain the selected authenticated point before arming, or retain an equivalent original-admission capability; current recovery_point::Authenticated::open rechecks the on-disk identity and is not yet wired to the worker. D155 full restoration and pre-migration startup ordering remain required. No new rollback or authority-overlay policy is introduced.

Recovery integration constraint, still unimplemented: Guardian::start currently starts /proc/self/exe directly (draft recovery_guardian.rs), which does not itself move the child outside a managed server service. Before claiming automatic recovery, qualify actual parent-service group cleanup and ensure the owned guardian survives it; do not rely on a staging Python launcher alone. Reuse the existing host supervision mechanism rather than choosing another engine. Two short-lived public-fixture functional probes on the named VM show the existing systemd-run scope launcher execs in the spawned child PID, preserves its original parent PID, and preserves both a passed public descriptor and socket stdin with SO_PEERCRED pointing to that original parent. [Normalized observed outputs and limits](https://git.kayg.org/attachments/8faaefac-ef37-43c5-8d4f-567e43798e35). These were functional probes with no timing acceptance; they do not prove survival after a managed-service failure. No keys or server state were used. A real provider must still launch the exact pinned helper image without temporarily making parent descriptors inheritable or sending keys through an unverified executable path, and join/cancel only its owned child/scope. Restore admission also must not depend on candidate-modified backup identity/configuration files after the parent exits. Validate and retain the selected authenticated point before arming, or retain an equivalent original-admission capability; current recovery_point::Authenticated::open rechecks the on-disk identity and is not yet wired to the worker. D155 full restoration and pre-migration startup ordering remain required. No new rollback or authority-overlay policy is introduced.
kayg commented 2026-10-16 04:06:48 +00:00
Author
Owner
Copy link

Committed and pushed effbf47637: Own private plugin actions in the existing cancellation and epoch fence (D16, D168, D198).

Mount declared sensitive actions through the existing HTTP/session host. Require exact origin, live cookie, declared private adapter and default-deny component authority before body polling; bound starts, concurrent protected bodies and the whole request. Keep bearer material host-side and exclude ordinary socket recording. Reuse Entry.tasks for abort/join and its mutex for weak original-epoch installation, including server feature startup. A second lifecycle loop or retained strong runtime admission would leave work behind or create cycles. Real-session HTTP tests and deterministic disable/cancellation tests qualify this boundary; backup feature registration and updater recovery are still separate.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 496 filtered out; finished in 0.00s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 498 filtered out; finished in 0.91s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 495 filtered out; finished in 2.55s

private-plugin-host-dispatch-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed effbf47637fa9c187e59031715faced6111d4ba5: Own private plugin actions in the existing cancellation and epoch fence (D16, D168, D198). Mount declared sensitive actions through the existing HTTP/session host. Require exact origin, live cookie, declared private adapter and default-deny component authority before body polling; bound starts, concurrent protected bodies and the whole request. Keep bearer material host-side and exclude ordinary socket recording. Reuse Entry.tasks for abort/join and its mutex for weak original-epoch installation, including server feature startup. A second lifecycle loop or retained strong runtime admission would leave work behind or create cycles. Real-session HTTP tests and deterministic disable/cancellation tests qualify this boundary; backup feature registration and updater recovery are still separate. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 496 filtered out; finished in 0.00s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 498 filtered out; finished in 0.91s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 495 filtered out; finished in 2.55s ``` [private-plugin-host-dispatch-gate.log](https://git.kayg.org/attachments/ead7a3e6-2c61-4b22-b71c-e50519dda9d4) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:07:07 +00:00
Author
Owner
Copy link

Committed and pushed deb254e594: Declare backup custody actions and existing-server dependencies once (D16, D186, D198).

Add one descriptor for private backup setup, unlock, enrollment, locking and readiness. Declare the server role, default switch, existing-server dependency, bounded input and concise instructions without starting runtime work. A separate HTTP-only action inventory would diverge from discovery and generated labels. The scheduled node commands remain honestly unavailable; this descriptor describes server key custody for pre-upgrade recovery.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

backup-custody-descriptor-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed deb254e5949009663bf3957d73e9c7702f6fbac0: Declare backup custody actions and existing-server dependencies once (D16, D186, D198). Add one descriptor for private backup setup, unlock, enrollment, locking and readiness. Declare the server role, default switch, existing-server dependency, bounded input and concise instructions without starting runtime work. A separate HTTP-only action inventory would diverge from discovery and generated labels. The scheduled node commands remain honestly unavailable; this descriptor describes server key custody for pre-upgrade recovery. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [backup-custody-descriptor-gate.log](https://git.kayg.org/attachments/cd4a30a6-00b9-4e09-85af-516133af6804) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:07:20 +00:00
Author
Owner
Copy link

Committed and pushed 095e8d69ed: Reuse existing message types for backup private-route refusal (D16, D198).

Make the already-pinned byte and protocol crates explicit optional dependencies of the server runtime. Ordinary plugin messages must return a bounded refusal for private key actions, while metadata-only builds retain no runtime dependency. No engine or version is added. Accepting key material in ordinary message handlers would bypass protected host intake.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s

backup-private-runtime-dependencies-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 095e8d69eda3672401f24fc95689033ca5c01a1d: Reuse existing message types for backup private-route refusal (D16, D198). Make the already-pinned byte and protocol crates explicit optional dependencies of the server runtime. Ordinary plugin messages must return a bounded refusal for private key actions, while metadata-only builds retain no runtime dependency. No engine or version is added. Accepting key material in ordinary message handlers would bypass protected host intake. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 22 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s ``` [backup-private-runtime-dependencies-gate.log](https://git.kayg.org/attachments/81d8100e-e5f1-4bf9-894f-aa4bc6f411a4) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:09:13 +00:00
Author
Owner
Copy link

Committed and pushed 37f17d3918: Own backup key ceremonies within enabled feature activation (D168, D186, D198).

Create a fresh cold key ring and purpose registry for each enabled activation, supplied by the trusted proof and encrypted-copy adapters. Create its cleanup guard before polling startup, clear only the matching activation and lock its key on drop. Route only declared private actions and refuse ordinary message calls. The service creates no storage or periodic wakeup at construction/activation. The unpolled-startup test covers duplicate activation, stale admission and cancellation; this does not yet register an updater recovery provider.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s

backup-custody-service-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 37f17d391860fe1c036306aac5c9dd987e258a33: Own backup key ceremonies within enabled feature activation (D168, D186, D198). Create a fresh cold key ring and purpose registry for each enabled activation, supplied by the trusted proof and encrypted-copy adapters. Create its cleanup guard before polling startup, clear only the matching activation and lock its key on drop. Route only declared private actions and refuse ordinary message calls. The service creates no storage or periodic wakeup at construction/activation. The unpolled-startup test covers duplicate activation, stale admission and cancellation; this does not yet register an updater recovery provider. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s ``` [backup-custody-service-gate.log](https://git.kayg.org/attachments/b212af49-fa2b-4df1-b50c-140886695aba) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:10:12 +00:00
Author
Owner
Copy link

Committed and pushed a9c41dc588: Keep server backup custody behind its own removable feature (D186, D198).

Connect the existing CLI backup feature to an optional server backup dependency without implicitly enabling the server role. Reuse existing protected memory, key-proof API and backup runtime; no new crate version or engine is selected. A core dependency would leave backup code compiled when disabled, while enabling server from backup metadata would violate D201. Runtime registration follows separately.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

server-backup-feature-dependencies-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed a9c41dc58851d95b2a69b0c1b9e06cd112c70c86: Keep server backup custody behind its own removable feature (D186, D198). Connect the existing CLI backup feature to an optional server backup dependency without implicitly enabling the server role. Reuse existing protected memory, key-proof API and backup runtime; no new crate version or engine is selected. A core dependency would leave backup code compiled when disabled, while enabling server from backup metadata would violate D201. Runtime registration follows separately. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [server-backup-feature-dependencies-gate.log](https://git.kayg.org/attachments/438051df-4cc3-4d79-a002-660d13d27680) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:20:08 +00:00
Author
Owner
Copy link

Committed and pushed 8285ce036d: Supply real server proofs and durable encrypted storage to backup custody (D168, D186, D198).

Register the optional server feature with the existing real Auth verifier and shared private storage adapters. Keep catalog-only callers unable to verify proofs, in-memory fixtures unable to initialize retained state, and constructors free of filesystem work. Publish the public key identity and first encrypted administrator copy through one durable directory rename, refusing existing/corrupt stores and lost identity beside retained points. Reuse private HTTP and task ownership with or without the remote component. Five real-filesystem refusal/publication tests and existing HTTP/lifecycle checks qualify the adapters. This enables key custody only; update application remains refused pending checkpoint and recovery integration.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 500 filtered out; finished in 0.40s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 503 filtered out; finished in 1.49s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 501 filtered out; finished in 0.00s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 500 filtered out; finished in 3.46s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 185 filtered out; finished in 0.87s

server-backup-custody-adapter-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 8285ce036d71da2ed823e55fd8ae2c2a0ac81c43: Supply real server proofs and durable encrypted storage to backup custody (D168, D186, D198). Register the optional server feature with the existing real Auth verifier and shared private storage adapters. Keep catalog-only callers unable to verify proofs, in-memory fixtures unable to initialize retained state, and constructors free of filesystem work. Publish the public key identity and first encrypted administrator copy through one durable directory rename, refusing existing/corrupt stores and lost identity beside retained points. Reuse private HTTP and task ownership with or without the remote component. Five real-filesystem refusal/publication tests and existing HTTP/lifecycle checks qualify the adapters. This enables key custody only; update application remains refused pending checkpoint and recovery integration. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 500 filtered out; finished in 0.40s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 503 filtered out; finished in 1.49s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 501 filtered out; finished in 0.00s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 500 filtered out; finished in 3.46s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 185 filtered out; finished in 0.87s ``` [server-backup-custody-adapter-gate.log](https://git.kayg.org/attachments/a8ba784e-9ea6-468d-a1b8-baeafc56288b) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:20:18 +00:00
Author
Owner
Copy link

Committed and pushed 28cf186f93: Bound encrypted recovery framing before allocating ciphertext (D147, D186).

Encode encrypted records with a fixed 33-byte version/nonce/tag envelope and unchanged ciphertext bytes. Decode only complete, versioned records within the existing resource-specific bounds before allocating. Keep checkpoint/image/resource authentication in the existing AEAD context, separate from framing. JSON byte arrays would expand encrypted data and require more parsing work; a new serialization library is unnecessary. Roundtrip, truncation, unknown-version and bound tests qualify the packet boundary.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 20 filtered out; finished in 0.00s

bounded-backup-record-framing-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 28cf186f9375c3e71d0b543b8bcfd3206a3e3349: Bound encrypted recovery framing before allocating ciphertext (D147, D186). Encode encrypted records with a fixed 33-byte version/nonce/tag envelope and unchanged ciphertext bytes. Decode only complete, versioned records within the existing resource-specific bounds before allocating. Keep checkpoint/image/resource authentication in the existing AEAD context, separate from framing. JSON byte arrays would expand encrypted data and require more parsing work; a new serialization library is unnecessary. Roundtrip, truncation, unknown-version and bound tests qualify the packet boundary. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 20 filtered out; finished in 0.00s ``` [bounded-backup-record-framing-gate.log](https://git.kayg.org/attachments/007c041a-c3ee-4cd1-9635-98fe6479c34a) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:20:40 +00:00
Author
Owner
Copy link

Committed and pushed 34d3363ceb: Fuzz encrypted recovery framing for every bounded resource kind (D12, D147).

Send arbitrary bytes to each actual resource-bounded encrypted record decoder. Accepted packets must serialize canonically and preserve nonce, tag and ciphertext through another decode. The harness grants no restore authority and does not duplicate production parsing. A runtime-instrumented campaign remains required; this commit claims only the target and its compile/lint gate.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

backup-record-parser-fuzz-target-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 34d3363ceb267c1b27bb0b55f840491969476659: Fuzz encrypted recovery framing for every bounded resource kind (D12, D147). Send arbitrary bytes to each actual resource-bounded encrypted record decoder. Accepted packets must serialize canonically and preserve nonce, tag and ciphertext through another decode. The harness grants no restore authority and does not duplicate production parsing. A runtime-instrumented campaign remains required; this commit claims only the target and its compile/lint gate. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [backup-record-parser-fuzz-target-gate.log](https://git.kayg.org/attachments/0d7aadaa-282c-4205-87c1-9057c5282254) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:20:54 +00:00
Author
Owner
Copy link

Committed and pushed 3d4c17f59b: Authenticate consistent database and private resources as one recovery bundle (D147, D186).

Own a protected key lease and seal the real SQLite snapshot plus bounded opaque host resources into an ordered authenticated inventory. Bind every record position and both verified image digests, reject duplicate/unsafe labels and validate the entire inventory before exposing recovery plaintext. Keep private resources in protected pages and wipe serialized database images on cancellation/drop. The real migration test applies SQLx migration 26, confirms predecessor VersionMissing(26), then decrypts/restores the bundle and reopens migration 25 with pre-upgrade data. Substitution and authenticated-malformed-database tests refuse without replacing existing state. This is the bundle engine; host publication, foreground checkpoint wiring and fatal-process recovery are not claimed.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 24 filtered out; finished in 0.02s
test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s

encrypted-consistent-checkpoint-bundle-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 3d4c17f59b80d950f1089f33c26af46b92a1e8e0: Authenticate consistent database and private resources as one recovery bundle (D147, D186). Own a protected key lease and seal the real SQLite snapshot plus bounded opaque host resources into an ordered authenticated inventory. Bind every record position and both verified image digests, reject duplicate/unsafe labels and validate the entire inventory before exposing recovery plaintext. Keep private resources in protected pages and wipe serialized database images on cancellation/drop. The real migration test applies SQLx migration 26, confirms predecessor VersionMissing(26), then decrypts/restores the bundle and reopens migration 25 with pre-upgrade data. Substitution and authenticated-malformed-database tests refuse without replacing existing state. This is the bundle engine; host publication, foreground checkpoint wiring and fatal-process recovery are not claimed. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 24 filtered out; finished in 0.02s test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.30s ``` [encrypted-consistent-checkpoint-bundle-gate.log](https://git.kayg.org/attachments/72077021-a684-40cf-8467-aede73eb7e4e) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:21:16 +00:00
Author
Owner
Copy link

Committed and pushed 987b38a9eb: Make the actual authenticated-inventory decoder available to fuzzing (D12, D147).

Enable the existing optional backup server surface only in the nonshipping fuzz package so its real inventory decoder can be exercised. All database, cryptographic and event-loop dependencies already exist and remain pinned. Copying the decoder into a stand-alone harness would fail to test production validation. The target follows separately.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

backup-inventory-fuzz-dependency-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 987b38a9eb051fe58e9a4d8ccd1168c7bd3800ae: Make the actual authenticated-inventory decoder available to fuzzing (D12, D147). Enable the existing optional backup server surface only in the nonshipping fuzz package so its real inventory decoder can be exercised. All database, cryptographic and event-loop dependencies already exist and remain pinned. Copying the decoder into a stand-alone harness would fail to test production validation. The target follows separately. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [backup-inventory-fuzz-dependency-gate.log](https://git.kayg.org/attachments/9c3f2446-94e5-4b9a-9faf-59e41305c066) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:21:23 +00:00
Author
Owner
Copy link

Committed and pushed e8b35a15ff: Fuzz bounded recovery inventories and canonical metadata roundtrips (D12, D147).

Exercise the real inventory and public point-metadata decoders independently of AEAD so malformed metadata reaches its version, label, count and size checks. Accepted inventories must survive canonical serialization and another decode. Decoding carries no image, key or restoration authority; production still authenticates the encrypted inventory first. A compile/lint gate is not an instrumented campaign, which remains required for final qualification.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

backup-inventory-parser-fuzz-target-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed e8b35a15ff6d1a0fe2a491d2283a09c0649bc252: Fuzz bounded recovery inventories and canonical metadata roundtrips (D12, D147). Exercise the real inventory and public point-metadata decoders independently of AEAD so malformed metadata reaches its version, label, count and size checks. Accepted inventories must survive canonical serialization and another decode. Decoding carries no image, key or restoration authority; production still authenticates the encrypted inventory first. A compile/lint gate is not an instrumented campaign, which remains required for final qualification. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [backup-inventory-parser-fuzz-target-gate.log](https://git.kayg.org/attachments/a1980c41-bf3d-479e-8e35-2ba033f9b138) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:23:19 +00:00
Author
Owner
Copy link

Committed and pushed 1d4f75af7d: Qualify immutable encrypted point publication and bounded retirement (D147, D186).

Prepare the checked filesystem adapter behind test-only backup wiring until the recovery provider is ready. Publish synced ciphertext and public transition metadata through one directory rename, refuse wrong image/key selection, preserve protected point references within feature-supplied retention and atomically retire superseded or interrupted staging directories. Validate metadata without reading every retained database during collection. Three actual SQLite/filesystem tests cover bound loading/private modes, twenty updates with an older protected rollback point, interrupted encrypted writes and refusal of unsafe files before deletion. No runtime checkpoint or process recovery is enabled by this step.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 505 filtered out; finished in 2.88s

encrypted-point-filesystem-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 1d4f75af7d953308befc660ddfa722b2f931f14b: Qualify immutable encrypted point publication and bounded retirement (D147, D186). Prepare the checked filesystem adapter behind test-only backup wiring until the recovery provider is ready. Publish synced ciphertext and public transition metadata through one directory rename, refuse wrong image/key selection, preserve protected point references within feature-supplied retention and atomically retire superseded or interrupted staging directories. Validate metadata without reading every retained database during collection. Three actual SQLite/filesystem tests cover bound loading/private modes, twenty updates with an older protected rollback point, interrupted encrypted writes and refusal of unsafe files before deletion. No runtime checkpoint or process recovery is enabled by this step. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 505 filtered out; finished in 2.88s ``` [encrypted-point-filesystem-tests-gate.log](https://git.kayg.org/attachments/10535926-3792-4135-8249-d639404ae340) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:27:06 +00:00
Author
Owner
Copy link

Committed and pushed 1e388acb11: Declare inert plugin-owned internal CLI worker bindings (D16, D198).

Represent a compiled internal callback without running it during metadata construction or exposing function addresses through Debug. Registry equality uses the explicit function-pointer comparator only for cloned bindings, never for authority. A feature-specific command table in the CLI would special-case the backup role; a second process transport or library is unnecessary. Private channel validation remains the callback responsibility, and this module does not register or launch any recovery process.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

internal-cli-worker-binding-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 1e388acb1159fcaec629feefdba153470844affc: Declare inert plugin-owned internal CLI worker bindings (D16, D198). Represent a compiled internal callback without running it during metadata construction or exposing function addresses through Debug. Registry equality uses the explicit function-pointer comparator only for cloned bindings, never for authority. A feature-specific command table in the CLI would special-case the backup role; a second process transport or library is unnecessary. Private channel validation remains the callback responsibility, and this module does not register or launch any recovery process. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [internal-cli-worker-binding-gate.log](https://git.kayg.org/attachments/dbd65407-6f58-4752-a4da-7dc8dd045f01) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:28:47 +00:00
Author
Owner
Copy link

Committed and pushed e2cc271bf2: Keep admission scenarios sequential within the fixture length gate (D128, D147).

The input-interruption scenarios grew one process-global admission test beyond its lint limit. Extract explicit and automatic phases into sequential helpers while retaining exactly one test, the same assertions and the original registry lifetime. Parallel tests would race the singleton; suppressing the lint would hide future scenario growth. Qualify this test-only change separately before the CLI dispatch feature.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 27 filtered out; finished in 0.00s

single-owner-admission-fixture-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed e2cc271bf24275d9619bf0c5b88d3f6db991bca4: Keep admission scenarios sequential within the fixture length gate (D128, D147). The input-interruption scenarios grew one process-global admission test beyond its lint limit. Extract explicit and automatic phases into sequential helpers while retaining exactly one test, the same assertions and the original registry lifetime. Parallel tests would race the singleton; suppressing the lint would hide future scenario growth. Qualify this test-only change separately before the CLI dispatch feature. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 27 filtered out; finished in 0.00s ``` [single-owner-admission-fixture-gate.log](https://git.kayg.org/attachments/7f146ac6-55b4-4358-a368-5abf0f62abc5) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 04:31:41 +00:00
Author
Owner
Copy link

BLOCKED on Forgejo storage, not authentication. Local head 849476024 (generic internal CLI dispatch) passed fmt, targeted Clippy, API/CLI and no-default tests, but pushing to edge-autoupdate failed verbatim:

remote: error: unable to create temporary file: No space left on device
remote: fatal: failed to write object
error: remote unpack failed: unpack-objects abnormal exit
! [remote rejected] HEAD -> edge-autoupdate (unpacker error)

Last successfully pushed head: e2cc271bf2. Forgejo operator/orchestrator needs to free storage on git.kayg.org; this job has no authorization to modify that host. No credentials inspected and no production changes. Preserve 849476024 and retry its push before making another commit. Recovery integration, VM acceptance, final caps/native qualification and fast remain unfinished.

BLOCKED on Forgejo storage, not authentication. Local head 849476024 (generic internal CLI dispatch) passed fmt, targeted Clippy, API/CLI and no-default tests, but pushing to edge-autoupdate failed verbatim: remote: error: unable to create temporary file: No space left on device remote: fatal: failed to write object error: remote unpack failed: unpack-objects abnormal exit ! [remote rejected] HEAD -> edge-autoupdate (unpacker error) Last successfully pushed head: e2cc271bf24275d9619bf0c5b88d3f6db991bca4. Forgejo operator/orchestrator needs to free storage on git.kayg.org; this job has no authorization to modify that host. No credentials inspected and no production changes. Preserve 849476024 and retry its push before making another commit. Recovery integration, VM acceptance, final caps/native qualification and fast remain unfinished.
kayg commented 2026-10-16 04:33:14 +00:00
Author
Owner
Copy link

Push retry also failed: remote could not write object 1c70e33969 because its device has no space. Local head remains 849476024d; remote edge-autoupdate remains e2cc271bf. Released the idle build slot rather than holding capacity for remote storage. Preserved the atomic unpushed change as patch; its targeted gate passed before commit. No final fast or task-completion claim. Once Forgejo storage is freed, push this head first, then continue with finish-exec-resources.py, not any completed prefix. The exact resume script is run-recovery-after-dispatch-push.py; its first failed push exits without another commit. No credentials were inspected and no other host was modified.

Push retry also failed: remote could not write object 1c70e3396941c8f0d9e4b0cffa8bf489c7d58bcc because its device has no space. Local head remains 849476024db4422c79e7cbf95c690db1260bbc9c; remote edge-autoupdate remains e2cc271bf. Released the idle build slot rather than holding capacity for remote storage. Preserved the atomic unpushed change as [patch](https://git.kayg.org/attachments/0b1eb689-84bc-4551-9c59-b66021a8bd4b); its targeted gate passed before commit. No final fast or task-completion claim. Once Forgejo storage is freed, push this head first, then continue with finish-exec-resources.py, not any completed prefix. The exact resume script is run-recovery-after-dispatch-push.py; its first failed push exits without another commit. No credentials were inspected and no other host was modified.
kayg commented 2026-10-16 05:32:23 +00:00
Author
Owner
Copy link

Resumed edge-autoupdate at 849476024d; merge base 57b0c3ddca. Forgejo fetch and issue reads work again. Preserving the previously gated generic exec-resource contract before rebasing onto origin/dev f210a4f25. Recovery runtime/startup/rollback wiring, VM acceptance, cap/native qualification and final fast remain incomplete. No merge or production deployment.

Resumed edge-autoupdate at 849476024db4422c79e7cbf95c690db1260bbc9c; merge base 57b0c3ddca8e190f674071e39dcc0aed1ca76cf6. Forgejo fetch and issue reads work again. Preserving the previously gated generic exec-resource contract before rebasing onto origin/dev f210a4f25. Recovery runtime/startup/rollback wiring, VM acceptance, cap/native qualification and final fast remain incomplete. No merge or production deployment.
kayg commented 2026-10-16 05:32:27 +00:00
Author
Owner
Copy link

Committed and pushed 6e36cef06a: Declare bounded plugin-owned private exec resources (D147, D168, D198).

Allow a prepared admission lease to transfer private channels while retaining its configuration and foreground fences. Each resource declares an exact compatibility note, public environment name, borrowed live descriptor and arm/fallback/cancel callbacks. Defaults remain empty. Key material is never serializable here. Backup-specific fields in the core replacement would violate D198, and compatibility notes cannot replace signature verification. Runtime export and real-process recovery are separate steps.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 31 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

generic-exec-resource-contract-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 6e36cef06a015eba06f4ac5cc474c103b6ea9bc5: Declare bounded plugin-owned private exec resources (D147, D168, D198). Allow a prepared admission lease to transfer private channels while retaining its configuration and foreground fences. Each resource declares an exact compatibility note, public environment name, borrowed live descriptor and arm/fallback/cancel callbacks. Defaults remain empty. Key material is never serializable here. Backup-specific fields in the core replacement would violate D198, and compatibility notes cannot replace signature verification. Runtime export and real-process recovery are separate steps. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 31 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [generic-exec-resource-contract-gate.log](https://git.kayg.org/attachments/90bbf3db-bfcf-4e32-a65e-3115bd45d148) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 05:35:41 +00:00
Author
Owner
Copy link

Rebased and pushed edge-autoupdate onto origin/dev f210a4f25; head 0cab5c07b. Preserved dev transport proof-authority isolation, pinned prompt/liveness fixes, both bootstrap regressions and current caps (x86 21,422,096 B; ARM 19,594,856 B). Superseded idle-session renewal and old browser-transport patches were omitted where dev already has the later implementation. Recovery drafts restored. scripts/verify iterate is running through build-slot; no new qualification claim.

Rebased and pushed edge-autoupdate onto origin/dev f210a4f25; head 0cab5c07b. Preserved dev transport proof-authority isolation, pinned prompt/liveness fixes, both bootstrap regressions and current caps (x86 21,422,096 B; ARM 19,594,856 B). Superseded idle-session renewal and old browser-transport patches were omitted where dev already has the later implementation. Recovery drafts restored. scripts/verify iterate is running through build-slot; no new qualification claim.
kayg commented 2026-10-16 05:35:42 +00:00
Author
Owner
Copy link

Recovered saved pre-outage report: generic internal CLI callback dispatch 849476024 was pushed before authentication interrupted the next slice; rebased equivalent 4b65e87cd1. fmt and targeted strict Clippy passed. Test summaries verbatim:

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 54 filtered out; finished in 0.03s
test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

generic-internal-cli-dispatch-gate.log

Recovery registration and runtime wiring remain unfinished.

Recovered saved pre-outage report: generic internal CLI callback dispatch 849476024 was pushed before authentication interrupted the next slice; rebased equivalent 4b65e87cd19a0d2897f51db1cb62d1d3a755215b. fmt and targeted strict Clippy passed. Test summaries verbatim: ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 54 filtered out; finished in 0.03s test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s ``` [generic-internal-cli-dispatch-gate.log](https://git.kayg.org/attachments/585437c3-395f-4f6d-be1e-03834e04f156) Recovery registration and runtime wiring remain unfinished.
kayg commented 2026-10-16 05:42:05 +00:00
Author
Owner
Copy link

Post-rebase strict Clippy found eight test compilation errors: newer dev uses the independent shipping Browser wrapper while update_staging_tests.rs still splits a raw socket, managed_update_staging_tests.rs calls a private helper, and local_browser_fixture constructs the old tuple Unit.
rebase-browser-adapter-red.log

Uncommitted adaptation reuses the existing Browser writer/probe loop and exposes completed probe counts; removes the redundant updater reader/writer, wraps raw test peers and fixes the named Unit cleanup fields. Targeted gates pending. The first iterate transcript mixes pre-adaptation Clippy with ongoing test compilation and will not be reported as a final-head pass.

Post-rebase strict Clippy found eight test compilation errors: newer dev uses the independent shipping Browser wrapper while update_staging_tests.rs still splits a raw socket, managed_update_staging_tests.rs calls a private helper, and local_browser_fixture constructs the old tuple Unit. [rebase-browser-adapter-red.log](https://git.kayg.org/attachments/4e16ea25-b5db-4eed-a18b-a7c05a7c4e1a) Uncommitted adaptation reuses the existing Browser writer/probe loop and exposes completed probe counts; removes the redundant updater reader/writer, wraps raw test peers and fixes the named Unit cleanup fields. Targeted gates pending. The first iterate transcript mixes pre-adaptation Clippy with ongoing test compilation and will not be reported as a final-head pass.
kayg commented 2026-10-16 06:01:52 +00:00
Author
Owner
Copy link

Source finding during recovery integration (not yet a reproduced end-to-end failure): websocket.rs:1609-1610 returns Err when Activity::input reports an update fence; AttachTerm similarly uses enter().ok_or(()) at :1480. local_update.rs cancels automatic preparation on the interruption, but these callers still retire the browser rather than retain its admitted frame until cancellation releases the fence. This can force a reconnect precisely when typing is supposed to postpone automatic updates. Existing API tests cover fence cancellation, not same-socket input continuity. Add a deterministic real-socket RED before changing this boundary; retain original authority, frame credit/order and fail-closed poisoning. No latency claim or production provider enablement.

Source finding during recovery integration (not yet a reproduced end-to-end failure): websocket.rs:1609-1610 returns Err when Activity::input reports an update fence; AttachTerm similarly uses enter().ok_or(()) at :1480. local_update.rs cancels automatic preparation on the interruption, but these callers still retire the browser rather than retain its admitted frame until cancellation releases the fence. This can force a reconnect precisely when typing is supposed to postpone automatic updates. Existing API tests cover fence cancellation, not same-socket input continuity. Add a deterministic real-socket RED before changing this boundary; retain original authority, frame credit/order and fail-closed poisoning. No latency claim or production provider enablement.
kayg commented 2026-10-16 06:04:15 +00:00
Author
Owner
Copy link

Committed and pushed c799e0a67d: Reuse the current shipping browser in updater acceptance fixtures (D128, D265).

Rebasing onto dev exposed eight fixture compilation errors: its shipping browser now owns probe progress independently, while updater acceptance still split a raw socket and a local unit used its retired tuple shape. Extend that existing browser with its ordered encoded writer and completed-probe watch, then have the updater consumer return credit and observe durable ACKs through it. Remove the redundant competing reader/writer, retain original attach/probe/credit assertions and construct the named unit cleanup guard. Reverting dev liveness fixes or copying a second browser driver would lose current proof-authority guarantees. Production transport is unchanged.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 6 passed; 0 failed; 5 ignored; 0 measured; 523 filtered out; finished in 3.31s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 533 filtered out; finished in 0.00s

rebase-shipping-fixture-adapters-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed c799e0a67d03ba2f3fdba4248b2c765322bbbb49: Reuse the current shipping browser in updater acceptance fixtures (D128, D265). Rebasing onto dev exposed eight fixture compilation errors: its shipping browser now owns probe progress independently, while updater acceptance still split a raw socket and a local unit used its retired tuple shape. Extend that existing browser with its ordered encoded writer and completed-probe watch, then have the updater consumer return credit and observe durable ACKs through it. Remove the redundant competing reader/writer, retain original attach/probe/credit assertions and construct the named unit cleanup guard. Reverting dev liveness fixes or copying a second browser driver would lose current proof-authority guarantees. Production transport is unchanged. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 6 passed; 0 failed; 5 ignored; 0 measured; 523 filtered out; finished in 3.31s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 533 filtered out; finished in 0.00s ``` [rebase-shipping-fixture-adapters-gate.log](https://git.kayg.org/attachments/67456667-4811-451e-92f7-e1b3d91f0c83) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:04:49 +00:00
Author
Owner
Copy link

Committed and pushed b4111fa7dd: Reuse the bounded ELF note reader for plugin exec compatibility (D217).

Expose the existing PT_NOTE reader with a bounded exact first-party note contract. CA-v1 and listener-v1 continue using the same scanner and retain independent meanings. Reusing the parser avoids a second executable parser and duplicated size/security surface. The opened image must still pass independent release signature and immutable-image admission; this adapter supplies no authority by itself.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 532 filtered out; finished in 0.00s

generic-elf-capability-adapter-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed b4111fa7dddc725645361d60e5d89357fb94d08f: Reuse the bounded ELF note reader for plugin exec compatibility (D217). Expose the existing PT_NOTE reader with a bounded exact first-party note contract. CA-v1 and listener-v1 continue using the same scanner and retain independent meanings. Reusing the parser avoids a second executable parser and duplicated size/security surface. The opened image must still pass independent release signature and immutable-image admission; this adapter supplies no authority by itself. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 532 filtered out; finished in 0.00s ``` [generic-elf-capability-adapter-gate.log](https://git.kayg.org/attachments/606f6847-b34e-49be-8df0-00fef3b034c1) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:06:22 +00:00
Author
Owner
Copy link

Committed and pushed 7ef5236f14: Carry only compatible plugin-owned descriptors through verified exec (D147, D168, D217).

Validate a bounded descriptor set against both signed immutable candidate and predecessor images before shutdown. Reject unsafe or duplicate environment names, standard-stream descriptors and missing exact capability notes. Construct only public PID/fd metadata, arm after serving stops, distinguish kernel fallback and cancel before redispatch only after acknowledgements. Every refused exec restores CLOEXEC; an uncertain cancellation terminates rather than spawning children with private authority. Existing CA frames and listener adoption retain their independent paths. Tests exercise real socket flags and ELF records; this bridge does not yet register a backup guardian.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 82 filtered out; finished in 0.00s
test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 63 filtered out; finished in 6.55s
test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

plugin-exec-resource-host-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 7ef5236f14ea6909ff6b294704b19962d2f47262: Carry only compatible plugin-owned descriptors through verified exec (D147, D168, D217). Validate a bounded descriptor set against both signed immutable candidate and predecessor images before shutdown. Reject unsafe or duplicate environment names, standard-stream descriptors and missing exact capability notes. Construct only public PID/fd metadata, arm after serving stops, distinguish kernel fallback and cancel before redispatch only after acknowledgements. Every refused exec restores CLOEXEC; an uncertain cancellation terminates rather than spawning children with private authority. Existing CA frames and listener adoption retain their independent paths. Tests exercise real socket flags and ELF records; this bridge does not yet register a backup guardian. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 82 filtered out; finished in 0.00s test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 63 filtered out; finished in 6.55s test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s ``` [plugin-exec-resource-host-gate.log](https://git.kayg.org/attachments/efee89e6-dbed-42c1-8b2d-4d2bea66d6e4) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:07:31 +00:00
Author
Owner
Copy link

Committed and pushed f0faa651fa: Fence recovery key release and check-in to one image transition (D17, D147, D168).

Define canonical fixed-size public commands separately from protected key bytes. An unarmed guardian can cancel without restoration; an armed transition releases its protected key once only to its exact admitted image and accepts healthy check-in only after resume. Kernel-refused candidates may select only the predecessor. Replayed, premature and wrong-image commands fail closed. Socket EOF is explicitly insufficient to authorize restoration, which requires the host to observe the pinned parent lifetime ending. Three state/framing tests qualify the protocol; process and database barriers remain separate.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 29 filtered out; finished in 0.00s

backup-recovery-control-protocol-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f0faa651faa351162418462ec81b09f5263dd5fe: Fence recovery key release and check-in to one image transition (D17, D147, D168). Define canonical fixed-size public commands separately from protected key bytes. An unarmed guardian can cancel without restoration; an armed transition releases its protected key once only to its exact admitted image and accepts healthy check-in only after resume. Kernel-refused candidates may select only the predecessor. Replayed, premature and wrong-image commands fail closed. Socket EOF is explicitly insufficient to authorize restoration, which requires the host to observe the pinned parent lifetime ending. Three state/framing tests qualify the protocol; process and database barriers remain separate. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 29 filtered out; finished in 0.00s ``` [backup-recovery-control-protocol-gate.log](https://git.kayg.org/attachments/260125a4-a6d5-4fba-8a70-52c4ea9553e2) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:07:41 +00:00
Author
Owner
Copy link

Committed and pushed fb9a69d4fc: Terminate a pinned update parent without looking up its PID again (D147, D217).

Add one audited Linux pidfd_send_signal boundary for the already authenticated update parent. A fixed SIGKILL, null siginfo and zero flags cannot target a reused PID; the kernel validates descriptor type and signal permissions. The host must authenticate process birth before opening its lifetime descriptor and must observe its exit before any restore. Falling back to numeric-PID kill would create a reuse race. Tests kill and reap only their own spawned sleeping child and reject ordinary file descriptors; no guardian or timeout worker is started by this module.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 93 filtered out; finished in 0.00s

pinned-parent-termination-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed fb9a69d4fcf673fef829fe42ff14e641e3d366b2: Terminate a pinned update parent without looking up its PID again (D147, D217). Add one audited Linux pidfd_send_signal boundary for the already authenticated update parent. A fixed SIGKILL, null siginfo and zero flags cannot target a reused PID; the kernel validates descriptor type and signal permissions. The host must authenticate process birth before opening its lifetime descriptor and must observe its exit before any restore. Falling back to numeric-PID kill would create a reuse race. Tests kill and reap only their own spawned sleeping child and reject ordinary file descriptors; no guardian or timeout worker is started by this module. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 93 filtered out; finished in 0.00s ``` [pinned-parent-termination-gate.log](https://git.kayg.org/attachments/05c54783-10ee-4574-8aea-5b17bd7ffb38) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:09:15 +00:00
Author
Owner
Copy link

Committed and pushed ae2a72adfd: Qualify the private cold-start recovery barrier (D147, D168, D217).

Prepare a test-only checked filesystem barrier before runtime wiring. An owned guardian retains the existing flock primitive through restore or durable healthy completion; public metadata binds its original PID, boot UUID, process birth tick and checkpoint. Exact warm exec may continue its private check-in, while a cold process must wait and require marker removal. Drop deliberately leaves incomplete recovery visible instead of silently opening the database. Refuse replacement of an earlier point, aliased/shared files, malformed metadata and substituted completion markers. Existing pidfds handle process lifetime separately; a new lock engine or PID-only warm bypass is unnecessary. Production startup and guardian integration remain incomplete.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 534 filtered out; finished in 0.08s

recovery-startup-barrier-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed ae2a72adfd1134e2f16543422edf6fd843962482: Qualify the private cold-start recovery barrier (D147, D168, D217). Prepare a test-only checked filesystem barrier before runtime wiring. An owned guardian retains the existing flock primitive through restore or durable healthy completion; public metadata binds its original PID, boot UUID, process birth tick and checkpoint. Exact warm exec may continue its private check-in, while a cold process must wait and require marker removal. Drop deliberately leaves incomplete recovery visible instead of silently opening the database. Refuse replacement of an earlier point, aliased/shared files, malformed metadata and substituted completion markers. Existing pidfds handle process lifetime separately; a new lock engine or PID-only warm bypass is unnecessary. Production startup and guardian integration remain incomplete. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 534 filtered out; finished in 0.08s ``` [recovery-startup-barrier-tests-gate.log](https://git.kayg.org/attachments/14fb74f8-cd4e-411d-b911-047aaaa84fd0) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:09:37 +00:00
Author
Owner
Copy link

Committed and pushed ff999977da: Keep optional recovery-resource bindings separate from private actions (D198).

Declare a separately removable private-resource host capability using only the existing private-action and protected-buffer dependencies. Ordinary CA private HTTP actions do not require this recovery surface or its runtime context, and metadata-only plugins remain inert. No library, version or engine is added. Enabling every recovery binding whenever private HTTP exists would retain unrelated code in feature-disabled builds.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 34 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

private-resource-visitor-feature-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed ff999977da95bf9b0ac4d35843c93fb9f3e29226: Keep optional recovery-resource bindings separate from private actions (D198). Declare a separately removable private-resource host capability using only the existing private-action and protected-buffer dependencies. Ordinary CA private HTTP actions do not require this recovery surface or its runtime context, and metadata-only plugins remain inert. No library, version or engine is added. Enabling every recovery binding whenever private HTTP exists would retain unrelated code in feature-disabled builds. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 34 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [private-resource-visitor-feature-gate.log](https://git.kayg.org/attachments/b24b2cd1-56a8-4fe1-b415-a6a9d464830c) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:09:47 +00:00
Author
Owner
Copy link

Committed and pushed 4fa20f5425: Visit bounded private recovery resources without aggregating plaintext (D147, D168, D198).

Add an inert generic plugin binding for the confirmed server resource host. Separate host-selected bounded absolute file targets from opaque encrypted resource labels; signing material stays memory-only. A synchronous visitor seals one borrowed protected resource before capture proceeds, avoiding another plaintext aggregate or serialized private-key container. Construction and binding start no work. Existing hosts and plugins keep default behavior. No capture engine, host registration or updater provider is enabled by this contract step.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

private-resource-visitor-contract-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 4fa20f5425fbaf23bcefbdb7edbe80c66a3b8341: Visit bounded private recovery resources without aggregating plaintext (D147, D168, D198). Add an inert generic plugin binding for the confirmed server resource host. Separate host-selected bounded absolute file targets from opaque encrypted resource labels; signing material stays memory-only. A synchronous visitor seals one borrowed protected resource before capture proceeds, avoiding another plaintext aggregate or serialized private-key container. Construction and binding start no work. Existing hosts and plugins keep default behavior. No capture engine, host registration or updater provider is enabled by this contract step. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 35 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [private-resource-visitor-contract-gate.log](https://git.kayg.org/attachments/21798fca-0399-4510-a1e4-22cb76d6c94f) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:10:02 +00:00
Author
Owner
Copy link

Committed and pushed 3be2914e03: Enable the shared private-resource surface only for backup runtime (D147, D198).

Have the removable backup server feature opt into the separately gated host resource interface. Keep metadata and encryption-only builds free of runtime context binding. This is a feature edge to an existing workspace interface, not a new dependency engine or a global private-HTTP capability. Actual host binding and capture follow independently.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s

backup-private-resource-capability-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 3be2914e03cb9e3263e9db014a3ebc8330170f1d: Enable the shared private-resource surface only for backup runtime (D147, D198). Have the removable backup server feature opt into the separately gated host resource interface. Keep metadata and encryption-only builds free of runtime context binding. This is a feature edge to an existing workspace interface, not a new dependency engine or a global private-HTTP capability. Actual host binding and capture follow independently. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s ``` [backup-private-resource-capability-gate.log](https://git.kayg.org/attachments/a75bb3ea-c1d4-46c6-acbe-db43906827c5) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:10:10 +00:00
Author
Owner
Copy link

Committed and pushed 24d6b2eb65: Share one opaque label predicate for recovery hosts and inventories (D147, D198).

Delegate the unchanged nonempty, bounded ASCII resource-name predicate to the shared private-resource API. Host-selected target labels and authenticated inventories must agree without treating either as filesystem authority. A second predicate would let their acceptance rules drift. Existing encrypted bundle, corruption and inventory tests pass; paths remain independently bounded and admitted.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s

shared-private-resource-labels-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 24d6b2eb65b2a7ceb218e65d1f817f1aa5cbddfd: Share one opaque label predicate for recovery hosts and inventories (D147, D198). Delegate the unchanged nonempty, bounded ASCII resource-name predicate to the shared private-resource API. Host-selected target labels and authenticated inventories must agree without treating either as filesystem authority. A second predicate would let their acceptance rules drift. Existing encrypted bundle, corruption and inventory tests pass; paths remain independently bounded and admitted. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s ``` [shared-private-resource-labels-gate.log](https://git.kayg.org/attachments/e373d361-77a4-4944-b902-30df2ed1e304) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:11:48 +00:00
Author
Owner
Copy link

Committed and pushed 3fa35596cf: Gate confirmed-host resource adapters as an optional capability (D147, D198).

Have the backup feature opt into the shared private-resource host capability while ordinary CA private HTTP support remains independent. Reuse the existing protected allocator and plugin interface. No host constructor, key import or background work starts from this feature edge, and disabling the feature removes the subsequent host adapter at build time. A backup-specific branch in core dispatch or globally enabling capture with every private HTTP route would break layering.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

server-private-resource-capability-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 3fa35596cf2d9e9a4f9227d2fc632c50e3645bd1: Gate confirmed-host resource adapters as an optional capability (D147, D198). Have the backup feature opt into the shared private-resource host capability while ordinary CA private HTTP support remains independent. Reuse the existing protected allocator and plugin interface. No host constructor, key import or background work starts from this feature edge, and disabling the feature removes the subsequent host adapter at build time. A backup-specific branch in core dispatch or globally enabling capture with every private HTTP route would break layering. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [server-private-resource-capability-gate.log](https://git.kayg.org/attachments/b3904e32-f4c6-45e4-9d16-278a4a13f4b8) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:14:31 +00:00
Author
Owner
Copy link

Committed and pushed 4738f7448c: Reuse the existing protected CA frame for recovery capture (D147, D168, D217).

Factor the existing unlocked-source, dump-protection and protected-frame export into one trusted snapshot function and have stdin handoff reuse it. Preserve CA-v1 encoding, secure provider allocation, transient-copy wiping and retained-issuer validation. Expose only configured public resource-directory coordinates to the optional host adapter. A second private-key serializer would duplicate sensitive copies and weaken wire compatibility. This exports no endpoint, authorization shortcut or plaintext key file; existing CA handoff and authority tests remain the gate.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 530 filtered out; finished in 0.52s
test result: ok. 33 passed; 0 failed; 10 ignored; 0 measured; 495 filtered out; finished in 18.59s

shared-protected-ca-snapshot-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 4738f7448c47e45237da24898013bab4a2bcd4db: Reuse the existing protected CA frame for recovery capture (D147, D168, D217). Factor the existing unlocked-source, dump-protection and protected-frame export into one trusted snapshot function and have stdin handoff reuse it. Preserve CA-v1 encoding, secure provider allocation, transient-copy wiping and retained-issuer validation. Expose only configured public resource-directory coordinates to the optional host adapter. A second private-key serializer would duplicate sensitive copies and weaken wire compatibility. This exports no endpoint, authorization shortcut or plaintext key file; existing CA handoff and authority tests remain the gate. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 530 filtered out; finished in 0.52s test result: ok. 33 passed; 0 failed; 10 ignored; 0 measured; 495 filtered out; finished in 18.59s ``` [shared-protected-ca-snapshot-gate.log](https://git.kayg.org/attachments/ed613f2e-75a5-4b38-a119-aec65dde2863) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:15:13 +00:00
Author
Owner
Copy link

Committed and pushed 957d38a824: Qualify bounded private-resource reads and protected JSON encoding (D147, D168, D244).

Prepare the host buffer helper under test-only wiring until the visitor is connected. Validate the actual opened file through the existing private-state boundary, read directly into bounded locked/dump-excluded pages and refuse growth, empty data and aliases. Encode configuration directly through the same protected allocation without another plaintext JSON Vec. Public certificates may be readable but never writable by others; that allowance cannot relax private-key permissions. Three actual file/protected-buffer tests cover bounds, aliases, mode separation and JSON compatibility. No capture or updater work is activated.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 538 filtered out; finished in 0.00s

protected-recovery-resource-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 957d38a82473cf43f1ce705632e0dc67a9f8f37a: Qualify bounded private-resource reads and protected JSON encoding (D147, D168, D244). Prepare the host buffer helper under test-only wiring until the visitor is connected. Validate the actual opened file through the existing private-state boundary, read directly into bounded locked/dump-excluded pages and refuse growth, empty data and aliases. Encode configuration directly through the same protected allocation without another plaintext JSON Vec. Public certificates may be readable but never writable by others; that allowance cannot relax private-key permissions. Three actual file/protected-buffer tests cover bounds, aliases, mode separation and JSON compatibility. No capture or updater work is activated. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 538 filtered out; finished in 0.00s ``` [protected-recovery-resource-tests-gate.log](https://git.kayg.org/attachments/99495428-a55e-4662-8994-2dd06e3b920b) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:16:30 +00:00
Author
Owner
Copy link

Committed and pushed 221964e268: Bind confirmed server configuration through the generic resource visitor (D147, D198, D201).

Construct only public coordinates and weak signer ownership for an already initialized server, then offer the inert adapter through the shared plugin hook. Capture configuration directly into protected JSON, reuse the protected CA frame and visit each configured file once before sealing. Combined certificate/key paths use one target with the stronger private permission. Caller-selected targets remain independent of point inventory. Unsupported optional capture coordinates leave the server running with recovery unavailable rather than turning context binding into server initialization or a listener failure. Real filesystem/configuration tests cover inert construction, visitor order, permissions and deduplication; CA cryptographic export is qualified separately. The backup consumer and updater provider remain uninstalled.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 541 filtered out; finished in 0.00s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 541 filtered out; finished in 0.00s
test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 538 filtered out; finished in 2.86s

confirmed-server-resource-host-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 221964e2689ae1f2e7d8a0ba74ba8031451bf3e1: Bind confirmed server configuration through the generic resource visitor (D147, D198, D201). Construct only public coordinates and weak signer ownership for an already initialized server, then offer the inert adapter through the shared plugin hook. Capture configuration directly into protected JSON, reuse the protected CA frame and visit each configured file once before sealing. Combined certificate/key paths use one target with the stronger private permission. Caller-selected targets remain independent of point inventory. Unsupported optional capture coordinates leave the server running with recovery unavailable rather than turning context binding into server initialization or a listener failure. Real filesystem/configuration tests cover inert construction, visitor order, permissions and deduplication; CA cryptographic export is qualified separately. The backup consumer and updater provider remain uninstalled. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 541 filtered out; finished in 0.00s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 541 filtered out; finished in 0.00s test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 538 filtered out; finished in 2.86s ``` [confirmed-server-resource-host-gate.log](https://git.kayg.org/attachments/c870140a-7e05-4451-80c1-fabc9af242b4) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 06:22:57 +00:00
Author
Owner
Copy link

Confirmed same-socket RED: after an admitted typed frame interrupts the checkpoint fence, the existing browser receives Close rather than its input echo/ACK. Isolated real WebSocket/SQLite test holds timer epochs stationary and observes the actual interruption event before releasing the fence. It sends a second byte range on the same connection and checks exact echoed bytes; no performance timing or real-PTY claim.
same-socket-foreground-red.log

Confirmed same-socket RED: after an admitted typed frame interrupts the checkpoint fence, the existing browser receives Close rather than its input echo/ACK. Isolated real WebSocket/SQLite test holds timer epochs stationary and observes the actual interruption event before releasing the fence. It sends a second byte range on the same connection and checks exact echoed bytes; no performance timing or real-PTY claim. [same-socket-foreground-red.log](https://git.kayg.org/attachments/5c4462c4-ab5d-4390-9484-ca3990fab996)
kayg commented 2026-10-16 06:31:46 +00:00
Author
Owner
Copy link

Continuation at pushed 221964e268. Rebased onto dev f210a4f25; all committed slices have their individual gates/receipts above. The new real-socket regression reproduced a protocol Close after input interrupts checkpoint preparation (RED attached above). Uncommitted activity.rs adds notification-driven input/attach admission waits and one controlled test; a strict Clippy doc-markdown finding is corrected. The behavioral socket change is not applied yet. Active queued command: build-slot python3 $HOME/.cache/codex-scratch/edge-autoupdate/resume-foreground-admission-gate.py; it resumes at the API gate, commits/pushes that slice, applies/tests the socket correction, then continues finish-ca-encrypted-snapshot.py. Do not replay completed prefixes.

Untracked recovery_channel.rs now also carries independently admitted target coordinates/signer expectation and refusal tests; recovery_worker.rs initializes the existing locked provider before CA frame validation. These edits are uncompiled/unwired and must receive actual module gates before any production claim. Guardian/provider/startup integration, real migration/rollback VM acceptance, current caps/native qualification, parser campaigns and final iterate/fast remain incomplete. No merge/deploy or final acceptance.

Continuation at pushed 221964e2689ae1f2e7d8a0ba74ba8031451bf3e1. Rebased onto dev f210a4f25; all committed slices have their individual gates/receipts above. The new real-socket regression reproduced a protocol Close after input interrupts checkpoint preparation (RED attached above). Uncommitted activity.rs adds notification-driven input/attach admission waits and one controlled test; a strict Clippy doc-markdown finding is corrected. The behavioral socket change is not applied yet. Active queued command: build-slot python3 $HOME/.cache/codex-scratch/edge-autoupdate/resume-foreground-admission-gate.py; it resumes at the API gate, commits/pushes that slice, applies/tests the socket correction, then continues finish-ca-encrypted-snapshot.py. Do not replay completed prefixes. Untracked recovery_channel.rs now also carries independently admitted target coordinates/signer expectation and refusal tests; recovery_worker.rs initializes the existing locked provider before CA frame validation. These edits are uncompiled/unwired and must receive actual module gates before any production claim. Guardian/provider/startup integration, real migration/rollback VM acceptance, current caps/native qualification, parser campaigns and final iterate/fast remain incomplete. No merge/deploy or final acceptance.
kayg commented 2026-10-16 06:35:31 +00:00
Author
Owner
Copy link

Additive recovery wiring contract before implementation: extend compiled CLI factories with an optional inert generic lifecycle callback (Claim after hardening and before child dispatch; BeforeServer(existing data path) before the serving runtime/database). Metadata construction never runs it; disabled builds retain no callback. Reuse the existing factory composition and CliWorker action callback, without a backup string route in core dispatch. Claim private fds once into CLOEXEC ownership; repeated in-process dispatch cannot claim a consumed descriptor again. No new library/engine or server initialization.

Startup completion must follow listener binding, actual-image history reconciliation and component health before accepting user work; the existing owned plugin task/epoch lifecycle should carry any readiness wait. This is an unwired contract/implementation boundary, not a successful recovery or VM proof.

Additive recovery wiring contract before implementation: extend compiled CLI factories with an optional inert generic lifecycle callback (Claim after hardening and before child dispatch; BeforeServer(existing data path) before the serving runtime/database). Metadata construction never runs it; disabled builds retain no callback. Reuse the existing factory composition and CliWorker action callback, without a backup string route in core dispatch. Claim private fds once into CLOEXEC ownership; repeated in-process dispatch cannot claim a consumed descriptor again. No new library/engine or server initialization. Startup completion must follow listener binding, actual-image history reconciliation and component health before accepting user work; the existing owned plugin task/epoch lifecycle should carry any readiness wait. This is an unwired contract/implementation boundary, not a successful recovery or VM proof.
kayg commented 2026-10-16 06:46:03 +00:00
Author
Owner
Copy link

Rebased dependency attribution at 221964e26: Cargo.lock adds/removes zero package identities and zero registry packages versus current origin/dev d5ebcb62e. Differences are feature/dependency edges to existing workspace engines, including the same libsqlite3-sys 0.30.1 already used by SQLx, existing OpenSSL, protocol/serialization and event-loop crates. CLI/API orchestration retains the previously reviewed size profile; no new TLS/HTTP/JSON/crypto engine was chosen. This is dependency attribution, not a final size or performance qualification.
rebased-dependency-identities.json

Origin/dev advanced after the rebase only in DECISIONS/TASTE (four commits since f210a4f25); D289–D291 read. No production code/cap changed in that advance. The final head still needs integration with the latest dev and complete qualification.

Rebased dependency attribution at 221964e26: Cargo.lock adds/removes zero package identities and zero registry packages versus current origin/dev d5ebcb62e. Differences are feature/dependency edges to existing workspace engines, including the same libsqlite3-sys 0.30.1 already used by SQLx, existing OpenSSL, protocol/serialization and event-loop crates. CLI/API orchestration retains the previously reviewed size profile; no new TLS/HTTP/JSON/crypto engine was chosen. This is dependency attribution, not a final size or performance qualification. [rebased-dependency-identities.json](https://git.kayg.org/attachments/3838c31a-25b1-4cf6-8cd6-758c0c82bf93) Origin/dev advanced after the rebase only in DECISIONS/TASTE (four commits since f210a4f25); D289–D291 read. No production code/cap changed in that advance. The final head still needs integration with the latest dev and complete qualification.
kayg commented 2026-10-16 06:53:12 +00:00
Author
Owner
Copy link

Resumable continuation at pushed 221964e26, with per-file hashes and exact gate/entry status.
recovery-continuation-221964e26.zip

Includes the current uncommitted patch, unwired channel/guardian/worker/fuzz sources, selected ordered workflows and integration drafts. Current entry remains resume-foreground-admission-gate.py through build-slot; do not replay earlier prefixes. Real-socket input Close is reproduced; API waits are uncommitted and awaiting their corrected lint gate. The scheduled fifty-administrator case is expected to expose the 32-target bound and needs a RED before its fix. The archive is not a production qualification; actual provider/startup/rollback, VM acceptance, caps/native/parser qualification and final fast remain unfinished.

Resumable continuation at pushed 221964e26, with per-file hashes and exact gate/entry status. [recovery-continuation-221964e26.zip](https://git.kayg.org/attachments/ae093ea9-d0dd-4fe1-a578-79cedb838897) Includes the current uncommitted patch, unwired channel/guardian/worker/fuzz sources, selected ordered workflows and integration drafts. Current entry remains resume-foreground-admission-gate.py through build-slot; do not replay earlier prefixes. Real-socket input Close is reproduced; API waits are uncommitted and awaiting their corrected lint gate. The scheduled fifty-administrator case is expected to expose the 32-target bound and needs a RED before its fix. The archive is not a production qualification; actual provider/startup/rollback, VM acceptance, caps/native/parser qualification and final fast remain unfinished.
kayg commented 2026-10-16 06:58:46 +00:00
Author
Owner
Copy link

Committed and pushed 7414cc56d1: Wake bounded foreground work when a cancelled handoff releases its fence (D128, D251).

A foreground attempt must postpone automatic preparation without discarding an already bounded frame or attachment. Add event-driven admission waits using the existing notification and original atomic input/attach checks; subscribe before inspecting state to avoid a lost release. Poisoned state still refuses. Keep the disabled-feature and ordinary input fast paths unchanged, with no polling timer or detached task. A controlled input/attach scenario proves interruption, parked work, release and pending-connection exclusion; the real-socket RED is recorded separately before server integration.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

bounded-foreground-admission-wait-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 7414cc56d11192b51148a3e6c01f34303a3e79cf: Wake bounded foreground work when a cancelled handoff releases its fence (D128, D251). A foreground attempt must postpone automatic preparation without discarding an already bounded frame or attachment. Add event-driven admission waits using the existing notification and original atomic input/attach checks; subscribe before inspecting state to avoid a lost release. Poisoned state still refuses. Keep the disabled-feature and ordinary input fast paths unchanged, with no polling timer or detached task. A controlled input/attach scenario proves interruption, parked work, release and pending-connection exclusion; the real-socket RED is recorded separately before server integration. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [bounded-foreground-admission-wait-gate.log](https://git.kayg.org/attachments/d73a13a5-2d3c-46df-940e-96dbd21e1810) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:17:07 +00:00
Author
Owner
Copy link

Committed and pushed 8829f8b08a: Retain typed input on its browser while automatic preparation cancels (D128, D251).

The input handler returned an error after correctly interrupting an update fence, forcing a healthy browser to reconnect before its unacknowledged bytes could be retried. Retain the admitted frame in its existing bounded ordered queue until the original fence releases, then recheck foreground admission before forwarding. Attach and bounded terminal-open work use the same release notification. Existing authority and revocation guards still wrap the entire wait, while independent transport proofs remain runnable. Returning Close or widening liveness leases would hide the cancellation boundary. The isolated real-WebSocket regression fails before the fix and then proves exact first/second byte ranges and ACKs on the same connection; the full socket suite qualifies the changed authority path.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 544 filtered out; finished in 0.63s
test result: ok. 41 passed; 0 failed; 2 ignored; 0 measured; 502 filtered out; finished in 91.17s

same-socket-foreground-continuity-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 8829f8b08a149c74e4bd3c82deb61f864aea3e2e: Retain typed input on its browser while automatic preparation cancels (D128, D251). The input handler returned an error after correctly interrupting an update fence, forcing a healthy browser to reconnect before its unacknowledged bytes could be retried. Retain the admitted frame in its existing bounded ordered queue until the original fence releases, then recheck foreground admission before forwarding. Attach and bounded terminal-open work use the same release notification. Existing authority and revocation guards still wrap the entire wait, while independent transport proofs remain runnable. Returning Close or widening liveness leases would hide the cancellation boundary. The isolated real-WebSocket regression fails before the fix and then proves exact first/second byte ranges and ACKs on the same connection; the full socket suite qualifies the changed authority path. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 544 filtered out; finished in 0.63s test result: ok. 41 passed; 0 failed; 2 ignored; 0 measured; 502 filtered out; finished in 91.17s ``` [same-socket-foreground-continuity-gate.log](https://git.kayg.org/attachments/4d7251d7-3f6f-4b7d-8e01-ea27c4487b36) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:18:54 +00:00
Author
Owner
Copy link

Committed and pushed c41b9734e5: Admit recovery files at the fifty-administrator design point (D147, D170).

The real encrypted-envelope inventory regression rejects fifty administrators because the original bound of 32 also includes the configured identity files. Keep a fixed bound of 64, sufficient for fifty envelopes plus five configured targets; do not use an unbounded listing or omit administrator recovery copies. Capture remains one protected resource at a time, rather than multiplying plaintext memory by the inventory count. The failing filesystem test is recorded separately and rerun in the following capture slice.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

recovery-target-capacity-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed c41b9734e51f1b1205080fcc83d30f5747f15f4a: Admit recovery files at the fifty-administrator design point (D147, D170). The real encrypted-envelope inventory regression rejects fifty administrators because the original bound of 32 also includes the configured identity files. Keep a fixed bound of 64, sufficient for fifty envelopes plus five configured targets; do not use an unbounded listing or omit administrator recovery copies. Capture remains one protected resource at a time, rather than multiplying plaintext memory by the inventory count. The failing filesystem test is recorded separately and rerun in the following capture slice. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [recovery-target-capacity-gate.log](https://git.kayg.org/attachments/6bc7b33c-051a-43d3-9b3d-8f832f606ac5) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:19:05 +00:00
Author
Owner
Copy link

Recovery inventory RED: the real filesystem suite has 2 passed / 2 failed. The fifty-administrator fixture exceeds MAX_TARGETS=32 after reserving five configured identity files; bounded capacity is being raised to 64, with sequential protected capture unchanged. The new inventory also initially assumed hexadecimal member names, but existing EncryptedCopies uses canonical URL-safe base64 SHA-256 names; the reader now validates that existing encoding rather than changing published envelopes. Both failures and paths are in the raw log below. No runtime recovery or performance qualification is claimed.

ca-inventory-capacity-red.log

Recovery inventory RED: the real filesystem suite has 2 passed / 2 failed. The fifty-administrator fixture exceeds MAX_TARGETS=32 after reserving five configured identity files; bounded capacity is being raised to 64, with sequential protected capture unchanged. The new inventory also initially assumed hexadecimal member names, but existing EncryptedCopies uses canonical URL-safe base64 SHA-256 names; the reader now validates that existing encoding rather than changing published envelopes. Both failures and paths are in the raw log below. No runtime recovery or performance qualification is claimed. [ca-inventory-capacity-red.log](https://git.kayg.org/attachments/35b0c9df-e1b9-4253-9812-1a1315975095)
kayg commented 2026-10-16 07:20:11 +00:00
Author
Owner
Copy link

Additive recovery wiring refinement before implementation (#211, D147/D155/D168/D198): retain original host-selected destination admission in private local records separate from encrypted point inventories. A successful image check-in selects its exact predecessor point; manual rollback reuses those original destinations, never timestamp guesses or paths from the bundle. Capture a fresh point before manual rollback so a failed downgrade restores the image/database it left. Retain only records referenced by bounded local point/image retention. Full D155 database/CA/config restoration applies; no invented security-state overlay.

Claim the inherited anonymous channel before child dispatch, then authenticate the actual image and wait on the guardian barrier before any serving database opens. A memory-only key lease may be transferred once into the enabled backup activation after retained key-identity checks; a cold process remains locked. A generic optional readiness callback must complete actual image-history reconciliation and component startup before the newly bound listener accepts mutations. Signer readiness changes use its existing lock-state subscription, owned by the enabled backup future. None of these contracts authorizes a new server, a signing service deployment or a new engine. Actual runtime wiring and VM proof remain incomplete.

Additive recovery wiring refinement before implementation (#211, D147/D155/D168/D198): retain original host-selected destination admission in private local records separate from encrypted point inventories. A successful image check-in selects its exact predecessor point; manual rollback reuses those original destinations, never timestamp guesses or paths from the bundle. Capture a fresh point before manual rollback so a failed downgrade restores the image/database it left. Retain only records referenced by bounded local point/image retention. Full D155 database/CA/config restoration applies; no invented security-state overlay. Claim the inherited anonymous channel before child dispatch, then authenticate the actual image and wait on the guardian barrier before any serving database opens. A memory-only key lease may be transferred once into the enabled backup activation after retained key-identity checks; a cold process remains locked. A generic optional readiness callback must complete actual image-history reconciliation and component startup before the newly bound listener accepts mutations. Signer readiness changes use its existing lock-state subscription, owned by the enabled backup future. None of these contracts authorizes a new server, a signing service deployment or a new engine. Actual runtime wiring and VM proof remain incomplete.
kayg commented 2026-10-16 07:21:40 +00:00
Author
Owner
Copy link

Committed and pushed b0f1e2da07: Capture encrypted CA administrator envelopes with retained configuration (D147, D168, D186).

A CA snapshot must preserve its encrypted administrator copies as configuration as well as the memory-only signer and retained issuer. Reuse the existing checked encrypted-copy directory, admit canonical bounded leaves before private capture and derive opaque labels from the configured paths. Keep publication serialized by the existing database writer reservation and require the complete admitted resource set during point authentication. Reading starts only during explicit capture/target admission, never construction. Copying raw signing keys to files, trusting inventory-selected paths or retaining an unbounded directory listing would violate custody or resource bounds. Four actual filesystem tests at the fifty-administrator design point cover strict bounds, canonical order/generation, alias/shared-mode/unknown-file refusal and non-repair; existing storage/capture gates remain required. Full guardian restore remains unwired.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 546 filtered out; finished in 0.00s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 545 filtered out; finished in 1.46s
test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 545 filtered out; finished in 0.66s
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 544 filtered out; finished in 0.09s

capture-encrypted-ca-administrator-state-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed b0f1e2da07c1a5e7f82620a45ab8e8dbbe556863: Capture encrypted CA administrator envelopes with retained configuration (D147, D168, D186). A CA snapshot must preserve its encrypted administrator copies as configuration as well as the memory-only signer and retained issuer. Reuse the existing checked encrypted-copy directory, admit canonical bounded leaves before private capture and derive opaque labels from the configured paths. Keep publication serialized by the existing database writer reservation and require the complete admitted resource set during point authentication. Reading starts only during explicit capture/target admission, never construction. Copying raw signing keys to files, trusting inventory-selected paths or retaining an unbounded directory listing would violate custody or resource bounds. Four actual filesystem tests at the fifty-administrator design point cover strict bounds, canonical order/generation, alias/shared-mode/unknown-file refusal and non-repair; existing storage/capture gates remain required. Full guardian restore remains unwired. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 546 filtered out; finished in 0.00s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 545 filtered out; finished in 1.46s test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 545 filtered out; finished in 0.66s test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 544 filtered out; finished in 0.09s ``` [capture-encrypted-ca-administrator-state-gate.log](https://git.kayg.org/attachments/40c5727f-fe82-4b1a-951d-99c4dfdc2e9b) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:24:08 +00:00
Author
Owner
Copy link

Committed and pushed 1183b118a6: Reuse the opened-image digest for verified recovery binding (D147, D217, D226).

Factor the unchanged positional bounded SHA-256 reader from manifest digest comparison. Keep metadata/length/growth/truncation checks and preserve caller seek position, while comparison still rejects mismatched signed checksums. The public helper establishes no signature or executable authority; the receiver must seal and admit its image independently. Copying another whole-image hash loop into restart or backup would duplicate I/O/security rules and increase binary size. Existing release verification tests remain the gate.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 25 filtered out; finished in 0.05s

shared-opened-image-digest-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 1183b118a68823f5497f8a18ea944366d75d6f40: Reuse the opened-image digest for verified recovery binding (D147, D217, D226). Factor the unchanged positional bounded SHA-256 reader from manifest digest comparison. Keep metadata/length/growth/truncation checks and preserve caller seek position, while comparison still rejects mismatched signed checksums. The public helper establishes no signature or executable authority; the receiver must seal and admit its image independently. Copying another whole-image hash loop into restart or backup would duplicate I/O/security rules and increase binary size. Existing release verification tests remain the gate. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 4 passed; 0 failed; 1 ignored; 0 measured; 25 filtered out; finished in 0.05s ``` [shared-opened-image-digest-gate.log](https://git.kayg.org/attachments/f9bce0e7-9449-460e-be7b-6d198239d4dc) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:24:16 +00:00
Author
Owner
Copy link

Committed and pushed 5891965dd4: Carry receiver-owned image commitments into handoff preparation (D147, D217).

Add a separate trusted receiver path that binds the candidate and pinned predecessor commitments before the post-fence preparation hook. Keep the bounded local wire request unchanged and never deserialize these commitments from its path/version fields. Existing admission consumers retain default behavior; the recovery consumer must explicitly require a binding before snapshot publication. Reopening mutable paths to choose checkpoint identities would detach the backup from the exact sealed bytes the receiver executes. No recovery provider or private export is enabled by this API step.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 29 filtered out; finished in 0.00s

receiver-bound-image-admission-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 5891965dd40e00fff0ff40ad386afbfc47dc1ee7: Carry receiver-owned image commitments into handoff preparation (D147, D217). Add a separate trusted receiver path that binds the candidate and pinned predecessor commitments before the post-fence preparation hook. Keep the bounded local wire request unchanged and never deserialize these commitments from its path/version fields. Existing admission consumers retain default behavior; the recovery consumer must explicitly require a binding before snapshot publication. Reopening mutable paths to choose checkpoint identities would detach the backup from the exact sealed bytes the receiver executes. No recovery provider or private export is enabled by this API step. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 29 filtered out; finished in 0.00s ``` [receiver-bound-image-admission-gate.log](https://git.kayg.org/attachments/fb661a69-f04f-4968-91d3-fb8ca28d1150) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:25:37 +00:00
Author
Owner
Copy link

Committed and pushed 5917678bf2: Bind recovery to the exact sealed candidate and pinned running image (D147, D217).

Pin the trusted running predecessor before post-fence preparation, compute both commitments with the shared positional digest reader and pass them through the receiver-only admission API. Export private CA frames only after admission succeeds, then retain and execute those same opened images. Reuse one constructor for manual reload and receiver-owned recovery rather than reopening the predecessor after choosing checkpoint identity. Request paths/version strings cannot substitute their own digests, and synchronous image reads retain owned I/O/scheduler behavior. Existing signature/refusal, sealed-image, real exec/recovery and no-default tests qualify the adapter; the actual backup provider remains fail-closed.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 63 filtered out; finished in 6.17s
test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 78 filtered out; finished in 3.22s
test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

sealed-image-pair-receiver-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 5917678bf2f5f32a96f4486f539ea76145409ade: Bind recovery to the exact sealed candidate and pinned running image (D147, D217). Pin the trusted running predecessor before post-fence preparation, compute both commitments with the shared positional digest reader and pass them through the receiver-only admission API. Export private CA frames only after admission succeeds, then retain and execute those same opened images. Reuse one constructor for manual reload and receiver-owned recovery rather than reopening the predecessor after choosing checkpoint identity. Request paths/version strings cannot substitute their own digests, and synchronous image reads retain owned I/O/scheduler behavior. Existing signature/refusal, sealed-image, real exec/recovery and no-default tests qualify the adapter; the actual backup provider remains fail-closed. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 21 passed; 0 failed; 0 ignored; 0 measured; 63 filtered out; finished in 6.17s test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 78 filtered out; finished in 3.22s test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s ``` [sealed-image-pair-receiver-gate.log](https://git.kayg.org/attachments/3398169a-00ca-4cb1-b1bb-c57eec6a4ad0) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:27:15 +00:00
Author
Owner
Copy link

Committed and pushed b4a1ba0a21: Enable optional release activation fencing for private recovery (D198, D251).

Keep private admission behind an explicit release feature selected weakly by the server private-resource host. Removing release still removes its dependency, and standalone release builds retain their existing API. This only enables shared admission types: it installs no updater recovery provider, task or key. Unconditionally linking private key administration into every release-only build would retain unrelated machinery.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 20 filtered out; finished in 0.13s

release-final-activation-feature-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed b4a1ba0a21135fdee647bfeb63fdf8d792b693ef: Enable optional release activation fencing for private recovery (D198, D251). Keep private admission behind an explicit release feature selected weakly by the server private-resource host. Removing release still removes its dependency, and standalone release builds retain their existing API. This only enables shared admission types: it installs no updater recovery provider, task or key. Unconditionally linking private key administration into every release-only build would retain unrelated machinery. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 13 passed; 0 failed; 0 ignored; 0 measured; 20 filtered out; finished in 0.13s ``` [release-final-activation-feature-gate.log](https://git.kayg.org/attachments/b3cef2fe-0907-4adc-858d-2581602dee58) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:28:00 +00:00
Author
Owner
Copy link

Recovery ordering finding from source: D155 restores release bookkeeping along with the database. On manual rollback B→A, restoring A's original point also restores its older A→B applying row, losing B's new rollback intent and its predecessor slot. If A then fails, restoring the fresh B point without marking that attempt entered can make startup permit A once more. Evidence: crates/plugins/release/src/startup.rs first-entry branch and updater.rs reconcile(), plus recovery_point.rs full database restoration boundary.

Implementation must regenerate only release-owned operational transition bookkeeping after the authenticated D155 restore, from public transition metadata captured in the fresh image-bound point. It must retain predecessor B on healthy rollback and mark the failed attempt entered after fatal restore so existing signature-verifying startup selects B. Current authorization/revocation tables still restore exactly per D155; no security-state overlay. The transition contains versions, image paths, kind and public clock only, never session proof/token or signing/backup key bytes. This is a source finding and additive integration contract, not a claimed acceptance result.

Recovery ordering finding from source: D155 restores release bookkeeping along with the database. On manual rollback B→A, restoring A's original point also restores its older A→B applying row, losing B's new rollback intent and its predecessor slot. If A then fails, restoring the fresh B point without marking that attempt entered can make startup permit A once more. Evidence: crates/plugins/release/src/startup.rs first-entry branch and updater.rs reconcile(), plus recovery_point.rs full database restoration boundary. Implementation must regenerate only release-owned operational transition bookkeeping after the authenticated D155 restore, from public transition metadata captured in the fresh image-bound point. It must retain predecessor B on healthy rollback and mark the failed attempt entered after fatal restore so existing signature-verifying startup selects B. Current authorization/revocation tables still restore exactly per D155; no security-state overlay. The transition contains versions, image paths, kind and public clock only, never session proof/token or signing/backup key bytes. This is a source finding and additive integration contract, not a claimed acceptance result.
kayg commented 2026-10-16 07:34:54 +00:00
Author
Owner
Copy link

Committed and pushed 0dd469a52a: Retain the original release activation after recovery preparation (D147, D198, D251).

A database writer reservation alone cannot exclude feature disable: the host invalidates and joins the old activation before acquiring that writer. Wrap the updater admission with its original host scope, delegate exact image binding and checkpoint preparation, then retain one final activation lease. Disable that wins during preparation makes the attempt fail and drop its owned channels; a retained attempt makes the host return Busy until exec or cancellation. Never substitute a new activation epoch. Controlled wrapper tests cover ordering, delegation, cancellation and single use; host lifecycle tests exercise actual switch serialization. Recovery checkpoint/provider installation remains separate.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 35 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 549 filtered out; finished in 0.00s

release-final-activation-reservation-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 0dd469a52a431961c477278a0c611403d0c10a94: Retain the original release activation after recovery preparation (D147, D198, D251). A database writer reservation alone cannot exclude feature disable: the host invalidates and joins the old activation before acquiring that writer. Wrap the updater admission with its original host scope, delegate exact image binding and checkpoint preparation, then retain one final activation lease. Disable that wins during preparation makes the attempt fail and drop its owned channels; a retained attempt makes the host return Busy until exec or cancellation. Never substitute a new activation epoch. Controlled wrapper tests cover ordering, delegation, cancellation and single use; host lifecycle tests exercise actual switch serialization. Recovery checkpoint/provider installation remains separate. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 35 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 549 filtered out; finished in 0.00s ``` [release-final-activation-reservation-gate.log](https://git.kayg.org/attachments/2110af24-daab-4713-b455-c1a2a352d941) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:36:10 +00:00
Author
Owner
Copy link

Committed and pushed f67787e39c: Validate the recovery database before host resources change (D147, D186).

Expose the existing authenticated-image SQLite loader and integrity check as a read-only preflight, then reuse exactly that helper during transactional restore. A multi-resource host must reject malformed database bytes before it atomically replaces its first configured file. Keep deserialization, trusted-schema restrictions, page-geometry handling and in-place restore behavior unchanged. Reimplementing integrity checks in the host or validating only after file publication would diverge from the database boundary or permit partial malformed recovery. Real checkpoint tests cover a valid migrated image and an authenticated malformed image; existing database integration tests cover WAL geometry and restoration.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s
test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.27s

preflight-recovery-database-validation-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f67787e39c5cfffcd0158915888fa8efefdb7591: Validate the recovery database before host resources change (D147, D186). Expose the existing authenticated-image SQLite loader and integrity check as a read-only preflight, then reuse exactly that helper during transactional restore. A multi-resource host must reject malformed database bytes before it atomically replaces its first configured file. Keep deserialization, trusted-schema restrictions, page-geometry handling and in-place restore behavior unchanged. Reimplementing integrity checks in the host or validating only after file publication would diverge from the database boundary or permit partial malformed recovery. Real checkpoint tests cover a valid migrated image and an authenticated malformed image; existing database integration tests cover WAL geometry and restoration. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 32 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.27s ``` [preflight-recovery-database-validation-gate.log](https://git.kayg.org/attachments/fb9d2d03-7d29-40fe-9988-18208893dd6b) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:39:38 +00:00
Author
Owner
Copy link

Gate filter correction for 0dd469a52: private_plugin_runtime is the source filename, not its Rust module path; that earlier supplementary invocation selected zero host tests. The release crate gate itself passed 35 tests including its three new reservation scenarios. The correct private_calls::tests filter now exercises the real host epoch boundary; output verbatim:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 545 filtered out; finished in 0.00s

release-host-epoch-followup-gate.log

Gate filter correction for 0dd469a52: private_plugin_runtime is the source filename, not its Rust module path; that earlier supplementary invocation selected zero host tests. The release crate gate itself passed 35 tests including its three new reservation scenarios. The correct private_calls::tests filter now exercises the real host epoch boundary; output verbatim: ```text test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 545 filtered out; finished in 0.00s ``` [release-host-epoch-followup-gate.log](https://git.kayg.org/attachments/0c2734c2-5a0b-4810-81b1-b2f44e7ccb85)
kayg commented 2026-10-16 07:43:54 +00:00
Author
Owner
Copy link

Committed and pushed cd61edd15c: Remove the unused staging diagnostic after control-loop integration (D128).

The rebased control loop no longer calls the old branch-only liveness diagnostic. Keeping its staging-only method makes that feature fail strict Clippy with dead code. Remove the unused getter without changing lease or proof behavior; retaining a diagnostic allowance or adding artificial calls would preserve obsolete instrumentation. The existing liveness tests and staging-feature compiler gate qualify the removal. Migration acceptance remains a separate slice.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 537 filtered out; finished in 20.43s

remove-obsolete-staging-liveness-diagnostic-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed cd61edd15cd4d3c39be4be8ce364d6999e4b4883: Remove the unused staging diagnostic after control-loop integration (D128). The rebased control loop no longer calls the old branch-only liveness diagnostic. Keeping its staging-only method makes that feature fail strict Clippy with dead code. Remove the unused getter without changing lease or proof behavior; retaining a diagnostic allowance or adding artificial calls would preserve obsolete instrumentation. The existing liveness tests and staging-feature compiler gate qualify the removal. Migration acceptance remains a separate slice. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 537 filtered out; finished in 20.43s ``` [remove-obsolete-staging-liveness-diagnostic-gate.log](https://git.kayg.org/attachments/a05083e7-a559-4a48-b06a-209bb2638353) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:44:07 +00:00
Author
Owner
Copy link

Committed and pushed 7f078ba6b6: Make failed-image acceptance commit a real newer migration (D147, D155, D251).

The public staging failure hook previously exited before core migration and could not distinguish a real database recovery from merely restarting the old image. Run the existing full core migration journal plus a staging-only version 26 that commits a probe table and mutates release state before the verified successor exits. Production migration history is unchanged and predecessor validation still rejects the newer journal. A real-engine test proves that the old migrator fails until an actual consistent snapshot restores both schema and data. Replacing the failure with a pre-migration exit or manually forging migration rows would not exercise the required recovery invariant. This test is not a claim of guardian or VM acceptance.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 0.06s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 550 filtered out; finished in 0.01s

staging-failed-image-migration-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 7f078ba6b675856699b553554eea36b31c70cfa4: Make failed-image acceptance commit a real newer migration (D147, D155, D251). The public staging failure hook previously exited before core migration and could not distinguish a real database recovery from merely restarting the old image. Run the existing full core migration journal plus a staging-only version 26 that commits a probe table and mutates release state before the verified successor exits. Production migration history is unchanged and predecessor validation still rejects the newer journal. A real-engine test proves that the old migrator fails until an actual consistent snapshot restores both schema and data. Replacing the failure with a pre-migration exit or manually forging migration rows would not exercise the required recovery invariant. This test is not a claim of guardian or VM acceptance. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 0.06s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 550 filtered out; finished in 0.01s ``` [staging-failed-image-migration-gate.log](https://git.kayg.org/attachments/361c6584-f407-4892-9cab-dc6e14b54fe0) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:46:51 +00:00
Author
Owner
Copy link

Committed and pushed 008b912b48: Specify authenticated restoration to independently selected host targets (D147, D155, D186).

Authenticate the exact image-bound point and retained backup-key identity, require the complete closed resource set, validate SQLite before any retained write, then restore the existing database in place and atomically replace only independently configured file targets. Resource labels and captured JSON can never select paths. CA frames reuse the existing parser and must match the captured issuer; signing material is never written as a file. Real filesystem/database tests restore both mutated data and one configured file, and show authenticated extra resources or traversal cannot change any target. Keep this boundary test-only until the owned recovery worker/provider is installed; no production rollback is claimed.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 549 filtered out; finished in 0.82s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 222 filtered out; finished in 1.09s

authenticated-host-restore-boundary-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 008b912b486d7aae444497ce1f4957e7a72f277e: Specify authenticated restoration to independently selected host targets (D147, D155, D186). Authenticate the exact image-bound point and retained backup-key identity, require the complete closed resource set, validate SQLite before any retained write, then restore the existing database in place and atomically replace only independently configured file targets. Resource labels and captured JSON can never select paths. CA frames reuse the existing parser and must match the captured issuer; signing material is never written as a file. Real filesystem/database tests restore both mutated data and one configured file, and show authenticated extra resources or traversal cannot change any target. Keep this boundary test-only until the owned recovery worker/provider is installed; no production rollback is claimed. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 549 filtered out; finished in 0.82s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 222 filtered out; finished in 1.09s ``` [authenticated-host-restore-boundary-gate.log](https://git.kayg.org/attachments/30670b4d-cf8e-4a07-a2f7-ffa2e94fb0e4) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:47:05 +00:00
Author
Owner
Copy link

Committed and pushed f9e8fa5986: Gate recovery admission interfaces independently of component metadata (D198).

Declare a removable API feature that reuses the existing private-resource and socket-host dependencies. It retains no runtime implementation, signing key or backup engine. Metadata-only builds keep the existing empty default feature set; enabling recovery globally would defeat compile-out.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

optional-private-recovery-interface-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f9e8fa59862a24c337bd2bfc3bfc62dc08945697: Gate recovery admission interfaces independently of component metadata (D198). Declare a removable API feature that reuses the existing private-resource and socket-host dependencies. It retains no runtime implementation, signing key or backup engine. Metadata-only builds keep the existing empty default feature set; enabling recovery globally would defeat compile-out. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 36 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [optional-private-recovery-interface-gate.log](https://git.kayg.org/attachments/56005c3c-8b22-4e0a-a80f-aa66039a5586) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:48:34 +00:00
Author
Owner
Copy link

Additional input ordering finding from source (needs behavioral RED before repair): Updater::authorize retains BEGIN IMMEDIATE through checkpoint/exec. The socket currently calls authority_deadline(renew=true) before its input handler can interrupt Activity's fence. Auth::socket_activity first reads live expiry, then writes renewal when more than 60 seconds elapsed. After the default five-minute quiet period, that renewal waits behind the updater writer; therefore the input cannot reach the cancellation signal. The new same-socket regression covers a foreground fence, but not this real writer plus renewal condition. Evidence: crates/plugins/release/src/updater.rs ConfigurationLease/authorize; crates/infraternal-server/src/websocket.rs while_authorized_operation/input handler; auth/sessions.rs socket_activity.

Extend the controlled real-WebSocket fixture to a WAL database with separate reader connections, shorten its still-live session after priming the stream, hold BEGIN IMMEDIATE and the Activity fence, then require input to interrupt the fence and retain exact ACK/bytes on that socket. The repair must retain the initial live-authority read, independent expiry/revocation watchdog, no idle renewal, and normal input cost. It must not renew against a stale clock after a wait. No performance or behavioral pass is claimed for this source finding.

Additional input ordering finding from source (needs behavioral RED before repair): Updater::authorize retains BEGIN IMMEDIATE through checkpoint/exec. The socket currently calls authority_deadline(renew=true) before its input handler can interrupt Activity's fence. Auth::socket_activity first reads live expiry, then writes renewal when more than 60 seconds elapsed. After the default five-minute quiet period, that renewal waits behind the updater writer; therefore the input cannot reach the cancellation signal. The new same-socket regression covers a foreground fence, but not this real writer plus renewal condition. Evidence: crates/plugins/release/src/updater.rs ConfigurationLease/authorize; crates/infraternal-server/src/websocket.rs while_authorized_operation/input handler; auth/sessions.rs socket_activity. Extend the controlled real-WebSocket fixture to a WAL database with separate reader connections, shorten its still-live session after priming the stream, hold BEGIN IMMEDIATE and the Activity fence, then require input to interrupt the fence and retain exact ACK/bytes on that socket. The repair must retain the initial live-authority read, independent expiry/revocation watchdog, no idle renewal, and normal input cost. It must not renew against a stale clock after a wait. No performance or behavioral pass is claimed for this source finding.
kayg commented 2026-10-16 07:49:29 +00:00
Author
Owner
Copy link

Committed and pushed 654740c43b: Keep recovery readiness typed across owned handoff admission (D147, D186, D198).

Declare the enabled provider boundary with exact receiver-owned image commitments and owned exec resources. Keep only a weak registration outside its activation future, release the registry mutex before awaited work, and wake subscribers through the existing watch primitive without idle polling. Setup, locked keys, missing administrator copies, locked signer and disabled feature have exact bounded private protocol replies, distinct from permanent image refusal. No key bytes or arbitrary diagnostics enter this interface. Controlled registration tests qualify lifetime/refusal; production provider and event-driven updater waiting remain separate, so no successful update is claimed.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 36 filtered out; finished in 0.00s
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 34 filtered out; finished in 0.00s

typed-private-recovery-admission-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 654740c43bee3107dca9c49895f0a41ef04f9ca7: Keep recovery readiness typed across owned handoff admission (D147, D186, D198). Declare the enabled provider boundary with exact receiver-owned image commitments and owned exec resources. Keep only a weak registration outside its activation future, release the registry mutex before awaited work, and wake subscribers through the existing watch primitive without idle polling. Setup, locked keys, missing administrator copies, locked signer and disabled feature have exact bounded private protocol replies, distinct from permanent image refusal. No key bytes or arbitrary diagnostics enter this interface. Controlled registration tests qualify lifetime/refusal; production provider and event-driven updater waiting remain separate, so no successful update is claimed. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 36 filtered out; finished in 0.00s test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 34 filtered out; finished in 0.00s ``` [typed-private-recovery-admission-gate.log](https://git.kayg.org/attachments/a63517a0-c8d5-4cd3-bdef-d06105d37743) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:52:42 +00:00
Author
Owner
Copy link

Committed and pushed 202f7a1b5e: Use one bounded local handoff reply contract (D147, D251).

Route receiver refusal/postponement through the shared exact-state encoder and decode responses through the same contract in the server host. Preserve existing successful and postponed bytes and generic refusal text; unsupported replies fail closed. This prepares typed backup readiness transport without parsing diagnostic prose or exposing private errors. Duplicated sender/receiver state tables would diverge as readiness grows. The provider and updater waiting loop remain unwired.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 51 filtered out; finished in 9.25s
test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 544 filtered out; finished in 0.40s

shared-handoff-replies-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 202f7a1b5e0211f47f178fbe43d62d71dcdf9832: Use one bounded local handoff reply contract (D147, D251). Route receiver refusal/postponement through the shared exact-state encoder and decode responses through the same contract in the server host. Preserve existing successful and postponed bytes and generic refusal text; unsupported replies fail closed. This prepares typed backup readiness transport without parsing diagnostic prose or exposing private errors. Duplicated sender/receiver state tables would diverge as readiness grows. The provider and updater waiting loop remain unwired. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 51 filtered out; finished in 9.25s test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 544 filtered out; finished in 0.40s ``` [shared-handoff-replies-gate.log](https://git.kayg.org/attachments/cbcaff6d-c655-452e-841a-b87aaed78fc0) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:56:58 +00:00
Author
Owner
Copy link

Committed and pushed 8e010d983e: Fuzz exact local update acknowledgements alongside bounded requests (D12, D147).

Extend the existing private update parser target to exercise every arbitrary response byte sequence through the exact acknowledgement decoder. Only the canonical successful response can admit handoff; encoded refusals and readiness states must remain errors. Enable the optional interface only for this fuzz dependency so its locked/setup/copy/signer/disabled cases are reachable. Reuse the current fuzz engine and request corpus rather than adding another parser or harness. This is a compile/lint gate; an instrumented seeded campaign remains required.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

fuzz-private-handoff-replies-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 8e010d983eb64f9b7e3f094bcd7bccfdbb981d8c: Fuzz exact local update acknowledgements alongside bounded requests (D12, D147). Extend the existing private update parser target to exercise every arbitrary response byte sequence through the exact acknowledgement decoder. Only the canonical successful response can admit handoff; encoded refusals and readiness states must remain errors. Enable the optional interface only for this fuzz dependency so its locked/setup/copy/signer/disabled cases are reachable. Reuse the current fuzz engine and request corpus rather than adding another parser or harness. This is a compile/lint gate; an instrumented seeded campaign remains required. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text ``` [fuzz-private-handoff-replies-gate.log](https://git.kayg.org/attachments/7620f1af-f209-42dd-b57c-6d7d229d8812) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:57:18 +00:00
Author
Owner
Copy link

Committed and pushed a5de084090: Persist public update readiness without changing core migrations (D147, D198, D251).

Add one bounded singleton table for a verified version and one closed readiness code. Keep owner/session proof, image paths, signing material and decrypted data out of public waiting state. Creation remains additive and idempotent alongside existing release-owned tables, so prior verified images still open the core journal unchanged. Reusing permanent image rejection would discard retry intent; altering the core migration journal for optional runtime state would break rollback independence.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s

public-recovery-waiting-state-schema-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed a5de084090c1dea7293271b5fcd3cad45d592821: Persist public update readiness without changing core migrations (D147, D198, D251). Add one bounded singleton table for a verified version and one closed readiness code. Keep owner/session proof, image paths, signing material and decrypted data out of public waiting state. Creation remains additive and idempotent alongside existing release-owned tables, so prior verified images still open the core journal unchanged. Reusing permanent image rejection would discard retry intent; altering the core migration journal for optional runtime state would break rollback independence. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 32 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s ``` [public-recovery-waiting-state-schema-gate.log](https://git.kayg.org/attachments/31ff300b-a06e-47aa-bebd-8e1e91206fb9) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:57:34 +00:00
Author
Owner
Copy link

Committed and pushed d5f5f30976: Make typed recovery waiting a removable release capability (D198).

Gate the readiness consumer independently of ordinary release metadata and host lockstep. Reuse the existing scoped admission and private recovery interface; this dependency step starts no worker, unlocks no key and supplies no recovery provider. Making all release-only builds retain backup coordination would defeat compile-out.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 35 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s

optional-recovery-waiting-consumer-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed d5f5f30976c1dc890f8a4f279760cd0db96d3abf: Make typed recovery waiting a removable release capability (D198). Gate the readiness consumer independently of ordinary release metadata and host lockstep. Reuse the existing scoped admission and private recovery interface; this dependency step starts no worker, unlocks no key and supplies no recovery provider. Making all release-only builds retain backup coordination would defeat compile-out. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 35 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s ``` [optional-recovery-waiting-consumer-gate.log](https://git.kayg.org/attachments/aa7e7b4a-7aa6-45b2-ad90-cb364a9065d1) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:59:05 +00:00
Author
Owner
Copy link

Committed and pushed 950e0d70a7: Wait for recovery readiness without discarding verified update intent (D147, D186, D251).

Keep typed handoff errors inside the running worker while preserving the public string-error adapter. A locked/setup/missing-copy/disabled/signer wait retains the same verified image and exact owner/session proof, records only public version-bound readiness, suppresses a misleading next-window timestamp and sleeps on existing readiness/operator/state events. Consume own notifications so a waiting attempt cannot immediately retry itself. Permanent refusal still pauses an image; foreground postponement retains its existing activity wait. The running-worker regression first fails because waiting is lost, then proves one attempt while locked, preserved proof, no repeated attempts and one retry after unlock. The provider remains uninstalled, so this does not enable an update without a real checkpoint.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 35 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.20s

event-driven-recovery-waiting-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 950e0d70a72f20bcd7fd6de703f14fc6301dc647: Wait for recovery readiness without discarding verified update intent (D147, D186, D251). Keep typed handoff errors inside the running worker while preserving the public string-error adapter. A locked/setup/missing-copy/disabled/signer wait retains the same verified image and exact owner/session proof, records only public version-bound readiness, suppresses a misleading next-window timestamp and sleeps on existing readiness/operator/state events. Consume own notifications so a waiting attempt cannot immediately retry itself. Permanent refusal still pauses an image; foreground postponement retains its existing activity wait. The running-worker regression first fails because waiting is lost, then proves one attempt while locked, preserved proof, no repeated attempts and one retry after unlock. The provider remains uninstalled, so this does not enable an update without a real checkpoint. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 35 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.20s ``` [event-driven-recovery-waiting-gate.log](https://git.kayg.org/attachments/35718f2b-f061-43f1-bc14-b7cb9ef4b56c) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:59:06 +00:00
Author
Owner
Copy link

Required failing-before-fix typed readiness worker receipt.
event-driven-recovery-waiting-red.log

Required failing-before-fix typed readiness worker receipt. [event-driven-recovery-waiting-red.log](https://git.kayg.org/attachments/b1aef712-0fe2-44b1-ae95-1afb2a149f3c)
kayg commented 2026-10-16 07:59:15 +00:00
Author
Owner
Copy link

Committed and pushed 1306dffcfe: Keep host recovery preparation behind the removable resource boundary (D147, D198).

Extend the existing generic confirmed-host resource adapter with readiness, joined preparation and exact-process completion callbacks under the optional recovery interface. Missing implementations refuse; neither a key lease nor a public image commitment can substitute for an actual checkpoint. Metadata/private-resource builds retain no recovery implementation. Reusing this host bridge avoids another host registry, lifecycle task or backup-specific branch in the core.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 37 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

private-host-recovery-boundary-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 1306dffcfe122388d0de69fa99ddfc9b79d6d97b: Keep host recovery preparation behind the removable resource boundary (D147, D198). Extend the existing generic confirmed-host resource adapter with readiness, joined preparation and exact-process completion callbacks under the optional recovery interface. Missing implementations refuse; neither a key lease nor a public image commitment can substitute for an actual checkpoint. Metadata/private-resource builds retain no recovery implementation. Reusing this host bridge avoids another host registry, lifecycle task or backup-specific branch in the core. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 37 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [private-host-recovery-boundary-gate.log](https://git.kayg.org/attachments/ddfe78ac-1b76-49f8-bb32-9680986c7eb6) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:59:35 +00:00
Author
Owner
Copy link

Committed and pushed 298c56eb70: Own bounded recovery preparation within backup activation (D147, D168, D198).

Register recovery only inside the enabled owned backup future, using its existing cold key ring and original epoch. Bound work to one executing and one queued request, refuse further sends, observe receiver cancellation and join private resource cleanup before the feature reservation drops. Inspect actual key/copy readiness, pass one protected lease to the existing host adapter, then reserve the same activation only after preparation. Retain inert host coordinates without a runtime cycle; successful key changes and authority notifications wake existing readiness subscribers. One real-SQLite/cipher/ceremony scenario proves cancelled preparation drops before another request, successful resource lifetime retains the epoch and disable during preparation cannot gain a final reservation. Host callbacks remain default-refusing until the actual guardian provider is installed; this commit does not enable updates.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 33 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s

backup-owned-recovery-service-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 298c56eb70622a71adc2543da6f12f38ac511c22: Own bounded recovery preparation within backup activation (D147, D168, D198). Register recovery only inside the enabled owned backup future, using its existing cold key ring and original epoch. Bound work to one executing and one queued request, refuse further sends, observe receiver cancellation and join private resource cleanup before the feature reservation drops. Inspect actual key/copy readiness, pass one protected lease to the existing host adapter, then reserve the same activation only after preparation. Retain inert host coordinates without a runtime cycle; successful key changes and authority notifications wake existing readiness subscribers. One real-SQLite/cipher/ceremony scenario proves cancelled preparation drops before another request, successful resource lifetime retains the epoch and disable during preparation cannot gain a final reservation. Host callbacks remain default-refusing until the actual guardian provider is installed; this commit does not enable updates. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 33 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s ``` [backup-owned-recovery-service-gate.log](https://git.kayg.org/attachments/43db2339-c2b3-49cd-9e15-7d9f4e3e07e8) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 07:59:44 +00:00
Author
Owner
Copy link

Committed and pushed e3cccfff2f: Declare inert process claim and existing-server preflight hooks (D198, D201, D217).

Private inherited descriptors must be claimed before child dispatch, and recovery must finish before the serving runtime opens a database. Add an optional callback contract for compiled role factories with these two ordered phases. Declarations execute no callback; paths supply existing-host coordinates only and static errors cannot leak private channel data. This extends the existing plugin composition instead of adding a backup command route to core or allowing an update to initialize a server. The additive contract was recorded on #211 before implementation.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

generic-process-lifecycle-contract-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed e3cccfff2fedac026b3e41aa07a786f01f95494c: Declare inert process claim and existing-server preflight hooks (D198, D201, D217). Private inherited descriptors must be claimed before child dispatch, and recovery must finish before the serving runtime opens a database. Add an optional callback contract for compiled role factories with these two ordered phases. Declarations execute no callback; paths supply existing-host coordinates only and static errors cannot leak private channel data. This extends the existing plugin composition instead of adding a backup command route to core or allowing an update to initialize a server. The additive contract was recorded on #211 before implementation. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 23 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [generic-process-lifecycle-contract-gate.log](https://git.kayg.org/attachments/24434a6a-aec8-44a3-9f92-b2ca141e7486) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:01:00 +00:00
Author
Owner
Copy link

Committed and pushed ce684e180b: Dispatch optional factory hooks before children and server database startup (D198, D201).

Run optional compiled factory callbacks after process hardening and before child/action dispatch, then before the existing server creates its serving runtime. Registry construction stays pure and generic action dispatch remains unchanged. Unconfigured server invocation still returns the existing setup instructions without running a server preflight. No factory installs a recovery callback yet; the next integration owns the private channel and restore consumer. Reusing the factory composition avoids a backup-specific branch in command dispatch or a new startup worker.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 83 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 8.59s
test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

factory-process-lifecycle-dispatch-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed ce684e180b8ead5fe78d69f7b38ffd4d597156fb: Dispatch optional factory hooks before children and server database startup (D198, D201). Run optional compiled factory callbacks after process hardening and before child/action dispatch, then before the existing server creates its serving runtime. Registry construction stays pure and generic action dispatch remains unchanged. Unconfigured server invocation still returns the existing setup instructions without running a server preflight. No factory installs a recovery callback yet; the next integration owns the private channel and restore consumer. Reusing the factory composition avoids a backup-specific branch in command dispatch or a new startup worker. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 83 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 8.59s test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [factory-process-lifecycle-dispatch-gate.log](https://git.kayg.org/attachments/dfbbb90d-864d-4d36-a197-368510bfdecd) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:01:16 +00:00
Author
Owner
Copy link

Committed and pushed c9ba05ec46: Reconcile release intent after full database restoration (D147, D155, D251).

A downgrade restores old release rows along with application data. Capture only public transition metadata in the authenticated preimage, rebuild its rollback intent after restoring the target snapshot, and mark an actually failed attempt entered before releasing fatal recovery. Existing startup still re-verifies every retained executable; session proof is not copied or renewed. Without this boundary an older applying row loses the just-left image, or a restored fresh point admits the failed image again as a first entry. Real SQLite tests cover predecessor retention, normal startup selection, failed downgrade selection and unchanged restored authorization state. Runtime recovery will consume this API in its host adapter; no production recovery is claimed by this module alone.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 36 filtered out; finished in 0.01s

release-recovery-transition-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed c9ba05ec46e9ab29dc746285276228f89b8d7eec: Reconcile release intent after full database restoration (D147, D155, D251). A downgrade restores old release rows along with application data. Capture only public transition metadata in the authenticated preimage, rebuild its rollback intent after restoring the target snapshot, and mark an actually failed attempt entered before releasing fatal recovery. Existing startup still re-verifies every retained executable; session proof is not copied or renewed. Without this boundary an older applying row loses the just-left image, or a restored fresh point admits the failed image again as a first entry. Real SQLite tests cover predecessor retention, normal startup selection, failed downgrade selection and unchanged restored authorization state. Runtime recovery will consume this API in its host adapter; no production recovery is claimed by this module alone. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 36 filtered out; finished in 0.01s ``` [release-recovery-transition-gate.log](https://git.kayg.org/attachments/3150eb5b-15ee-4fb5-bb3b-217f61eb934a) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:02:40 +00:00
Author
Owner
Copy link

Required behavioral RED for input during the real SQLite writer reservation with session renewal due. This extends the same-socket byte/ACK test with a WAL database and separate read connections; no lease is widened. Failure occurs before the preparation interruption signal, as predicted by the source finding. The repair remains pending.

checkpoint-writer-input-red.log

Required behavioral RED for input during the real SQLite writer reservation with session renewal due. This extends the same-socket byte/ACK test with a WAL database and separate read connections; no lease is widened. Failure occurs before the preparation interruption signal, as predicted by the source finding. The repair remains pending. [checkpoint-writer-input-red.log](https://git.kayg.org/attachments/618f2d31-e01d-471d-953d-e1f029e2acd6)
kayg commented 2026-10-16 08:02:45 +00:00
Author
Owner
Copy link

Recovery continuation checkpoint at c9ba05ec46. Selected gate/commit workflow remains active; this archive preserves unwired channel/guardian/worker sources, planned destination admission/release reconciliation and the pending real-writer input regression/repair. Source hashes and head are inside. These drafts are not VM acceptance, a working production provider or completion. Remaining integration and final qualifications are listed explicitly so work does not depend on this chat.

recovery-integration-next-20261016.txt
recovery-drafts-c9ba05ec4.zip

Recovery continuation checkpoint at c9ba05ec46e9ab29dc746285276228f89b8d7eec. Selected gate/commit workflow remains active; this archive preserves unwired channel/guardian/worker sources, planned destination admission/release reconciliation and the pending real-writer input regression/repair. Source hashes and head are inside. These drafts are not VM acceptance, a working production provider or completion. Remaining integration and final qualifications are listed explicitly so work does not depend on this chat. [recovery-integration-next-20261016.txt](https://git.kayg.org/attachments/318c98ec-532b-4e9c-a600-031bf81eb0e9) [recovery-drafts-c9ba05ec4.zip](https://git.kayg.org/attachments/91476b0a-67c8-4ce4-a440-1320009b0307)
kayg commented 2026-10-16 08:06:37 +00:00
Author
Owner
Copy link

Committed and pushed aabd5b83be: Interrupt checkpoint preparation before a foreground session renewal waits for its writer (D128, D251).

The updater already owns BEGIN IMMEDIATE before freezing foreground work. After a quiet window, sliding renewal is due and the socket used to wait for that writer before typed input could cancel preparation. Keep the initial live-authority read, signal new contiguous foreground work before renewal, and defer a blocked renewal into the existing expiry/revocation watchdog until joined preparation releases its fence. Resample live authority and clock afterward; normal input retains one authority read and one activity record. Attach/open intent uses the same ordering, while proof traffic remains non-renewing. Shared input-range validation prevents acknowledged duplicates from becoming new activity. The real-WAL same-socket regression fails before repair with renewal due and a separate held writer, then requires exact bytes/ACKs after interruption without a new connection. Native latency still requires final VM qualification.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 0.66s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 1.17s
test result: ok. 42 passed; 0 failed; 2 ignored; 0 measured; 508 filtered out; finished in 90.16s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 1.06s

checkpoint-writer-input-continuity-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed aabd5b83beec9886b3dbd258e4f09df881ef1dd6: Interrupt checkpoint preparation before a foreground session renewal waits for its writer (D128, D251). The updater already owns BEGIN IMMEDIATE before freezing foreground work. After a quiet window, sliding renewal is due and the socket used to wait for that writer before typed input could cancel preparation. Keep the initial live-authority read, signal new contiguous foreground work before renewal, and defer a blocked renewal into the existing expiry/revocation watchdog until joined preparation releases its fence. Resample live authority and clock afterward; normal input retains one authority read and one activity record. Attach/open intent uses the same ordering, while proof traffic remains non-renewing. Shared input-range validation prevents acknowledged duplicates from becoming new activity. The real-WAL same-socket regression fails before repair with renewal due and a separate held writer, then requires exact bytes/ACKs after interruption without a new connection. Native latency still requires final VM qualification. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 0.66s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 1.17s test result: ok. 42 passed; 0 failed; 2 ignored; 0 measured; 508 filtered out; finished in 90.16s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 551 filtered out; finished in 1.06s ``` [checkpoint-writer-input-continuity-gate.log](https://git.kayg.org/attachments/7f81ce1b-c613-470d-84c3-1349981eebbc) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:18:33 +00:00
Author
Owner
Copy link

Committed and pushed e64f846a45: Specify bounded recovery metadata and protected anonymous frames (D147, D168, D217).

Separate bounded public bootstrap/restore coordinates from protected key frames on an anonymous channel, with canonical fixed commands, absolute health deadlines and exact key-identity checks. A rollback selection must reverse the fresh image transition and share its key identity; no encrypted inventory chooses destinations. Same-PID descriptor claim checks creator UID/PID/type and closes the original only after CLOEXEC duplication. Tests cover bounds, unknown fields, substituted keys, target aliases, expired deadlines, ordinary/malformed invocation and descriptor inheritance defaults. Keep this module test-only until the actual startup/worker consumer is installed; the ELF recovery capability is not advertised.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 559 filtered out; finished in 0.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 559 filtered out; finished in 0.00s
test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 552 filtered out; finished in 0.01s

private-recovery-channel-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed e64f846a451e3ad56a91f0e733489e462c50291a: Specify bounded recovery metadata and protected anonymous frames (D147, D168, D217). Separate bounded public bootstrap/restore coordinates from protected key frames on an anonymous channel, with canonical fixed commands, absolute health deadlines and exact key-identity checks. A rollback selection must reverse the fresh image transition and share its key identity; no encrypted inventory chooses destinations. Same-PID descriptor claim checks creator UID/PID/type and closes the original only after CLOEXEC duplication. Tests cover bounds, unknown fields, substituted keys, target aliases, expired deadlines, ordinary/malformed invocation and descriptor inheritance defaults. Keep this module test-only until the actual startup/worker consumer is installed; the ELF recovery capability is not advertised. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 559 filtered out; finished in 0.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 559 filtered out; finished in 0.00s test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 552 filtered out; finished in 0.01s ``` [private-recovery-channel-tests-gate.log](https://git.kayg.org/attachments/99931769-740e-4579-a1cb-4e060c5f288f) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:19:13 +00:00
Author
Owner
Copy link

Committed and pushed c2b1cdc999: Fence owned recovery work to the pinned parent lifetime (D147, D168, D217).

Authenticate the anonymous stdin peer as the actual same-UID parent, pin its birth/pidfd, validate its point and hold the cold-start barrier before acknowledging preparation. A malformed frame or EOF never authorizes restore: armed recovery waits for actual parent exit, using pidfd termination only at the absolute startup deadline. Release the protected key once to the exact resumed image and acknowledge completion only after durable barrier removal. Initialize the shipping CA heap before frame import and reject ordinary stdin before any callbacks. Keep the worker test-only until its CLI/startup consumer exists; positive owned-child lifecycle tests follow in the guardian slice.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 560 filtered out; finished in 0.00s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 560 filtered out; finished in 0.01s

owned-recovery-worker-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed c2b1cdc9995ceda7774850bb94b2c2aa147dda80: Fence owned recovery work to the pinned parent lifetime (D147, D168, D217). Authenticate the anonymous stdin peer as the actual same-UID parent, pin its birth/pidfd, validate its point and hold the cold-start barrier before acknowledging preparation. A malformed frame or EOF never authorizes restore: armed recovery waits for actual parent exit, using pidfd termination only at the absolute startup deadline. Release the protected key once to the exact resumed image and acknowledge completion only after durable barrier removal. Initialize the shipping CA heap before frame import and reject ordinary stdin before any callbacks. Keep the worker test-only until its CLI/startup consumer exists; positive owned-child lifecycle tests follow in the guardian slice. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 560 filtered out; finished in 0.00s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 560 filtered out; finished in 0.01s ``` [owned-recovery-worker-tests-gate.log](https://git.kayg.org/attachments/e2cba1c8-6fb3-4867-b3f9-a1f480ab964c) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:19:51 +00:00
Author
Owner
Copy link

Additive compile-time composition before installing recovery: introduce a server recovery integration feature requiring the existing backup/server and release/recovery-updates implementations, selected by an explicit update-recovery feature in the normal shipping CLI defaults. Minimal backup-only or release-only builds keep their independent contracts/default refusals and advertise no recovery ELF note. The Linux compiled backup factory binds its existing CliWorker action plus generic process lifecycle hook; core dispatch has no backup string route. Runtime backup disable still owns/cancels/joins the broker and any readiness watcher; no worker exists when off. This adds no dependency package, crypto/database/transport engine or signing authority. Actual provider/startup wiring, size and VM proof remain required.

Additive compile-time composition before installing recovery: introduce a server recovery integration feature requiring the existing backup/server and release/recovery-updates implementations, selected by an explicit update-recovery feature in the normal shipping CLI defaults. Minimal backup-only or release-only builds keep their independent contracts/default refusals and advertise no recovery ELF note. The Linux compiled backup factory binds its existing CliWorker action plus generic process lifecycle hook; core dispatch has no backup string route. Runtime backup disable still owns/cancels/joins the broker and any readiness watcher; no worker exists when off. This adds no dependency package, crypto/database/transport engine or signing authority. Actual provider/startup wiring, size and VM proof remain required.
kayg commented 2026-10-16 08:20:14 +00:00
Author
Owner
Copy link

Committed and pushed fa64b8687a: Join the recovery guardian through preparation, refusal and check-in (D147, D168, D217).

Own the actual worker child before the first fallible bootstrap operation. Unarmed cancellation joins and reaps it; arming is allowed only immediately before verified exec and uncertain armed destruction fails closed. Kernel fallback and final abandonment use the exact protocol fence rather than a PID/EOF guess. Confine armed tests to owned fixture processes, exercise the protected resume/bootstrap/key/PID reply and healthy check-in, and prove missing worker dispatch refuses without a marker. These real process/channel tests complement encrypted point tests; they do not install the production checkpoint provider or claim VM acceptance.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.50s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.51s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 561 filtered out; finished in 10.23s

owned-recovery-guardian-tests-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed fa64b8687af86bf13b237fe5a3d8daea0420a7d7: Join the recovery guardian through preparation, refusal and check-in (D147, D168, D217). Own the actual worker child before the first fallible bootstrap operation. Unarmed cancellation joins and reaps it; arming is allowed only immediately before verified exec and uncertain armed destruction fails closed. Kernel fallback and final abandonment use the exact protocol fence rather than a PID/EOF guess. Confine armed tests to owned fixture processes, exercise the protected resume/bootstrap/key/PID reply and healthy check-in, and prove missing worker dispatch refuses without a marker. These real process/channel tests complement encrypted point tests; they do not install the production checkpoint provider or claim VM acceptance. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.50s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.51s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 561 filtered out; finished in 10.23s ``` [owned-recovery-guardian-tests-gate.log](https://git.kayg.org/attachments/d7de4ffb-4b57-41b8-83e5-d3cace5470d3) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:23:09 +00:00
Author
Owner
Copy link

Recovery collection ordering finding (source, not runtime qualification): updater.rs reconcile() currently invokes image collect before a new guardian health check-in. If B fails before CheckIn and the guardian restores A's database, A's earlier previous image Z may already have been deleted by B's reconciliation. Evidence: crates/plugins/release/src/updater.rs reconcile/collect and the new recovery startup ordering.

Defer the host engine's image collection while a resumed guardian is incomplete. After all startup health checks and the positive CheckIn ACK, mark that process complete and invoke collection through an additive default checked_in callback on the existing local_update::HandoffAdmission registration (Scoped forwards under its original epoch; Updater reuses its existing collect implementation). No new registry or duplicate SQL/path-selection table. The backup host completion future awaits this role-owned callback before serving. Keep current/previous point references protected independently under D147 local retention; only then collect admission metadata. No signing key, executable or restoration authority comes from this callback. Actual wiring/test/VM proof remains pending.

Recovery collection ordering finding (source, not runtime qualification): updater.rs reconcile() currently invokes image collect before a new guardian health check-in. If B fails before CheckIn and the guardian restores A's database, A's earlier previous image Z may already have been deleted by B's reconciliation. Evidence: crates/plugins/release/src/updater.rs reconcile/collect and the new recovery startup ordering. Defer the host engine's image collection while a resumed guardian is incomplete. After all startup health checks and the positive CheckIn ACK, mark that process complete and invoke collection through an additive default checked_in callback on the existing local_update::HandoffAdmission registration (Scoped forwards under its original epoch; Updater reuses its existing collect implementation). No new registry or duplicate SQL/path-selection table. The backup host completion future awaits this role-owned callback before serving. Keep current/previous point references protected independently under D147 local retention; only then collect admission metadata. No signing key, executable or restoration authority comes from this callback. Actual wiring/test/VM proof remains pending.
kayg commented 2026-10-16 08:34:26 +00:00
Author
Owner
Copy link

Pre-arm validation finding from source: recovery_point::validate_resources authenticates the full closed set and CA/issuer match, but treats configured HTTPS/remote certificate and private-key resources as opaque configuration. External file replacement is not serialized by the SQLite writer, so an authenticated capture can still contain a mismatched file pair. Restoring such a point would prevent listener startup. Evidence: private_resources_host.rs sequential capture and recovery_point.rs validate_resources.

Before the actual provider can arm, validate each captured configured certificate/key pair with the existing crypto provider (including the single combined-identity target already deduplicated by Resources::file). Add an actual mismatched-pair test that authenticates successfully but refuses before any retained write. This uses existing provider/parsers, adds no library and never writes private key material outside the configured original files. It does not claim filesystem writers are coordinated by the database lock or invent restoration destinations from captured JSON. Actual runtime wiring and VM proof remain pending.

Pre-arm validation finding from source: recovery_point::validate_resources authenticates the full closed set and CA/issuer match, but treats configured HTTPS/remote certificate and private-key resources as opaque configuration. External file replacement is not serialized by the SQLite writer, so an authenticated capture can still contain a mismatched file pair. Restoring such a point would prevent listener startup. Evidence: private_resources_host.rs sequential capture and recovery_point.rs validate_resources. Before the actual provider can arm, validate each captured configured certificate/key pair with the existing crypto provider (including the single combined-identity target already deduplicated by Resources::file). Add an actual mismatched-pair test that authenticates successfully but refuses before any retained write. This uses existing provider/parsers, adds no library and never writes private key material outside the configured original files. It does not claim filesystem writers are coordinated by the database lock or invent restoration destinations from captured JSON. Actual runtime wiring and VM proof remain pending.
kayg commented 2026-10-16 08:48:16 +00:00
Author
Owner
Copy link

Committed and pushed 0b6e159373: Declare one-shot warm custody and post-check-in lifecycle boundaries (D147, D168, D198).

Add inert optional host key-transfer/readiness subscriptions, a guarded startup-ready callback and post-check-in collection through the existing enabled handoff registration. A cold/default host transfers no key and construction starts no callback. The resumed host must match retained identity and complete actual health before allowing the existing role to collect superseded state; a fresh registry or early image deletion would lose rollback ownership. These additive contracts were recorded on #211 before implementation. Minimal API builds retain no recovery callbacks, and no runtime provider is installed by this declaration slice.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 37 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

recovery-startup-contracts-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 0b6e159373ab91ff976364f0c28fd1197156a923: Declare one-shot warm custody and post-check-in lifecycle boundaries (D147, D168, D198). Add inert optional host key-transfer/readiness subscriptions, a guarded startup-ready callback and post-check-in collection through the existing enabled handoff registration. A cold/default host transfers no key and construction starts no callback. The resumed host must match retained identity and complete actual health before allowing the existing role to collect superseded state; a fresh registry or early image deletion would lose rollback ownership. These additive contracts were recorded on #211 before implementation. Minimal API builds retain no recovery callbacks, and no runtime provider is installed by this declaration slice. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 37 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s ``` [recovery-startup-contracts-gate.log](https://git.kayg.org/attachments/0516c7d6-822e-4a1a-8173-40c7a56bfdb8) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:48:35 +00:00
Author
Owner
Copy link

Committed and pushed f62350133a: Import warm backup custody only into its original enabled activation (D168, D186, D198).

An authenticated same-process resume must keep backups unlocked without creating a cold-start key file. Ask the host once for protected inherited input, independently match its retained key identity, then install under the original activation commit after I/O/hash work finishes. Default/cold hosts supply nothing. Reuse KeyMaterial itself as the private input owner and remove the duplicate broker wrapper; no plaintext aggregate or new crypto path is introduced. The real ceremony/SQLite test proves preparation alone does not unlock, rejects short/substituted input and rejects a retired epoch, alongside the existing joined broker/custody tests. The actual host channel consumer remains a separate integration step.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 34 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s

memory-only-warm-backup-custody-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f62350133a8c5b716f00c39b20543bc892726ac9: Import warm backup custody only into its original enabled activation (D168, D186, D198). An authenticated same-process resume must keep backups unlocked without creating a cold-start key file. Ask the host once for protected inherited input, independently match its retained key identity, then install under the original activation commit after I/O/hash work finishes. Default/cold hosts supply nothing. Reuse KeyMaterial itself as the private input owner and remove the duplicate broker wrapper; no plaintext aggregate or new crypto path is introduced. The real ceremony/SQLite test proves preparation alone does not unlock, rejects short/substituted input and rejects a retired epoch, alongside the existing joined broker/custody tests. The actual host channel consumer remains a separate integration step. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 34 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s ``` [memory-only-warm-backup-custody-gate.log](https://git.kayg.org/attachments/2f20883b-5c50-4fd3-b084-8a612af771d7) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:51:36 +00:00
Author
Owner
Copy link

Committed and pushed c9c5780ff5: Keep update recovery an optional composition of existing server plugins (D147, D198).

Declare the host integration feature from existing backup and release capabilities, including their optional private recovery interfaces. Backup-only and release-only builds remain independent; no package or foundational engine is added. The actual host consumer and normal shipping CLI opt-in follow separately, and no recovery ELF capability is advertised at this boundary. Strict combined-feature lint/process tests and both minimal compile-out checks qualify the dependency composition.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered outtest recovery_guardian::tests::armed_cancellation_is_confined_to_an_owned_fixture_process ... ; finished in 0.22sok
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.22s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 561 filtered out; finished in 10.34s

optional-recovery-runtime-composition-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed c9c5780ff5b251b65b10abd67bb546914acf154c: Keep update recovery an optional composition of existing server plugins (D147, D198). Declare the host integration feature from existing backup and release capabilities, including their optional private recovery interfaces. Backup-only and release-only builds remain independent; no package or foundational engine is added. The actual host consumer and normal shipping CLI opt-in follow separately, and no recovery ELF capability is advertised at this boundary. Strict combined-feature lint/process tests and both minimal compile-out checks qualify the dependency composition. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered outtest recovery_guardian::tests::armed_cancellation_is_confined_to_an_owned_fixture_process ... ; finished in 0.22sok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 0.22s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 561 filtered out; finished in 10.34s ``` [optional-recovery-runtime-composition-gate.log](https://git.kayg.org/attachments/dac71f06-e0bb-4721-85bd-75a29ce2f711) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:56:31 +00:00
Author
Owner
Copy link

Committed and pushed ba2977dd91: Report actual release startup health before resumed check-in (D147, D198, D251).

Publish initial listener-admitted reconciliation through the existing owned release activation and fail the promise when initialization exits or is cancelled. Reset before a new role future can observe a prior success; do not spawn a health task. Forward post-check-in collection through the original scoped admission and reuse Updater collection. Real running-worker tests require health to remain pending before listener admission and report an actual closed-database initialization failure rather than success or a hanging watch. The host startup consumer and deferred image-collection guard are installed separately, so no production update completion is claimed here.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 39 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s

release-startup-health-and-checkin-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed ba2977dd915da56081a7fa99f8bef96c4d38c7e7: Report actual release startup health before resumed check-in (D147, D198, D251). Publish initial listener-admitted reconciliation through the existing owned release activation and fail the promise when initialization exits or is cancelled. Reset before a new role future can observe a prior success; do not spawn a health task. Forward post-check-in collection through the original scoped admission and reuse Updater collection. Real running-worker tests require health to remain pending before listener admission and report an actual closed-database initialization failure rather than success or a hanging watch. The host startup consumer and deferred image-collection guard are installed separately, so no production update completion is claimed here. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 39 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 2.21s ``` [release-startup-health-and-checkin-gate.log](https://git.kayg.org/attachments/5bee9427-317c-4965-8625-14fb85cad7b1) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 08:57:54 +00:00
Author
Owner
Copy link

Committed and pushed 3106eaa953: Retain canonical certificate and key associations in encrypted configuration (D147, D155).

A consistent database reservation does not serialize external certificate file replacement. Retain each configured role pair as opaque canonical labels after existing path deduplication, including combined identities and roles sharing the same files. These labels select no new filesystem destination; original host targets still own every restore path. Reuse one path normalizer and do not duplicate captured private files. The existing inert-construction/capture tests now check the associations, and an added shared-role case keeps one pair for two uses. Pair cryptographic preflight is the next slice.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 562 filtered out; finished in 0.00s

configured-identity-role-associations-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 3106eaa9530a212487149c2dc74237020b2b4525: Retain canonical certificate and key associations in encrypted configuration (D147, D155). A consistent database reservation does not serialize external certificate file replacement. Retain each configured role pair as opaque canonical labels after existing path deduplication, including combined identities and roles sharing the same files. These labels select no new filesystem destination; original host targets still own every restore path. Reuse one path normalizer and do not duplicate captured private files. The existing inert-construction/capture tests now check the associations, and an added shared-role case keeps one pair for two uses. Pair cryptographic preflight is the next slice. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 562 filtered out; finished in 0.00s ``` [configured-identity-role-associations-gate.log](https://git.kayg.org/attachments/be8fd0a4-24b9-495c-8d75-83e0a2ae7420) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 09:11:12 +00:00
Author
Owner
Copy link

Committed and pushed 034e31cfe1: Refuse an authenticated but unusable configured TLS identity before restoration (D147, D155).

Authentication alone cannot show that separately captured certificate and key files match. Validate bounded role associations against independently admitted target labels, then use the existing crypto provider to check each captured public/private pair before changing any database or file. A combined file works through the same canonical pair; no configuration JSON can add a restore path. The real encrypted-point/SQLite regression first admits a mismatched identity and fails, then refuses it without changing retained state, while separate and combined valid identities remain accepted. This boundary is still test-only until the host consumer is installed.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 1.02s
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 237 filtered out; finished in 0.37s

configured-identity-preflight-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 034e31cfe156c8f5ad146df103d528b7c964c14e: Refuse an authenticated but unusable configured TLS identity before restoration (D147, D155). Authentication alone cannot show that separately captured certificate and key files match. Validate bounded role associations against independently admitted target labels, then use the existing crypto provider to check each captured public/private pair before changing any database or file. A combined file works through the same canonical pair; no configuration JSON can add a restore path. The real encrypted-point/SQLite regression first admits a mismatched identity and fails, then refuses it without changing retained state, while separate and combined valid identities remain accepted. This boundary is still test-only until the host consumer is installed. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 564 filtered out; finished in 1.02s test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 237 filtered out; finished in 0.37s ``` [configured-identity-preflight-gate.log](https://git.kayg.org/attachments/5075ed69-414b-4a97-99f3-c476525d0023) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 09:11:13 +00:00
Author
Owner
Copy link

Required configured-identity failing-before-fix receipt.
configured-identity-preflight-red.log

Required configured-identity failing-before-fix receipt. [configured-identity-preflight-red.log](https://git.kayg.org/attachments/3d6ef00e-6902-4e08-af08-5fa3b26fdb80)
kayg commented 2026-10-16 09:12:40 +00:00
Author
Owner
Copy link

Committed and pushed f59d67a8db: Wait for the exact owned startup task before resumed health can commit (D147, D198).

Track one weak server-task identity and completion flag per role, preserving the original activation epoch while awaiting optional health. Unrelated node/socket tasks cannot substitute for startup. Publish exact completion before reusing the existing lifecycle wake; JoinHandle completion alone races a future destructor, and unpolled cancellation must wake too. No field or work is added per terminal task and minimal builds retain no health tracking. Real runtime tests cover pending/successful health, disable/re-enable and a dead startup with another owned task still alive; original private-call lifecycle tests remain green. The actual resumed host consumer remains the next integration step.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 567 filtered out; finished in 0.00s
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 566 filtered out; finished in 0.00s

exact-server-startup-ownership-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f59d67a8dbd56866645108d89b08cf04136868ce: Wait for the exact owned startup task before resumed health can commit (D147, D198). Track one weak server-task identity and completion flag per role, preserving the original activation epoch while awaiting optional health. Unrelated node/socket tasks cannot substitute for startup. Publish exact completion before reusing the existing lifecycle wake; JoinHandle completion alone races a future destructor, and unpolled cancellation must wake too. No field or work is added per terminal task and minimal builds retain no health tracking. Real runtime tests cover pending/successful health, disable/re-enable and a dead startup with another owned task still alive; original private-call lifecycle tests remain green. The actual resumed host consumer remains the next integration step. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 567 filtered out; finished in 0.00s test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 566 filtered out; finished in 0.00s ``` [exact-server-startup-ownership-gate.log](https://git.kayg.org/attachments/c35e2130-cb10-4747-81e6-1494a737203d) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 09:17:36 +00:00
Author
Owner
Copy link

Correction to the unwired continuation notes: the existing D147 local-backup default is seven, not ten. The ten-point wording was my draft-notes error. Source of truth: crates/plugins/backup/src/descriptor.rs DEFAULT_LOCAL_KEEP=7 (read-only setting) and checkpoint::DEFAULT_KEEP reexport. The new admission retention test uses that existing constant, so its twenty-update bound is seven local point admissions plus two image selectors. No retention decision/default was changed.

Correction to the unwired continuation notes: the existing D147 local-backup default is seven, not ten. The ten-point wording was my draft-notes error. Source of truth: crates/plugins/backup/src/descriptor.rs DEFAULT_LOCAL_KEEP=7 (read-only setting) and checkpoint::DEFAULT_KEEP reexport. The new admission retention test uses that existing constant, so its twenty-update bound is seven local point admissions plus two image selectors. No retention decision/default was changed.
kayg commented 2026-10-16 09:52:57 +00:00
Author
Owner
Copy link

Continuation checkpoint at f59d67a8db. Managed build-slot process 3676663 is queued (no admission gate has begun). Prepared runtime integration is attached as UNCOMPILED drafts, not acceptance evidence: ordered scripts finish-recovery-admissions.py -> finish-recovery-transition-coordinates.py -> finish-recovery-host-consumer.py -> finish-recovery-runtime.py. run-managed-continuation.py owns the gate sequence and bounded failure repair. Each logical commit gates before commit/push. Draft host tests cover real fatal SQLite/schema restore, capture while the original writer reservation is held, and twenty cancelled preparations bounding encrypted points and original admissions to D147 default SEVEN. Runtime hook draft claims before children, restores before database startup, installs rollback signer against restored issuer, waits exact startup health, then checks in and collects. No new engine/dependency is chosen.

Nothing from these draft integration steps is committed or qualified yet. Final VM acceptance, final default-production size/caps, native latency qualification, final dev integration and verify fast remain outstanding.

Archive SHA256 6b82edc6c03323d91e3a6cf698a278217e382fcd3cf30811f549a05cc833ab4f

Uncompiled continuation sources and ordered gate scripts

Continuation checkpoint at f59d67a8dbd56866645108d89b08cf04136868ce. Managed build-slot process 3676663 is queued (no admission gate has begun). Prepared runtime integration is attached as UNCOMPILED drafts, not acceptance evidence: ordered scripts finish-recovery-admissions.py -> finish-recovery-transition-coordinates.py -> finish-recovery-host-consumer.py -> finish-recovery-runtime.py. run-managed-continuation.py owns the gate sequence and bounded failure repair. Each logical commit gates before commit/push. Draft host tests cover real fatal SQLite/schema restore, capture while the original writer reservation is held, and twenty cancelled preparations bounding encrypted points and original admissions to D147 default SEVEN. Runtime hook draft claims before children, restores before database startup, installs rollback signer against restored issuer, waits exact startup health, then checks in and collects. No new engine/dependency is chosen. Nothing from these draft integration steps is committed or qualified yet. Final VM acceptance, final default-production size/caps, native latency qualification, final dev integration and verify fast remain outstanding. Archive SHA256 6b82edc6c03323d91e3a6cf698a278217e382fcd3cf30811f549a05cc833ab4f [Uncompiled continuation sources and ordered gate scripts](https://git.kayg.org/attachments/1f10a5bc-2c0a-40d2-b0d9-3cddce787a3f)
kayg commented 2026-10-16 09:57:39 +00:00
Author
Owner
Copy link

Integration finding at f59d67a8d: crates/infraternal-server/src/release_update.rs Engine does not override UpdateEngine::prepare_recovery, so the production engine still takes the deliberately refusing default at crates/plugins/release/src/updater.rs:55 before contacting the handoff receiver. The feature-gated host integration will supply readiness here only. Actual encrypted capture stays in receiver admission under its final writer/foreground fences after independent verification of the opened predecessor/successor; it must not be duplicated before the fence. This is uncompiled wiring work, not an acceptance claim.

Integration finding at f59d67a8d: crates/infraternal-server/src/release_update.rs Engine does not override UpdateEngine::prepare_recovery, so the production engine still takes the deliberately refusing default at crates/plugins/release/src/updater.rs:55 before contacting the handoff receiver. The feature-gated host integration will supply readiness here only. Actual encrypted capture stays in receiver admission under its final writer/foreground fences after independent verification of the opened predecessor/successor; it must not be duplicated before the fence. This is uncompiled wiring work, not an acceptance claim.
kayg commented 2026-10-16 10:04:06 +00:00
Author
Owner
Copy link

Integration constraint: scripts/release/staging-proof signs independently versioned A/B/C/D/E manifests around executable fixtures with the same compiled build identity. The existing Engine::current authenticates the actual /proc/self/exe bytes and signed VERSION; the compiled display/version constant is not its replacement. The unwired host draft now reuses that verified identity for capture and resumed rollback checks, rather than comparing history against a build constant. A functional capture case checks an edge manifest identity distinct from the constant. No trust exception, binary rewriting, compiler-profile change or weaker verifier was introduced. The staged runtime integration is still awaiting its managed build slot.

Integration constraint: scripts/release/staging-proof signs independently versioned A/B/C/D/E manifests around executable fixtures with the same compiled build identity. The existing Engine::current authenticates the actual /proc/self/exe bytes and signed VERSION; the compiled display/version constant is not its replacement. The unwired host draft now reuses that verified identity for capture and resumed rollback checks, rather than comparing history against a build constant. A functional capture case checks an edge manifest identity distinct from the constant. No trust exception, binary rewriting, compiler-profile change or weaker verifier was introduced. The staged runtime integration is still awaiting its managed build slot.
kayg commented 2026-10-16 10:15:37 +00:00
Author
Owner
Copy link

Execution status: managed build-slot PID 3676663 has waited approximately one hour; its only child is the scheduler sleep, so no pending source mutation or gate has begun. Slot allocation metadata ages observed: normal slots 1/2/3/4 approximately 31/72/19/20 minutes. Orchestrator scheduling capacity is the dependency; I have not bypassed the slot limit, changed priorities or touched another job. Runtime, regression and fuzz continuation sources are prepared in the job scratch directory; f59d67a8d remains the committed/pushed head. Prepared work remains UNCOMPILED and no new acceptance or performance result is claimed.

Execution status: managed build-slot PID 3676663 has waited approximately one hour; its only child is the scheduler sleep, so no pending source mutation or gate has begun. Slot allocation metadata ages observed: normal slots 1/2/3/4 approximately 31/72/19/20 minutes. Orchestrator scheduling capacity is the dependency; I have not bypassed the slot limit, changed priorities or touched another job. Runtime, regression and fuzz continuation sources are prepared in the job scratch directory; f59d67a8d remains the committed/pushed head. Prepared work remains UNCOMPILED and no new acceptance or performance result is claimed.
kayg commented 2026-10-16 10:24:42 +00:00
Author
Owner
Copy link

Updated continuation checkpoint at f59d67a8db. Still queued for the managed build slot; no new source mutation or gate has begun. This archive supersedes the earlier uncompiled runtime drafts. UNCOMPILED, not acceptance evidence.

Ordered scripts: finish-recovery-admissions.py -> finish-recovery-transition-coordinates.py -> finish-release-readiness-preflight.py -> finish-recovery-host-consumer.py -> finish-recovery-startup-consumer.py -> finish-recovery-runtime.py -> finish-recovery-staging-fixture.py -> finish-recovery-fuzz.py. The host snapshot module and process startup module now have separate atomic gates/commits. New module cases include unsigned entry refusal before capture, fallback preserving live state, real data/schema restoration, original-writer snapshot, signed identity distinct from a build constant, twenty cancelled preparations bounded to SEVEN points/admissions, and safe cleanup of an empty abandoned publication. Concrete-engine preflight and signer-event regressions require behavioral RED before their fixes. The runtime feature declares its existing warm-handoff compile dependency and installs actual worker/lifecycle/listener consumers before advertising the capability note. Fuzz target registration and three seeded sanitizer campaigns follow.

Runner: run-managed-continuation.py in build-slot PID 3676663; entry finish-recovery-admissions.py now pins its exact starting head. Inspect git status/head, running processes and managed receipts before resuming: NEVER replay completed mutation prefixes. On failure, use the exact nonce to resume only the incomplete gate; the wrapper releases its slot after five minutes without a repair. Each completed step commits, pushes and comments before continuing. All chains set CARGO_INCREMENTAL=0. Entry reclaims only this job incremental cache under its managed slot to prevent another disk-full incident.

Outstanding after these scripts: integrate latest origin/dev (currently docs-only since f210a4f25), scripts/verify iterate, actual shipping-profile size/ratchet qualification, real perf-VM acceptance including 128 attached routes and managed host, native A/B qualification with fresh baseline/artifacts, final scripts/verify fast through build-slot. No merge or production deployment.

Archive SHA256 7ffdcef37b218b567c753b317fd4303960449998aab6ee4ce32f67398f90d1f2

Updated uncompiled sources and ordered gate scripts

Updated continuation checkpoint at f59d67a8dbd56866645108d89b08cf04136868ce. Still queued for the managed build slot; no new source mutation or gate has begun. This archive supersedes the earlier uncompiled runtime drafts. UNCOMPILED, not acceptance evidence. Ordered scripts: finish-recovery-admissions.py -> finish-recovery-transition-coordinates.py -> finish-release-readiness-preflight.py -> finish-recovery-host-consumer.py -> finish-recovery-startup-consumer.py -> finish-recovery-runtime.py -> finish-recovery-staging-fixture.py -> finish-recovery-fuzz.py. The host snapshot module and process startup module now have separate atomic gates/commits. New module cases include unsigned entry refusal before capture, fallback preserving live state, real data/schema restoration, original-writer snapshot, signed identity distinct from a build constant, twenty cancelled preparations bounded to SEVEN points/admissions, and safe cleanup of an empty abandoned publication. Concrete-engine preflight and signer-event regressions require behavioral RED before their fixes. The runtime feature declares its existing warm-handoff compile dependency and installs actual worker/lifecycle/listener consumers before advertising the capability note. Fuzz target registration and three seeded sanitizer campaigns follow. Runner: run-managed-continuation.py in build-slot PID 3676663; entry finish-recovery-admissions.py now pins its exact starting head. Inspect git status/head, running processes and managed receipts before resuming: NEVER replay completed mutation prefixes. On failure, use the exact nonce to resume only the incomplete gate; the wrapper releases its slot after five minutes without a repair. Each completed step commits, pushes and comments before continuing. All chains set CARGO_INCREMENTAL=0. Entry reclaims only this job incremental cache under its managed slot to prevent another disk-full incident. Outstanding after these scripts: integrate latest origin/dev (currently docs-only since f210a4f25), scripts/verify iterate, actual shipping-profile size/ratchet qualification, real perf-VM acceptance including 128 attached routes and managed host, native A/B qualification with fresh baseline/artifacts, final scripts/verify fast through build-slot. No merge or production deployment. Archive SHA256 7ffdcef37b218b567c753b317fd4303960449998aab6ee4ce32f67398f90d1f2 [Updated uncompiled sources and ordered gate scripts](https://git.kayg.org/attachments/39e474f7-5c69-48b6-9dd4-c015feef0765)
kayg commented 2026-10-16 10:32:59 +00:00
Author
Owner
Copy link

Additional reconciliation finding from code inspection (not yet a reproducing test): a full D155 manual rollback restores release_update_notifications from the older preimage. Main-path B readiness is already in the A→B preimage, but a later staged C observed while B runs can be absent there; rolling back B→A then checking C could emit its toast again. crates/plugins/release/src/schema.sql promises persistent dedup across rollback, while recovery.rs Transition currently carries only the applying intent. Application/authorization state must still restore completely; any preservation belongs exclusively to public release operational metadata. After the core recovery consumer compiles, add a real SQLite failing case and reconcile the source notifications through the release-owned boundary without a security-state overlay or downloaded path authority. No fix or acceptance claim yet.

Additional reconciliation finding from code inspection (not yet a reproducing test): a full D155 manual rollback restores release_update_notifications from the older preimage. Main-path B readiness is already in the A→B preimage, but a later staged C observed while B runs can be absent there; rolling back B→A then checking C could emit its toast again. crates/plugins/release/src/schema.sql promises persistent dedup across rollback, while recovery.rs Transition currently carries only the applying intent. Application/authorization state must still restore completely; any preservation belongs exclusively to public release operational metadata. After the core recovery consumer compiles, add a real SQLite failing case and reconcile the source notifications through the release-owned boundary without a security-state overlay or downloaded path authority. No fix or acceptance claim yet.
kayg commented 2026-10-16 10:44:50 +00:00
Author
Owner
Copy link

Committed and pushed 9e00e82af5: Retain original host destinations separately from encrypted recovery inventories (D147, D155).

Publish immutable local destination admission under the configured host namespace, then select its exact point only after the actual successor is healthy. Kernel fallback preserves the prior selection. A downloaded bundle can neither register a path nor select a point by timestamp. Enforce checked private unique files and validate the complete namespace before collection; retain only current/previous selectors and bounded local point admissions. Real filesystem tests cover health/fallback/refusal, alias/shared-mode/unknown-leaf refusal and twenty updates bounded to seven point records plus two selectors. This metadata boundary remains test-only until the host consumer is installed; it is not an AEAD or VM proof.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 570 filtered out; finished in 0.84s

original-host-recovery-admissions-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 9e00e82af50bd49b5b48ad1aaec7a3ea95e68b2e: Retain original host destinations separately from encrypted recovery inventories (D147, D155). Publish immutable local destination admission under the configured host namespace, then select its exact point only after the actual successor is healthy. Kernel fallback preserves the prior selection. A downloaded bundle can neither register a path nor select a point by timestamp. Enforce checked private unique files and validate the complete namespace before collection; retain only current/previous selectors and bounded local point admissions. Real filesystem tests cover health/fallback/refusal, alias/shared-mode/unknown-leaf refusal and twenty updates bounded to seven point records plus two selectors. This metadata boundary remains test-only until the host consumer is installed; it is not an AEAD or VM proof. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 570 filtered out; finished in 0.84s ``` [original-host-recovery-admissions-gate.log](https://git.kayg.org/attachments/ba93c0f9-ef41-400e-83f1-180bc3717351) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 10:46:03 +00:00
Author
Owner
Copy link

Committed and pushed 42301b7c3e: Reuse validated point collection for admission retention identities (D147).

Return the exact kept checkpoint IDs from the existing validate-before-retire collector, preserving the prior unit-returning API for existing callers. This lets the host retain original destination records alongside its bounded encrypted point inventory without a second scanner or full database reads. The twenty-checkpoint test checks the returned seven-point set and its protected rollback reference; unknown/aliased entries still refuse before deletion. No retention default or crypto format changes.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 571 filtered out; finished in 1.46s

retained-point-identities-after-collection-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 42301b7c3e396629c4555f5e650800f6b08b533a: Reuse validated point collection for admission retention identities (D147). Return the exact kept checkpoint IDs from the existing validate-before-retire collector, preserving the prior unit-returning API for existing callers. This lets the host retain original destination records alongside its bounded encrypted point inventory without a second scanner or full database reads. The twenty-checkpoint test checks the returned seven-point set and its protected rollback reference; unknown/aliased entries still refuse before deletion. No retention default or crypto format changes. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 571 filtered out; finished in 1.46s ``` [retained-point-identities-after-collection-gate.log](https://git.kayg.org/attachments/81178315-78f1-478c-b653-e8fd3eebe5be) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 10:46:31 +00:00
Author
Owner
Copy link

Committed and pushed 0b5d463c78: Expose authenticated transition coordinates to the host recovery boundary (D147, D155).

Provide borrowed version coordinates and rollback kind from the existing validated transition. The host can bind both encrypted points to the exact reversed image pair without duplicating the release schema or accepting a downloaded path as authority. Existing real SQLite recovery tests exercise the same decoder and restore operations; no authorization or key material is exposed.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 37 filtered out; finished in 0.01s

recovery-transition-coordinates-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed 0b5d463c7830c9407a21c1288fd4704c22f60e9c: Expose authenticated transition coordinates to the host recovery boundary (D147, D155). Provide borrowed version coordinates and rollback kind from the existing validated transition. The host can bind both encrypted points to the exact reversed image pair without duplicating the release schema or accepting a downloaded path as authority. Existing real SQLite recovery tests exercise the same decoder and restore operations; no authorization or key material is exposed. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 37 filtered out; finished in 0.01s ``` [recovery-transition-coordinates-gate.log](https://git.kayg.org/attachments/5b42dffd-6cbc-4aa5-bb8c-e0f042cce105) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 10:47:11 +00:00
Author
Owner
Copy link

Edge auto-update is not shipped because the branch still lacks an installed recovery path that can undo a failed, database-changing update. The current production engine deliberately refuses application before handoff. The earlier implementation reached staging, but independent review found five P1s; subsequent fixes and recovery primitives have not received final integrated qualification. Shared capacity has delayed that work, but removing the refusal would expose a real recovery failure.

Scope checked: detached f59d67a8dbd56866645108d89b08cf04136868ce; local origin/dev=190bf088d, common ancestor f210a4f25; 207 commits in origin/dev..HEAD. Read CLAUDE.md, architecture/process, D147/D155/D186/D243/D250/D251, issue body, review verdicts and all last 40 comments; skimmed earlier history. Complete ordered SHA/file inventory. Findings below concern this pinned head, not another job's drafts or later live state.

  1. What exists, and what its tests actually establish
Path Implemented now Evidence / limit
Reviewed publication Exact source/gate/bundle binding, structured MERGE with zero P0/P1, signed handoff metadata, ordering and direct-upload fencing. 773302ce9, 68179ebf3, 889278f70, c3ad4b468; edge_admission.py:47. This is publication machinery, not proof the external hardened signer and production feed are enabled.
Check, download, verify Channel selection; signature-verified staging; authenticated VERSION/SOURCE and exact executable; actual /proc/self/exe retention; fsync/rename publication. 771160120, 48fc61fc6, cbff51f01; release_update.rs:55, :387. Signed-engine and compiled-control receipts are in 46104 and 46102.
Quiet verified handoff Foreground admission, fresh requester checks, sealed candidate and pinned predecessor, memory-only CA transfer, listener inheritance. Input can cancel preparation without losing its socket/ACKs, including when session renewal waits behind the checkpoint writer. 0d6cfd2a4, 5917678bf, 4abb6ab09, 8829f8b08, aabd5b83b; restart.rs:232; real-WAL red/green 54581.
Startup/health Verified cold selection, durable startup-attempt tracking, listener-ready reconciliation; newer optional startup-health reporting tracks the exact owned role/epoch. 076cea7c5, 2e9d6ffe8, ba2977dd9, f59d67a8d; updater.rs:557. This is not an installed end-to-end D155 health verdict covering HTTP, WebSocket attach, infraternal-agent reconnect, migrations and session resume. The resumed host consumer is explicitly still pending in 54715.
Previous binary / host A/B Immediate exec refusal falls back to pinned predecessor bytes. Cold startup can select a verified predecessor after an entered-but-unready attempt. Managed hosts have resumable signed A/B storage, independent service supervision and failed-image pause. 116c4f984, d99f72129, eecdd8dad; restart.rs:498, startup.rs:48. Binary selection alone cannot undo a successor migration.
Encrypted recovery Real SQLite/WAL/page-geometry restore; dedicated protected backup-key custody; authenticated DB/CA/config bundles; configured-target and TLS-pair validation; guardian/channel/barrier and release-transition primitives. 131d416bf, 05b9f8da5, 479f9c6bd, 008b912b4, c9ba05ec4, fa64b8687, 034e31cfe. Focused tests pass, including real newer migration restoration and TLS mismatch refusal. Critical host modules remain test-only: lib.rs:164–186.

The decisive gap is UpdateEngine::prepare_recovery at updater.rs:55: default refusal is pre-upgrade backup unavailable. The concrete Engine implementation at release_update.rs:311–483 never overrides it; updater.rs:419 calls it before handoff. 54771 independently records this exact integration gap. Therefore this head can prepare an update, but cannot automatically apply it through the production updater.

Earlier staging did demonstrate useful behavior: quiet-window postponement, warm CA/PTY survival, manual update/rollback, late exec refusal, managed-host watchdog rollback, and fatal server binary recovery. But that was an older head with 128 PTYs and only ONE active server route plus the managed-host route, using same-source versioned fixtures. Fatal server recovery cold-locked the CA. Reported maxima were 882.680 ms listener-gap bracket and 61,867.495 ms last-input→apply for a 60 s window: 51735. It did not prove autonomous recovery after a genuinely newer migration.

The independent verdict was HOLD, P0=0/P1=5, despite verify fast passing: route continuity, native latency, unbounded images, absent backup/restore, and healthy listener gap: 51934. Collection and listener/control fixes now exist; their final-head acceptance is still outstanding. Do not repeat all five as unfixed code defects, or describe them as cleared by review.

  1. Required for monitor01 versus later slices

Required before unattended application:

  • Install the concrete recovery readiness/provider and shipping CLI/startup consumers. Capture the consistent encrypted preimage under the receiver's final writer/foreground fences, bound to the independently verified opened image pair. Authenticate the complete point and independently admitted restore targets before arming. A readiness-only override or bypass of the refusing default is insufficient.
  • Keep recovery authority outside the replaceable process; recover both previous executable and D147 database/CA/config before predecessor startup/migrations. Exercise crash, hang and health failure, not only exec returning an error. Prevent restart loops and keep the failed candidate paused. Preserve usable CA custody through this update transaction without introducing a cold-start auto-unlock; total host/power loss retains D168 semantics.
  • Complete actual startup/health consumers and bounded check-in. A listener binding or an updater task reporting initialization success alone is insufficient. Do not accept normal foreground mutations before the health decision that makes failed-update restoration safe.
  • Defer destructive collection until positive guardian check-in. updater.rs:510 currently collects during reconciliation; restoring the older DB after a later failure can then refer to an already-deleted predecessor. This is a required recovery defect, not cleanup polish: 54615. Bound points/admissions using D147's existing seven-point default while protecting image-selected recovery references.
  • Wire release transition reconciliation after full restoration, including failed downgrade recovery. c9ba05ec4 supplies the API but no host consumer. Losing B→A intent or re-admitting failed A as a first startup can break recovery; those cases stay in the first slice. Follow the corrected full-restoration contract in 54024, not the earlier speculative security-state overlay.
  • Close qualification and rollout prerequisites: final review/gates, production-trusted released artifacts/feed, signed current installation/metadata, explicit edge selection, and provisioned/unlocked backup custody on monitor01. Default channel is stable (updater.rs:149). Initial enablement is a one-time rollout task; subsequent releases must need no orchestrator deploy. This scope check did not inspect or change monitor01's live configuration.

Can ship later: remote/S3/SFTP/PBS backup destinations, daily/weekly backup product workflows, disaster-recovery/bootstrap UX, additional recovery tooling, UI polish and the separate Settings/Inbox visual pass. D251's controls remain owed; this issue explicitly scopes the backend first. Keep the existing backend status/events/CLI.

TLS restoration is conditional, not blanket deferral. General identity repair/re-enrollment tooling can wait. Restoring configured TLS/private-key/issuer material that the previous monitor01 build needs to bind and reconnect cannot wait; D147/D155 already include CA/config. Existing capture covers HTTPS and remote identities (private_resources_host.rs:41). Reuse the committed validation; do not add new identity-management scope.

The newest C-ready-toast replay after a full manual rollback is a separate notification-dedup slice: 54830. It does not prevent the previous build recovering. Conversely, preserving the correct rollback image/intent and delivering readiness despite cleanup failure are functional requirements; the latter already has d047ce838.

  1. Smallest safe first shipping cut

Keep the committed backend and finish its missing recovery seam; do not restart the 207-commit history or add a general backup product. The linked inventory lists every retained SHA and file. The essential existing groups are the publication/updater/handoff/host commits above, plus 24ca44031 (fail closed), ca179382c/e4dafb7f3 (image collection), 7f078ba6b (real migration-failure fixture), and the recovery/health commits above. Keeping already-built optional primitives does not require expanding their shipping scope.

Add only these logical, individually gated commits; future SHAs do not exist yet:

  1. Durable original recovery admissions/transition coordinates and bounded retention: existing backup_points.rs, recovery_channel.rs, release recovery.rs, plus the host admission adapter/tests.
  2. Concrete Engine readiness, retaining fail-closed behavior: release_update.rs and its real-engine regressions. Capture remains after receiver verification/fencing, not in this early preflight.
  3. Host checkpoint/restore consumer: private_resources_host.rs, recovery_point.rs, guardian/worker/barrier modules and host integration tests. Cover the original writer snapshot, authenticated target restoration, cancellation and fatal migration rollback.
  4. Process/startup consumer: server startup integration, CLI actions.rs/server entry, original-issuer signer installation and one-shot warm custody. Claim descriptors before children and restore before any serving DB opens.
  5. Shipping composition and health/check-in/collection ordering: Cargo features, lib.rs, existing plugin lifecycle/runtime, release updater and Engine. Advertise recovery compatibility only after its actual consumers exist. Retain release-only/backup-only compile-out.
  6. Acceptance/fuzz coverage: scripts/release/staging-proof, actual update/managed-host staging tests, migration-failure fixture, and recovery parser fuzz targets. Extend existing harnesses.

The latest continuation archive contains candidate scripts for essentially these steps, explicitly UNCOMPILED. It is starting material, not finished implementation or an eight-command shipping guarantee.

Required exit gates:

  • Focused red/green tests for real migration rollback, health hang/failure, failed downgrade, immediate exec refusal without data restore, unsigned/mismatched identity refusal, same-socket input cancellation, epoch revocation and bounded retention. Seeded sanitizer campaigns for the new parsers.
  • scripts/verify iterate, then scripts/verify fast on the final dev integration head, attaching verbatim output; independent break-it review with no P0/P1 and review bound to the exact publishable bundle.
  • Locked perf-VM staging: automatic signed-feed→quiet apply with no per-update deploy; 128 attached routes and managed-host convergence; HTTP/WS/reconnect/migration/session health; deliberately migrated successor failure/hang→restored old schema/data/image and functioning previous service without operator recovery. Measure listener/reconnect/input continuity. A one-route pass or same-schema binary swap is insufficient.
  • Native final-artifact qualification against unchanged budgets. Prior ten-pair diagnostics found baseline/candidate median same-PTY echo p99 413.495/413.270 ms versus 334 ms; neither establishes a pass: 52926. Baseline failure does not waive the open gate.
  • D243: actual shipping stable/edge recipes on both static targets, production trust/linkage and D244 checks. Current checked-in ceilings are 21,422,096 B x86 / 19,594,856 B ARM (scripts/verify.d/rust.sh:67–68; PROCESS:141). Measure after wiring; do not cite older size passes as head evidence, raise caps to fit, or adopt unqualified profile experiments. Ratchet reductions as required.

Estimate: 3–5 focused engineering days; plan 4–7 working days elapsed with roughly four shared build slots and the separately locked perf VM. Allow 1–2 days for integration/regressions, 1–2 for shipping size plus staging/native qualification, and about a day for independent review/fixes/integration gates, with queue time overlapping where possible. This is a scope estimate, not a measured forecast. The recorded one-hour slot wait in 54795 makes “a few hours” unrealistic. If the existing latency P1 needs a substantive fix or recovery integration exposes new defects, add a separate measured fix slice; no safe shipping date is established until those gates clear.

This was a read-only scope assessment: no code edits, builds, pushes or deployments. No new verify fast result is claimed; running it would conflict with the explicit no-heavy-build job scope. Checkout remained clean at f59d67a8d.

Edge auto-update is not shipped because the branch still lacks an installed recovery path that can undo a failed, database-changing update. The current production engine deliberately refuses application before handoff. The earlier implementation reached staging, but independent review found five P1s; subsequent fixes and recovery primitives have not received final integrated qualification. Shared capacity has delayed that work, but removing the refusal would expose a real recovery failure. Scope checked: detached `f59d67a8dbd56866645108d89b08cf04136868ce`; local `origin/dev=190bf088d`, common ancestor `f210a4f25`; 207 commits in `origin/dev..HEAD`. Read CLAUDE.md, architecture/process, D147/D155/D186/D243/D250/D251, issue body, review verdicts and all last 40 comments; skimmed earlier history. [Complete ordered SHA/file inventory](https://git.kayg.org/attachments/fa081ac3-1681-4a77-9a1c-2f902cbb9b50). Findings below concern this pinned head, not another job's drafts or later live state. 1. **What exists, and what its tests actually establish** | Path | Implemented now | Evidence / limit | | --- | --- | --- | | Reviewed publication | Exact source/gate/bundle binding, structured MERGE with zero P0/P1, signed handoff metadata, ordering and direct-upload fencing. | `773302ce9`, `68179ebf3`, `889278f70`, `c3ad4b468`; [edge_admission.py:47](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/scripts/release/edge_admission.py#L47). This is publication machinery, not proof the external hardened signer and production feed are enabled. | | Check, download, verify | Channel selection; signature-verified staging; authenticated VERSION/SOURCE and exact executable; actual `/proc/self/exe` retention; fsync/rename publication. | `771160120`, `48fc61fc6`, `cbff51f01`; [release_update.rs:55](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/infraternal-server/src/release_update.rs#L55), [:387](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/infraternal-server/src/release_update.rs#L387). Signed-engine and compiled-control receipts are in [46104](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-46104) and [46102](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-46102). | | Quiet verified handoff | Foreground admission, fresh requester checks, sealed candidate and pinned predecessor, memory-only CA transfer, listener inheritance. Input can cancel preparation without losing its socket/ACKs, including when session renewal waits behind the checkpoint writer. | `0d6cfd2a4`, `5917678bf`, `4abb6ab09`, `8829f8b08`, `aabd5b83b`; [restart.rs:232](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/infraternal/src/restart.rs#L232); real-WAL red/green [54581](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54581). | | Startup/health | Verified cold selection, durable startup-attempt tracking, listener-ready reconciliation; newer optional startup-health reporting tracks the exact owned role/epoch. | `076cea7c5`, `2e9d6ffe8`, `ba2977dd9`, `f59d67a8d`; [updater.rs:557](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/plugins/release/src/updater.rs#L557). This is not an installed end-to-end D155 health verdict covering HTTP, WebSocket attach, infraternal-agent reconnect, migrations and session resume. The resumed host consumer is explicitly still pending in [54715](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54715). | | Previous binary / host A/B | Immediate exec refusal falls back to pinned predecessor bytes. Cold startup can select a verified predecessor after an entered-but-unready attempt. Managed hosts have resumable signed A/B storage, independent service supervision and failed-image pause. | `116c4f984`, `d99f72129`, `eecdd8dad`; [restart.rs:498](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/infraternal/src/restart.rs#L498), [startup.rs:48](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/plugins/release/src/startup.rs#L48). Binary selection alone cannot undo a successor migration. | | Encrypted recovery | Real SQLite/WAL/page-geometry restore; dedicated protected backup-key custody; authenticated DB/CA/config bundles; configured-target and TLS-pair validation; guardian/channel/barrier and release-transition primitives. | `131d416bf`, `05b9f8da5`, `479f9c6bd`, `008b912b4`, `c9ba05ec4`, `fa64b8687`, `034e31cfe`. Focused tests pass, including [real newer migration restoration](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54540) and [TLS mismatch refusal](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54710). Critical host modules remain test-only: [lib.rs:164–186](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/infraternal-server/src/lib.rs#L164). | The decisive gap is [UpdateEngine::prepare_recovery at updater.rs:55](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/plugins/release/src/updater.rs#L55): default refusal is `pre-upgrade backup unavailable`. The concrete Engine implementation at `release_update.rs:311–483` never overrides it; `updater.rs:419` calls it before handoff. [54771](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54771) independently records this exact integration gap. Therefore this head can prepare an update, but cannot automatically apply it through the production updater. Earlier staging **did** demonstrate useful behavior: quiet-window postponement, warm CA/PTY survival, manual update/rollback, late exec refusal, managed-host watchdog rollback, and fatal server binary recovery. But that was an older head with 128 PTYs and only ONE active server route plus the managed-host route, using same-source versioned fixtures. Fatal server recovery cold-locked the CA. Reported maxima were 882.680 ms listener-gap bracket and 61,867.495 ms last-input→apply for a 60 s window: [51735](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-51735). It did not prove autonomous recovery after a genuinely newer migration. The independent verdict was **HOLD, P0=0/P1=5**, despite `verify fast` passing: route continuity, native latency, unbounded images, absent backup/restore, and healthy listener gap: [51934](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-51934). Collection and listener/control fixes now exist; their final-head acceptance is still outstanding. Do not repeat all five as unfixed code defects, or describe them as cleared by review. 2. **Required for monitor01 versus later slices** Required before unattended application: - Install the concrete recovery readiness/provider and shipping CLI/startup consumers. Capture the consistent encrypted preimage under the receiver's final writer/foreground fences, bound to the independently verified opened image pair. Authenticate the complete point and independently admitted restore targets before arming. A readiness-only override or bypass of the refusing default is insufficient. - Keep recovery authority outside the replaceable process; recover both previous executable and D147 database/CA/config before predecessor startup/migrations. Exercise crash, hang and health failure, not only `exec` returning an error. Prevent restart loops and keep the failed candidate paused. Preserve usable CA custody through this update transaction without introducing a cold-start auto-unlock; total host/power loss retains D168 semantics. - Complete actual startup/health consumers and bounded check-in. A listener binding or an updater task reporting initialization success alone is insufficient. Do not accept normal foreground mutations before the health decision that makes failed-update restoration safe. - Defer destructive collection until positive guardian check-in. `updater.rs:510` currently collects during reconciliation; restoring the older DB after a later failure can then refer to an already-deleted predecessor. This is a required recovery defect, not cleanup polish: [54615](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54615). Bound points/admissions using D147's existing seven-point default while protecting image-selected recovery references. - Wire release transition reconciliation after full restoration, including failed downgrade recovery. `c9ba05ec4` supplies the API but no host consumer. Losing B→A intent or re-admitting failed A as a first startup can break recovery; those cases stay in the first slice. Follow the corrected full-restoration contract in [54024](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54024), not the earlier speculative security-state overlay. - Close qualification and rollout prerequisites: final review/gates, production-trusted released artifacts/feed, signed current installation/metadata, explicit edge selection, and provisioned/unlocked backup custody on monitor01. Default channel is stable (`updater.rs:149`). Initial enablement is a one-time rollout task; subsequent releases must need no orchestrator deploy. This scope check did not inspect or change monitor01's live configuration. Can ship later: remote/S3/SFTP/PBS backup destinations, daily/weekly backup product workflows, disaster-recovery/bootstrap UX, additional recovery tooling, UI polish and the separate Settings/Inbox visual pass. D251's controls remain owed; this issue explicitly scopes the backend first. Keep the existing backend status/events/CLI. **TLS restoration is conditional, not blanket deferral.** General identity repair/re-enrollment tooling can wait. Restoring configured TLS/private-key/issuer material that the previous monitor01 build needs to bind and reconnect cannot wait; D147/D155 already include CA/config. Existing capture covers HTTPS and remote identities ([private_resources_host.rs:41](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/crates/infraternal-server/src/private_resources_host.rs#L41)). Reuse the committed validation; do not add new identity-management scope. The newest C-ready-toast replay after a full manual rollback is a separate notification-dedup slice: [54830](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54830). It does not prevent the previous build recovering. Conversely, preserving the correct rollback image/intent and delivering readiness despite cleanup failure are functional requirements; the latter already has `d047ce838`. 3. **Smallest safe first shipping cut** Keep the committed backend and finish its missing recovery seam; do not restart the 207-commit history or add a general backup product. The linked inventory lists every retained SHA and file. The essential existing groups are the publication/updater/handoff/host commits above, plus `24ca44031` (fail closed), `ca179382c`/`e4dafb7f3` (image collection), `7f078ba6b` (real migration-failure fixture), and the recovery/health commits above. Keeping already-built optional primitives does not require expanding their shipping scope. Add only these logical, individually gated commits; future SHAs do not exist yet: 1. Durable original recovery admissions/transition coordinates and bounded retention: existing `backup_points.rs`, `recovery_channel.rs`, release `recovery.rs`, plus the host admission adapter/tests. 2. Concrete Engine readiness, retaining fail-closed behavior: `release_update.rs` and its real-engine regressions. Capture remains after receiver verification/fencing, not in this early preflight. 3. Host checkpoint/restore consumer: `private_resources_host.rs`, `recovery_point.rs`, guardian/worker/barrier modules and host integration tests. Cover the original writer snapshot, authenticated target restoration, cancellation and fatal migration rollback. 4. Process/startup consumer: server startup integration, CLI `actions.rs`/server entry, original-issuer signer installation and one-shot warm custody. Claim descriptors before children and restore before any serving DB opens. 5. Shipping composition and health/check-in/collection ordering: Cargo features, `lib.rs`, existing plugin lifecycle/runtime, release updater and Engine. Advertise recovery compatibility only after its actual consumers exist. Retain release-only/backup-only compile-out. 6. Acceptance/fuzz coverage: `scripts/release/staging-proof`, actual update/managed-host staging tests, migration-failure fixture, and recovery parser fuzz targets. Extend existing harnesses. The [latest continuation archive](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54814) contains candidate scripts for essentially these steps, explicitly **UNCOMPILED**. It is starting material, not finished implementation or an eight-command shipping guarantee. Required exit gates: - Focused red/green tests for real migration rollback, health hang/failure, failed downgrade, immediate exec refusal without data restore, unsigned/mismatched identity refusal, same-socket input cancellation, epoch revocation and bounded retention. Seeded sanitizer campaigns for the new parsers. - `scripts/verify iterate`, then `scripts/verify fast` on the final dev integration head, attaching verbatim output; independent break-it review with no P0/P1 and review bound to the exact publishable bundle. - Locked perf-VM staging: automatic signed-feed→quiet apply with no per-update deploy; **128 attached routes** and managed-host convergence; HTTP/WS/reconnect/migration/session health; deliberately migrated successor failure/hang→restored old schema/data/image and functioning previous service without operator recovery. Measure listener/reconnect/input continuity. A one-route pass or same-schema binary swap is insufficient. - Native final-artifact qualification against unchanged budgets. Prior ten-pair diagnostics found baseline/candidate median same-PTY echo p99 413.495/413.270 ms versus 334 ms; neither establishes a pass: [52926](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-52926). Baseline failure does not waive the open gate. - D243: actual shipping stable/edge recipes on both static targets, production trust/linkage and D244 checks. Current checked-in ceilings are **21,422,096 B x86 / 19,594,856 B ARM** (`scripts/verify.d/rust.sh:67–68`; [PROCESS:141](https://git.kayg.org/kayg/infraternal/src/commit/f59d67a8dbd56866645108d89b08cf04136868ce/docs/PROCESS.md#L141)). Measure after wiring; do not cite older size passes as head evidence, raise caps to fit, or adopt unqualified profile experiments. Ratchet reductions as required. Estimate: **3–5 focused engineering days; plan 4–7 working days elapsed** with roughly four shared build slots and the separately locked perf VM. Allow 1–2 days for integration/regressions, 1–2 for shipping size plus staging/native qualification, and about a day for independent review/fixes/integration gates, with queue time overlapping where possible. This is a scope estimate, not a measured forecast. The recorded one-hour slot wait in [54795](https://git.kayg.org/kayg/infraternal/issues/211#issuecomment-54795) makes “a few hours” unrealistic. If the existing latency P1 needs a substantive fix or recovery integration exposes new defects, add a separate measured fix slice; no safe shipping date is established until those gates clear. This was a read-only scope assessment: no code edits, builds, pushes or deployments. No new `verify fast` result is claimed; running it would conflict with the explicit no-heavy-build job scope. Checkout remained clean at `f59d67a8d`.
kayg commented 2026-10-16 10:49:20 +00:00
Author
Owner
Copy link

Committed and pushed f49972c148: Defer verified candidates on missing recovery readiness instead of rejecting them (D147, D251).

The concrete engine inherited the backup-refusing default even when the recovery feature was compiled. Override its preflight with the existing typed readiness provider so disabled/setup/locked states retain the same verified candidate. Actual capture remains exclusively in independently verified receiver admission under its writer and foreground fences; do not snapshot twice or export keys here. A behavioral failing test first reproduced the default Refused response, then passed as Waiting Disabled with the fix.

Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim:

test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 567 filtered out; finished in 0.72s

release-engine-readiness-preflight-gate.log

Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.

Committed and pushed f49972c14858518789255bdbfa732a8cb1992b19: Defer verified candidates on missing recovery readiness instead of rejecting them (D147, D251). The concrete engine inherited the backup-refusing default even when the recovery feature was compiled. Override its preflight with the existing typed readiness provider so disabled/setup/locked states retain the same verified candidate. Actual capture remains exclusively in independently verified receiver admission under its writer and foreground fences; do not snapshot twice or export keys here. A behavioral failing test first reproduced the default Refused response, then passed as Waiting Disabled with the fix. Gate: fmt, targeted all-target Clippy with warnings denied and selected functional tests passed. Test summaries, verbatim: ```text test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 567 filtered out; finished in 0.72s ``` [release-engine-readiness-preflight-gate.log](https://git.kayg.org/attachments/ce3c1a5f-39eb-4cb5-a4cb-800b6db8e0ad) Build-host durations in the raw log are operational, not performance evidence. Encrypted updater recovery integration, final VM acceptance, size/profile qualification and final iterate/fast remain incomplete.
kayg commented 2026-10-16 10:49:21 +00:00
Author
Owner
Copy link

Behavioral RED for the concrete engine preflight, followed by the committed passing gate above.
release-engine-readiness-preflight-red.log

Behavioral RED for the concrete engine preflight, followed by the committed passing gate above. [release-engine-readiness-preflight-red.log](https://git.kayg.org/attachments/b8a3f69f-3ca7-459d-b691-f23ab87ef38c)
kayg commented 2026-10-16 10:52:27 +00:00
Author
Owner
Copy link

Resumed edge-autoupdate from f49972c148. Read D295 on origin/dev=41a3a81ab and repository contracts; issue #211 and parent #157 histories retrieved. Preserved interrupted unqualified recovery drafts as local-only branch edge-autoupdate-recovery-drafts at 5f39b7e0a (not pushed), then rebased shipping history onto origin/dev without conflict. The old encrypted recovery wiring is rejected for this slice. Implementing only D295: SQLite online backup, bounded update marker, previous stable restart target until health/check-in, restore before DB open, failed-update Inbox result and disk admission. Reuse existing signature verifier, online-backup bridge, owned admission and warm listener handoff; no new dependency, supervisor, certificate restoration or production deployment. Required failing-first crash/health/deadline/migration/power-loss/disk tests and locked staging/size/native/final-fast remain pending.

Resumed edge-autoupdate from f49972c14858518789255bdbfa732a8cb1992b19. Read D295 on origin/dev=41a3a81ab and repository contracts; issue #211 and parent #157 histories retrieved. Preserved interrupted unqualified recovery drafts as local-only branch edge-autoupdate-recovery-drafts at 5f39b7e0a (not pushed), then rebased shipping history onto origin/dev without conflict. The old encrypted recovery wiring is rejected for this slice. Implementing only D295: SQLite online backup, bounded update marker, previous stable restart target until health/check-in, restore before DB open, failed-update Inbox result and disk admission. Reuse existing signature verifier, online-backup bridge, owned admission and warm listener handoff; no new dependency, supervisor, certificate restoration or production deployment. Required failing-first crash/health/deadline/migration/power-loss/disk tests and locked staging/size/native/final-fast remain pending.
kayg commented 2026-10-16 10:53:29 +00:00
Author
Owner
Copy link

D295 additive implementation contract: reuse release-owned admission/ExecResource hooks and the existing SQLite online-backup bridge. Finish and fsync one copy under the receiver's final writer/foreground fence, then arm a small private atomic marker immediately before exec. The marker contains validated release coordinates, backup digest, attempt phase and deadline; paths are derived under this server's image store. A distinct ELF compatibility note requires both binaries to understand recovery. The existing owned startup/serving futures enforce health/check-in and the ~120-second deadline; no detached supervisor. The stable service symlink remains the verified predecessor until successful startup/reconciliation; flip it atomically then mark committed. On any other entry with uncommitted intent, select/verify predecessor, restore the saved database before live DB opens, pause the failed image and expose “Update to X failed and was undone” in Inbox. Fsync ordering makes interrupted copies, marker publication, restore and symlink flip retryable. Keep the successful copy until a later successful update; collect only after check-in. Refuse insufficient disk plainly; do not require backup-plugin key custody. Tests will exercise interruption points and actual schema rollback, rather than test-only encrypted recovery machinery.

D295 additive implementation contract: reuse release-owned admission/ExecResource hooks and the existing SQLite online-backup bridge. Finish and fsync one copy under the receiver's final writer/foreground fence, then arm a small private atomic marker immediately before exec. The marker contains validated release coordinates, backup digest, attempt phase and deadline; paths are derived under this server's image store. A distinct ELF compatibility note requires both binaries to understand recovery. The existing owned startup/serving futures enforce health/check-in and the ~120-second deadline; no detached supervisor. The stable service symlink remains the verified predecessor until successful startup/reconciliation; flip it atomically then mark committed. On any other entry with uncommitted intent, select/verify predecessor, restore the saved database before live DB opens, pause the failed image and expose “Update to X failed and was undone” in Inbox. Fsync ordering makes interrupted copies, marker publication, restore and symlink flip retryable. Keep the successful copy until a later successful update; collect only after check-in. Refuse insufficient disk plainly; do not require backup-plugin key custody. Tests will exercise interruption points and actual schema rollback, rather than test-only encrypted recovery machinery.
kayg commented 2026-10-16 11:05:46 +00:00
Author
Owner
Copy link

D295 wiring draft is in the worktree, not committed or qualified. New update_recovery.rs reuses SQLite copy_main and the existing ExecResource arm/fallback lifecycle; release_startup restores before opening the live DB, and the service installer uses updates/current. Startup health commits before image collection. Compatibility is a distinct release-only ELF note (a remote-only build must not advertise recovery). Reused the existing exact-file SHA-256 loop with a caller-supplied size bound so database copies do not inherit the executable parser's 128 MiB ceiling; no second hasher or crypto dependency. Tests drafted for actual schema rollback, WAL-only data under an existing writer reservation, deadline, interrupted copy/marker/flip, disk admission, corrupt-copy refusal and twenty-update retention. The first managed RED/green gate remains queued; no test or staging pass is claimed. Exact new copy: “Update to X failed and was undone”; disk refusal: “Not enough disk space to copy the database before updating”.

D295 wiring draft is in the worktree, not committed or qualified. New update_recovery.rs reuses SQLite copy_main and the existing ExecResource arm/fallback lifecycle; release_startup restores before opening the live DB, and the service installer uses updates/current. Startup health commits before image collection. Compatibility is a distinct release-only ELF note (a remote-only build must not advertise recovery). Reused the existing exact-file SHA-256 loop with a caller-supplied size bound so database copies do not inherit the executable parser's 128 MiB ceiling; no second hasher or crypto dependency. Tests drafted for actual schema rollback, WAL-only data under an existing writer reservation, deadline, interrupted copy/marker/flip, disk admission, corrupt-copy refusal and twenty-update retention. The first managed RED/green gate remains queued; no test or staging pass is claimed. Exact new copy: “Update to X failed and was undone”; disk refusal: “Not enough disk space to copy the database before updating”.
kayg commented 2026-10-16 11:16:25 +00:00
Author
Owner
Copy link

D295 continuation safety record (UNCOMPILED, not acceptance): rebased shipping HEAD bf5547593; original rejected recovery drafts remain local-only at edge-autoupdate-recovery-drafts=5f39b7e0a. Current approved D295 changes are uncommitted while their managed gate waits. Gate scheduler PID 295541 (session 60789), queued >12 minutes; script /home/kayg/.cache/codex-scratch/edge-autoupdate/d295-gate.sh. Source currently deliberately lacks enter() failure restoration for behavioral RED; the script restores the exact approved lean fix from d295-restore-green.txt after it observes test result FAILED, then runs green/Clippy/focused tests/iterate sequentially. Do not replay the RED prefix after a completed green run; inspect logs and source first. All output is under scratch/evidence/d295-*.log. Perf-VM NetBird access checked successfully; no measurement started. Next: compilation repairs, atomic gated logical commits/push, signed staging with 128 routes + real E migration failure + managed host, production size deltas/caps, fresh native A/B qualification, final verify fast through build-slot. No production change, no signing keys or provider credentials.

Uncompiled D295 sources and exact RED-to-green gate driver

D295 continuation safety record (UNCOMPILED, not acceptance): rebased shipping HEAD bf5547593; original rejected recovery drafts remain local-only at edge-autoupdate-recovery-drafts=5f39b7e0a. Current approved D295 changes are uncommitted while their managed gate waits. Gate scheduler PID 295541 (session 60789), queued >12 minutes; script /home/kayg/.cache/codex-scratch/edge-autoupdate/d295-gate.sh. Source currently deliberately lacks enter() failure restoration for behavioral RED; the script restores the exact approved lean fix from d295-restore-green.txt after it observes test result FAILED, then runs green/Clippy/focused tests/iterate sequentially. Do not replay the RED prefix after a completed green run; inspect logs and source first. All output is under scratch/evidence/d295-*.log. Perf-VM NetBird access checked successfully; no measurement started. Next: compilation repairs, atomic gated logical commits/push, signed staging with 128 routes + real E migration failure + managed host, production size deltas/caps, fresh native A/B qualification, final verify fast through build-slot. No production change, no signing keys or provider credentials. [Uncompiled D295 sources and exact RED-to-green gate driver](https://git.kayg.org/attachments/872b26c6-e87b-4dd6-9ac3-7fc68aa332e9)
kayg commented 2026-10-16 11:27:07 +00:00
Author
Owner
Copy link

D295 static self-review finding, not yet a test result: a health timer started before release_startup::prepare could repeatedly abort an expired attempt's predecessor restore. remote_server.rs now starts the owned candidate timer only after startup recovery returns. Added a virtual-time regression requiring an expired candidate marker to become inert after predecessor restoration. release_startup.rs also validates the restored live inode after recovery, rather than requiring the failed candidate's database to exist first. New tests include interrupted restore-file and WAL/SHM-removal states, a real SQLx migration journal (old migrator refuses version 2 before restoration), and explicit rollback of schema plus the existing reverse release intent. Reuses Transition::restore_rollback; no encryption or supervisor added. Managed gate PID 295541 is still queued after >23 minutes; all these sources remain UNCOMPILED and no gate, size or staging pass is claimed.

D295 static self-review finding, not yet a test result: a health timer started before release_startup::prepare could repeatedly abort an expired attempt's predecessor restore. remote_server.rs now starts the owned candidate timer only after startup recovery returns. Added a virtual-time regression requiring an expired candidate marker to become inert after predecessor restoration. release_startup.rs also validates the restored live inode after recovery, rather than requiring the failed candidate's database to exist first. New tests include interrupted restore-file and WAL/SHM-removal states, a real SQLx migration journal (old migrator refuses version 2 before restoration), and explicit rollback of schema plus the existing reverse release intent. Reuses Transition::restore_rollback; no encryption or supervisor added. Managed gate PID 295541 is still queued after >23 minutes; all these sources remain UNCOMPILED and no gate, size or staging pass is claimed.
kayg commented 2026-10-16 11:30:39 +00:00
Author
Owner
Copy link

D295 behavioral RED/green through build-slot: missing restoration reproduced seven failures, including real SQLx VersionMissing(2), retained migrated data, WAL copy recovery, deadline recovery and the predecessor timer. After installing lean restore, all 14 recovery tests pass, including twenty updates retaining two images and one database copy. This is functional build-host evidence, not VM timing evidence.

RED verbatim: test result: FAILED. 7 passed; 7 failed; 0 ignored; 0 measured; 299 filtered out; finished in 6.55s
Green verbatim: test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 299 filtered out; finished in 3.70s

RED · green

Focused all-target Clippy then stopped on a 114-line prepare function and a parser entry point after the inline test module. Extracted the single online-copy operation and moved parser/test declarations; rerun queued. No commit/push or final gate claim yet. VM acceptance, size deltas and native qualification remain pending.

D295 behavioral RED/green through build-slot: missing restoration reproduced seven failures, including real SQLx VersionMissing(2), retained migrated data, WAL copy recovery, deadline recovery and the predecessor timer. After installing lean restore, all 14 recovery tests pass, including twenty updates retaining two images and one database copy. This is functional build-host evidence, not VM timing evidence. RED verbatim: test result: FAILED. 7 passed; 7 failed; 0 ignored; 0 measured; 299 filtered out; finished in 6.55s Green verbatim: test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 299 filtered out; finished in 3.70s [RED](https://git.kayg.org/attachments/33e2fb59-97c9-45fc-9794-6c49b555d49b) · [green](https://git.kayg.org/attachments/7424380d-6115-424a-a8cb-0af0b42c12f9) Focused all-target Clippy then stopped on a 114-line prepare function and a parser entry point after the inline test module. Extracted the single online-copy operation and moved parser/test declarations; rerun queued. No commit/push or final gate claim yet. VM acceptance, size deltas and native qualification remain pending.
kayg commented 2026-10-16 11:51:33 +00:00
Author
Owner
Copy link

Updated continuation source archive, superseding the earlier UNCOMPILED/RED draft. Restoration is now installed; the 14-test passing receipt is above. Since that receipt: extracted online-copy helper for Clippy, fixed declaration ordering, explicitly selected DELETE journaling for the standalone copy, and strengthened the twenty-update disk-byte assertion. These final deltas still await the focused rerun (queued PID 411603, session 64610). Resume helper d295-post-green-gate.sh acquires build-slot and runs only the post-green checks; NEVER replay the earlier RED mutation driver.

Current green recovery source, pending lint/integration qualification

No new shipping commit yet; rebased HEAD remains bf5547593. No final gate, size or VM acceptance is claimed.

Updated continuation source archive, superseding the earlier UNCOMPILED/RED draft. Restoration is now installed; the 14-test passing receipt is above. Since that receipt: extracted online-copy helper for Clippy, fixed declaration ordering, explicitly selected DELETE journaling for the standalone copy, and strengthened the twenty-update disk-byte assertion. These final deltas still await the focused rerun (queued PID 411603, session 64610). Resume helper d295-post-green-gate.sh acquires build-slot and runs only the post-green checks; NEVER replay the earlier RED mutation driver. [Current green recovery source, pending lint/integration qualification](https://git.kayg.org/attachments/2685ed31-7553-4568-a6ce-308142b9fa46) No new shipping commit yet; rebased HEAD remains bf5547593. No final gate, size or VM acceptance is claimed.
kayg commented 2026-10-16 12:46:27 +00:00
Author
Owner
Copy link

D295 scheduling risk: the current focused/iterate driver (PID 932481, session 9620) has been queued for 16:23. Earlier admissions also waited roughly 23 and 38 minutes. These are scheduling receipts, not performance measurements. First 14 recovery tests passed; a later all-target Clippy pass and API tests passed, then added RED assertions reproduced rollback-pause loss and clean-exit restart coverage. Fixes are in the worktree; the rerun is awaiting capacity. No slot limit was bypassed and no other job was stopped. Signed staging, shipping size, native qualification, final fast and atomic commits/push remain outstanding. The 1–2 day target depends on enough build and perf-lock capacity for those remaining gates. Continuing autonomously.

D295 scheduling risk: the current focused/iterate driver (PID 932481, session 9620) has been queued for 16:23. Earlier admissions also waited roughly 23 and 38 minutes. These are scheduling receipts, not performance measurements. First 14 recovery tests passed; a later all-target Clippy pass and API tests passed, then added RED assertions reproduced rollback-pause loss and clean-exit restart coverage. Fixes are in the worktree; the rerun is awaiting capacity. No slot limit was bypassed and no other job was stopped. Signed staging, shipping size, native qualification, final fast and atomic commits/push remain outstanding. The 1–2 day target depends on enough build and perf-lock capacity for those remaining gates. Continuing autonomously.
kayg commented 2026-10-16 12:48:39 +00:00
Author
Owner
Copy link

Additional failing-first findings and source repairs (rerun pending):

  1. Restoring the previous database lost the explicit rollback pause. The real SQLite test failed with ignored_version=None instead of 2.0.0 (13 passed / 1 failed). Transition::restore_rollback now reinstates the source version as ignored using release-owned metadata only.
  2. The installed service used Restart=on-failure, which leaves a candidate that exits 0 before check-in stopped. The rendering assertion failed. Release-enabled services now use Restart=always, including the staging unit; explicit manager stops retain normal stop behavior.
  3. The new Inbox fixture called an explicit apply without queuing a request; corrected it to model automatic application. Two existing CLI resource tests also required INFRATERNAL_TEST_STATE_ROOT, missing from my focused driver. The driver now exports its owned scratch root. A temporary Cargo configuration override used during diagnosis has been restored; no configuration change remains.

Rollback-pause RED · Restart RED, including the two fixture-environment failures. API check passed: 39 unit tests (1 ignored) + 2 integration tests, including the bounded disk-refusal acknowledgement: receipt. Build-host runner durations are operational logs only.

Current managed gate: PID 932481 / session 9620, source-repair request path scratch/d295-repair.request. Green source has all repairs; no final acceptance or shipping commit is claimed yet.

Additional failing-first findings and source repairs (rerun pending): 1. Restoring the previous database lost the explicit rollback pause. The real SQLite test failed with ignored_version=None instead of 2.0.0 (13 passed / 1 failed). Transition::restore_rollback now reinstates the source version as ignored using release-owned metadata only. 2. The installed service used Restart=on-failure, which leaves a candidate that exits 0 before check-in stopped. The rendering assertion failed. Release-enabled services now use Restart=always, including the staging unit; explicit manager stops retain normal stop behavior. 3. The new Inbox fixture called an explicit apply without queuing a request; corrected it to model automatic application. Two existing CLI resource tests also required INFRATERNAL_TEST_STATE_ROOT, missing from my focused driver. The driver now exports its owned scratch root. A temporary Cargo configuration override used during diagnosis has been restored; no configuration change remains. [Rollback-pause RED](https://git.kayg.org/attachments/4ea09fea-44e4-4841-aea4-3a6c2c237ec1) · [Restart RED, including the two fixture-environment failures](https://git.kayg.org/attachments/c4435a83-b33b-40af-91da-da80d73f4860). API check passed: 39 unit tests (1 ignored) + 2 integration tests, including the bounded disk-refusal acknowledgement: [receipt](https://git.kayg.org/attachments/6b2e5602-1a47-4637-8b18-c3b88391a47f). Build-host runner durations are operational logs only. Current managed gate: PID 932481 / session 9620, source-repair request path scratch/d295-repair.request. Green source has all repairs; no final acceptance or shipping commit is claimed yet.
kayg commented 2026-10-16 13:13:22 +00:00
Author
Owner
Copy link

D295 recovery is pushed through 7ef436eeb, rebased on dev 41a3a81ab. Rejected drafts remain local only on edge-autoupdate-recovery-drafts (5f39b7e0a).

Atomic steps: 7bde610fd shared exact-file hashing; 08be619cd bounded disk-full reply; 8700101f9 existing SQLite backup bridge feature; 3e20c0a3c reverse-transition validation/pause preservation; 9fe01279e final-admission capture and check-in-before-collection; b95f4201c persistent undone-update Inbox; a82b58f5e one-copy recovery; 7ef436eeb stable service restart path/health deadline. No new encryption or recovery supervisor.

Current focused gates: API 39 unit + 2 integration pass (1 ignored); release 36 unit + 3 integration pass (3 ignored); recovery 14 pass; server release 26 pass (4 ignored); CLI 83 pass (1 ignored); touched crates Clippy pass. Recovery covers real SQLite migrations, WAL-only committed data, interrupted publication/restoration, disk-full refusal, explicit rollback and 20 updates (2 images + 1 copy).

Receipts: recovery, release, CLI, Clippy.

Iterate: fmt, VT fmt, CLI compile-out, Clippy, cargo-deny PASS; workspace test FAIL: 534 passed, 1 failed, 51 ignored. Only failure is responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment at socket_clock.rs:87, observed-event watchdog. Detached origin/dev baseline comparison queued in the same host-load window; no waiver claimed. Staging migration assertions/parser fuzz/docs remain uncommitted pending their gates. VM acceptance, both shipping sizes/native qualification, final fast remain required; scheduling/build-slot contention threatens the 1–2 day target.

D295 recovery is pushed through 7ef436eeb, rebased on dev 41a3a81ab. Rejected drafts remain local only on edge-autoupdate-recovery-drafts (5f39b7e0a). Atomic steps: 7bde610fd shared exact-file hashing; 08be619cd bounded disk-full reply; 8700101f9 existing SQLite backup bridge feature; 3e20c0a3c reverse-transition validation/pause preservation; 9fe01279e final-admission capture and check-in-before-collection; b95f4201c persistent undone-update Inbox; a82b58f5e one-copy recovery; 7ef436eeb stable service restart path/health deadline. No new encryption or recovery supervisor. Current focused gates: API 39 unit + 2 integration pass (1 ignored); release 36 unit + 3 integration pass (3 ignored); recovery 14 pass; server release 26 pass (4 ignored); CLI 83 pass (1 ignored); touched crates Clippy pass. Recovery covers real SQLite migrations, WAL-only committed data, interrupted publication/restoration, disk-full refusal, explicit rollback and 20 updates (2 images + 1 copy). Receipts: [recovery](https://git.kayg.org/attachments/8831ae86-30df-447d-8777-2bb2d2cc3a4a), [release](https://git.kayg.org/attachments/ac7d4bfa-9538-4652-9c64-b2b8b5df1018), [CLI](https://git.kayg.org/attachments/1bddda30-6e66-436e-bfe5-2f48cdb6627e), [Clippy](https://git.kayg.org/attachments/7fcbdb64-b9b1-41bd-93f5-96b4ed7082a2). Iterate: fmt, VT fmt, CLI compile-out, Clippy, cargo-deny PASS; workspace test FAIL: 534 passed, 1 failed, 51 ignored. Only failure is responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment at socket_clock.rs:87, observed-event watchdog. Detached origin/dev baseline comparison queued in the same host-load window; no waiver claimed. Staging migration assertions/parser fuzz/docs remain uncommitted pending their gates. VM acceptance, both shipping sizes/native qualification, final fast remain required; scheduling/build-slot contention threatens the 1–2 day target.
kayg commented 2026-10-16 13:30:07 +00:00
Author
Owner
Copy link

Author review at c0f1e1ff0 found two additional recovery ordering edges; tests are uncommitted and queued to fail before fixes:

  1. update_recovery.rs prepare currently replaces the last committed marker with Prepared; dropping an unarmed Guard removes it. Thus cancelling a later update can discard the metadata needed to roll back the last healthy update. Test cancelled_preparation_and_kernel_refusal_preserve_the_last_committed_rollback covers cancellation, kernel refusal and abandon. Prepared fix keeps the copy in the guard until arm, preserves the prior committed marker on cancellation/fallback, and consumes an inherited copy fd even when fallback restores an absent marker.
  2. write_marker serializes without enforcing the decoder’s 16 KiB ceiling. Two valid escaped filesystem paths can expand past it. Test oversized_marker_publication_never_replaces_a_readable_intent requires refusal before replacing the readable intent.

Pending fix source is outside the checkout at ~/.cache/codex-scratch/edge-autoupdate/d295-cancellation-{update-recovery,release-startup}.rs; apply only after the RED receipt. Build-slot queue exceeds 16 minutes. The managed driver d295-qualification.sh runs baseline comparison, RED, a bounded five-minute repair window, then GREEN/iterate, both shipping builds, current-dev baseline build, staging preparation and parser fuzzing. No new production or performance claim. Docs pushed at c0f1e1ff0.

Author review at c0f1e1ff0 found two additional recovery ordering edges; tests are uncommitted and queued to fail before fixes: 1. update_recovery.rs prepare currently replaces the last committed marker with Prepared; dropping an unarmed Guard removes it. Thus cancelling a later update can discard the metadata needed to roll back the last healthy update. Test cancelled_preparation_and_kernel_refusal_preserve_the_last_committed_rollback covers cancellation, kernel refusal and abandon. Prepared fix keeps the copy in the guard until arm, preserves the prior committed marker on cancellation/fallback, and consumes an inherited copy fd even when fallback restores an absent marker. 2. write_marker serializes without enforcing the decoder’s 16 KiB ceiling. Two valid escaped filesystem paths can expand past it. Test oversized_marker_publication_never_replaces_a_readable_intent requires refusal before replacing the readable intent. Pending fix source is outside the checkout at ~/.cache/codex-scratch/edge-autoupdate/d295-cancellation-{update-recovery,release-startup}.rs; apply only after the RED receipt. Build-slot queue exceeds 16 minutes. The managed driver d295-qualification.sh runs baseline comparison, RED, a bounded five-minute repair window, then GREEN/iterate, both shipping builds, current-dev baseline build, staging preparation and parser fuzzing. No new production or performance claim. Docs pushed at c0f1e1ff0.
kayg commented 2026-10-16 13:48:28 +00:00
Author
Owner
Copy link

Three additional D295 regressions reproduced before their fixes: 14 pass / 3 fail. RED receipt.

Failures: cancelled preparation deletes the previous healthy marker; oversized escaped paths publish an intent the bounded reader rejects; after a later failed update, rollback of the last healthy update refuses despite its retained database copy. Fix applied, not yet committed: publish only at final arm; preserve the previous marker on cancel/kernel refusal/abandon; consume inherited descriptors even when fallback restores no marker; bound serialized marker publication; pin/hash the private retained rollback copy independently of a later attempt’s marker. Signed image selection remains the caller’s existing verified path. No new encryption or supervisor.

Baseline comparison first rejected an unsupported feature flag (dev has no backup feature); corrected to dev’s remote feature and currently building. This harness error is not a baseline test result. Own allocated slot is sequencing that comparison before the green/iterate run. Rust qualification began after ~31 minutes queued.

Existing publication admission: 14 pass (receipt); staging artifacts: 3 pass (receipt). No new VM timing or acceptance claim.

Three additional D295 regressions reproduced before their fixes: 14 pass / 3 fail. [RED receipt](https://git.kayg.org/attachments/8fe94d24-f830-40e9-b98c-289b899d9610). Failures: cancelled preparation deletes the previous healthy marker; oversized escaped paths publish an intent the bounded reader rejects; after a later failed update, rollback of the last healthy update refuses despite its retained database copy. Fix applied, not yet committed: publish only at final arm; preserve the previous marker on cancel/kernel refusal/abandon; consume inherited descriptors even when fallback restores no marker; bound serialized marker publication; pin/hash the private retained rollback copy independently of a later attempt’s marker. Signed image selection remains the caller’s existing verified path. No new encryption or supervisor. Baseline comparison first rejected an unsupported feature flag (dev has no backup feature); corrected to dev’s remote feature and currently building. This harness error is not a baseline test result. Own allocated slot is sequencing that comparison before the green/iterate run. Rust qualification began after ~31 minutes queued. Existing publication admission: 14 pass ([receipt](https://git.kayg.org/attachments/2620d0fb-d125-4d1e-92bb-f804211fa5e8)); staging artifacts: 3 pass ([receipt](https://git.kayg.org/attachments/dfa708ee-483e-4495-b78d-4b5dc121b95b)). No new VM timing or acceptance claim.
kayg commented 2026-10-16 14:03:06 +00:00
Author
Owner
Copy link

Qualification correction: sharing a Cargo target between the detached dev checkout and this worktree reused incompatible local protocol artifacts (missing infraternal_protocol::machine). Discarded the contaminated green/iterate outputs, invalidated workspace artifacts, and assigned future baseline builds their own target-baseline directory. The earlier completed baseline socket receipt remains the comparison: exact same observed-event watchdog failure as the branch (links below).

The rebuild then stalled on the host’s shared compiler cache: 29 sccache processes and no rustc process were present. Disabled RUSTC_WRAPPER only in this job’s managed driver (same pinned compiler/flags), stopped only this job’s waiting clients, and resumed in the already allocated build slot. No shared cache daemon or other job was stopped. Current driver: ~/.cache/codex-scratch/edge-autoupdate/d295-no-cache-resume.sh. Recovery GREEN, clean iterate, sizes, VM acceptance and final fast are still pending.

dev baseline socket; branch iterate. Both fail only responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment with “socket test stopped before its observed event”; baseline at socket_clock.rs:81, branch at :87. Applying the brief’s explicit baseline exception to this failure only.

Qualification correction: sharing a Cargo target between the detached dev checkout and this worktree reused incompatible local protocol artifacts (missing infraternal_protocol::machine). Discarded the contaminated green/iterate outputs, invalidated workspace artifacts, and assigned future baseline builds their own target-baseline directory. The earlier completed baseline socket receipt remains the comparison: exact same observed-event watchdog failure as the branch (links below). The rebuild then stalled on the host’s shared compiler cache: 29 sccache processes and no rustc process were present. Disabled RUSTC_WRAPPER only in this job’s managed driver (same pinned compiler/flags), stopped only this job’s waiting clients, and resumed in the already allocated build slot. No shared cache daemon or other job was stopped. Current driver: ~/.cache/codex-scratch/edge-autoupdate/d295-no-cache-resume.sh. Recovery GREEN, clean iterate, sizes, VM acceptance and final fast are still pending. [dev baseline socket](https://git.kayg.org/attachments/108743a3-2f11-4077-89a4-a052672c59ed); [branch iterate](https://git.kayg.org/attachments/cba5094b-8c35-4405-9f37-1121627dd21d). Both fail only responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment with “socket test stopped before its observed event”; baseline at socket_clock.rs:81, branch at :87. Applying the brief’s explicit baseline exception to this failure only.
kayg commented 2026-10-16 14:06:42 +00:00
Author
Owner
Copy link

Pushed 1ac528e18: transactional marker publication/fallback, bounded marker serialization, and rollback after a failed later image. All 17 real SQLite recovery tests pass (GREEN); the three failures before fixes are attached above. Clean fmt and workspace/all-target Clippy pass. Full iterate tests are running under the allocated build slot with RUSTC_WRAPPER disabled only for this job. Staging test assertions and parser fuzz harness remain uncommitted pending their dedicated gates. No VM acceptance, shipping-size or final-fast claim yet.

Pushed 1ac528e18: transactional marker publication/fallback, bounded marker serialization, and rollback after a failed later image. All 17 real SQLite recovery tests pass ([GREEN](https://git.kayg.org/attachments/710eb5d9-e530-40d9-85fb-e9af7c8754e5)); the three failures before fixes are attached above. Clean fmt and workspace/all-target Clippy pass. Full iterate tests are running under the allocated build slot with RUSTC_WRAPPER disabled only for this job. Staging test assertions and parser fuzz harness remain uncommitted pending their dedicated gates. No VM acceptance, shipping-size or final-fast claim yet.
kayg commented 2026-10-16 14:22:14 +00:00
Author
Owner
Copy link

Harness correction, no product change: the clean iterate run had 535 server passes and 3 setup-token failures from SUN_LEN. TMPDIR was the long job directory; a first shortened root still produced 111-byte paths. The exclusively created job-owned alias ~/.cache/codex-scratch/ea (marker .edge-autoupdate-owned) produces 107-byte paths. With TMPDIR set there, the workspace runtime filter passes 47 tests, 4 ignored, including all three setup-token regressions (receipt).

The unkeyed staging compile was refused by its public-authority build guard. Removed that invalid invocation; staging-proof --prepare-only will create its ephemeral in-memory fixture signer, supply only the public build key and compile the correct harness. This is not a signed-path bypass or a test pass.

Current managed driver /.cache/codex-scratch/edge-autoupdate/d295-qualification-v3.sh; RUSTC_WRAPPER empty, INFRATERNAL_TEST_STATE_ROOT=/.cache/codex-scratch/e211, TMPDIR=~/.cache/codex-scratch/ea. Full iterate running, then shipping builds, isolated dev target-baseline build, signed staging preparation and parser fuzz. Head still pushed 1ac528e18. Final fast and VM receipts remain outstanding.

Harness correction, no product change: the clean iterate run had 535 server passes and 3 setup-token failures from SUN_LEN. TMPDIR was the long job directory; a first shortened root still produced 111-byte paths. The exclusively created job-owned alias ~/.cache/codex-scratch/ea (marker .edge-autoupdate-owned) produces 107-byte paths. With TMPDIR set there, the workspace runtime filter passes 47 tests, 4 ignored, including all three setup-token regressions ([receipt](https://git.kayg.org/attachments/1345d2ec-a54f-405c-9590-05b6a0f2207b)). The unkeyed staging compile was refused by its public-authority build guard. Removed that invalid invocation; staging-proof --prepare-only will create its ephemeral in-memory fixture signer, supply only the public build key and compile the correct harness. This is not a signed-path bypass or a test pass. Current managed driver ~/.cache/codex-scratch/edge-autoupdate/d295-qualification-v3.sh; RUSTC_WRAPPER empty, INFRATERNAL_TEST_STATE_ROOT=~/.cache/codex-scratch/e211, TMPDIR=~/.cache/codex-scratch/ea. Full iterate running, then shipping builds, isolated dev target-baseline build, signed staging preparation and parser fuzz. Head still pushed 1ac528e18. Final fast and VM receipts remain outstanding.
kayg commented 2026-10-16 14:32:59 +00:00
Author
Owner
Copy link

Clean scripts/verify iterate PASS at 1ac528e18; full transcript. Server tests: 538 passed, 0 failed, 51 ignored. All Rust gate rows pass; TypeScript/Svelte checks pass. This run needs no baseline waiver. This is not the final fast gate.

Pushed 2de5e165b separately: enable the existing release feature in the fuzz harness dependency; no new package/engine. Marker target and documentation await the instrumented run. Normal production x86_64 and ARM builds are underway, then an isolated dev baseline build and signed staging preparation.

Native qualification is prespecified as 20 alternating-order interleaved A/B pairs (100 samples per phase), using fresh production-recipe artifacts against dev 41a3a81ab. This exceeds the required 10 pairs because the older diagnostic ten-pair confidence interval did not rule out a one-frame regression. Preserve all original budget failures and paired intervals; do not turn a matching baseline failure into an unqualified budget PASS. Every measurement will run under the perf-VM lock; no build-host performance evidence.

Clean scripts/verify iterate PASS at 1ac528e18; [full transcript](https://git.kayg.org/attachments/dd3aa2fa-ff34-4fc6-9cd1-6c1d6d617c7c). Server tests: 538 passed, 0 failed, 51 ignored. All Rust gate rows pass; TypeScript/Svelte checks pass. This run needs no baseline waiver. This is not the final fast gate. Pushed 2de5e165b separately: enable the existing release feature in the fuzz harness dependency; no new package/engine. Marker target and documentation await the instrumented run. Normal production x86_64 and ARM builds are underway, then an isolated dev baseline build and signed staging preparation. Native qualification is prespecified as 20 alternating-order interleaved A/B pairs (100 samples per phase), using fresh production-recipe artifacts against dev 41a3a81ab. This exceeds the required 10 pairs because the older diagnostic ten-pair confidence interval did not rule out a one-frame regression. Preserve all original budget failures and paired intervals; do not turn a matching baseline failure into an unqualified budget PASS. Every measurement will run under the perf-VM lock; no build-host performance evidence.
kayg commented 2026-10-16 14:48:37 +00:00
Author
Owner
Copy link

Further author-review finding in 1ac528e18: manual rollback now hashes the retained copy afresh. A valid SQLite copy modified since capture would be blessed by that new hash; quick_check cannot establish the original bytes. Added failing-first real-SQLite regression a_changed_but_valid_rollback_copy_is_refused_after_a_later_failure; awaiting the active ARM build before running it in the allocated slot.

Proposed narrow internal format change before implementation: retain ONE prior healthy copy coordinate (version + original SHA-256) in the existing small transaction marker while a later attempt is armed/undone. Verify against that original digest on rollback; clear the older coordinate only at successful check-in. One JSON marker, existing online copy and hasher; no additional file, encryption, supervisor or certificate recovery. Bump the unpublished update compatibility note from format 1 to 2 so incompatible predecessors refuse before exec. All staging images will be rebuilt with matching format-2 support. The generic private-resource contract and signed release format are unchanged.

Normal pre-fix x86_64 shipping artifact: 20,833,408 B vs dev cap 21,422,096 B (-588,688 B), production-trust PASS, stripped static PIE, no PT_INTERP. This artifact is NOT the final qualified head: checksum retention will be gated and both shipping artifacts rebuilt. No size ceiling raised; no optimization profile change planned. Current driver will continue through d295-integrity-slice.sh after the ARM loop, with a behavioral-RED guard before applying the prepared fix.

Further author-review finding in 1ac528e18: manual rollback now hashes the retained copy afresh. A valid SQLite copy modified since capture would be blessed by that new hash; quick_check cannot establish the original bytes. Added failing-first real-SQLite regression a_changed_but_valid_rollback_copy_is_refused_after_a_later_failure; awaiting the active ARM build before running it in the allocated slot. Proposed narrow internal format change before implementation: retain ONE prior healthy copy coordinate (version + original SHA-256) in the existing small transaction marker while a later attempt is armed/undone. Verify against that original digest on rollback; clear the older coordinate only at successful check-in. One JSON marker, existing online copy and hasher; no additional file, encryption, supervisor or certificate recovery. Bump the unpublished update compatibility note from format 1 to 2 so incompatible predecessors refuse before exec. All staging images will be rebuilt with matching format-2 support. The generic private-resource contract and signed release format are unchanged. Normal pre-fix x86_64 shipping artifact: 20,833,408 B vs dev cap 21,422,096 B (-588,688 B), production-trust PASS, stripped static PIE, no PT_INTERP. This artifact is NOT the final qualified head: checksum retention will be gated and both shipping artifacts rebuilt. No size ceiling raised; no optimization profile change planned. Current driver will continue through d295-integrity-slice.sh after the ARM loop, with a behavioral-RED guard before applying the prepared fix.
kayg commented 2026-10-16 15:19:32 +00:00
Author
Owner
Copy link

Pushed 09999225d: retain the original rollback checksum through a failed later attempt; one bounded coordinate in the existing marker, cleared at successful check-in. Manual rollback and offline undo share exact-file checksum admission. Compatibility note format 2; no new file, encryption or supervisor.

Changed-but-valid SQLite copy reproduced before the fix (RED); all 18 recovery tests pass after it (GREEN). Full suite: 539 server passes / 0 failures / 51 ignored. The initial 117-line function Clippy failure was repaired by sharing checksum admission and factoring marker-coordinate selection; fresh workspace/all-target Clippy passes (receipt).

Fresh normal production-recipe artifacts at this head: x86_64 20,835,264 B (-586,832 vs dev cap), ARM 19,136,400 B (-458,456). Original-checksum fix cost +1,856 / +1,936 B against the prior build. Both pass production-trust checks and contain update format 2; recipe and SHA-256s attached. No cap or optimization profile raised. Final downward size ratchet will follow acceptance.

UI/backend copy remains: ready item/toast “Update ready · ”, controls “Update now” / “Roll back”; failure “Update to failed and was undone”; disk refusal “Not enough disk space to copy the database before updating”. Rollback restores the database copy from before that upgrade, so later database changes are undone (D155). Healthy handoff retains unlocked CA custody; a cold crash restart leaves it locked (D168/D295). UI work remains deferred.

Isolated dev baseline build running; signed VM acceptance, native pairs, parser fuzz and final fast remain outstanding.

Pushed 09999225d: retain the original rollback checksum through a failed later attempt; one bounded coordinate in the existing marker, cleared at successful check-in. Manual rollback and offline undo share exact-file checksum admission. Compatibility note format 2; no new file, encryption or supervisor. Changed-but-valid SQLite copy reproduced before the fix ([RED](https://git.kayg.org/attachments/b676d90f-5b0a-4f36-9dcd-60054b3de879)); all 18 recovery tests pass after it ([GREEN](https://git.kayg.org/attachments/7dd9da42-5f78-480a-a2ef-aa38c44ceadc)). Full suite: 539 server passes / 0 failures / 51 ignored. The initial 117-line function Clippy failure was repaired by sharing checksum admission and factoring marker-coordinate selection; fresh workspace/all-target Clippy passes ([receipt](https://git.kayg.org/attachments/a8d4eaf9-a66f-4092-8c7b-fba55f77003a)). Fresh normal production-recipe artifacts at this head: x86_64 20,835,264 B (-586,832 vs dev cap), ARM 19,136,400 B (-458,456). Original-checksum fix cost +1,856 / +1,936 B against the prior build. Both pass production-trust checks and contain update format 2; recipe and SHA-256s [attached](https://git.kayg.org/attachments/51fe3170-7ad1-4115-979c-e63728d79110). No cap or optimization profile raised. Final downward size ratchet will follow acceptance. UI/backend copy remains: ready item/toast “Update ready · <version>”, controls “Update now” / “Roll back”; failure “Update to <version> failed and was undone”; disk refusal “Not enough disk space to copy the database before updating”. Rollback restores the database copy from before that upgrade, so later database changes are undone (D155). Healthy handoff retains unlocked CA custody; a cold crash restart leaves it locked (D168/D295). UI work remains deferred. Isolated dev baseline build running; signed VM acceptance, native pairs, parser fuzz and final fast remain outstanding.
kayg commented 2026-10-16 16:27:21 +00:00
Author
Owner
Copy link

Resuming D295 on edge-autoupdate. Prior head 0490aff70; rebased cleanly onto origin/dev 1bcb7a87b, current head dc9e778681. Preserved the two uncommitted staging-test files. Existing 18 recovery tests and restore-before-open path will be requalified. Latest VM fixture stops on the first post-stage input acknowledgement (offset 29, last seen 2); no new acceptance or timing claim. Detailed logs stay in scratch, console reads limited to summaries. Next: isolate input continuity, complete migration/restore staging, sizes/native qualification and final fast via build-slot. No production deployment.

Resuming D295 on edge-autoupdate. Prior head 0490aff70; rebased cleanly onto origin/dev 1bcb7a87b, current head dc9e77868188a287916f509d81024daad5751fb1. Preserved the two uncommitted staging-test files. Existing 18 recovery tests and restore-before-open path will be requalified. Latest VM fixture stops on the first post-stage input acknowledgement (offset 29, last seen 2); no new acceptance or timing claim. Detailed logs stay in scratch, console reads limited to summaries. Next: isolate input continuity, complete migration/restore staging, sizes/native qualification and final fast via build-slot. No production deployment.
kayg commented 2026-10-16 16:37:16 +00:00
Author
Owner
Copy link

Rebased head dc9e77868 includes dev healthy-route scheduling fix 1819a23b7; retained staging images predate it and cannot qualify the rebased branch. Focused recovery suite: 18 passed / 0 failed. The first staging filter omitted remote and matched 0 tests; discarded as evidence. Corrected failing-first idle-pump test is queued through build-slot. Author review identified permanent pump using Browser::read's 15-second application-output deadline during deliberate 20-second idle intervals; dedicated virtual-clock regression is pending. Existing VM runs remain failed, no acceptance claim. Build-slot contention remains a schedule risk for the 1–2 day target.

Rebased head dc9e77868 includes dev healthy-route scheduling fix 1819a23b7; retained staging images predate it and cannot qualify the rebased branch. Focused recovery suite: 18 passed / 0 failed. The first staging filter omitted remote and matched 0 tests; discarded as evidence. Corrected failing-first idle-pump test is queued through build-slot. Author review identified permanent pump using Browser::read's 15-second application-output deadline during deliberate 20-second idle intervals; dedicated virtual-clock regression is pending. Existing VM runs remain failed, no acceptance claim. Build-slot contention remains a schedule risk for the 1–2 day target.
kayg commented 2026-10-16 17:02:28 +00:00
Author
Owner
Copy link

Pushed a75761b80 on edge-autoupdate after rebasing onto dev 1bcb7a87b. Atomic fixture-only fix: permanent application pump no longer applies the assertion reader's 15-second output deadline during healthy quiet intervals; assertion waits remain bounded. Virtual-clock test reproduced before repair (0 pass / 1 fail), then all six pump tests pass, including acknowledgement consumption after silence. Browser loop test 1 pass; touched-server remote/all-target Clippy pass. Earlier zero-match module filter is discarded, not a green suite.

resume-idle-red-remote.log

resume-fixed-pump-tests.log
resume-fixed-clippy.log

Rebased SQLite recovery suite remains 18 pass / 0 fail: resume-recovery.log

Fresh signed staging image SHA-256 4aaa212462309fe97630be1f9c492f4bbab15b30545b1eeb9d5118e0e9a62aae; full 128-route + managed-host VM acceptance is waiting for the perf lock. Ordinary-trust sizes/native qualification and final fast remain pending. No production deployment.

Pushed a75761b80 on edge-autoupdate after rebasing onto dev 1bcb7a87b. Atomic fixture-only fix: permanent application pump no longer applies the assertion reader's 15-second output deadline during healthy quiet intervals; assertion waits remain bounded. Virtual-clock test reproduced before repair (0 pass / 1 fail), then all six pump tests pass, including acknowledgement consumption after silence. Browser loop test 1 pass; touched-server remote/all-target Clippy pass. Earlier zero-match module filter is discarded, not a green suite. [resume-idle-red-remote.log](https://git.kayg.org/attachments/9dcb52dd-6a80-412a-9894-7db7865c830d) [resume-fixed-pump-tests.log](https://git.kayg.org/attachments/befd74c8-5cbd-4328-994f-90399371502e) [resume-fixed-clippy.log](https://git.kayg.org/attachments/c5f398ab-0b88-4539-b5c5-935b51f81d70) Rebased SQLite recovery suite remains 18 pass / 0 fail: [resume-recovery.log](https://git.kayg.org/attachments/c20d9089-935c-469e-85e7-369951278dac) Fresh signed staging image SHA-256 4aaa212462309fe97630be1f9c492f4bbab15b30545b1eeb9d5118e0e9a62aae; full 128-route + managed-host VM acceptance is waiting for the perf lock. Ordinary-trust sizes/native qualification and final fast remain pending. No production deployment.
kayg commented 2026-10-16 17:09:17 +00:00
Author
Owner
Copy link

Pushed 7136a54ad: staging service now starts through the installed stable link with Restart=always, drops its fixture-only SQLite connection before offline restoration, and asserts failed-update Inbox copy plus removal of the successor migration and compatibility with the old migration set. Production recovery wiring is unchanged.

Perf VM route-isolation run: 50 users, 10,000 nodes, 128 real PTYs / 128 attached routes. Main scenario PASS (1/1); browser-service control PASS (1/1). Typing observed until 60,879.325 ms; quiet application at 124,228.559 ms; final-input-to-apply 63,349.235 ms against configured 60 s. Rollback 3,302.803 ms; Update now 3,377.748 ms; real migrated-successor failure restored the predecessor and database in 4,723.099 ms. All 128 shim PIDs survive. Healthy swaps keep CA unlocked; cold failure restart locks it as D295/D168 require. Listener probes DISABLED in this isolation run: its zero-gap fields are not gap evidence.

The earlier combined managed-host run is retained as FAILED before staging: fourth attached route received a server-level close (frame_refused, 3 existing attachments). Not waived as noise. Combined 128-route + managed-host + listener-probe retry is underway; if it recurs, fixed-label diagnostics are prepared outside the checkout.

resume-staging-routes-vm.log
resume-staging-full-vm.log

Ordinary-trust builds, native pairs, downward size ratchet and final fast are pending. No production deployment.

Pushed 7136a54ad: staging service now starts through the installed stable link with Restart=always, drops its fixture-only SQLite connection before offline restoration, and asserts failed-update Inbox copy plus removal of the successor migration and compatibility with the old migration set. Production recovery wiring is unchanged. Perf VM route-isolation run: 50 users, 10,000 nodes, 128 real PTYs / 128 attached routes. Main scenario PASS (1/1); browser-service control PASS (1/1). Typing observed until 60,879.325 ms; quiet application at 124,228.559 ms; final-input-to-apply 63,349.235 ms against configured 60 s. Rollback 3,302.803 ms; Update now 3,377.748 ms; real migrated-successor failure restored the predecessor and database in 4,723.099 ms. All 128 shim PIDs survive. Healthy swaps keep CA unlocked; cold failure restart locks it as D295/D168 require. Listener probes DISABLED in this isolation run: its zero-gap fields are not gap evidence. The earlier combined managed-host run is retained as FAILED before staging: fourth attached route received a server-level close (frame_refused, 3 existing attachments). Not waived as noise. Combined 128-route + managed-host + listener-probe retry is underway; if it recurs, fixed-label diagnostics are prepared outside the checkout. [resume-staging-routes-vm.log](https://git.kayg.org/attachments/39609be3-536b-4782-92ae-6b2372e431bf) [resume-staging-full-vm.log](https://git.kayg.org/attachments/4d53681e-ef1f-4467-bc5e-d7ac07adc06f) Ordinary-trust builds, native pairs, downward size ratchet and final fast are pending. No production deployment.
kayg commented 2026-10-16 17:15:42 +00:00
Author
Owner
Copy link

Combined retry progressed past all 128 attachments and the quiet server swap, then the fixture's 90-second host convergence wait elapsed before download completion. VM progress: no receiving file at 70,005.812 ms; 7,487,488 of 20,875,773 bytes present at 80,036.953 ms. This is a fixture deadline including reconnect + verified transfer, not the production post-exec check-in deadline. Preparing a bounded 180-second functional wait so the real transfer can finish; the production thirty-second host watchdog and 120-second server health deadline stay unchanged. No throughput or final host-convergence pass is claimed yet. Earlier combined attachment refusal remains recorded. Fresh harness will rerun under the perf lock.

Combined retry progressed past all 128 attachments and the quiet server swap, then the fixture's 90-second host convergence wait elapsed before download completion. VM progress: no receiving file at 70,005.812 ms; 7,487,488 of 20,875,773 bytes present at 80,036.953 ms. This is a fixture deadline including reconnect + verified transfer, not the production post-exec check-in deadline. Preparing a bounded 180-second functional wait so the real transfer can finish; the production thirty-second host watchdog and 120-second server health deadline stay unchanged. No throughput or final host-convergence pass is claimed yet. Earlier combined attachment refusal remains recorded. Fresh harness will rerun under the perf lock.
kayg commented 2026-10-16 17:18:01 +00:00
Author
Owner
Copy link

Perf VM listener regression PASS at pushed head 7136a54ad (same signed staging bytes as the 128-route recovery proof): 128 live PTYs, 128 surviving shim PIDs, CA unlocked, 0 refused TCP probes, observed listener-gap bracket 0.000 ms, maximum probe interval 5.313 ms, measured four-RTT + 50 ms allowance 52.290 ms. The isolated listener case has no active attached routes; combined attached-route/listener/managed-host acceptance is still pending.

Rebased iterate failed only pty::child_locale_tests::spawned_login_shell_receives_selected_locale_without_other_host_variables (selected locale assertion); its package had 82 pass / 1 fail / 13 ignored. fmt, VT fmt, CLI compile-out, Clippy and cargo-deny pass. No waiver: rerun the locale regression with this job's isolated ZDOTDIR profile before the final full gate. Owner startup files are not read or changed.

resume-listener-vm.log
resume-staging-combined2-vm.log
resume-iterate.log

Production ordinary-trust builds remain running in the allocated slot; both size deltas, native pairs and final fast are outstanding.

Perf VM listener regression PASS at pushed head 7136a54ad (same signed staging bytes as the 128-route recovery proof): 128 live PTYs, 128 surviving shim PIDs, CA unlocked, 0 refused TCP probes, observed listener-gap bracket 0.000 ms, maximum probe interval 5.313 ms, measured four-RTT + 50 ms allowance 52.290 ms. The isolated listener case has no active attached routes; combined attached-route/listener/managed-host acceptance is still pending. Rebased iterate failed only pty::child_locale_tests::spawned_login_shell_receives_selected_locale_without_other_host_variables (selected locale assertion); its package had 82 pass / 1 fail / 13 ignored. fmt, VT fmt, CLI compile-out, Clippy and cargo-deny pass. No waiver: rerun the locale regression with this job's isolated ZDOTDIR profile before the final full gate. Owner startup files are not read or changed. [resume-listener-vm.log](https://git.kayg.org/attachments/6782dab9-df74-43a0-a1c8-2669ca2261dd) [resume-staging-combined2-vm.log](https://git.kayg.org/attachments/787bfe48-0552-48d9-997c-5a7abbceba8e) [resume-iterate.log](https://git.kayg.org/attachments/f89e4348-79f5-4e97-b095-98a7aad287cd) Production ordinary-trust builds remain running in the allocated slot; both size deltas, native pairs and final fast are outstanding.
kayg commented 2026-10-16 17:40:19 +00:00
Author
Owner
Copy link

D295 staging found an additional continuity edge after rollback: the managed host follows B in 12,825.277 ms with the same daemon/shim PIDs, then follows A's signed image, but its new terminal echo times out after the database rollback (managed_update_staging_tests.rs:464). The server database restores terminal_writers' AUTOINCREMENT state while the surviving shim keeps post-backup writer cursors. A newly allocated writer can therefore reuse an identifier already used by a different browser after the snapshot, and the shim can trim new input as a duplicate. Preparing a focused real-SQLite failing test before the repair. This is distinct from the pending 128-route acknowledgement diagnostic.

Proposed narrow internal change before implementation: keep a monotonic terminal-writer high-water mark in the EXISTING small D295 transaction marker; reserve bounded ID blocks durably before committing new writer rows, merge the watermark under the marker's publication lock, and advance SQLite's writer sequence before serving a restored database. No extra recovery file, database copy, encryption, supervisor or CA/TLS restoration. Existing signed image admission remains unchanged; bump the unpublished private recovery compatibility note if the required marker field changes. Normal typing gains no work; measure attachment effects at 128 routes on the perf VM.

The ordinary images remain x86_64 20,835,264 B and ARM 19,136,400 B, but they precede this repair. Stopped the preliminary native A/B runner by its owned PID; its partial receipts will be preserved, not claimed as final qualification. New shipping images and interleaved pairs must follow the repair. This newly exposed D128/D295 interaction threatens the 1–2 day target; keeping the fix confined to the existing marker/allocator path.

D295 staging found an additional continuity edge after rollback: the managed host follows B in 12,825.277 ms with the same daemon/shim PIDs, then follows A's signed image, but its new terminal echo times out after the database rollback (managed_update_staging_tests.rs:464). The server database restores terminal_writers' AUTOINCREMENT state while the surviving shim keeps post-backup writer cursors. A newly allocated writer can therefore reuse an identifier already used by a different browser after the snapshot, and the shim can trim new input as a duplicate. Preparing a focused real-SQLite failing test before the repair. This is distinct from the pending 128-route acknowledgement diagnostic. Proposed narrow internal change before implementation: keep a monotonic terminal-writer high-water mark in the EXISTING small D295 transaction marker; reserve bounded ID blocks durably before committing new writer rows, merge the watermark under the marker's publication lock, and advance SQLite's writer sequence before serving a restored database. No extra recovery file, database copy, encryption, supervisor or CA/TLS restoration. Existing signed image admission remains unchanged; bump the unpublished private recovery compatibility note if the required marker field changes. Normal typing gains no work; measure attachment effects at 128 routes on the perf VM. The ordinary images remain x86_64 20,835,264 B and ARM 19,136,400 B, but they precede this repair. Stopped the preliminary native A/B runner by its owned PID; its partial receipts will be preserved, not claimed as final qualification. New shipping images and interleaved pairs must follow the repair. This newly exposed D128/D295 interaction threatens the 1–2 day target; keeping the fix confined to the existing marker/allocator path.
kayg commented 2026-10-16 18:04:04 +00:00
Author
Owner
Copy link

Writer reuse now reproduced behaviorally before repair: real SQLite backup/undo allocates the same ID retained by the live-terminal model (0 pass / 1 fail). resume-writer-red.log

First repaired recovery run: 24 passed / 0 failed. resume-writer-green.log

Uncommitted fix uses only the existing transaction marker: 4096-ID durable reservations, monotonic merge under the marker publication mutex, and SQLite sequence fencing before serving a restored or restarted database. Reservation precedes the writer-row commit; steady typing has no new work. No extra recovery file/copy, encryption, supervisor or CA restoration. Private unpublished update note/marker format 3; mixed formats refuse before handoff. Tests cover stale phase publication, healthy restart, retained-copy undo, invalid metadata, exhaustion and absence of an update record. Offline restore also removes an old rollback journal before the atomic database replacement.

The first Clippy pass found only function-length limits in startup and prepare; factored the existing selection step and reused the private SQLite-file checker. Fresh focused tests/Clippy plus signed format-3 staging are queued. A new perf-VM-only 128-writer WAL/NORMAL benchmark will compare direct inserts, no update record and committed-marker reservations. The 128-route durable-ack stall remains under fixed-label diagnosis; no native or final-gate pass claimed.
resume-staging-convergence-vm.log
resume-transport-vm.log
resume-locale-isolated.log

Writer reuse now reproduced behaviorally before repair: real SQLite backup/undo allocates the same ID retained by the live-terminal model (0 pass / 1 fail). [resume-writer-red.log](https://git.kayg.org/attachments/d2f44beb-8756-4055-9004-802ea0f5fec4) First repaired recovery run: 24 passed / 0 failed. [resume-writer-green.log](https://git.kayg.org/attachments/5fed984f-19cd-4cb3-9395-b7a4ef2a1163) Uncommitted fix uses only the existing transaction marker: 4096-ID durable reservations, monotonic merge under the marker publication mutex, and SQLite sequence fencing before serving a restored or restarted database. Reservation precedes the writer-row commit; steady typing has no new work. No extra recovery file/copy, encryption, supervisor or CA restoration. Private unpublished update note/marker format 3; mixed formats refuse before handoff. Tests cover stale phase publication, healthy restart, retained-copy undo, invalid metadata, exhaustion and absence of an update record. Offline restore also removes an old rollback journal before the atomic database replacement. The first Clippy pass found only function-length limits in startup and prepare; factored the existing selection step and reused the private SQLite-file checker. Fresh focused tests/Clippy plus signed format-3 staging are queued. A new perf-VM-only 128-writer WAL/NORMAL benchmark will compare direct inserts, no update record and committed-marker reservations. The 128-route durable-ack stall remains under fixed-label diagnosis; no native or final-gate pass claimed. [resume-staging-convergence-vm.log](https://git.kayg.org/attachments/6aacf0b5-f9ad-46fd-adb2-95e7c41ee16b) [resume-transport-vm.log](https://git.kayg.org/attachments/314078a0-1237-4530-a005-f0390a0bd21c) [resume-locale-isolated.log](https://git.kayg.org/attachments/d3f390e0-1caa-4ccc-a05a-f4001aa76ab5)
kayg commented 2026-10-16 18:28:09 +00:00
Author
Owner
Copy link

Additional bounded-disk regression reproduced before repair: after a later failed attempt is undone and the healthy predecessor checks in, its failed-attempt preimage remains beside the current binary in addition to the older healthy rollback copy. Test healthy_predecessor_checkin_keeps_only_the_retained_rollback_copy reproduced (0 pass / 1 fail). Repair reuses check-in cleanup to remove only that redundant current-image preimage after a durable undone marker; the older verified rollback copy remains.

Current focused SQLite recovery suite: 25 passed / 0 failed / 1 ignored (the new perf-only counter benchmark). Server remote+staging/all-target Clippy PASS after reusing Marker::needs_entry and the existing private SQLite-file checker plus factoring startup selection. resume-redundant-copy-red.log
resume-writer-green.log

Format-3 staging build with fixed-label input receipts is running in build-slot. Temporary receipt changes remain uncommitted and will be removed before ordinary shipping qualification. Current driver: ~/.cache/codex-scratch/edge-autoupdate/resume-writer-complete-build.sh; its writer-reuse and redundant-copy RED guards have ALREADY run and repairs are applied—do not replay that RED/apply prefix on resumption. The prior partial native receipts are preserved under evidence/pre-writer-reservation-native and are not final qualification. Next: counter overhead/rollback echo on the locked VM, pinpoint 128-route acknowledgement stall, atomically commit/push the tested slices, then new sizes/native pairs and final fast.

Additional bounded-disk regression reproduced before repair: after a later failed attempt is undone and the healthy predecessor checks in, its failed-attempt preimage remains beside the current binary in addition to the older healthy rollback copy. Test healthy_predecessor_checkin_keeps_only_the_retained_rollback_copy reproduced (0 pass / 1 fail). Repair reuses check-in cleanup to remove only that redundant current-image preimage after a durable undone marker; the older verified rollback copy remains. Current focused SQLite recovery suite: 25 passed / 0 failed / 1 ignored (the new perf-only counter benchmark). Server remote+staging/all-target Clippy PASS after reusing Marker::needs_entry and the existing private SQLite-file checker plus factoring startup selection. [resume-redundant-copy-red.log](https://git.kayg.org/attachments/c981036c-2471-4016-83c7-65ec7197ecb2) [resume-writer-green.log](https://git.kayg.org/attachments/ea5c3226-fba3-45a9-a608-94912238b1e9) Format-3 staging build with fixed-label input receipts is running in build-slot. Temporary receipt changes remain uncommitted and will be removed before ordinary shipping qualification. Current driver: ~/.cache/codex-scratch/edge-autoupdate/resume-writer-complete-build.sh; its writer-reuse and redundant-copy RED guards have ALREADY run and repairs are applied—do not replay that RED/apply prefix on resumption. The prior partial native receipts are preserved under evidence/pre-writer-reservation-native and are not final qualification. Next: counter overhead/rollback echo on the locked VM, pinpoint 128-route acknowledgement stall, atomically commit/push the tested slices, then new sizes/native pairs and final fast.
kayg commented 2026-10-16 18:57:43 +00:00
Author
Owner
Copy link

Head 78b313a4f pushed: public operational transition metadata can be cloned for serialized atomic marker publication. Release tests 39 passed, CLI 83 passed; touched release/CLI all-target Clippy passed. Recovery implementation and tests are still uncommitted.

Format-3 staging fixture (instrumented, not final shipping qualification): full managed update scenario passed at 128 real PTYs/attached routes, 50 users and 10,000 nodes. Host follow/rollback, quiet window, typing deferral, immediate apply, startup refusal, and schema-change recovery all passed. 128 shim PIDs survived; CA remained unlocked during healthy switches. Listener: zero failed probes, bracket gap 0.000 ms, maximum probe interval 25.510 ms. Refused host startup restored in 30,550.049 ms from observed refusal; server schema-failure recovery 4,920.517 ms.

Separate transport128 still stalls. Trace follows the unmatched input through server/backend forwarding, with no backend acknowledgement. Native shim State replies can subsume cumulative InputAck; daemon currently forwards only probe Pong and discards State.written. Adding a deterministic Unix-socket regression before repair; no protocol change or timeout relaxation. Temporary server tracing has now been removed.

fmt3-managed-vm.log
fmt3-transport-vm.log

Head 78b313a4f pushed: public operational transition metadata can be cloned for serialized atomic marker publication. Release tests 39 passed, CLI 83 passed; touched release/CLI all-target Clippy passed. Recovery implementation and tests are still uncommitted. Format-3 staging fixture (instrumented, not final shipping qualification): full managed update scenario passed at 128 real PTYs/attached routes, 50 users and 10,000 nodes. Host follow/rollback, quiet window, typing deferral, immediate apply, startup refusal, and schema-change recovery all passed. 128 shim PIDs survived; CA remained unlocked during healthy switches. Listener: zero failed probes, bracket gap 0.000 ms, maximum probe interval 25.510 ms. Refused host startup restored in 30,550.049 ms from observed refusal; server schema-failure recovery 4,920.517 ms. Separate transport128 still stalls. Trace follows the unmatched input through server/backend forwarding, with no backend acknowledgement. Native shim State replies can subsume cumulative InputAck; daemon currently forwards only probe Pong and discards State.written. Adding a deterministic Unix-socket regression before repair; no protocol change or timeout relaxation. Temporary server tracing has now been removed. [fmt3-managed-vm.log](https://git.kayg.org/attachments/5c703604-277c-4f8b-88d0-89bba3deeae6) [fmt3-transport-vm.log](https://git.kayg.org/attachments/baeb4e5e-d97e-4a2a-8d4f-894a99d0b0af)
kayg commented 2026-10-16 19:00:44 +00:00
Author
Owner
Copy link

Deterministic failing-first native Unix-socket regression reproduced the transport input stall: shim InputState(2,2) legally subsumes InputAck(2), but the daemon emits only Pong. The browser's durable acknowledgement never advances while liveness remains healthy. Test terminal_probe_preserves_coalesced_input_progress_without_duplicate_acks failed at the expected cursor assertion before repair.

Patch forwards advancing cumulative State.written before Pong, also handling a parked-link relink; unchanged probes do not generate duplicate Acks. Explicit output/replay rebinds retain their mandatory acknowledgements. No wire/schema change, no expanded timeout. Daemon tests and all-target remote+release Clippy are queued; VM transport acceptance must be repeated with a new uninstrumented artifact.

resume-fence-red.log

Deterministic failing-first native Unix-socket regression reproduced the transport input stall: shim InputState(2,2) legally subsumes InputAck(2), but the daemon emits only Pong. The browser's durable acknowledgement never advances while liveness remains healthy. Test terminal_probe_preserves_coalesced_input_progress_without_duplicate_acks failed at the expected cursor assertion before repair. Patch forwards advancing cumulative State.written before Pong, also handling a parked-link relink; unchanged probes do not generate duplicate Acks. Explicit output/replay rebinds retain their mandatory acknowledgements. No wire/schema change, no expanded timeout. Daemon tests and all-target remote+release Clippy are queued; VM transport acceptance must be repeated with a new uninstrumented artifact. [resume-fence-red.log](https://git.kayg.org/attachments/6d8131ae-8fda-4fbb-8181-b6d0336087cc)
kayg commented 2026-10-16 19:04:12 +00:00
Author
Owner
Copy link

Committed and pushed 3602d39e5: cumulative shim State progress now reaches the server before probe Pong and after parked-link reconnect. Direct shim acknowledgements and mandatory replay/rebind acknowledgements retain their existing delivery semantics; unchanged idle State probes add no duplicate acknowledgement.

Failing-first regression was reproduced before repair. Final native daemon feature-enabled suite: 113 passed / 0 failed / 14 ignored. Remote+release all-target Clippy PASS; formatting PASS. These are functional checks, not VM latency qualification. New ordinary staging artifacts are next.

resume-fence-final-tests.log
resume-fence-final-clippy.log

Committed and pushed 3602d39e5: cumulative shim State progress now reaches the server before probe Pong and after parked-link reconnect. Direct shim acknowledgements and mandatory replay/rebind acknowledgements retain their existing delivery semantics; unchanged idle State probes add no duplicate acknowledgement. Failing-first regression was reproduced before repair. Final native daemon feature-enabled suite: 113 passed / 0 failed / 14 ignored. Remote+release all-target Clippy PASS; formatting PASS. These are functional checks, not VM latency qualification. New ordinary staging artifacts are next. [resume-fence-final-tests.log](https://git.kayg.org/attachments/5d80b958-6faf-4cfe-9264-8642f34ab151) [resume-fence-final-clippy.log](https://git.kayg.org/attachments/f1560002-be0d-45e6-ae1c-6df42c81f7be)
kayg commented 2026-10-16 19:06:47 +00:00
Author
Owner
Copy link

Committed and pushed feae8c482: format-3 recovery marker durably reserves terminal writer IDs before row commit; startup/restore floor the sequence and phase publication merges concurrent reservations. Reuses the existing marker, backup and private-file paths. Removes stale rollback journals before database reopen. No new encryption, supervisor, dependency or terminal Input writes.

Per-commit gates: formatting PASS; existing real-SQLite recovery suite 18 passed / 0 failed; server remote all-target Clippy PASS. New failing-first identity regressions are being committed separately next. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-writer-module-{fmt,tests,clippy}.log. VM counter/transport and ordinary shipping sizes still pending.

Committed and pushed feae8c482: format-3 recovery marker durably reserves terminal writer IDs before row commit; startup/restore floor the sequence and phase publication merges concurrent reservations. Reuses the existing marker, backup and private-file paths. Removes stale rollback journals before database reopen. No new encryption, supervisor, dependency or terminal Input writes. Per-commit gates: formatting PASS; existing real-SQLite recovery suite 18 passed / 0 failed; server remote all-target Clippy PASS. New failing-first identity regressions are being committed separately next. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-writer-module-{fmt,tests,clippy}.log. VM counter/transport and ordinary shipping sizes still pending.
kayg commented 2026-10-16 19:08:00 +00:00
Author
Owner
Copy link

Committed and pushed c26a20b77: six real-SQLite writer identity regressions cover undo with surviving shim cursors, retained-copy rollback, healthy restart/stale phase publication, refusal before unreadable reservation commit, exhaustion, and absent/in-memory marker behavior. Failing-first original case receipt is attached above.

Per-commit gates: formatting PASS; recovery suite 24 passed / 0 failed; server remote all-target Clippy PASS. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-writer-regressions-{fmt,tests,clippy}.log. Next independent step removes redundant failed-attempt preimages only after healthy predecessor check-in.

Committed and pushed c26a20b77: six real-SQLite writer identity regressions cover undo with surviving shim cursors, retained-copy rollback, healthy restart/stale phase publication, refusal before unreadable reservation commit, exhaustion, and absent/in-memory marker behavior. Failing-first original case receipt is attached above. Per-commit gates: formatting PASS; recovery suite 24 passed / 0 failed; server remote all-target Clippy PASS. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-writer-regressions-{fmt,tests,clippy}.log. Next independent step removes redundant failed-attempt preimages only after healthy predecessor check-in.
kayg commented 2026-10-16 19:10:50 +00:00
Author
Owner
Copy link

Committed and pushed 2adb68940: healthy predecessor check-in retires the redundant failed-attempt preimage after durable undo; the older healthy verified rollback copy remains. The focused regression failed before repair (receipt attached above).

Per-commit gates: formatting PASS; recovery suite 25 passed / 0 failed; server remote all-target Clippy PASS. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-copy-cleanup-{fmt,tests,clippy}.log. No extra recovery process, identity restoration or encryption was introduced. Next are release-profile VM measurement and new uninstrumented staging qualification.

Committed and pushed 2adb68940: healthy predecessor check-in retires the redundant failed-attempt preimage after durable undo; the older healthy verified rollback copy remains. The focused regression failed before repair (receipt attached above). Per-commit gates: formatting PASS; recovery suite 25 passed / 0 failed; server remote all-target Clippy PASS. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-copy-cleanup-{fmt,tests,clippy}.log. No extra recovery process, identity restoration or encryption was introduced. Next are release-profile VM measurement and new uninstrumented staging qualification.
kayg commented 2026-10-16 19:15:57 +00:00
Author
Owner
Copy link

Committed and pushed a3492d17d: writer-cost benchmark uses ten alternating-order waves of 128 real SQLite writers in three admission modes. The staging tool requires --release-harness for this case, records cache profile, refuses profile mismatch, and measures under the locked VM scope with CPUWeight=10000. Receipts include debug_assertions so a debug diagnostic cannot be mistaken for final qualification.

Per-commit gates: formatting PASS; recovery suite 25 passed / 0 failed / 1 ignored (VM-only benchmark); server remote all-target Clippy PASS; three artifact functional tests PASS; actual debug writer-cost invocation refused with ValueError before build/VM work. No new timing result yet. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-benchmark-*.log.

Committed and pushed a3492d17d: writer-cost benchmark uses ten alternating-order waves of 128 real SQLite writers in three admission modes. The staging tool requires --release-harness for this case, records cache profile, refuses profile mismatch, and measures under the locked VM scope with CPUWeight=10000. Receipts include debug_assertions so a debug diagnostic cannot be mistaken for final qualification. Per-commit gates: formatting PASS; recovery suite 25 passed / 0 failed / 1 ignored (VM-only benchmark); server remote all-target Clippy PASS; three artifact functional tests PASS; actual debug writer-cost invocation refused with ValueError before build/VM work. No new timing result yet. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-benchmark-*.log.
kayg commented 2026-10-16 19:20:44 +00:00
Author
Owner
Copy link

Committed and pushed 3d39279a6: managed-host fixture separates functional transfer convergence from the existing post-exec watchdog, and requires observed refusal-to-restoration within 45 seconds. Shipping watchdogs stay unchanged. The earlier full format-3 VM proof observed 30.55 seconds from refusal (attached above); final uninstrumented proof is next.

Per-commit gates: formatting PASS; server remote+staging-trust all-target Clippy PASS; deploy_staging::updates 6 passed / 0 failed. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-managed-{clippy,tests}.log.

Committed and pushed b38ab871b: operational documentation now explains durable writer reservations and failed-attempt preimage retirement. Source tree is clean. Fresh release-profile signed staging preparation is running under build-slot; its queued VM driver runs transport128 first, then writer cost, managed recovery/listener acceptance and retention under the exclusive perf lock. Final ordinary sizes/native A/B and scripts/verify fast remain pending.

Committed and pushed 3d39279a6: managed-host fixture separates functional transfer convergence from the existing post-exec watchdog, and requires observed refusal-to-restoration within 45 seconds. Shipping watchdogs stay unchanged. The earlier full format-3 VM proof observed 30.55 seconds from refusal (attached above); final uninstrumented proof is next. Per-commit gates: formatting PASS; server remote+staging-trust all-target Clippy PASS; deploy_staging::updates 6 passed / 0 failed. Logs: ~/.cache/codex-scratch/edge-autoupdate/evidence/resume-managed-{clippy,tests}.log. Committed and pushed b38ab871b: operational documentation now explains durable writer reservations and failed-attempt preimage retirement. Source tree is clean. Fresh release-profile signed staging preparation is running under build-slot; its queued VM driver runs transport128 first, then writer cost, managed recovery/listener acceptance and retention under the exclusive perf lock. Final ordinary sizes/native A/B and scripts/verify fast remain pending.
kayg commented 2026-10-16 19:23:33 +00:00
Author
Owner
Copy link

Resume state at b38ab871b (clean, pushed): all source repairs are committed. Do NOT rerun resume-commit-chain.sh from the beginning: its temporary test extraction steps have already been committed. Active build-slot continuation is resume-commit-chain-continue.sh, currently preparing fresh uninstrumented signed fixtures with --release-harness under resume-fence-staging. Its progress receipt is evidence/resume-commit-chain.log; success ends with Uninstrumented release-profile staging prepared.

Queued lightweight drivers: resume-final-vm.py waits for that marker, then runs transport128 → writer-cost → full managed recovery/listener proof → retention under the perf lock, saving final--vm.log and driver logs. resume-final-production-wait.py then runs resume-final-production.sh through build-slot: isolated-shell iterate, ordinary production-trust x86/ARM artifacts, exact sizes/hashes. resume-final-native-wait.py starts the fixed twenty-pair AB/BA qualification only after ordinary artifacts exist and transport128 passes; native pair receipts use resume-native-pair-.log. Baseline remains detached dev 1bcb7a87b; original preliminary pre-repair receipts remain under evidence/pre-writer-reservation-native and are not final evidence.

Prepared but NOT started: resume-final-cap-and-fast.sh ratchets both exact measured caps, commits/pushes, then runs scripts/verify fast on that head through build-slot. Inspect ordinary artifact measurements first. Current remaining work: inspect fresh VM acceptance, native pairs/CI, exact size deltas, cap ratchet and final fast; attach receipts and quote final gate summary verbatim; stop for independent break-it review. No merge/deploy.

Resume state at b38ab871b (clean, pushed): all source repairs are committed. Do NOT rerun resume-commit-chain.sh from the beginning: its temporary test extraction steps have already been committed. Active build-slot continuation is resume-commit-chain-continue.sh, currently preparing fresh uninstrumented signed fixtures with --release-harness under resume-fence-staging. Its progress receipt is evidence/resume-commit-chain.log; success ends with Uninstrumented release-profile staging prepared. Queued lightweight drivers: resume-final-vm.py waits for that marker, then runs transport128 → writer-cost → full managed recovery/listener proof → retention under the perf lock, saving final-*-vm.log and driver logs. resume-final-production-wait.py then runs resume-final-production.sh through build-slot: isolated-shell iterate, ordinary production-trust x86/ARM artifacts, exact sizes/hashes. resume-final-native-wait.py starts the fixed twenty-pair AB/BA qualification only after ordinary artifacts exist and transport128 passes; native pair receipts use resume-native-pair-*.log. Baseline remains detached dev 1bcb7a87b; original preliminary pre-repair receipts remain under evidence/pre-writer-reservation-native and are not final evidence. Prepared but NOT started: resume-final-cap-and-fast.sh ratchets both exact measured caps, commits/pushes, then runs scripts/verify fast on that head through build-slot. Inspect ordinary artifact measurements first. Current remaining work: inspect fresh VM acceptance, native pairs/CI, exact size deltas, cap ratchet and final fast; attach receipts and quote final gate summary verbatim; stop for independent break-it review. No merge/deploy.
kayg commented 2026-10-16 19:40:40 +00:00
Author
Owner
Copy link

Fresh uninstrumented signed staging preparation completed at source b38ab871b. Public cache: ~/.cache/codex-scratch/edge-autoupdate/resume-fence-staging/public-transfer-9f2b6f47. Harness profile is release. Staged x86 artifact: 20,888,224 bytes, SHA256 c84cfc8f1a3f6b6ca1f48b595cd1b8bf98ccfc530722cb8b16f044df38da1844. This is a staging-trust image, not the ordinary production size result.

VM transport128 is now queued/running against that exact cache. Additional exact attachment/listener review cases are queued by resume-final-review-vm.py after the main VM qualification driver; receipt evidence/resume-final-review-vm-driver.log. Ordinary-trust iterate/build is queued independently via build-slot. Worktree clean; no extra source changes from the checklist review. First-update snapshot allocation is protected by the existing BEGIN IMMEDIATE ConfigurationLease held through preparation and handoff (updater.rs and local_update::admit_inner); the WAL snapshot regression exercises that reservation.

Fresh uninstrumented signed staging preparation completed at source b38ab871b. Public cache: ~/.cache/codex-scratch/edge-autoupdate/resume-fence-staging/public-transfer-9f2b6f47. Harness profile is release. Staged x86 artifact: 20,888,224 bytes, SHA256 c84cfc8f1a3f6b6ca1f48b595cd1b8bf98ccfc530722cb8b16f044df38da1844. This is a staging-trust image, not the ordinary production size result. VM transport128 is now queued/running against that exact cache. Additional exact attachment/listener review cases are queued by resume-final-review-vm.py after the main VM qualification driver; receipt evidence/resume-final-review-vm-driver.log. Ordinary-trust iterate/build is queued independently via build-slot. Worktree clean; no extra source changes from the checklist review. First-update snapshot allocation is protected by the existing BEGIN IMMEDIATE ConfigurationLease held through preparation and handoff (updater.rs and local_update::admit_inner); the WAL snapshot regression exercises that reservation.
kayg commented 2026-10-16 19:43:03 +00:00
Author
Owner
Copy link

Fresh source b38ab871b / public-transfer-9f2b6f47 release-profile VM qualification:

Transport128 PASS: 50 users, 10,000 nodes, 128 real PTYs and attached routes, 13 browser sockets. All 1,024 durable input acknowledgements completed. p50 1.124 ms; p99 5.396 ms; maximum 33.338 ms; existing p99 budget 50 ms. The prior indefinite stall is absent after forwarding cumulative State progress. No timeout or budget was relaxed.

Writer reservation benchmark completed on the locked perf VM under CPUWeight=10000, release profile, debug_assertions=false, SQLite WAL/NORMAL. Ten alternating-order waves of 128 new writers per mode (1,280 allocations/mode):

  • Direct allocation: per-writer p50 98.638 us / p99 889.196 us; 128-writer wave p50 16.121 ms / p99 22.893 ms.
  • Reservation API without marker: p50 139.750 us / p99 407.477 us; wave p50 20.100 ms / p99 23.030 ms.
  • Committed marker: p50 153.815 us / p99 822.576 us; wave p50 47.218 ms / p99 56.563 ms. First durable reservation maximum (10 waves) 34.615 ms.

Cost is confined to new writer admission: median per-writer increase 55.177 us and median 128-writer wave increase 31.097 ms versus direct allocation. One durable reservation covers 4,096 identities; terminal Input adds no marker writes. This cost prevents reuse of surviving shim cursors after database undo; existing-route transport remains below its budget. No separate writer-cost budget is asserted, and native latency A/B qualification remains pending.

Machine: authorized perf VM 10.69.69.208, 4 CPUs, MemTotal 8,069,112 kB. Writer-run load before 3.92/1.71/0.79, after 3.06/1.67/0.79. Full managed recovery/listener proof is running next; exact routes/reconnect cases are also queued.

final-transport-vm.log
final-writer-cost-vm.log

Fresh source b38ab871b / public-transfer-9f2b6f47 release-profile VM qualification: Transport128 PASS: 50 users, 10,000 nodes, 128 real PTYs and attached routes, 13 browser sockets. All 1,024 durable input acknowledgements completed. p50 1.124 ms; p99 5.396 ms; maximum 33.338 ms; existing p99 budget 50 ms. The prior indefinite stall is absent after forwarding cumulative State progress. No timeout or budget was relaxed. Writer reservation benchmark completed on the locked perf VM under CPUWeight=10000, release profile, debug_assertions=false, SQLite WAL/NORMAL. Ten alternating-order waves of 128 new writers per mode (1,280 allocations/mode): - Direct allocation: per-writer p50 98.638 us / p99 889.196 us; 128-writer wave p50 16.121 ms / p99 22.893 ms. - Reservation API without marker: p50 139.750 us / p99 407.477 us; wave p50 20.100 ms / p99 23.030 ms. - Committed marker: p50 153.815 us / p99 822.576 us; wave p50 47.218 ms / p99 56.563 ms. First durable reservation maximum (10 waves) 34.615 ms. Cost is confined to new writer admission: median per-writer increase 55.177 us and median 128-writer wave increase 31.097 ms versus direct allocation. One durable reservation covers 4,096 identities; terminal Input adds no marker writes. This cost prevents reuse of surviving shim cursors after database undo; existing-route transport remains below its budget. No separate writer-cost budget is asserted, and native latency A/B qualification remains pending. Machine: authorized perf VM 10.69.69.208, 4 CPUs, MemTotal 8,069,112 kB. Writer-run load before 3.92/1.71/0.79, after 3.06/1.67/0.79. Full managed recovery/listener proof is running next; exact routes/reconnect cases are also queued. [final-transport-vm.log](https://git.kayg.org/attachments/58c09c03-3344-4e94-97fb-4dd08640d12c) [final-writer-cost-vm.log](https://git.kayg.org/attachments/568def0a-590a-4b53-8d68-7c184f2f46c6)
kayg commented 2026-10-16 19:49:47 +00:00
Author
Owner
Copy link

Fresh release-profile managed staging proof PASS at b38ab871b/public-transfer-9f2b6f47: 50 users, 10,000 nodes, 128 attached real PTYs, rootless UID1000 managed host. All 128 shim PIDs survived healthy switches and schema-failure recovery.

Quiet application was deferred by continued accepted input: ready-to-apply 123,853.265 ms, typing observed through 60,713.424 ms, last-input-to-apply 63,139.841 ms against the configured 60,000 ms quiet window. Healthy switches retained unlocked CA custody. Listener monitoring observed zero refused probes; sampled gap bracket 0.000 ms, maximum probe interval 18.925 ms (review reconnect allowance 92.2 ms).

Host followed B → A → B over the verified path. Verified host startup refusal D was restored automatically to B in 30,369.713 ms from observed refusal, with the same PTY shim. Server E made a real schema change and then stopped before check-in: stable restart restored the database before old migrations opened it, posted the exact undo Inbox item, removed the new probe table, and retained all 128 shims. Cold recovery took 4,568.190 ms; CA was locked after the cold restart as D168/D295 require.

The fixture's rollback and Update now timers include host convergence and 128-route custody verification: respectively 17,104.345 ms and 92,261.186 ms; they are end-to-end recovery figures, not pure server switch time. Update now used configured quiet_minutes=5. The queued server-only attachment and listener review cases provide separate server measurements. Retention and native A/B qualification plus ordinary sizes/final gate remain pending.

final-managed-vm.log

Fresh release-profile managed staging proof PASS at b38ab871b/public-transfer-9f2b6f47: 50 users, 10,000 nodes, 128 attached real PTYs, rootless UID1000 managed host. All 128 shim PIDs survived healthy switches and schema-failure recovery. Quiet application was deferred by continued accepted input: ready-to-apply 123,853.265 ms, typing observed through 60,713.424 ms, last-input-to-apply 63,139.841 ms against the configured 60,000 ms quiet window. Healthy switches retained unlocked CA custody. Listener monitoring observed zero refused probes; sampled gap bracket 0.000 ms, maximum probe interval 18.925 ms (review reconnect allowance 92.2 ms). Host followed B → A → B over the verified path. Verified host startup refusal D was restored automatically to B in 30,369.713 ms from observed refusal, with the same PTY shim. Server E made a real schema change and then stopped before check-in: stable restart restored the database before old migrations opened it, posted the exact undo Inbox item, removed the new probe table, and retained all 128 shims. Cold recovery took 4,568.190 ms; CA was locked after the cold restart as D168/D295 require. The fixture's rollback and Update now timers include host convergence and 128-route custody verification: respectively 17,104.345 ms and 92,261.186 ms; they are end-to-end recovery figures, not pure server switch time. Update now used configured quiet_minutes=5. The queued server-only attachment and listener review cases provide separate server measurements. Retention and native A/B qualification plus ordinary sizes/final gate remain pending. [final-managed-vm.log](https://git.kayg.org/attachments/14b55b75-6564-4055-a06c-ac3433823fac)
kayg commented 2026-10-16 19:52:10 +00:00
Author
Owner
Copy link

Fresh VM retention review PASS at b38ab871b/public-transfer-9f2b6f47: five superseding prepared versions leave one selectable ready image and one retained executable (20,888,253 bytes including the staging version suffix). The real-SQLite twenty-update test separately verifies healthy current/previous images plus one database copy; the failed-later-attempt regression verifies redundant preimage removal after predecessor check-in. Both are in the 25-test passing recovery suite.

Main VM driver completed all four cases with exit 0: transport128, release-profile writer cost, full managed recovery/listener proof, and retention. Exact review routes/reconnect cases are now running separately. Build-host iterate has passed into workspace functional tests; ordinary shipping sizes and fixed twenty-pair native qualification remain pending, followed by cap ratchet/final fast.

final-retention-vm.log

Fresh VM retention review PASS at b38ab871b/public-transfer-9f2b6f47: five superseding prepared versions leave one selectable ready image and one retained executable (20,888,253 bytes including the staging version suffix). The real-SQLite twenty-update test separately verifies healthy current/previous images plus one database copy; the failed-later-attempt regression verifies redundant preimage removal after predecessor check-in. Both are in the 25-test passing recovery suite. Main VM driver completed all four cases with exit 0: transport128, release-profile writer cost, full managed recovery/listener proof, and retention. Exact review routes/reconnect cases are now running separately. Build-host iterate has passed into workspace functional tests; ordinary shipping sizes and fixed twenty-pair native qualification remain pending, followed by cap ratchet/final fast. [final-retention-vm.log](https://git.kayg.org/attachments/805169de-4192-4a8a-a86a-599fbb4f2560)
kayg commented 2026-10-16 19:55:48 +00:00
Author
Owner
Copy link

All six fresh release-profile VM cases completed with exit 0 at b38ab871b/public-transfer-9f2b6f47: transport128, writer-cost, managed recovery/listener proof, retention, exact review attachment/routes, exact review reconnect.

Exact attachment case: 128 real PTYs and attached routes. Typing deferred the configured one-minute quiet interval; last-input-to-apply 63,206.501 ms. Server-only Roll back plus custody checks: 3,006.240 ms; Update now plus custody checks: 3,100.753 ms. These omit the managed-host convergence waits included in the broader proof above.

Exact reconnect review: 128 live PTYs and surviving shims, CA unlocked, zero failed listener probes, gap bracket/lower bound 0.000 ms, maximum probe interval 5.786 ms. Its freshly calibrated four-RTT-plus-50-ms allowance was 51.155 ms (tighter than the earlier 92.2 ms review figure). This qualifies listener queue availability, not a claimed TLS handshake latency.

Build-host workspace functional tests are still running in scripts/verify iterate; ordinary production sizes and the fixed twenty-pair native comparison follow. Final fast/head/caps are still pending; no completion claim yet.

final-routes-vm.log
final-reconnect-vm.log

All six fresh release-profile VM cases completed with exit 0 at b38ab871b/public-transfer-9f2b6f47: transport128, writer-cost, managed recovery/listener proof, retention, exact review attachment/routes, exact review reconnect. Exact attachment case: 128 real PTYs and attached routes. Typing deferred the configured one-minute quiet interval; last-input-to-apply 63,206.501 ms. Server-only Roll back plus custody checks: 3,006.240 ms; Update now plus custody checks: 3,100.753 ms. These omit the managed-host convergence waits included in the broader proof above. Exact reconnect review: 128 live PTYs and surviving shims, CA unlocked, zero failed listener probes, gap bracket/lower bound 0.000 ms, maximum probe interval 5.786 ms. Its freshly calibrated four-RTT-plus-50-ms allowance was 51.155 ms (tighter than the earlier 92.2 ms review figure). This qualifies listener queue availability, not a claimed TLS handshake latency. Build-host workspace functional tests are still running in scripts/verify iterate; ordinary production sizes and the fixed twenty-pair native comparison follow. Final fast/head/caps are still pending; no completion claim yet. [final-routes-vm.log](https://git.kayg.org/attachments/59428494-bc04-4a3e-8a21-1b78b8233dce) [final-reconnect-vm.log](https://git.kayg.org/attachments/2f03e087-ef70-4b64-b52e-55acf1306f8b)
kayg commented 2026-10-16 19:59:55 +00:00
Author
Owner
Copy link

scripts/verify iterate PASS at b38ab871b through build-slot with isolated job ZDOTDIR, RUSTC_WRAPPER unset, TRACER_TEST_PORT=4418 and all build/test state under job scratch. Rust summary verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
+---------------------------+--------------+

TypeScript/compiler/production bundle/protocol checks also completed. Final line verbatim:

ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done.

No host-load baseline exception was needed. Ordinary production-trust x86 and ARM builds are running next; then fixed twenty-pair native A/B, exact size ratchet and final scripts/verify fast on branch head. All six fresh VM acceptance/review cases passed as recorded above.

resume-final-iterate.log

scripts/verify iterate PASS at b38ab871b through build-slot with isolated job ZDOTDIR, RUSTC_WRAPPER unset, TRACER_TEST_PORT=4418 and all build/test state under job scratch. Rust summary verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | +---------------------------+--------------+ ``` TypeScript/compiler/production bundle/protocol checks also completed. Final line verbatim: ```text ITERATE gate passed. This is not the final gate: run scripts/verify fast before reporting done. ``` No host-load baseline exception was needed. Ordinary production-trust x86 and ARM builds are running next; then fixed twenty-pair native A/B, exact size ratchet and final scripts/verify fast on branch head. All six fresh VM acceptance/review cases passed as recorded above. [resume-final-iterate.log](https://git.kayg.org/attachments/baecdffc-60bb-4b43-9f5f-fe574daa9649)
kayg commented 2026-10-16 20:10:27 +00:00
Author
Owner
Copy link

Ordinary production-trust builds PASS at source b38ab871b (unchanged release recipe/profile/features):

  • x86_64: 20,852,608 bytes; 569,488 bytes below the rebased dev cap 21,422,096; 569,232 bytes smaller than the actual frozen dev 1bcb7a87b comparison artifact (21,421,840 bytes).
  • ARM: 19,151,104 bytes; 443,752 bytes below the rebased dev cap 19,594,856.

Both check-production-trust checks passed. Exact source heads, artifact SHA256 and build recipe are attached. D243/D264 require a downward ratchet with no allowance: next commit sets rust.sh and PROCESS.md to exactly 20,852,608 / 19,151,104 bytes, exercises exact/+1/shrink boundaries, and pushes. This is a numerical ratchet, with no build-profile, feature or trust changes.

The fixed twenty-pair AB/BA native comparison is starting on the locked VM from these retained ordinary binaries, 100 samples per phase, with environment/load recorded for every run. Raw files are evidence/resume-native-pair-*.log; source/binary metadata is evidence/resume-native-artifacts.json. The cap commit changes only gate/docs; final fast runs on that new head while the native measurements continue. No source changes after acceptance are planned.

resume-final-production-artifacts.json

Ordinary production-trust builds PASS at source b38ab871b (unchanged release recipe/profile/features): - x86_64: 20,852,608 bytes; 569,488 bytes below the rebased dev cap 21,422,096; 569,232 bytes smaller than the actual frozen dev 1bcb7a87b comparison artifact (21,421,840 bytes). - ARM: 19,151,104 bytes; 443,752 bytes below the rebased dev cap 19,594,856. Both check-production-trust checks passed. Exact source heads, artifact SHA256 and build recipe are attached. D243/D264 require a downward ratchet with no allowance: next commit sets rust.sh and PROCESS.md to exactly 20,852,608 / 19,151,104 bytes, exercises exact/+1/shrink boundaries, and pushes. This is a numerical ratchet, with no build-profile, feature or trust changes. The fixed twenty-pair AB/BA native comparison is starting on the locked VM from these retained ordinary binaries, 100 samples per phase, with environment/load recorded for every run. Raw files are evidence/resume-native-pair-*.log; source/binary metadata is evidence/resume-native-artifacts.json. The cap commit changes only gate/docs; final fast runs on that new head while the native measurements continue. No source changes after acceptance are planned. [resume-final-production-artifacts.json](https://git.kayg.org/attachments/ab01d946-c1b5-4627-9ba3-c46901350193)
kayg commented 2026-10-16 20:14:41 +00:00
Author
Owner
Copy link

Native qualification finding, preliminary only: first complete interleaved pair has all eight metrics with n=100 on both actual frozen dev 1bcb7a87b and candidate b38ab871b. Both exceed the same-session flood budgets:

  • Confirmed echo p99: dev 480.42 ms, candidate 423.36 ms; budget 334.00 ms.
  • PTY echo p99: dev 480.57 ms, candidate 437.53 ms; budget 334.00 ms.
  • Same-session isolation growth: dev 153.79 ms, candidate 110.23 ms; budget 16.67 ms.

This does not establish noise or pass the absolute native budgets. Continue the prespecified twenty AB/BA pairs (100 samples/phase) and report all failures plus paired deltas/95% intervals; do not discard failing runs or change budgets. Receipts: evidence/resume-native-pair-00-{baseline,candidate}.log and artifact/head metadata evidence/resume-native-artifacts.json. Production sizes already pass both caps; numerical cap commit/final fast is queued. All six separate fresh staging VM cases passed.

Native qualification finding, preliminary only: first complete interleaved pair has all eight metrics with n=100 on both actual frozen dev 1bcb7a87b and candidate b38ab871b. Both exceed the same-session flood budgets: - Confirmed echo p99: dev 480.42 ms, candidate 423.36 ms; budget 334.00 ms. - PTY echo p99: dev 480.57 ms, candidate 437.53 ms; budget 334.00 ms. - Same-session isolation growth: dev 153.79 ms, candidate 110.23 ms; budget 16.67 ms. This does not establish noise or pass the absolute native budgets. Continue the prespecified twenty AB/BA pairs (100 samples/phase) and report all failures plus paired deltas/95% intervals; do not discard failing runs or change budgets. Receipts: evidence/resume-native-pair-00-{baseline,candidate}.log and artifact/head metadata evidence/resume-native-artifacts.json. Production sizes already pass both caps; numerical cap commit/final fast is queued. All six separate fresh staging VM cases passed.
kayg commented 2026-10-16 20:17:55 +00:00
Author
Owner
Copy link

Committed and pushed d22f19573: D243/D264 ceilings ratcheted to exactly 20,852,608 x86 bytes and 19,151,104 ARM bytes, in both rust.sh and PROCESS.md. No allowance, profile, feature or trust changes. Per-commit formatting, Bash syntax and boundary checks passed. Boundary output verbatim:

x86_64-unknown-linux-musl: exact 20852608-byte cap PASS; 20852609 bytes rejected PASS; smaller artifact requires ratchet PASS
aarch64-unknown-linux-musl: exact 19151104-byte cap PASS; 19151105 bytes rejected PASS; smaller artifact requires ratchet PASS
unsupported target: rejected PASS

scripts/verify fast is now running through build-slot on head d22f19573, using the same isolated job shell/test/evidence roots as the green iterate run. Native A/B uses the retained ordinary artifacts from binary source b38ab871b; d22f19573 changes only gate/docs, so Rust source is identical. Two complete interleaved pairs are recorded so far; final twenty-pair deltas/95% intervals and every absolute budget failure will be retained. Do not mark native qualification green from early pairs. Worktree clean; all six fresh release-profile staging/review cases already passed.

Committed and pushed d22f19573: D243/D264 ceilings ratcheted to exactly 20,852,608 x86 bytes and 19,151,104 ARM bytes, in both rust.sh and PROCESS.md. No allowance, profile, feature or trust changes. Per-commit formatting, Bash syntax and boundary checks passed. Boundary output verbatim: ```text x86_64-unknown-linux-musl: exact 20852608-byte cap PASS; 20852609 bytes rejected PASS; smaller artifact requires ratchet PASS aarch64-unknown-linux-musl: exact 19151104-byte cap PASS; 19151105 bytes rejected PASS; smaller artifact requires ratchet PASS unsupported target: rejected PASS ``` scripts/verify fast is now running through build-slot on head d22f19573, using the same isolated job shell/test/evidence roots as the green iterate run. Native A/B uses the retained ordinary artifacts from binary source b38ab871b; d22f19573 changes only gate/docs, so Rust source is identical. Two complete interleaved pairs are recorded so far; final twenty-pair deltas/95% intervals and every absolute budget failure will be retained. Do not mark native qualification green from early pairs. Worktree clean; all six fresh release-profile staging/review cases already passed.
kayg commented 2026-10-16 20:24:57 +00:00
Author
Owner
Copy link

Initial final scripts/verify fast at d22f19573 reproduced one functional failure: remote_client::server_path::tests::component_down_proves_tcp_fallback_when_enrolled_udp_is_unavailable, remote_server_path_tests.rs:676, Disconnected versus expected Fallback. All other Rust rows, including both exact static builds, passed. The full RED transcript is attached; it was moved to evidence/resume-final-fast-initial-red.log and is preserved.

Cause in the existing TCP fixture: after sending Hello it read one frame and returned, closing the fallback connection. The additive initial terminal census completes that read immediately, so a healthy link can be closed before its registry assertion. This is not an allowed host-load waiver; repair the fixture lifecycle.

Uncommitted test-only repair consumes the initial census before signalling readiness and drains later control frames until actual peer closure. Same three-second functional deadlines; no production transport or timeout change. Queued build-slot driver resume-census-fixture-gates.sh runs the full agent remote+release suite, all-target Clippy and formatting, commits/pushes this independent fixture repair, then reruns final scripts/verify fast on the new head. Initial gate/cap script must NOT be replayed from the start (caps already committed).

Native twenty-pair qualification continues on the retained ordinary artifacts; this file is cfg(test)-only, so measured production code and all six accepted staging cases are unchanged. Native absolute same-session failures on both dev/candidate remain recorded; final paired results are pending. Current pushed head d22f19573; worktree contains only this fixture repair.

resume-final-fast-initial-red.log

Initial final scripts/verify fast at d22f19573 reproduced one functional failure: remote_client::server_path::tests::component_down_proves_tcp_fallback_when_enrolled_udp_is_unavailable, remote_server_path_tests.rs:676, Disconnected versus expected Fallback. All other Rust rows, including both exact static builds, passed. The full RED transcript is attached; it was moved to evidence/resume-final-fast-initial-red.log and is preserved. Cause in the existing TCP fixture: after sending Hello it read one frame and returned, closing the fallback connection. The additive initial terminal census completes that read immediately, so a healthy link can be closed before its registry assertion. This is not an allowed host-load waiver; repair the fixture lifecycle. Uncommitted test-only repair consumes the initial census before signalling readiness and drains later control frames until actual peer closure. Same three-second functional deadlines; no production transport or timeout change. Queued build-slot driver resume-census-fixture-gates.sh runs the full agent remote+release suite, all-target Clippy and formatting, commits/pushes this independent fixture repair, then reruns final scripts/verify fast on the new head. Initial gate/cap script must NOT be replayed from the start (caps already committed). Native twenty-pair qualification continues on the retained ordinary artifacts; this file is cfg(test)-only, so measured production code and all six accepted staging cases are unchanged. Native absolute same-session failures on both dev/candidate remain recorded; final paired results are pending. Current pushed head d22f19573; worktree contains only this fixture repair. [resume-final-fast-initial-red.log](https://git.kayg.org/attachments/f9bb2505-8086-407d-bed0-9420fcd52681)
kayg commented 2026-10-16 20:26:46 +00:00
Author
Owner
Copy link

Committed and pushed c18aaf444: TCP fallback fixture consumes the initial session census before readiness and stays alive until peer closure. Production transport, timeouts and budgets are unchanged. This corrects the real fixture lifecycle behind the preserved final-gate RED, rather than treating it as host-load noise.

Per-commit gates: formatting PASS; full agent remote+release suite 113 passed / 0 failed / 14 ignored; all-target remote+release Clippy PASS. Worktree clean. Final scripts/verify fast is rerunning through build-slot on c18aaf444; evidence/resume-final-gate-head.txt records this head. All earlier static sizes/caps and six VM acceptance cases remain valid because this is cfg(test)-only code; final static artifact hashes will be checked again.

Native qualification currently has four complete pairs and continues the fixed twenty-pair plan. Absolute same-session budget failures reproduce on both dev and candidate; no noise/pass claim is made before the full paired summary.

resume-census-fixture-tests.log
resume-census-fixture-clippy.log

Committed and pushed c18aaf444: TCP fallback fixture consumes the initial session census before readiness and stays alive until peer closure. Production transport, timeouts and budgets are unchanged. This corrects the real fixture lifecycle behind the preserved final-gate RED, rather than treating it as host-load noise. Per-commit gates: formatting PASS; full agent remote+release suite 113 passed / 0 failed / 14 ignored; all-target remote+release Clippy PASS. Worktree clean. Final scripts/verify fast is rerunning through build-slot on c18aaf444; evidence/resume-final-gate-head.txt records this head. All earlier static sizes/caps and six VM acceptance cases remain valid because this is cfg(test)-only code; final static artifact hashes will be checked again. Native qualification currently has four complete pairs and continues the fixed twenty-pair plan. Absolute same-session budget failures reproduce on both dev and candidate; no noise/pass claim is made before the full paired summary. [resume-census-fixture-tests.log](https://git.kayg.org/attachments/2a43307e-a3a3-4eea-b713-561d1f43d693) [resume-census-fixture-clippy.log](https://git.kayg.org/attachments/505ab695-6daa-404e-bf2e-885200bb11de)
kayg commented 2026-10-16 20:37:14 +00:00
Author
Owner
Copy link

Final scripts/verify fast PASS through build-slot on pushed head c18aaf444. Worktree clean; no host-load baseline waiver. Rust summary verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Final exit line verbatim:

Final scripts/verify fast exit=0

TypeScript compiler, production bundle/transfer checks and protocol tests also completed successfully in the attached full transcript. Exact static caps passed at 20,852,608 x86 bytes and 19,151,104 ARM bytes. Both final static artifact hashes exactly match the ordinary binaries retained before the cfg(test)-only fixture repair, so all six staging VM cases and the ongoing native A/B artifacts remain attributable to this head. Artifact mapping is attached.

Still outstanding before handoff: finish the fixed twenty native AB/BA pairs and report all absolute budget failures plus paired deltas/95% intervals. Five valid pairs have completed so far; earlier same-session budget failures reproduce on both dev and candidate. No native noise/pass conclusion yet. Source/build work is complete, but this is not the final completion comment.

resume-final-fast.log
resume-final-gate-artifacts.json

Final scripts/verify fast PASS through build-slot on pushed head c18aaf444. Worktree clean; no host-load baseline waiver. Rust summary verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Final exit line verbatim: ```text Final scripts/verify fast exit=0 ``` TypeScript compiler, production bundle/transfer checks and protocol tests also completed successfully in the attached full transcript. Exact static caps passed at 20,852,608 x86 bytes and 19,151,104 ARM bytes. Both final static artifact hashes exactly match the ordinary binaries retained before the cfg(test)-only fixture repair, so all six staging VM cases and the ongoing native A/B artifacts remain attributable to this head. Artifact mapping is attached. Still outstanding before handoff: finish the fixed twenty native AB/BA pairs and report all absolute budget failures plus paired deltas/95% intervals. Five valid pairs have completed so far; earlier same-session budget failures reproduce on both dev and candidate. No native noise/pass conclusion yet. Source/build work is complete, but this is not the final completion comment. [resume-final-fast.log](https://git.kayg.org/attachments/b86bc1b6-84d2-448d-92c5-ad665816d222) [resume-final-gate-artifacts.json](https://git.kayg.org/attachments/b3a2ac0c-b8e5-4f23-8917-52091d9be890)
kayg commented 2026-10-16 20:52:06 +00:00
Author
Owner
Copy link

Current state: pushed head c18aaf444, clean tree, final scripts/verify fast PASS and both final static artifact hashes match measured ordinary binaries. All six fresh staging/review VM cases PASS; receipts and verbatim gate are attached above.

Native fixed twenty-pair qualification continues. Six pairs plus baseline run 06 are recorded; run 06-candidate currently waits in flock -w 3600 before measurement (receipt exists, no ENV lock-acquired marker, zero metric rows, no result yet). This is lock contention, not a measured timeout. Do not start CPU work on another host or change the plan/budgets. Runner holds the lock only per bounded run and releases between runs.

Active orchestration: resume-final-native-wait.py → resume-run-native-pairs.py; stdout evidence/resume-final-native-driver.log, raw evidence/resume-native-pair-*.log, active owned VM run/unit metadata resume-native-active.json. On completion resume-summarize-native.py checks all forty runs have eight n=100 metrics and writes evidence/resume-native-pairs-summary.json (paired deltas/95% intervals and every absolute budget failure). Current first-pair absolute same-session failures are present on both dev and branch; no final noise/pass claim yet.

Do NOT replay cap/commit chains: caps and fixture repairs are committed, final gate is already green. Remaining: finish native comparison, attach raw bundle/summary, classify results honestly, clean owned temporary build targets/baseline, final head/gate report and stop for independent break-it review. No merge/deploy.

Current state: pushed head c18aaf444, clean tree, final scripts/verify fast PASS and both final static artifact hashes match measured ordinary binaries. All six fresh staging/review VM cases PASS; receipts and verbatim gate are attached above. Native fixed twenty-pair qualification continues. Six pairs plus baseline run 06 are recorded; run 06-candidate currently waits in flock -w 3600 before measurement (receipt exists, no ENV lock-acquired marker, zero metric rows, no result yet). This is lock contention, not a measured timeout. Do not start CPU work on another host or change the plan/budgets. Runner holds the lock only per bounded run and releases between runs. Active orchestration: resume-final-native-wait.py → resume-run-native-pairs.py; stdout evidence/resume-final-native-driver.log, raw evidence/resume-native-pair-*.log, active owned VM run/unit metadata resume-native-active.json. On completion resume-summarize-native.py checks all forty runs have eight n=100 metrics and writes evidence/resume-native-pairs-summary.json (paired deltas/95% intervals and every absolute budget failure). Current first-pair absolute same-session failures are present on both dev and branch; no final noise/pass claim yet. Do NOT replay cap/commit chains: caps and fixture repairs are committed, final gate is already green. Remaining: finish native comparison, attach raw bundle/summary, classify results honestly, clean owned temporary build targets/baseline, final head/gate report and stop for independent break-it review. No merge/deploy.
kayg commented 2026-10-16 23:10:09 +00:00
Author
Owner
Copy link

Native qualification completed at pushed head c18aaf444: fixed twenty interleaved AB/BA pairs, forty ordinary production-trust runs, eight metrics/run, 100 samples/phase. No missing/partial finished runs and no discarded budget failures. Baseline is frozen dev 1bcb7a87b; candidate binary source b38ab871b is byte-identical to the final c18aaf444 static builds (mapping attached above). Both use the same unchanged scripts, release recipe and 300 ms RTT / 30 ms jitter relay.

Every paired 95% interval includes zero: no statistically detectable branch regression. Absolute same-session flood budgets fail on BOTH images in ALL twenty runs: echo budget 334 ms, isolation-growth budget 16.67 ms. The other five metrics have zero budget failures on either image. This is baseline-common behavior, not an absolute native gate PASS. The intervals do not prove equivalence and permit material same-session variation; keep that limitation in the independent review.

Metric (ms) Dev median Branch median Mean paired branch − dev Paired 95% interval Budget failures dev/branch
Confirmed echo, idle p99 325.970 326.650 +0.098 [-1.106, +1.302] 0/20 · 0/20
PTY echo, idle p99 326.290 326.670 -0.263 [-1.320, +0.793] 0/20 · 0/20
Confirmed echo, other-session flood p99 302.115 300.580 -0.200 [-6.057, +5.658] 0/20 · 0/20
PTY echo, other-session flood p99 303.880 301.690 -0.214 [-6.557, +6.128] 0/20 · 0/20
Other-session isolation growth -23.235 -24.025 +0.052 [-6.235, +6.338] 0/20 · 0/20
Confirmed echo, same-session flood p99 405.390 418.820 -7.397 [-30.962, +16.169] 20/20 · 20/20
PTY echo, same-session flood p99 410.920 427.200 -1.417 [-24.440, +21.605] 20/20 · 20/20
Same-session isolation growth 84.755 103.515 -1.152 [-24.172, +21.868] 20/20 · 20/20

Intervals are paired Student-t intervals over twenty run-level differences (df=19); medians and paired means are both reported to expose skew. No budget or workload was changed. Machine/CPU/memory and before/after load are in every receipt. Across eighty load observations the 1/5/15-minute ranges were 0.04–2.60 / 0.41–1.90 / 0.66–1.64; measurement stayed on the authorized 4-CPU perf VM under the shared lock and CPUWeight=10000. Lock released between bounded runs. Native driver and strict summary exited 0; owned active-run marker is gone.

The forty raw transcripts, exact artifact/script hashes, complete arrays, paired summary and machine manifest are attached. Final scripts/verify fast is already green on c18aaf444; all six separate fresh staging/review cases passed. Next: remove only owned temporary build targets/baseline, final head/gate report, then stop for independent break-it review. No issue closure, merge or deployment.

final-native-pairs.tar.gz
resume-native-pairs-summary.json
final-native-manifest.json

Native qualification completed at pushed head c18aaf444: fixed twenty interleaved AB/BA pairs, forty ordinary production-trust runs, eight metrics/run, 100 samples/phase. No missing/partial finished runs and no discarded budget failures. Baseline is frozen dev 1bcb7a87b; candidate binary source b38ab871b is byte-identical to the final c18aaf444 static builds (mapping attached above). Both use the same unchanged scripts, release recipe and 300 ms RTT / 30 ms jitter relay. Every paired 95% interval includes zero: no statistically detectable branch regression. Absolute same-session flood budgets fail on BOTH images in ALL twenty runs: echo budget 334 ms, isolation-growth budget 16.67 ms. The other five metrics have zero budget failures on either image. This is baseline-common behavior, not an absolute native gate PASS. The intervals do not prove equivalence and permit material same-session variation; keep that limitation in the independent review. | Metric (ms) | Dev median | Branch median | Mean paired branch − dev | Paired 95% interval | Budget failures dev/branch | |---|---:|---:|---:|---:|---:| | Confirmed echo, idle p99 | 325.970 | 326.650 | +0.098 | [-1.106, +1.302] | 0/20 · 0/20 | | PTY echo, idle p99 | 326.290 | 326.670 | -0.263 | [-1.320, +0.793] | 0/20 · 0/20 | | Confirmed echo, other-session flood p99 | 302.115 | 300.580 | -0.200 | [-6.057, +5.658] | 0/20 · 0/20 | | PTY echo, other-session flood p99 | 303.880 | 301.690 | -0.214 | [-6.557, +6.128] | 0/20 · 0/20 | | Other-session isolation growth | -23.235 | -24.025 | +0.052 | [-6.235, +6.338] | 0/20 · 0/20 | | Confirmed echo, same-session flood p99 | 405.390 | 418.820 | -7.397 | [-30.962, +16.169] | 20/20 · 20/20 | | PTY echo, same-session flood p99 | 410.920 | 427.200 | -1.417 | [-24.440, +21.605] | 20/20 · 20/20 | | Same-session isolation growth | 84.755 | 103.515 | -1.152 | [-24.172, +21.868] | 20/20 · 20/20 | Intervals are paired Student-t intervals over twenty run-level differences (df=19); medians and paired means are both reported to expose skew. No budget or workload was changed. Machine/CPU/memory and before/after load are in every receipt. Across eighty load observations the 1/5/15-minute ranges were 0.04–2.60 / 0.41–1.90 / 0.66–1.64; measurement stayed on the authorized 4-CPU perf VM under the shared lock and CPUWeight=10000. Lock released between bounded runs. Native driver and strict summary exited 0; owned active-run marker is gone. The forty raw transcripts, exact artifact/script hashes, complete arrays, paired summary and machine manifest are attached. Final scripts/verify fast is already green on c18aaf444; all six separate fresh staging/review cases passed. Next: remove only owned temporary build targets/baseline, final head/gate report, then stop for independent break-it review. No issue closure, merge or deployment. [final-native-pairs.tar.gz](https://git.kayg.org/attachments/11636bb2-e64e-4881-843d-85b7d96f4121) [resume-native-pairs-summary.json](https://git.kayg.org/attachments/e993d5e6-ec7a-43e1-93f6-98031a84cd30) [final-native-manifest.json](https://git.kayg.org/attachments/40eacfda-533d-4ec8-b7cc-69ed3775e55d)
kayg commented 2026-10-16 23:12:13 +00:00
Author
Owner
Copy link

Final implementation handoff — head c18aaf4442, branch edge-autoupdate, pushed and clean. Stop here for the independent break-it review; no merge, deployment or issue closure.

D295 is wired through the existing verified update path: consistent online SQLite preimage beside the predecessor; stable restart target stays on the previous verified binary until health/check-in; uncommitted attempts restore before database opening/migrations; exact undo Inbox item; bounded images/copies and disk-full refusal. Format-3 marker reservations preserve terminal writer identity across restore. Shim State progress now reaches the server before probe liveness, preventing the reproduced durable-input stall. Initial-census TCP fixture closure was corrected from a preserved failing-first gate.

Acceptance on the locked perf VM: six fresh release-profile staging/review cases exited 0, with 50 users, 10,000 nodes and 128 real PTYs/attached routes. Quiet application after last input 63,139.841 ms against a 60,000 ms test window; typing postponed it. Server-only Update now 3,100.753 ms and Roll back 3,006.240 ms including custody checks. All 128 shim PIDs survived. Healthy handoffs retained unlocked CA custody; zero refused listener probes (maximum interval 18.925 ms at full scale, 5.786 ms in the exact reconnect case, calibrated allowance 51.155 ms). Failed real migration restored before old migrations and recovered in 4,568.190 ms; cold CA stayed locked as required. Host followed B/A/B; its verified refused startup restored in 30,369.713 ms. Transport128: all 1,024 durable acknowledgements, p99 5.396 ms versus 50 ms budget. Writer-cost overhead is measured and reported above, including the 34.615 ms first durable reservation.

Ordinary production-trust sizes and exact ratcheted caps: x86 20,852,608 bytes (−569,488 versus rebased dev cap; −569,232 versus actual frozen dev artifact); ARM 19,151,104 bytes (−443,752 versus dev cap). Final static hashes match the measured ordinary binaries. Exact/+1/shrink boundary tests pass.

Native review evidence: twenty fixed interleaved AB/BA pairs, forty complete runs, eight n=100 metrics/run. Every paired 95% interval includes zero; no statistically detectable change. Absolute same-session flood budgets fail 20/20 on BOTH dev and branch; the other five metrics have zero failures on both. Do not call the absolute native gate green or claim equivalence. Full paired means, medians, intervals, failure counts and all raw runs are attached above for the independent reviewer. This is the requested baseline comparison, with the remaining common budget miss exposed rather than waived silently.

Final scripts/verify fast ran through build-slot on this exact head; no host-load exception. Rust output verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| test                      | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

Final exit line verbatim:

Final scripts/verify fast exit=0

TypeScript compiler, production build/transfer and protocol checks also passed; the full gate transcript is attached. Author release checklist completed: existing approved engines only; strict bounded parser/trust paths retained; private owned storage and verified descriptors; off/cancellation behavior retained; no Worker credentials/production signing keys, new encryption, independent recovery supervisor, TLS/CA restoration or UI work introduced.

Cleanup: removed four owned build targets and the detached baseline worktree; zero owned scratch worktrees remain. Retained selected evidence, ordinary image copies and public signed fixtures for review. Rejected recovery drafts remain on their separate unpushed local branch. No repository report/evidence file was added.

Gate and artifact mapping:
resume-final-fast.log
resume-final-gate-artifacts.json

Native raw data and complete comparison:
final-native-pairs.tar.gz
resume-native-pairs-summary.json
final-native-manifest.json

All six acceptance receipts, earlier RED/GREEN proofs and every completed step SHA are in the comments above. Issue remains open. Independent break-it verdict is the next step.

Final implementation handoff — head c18aaf4442e73441dda570de7df95040f7ee11d1, branch edge-autoupdate, pushed and clean. Stop here for the independent break-it review; no merge, deployment or issue closure. D295 is wired through the existing verified update path: consistent online SQLite preimage beside the predecessor; stable restart target stays on the previous verified binary until health/check-in; uncommitted attempts restore before database opening/migrations; exact undo Inbox item; bounded images/copies and disk-full refusal. Format-3 marker reservations preserve terminal writer identity across restore. Shim State progress now reaches the server before probe liveness, preventing the reproduced durable-input stall. Initial-census TCP fixture closure was corrected from a preserved failing-first gate. Acceptance on the locked perf VM: six fresh release-profile staging/review cases exited 0, with 50 users, 10,000 nodes and 128 real PTYs/attached routes. Quiet application after last input 63,139.841 ms against a 60,000 ms test window; typing postponed it. Server-only Update now 3,100.753 ms and Roll back 3,006.240 ms including custody checks. All 128 shim PIDs survived. Healthy handoffs retained unlocked CA custody; zero refused listener probes (maximum interval 18.925 ms at full scale, 5.786 ms in the exact reconnect case, calibrated allowance 51.155 ms). Failed real migration restored before old migrations and recovered in 4,568.190 ms; cold CA stayed locked as required. Host followed B/A/B; its verified refused startup restored in 30,369.713 ms. Transport128: all 1,024 durable acknowledgements, p99 5.396 ms versus 50 ms budget. Writer-cost overhead is measured and reported above, including the 34.615 ms first durable reservation. Ordinary production-trust sizes and exact ratcheted caps: x86 20,852,608 bytes (−569,488 versus rebased dev cap; −569,232 versus actual frozen dev artifact); ARM 19,151,104 bytes (−443,752 versus dev cap). Final static hashes match the measured ordinary binaries. Exact/+1/shrink boundary tests pass. Native review evidence: twenty fixed interleaved AB/BA pairs, forty complete runs, eight n=100 metrics/run. Every paired 95% interval includes zero; no statistically detectable change. Absolute same-session flood budgets fail 20/20 on BOTH dev and branch; the other five metrics have zero failures on both. Do not call the absolute native gate green or claim equivalence. Full paired means, medians, intervals, failure counts and all raw runs are attached above for the independent reviewer. This is the requested baseline comparison, with the remaining common budget miss exposed rather than waived silently. Final scripts/verify fast ran through build-slot on this exact head; no host-load exception. Rust output verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | test | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` Final exit line verbatim: ```text Final scripts/verify fast exit=0 ``` TypeScript compiler, production build/transfer and protocol checks also passed; the full gate transcript is attached. Author release checklist completed: existing approved engines only; strict bounded parser/trust paths retained; private owned storage and verified descriptors; off/cancellation behavior retained; no Worker credentials/production signing keys, new encryption, independent recovery supervisor, TLS/CA restoration or UI work introduced. Cleanup: removed four owned build targets and the detached baseline worktree; zero owned scratch worktrees remain. Retained selected evidence, ordinary image copies and public signed fixtures for review. Rejected recovery drafts remain on their separate unpushed local branch. No repository report/evidence file was added. Gate and artifact mapping: [resume-final-fast.log](https://git.kayg.org/attachments/b86bc1b6-84d2-448d-92c5-ad665816d222) [resume-final-gate-artifacts.json](https://git.kayg.org/attachments/b3a2ac0c-b8e5-4f23-8917-52091d9be890) Native raw data and complete comparison: [final-native-pairs.tar.gz](https://git.kayg.org/attachments/11636bb2-e64e-4881-843d-85b7d96f4121) [resume-native-pairs-summary.json](https://git.kayg.org/attachments/e993d5e6-ec7a-43e1-93f6-98031a84cd30) [final-native-manifest.json](https://git.kayg.org/attachments/40eacfda-533d-4ec8-b7cc-69ed3775e55d) All six acceptance receipts, earlier RED/GREEN proofs and every completed step SHA are in the comments above. Issue remains open. Independent break-it verdict is the next step.
kayg commented 2026-10-16 23:14:51 +00:00
Author
Owner
Copy link

Independent D295 verification started. Branch review-edge-autoupdate-d295; target/base c18aaf4442; diff base 1bcb7a87b. Reviewing update/undo boundaries and prior EA-01 through EA-05. No implementation fixes, push or deployment. Exact-target scripts/verify fast started through build-slot; receipts under edge-autoupdate-review/evidence. Existing issue and parent histories retrieved; D295 narrows prior recovery requirements.

Independent D295 verification started. Branch review-edge-autoupdate-d295; target/base c18aaf4442e73441dda570de7df95040f7ee11d1; diff base 1bcb7a87b. Reviewing update/undo boundaries and prior EA-01 through EA-05. No implementation fixes, push or deployment. Exact-target scripts/verify fast started through build-slot; receipts under edge-autoupdate-review/evidence. Existing issue and parent histories retrieved; D295 narrows prior recovery requirements.
kayg commented 2026-10-16 23:23:00 +00:00
Author
Owner
Copy link

Independent review validation note: the untouched c18aaf444 fast run passed formatting, plugin compile-out and Clippy, then workspace test links failed because numerous object files and dependency archives disappeared from its target/debug/deps directory (ENOENT). Target debug size dropped from multi-GB to 445 MB during compilation. This is not a confirmed source defect or an allowed test waiver; retaining the RED log and rerunning with a unique D295 target directory. No implementation or test edits have been applied yet. Perf-VM native A/B is running separately.

Independent review validation note: the untouched c18aaf444 fast run passed formatting, plugin compile-out and Clippy, then workspace test links failed because numerous object files and dependency archives disappeared from its target/debug/deps directory (ENOENT). Target debug size dropped from multi-GB to 445 MB during compilation. This is not a confirmed source defect or an allowed test waiver; retaining the RED log and rerunning with a unique D295 target directory. No implementation or test edits have been applied yet. Perf-VM native A/B is running separately.
kayg commented 2026-10-16 23:42:31 +00:00
Author
Owner
Copy link

Independent perf step at review base c18aaf444: three fresh interleaved A/B pairs on the locked 4-vCPU VM, 100 samples/phase, unchanged 300 ms RTT relay. Same-session confirmed echo, PTY echo and isolation-growth budgets fail 3/3 on both frozen dev 1bcb7a87b and candidate; other five metrics have no failures. PTY echo p99 dev=[441.35,421.49,424.91] ms; branch=[443.23,347.47,470.85] ms; budget=334 ms. Audited all forty original receipts: eight n=100 metrics/run, same-session failures 20/20 on BOTH binaries. This confirms baseline-common behavior; it is not an absolute latency pass or proof of equivalence. Retained ordinary artifacts rechecked on VM: x86 20852608 B, ARM 19151104 B, hashes match the recorded artifacts. Fresh independent builds: x86 20852864 B (+256 vs cap), ARM 19151104 B; x86 section growth is rodata only (+256), with an embedded compiler-path difference. No cap changed. Raw receipts and strict audit/summary are under edge-autoupdate-review/evidence; new rollback/deadline tests await the rebuilt harness.

Independent perf step at review base c18aaf444: three fresh interleaved A/B pairs on the locked 4-vCPU VM, 100 samples/phase, unchanged 300 ms RTT relay. Same-session confirmed echo, PTY echo and isolation-growth budgets fail 3/3 on both frozen dev 1bcb7a87b and candidate; other five metrics have no failures. PTY echo p99 dev=[441.35,421.49,424.91] ms; branch=[443.23,347.47,470.85] ms; budget=334 ms. Audited all forty original receipts: eight n=100 metrics/run, same-session failures 20/20 on BOTH binaries. This confirms baseline-common behavior; it is not an absolute latency pass or proof of equivalence. Retained ordinary artifacts rechecked on VM: x86 20852608 B, ARM 19151104 B, hashes match the recorded artifacts. Fresh independent builds: x86 20852864 B (+256 vs cap), ARM 19151104 B; x86 section growth is rodata only (+256), with an embedded compiler-path difference. No cap changed. Raw receipts and strict audit/summary are under edge-autoupdate-review/evidence; new rollback/deadline tests await the rebuilt harness.
kayg commented 2026-10-16 23:56:35 +00:00
Author
Owner
Copy link

EA-06 (P2), independent D295 review of c18aaf444. The real-SQLite/paused-clock test models a backward wall-clock correction between arm and successor startup. After 121 seconds of process-local virtual time, the unhealthy candidate still has no deadline result: 0 passed / 1 failed. release_startup.rs:178 sleeps persisted deadline minus wall time without a maximum remaining wait, so a one-hour correction permits roughly 3720 seconds. No host clock changed; this is functional timer evidence, not a benchmark. Failing test committed locally as 50013bc74 on review-edge-autoupdate-d295; no implementation fix or push. Test: update_recovery::tests::review_d295_backward_clock_adjustment_does_not_extend_health_window.

EA-06 (P2), independent D295 review of c18aaf444. The real-SQLite/paused-clock test models a backward wall-clock correction between arm and successor startup. After 121 seconds of process-local virtual time, the unhealthy candidate still has no deadline result: 0 passed / 1 failed. release_startup.rs:178 sleeps persisted deadline minus wall time without a maximum remaining wait, so a one-hour correction permits roughly 3720 seconds. No host clock changed; this is functional timer evidence, not a benchmark. Failing test committed locally as 50013bc74 on review-edge-autoupdate-d295; no implementation fix or push. Test: update_recovery::tests::review_d295_backward_clock_adjustment_does_not_extend_health_window.
kayg commented 2026-10-16 23:59:14 +00:00
Author
Owner
Copy link

Resuming edge-autoupdate at c18aaf4442 (clean tree). Read #211 and parent #157 histories and D295. Local review-edge-autoupdate-d295 is 50013bc74 and contains only the EA-06 paused-clock regression; the five prior P1 tests/fixes are already in this branch. Revalidate those paths rather than duplicate them. Reproduce EA-06 first, bound health wait with the process monotonic timer, remove branch-added compiler profile overrides, then baseline/VM qualification and final build-slot verify fast. No production deployment or merge. Logs under ~/.cache/codex-scratch/edge-autoupdate/evidence/.

Resuming edge-autoupdate at c18aaf4442e73441dda570de7df95040f7ee11d1 (clean tree). Read #211 and parent #157 histories and D295. Local review-edge-autoupdate-d295 is 50013bc74 and contains only the EA-06 paused-clock regression; the five prior P1 tests/fixes are already in this branch. Revalidate those paths rather than duplicate them. Reproduce EA-06 first, bound health wait with the process monotonic timer, remove branch-added compiler profile overrides, then baseline/VM qualification and final build-slot verify fast. No production deployment or merge. Logs under ~/.cache/codex-scratch/edge-autoupdate/evidence/.
kayg commented 2026-10-17 00:04:16 +00:00
Author
Owner
Copy link

Rebased the lane onto origin/dev 3b2183eaa (237 lane commits replayed); EA-06 test cherry-picked from review 50013bc74 as d36d6bc39. Rebase retained the newer peer capability bits, path-proof transport binding, shared SQLite writer admission and normalized static compiler driver. Skipped the old size-ratchet commit d22f19573 because its artifact bytes predate this base; current dev caps remain 21,300,016 / 19,500,376 B until fresh final artifacts are measured. Removed branch-added CLI/plugin-API optimization overrides in the working tree; release profiles now match origin/dev exactly, so no unqualified profile exception is requested. Focused failing-first clock build and exact-dev comparator build are running through build-slot; no perf result yet. Full logs retained under evidence/delta-*.log.

Rebased the lane onto origin/dev 3b2183eaa (237 lane commits replayed); EA-06 test cherry-picked from review 50013bc74 as d36d6bc39. Rebase retained the newer peer capability bits, path-proof transport binding, shared SQLite writer admission and normalized static compiler driver. Skipped the old size-ratchet commit d22f19573 because its artifact bytes predate this base; current dev caps remain 21,300,016 / 19,500,376 B until fresh final artifacts are measured. Removed branch-added CLI/plugin-API optimization overrides in the working tree; release profiles now match origin/dev exactly, so no unqualified profile exception is requested. Focused failing-first clock build and exact-dev comparator build are running through build-slot; no perf result yet. Full logs retained under evidence/delta-*.log.
kayg commented 2026-10-17 00:16:06 +00:00
Author
Owner
Copy link

EA-06 reproduced on rebased production base: review_d295_backward_clock_adjustment_does_not_extend_health_window = 0 passed / 1 failed (574 filtered). No host clock change. The persisted wall deadline could yield a 3,720-second wait after a one-hour correction. Fix in progress caps the initial duration at the existing 120-second window; Tokio then owns a monotonic timer. No marker-format, encryption or recovery-process change.

delta-clock-red.log

EA-06 reproduced on rebased production base: review_d295_backward_clock_adjustment_does_not_extend_health_window = 0 passed / 1 failed (574 filtered). No host clock change. The persisted wall deadline could yield a 3,720-second wait after a one-hour correction. Fix in progress caps the initial duration at the existing 120-second window; Tokio then owns a monotonic timer. No marker-format, encryption or recovery-process change. [delta-clock-red.log](https://git.kayg.org/attachments/2619139d-068d-4014-bdf4-92527d19d5ca)
kayg commented 2026-10-17 00:25:58 +00:00
Author
Owner
Copy link

EA-06 focused GREEN: 1 passed / 0 failed (574 filtered), after the preserved 0 passed / 1 failed RED. release_startup::health_deadline caps the initial duration at update_recovery::WINDOW (120 seconds), then Tokio uses its monotonic timer. Persisted deadlines still shorten the wait; committed/recovered markers retain their existing behavior. Full server, infraternal-agent, release and Clippy gates remain in progress; no final claim or push yet.

delta-clock-green.log

EA-06 focused GREEN: 1 passed / 0 failed (574 filtered), after the preserved 0 passed / 1 failed RED. release_startup::health_deadline caps the initial duration at update_recovery::WINDOW (120 seconds), then Tokio uses its monotonic timer. Persisted deadlines still shorten the wait; committed/recovered markers retain their existing behavior. Full server, infraternal-agent, release and Clippy gates remain in progress; no final claim or push yet. [delta-clock-green.log](https://git.kayg.org/attachments/08089834-f149-4357-9c82-8d689e802131)
kayg commented 2026-10-17 00:51:40 +00:00
Author
Owner
Copy link

Committed and pushed 27c5205ae (EA-06 clock bound) and 777d29562 (current staging harness can build the server from an explicit comparison checkout). Rebased onto c47a438be; its changes after production 3b2183eaa are frontend-only. Comparator checkout and ordinary image are explicitly pinned/rebuilt from 3b2183eaac. Three rebase composition corrections were folded into their owning commits; recorded hashes prove the tested backend sources stayed unchanged.

Focused gates: format and touched all-target Clippy PASS; recovery 26 passed / 1 benchmark ignored; startup 2 passed; release engine 8 passed; listener handoff 3 passed; remote transport 93 passed / 14 ignored; infraternal-agent 132 passed / 21 ignored; release 39 unit + 3 integration passed / 3 ignored. Staging artifact Python checks: 3 passed.

Initial broad server run: 518 passed / 5 failed / 52 ignored. Three failures were SUN_LEN from the long TMPDIR; one checkpoint child required its absent state-root directory; one frozen-socket observation reached its hang bound. Created the required root, restored the short owned TMPDIR, and used two test threads. Unchanged runtime and foreground/liveness cases then pass: 52 runtime + 4 liveness tests (including every initial failure). No host-load exception or final gate pass is claimed. Initial and corrected raw logs are attached.

scripts/verify iterate is running in the managed slot, followed by ordinary static builds using dev's release profiles. Only Cargo.toml's removal of the branch-specific profile overrides remains uncommitted pending measured bytes. VM comparisons, size decision and final fast remain outstanding. No merge or deployment.

delta-clippy.log
delta-server-update_recovery__.log
delta-server-remote_.log
delta-agent-tests.log
delta-release-tests.log
delta-server-initial.log
delta-server-runtime__tests__.log
delta-server-restart_open_liveness_review__.log

Committed and pushed 27c5205ae (EA-06 clock bound) and 777d29562 (current staging harness can build the server from an explicit comparison checkout). Rebased onto c47a438be; its changes after production 3b2183eaa are frontend-only. Comparator checkout and ordinary image are explicitly pinned/rebuilt from 3b2183eaac8a9d8cc52a922dfbbbaecf895fd854. Three rebase composition corrections were folded into their owning commits; recorded hashes prove the tested backend sources stayed unchanged. Focused gates: format and touched all-target Clippy PASS; recovery 26 passed / 1 benchmark ignored; startup 2 passed; release engine 8 passed; listener handoff 3 passed; remote transport 93 passed / 14 ignored; infraternal-agent 132 passed / 21 ignored; release 39 unit + 3 integration passed / 3 ignored. Staging artifact Python checks: 3 passed. Initial broad server run: 518 passed / 5 failed / 52 ignored. Three failures were SUN_LEN from the long TMPDIR; one checkpoint child required its absent state-root directory; one frozen-socket observation reached its hang bound. Created the required root, restored the short owned TMPDIR, and used two test threads. Unchanged runtime and foreground/liveness cases then pass: 52 runtime + 4 liveness tests (including every initial failure). No host-load exception or final gate pass is claimed. Initial and corrected raw logs are attached. scripts/verify iterate is running in the managed slot, followed by ordinary static builds using dev's release profiles. Only Cargo.toml's removal of the branch-specific profile overrides remains uncommitted pending measured bytes. VM comparisons, size decision and final fast remain outstanding. No merge or deployment. [delta-clippy.log](https://git.kayg.org/attachments/e04dc951-fe43-4740-b7b9-84c5ddf79d5f) [delta-server-update_recovery__.log](https://git.kayg.org/attachments/403b0188-8f4d-483d-8cb7-14b4f5b7e833) [delta-server-remote_.log](https://git.kayg.org/attachments/58bb1057-e729-4c1b-8b5e-0a5d4c957cdc) [delta-agent-tests.log](https://git.kayg.org/attachments/6de3552a-a1b8-458f-b127-3515f2650d4a) [delta-release-tests.log](https://git.kayg.org/attachments/57573892-ce40-46ab-9ecb-565381d63e0d) [delta-server-initial.log](https://git.kayg.org/attachments/42938764-b4b9-4bc6-a4a5-d53ad27cf46e) [delta-server-runtime__tests__.log](https://git.kayg.org/attachments/615f6a5b-579e-4100-b1ae-9d0ddacfdb79) [delta-server-restart_open_liveness_review__.log](https://git.kayg.org/attachments/ef3e4920-bb6f-4978-b486-0b26527e8af6)
kayg commented 2026-10-17 01:19:01 +00:00
Author
Owner
Copy link

Committed and pushed b2633a6b3. The compiler-input fixture now copies the real scripts/static-cargo driver into its private root and isolates the separate artifact-metadata command. Preserved RED: fixture refused because scripts/static-cargo did not exist. GREEN: all four default/disabled/stable/edge modes use production compilation and preserve the explicit identity. Actual shipping trust, linkage, key-heap and size checks remain unchanged.

First iterate stopped only in the unchanged SSH config-isolation fixture (helper start refused). Its isolated package rerun passes 2/2; the same target with the complete workspace feature graph also passes 1/1. No source change or host-load waiver was used for SSH. The initial focused command was corrected to match verify's default test targets rather than include standalone fuzz executables.

Full iterate retry and then ordinary static builds are running in the managed slot. The compiler-profile removal remains the only uncommitted change; no VM qualification or final fast result yet.

delta-static-recipe-red.log
delta-static-recipe-green.log
delta-ssh-config-isolation-retry.log
delta-ssh-workspace-retry.log

Committed and pushed b2633a6b3. The compiler-input fixture now copies the real scripts/static-cargo driver into its private root and isolates the separate artifact-metadata command. Preserved RED: fixture refused because scripts/static-cargo did not exist. GREEN: all four default/disabled/stable/edge modes use production compilation and preserve the explicit identity. Actual shipping trust, linkage, key-heap and size checks remain unchanged. First iterate stopped only in the unchanged SSH config-isolation fixture (helper start refused). Its isolated package rerun passes 2/2; the same target with the complete workspace feature graph also passes 1/1. No source change or host-load waiver was used for SSH. The initial focused command was corrected to match verify's default test targets rather than include standalone fuzz executables. Full iterate retry and then ordinary static builds are running in the managed slot. The compiler-profile removal remains the only uncommitted change; no VM qualification or final fast result yet. [delta-static-recipe-red.log](https://git.kayg.org/attachments/2827bb93-fd3c-4148-91e2-34fa985eb270) [delta-static-recipe-green.log](https://git.kayg.org/attachments/1082108c-a95c-412d-a690-174720df2f7e) [delta-ssh-config-isolation-retry.log](https://git.kayg.org/attachments/1c67c73b-64ec-41c3-8d50-aa1ade039f91) [delta-ssh-workspace-retry.log](https://git.kayg.org/attachments/8debbd72-73bf-4a2e-a151-be2883e6c04d)
kayg commented 2026-10-17 01:44:42 +00:00
Author
Owner
Copy link

Committed and pushed 9819d8981: held-open ordering fixture now advances the configured idle SERIAL_GAP, rather than assuming the fast-route 25 ms cadence. Production's gap remains 26 ms and every response deadline is unchanged. The correlated-reply assertion while terminal creation is held still happens before clock advancement, preserving the original regression oracle.

Before: second iterate reached 565 passed / 1 failed / 52 ignored; responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment hit FrozenSocketTime's real-I/O hang bound. Production 3b2183eaa has the same 25 ms fixture expectation against the same 26 ms idle cadence. This is an ordering-fixture correction, not a widened production timeout or a host-load waiver.

After: format PASS; all-target server Clippy PASS; 15 liveness tests PASS; all 4 held-open/checkpoint socket tests PASS. Raw outputs attached. Ordinary production static builds now run first with the branch's CLI/API profile overrides removed; full iterate retry follows. VM acceptance, profile/size qualification and final fast are still pending. No merge or deployment.

delta-pacing-clippy.log
delta-pacing-unit.log
delta-pacing-socket.log
delta-iterate-retry.log

Committed and pushed 9819d8981: held-open ordering fixture now advances the configured idle SERIAL_GAP, rather than assuming the fast-route 25 ms cadence. Production's gap remains 26 ms and every response deadline is unchanged. The correlated-reply assertion while terminal creation is held still happens before clock advancement, preserving the original regression oracle. Before: second iterate reached 565 passed / 1 failed / 52 ignored; responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment hit FrozenSocketTime's real-I/O hang bound. Production 3b2183eaa has the same 25 ms fixture expectation against the same 26 ms idle cadence. This is an ordering-fixture correction, not a widened production timeout or a host-load waiver. After: format PASS; all-target server Clippy PASS; 15 liveness tests PASS; all 4 held-open/checkpoint socket tests PASS. Raw outputs attached. Ordinary production static builds now run first with the branch's CLI/API profile overrides removed; full iterate retry follows. VM acceptance, profile/size qualification and final fast are still pending. No merge or deployment. [delta-pacing-clippy.log](https://git.kayg.org/attachments/39a71086-76c3-4d93-b91f-0adf56551cec) [delta-pacing-unit.log](https://git.kayg.org/attachments/67474c66-744d-48bf-b3bb-d7ec8f4f44e4) [delta-pacing-socket.log](https://git.kayg.org/attachments/e97ec62c-297f-434e-a014-db3fcbff2010) [delta-iterate-retry.log](https://git.kayg.org/attachments/2268e095-46ec-426a-89bf-3a74e3aa96b4)
kayg commented 2026-10-17 02:01:09 +00:00
Author
Owner
Copy link

D243 finding at 9819d8981: removing the branch CLI/API release overrides produces a normal production-trust x86 image of 22,218,144 B, +918,128 B against dev's 21,300,016 B cap. No ceiling changed; this control cannot ship. ARM's dev-profile control is still building.

The permitted profile qualification is now necessary: building the original compact profile as a matched control, without modifying the active dev-profile manifest. The experiment records explicit per-package compiler overrides and artifact hashes. Next measure all three requested hot paths on the locked perf VM: keystroke echo, credited output throughput and real TCP/mTLS handshakes at 1,000 connected hosts, with interleaved A/B pairs. No claim of runtime equivalence or final size compliance yet. If a profile regression is detected, reduce the change rather than increase a cap.
delta-dev-profile-native.json
delta-profile-removal.patch

D243 finding at 9819d8981: removing the branch CLI/API release overrides produces a normal production-trust x86 image of 22,218,144 B, +918,128 B against dev's 21,300,016 B cap. No ceiling changed; this control cannot ship. ARM's dev-profile control is still building. The permitted profile qualification is now necessary: building the original compact profile as a matched control, without modifying the active dev-profile manifest. The experiment records explicit per-package compiler overrides and artifact hashes. Next measure all three requested hot paths on the locked perf VM: keystroke echo, credited output throughput and real TCP/mTLS handshakes at 1,000 connected hosts, with interleaved A/B pairs. No claim of runtime equivalence or final size compliance yet. If a profile regression is detected, reduce the change rather than increase a cap. [delta-dev-profile-native.json](https://git.kayg.org/attachments/9703ed3b-62dc-4d39-b93d-64f56be5afff) [delta-profile-removal.patch](https://git.kayg.org/attachments/e66dab74-8166-46df-b075-1e0b44f2e97c)
kayg commented 2026-10-17 02:10:49 +00:00
Author
Owner
Copy link

Both ordinary dev-profile controls at 9819d8981 completed with production trust PASS. Profiles exactly match production 3b2183eaa:

  • x86_64: 22,218,144 B; +918,128 over the 21,300,016 B cap.
  • ARM: 20,322,328 B; +821,952 over the 19,500,376 B cap.

These controls are not shippable; no cap changed. Artifact SHA-256s, source head, manifest digest and the pending profile-removal patch are recorded in the attached metadata. The original compact profile and two release-profile real-TLS harness controls are building separately. Ten paired A/B runs per hot-path workload on the locked perf VM will test the explicitly permitted profile exception. Full iterate with the corrected pacing fixture is also running; final fast is outstanding.
delta-production-artifacts.json
delta-trust-x86_64-unknown-linux-musl.log
delta-trust-aarch64-unknown-linux-musl.log

Both ordinary dev-profile controls at 9819d8981 completed with production trust PASS. Profiles exactly match production 3b2183eaa: - x86_64: 22,218,144 B; +918,128 over the 21,300,016 B cap. - ARM: 20,322,328 B; +821,952 over the 19,500,376 B cap. These controls are not shippable; no cap changed. Artifact SHA-256s, source head, manifest digest and the pending profile-removal patch are recorded in the attached metadata. The original compact profile and two release-profile real-TLS harness controls are building separately. Ten paired A/B runs per hot-path workload on the locked perf VM will test the explicitly permitted profile exception. Full iterate with the corrected pacing fixture is also running; final fast is outstanding. [delta-production-artifacts.json](https://git.kayg.org/attachments/5c851bfd-191d-4908-afbc-483c93b86bc8) [delta-trust-x86_64-unknown-linux-musl.log](https://git.kayg.org/attachments/3b61fbc7-7361-460e-ae83-5edb2e38862c) [delta-trust-aarch64-unknown-linux-musl.log](https://git.kayg.org/attachments/d416f267-9746-46eb-8a07-d551799956e1)
kayg commented 2026-10-17 02:17:21 +00:00
Author
Owner
Copy link

Head 9819d8981. The matched compact x86 control is 20,516,064 bytes: 1,702,080 bytes smaller than the dev-profile control and 783,952 bytes below the unchanged dev cap. Runtime qualification is predefined as 20 interleaved A/B pairs per phase (expanded before collecting data): keystroke echo, three output payloads, byte-verified credited output, and 1,000 real TLS host handshakes. Same source/toolchain; only the existing branch compiler overrides differ. Builds remain local; measurements will hold the perf VM lock only for each workload. No profile decision or size waiver yet. Full iterate is still running.

Head 9819d8981. The matched compact x86 control is 20,516,064 bytes: 1,702,080 bytes smaller than the dev-profile control and 783,952 bytes below the unchanged dev cap. Runtime qualification is predefined as 20 interleaved A/B pairs per phase (expanded before collecting data): keystroke echo, three output payloads, byte-verified credited output, and 1,000 real TLS host handshakes. Same source/toolchain; only the existing branch compiler overrides differ. Builds remain local; measurements will hold the perf VM lock only for each workload. No profile decision or size waiver yet. Full iterate is still running.
kayg commented 2026-10-17 02:21:30 +00:00
Author
Owner
Copy link

Started ten interleaved native latency pairs on the locked perf VM: production 3b2183eaac versus head 9819d8981 with its committed compact profiles. This uses the already-built compact control while the matched profile harnesses compile. All absolute gate misses and all samples will be retained. This is provisional qualification: if the compiler profiles change after their separate runtime comparison, rerun against the final executable. No caps raised.

Started ten interleaved native latency pairs on the locked perf VM: production 3b2183eaac8a9d8cc52a922dfbbbaecf895fd854 versus head 9819d8981 with its committed compact profiles. This uses the already-built compact control while the matched profile harnesses compile. All absolute gate misses and all samples will be retained. This is provisional qualification: if the compiler profiles change after their separate runtime comparison, rerun against the final executable. No caps raised.
kayg commented 2026-10-17 02:24:59 +00:00
Author
Owner
Copy link

Head 9819d8981 iterate: server 565 passed, 1 failed, 52 ignored; failure remote_runtime::tests::standby::control_queue::saturated_native_control_queue_does_not_hide_primary_terminal_output at remote_control_queue_tests.rs:229 (live connection already closed). Isolated rerun with --features remote passed: 1 passed, 0 failed, 574 filtered; CONTROL_SATURATION active=true queued=1 native_primary_live=true shadow_output=0. Initial invocation without remote was excluded from evidence. No waiver or production behavior change; final full gate remains required. Full and focused logs retained under edge-autoupdate/evidence.

Head 9819d8981 iterate: server 565 passed, 1 failed, 52 ignored; failure remote_runtime::tests::standby::control_queue::saturated_native_control_queue_does_not_hide_primary_terminal_output at remote_control_queue_tests.rs:229 (live connection already closed). Isolated rerun with --features remote passed: 1 passed, 0 failed, 574 filtered; CONTROL_SATURATION active=true queued=1 native_primary_live=true shadow_output=0. Initial invocation without remote was excluded from evidence. No waiver or production behavior change; final full gate remains required. Full and focused logs retained under edge-autoupdate/evidence.
kayg commented 2026-10-17 02:25:09 +00:00
Author
Owner
Copy link

delta-iterate-pacing.log
delta-control-queue-remote-rerun.log

[delta-iterate-pacing.log](https://git.kayg.org/attachments/334a7436-416e-425c-9a0e-d2f1c3247e8d) [delta-control-queue-remote-rerun.log](https://git.kayg.org/attachments/9970c1b8-fec0-4fe4-a609-1d55fe897768)
kayg commented 2026-10-17 02:39:20 +00:00
Author
Owner
Copy link

Head 9819d8981, clean worktree. Both matched profile controls and release harnesses built. Qualification drivers are active, waiting on the shared perf VM lock between workloads (flock -w 3600), with 3/20 native runs and 1/160 profile workloads complete so far. Native pair 00: production and candidate both miss the three same-session flood budgets; candidate is slower in this single pair, so no noise/no-regression conclusion yet. Candidate signed staging executable built; release harness and ordinary ARM build are pending build slots/compilation. No local timing substituted, no budget/cap changes, no final gate claimed.

Head 9819d8981, clean worktree. Both matched profile controls and release harnesses built. Qualification drivers are active, waiting on the shared perf VM lock between workloads (flock -w 3600), with 3/20 native runs and 1/160 profile workloads complete so far. Native pair 00: production and candidate both miss the three same-session flood budgets; candidate is slower in this single pair, so no noise/no-regression conclusion yet. Candidate signed staging executable built; release harness and ordinary ARM build are pending build slots/compilation. No local timing substituted, no budget/cap changes, no final gate claimed.
kayg commented 2026-10-17 02:44:07 +00:00
Author
Owner
Copy link

Profile qualification setup finding: bench-agent-output.py stopped in client.until(shim-test) before any payload/timing row. Perf VM login shell does not consume the isolated zsh profile; verify-agent-flood.py had the same prompt dependency. Preserved the interrupted run under evidence/delta-profile-prompt-refused (including two complete echo controls, not pooled into the restarted comparison). Removed only the prompt waits: both scripts already send a split printf marker command and consume it before starting their timers. Workload sizes, credit and payload checks are unchanged. The owned queued perf-lock process was identified by its exact run command and stopped by PID; its scope/run directory were cleaned. Native production comparison continues independently. Will validate both output paths on the VM before committing this fixture correction, then restart the predefined 20 profile pairs with the corrected setup.

Profile qualification setup finding: bench-agent-output.py stopped in client.until(shim-test) before any payload/timing row. Perf VM login shell does not consume the isolated zsh profile; verify-agent-flood.py had the same prompt dependency. Preserved the interrupted run under evidence/delta-profile-prompt-refused (including two complete echo controls, not pooled into the restarted comparison). Removed only the prompt waits: both scripts already send a split printf marker command and consume it before starting their timers. Workload sizes, credit and payload checks are unchanged. The owned queued perf-lock process was identified by its exact run command and stopped by PID; its scope/run directory were cleaned. Native production comparison continues independently. Will validate both output paths on the VM before committing this fixture correction, then restart the predefined 20 profile pairs with the corrected setup.
kayg commented 2026-10-17 02:44:54 +00:00
Author
Owner
Copy link

Restarted the predefined 20 profile pairs after fixing prompt admission (no throughput sample existed in the refused setup). Each matched pair now holds one lock for its eight sequential workloads, capped at 240 seconds, with a separate CPUWeight=10000 scope and raw receipt for each workload; releases the lock between pairs. This keeps the paired variants adjacent and avoids 160 separate lock-queue waits. Upload/build/receipt transfer remain outside the lock. Same source artifacts, n=1000 echo, 50 MiB output, 1000 TLS hosts, AB/BA alternation; all budget misses retained. Any incomplete workload stops qualification. Corrected scripts are still uncommitted until the first VM pair validates both output paths.

Restarted the predefined 20 profile pairs after fixing prompt admission (no throughput sample existed in the refused setup). Each matched pair now holds one lock for its eight sequential workloads, capped at 240 seconds, with a separate CPUWeight=10000 scope and raw receipt for each workload; releases the lock between pairs. This keeps the paired variants adjacent and avoids 160 separate lock-queue waits. Upload/build/receipt transfer remain outside the lock. Same source artifacts, n=1000 echo, 50 MiB output, 1000 TLS hosts, AB/BA alternation; all budget misses retained. Any incomplete workload stops qualification. Corrected scripts are still uncommitted until the first VM pair validates both output paths.
kayg commented 2026-10-17 02:48:12 +00:00
Author
Owner
Copy link

Committed and pushed b0361d607d: output measurements now fence shell startup with their existing ordered marker command, without a zsh prompt dependency. RED: VM dev-profile output refused before payload at client.until(shim-test). GREEN: both dev/compact controls completed LF/CRLF/PRINTABLE 50 MiB each and the separate byte-verified credited flood; all exit 0. Both 1000-real-host TLS cases also passed. Python syntax (2 files) and git diff --check passed. First corrected pair is validation only for this fixture change; all 20 predefined profile pairs still run before the compiler-profile decision. Rust source/artifacts remain those from 9819d8981.

Committed and pushed b0361d607d983d54a9db6b1615120dbc4e5b626a: output measurements now fence shell startup with their existing ordered marker command, without a zsh prompt dependency. RED: VM dev-profile output refused before payload at client.until(shim-test). GREEN: both dev/compact controls completed LF/CRLF/PRINTABLE 50 MiB each and the separate byte-verified credited flood; all exit 0. Both 1000-real-host TLS cases also passed. Python syntax (2 files) and git diff --check passed. First corrected pair is validation only for this fixture change; all 20 predefined profile pairs still run before the compiler-profile decision. Rust source/artifacts remain those from 9819d8981.
kayg commented 2026-10-17 02:49:14 +00:00
Author
Owner
Copy link

delta-profile-00-output-dev.log
delta-profile-00-output-dev.log
delta-profile-00-output-compact.log
delta-profile-00-payload-dev.log
delta-profile-00-payload-compact.log

[delta-profile-00-output-dev.log](https://git.kayg.org/attachments/204856c8-c50a-4cad-8b55-ef29a6b1c14e) [delta-profile-00-output-dev.log](https://git.kayg.org/attachments/3659856c-89a6-4baf-9e75-0d122c9edff4) [delta-profile-00-output-compact.log](https://git.kayg.org/attachments/748d23de-ef24-434d-ba37-ef4c23145c94) [delta-profile-00-payload-dev.log](https://git.kayg.org/attachments/bd2d190f-ed71-4a3a-9454-965ec2377c4a) [delta-profile-00-payload-compact.log](https://git.kayg.org/attachments/41eca00c-c94e-4154-aa4c-e7b8752cd130)
kayg commented 2026-10-17 02:49:47 +00:00
Author
Owner
Copy link

Before a compiler-profile decision: corrected pairs 00/01 show printable output dev 55.433/56.708 MiB/s vs compact 50.456/46.241 MiB/s; this is preliminary, not a completed regression/noise claim. Original 20-pair matrix continues unchanged. Started building an attribution control with only profile.release.package.infraternal-plugin-api.opt-level restored to dev=3, leaving the CLI override; working manifest untouched. If the API override costs throughput, this control establishes whether a narrower shipping recipe fits the unchanged cap while retaining the existing API hot-path profile. No wider profile change will be accepted from size numbers alone.

Before a compiler-profile decision: corrected pairs 00/01 show printable output dev 55.433/56.708 MiB/s vs compact 50.456/46.241 MiB/s; this is preliminary, not a completed regression/noise claim. Original 20-pair matrix continues unchanged. Started building an attribution control with only profile.release.package.infraternal-plugin-api.opt-level restored to dev=3, leaving the CLI override; working manifest untouched. If the API override costs throughput, this control establishes whether a narrower shipping recipe fits the unchanged cap while retaining the existing API hot-path profile. No wider profile change will be accepted from size numbers alone.
kayg commented 2026-10-17 02:57:40 +00:00
Author
Owner
Copy link

Ordinary compact ARM control built at source b0361d607 (Rust source unchanged from 9819d8981): 18,834,752 bytes, -665,624 vs unchanged dev cap 19,500,376; check-production-trust PASS. Artifact retained separately from staging. This is a size control only: no cap ratchet or compiler-profile approval while the runtime matrix is pending. Candidate reconnect staging is now exercising 128 real PTYs with listener probes on the locked VM.

Ordinary compact ARM control built at source b0361d607 (Rust source unchanged from 9819d8981): 18,834,752 bytes, -665,624 vs unchanged dev cap 19,500,376; check-production-trust PASS. Artifact retained separately from staging. This is a size control only: no cap ratchet or compiler-profile approval while the runtime matrix is pending. Candidate reconnect staging is now exercising 128 real PTYs with listener probes on the locked VM.
kayg commented 2026-10-17 02:59:12 +00:00
Author
Owner
Copy link

Candidate exact reconnect review case PASS on the locked perf VM, release-profile staging fixture from Rust source 9819d8981 (current script-only head b0361d607). REVIEW reconnect phase=healthy_manual_apply active_routes=0 live_pty_sessions=128 surviving_shims=128 ca_unlocked=true listener_gap_bracket_ms=0.000 probe_max_interval_ms=10.922 failed_probes=0 listener_unavailable_lower_ms=0.000 four_rtt_plus_50_ms=71.703

Zero refused probes; maximum probe interval 10.922 ms < calibrated allowance 71.703 ms. This establishes a sampling bound, not an exact zero gap. All 128 live PTY shims survived and the CA stayed unlocked. This isolated reconnect case has active_routes=0; full attached-route acceptance and production transport comparison remain pending. Compiler-profile decision and final production artifact qualification remain pending.

Candidate exact reconnect review case PASS on the locked perf VM, release-profile staging fixture from Rust source 9819d8981 (current script-only head b0361d607). REVIEW reconnect phase=healthy_manual_apply active_routes=0 live_pty_sessions=128 surviving_shims=128 ca_unlocked=true listener_gap_bracket_ms=0.000 probe_max_interval_ms=10.922 failed_probes=0 listener_unavailable_lower_ms=0.000 four_rtt_plus_50_ms=71.703 Zero refused probes; maximum probe interval 10.922 ms < calibrated allowance 71.703 ms. This establishes a sampling bound, not an exact zero gap. All 128 live PTY shims survived and the CA stayed unlocked. This isolated reconnect case has active_routes=0; full attached-route acceptance and production transport comparison remain pending. Compiler-profile decision and final production artifact qualification remain pending.
kayg commented 2026-10-17 03:00:51 +00:00
Author
Owner
Copy link

delta-candidate-reconnect-vm.log
delta-candidate-reconnect-driver.log

[delta-candidate-reconnect-vm.log](https://git.kayg.org/attachments/44fdc59e-3008-47ae-b484-738b362f475c) [delta-candidate-reconnect-driver.log](https://git.kayg.org/attachments/bda65680-e434-46dc-8c39-71364a19bfd0)
kayg commented 2026-10-17 03:02:46 +00:00
Author
Owner
Copy link

CLI-only x86 control built with API opt-level restored to dev=3: 20,578,592 bytes, -721,424 vs unchanged cap; production-trust PASS. API speed costs only +62,528 bytes versus compact. Starting a predefined separate 20 interleaved matched dev/CLI-only pair matrix with identical echo/output/byte-validation/1000-TLS workloads and 240-second bounded pair locks. The TLS test executable is byte-identical to the dev control because the CLI crate is not linked there; recording hashes and actual runs, plus native CLI echo/output paths. Original 20-pair compact comparison continues unchanged for a complete attribution receipt. No compiler-profile acceptance or cap change yet.

CLI-only x86 control built with API opt-level restored to dev=3: 20,578,592 bytes, -721,424 vs unchanged cap; production-trust PASS. API speed costs only +62,528 bytes versus compact. Starting a predefined separate 20 interleaved matched dev/CLI-only pair matrix with identical echo/output/byte-validation/1000-TLS workloads and 240-second bounded pair locks. The TLS test executable is byte-identical to the dev control because the CLI crate is not linked there; recording hashes and actual runs, plus native CLI echo/output paths. Original 20-pair compact comparison continues unchanged for a complete attribution receipt. No compiler-profile acceptance or cap change yet.
kayg commented 2026-10-17 03:03:38 +00:00
Author
Owner
Copy link

Working tree now restores the plugin API to dev default opt-level=3 and removes redundant package strip=true overrides; the CLI-only override remains provisional pending its separate 20-pair runtime qualification. CLI-only ARM build started. This conservative restoration avoids retaining an API-wide profile cost for just 62,528 bytes; original 20-pair compact attribution still completes from immutable artifacts. No recipe commit/cap change until qualification. Existing compact staging receipts stay labeled as such; final staging artifacts will be regenerated if the narrower recipe qualifies.

Working tree now restores the plugin API to dev default opt-level=3 and removes redundant package strip=true overrides; the CLI-only override remains provisional pending its separate 20-pair runtime qualification. CLI-only ARM build started. This conservative restoration avoids retaining an API-wide profile cost for just 62,528 bytes; original 20-pair compact attribution still completes from immutable artifacts. No recipe commit/cap change until qualification. Existing compact staging receipts stay labeled as such; final staging artifacts will be regenerated if the narrower recipe qualifies.
kayg commented 2026-10-17 03:17:23 +00:00
Author
Owner
Copy link

Qualification coverage finding: the library TLS diagnostic changes with the API profile but does not exercise the native CLI link profile; dev/CLI-only harness executables are byte-identical, as already recorded. Those samples cannot justify retaining the CLI override. Added a shared real-enrolled-client fixture by extracting the existing registry diagnostic setup, with a small real TCP/mTLS admission smoke test; fmt/clippy/tests queued. Next is a shipping-executable handshake case at 1000 active hosts, 50 users, 10000 stored nodes, 128 live PTYs, with credential allocation outside the timed region. It will use existing CA/enrollment/TLS code, no new engine or dependency, and no key material in files/logs/argv. CLI-only recipe remains uncommitted until the actual shipping path is qualified. Existing matrices continue for echo/output and API-profile attribution.

Qualification coverage finding: the library TLS diagnostic changes with the API profile but does not exercise the native CLI link profile; dev/CLI-only harness executables are byte-identical, as already recorded. Those samples cannot justify retaining the CLI override. Added a shared real-enrolled-client fixture by extracting the existing registry diagnostic setup, with a small real TCP/mTLS admission smoke test; fmt/clippy/tests queued. Next is a shipping-executable handshake case at 1000 active hosts, 50 users, 10000 stored nodes, 128 live PTYs, with credential allocation outside the timed region. It will use existing CA/enrollment/TLS code, no new engine or dependency, and no key material in files/logs/argv. CLI-only recipe remains uncommitted until the actual shipping path is qualified. Existing matrices continue for echo/output and API-profile attribution.
kayg commented 2026-10-17 03:21:20 +00:00
Author
Owner
Copy link

ARM CLI-only first build produced 25,426,720 bytes and file reports not stripped. readelf shows .symtab 0x29de88 and .strtab 0x3a0ec3 bytes; this is not an attributed API code increase. Restored the explicit CLI/release package strip=true settings to match the measured native control; earlier characterization as redundant was incorrect for this recipe. Unstripped artifact/build metadata preserved separately. Rebuilding ordinary ARM before any size/cap conclusion. No cap changed.

ARM CLI-only first build produced 25,426,720 bytes and file reports not stripped. readelf shows .symtab 0x29de88 and .strtab 0x3a0ec3 bytes; this is not an attributed API code increase. Restored the explicit CLI/release package strip=true settings to match the measured native control; earlier characterization as redundant was incorrect for this recipe. Unstripped artifact/build metadata preserved separately. Rebuilding ordinary ARM before any size/cap conclusion. No cap changed.
kayg commented 2026-10-17 03:32:13 +00:00
Author
Owner
Copy link

Committed and pushed 1a72c23cc3: extracted existing real enrolled-client and TCP/mTLS/Hello setup into crates/infraternal-server/src/remote_test_clients.rs; registry retirement tests reuse it. No runtime API/dependency change. Per-commit gates: cargo fmt/check PASS; all-target server Clippy with remote PASS; real two-host admission test 1 passed; retirement tests 2 passed / 1 ignored (VM-only diagnostic). Native shipping handshake diagnostic and CLI profile launcher are now wired but uncommitted, awaiting their gates and a real VM run. Cargo API speed restoration remains a separate uncommitted recipe change.

Committed and pushed 1a72c23cc358fb8489a1b98da47f58d3a4e28928: extracted existing real enrolled-client and TCP/mTLS/Hello setup into crates/infraternal-server/src/remote_test_clients.rs; registry retirement tests reuse it. No runtime API/dependency change. Per-commit gates: cargo fmt/check PASS; all-target server Clippy with remote PASS; real two-host admission test 1 passed; retirement tests 2 passed / 1 ignored (VM-only diagnostic). Native shipping handshake diagnostic and CLI profile launcher are now wired but uncommitted, awaiting their gates and a real VM run. Cargo API speed restoration remains a separate uncommitted recipe change.
kayg commented 2026-10-17 07:32:44 +00:00
Author
Owner
Copy link

Resuming edge-autoupdate (new worker) at 1a72c23cc, base origin/dev merge-base c47a438be. Previous worker's four uncommitted qualification drafts (CLI-profile launcher, native handshake diagnostic, API opt-level restoration) are kept on local unpushed branch edge-autoupdate-profile-drafts (4618441cf, untracked file in its ^3); tree clean.

Partial A/B state recovered from receipts (locked perf VM, AB/BA): compact vs dev profile, 12 pairs: PRINTABLE output median 34.18 vs 41.06 MiB/s, LF 8.08 vs 8.61 MiB/s (paired 95% interval [-1.02,-0.13], slower). CLI-only vs dev, 6 pairs: PRINTABLE 40.14 vs 47.53 MiB/s. Echo/TLS medians within noise. Conclusion: the compiler-profile override is NOT shown harmless; output throughput leans slower. Per the brief it gets reverted.

Size: with dev's profiles the branch image is 22,218,144 B x86 (+918,128 over cap) / 20,322,328 B ARM (+821,952). The real code growth was hidden by the profile change. The shipping default enables plugin-backup -> infraternal-server/backup -> backup/server (protected-key, encryption, key administration, key copies, private resources), i.e. the encrypted-recovery design that D295 rejected. Next: remove that rejected code from the shipping graph (D295 path lives under release, not backup), rebuild with dev profiles, attribute what remains.

Resuming edge-autoupdate (new worker) at 1a72c23cc, base origin/dev merge-base c47a438be. Previous worker's four uncommitted qualification drafts (CLI-profile launcher, native handshake diagnostic, API opt-level restoration) are kept on local unpushed branch `edge-autoupdate-profile-drafts` (4618441cf, untracked file in its ^3); tree clean. Partial A/B state recovered from receipts (locked perf VM, AB/BA): compact vs dev profile, 12 pairs: PRINTABLE output median 34.18 vs 41.06 MiB/s, LF 8.08 vs 8.61 MiB/s (paired 95% interval [-1.02,-0.13], slower). CLI-only vs dev, 6 pairs: PRINTABLE 40.14 vs 47.53 MiB/s. Echo/TLS medians within noise. Conclusion: the compiler-profile override is NOT shown harmless; output throughput leans slower. Per the brief it gets reverted. Size: with dev's profiles the branch image is 22,218,144 B x86 (+918,128 over cap) / 20,322,328 B ARM (+821,952). The real code growth was hidden by the profile change. The shipping default enables `plugin-backup -> infraternal-server/backup -> backup/server (protected-key, encryption, key administration, key copies, private resources)`, i.e. the encrypted-recovery design that D295 rejected. Next: remove that rejected code from the shipping graph (D295 path lives under `release`, not `backup`), rebuild with dev profiles, attribute what remains.
kayg commented 2026-10-17 08:26:32 +00:00
Author
Owner
Copy link

Size step 1 (working tree on 1a72c23cc, dev's release profiles exactly, plugin-backup no longer enables infraternal-server/backup): x86 static release 21,935,904 B, +635,888 B over the 21,300,016 B cap (was +918,128 with the rejected backup custody linked). The rejected D147/D168 encrypted-custody graph accounts for 282,240 B. The D295 path (update_recovery, release_update, release_startup) sits under release and stays. Build took 44.5 min at load ~33 (nice 19).
Next: matched cargo-bloat crate attribution, dev 3b2183eaa vs this tree (strip disabled only for attribution), running now.

Size step 1 (working tree on 1a72c23cc, dev's release profiles exactly, `plugin-backup` no longer enables `infraternal-server/backup`): x86 static release 21,935,904 B, +635,888 B over the 21,300,016 B cap (was +918,128 with the rejected backup custody linked). The rejected D147/D168 encrypted-custody graph accounts for 282,240 B. The D295 path (`update_recovery`, `release_update`, `release_startup`) sits under `release` and stays. Build took 44.5 min at load ~33 (nice 19). Next: matched cargo-bloat crate attribution, dev 3b2183eaa vs this tree (strip disabled only for attribution), running now.
kayg commented 2026-10-17 10:45:17 +00:00
Author
Owner
Copy link

D243 attribution, dev 3b2183eaa vs this tree (dev's release profiles exactly, backup custody unhooked), x86 musl, strip disabled only for attribution (cargo-bloat crates + nm symbols):

  • .text 16,251,604 -> 16,757,366 B (+505,762). Shipping (stripped) delta +635,888 B.
  • By crate: infraternal_plugin_release +294,466 (already opt-level s on dev), infraternal_server +162,932 (already s), std +44,113, plugin_api +25,610, CLI +21,542, axum +8,590; host_facts -63,542.
  • By module (symbols): updater +62 KB, release_update +50 KB, CLI action dispatch +41 KB, restart control +35 KB, websocket router +35 KB, release_startup +29 KB, update_recovery +26 KB, host_receiver +20 KB, release service +18 KB, host_slots +14 KB, host catalog +11 KB, unwind tables +46 KB. No duplicated engine, no new HTTP/TLS/JSON stack, no single outlier; the cost is spread across the decided D251 scope (quiet-window updater, host lockstep, D295 undo, listener handoff). Only private_http (+8 KB) is left-over rejected custody code.
  • Conclusion: without the compiler-profile override (which the A/B data does not clear) the branch cannot meet dev's x86 ceiling by trimming; realistic trims are tens of KB against +636 KB. This needs an owner size decision (as D298 did for logins). No ceiling changed.
    n-nm-diff.txt
    n-branch-bloat-crates.json
    n-dev-bloat-crates.json
D243 attribution, dev 3b2183eaa vs this tree (dev's release profiles exactly, backup custody unhooked), x86 musl, strip disabled only for attribution (cargo-bloat crates + nm symbols): - .text 16,251,604 -> 16,757,366 B (+505,762). Shipping (stripped) delta +635,888 B. - By crate: infraternal_plugin_release +294,466 (already opt-level s on dev), infraternal_server +162,932 (already s), std +44,113, plugin_api +25,610, CLI +21,542, axum +8,590; host_facts -63,542. - By module (symbols): updater +62 KB, release_update +50 KB, CLI action dispatch +41 KB, restart control +35 KB, websocket router +35 KB, release_startup +29 KB, update_recovery +26 KB, host_receiver +20 KB, release service +18 KB, host_slots +14 KB, host catalog +11 KB, unwind tables +46 KB. No duplicated engine, no new HTTP/TLS/JSON stack, no single outlier; the cost is spread across the decided D251 scope (quiet-window updater, host lockstep, D295 undo, listener handoff). Only private_http (+8 KB) is left-over rejected custody code. - Conclusion: without the compiler-profile override (which the A/B data does not clear) the branch cannot meet dev's x86 ceiling by trimming; realistic trims are tens of KB against +636 KB. This needs an owner size decision (as D298 did for logins). No ceiling changed. [n-nm-diff.txt](https://git.kayg.org/attachments/8b491194-aaf0-4a0f-b42e-474cdb0b8d6f) [n-branch-bloat-crates.json](https://git.kayg.org/attachments/2b53eb98-6719-4e1b-aa4d-c10867060a6c) [n-dev-bloat-crates.json](https://git.kayg.org/attachments/30fdb00a-8176-4d8b-8eea-d834d806a368)
kayg commented 2026-10-17 12:32:23 +00:00
Author
Owner
Copy link

Paused on coordinator order (host load). Pushed head 698f6aee3 on edge-autoupdate; tree clean; nothing of mine running.

New commits this round:

  • 389b7b0af Keep rejected backup custody out of the shipping server [295,243]: plugin-backup no longer enables infraternal-server/backup. x86 static with dev profiles 22,218,144 -> 21,935,904 B (-282,240).
  • 698f6aee3 Restore dev's release profiles for the CLI and plugin API [243,5]: the A/B receipts do not show the override harmless (compact vs dev, 12 pairs: PRINTABLE output median 34.18 vs 41.06 MiB/s; LF paired 95% interval -1.02..-0.13 MiB/s), so it is reverted per the brief.
    Per-commit gates: fmt PASS; clippy -D warnings (infraternal, infraternal-server, plugin-backup, plugin-release, all targets) PASS; CLI bin tests 83 passed / 0 failed / 1 ignored; update_recovery 26 passed / 0 failed / 1 ignored.

Finding status:

  • P1 automatic path skips the DB copy: fixed earlier (one online-backup copy on every switch path; update_recovery suite green above).
  • P1 warm-handoff listener gap: fixed earlier by passing the listening sockets across exec. Last VM receipt (Rust 9819d8981, compact profile): 0 refused probes, max probe interval 10.922 ms vs 71.703 ms allowance, 128 shims kept, CA unlocked. Re-measuring on 698f6aee3 is queued and was stopped by the pause (not started).
  • P1 images unbounded: fixed earlier (current + previous + one DB copy; 20-update test green).
  • P1 128-route lease / native latency gate: the reviewer's VM runs show the same-session budget misses 20/20 on dev 3b2183eaa as well, so they predate this branch.
  • P2 backward clock correction: fixed in 27c5205ae (monotonic, capped at 120 s).
  • Compiler profile: reverted (above).

Blocking, owner decision needed: with dev's profiles the image is +635,888 B over the x86 cap (ARM not rebuilt; earlier dev-profile control was +821,952 before the backup unhook). The attribution posted above shows the cost is spread across the decided D251 scope with no outlier; trimming cannot close +636 KB. Options for the owner: a measured cap allowance for D251 (as D298 did for logins), or a qualified narrower profile.
Not run: final scripts/verify fast (stopped before it got a build slot; it will fail the size row as above) and the VM re-measurement. Both resume on the coordinator's word.

Paused on coordinator order (host load). Pushed head 698f6aee3 on edge-autoupdate; tree clean; nothing of mine running. New commits this round: - 389b7b0af Keep rejected backup custody out of the shipping server [295,243]: `plugin-backup` no longer enables `infraternal-server/backup`. x86 static with dev profiles 22,218,144 -> 21,935,904 B (-282,240). - 698f6aee3 Restore dev's release profiles for the CLI and plugin API [243,5]: the A/B receipts do not show the override harmless (compact vs dev, 12 pairs: PRINTABLE output median 34.18 vs 41.06 MiB/s; LF paired 95% interval -1.02..-0.13 MiB/s), so it is reverted per the brief. Per-commit gates: fmt PASS; clippy -D warnings (infraternal, infraternal-server, plugin-backup, plugin-release, all targets) PASS; CLI bin tests 83 passed / 0 failed / 1 ignored; update_recovery 26 passed / 0 failed / 1 ignored. Finding status: - P1 automatic path skips the DB copy: fixed earlier (one online-backup copy on every switch path; update_recovery suite green above). - P1 warm-handoff listener gap: fixed earlier by passing the listening sockets across exec. Last VM receipt (Rust 9819d8981, compact profile): 0 refused probes, max probe interval 10.922 ms vs 71.703 ms allowance, 128 shims kept, CA unlocked. Re-measuring on 698f6aee3 is queued and was stopped by the pause (not started). - P1 images unbounded: fixed earlier (current + previous + one DB copy; 20-update test green). - P1 128-route lease / native latency gate: the reviewer's VM runs show the same-session budget misses 20/20 on dev 3b2183eaa as well, so they predate this branch. - P2 backward clock correction: fixed in 27c5205ae (monotonic, capped at 120 s). - Compiler profile: reverted (above). Blocking, owner decision needed: with dev's profiles the image is +635,888 B over the x86 cap (ARM not rebuilt; earlier dev-profile control was +821,952 before the backup unhook). The attribution posted above shows the cost is spread across the decided D251 scope with no outlier; trimming cannot close +636 KB. Options for the owner: a measured cap allowance for D251 (as D298 did for logins), or a qualified narrower profile. Not run: final `scripts/verify fast` (stopped before it got a build slot; it will fail the size row as above) and the VM re-measurement. Both resume on the coordinator's word.
kayg commented 2026-10-21 17:48:10 +00:00
Author
Owner
Copy link

Resume started: edge-autoupdate-r2 from 698f6aee3; merging origin/dev adee19da07 without rebasing. Initial merge reports 25 conflicted paths. Scope: D251 integration, measured D301 caps, update_recovery and locked perf VM handoff, persisted host version/update state and owner-present legacy SSH repair (D23/D148). No deploy; no contact with 10.69.69.125. Evidence under edge-autoupdate-resume scratch.

Resume started: edge-autoupdate-r2 from 698f6aee3; merging origin/dev adee19da07cea19e538cb801858ce0d901841b3a without rebasing. Initial merge reports 25 conflicted paths. Scope: D251 integration, measured D301 caps, update_recovery and locked perf VM handoff, persisted host version/update state and owner-present legacy SSH repair (D23/D148). No deploy; no contact with 10.69.69.125. Evidence under edge-autoupdate-resume scratch.
kayg commented 2026-10-21 17:51:39 +00:00
Author
Owner
Copy link

Additive #236 contract before implementation: retain last reported infraternal-agent version and machine-update capability plus update state in admitted-host inventory; legacy capability absence yields needs_manual_update / "Needs a manual update", with unknown version rather than inference. Repair is an explicit owner-present bootstrap request bound to one existing admitted host, its mode/uid and authenticated SSH destination. It reuses add-host verification, transfer, activation and canary; it must preserve prior host/certificate/session identity on failure and never consume stored SSH secrets unattended (D23/D148). Missing saved SSH coordinates requires normal SSH setup. No new updater engine or dependency. Incremental repair size is measured separately from the D301 merge artifact. Merge finding: 25 conflicted paths; release-script fixtures pass 8/8 after preserving session binaries and SOURCE/review admission.

Additive #236 contract before implementation: retain last reported infraternal-agent version and machine-update capability plus update state in admitted-host inventory; legacy capability absence yields needs_manual_update / "Needs a manual update", with unknown version rather than inference. Repair is an explicit owner-present bootstrap request bound to one existing admitted host, its mode/uid and authenticated SSH destination. It reuses add-host verification, transfer, activation and canary; it must preserve prior host/certificate/session identity on failure and never consume stored SSH secrets unattended (D23/D148). Missing saved SSH coordinates requires normal SSH setup. No new updater engine or dependency. Incremental repair size is measured separately from the D301 merge artifact. Merge finding: 25 conflicted paths; release-script fixtures pass 8/8 after preserving session binaries and SOURCE/review admission.
kayg commented 2026-10-21 17:58:57 +00:00
Author
Owner
Copy link

Integration findings (uncommitted merge): first workspace check failed because dev replaced AgentPlugin::format_human with present(Presented); release metadata/live handlers and their existing tests are adapted to that API. Dev asynchronous session-renewal and authority watchdog remain; D251 foreground admission and D295 durable writer reservations are retained. Extracted SSH ACTIVATE retains the previous A/B symlink; the newer negotiated transfer retains exclusive cache-reuse copies. Review-admission 14/14, release scripts 8/8, staging artifacts 3/3 pass. Broad Python discovery is not claimed green: three CLI modules require INFRATERNAL_BIN and must run with the compiled executable. Correction: initial merge has 26 conflicted paths, not the 25 stated in the start comment.

Initial compiler receipt: merge-check.log
release scripts, admission, staging artifacts.

Integration findings (uncommitted merge): first workspace check failed because dev replaced AgentPlugin::format_human with present(Presented); release metadata/live handlers and their existing tests are adapted to that API. Dev asynchronous session-renewal and authority watchdog remain; D251 foreground admission and D295 durable writer reservations are retained. Extracted SSH ACTIVATE retains the previous A/B symlink; the newer negotiated transfer retains exclusive cache-reuse copies. Review-admission 14/14, release scripts 8/8, staging artifacts 3/3 pass. Broad Python discovery is not claimed green: three CLI modules require INFRATERNAL_BIN and must run with the compiled executable. Correction: initial merge has 26 conflicted paths, not the 25 stated in the start comment. Initial compiler receipt: [merge-check.log](https://git.kayg.org/attachments/826ca7f5-a56f-4460-8fa0-99924d1877c3) [release scripts](https://git.kayg.org/attachments/0d76b822-5c55-4991-8727-07cffda324aa), [admission](https://git.kayg.org/attachments/14b5a3b6-1820-483f-99dc-23ac2200d2ca), [staging artifacts](https://git.kayg.org/attachments/089a41be-2a45-4dce-ba9f-7c8820133ceb).
kayg commented 2026-10-21 18:12:10 +00:00
Author
Owner
Copy link

Checkpoint, still working (not a finished merge): origin/edge-autoupdate-r2 now exists at 698f6aee3b. Worktree has a resolved, staged merge of origin/dev adee19da07; no merge commit yet because its gates are pending. Formatting and repository artifact gate pass (829 changed paths against pre-merge c47a438be7); release-plugin default server-feature cargo check --all-targets passes. Host-side agent-feature check is next; full scripts/verify iterate is waiting for a shared build slot.

Resolved merge patch against 698f6aee3; apply to that head to recover the staged tree, retaining adee19da07 as the merge parent. Release server-feature check. Merge commit message is prepared under edge-autoupdate-resume/evidence/merge-message.txt. No cap change, legacy-host implementation, static measurement or VM measurement has been claimed. No deployment or contact with 10.69.69.125.

Checkpoint, still working (not a finished merge): origin/edge-autoupdate-r2 now exists at 698f6aee3bbfd7af17b02f074dc22613cb125f77. Worktree has a resolved, staged merge of origin/dev adee19da07cea19e538cb801858ce0d901841b3a; no merge commit yet because its gates are pending. Formatting and repository artifact gate pass (829 changed paths against pre-merge c47a438be76e); release-plugin default server-feature cargo check --all-targets passes. Host-side agent-feature check is next; full scripts/verify iterate is waiting for a shared build slot. [Resolved merge patch against 698f6aee3](https://git.kayg.org/attachments/984bd530-44e2-40ee-ad8d-2d6d56078346); apply to that head to recover the staged tree, retaining adee19da07ce as the merge parent. [Release server-feature check](https://git.kayg.org/attachments/9096e08b-ee01-4f81-b6be-624cee2365f4). Merge commit message is prepared under edge-autoupdate-resume/evidence/merge-message.txt. No cap change, legacy-host implementation, static measurement or VM measurement has been claimed. No deployment or contact with 10.69.69.125.
kayg commented 2026-10-21 18:23:51 +00:00
Author
Owner
Copy link

Integration checkpoint: release-plugin server + host feature type check passes; existing host off/status/reconstruction regression passes 1/1. New restored_host_update_is_presented_as_needing_attention regression failed before the presentation correction (Tone::Good vs Tone::Attention) and passes after it (1/1). RED, GREEN.

Full merge iterate is active, not green: its first compile-out/clippy attempt found two merged API mismatches (daemon.rs:733 called machine_control on the now-optional registry; plugins.rs:111 omitted the new uninstall Kernel argument). Both are corrected in the staged merge. The gate continues to collect other failures before a clean rerun. WebSocket integration also retains private owner dispatch/router hooks, shared contiguous-input admission and D295 writer reservations alongside dev authority reads. No cap or feature-completion claim.

Integration checkpoint: release-plugin server + host feature type check passes; existing host off/status/reconstruction regression passes 1/1. New restored_host_update_is_presented_as_needing_attention regression failed before the presentation correction (Tone::Good vs Tone::Attention) and passes after it (1/1). [RED](https://git.kayg.org/attachments/6d776249-610b-4192-9bec-7a0ea69bc475), [GREEN](https://git.kayg.org/attachments/a9c09105-ac28-48fb-9926-ca8cdfd934fd). Full merge iterate is active, not green: its first compile-out/clippy attempt found two merged API mismatches (daemon.rs:733 called machine_control on the now-optional registry; plugins.rs:111 omitted the new uninstall Kernel argument). Both are corrected in the staged merge. The gate continues to collect other failures before a clean rerun. WebSocket integration also retains private owner dispatch/router hooks, shared contiguous-input admission and D295 writer reservations alongside dev authority reads. No cap or feature-completion claim.
kayg commented 2026-10-21 18:52:11 +00:00
Author
Owner
Copy link

Merge rerun remains queued through the required build-slot wrapper; the three occupied slots are verify fast (started 20:40 CEST), revocation baseline/primitive (20:31), and release build (20:24). The resolved merge tree is held fixed while its gate waits. No size-cap change or VM measurement claimed. Legacy repair drafts are outside the checkout: bind one existing identity to the live owner socket, preserve admitted authority on failure, and use the normal SSH installation transaction rather than detached setup.

Merge rerun remains queued through the required build-slot wrapper; the three occupied slots are verify fast (started 20:40 CEST), revocation baseline/primitive (20:31), and release build (20:24). The resolved merge tree is held fixed while its gate waits. No size-cap change or VM measurement claimed. Legacy repair drafts are outside the checkout: bind one existing identity to the live owner socket, preserve admitted authority on failure, and use the normal SSH installation transaction rather than detached setup.
kayg commented 2026-10-21 19:06:53 +00:00
Author
Owner
Copy link

Merge gate rerun 2 failed in clippy/test, with integration fixes now staged: daemon writer lint boundary; uninstall test imports/Kernel argument; five-value runtime fixture; cgroup shim discovery in the update proof; current CLI help and test scratch setup. The CLI compile-out helper also masked an earlier failing invocation, so it now propagates each failure. Gate 3 is queued. The separate-process update-control regression was RED (operational refusal incorrectly mapped to NotFound/exit 4) then GREEN (1/1) after preserving Failed/exit 1 and an accurate operator message. Server all-target check and saturated-route regression also pass. No caps/VM/completion claim yet.

merge-iterate-2.log
merge-control-red.log
merge-server-check-2.log

merge-control-green.log

Merge gate rerun 2 failed in clippy/test, with integration fixes now staged: daemon writer lint boundary; uninstall test imports/Kernel argument; five-value runtime fixture; cgroup shim discovery in the update proof; current CLI help and test scratch setup. The CLI compile-out helper also masked an earlier failing invocation, so it now propagates each failure. Gate 3 is queued. The separate-process update-control regression was RED (operational refusal incorrectly mapped to NotFound/exit 4) then GREEN (1/1) after preserving Failed/exit 1 and an accurate operator message. Server all-target check and saturated-route regression also pass. No caps/VM/completion claim yet. [merge-iterate-2.log](https://git.kayg.org/attachments/ccb2c140-8982-41b5-ab0a-0e9bd2239767) [merge-control-red.log](https://git.kayg.org/attachments/a4fea350-22cd-4983-83d4-9644f3afc00c) [merge-server-check-2.log](https://git.kayg.org/attachments/fae4c936-1377-44de-83ed-fb8c957dfadd) [merge-control-green.log](https://git.kayg.org/attachments/5547eb67-b980-4550-9d56-74676b996351)
kayg commented 2026-10-21 19:16:39 +00:00
Author
Owner
Copy link

Branch edge-autoupdate-r2 remains on 698f6aee3 with the resolved dev merge staged. Additional focused checks now pass: server all-target with remote enabled, public CLI help 1/1, separate-process update control 1/1, saturated-route queue 1/1. Full iterate remains queued. The slot-wrapped integration-milestone script will commit/push only after iterate exits successfully, then build and retain ordinary production-trust x86/ARM artifacts before any legacy-host change, and build the pinned dev x86 comparator. No cap/performance/final-completion claim yet.

Branch edge-autoupdate-r2 remains on 698f6aee3 with the resolved dev merge staged. Additional focused checks now pass: server all-target with remote enabled, public CLI help 1/1, separate-process update control 1/1, saturated-route queue 1/1. Full iterate remains queued. The slot-wrapped integration-milestone script will commit/push only after iterate exits successfully, then build and retain ordinary production-trust x86/ARM artifacts before any legacy-host change, and build the pinned dev x86 comparator. No cap/performance/final-completion claim yet.
kayg commented 2026-10-21 19:18:33 +00:00
Author
Owner
Copy link

Updated resume receipt while all build slots remain occupied. The attached patch includes every staged merge resolution through the remote shipping fixture adaptations. Base/parents: 698f6aee3 + adee19da07. Apply to the old branch only if resuming before the eventual merge commit; do not replay it over a committed merge. Server remote/all-target and help receipts are attached. No completion claim.

merge-progress.patch.gz
merge-server-remote-check-2.log
merge-help-green.log

Updated resume receipt while all build slots remain occupied. The attached patch includes every staged merge resolution through the remote shipping fixture adaptations. Base/parents: 698f6aee3 + adee19da07ce. Apply to the old branch only if resuming before the eventual merge commit; do not replay it over a committed merge. Server remote/all-target and help receipts are attached. No completion claim. [merge-progress.patch.gz](https://git.kayg.org/attachments/0ffa1313-c82d-42ea-a7cb-51b9caa28d82) [merge-server-remote-check-2.log](https://git.kayg.org/attachments/62e28b42-2b26-4cd4-a5c9-3a0ab3fce59f) [merge-help-green.log](https://git.kayg.org/attachments/4c5cac37-8785-4c72-81ed-6d3cdb2801a1)
kayg commented 2026-10-21 20:14:17 +00:00
Author
Owner
Copy link

Merge qualification: fmt, CLI compile-out and clippy now pass. Gate 4 reached 678 server tests passing / 56 ignored, with its only server failure caused by missing INFRATERNAL_TEST_STATE_ROOT. The affected checkpoint child passes with an owned root. Gate 5 exposed two additional SUN_LEN fixture failures because the supplied root was too long: runtime_lock_tests.rs:463 and user_host.rs:1423. Both affected tests pass unchanged with the shorter owned root /home/kayg/.cache/codex-scratch/eb07d. Gate 6 is queued with that root. No product assertion or timeout was weakened; no host-load waiver is being used. No cap/VM/final-completion claim yet.

merge-iterate-4.log
merge-iterate-5.log
checkpoint-owned-root.log
runtime-lock-short-root.log
pool-churn-short-root.log

Merge qualification: fmt, CLI compile-out and clippy now pass. Gate 4 reached 678 server tests passing / 56 ignored, with its only server failure caused by missing INFRATERNAL_TEST_STATE_ROOT. The affected checkpoint child passes with an owned root. Gate 5 exposed two additional SUN_LEN fixture failures because the supplied root was too long: runtime_lock_tests.rs:463 and user_host.rs:1423. Both affected tests pass unchanged with the shorter owned root /home/kayg/.cache/codex-scratch/eb07d. Gate 6 is queued with that root. No product assertion or timeout was weakened; no host-load waiver is being used. No cap/VM/final-completion claim yet. [merge-iterate-4.log](https://git.kayg.org/attachments/fbe8f22b-a270-4e0e-a923-3c7aa9e0bb94) [merge-iterate-5.log](https://git.kayg.org/attachments/85e4aaef-f7f6-41c8-a577-bedc08868874) [checkpoint-owned-root.log](https://git.kayg.org/attachments/93c7fee4-52c5-47c4-aa39-9998fabf953e) [runtime-lock-short-root.log](https://git.kayg.org/attachments/2c6fea7b-006b-43b1-a145-24027997407b) [pool-churn-short-root.log](https://git.kayg.org/attachments/9e6eee33-3c5d-41f2-a24b-9c7a69384742)
kayg commented 2026-10-21 20:23:13 +00:00
Author
Owner
Copy link

Integration contract finding (D303): the old update-control tests expect exit 1 even for invalid options and an off/unreachable update service. The current private control reply only says ok=false, so the CLI cannot distinguish those cases. Proposed additive reply field: code (usage, not_allowed, unreachable, failed), carrying only fixed public categories; existing clients still read ok. Keep local transport failures distinct from a live handler's refusal, and map them to D303 exits 2/3/5/1. This is an integration correction on #211, separate from the #236 size measurement. No deployment or permission change.

Integration contract finding (D303): the old update-control tests expect exit 1 even for invalid options and an off/unreachable update service. The current private control reply only says ok=false, so the CLI cannot distinguish those cases. Proposed additive reply field: code (usage, not_allowed, unreachable, failed), carrying only fixed public categories; existing clients still read ok. Keep local transport failures distinct from a live handler's refusal, and map them to D303 exits 2/3/5/1. This is an integration correction on #211, separate from the #236 size measurement. No deployment or permission change.
kayg commented 2026-10-21 20:36:47 +00:00
Author
Owner
Copy link

Merge gate progress: every Rust row passed (fmt, native fmt, CLI compile-out, clippy, runtime helper, workspace tests, inode reuse, per-user shim, cargo-deny); server suite 679 passed / 56 ignored. TypeScript had 346 passes and two canvas reducer property-suite build failures: plugin-api owned_io uses block_in_place without declaring rt-multi-thread when built standalone. Declared that existing runtime feature on the optional Tokio dependency; the shipping named feature set is unchanged (0 additions/removals). Re-running plugin-api clippy/tests and the complete TypeScript gate before the merge commit; no failure waived.

merge-iterate-6.log
merge-feature-sets.txt

Merge gate progress: every Rust row passed (fmt, native fmt, CLI compile-out, clippy, runtime helper, workspace tests, inode reuse, per-user shim, cargo-deny); server suite 679 passed / 56 ignored. TypeScript had 346 passes and two canvas reducer property-suite build failures: plugin-api owned_io uses block_in_place without declaring rt-multi-thread when built standalone. Declared that existing runtime feature on the optional Tokio dependency; the shipping named feature set is unchanged (0 additions/removals). Re-running plugin-api clippy/tests and the complete TypeScript gate before the merge commit; no failure waived. [merge-iterate-6.log](https://git.kayg.org/attachments/7a445055-3d0d-4a0d-9051-175a4a870c2a) [merge-feature-sets.txt](https://git.kayg.org/attachments/723a14c0-6d12-4e1b-ae57-2ce81c71779c)
kayg commented 2026-10-21 20:37:58 +00:00
Author
Owner
Copy link

Updated resumable staged merge patch, including the standalone Tokio dependency fix. HEAD remains 698f6aee3 while the follow-up gate waits for a host build slot; no legacy slice applied and no deploy.

merge-progress.patch.gz
current-resume.txt

Updated resumable staged merge patch, including the standalone Tokio dependency fix. HEAD remains 698f6aee3 while the follow-up gate waits for a host build slot; no legacy slice applied and no deploy. [merge-progress.patch.gz](https://git.kayg.org/attachments/22ed23d0-fcf4-4b04-842f-5a8e219120d1) [current-resume.txt](https://git.kayg.org/attachments/3c28c21c-d031-40e1-8238-9efff0de5bc3)
kayg commented 2026-10-21 20:42:28 +00:00
Author
Owner
Copy link

Merged origin/dev adee19da07 into edge-autoupdate-r2 without rebasing. Merge commit a9c8fc03ce is pushed. All 26 conflict resolutions and their alternatives are recorded in the commit body. Full Rust gate rows passed in merge-iterate-6.log (server 679 passed, 56 ignored). After the explicit standalone runtime feature fix, fmt and plugin-api socket-host clippy/tests passed (44 unit / 2 doc tests); the complete TypeScript gate passed: canvas/UI 348, connection 105, terminal query 17, protocol 39; production bundle transfer checks passed. Static production-trust x86/ARM artifacts and the dev size comparator are now building; final verify fast still pending.

merge-feature-followup.log

Merged origin/dev adee19da07cea19e538cb801858ce0d901841b3a into edge-autoupdate-r2 without rebasing. Merge commit a9c8fc03ce8c14291d36f31c6d053aa29793e20c is pushed. All 26 conflict resolutions and their alternatives are recorded in the commit body. Full Rust gate rows passed in merge-iterate-6.log (server 679 passed, 56 ignored). After the explicit standalone runtime feature fix, fmt and plugin-api socket-host clippy/tests passed (44 unit / 2 doc tests); the complete TypeScript gate passed: canvas/UI 348, connection 105, terminal query 17, protocol 39; production bundle transfer checks passed. Static production-trust x86/ARM artifacts and the dev size comparator are now building; final verify fast still pending. [merge-feature-followup.log](https://git.kayg.org/attachments/24b5ad85-cd37-479b-9148-40838f92496b)
kayg commented 2026-10-21 20:56:50 +00:00
Author
Owner
Copy link

Merge a9c8fc03ce ordinary production-trust x86_64 static image: 22,024,736 bytes, +635,504 bytes relative to the prior 21,389,232-byte cap. This matches the D301 accepted updater scope; the actual adee19da07 comparator is still pending. SHA-256 2be05cf3d490fd3f9a906901b195703085e94e043f96207860badfb6225ec1af. Production-trust check passed (fixture authority absent). Retained artifact: ~/.cache/codex-scratch/edge-autoupdate-resume/pre-legacy/infraternal-x86_64; raw receipt evidence/pre-legacy-sizes.txt. ARM build is running; no compiler profile changes.

Merge a9c8fc03ce8c14291d36f31c6d053aa29793e20c ordinary production-trust x86_64 static image: 22,024,736 bytes, +635,504 bytes relative to the prior 21,389,232-byte cap. This matches the D301 accepted updater scope; the actual adee19da07ce comparator is still pending. SHA-256 2be05cf3d490fd3f9a906901b195703085e94e043f96207860badfb6225ec1af. Production-trust check passed (fixture authority absent). Retained artifact: ~/.cache/codex-scratch/edge-autoupdate-resume/pre-legacy/infraternal-x86_64; raw receipt evidence/pre-legacy-sizes.txt. ARM build is running; no compiler profile changes.
kayg commented 2026-10-21 21:12:28 +00:00
Author
Owner
Copy link

Repair integration finding: SSH lifecycle Activity tracks component shutdown (crates/plugins/ssh/src/lifecycle.rs:34), while daemon handoff uses plugin-api activity::Activity; these are separate lifetimes. The host adapter must retain the daemon foreground fence through the actual installation and rollback, including socket cancellation, and release it before an idle wizard remains open. Reusing a defaulted backend resource hook and the existing D251 wait_enter fence; no new task, timer, library or persisted secret. The same installation path protects fresh setup as well as repair. Regression coverage will hold cleanup after cancellation to prove the fence remains active.

Repair integration finding: SSH lifecycle Activity tracks component shutdown (crates/plugins/ssh/src/lifecycle.rs:34), while daemon handoff uses plugin-api activity::Activity; these are separate lifetimes. The host adapter must retain the daemon foreground fence through the actual installation and rollback, including socket cancellation, and release it before an idle wizard remains open. Reusing a defaulted backend resource hook and the existing D251 wait_enter fence; no new task, timer, library or persisted secret. The same installation path protects fresh setup as well as repair. Regression coverage will hold cleanup after cancellation to prove the fence remains active.
kayg commented 2026-10-21 21:18:19 +00:00
Author
Owner
Copy link

Pure merge a9c8fc03ce static artifacts retained: x86_64 22,024,736 B; aarch64 20,125,160 B. Both production-trust checks passed; unchanged shipping profiles. Relative to the previous caps, +635,504 / +563,504 B; actual dev comparator remains pending. Its first build stopped because comparison/auth-tools/zig was absent. That target now shares this job’s verified pinned Zig 0.15.2; no baseline source change. Proceeding with separately gated integration/legacy slices while the comparator is scheduled before the final gate. Reclaimed 13 GB of completed incremental cache and a further 3,290,900,608 B of completed test executables from touched crates only; shipping artifacts and dependencies retained.

pre-legacy-sizes.txt
baseline-static-x86.log
cache-reclaim.log

Pure merge a9c8fc03ce8c14291d36f31c6d053aa29793e20c static artifacts retained: x86_64 22,024,736 B; aarch64 20,125,160 B. Both production-trust checks passed; unchanged shipping profiles. Relative to the previous caps, +635,504 / +563,504 B; actual dev comparator remains pending. Its first build stopped because comparison/auth-tools/zig was absent. That target now shares this job’s verified pinned Zig 0.15.2; no baseline source change. Proceeding with separately gated integration/legacy slices while the comparator is scheduled before the final gate. Reclaimed 13 GB of completed incremental cache and a further 3,290,900,608 B of completed test executables from touched crates only; shipping artifacts and dependencies retained. [pre-legacy-sizes.txt](https://git.kayg.org/attachments/214e9316-45f1-4195-b6a8-6217ec4752da) [baseline-static-x86.log](https://git.kayg.org/attachments/73991155-a168-4447-9673-f7910711f647) [cache-reclaim.log](https://git.kayg.org/attachments/6d28118a-95d2-4729-ad78-a558111d1f6a)
kayg commented 2026-10-21 21:31:44 +00:00
Author
Owner
Copy link

Legacy-state integration finding: remote_runtime::attach publishes node channels for temporary SSH setup routes as well as installed infraternal agents. Both a temporary route and a legacy daemon can lack MACHINE, so absence alone must not label the setup route as a legacy host. Proposing additive NodeChannel::is_provisioning() (default false), supplied from NodeBridge’s existing admitted AuthorityGuard rather than peer input. Sender and inventory skip capability/version observations for temporary routes; an outstanding bootstrap retirement intent also suppresses manual repair until setup completes. No wire change or dependency addition. This preserves unknown version during setup and avoids offering a second installation over an active one.

Legacy-state integration finding: remote_runtime::attach publishes node channels for temporary SSH setup routes as well as installed infraternal agents. Both a temporary route and a legacy daemon can lack MACHINE, so absence alone must not label the setup route as a legacy host. Proposing additive NodeChannel::is_provisioning() (default false), supplied from NodeBridge’s existing admitted AuthorityGuard rather than peer input. Sender and inventory skip capability/version observations for temporary routes; an outstanding bootstrap retirement intent also suppresses manual repair until setup completes. No wire change or dependency addition. This preserves unknown version during setup and avoids offering a second installation over an active one.
kayg commented 2026-10-21 21:33:12 +00:00
Author
Owner
Copy link

Pushed 35f1107db1: D303 local control refusal categories preserved. The separate-process invalid-quiet case failed first; fmt, touched-crate clippy, 2 local-control tests and 5 release-service tests passed. The source gate is green. A scratch runner edit caused a shell reader offset error after the tests, before commit; resumed from the unchanged passed source and committed/pushed manually. No check waived. A new immutable runner will build the updater-only artifacts and D301 caps, then gate each #236 slice. Full receipts will be attached by that runner.

Pushed 35f1107db1bc1485f0ebbebce2278a7366b768cf: D303 local control refusal categories preserved. The separate-process invalid-quiet case failed first; fmt, touched-crate clippy, 2 local-control tests and 5 release-service tests passed. The source gate is green. A scratch runner edit caused a shell reader offset error after the tests, before commit; resumed from the unchanged passed source and committed/pushed manually. No check waived. A new immutable runner will build the updater-only artifacts and D301 caps, then gate each #236 slice. Full receipts will be attached by that runner.
kayg commented 2026-10-21 21:44:16 +00:00
Author
Owner
Copy link

Updated resume checkpoint at pushed head 35f1107db. The immutable next runner is waiting for a host build slot; the latest implementation drafts, ownership/readiness/fence regressions and exact remaining gates are attached. Legacy slices remain unapplied until their separate gates run. No deploy.

current-resume.txt
legacy-preparation-current.tar.gz

Updated resume checkpoint at pushed head 35f1107db. The immutable next runner is waiting for a host build slot; the latest implementation drafts, ownership/readiness/fence regressions and exact remaining gates are attached. Legacy slices remain unapplied until their separate gates run. No deploy. [current-resume.txt](https://git.kayg.org/attachments/cce40a88-a2ce-4bd1-a70b-8a3445c3b2ad) [legacy-preparation-current.tar.gz](https://git.kayg.org/attachments/b7d9ad9f-f2a6-465b-be96-c060907d6ed7)
kayg commented 2026-10-21 21:46:39 +00:00
Author
Owner
Copy link

Pushed D303 local-control integration fix 35f1107db1. Separate-process invalid-quiet regression failed before the fix; fmt, touched-crate clippy and local-control/service tests passed after it. Refusals now preserve usage 2, not allowed 3, unavailable 5 and failed operation 1; old receiver replies remain generic refusals. Fixed categories only, with no storage diagnostics.
test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 102 filtered out;
test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 31 filtered out;

control-codes-red.log
control-codes-green.log

Pushed D303 local-control integration fix 35f1107db1bc1485f0ebbebce2278a7366b768cf. Separate-process invalid-quiet regression failed before the fix; fmt, touched-crate clippy and local-control/service tests passed after it. Refusals now preserve usage 2, not allowed 3, unavailable 5 and failed operation 1; old receiver replies remain generic refusals. Fixed categories only, with no storage diagnostics. test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 102 filtered out; test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 31 filtered out; [control-codes-red.log](https://git.kayg.org/attachments/fe15ae50-8edf-4803-9ee6-a967e794e213) [control-codes-green.log](https://git.kayg.org/attachments/d225091e-8c0a-4d16-8397-517ecea87426)
kayg commented 2026-10-21 21:56:33 +00:00
Author
Owner
Copy link

Pushed exact D301 cap ratchet d3b5dc0b8e; unchanged shipping profiles, production trust passed. Both architectures passed exact-size validation, reject one byte above cap, and require a ratchet after shrink. This is the retained updater-only baseline for measuring #236 separately.
x86_64: updater baseline 22,026,848 B; D303 integration delta from pure merge +2,112 B.
aarch64: updater baseline 20,127,592 B; D303 integration delta from pure merge +2,432 B.

control-static-sizes.txt
d301-caps.log

Pushed exact D301 cap ratchet d3b5dc0b8e63ff2115282432906eff0729baf681; unchanged shipping profiles, production trust passed. Both architectures passed exact-size validation, reject one byte above cap, and require a ratchet after shrink. This is the retained updater-only baseline for measuring #236 separately. x86_64: updater baseline 22,026,848 B; D303 integration delta from pure merge +2,112 B. aarch64: updater baseline 20,127,592 B; D303 integration delta from pure merge +2,432 B. [control-static-sizes.txt](https://git.kayg.org/attachments/3f3b22a7-1e6f-4a69-9b21-a6e98ace8a20) [d301-caps.log](https://git.kayg.org/attachments/18e7d2ed-55f7-43ee-8728-de93d4bf416e)
kayg commented 2026-10-21 21:59:10 +00:00
Author
Owner
Copy link

The first #236 migration gate stopped on a remote-only clippy configuration: infraternal-agent/src/plugins.rs kernel callbacks retain a fallible function-pointer signature with mesh compiled out, triggering unnecessary_wraps. No migration test ran or was waived. A separate correction scopes the allowance to non-mesh/non-Linux builds; queued remote-only clippy and tests precede the migration retry. D301 cap commit is pushed at d3b5dc0b8e.

The first #236 migration gate stopped on a remote-only clippy configuration: infraternal-agent/src/plugins.rs kernel callbacks retain a fallible function-pointer signature with mesh compiled out, triggering unnecessary_wraps. No migration test ran or was waived. A separate correction scopes the allowance to non-mesh/non-Linux builds; queued remote-only clippy and tests precede the migration retry. D301 cap commit is pushed at d3b5dc0b8e63ff2115282432906eff0729baf681.
kayg commented 2026-10-21 22:01:58 +00:00
Author
Owner
Copy link

Resume checkpoint: branch edge-autoupdate-r2, pushed head d3b5dc0b8e. Merge a9c8fc03c, D303 correction 35f1107db, exact updater-only caps 22,026,848 B x86_64 / 20,127,592 B aarch64. Migration 0031 is applied but uncommitted; gate first encountered a non-mesh callback lint, not a migration failure. Active immutable legacy-resume-v3.sh is waiting through the build-slot wrapper, then gates/commits that correction, schema, trusted setup scope, sender observations, durable inventory, SSH repair, server repair, UI and development-only coverage in separate steps. Each step stops before commit on a failed gate. Draft archive is continuation material, not landed code or test evidence. After that sequence, review-artifacts-v1.sh adds the docs commit, runs explicit update_recovery, builds the detached dev comparator, prepares a release warm-handoff harness, and rebuilds ordinary production-trust artifacts. VM measurements, separate #236 size review/cap ratchet, author review, final verify fast and cleanup remain. No deployment or acceptance-host contact.
legacy-preparation-v3.tar.gz

Resume checkpoint: branch edge-autoupdate-r2, pushed head d3b5dc0b8e63ff2115282432906eff0729baf681. Merge a9c8fc03c, D303 correction 35f1107db, exact updater-only caps 22,026,848 B x86_64 / 20,127,592 B aarch64. Migration 0031 is applied but uncommitted; gate first encountered a non-mesh callback lint, not a migration failure. Active immutable legacy-resume-v3.sh is waiting through the build-slot wrapper, then gates/commits that correction, schema, trusted setup scope, sender observations, durable inventory, SSH repair, server repair, UI and development-only coverage in separate steps. Each step stops before commit on a failed gate. Draft archive is continuation material, not landed code or test evidence. After that sequence, review-artifacts-v1.sh adds the docs commit, runs explicit update_recovery, builds the detached dev comparator, prepares a release warm-handoff harness, and rebuilds ordinary production-trust artifacts. VM measurements, separate #236 size review/cap ratchet, author review, final verify fast and cleanup remain. No deployment or acceptance-host contact. [legacy-preparation-v3.tar.gz](https://git.kayg.org/attachments/1e7da532-3b18-4086-822e-e8a57be1d236)
kayg commented 2026-10-21 22:15:57 +00:00
Author
Owner
Copy link

Keep remote kernel callbacks lint-clean without mesh (#211)
Pushed 45367cb37b. fmt and touched-crate clippy passed.
test result: ok. 149 passed; 0 failed; 20 ignored; 0 measured; 0 filtered out;

kernel-callback-gate.log

Keep remote kernel callbacks lint-clean without mesh (#211) Pushed 45367cb37b4ad7323b27599f3baefcd375ff3ea8. fmt and touched-crate clippy passed. test result: ok. 149 passed; 0 failed; 20 ignored; 0 measured; 0 filtered out; [kernel-callback-gate.log](https://git.kayg.org/attachments/f300b629-ea6b-4628-9e13-8e61aac83cde)
kayg commented 2026-10-21 22:43:34 +00:00
Author
Owner
Copy link

Current checkpoint: edge-autoupdate-r2 pushed head b66e3f14d. New pushed slices: 45367cb37 kernel callbacks; 3f1b88a2f schema; 34086298d trusted temporary-setup scope; b66e3f14d sender observations. Schema’s original filter matched zero tests; the corrected actual module passed all 6, attached separately. Scope passed 44 API cases plus the actual node bridge case. Sender passed 11. Pending inventory passed 3 observation tests and 12 inventory cases; its stale-server-target regression failed by assertion before the guard. The no-default-feature matrix then found two shared auth-fixture cfg assumptions, now corrected but not yet gated/committed.

Active immutable legacy-resume-v6.sh is queued through build-slot (tool session 77738). It gates/commits the two fixture corrections first, then inventory, SSH repair, server repair, UI, request/scale coverage separately. No paused shell remains. The attached patch captures actual pending native files; do not blindly rerun source appliers. The bundle includes later prepared steps. Updated UI uses existing shared Hosts settings/fact rows with 16-group initial mounting and explicit 16-group expansion; production desktop/phone fixture covers 32 hosts and repair consent. Server repair now explicitly refuses a pending fresh setup and checks execution UID before invitation reissue.

After v6 succeeds, run review-artifacts-v1.sh through the same build-slot: docs commit, explicit update_recovery, exact detached dev static comparator, test-only dev inventory harness, candidate release warm-handoff preparation, ordinary production-trust final static builds. Then run warm handoff and paired 128-host inventory on the authorized perf VM outside the build-slot; inventory-perf-vm.py transfers only public test executables/libraries and runs both variants under one short shared lock/weighted scope. Separate #236 size delta/cap ratchet, author checklist, final verify fast, receipts and cleanup remain. No deployment or acceptance-host contact.
native-pending-v6.patch
legacy-preparation-v6.tar.gz

Current checkpoint: edge-autoupdate-r2 pushed head b66e3f14d. New pushed slices: 45367cb37 kernel callbacks; 3f1b88a2f schema; 34086298d trusted temporary-setup scope; b66e3f14d sender observations. Schema’s original filter matched zero tests; the corrected actual module passed all 6, attached separately. Scope passed 44 API cases plus the actual node bridge case. Sender passed 11. Pending inventory passed 3 observation tests and 12 inventory cases; its stale-server-target regression failed by assertion before the guard. The no-default-feature matrix then found two shared auth-fixture cfg assumptions, now corrected but not yet gated/committed. Active immutable legacy-resume-v6.sh is queued through build-slot (tool session 77738). It gates/commits the two fixture corrections first, then inventory, SSH repair, server repair, UI, request/scale coverage separately. No paused shell remains. The attached patch captures actual pending native files; do not blindly rerun source appliers. The bundle includes later prepared steps. Updated UI uses existing shared Hosts settings/fact rows with 16-group initial mounting and explicit 16-group expansion; production desktop/phone fixture covers 32 hosts and repair consent. Server repair now explicitly refuses a pending fresh setup and checks execution UID before invitation reissue. After v6 succeeds, run review-artifacts-v1.sh through the same build-slot: docs commit, explicit update_recovery, exact detached dev static comparator, test-only dev inventory harness, candidate release warm-handoff preparation, ordinary production-trust final static builds. Then run warm handoff and paired 128-host inventory on the authorized perf VM outside the build-slot; inventory-perf-vm.py transfers only public test executables/libraries and runs both variants under one short shared lock/weighted scope. Separate #236 size delta/cap ratchet, author checklist, final verify fast, receipts and cleanup remain. No deployment or acceptance-host contact. [native-pending-v6.patch](https://git.kayg.org/attachments/81ab4f4f-f763-4a5f-aaef-8a91c4758ae8) [legacy-preparation-v6.tar.gz](https://git.kayg.org/attachments/b314d6ce-16cd-42a3-96e2-67727e977ed6)
kayg commented 2026-10-21 22:56:52 +00:00
Author
Owner
Copy link

Pushed host-inventory milestone on edge-autoupdate-r2, head 6852b493ce.
Schema 3f1b88a2f has the corrected actual migration module: 6 passed, including v30→31 and retained 28 checksums/integrity. The original zero-test filter is explicitly invalid, not a pass.

legacy-schema-tests-corrected.log

Distinguish temporary SSH setup from installed node capability (#236)
Pushed 34086298d5. fmt and touched-crate clippy passed.
test result: ok. 44 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out;
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 736 filtered out;

legacy-scope-gate.log

Publish host identity and update phases from the existing sender (#236)
Pushed b66e3f14d9. fmt and touched-crate clippy passed.
test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 30 filtered out;

legacy-sender-gate.log

Keep shared auth fixtures buildable without mesh and updates (#211)
Pushed d632949e6e. fmt and touched-crate clippy passed.
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 744 filtered out;

compileout-fixtures-gate.log
inventory-before-compileout-fix.log

Expose each host’s running version and update readiness in inventory (#236)
Pushed 6852b493ce. fmt and touched-crate clippy passed.
test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 742 filtered out;
test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 733 filtered out;

legacy-inventory-gate.log
inventory-target-red.log

SSH repair is applied but uncommitted; the first intended regression stopped at a test-backend compile error, not an assertion. Its two missing proof methods are now explicit unreachable methods and legacy-resume-v7.sh is queued to capture the real assertion failure before the worker correction. Server repair, UI, request/scale coverage, docs, explicit recovery/perf measurements, separate legacy size review and final fast gate remain.

Pushed host-inventory milestone on edge-autoupdate-r2, head 6852b493ce5503db109abfe1a26ddb926665ab5a. Schema 3f1b88a2f has the corrected actual migration module: 6 passed, including v30→31 and retained 28 checksums/integrity. The original zero-test filter is explicitly invalid, not a pass. [legacy-schema-tests-corrected.log](https://git.kayg.org/attachments/fa04df65-db2c-4664-9492-a0a7525f837f) Distinguish temporary SSH setup from installed node capability (#236) Pushed 34086298d58b94de73caccb5d553301554f310d2. fmt and touched-crate clippy passed. test result: ok. 44 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 736 filtered out; [legacy-scope-gate.log](https://git.kayg.org/attachments/9d623078-cd4f-44d2-bde1-75a8a51ea982) Publish host identity and update phases from the existing sender (#236) Pushed b66e3f14d9cb640271b9fa4760fb64c52c1e51e2. fmt and touched-crate clippy passed. test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 30 filtered out; [legacy-sender-gate.log](https://git.kayg.org/attachments/f8de827f-3f7a-491f-ad67-da9aa1fbc1d6) Keep shared auth fixtures buildable without mesh and updates (#211) Pushed d632949e6e09b7825a51143a11acbbe3c898e421. fmt and touched-crate clippy passed. test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 744 filtered out; [compileout-fixtures-gate.log](https://git.kayg.org/attachments/896f1ed5-2a3f-46d5-88da-e5c236bf76d3) [inventory-before-compileout-fix.log](https://git.kayg.org/attachments/1610c2d4-b57c-4256-a6fa-3ed3885f668a) Expose each host’s running version and update readiness in inventory (#236) Pushed 6852b493ce5503db109abfe1a26ddb926665ab5a. fmt and touched-crate clippy passed. test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 742 filtered out; test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 733 filtered out; [legacy-inventory-gate.log](https://git.kayg.org/attachments/6fa7a884-0bcf-455f-ad6e-84257edc8961) [inventory-target-red.log](https://git.kayg.org/attachments/98c462ec-2354-43a6-9077-442379f9ffef) SSH repair is applied but uncommitted; the first intended regression stopped at a test-backend compile error, not an assertion. Its two missing proof methods are now explicit unreachable methods and legacy-resume-v7.sh is queued to capture the real assertion failure before the worker correction. Server repair, UI, request/scale coverage, docs, explicit recovery/perf measurements, separate legacy size review and final fast gate remain.
kayg commented 2026-10-21 23:21:20 +00:00
Author
Owner
Copy link

Capacity status: legacy-resume-v7.sh remains queued through build-slot after the SSH test-backend correction; no new test result is claimed. Pushed head remains 6852b493c (inventory). All three ordinary slot holders are alive; no other job was stopped and no slot count was overridden. Current holder records:

  • 2026-10-22T00:13:09+02:00 slot 1: sync-journal-r3 pid 2069620
  • 2026-10-22T01:19:59+02:00 slot 2: review-mesh-drag-r3 pid 3488178
  • 2026-10-22T00:35:49+02:00 slot 3: ? pid 2447742

Continuing to wait and keeping the prepared continuation state on the issue.

Capacity status: legacy-resume-v7.sh remains queued through build-slot after the SSH test-backend correction; no new test result is claimed. Pushed head remains 6852b493c (inventory). All three ordinary slot holders are alive; no other job was stopped and no slot count was overridden. Current holder records: - 2026-10-22T00:13:09+02:00 slot 1: sync-journal-r3 pid 2069620 - 2026-10-22T01:19:59+02:00 slot 2: review-mesh-drag-r3 pid 3488178 - 2026-10-22T00:35:49+02:00 slot 3: ? pid 2447742 Continuing to wait and keeping the prepared continuation state on the issue.
kayg commented 2026-10-21 23:37:49 +00:00
Author
Owner
Copy link

Checkpoint: pushed head 945bbc6ea (SSH repair), following inventory 6852b493c and compile-out fixture correction d632949e6. SSH fmt/clippy and all-target tests passed: 221 passing executions, 14 ignored, 29 test binaries. Cancellation fence regression failed by the expected assertion before the worker fix. Attempts now share one private cookie allocation and use fresh public reservation nonces.

Server repair is applied but uncommitted. Both intended regressions reached assertions: obsolete unpublished guard removed its successor; completion accepted a concurrently removed host. Corrections applied. First clippy then found wildcard imports, function length and branch ordering; these are fixed by explicit imports, a synchronous reserve_attempt helper preserving its lock boundary, and branch reordering. Immutable legacy-resume-v8.sh is queued through build-slot (tool session 74180); it runs the server gate then commits/pushes, followed by legacy-ui-steps.sh and coverage-steps.sh. Do not replay already applied native appliers. Attached patch captures all actual pending server files.

Prepared UI now also exposes full, wrapping version/state facts in shared Hosts settings; initial 16 status groups, explicit 16-group expansion, stable keyed controls. Strict overlay check of actual app configuration plus desktop/phone spec reports zero diagnostics; actual branch/production-browser gates still pending. Browser fixture has 32 hosts and checks 16→32 expansion, original control retention, unknown version, current edge version and explicit root consent. Browser temporary profiles stay under this job’s cache, with launch/exit receipts.

After v8 succeeds, slot-wrap review-artifacts-v1.sh. It first runs the separate failing-first receiver-capability correction: receiver-free infraternal-agent builds currently advertise MACHINE unconditionally; factor the existing bit through plugin composition, preserve runtime-disabled support, run both agent feature matrices. Then docs commit, explicit update_recovery, exact dev static comparator, test-only baseline inventory harness, candidate release warm-handoff preparation and ordinary production-trust final static builds. Outside the build-slot, measure warm handoff and paired 128-host inventory on authorized VM 208, with shared lock/CPUWeight and bounded lock hold. Then review separate legacy size delta, ratchet caps only from measured justified sizes, author checklist, final verify fast verbatim and cleanup. No deploy or acceptance-host contact.
server-repair-pending-v8.patch
legacy-preparation-v8.tar.gz

Checkpoint: pushed head 945bbc6ea (SSH repair), following inventory 6852b493c and compile-out fixture correction d632949e6. SSH fmt/clippy and all-target tests passed: 221 passing executions, 14 ignored, 29 test binaries. Cancellation fence regression failed by the expected assertion before the worker fix. Attempts now share one private cookie allocation and use fresh public reservation nonces. Server repair is applied but uncommitted. Both intended regressions reached assertions: obsolete unpublished guard removed its successor; completion accepted a concurrently removed host. Corrections applied. First clippy then found wildcard imports, function length and branch ordering; these are fixed by explicit imports, a synchronous reserve_attempt helper preserving its lock boundary, and branch reordering. Immutable legacy-resume-v8.sh is queued through build-slot (tool session 74180); it runs the server gate then commits/pushes, followed by legacy-ui-steps.sh and coverage-steps.sh. Do not replay already applied native appliers. Attached patch captures all actual pending server files. Prepared UI now also exposes full, wrapping version/state facts in shared Hosts settings; initial 16 status groups, explicit 16-group expansion, stable keyed controls. Strict overlay check of actual app configuration plus desktop/phone spec reports zero diagnostics; actual branch/production-browser gates still pending. Browser fixture has 32 hosts and checks 16→32 expansion, original control retention, unknown version, current edge version and explicit root consent. Browser temporary profiles stay under this job’s cache, with launch/exit receipts. After v8 succeeds, slot-wrap review-artifacts-v1.sh. It first runs the separate failing-first receiver-capability correction: receiver-free infraternal-agent builds currently advertise MACHINE unconditionally; factor the existing bit through plugin composition, preserve runtime-disabled support, run both agent feature matrices. Then docs commit, explicit update_recovery, exact dev static comparator, test-only baseline inventory harness, candidate release warm-handoff preparation and ordinary production-trust final static builds. Outside the build-slot, measure warm handoff and paired 128-host inventory on authorized VM 208, with shared lock/CPUWeight and bounded lock hold. Then review separate legacy size delta, ratchet caps only from measured justified sizes, author checklist, final verify fast verbatim and cleanup. No deploy or acceptance-host contact. [server-repair-pending-v8.patch](https://git.kayg.org/attachments/31354698-8bb9-4e2d-89cb-00ed5e36dfba) [legacy-preparation-v8.tar.gz](https://git.kayg.org/attachments/beb0f9f9-75b7-42f1-8bf0-6d6d016aab01)
kayg commented 2026-10-22 00:15:41 +00:00
Author
Owner
Copy link

Resume checkpoint: edge-autoupdate-r2 at 643a5af84d, pushed to origin. Native manual-repair commits through b0212568a and the shared non-DOM mark-loader correction 643a5af84 are complete. Pending UI diff attached.

The single owned build-slot wrapper PID 215909 is waiting to run legacy-resume-v11.sh. It reruns only production browsers after successful source checks (104 unit cases, typecheck, production build). Chromium desktop and WebKit phone are separate CLI invocations because Playwright rejects browserName inside describe; that prior configuration failure launched no browser. Successful UI checks commit/push and attach four screenshots, then coverage-steps.sh chains review-artifacts-v1.sh. Each slice stops on failure and commits only its own paths.

Next prepared scripts in the scratch job root: coverage-steps.sh; agent-capability-steps.sh; docs-steps.sh; review-artifacts-v1.sh; inventory-perf-vm.py. The documentation runner's embedded Python now compiles. No running shell file was edited.

After artifacts: run warm-handoff VM proof with reuse-only public fixture, then paired baseline/candidate inventory VM measurement. Review separate legacy size delta before an exact-cap commit. Run final scripts/verify fast through build-slot and attach verbatim output to both issues. Cleanup remains pending. No deployment or acceptance-host contact.

ui-pending-v11.patch
author-review.md

Resume checkpoint: edge-autoupdate-r2 at 643a5af84d89aa110ae40c7a54ee40f3d79ef65c, pushed to origin. Native manual-repair commits through b0212568a and the shared non-DOM mark-loader correction 643a5af84 are complete. Pending UI diff attached. The single owned build-slot wrapper PID 215909 is waiting to run legacy-resume-v11.sh. It reruns only production browsers after successful source checks (104 unit cases, typecheck, production build). Chromium desktop and WebKit phone are separate CLI invocations because Playwright rejects browserName inside describe; that prior configuration failure launched no browser. Successful UI checks commit/push and attach four screenshots, then coverage-steps.sh chains review-artifacts-v1.sh. Each slice stops on failure and commits only its own paths. Next prepared scripts in the scratch job root: coverage-steps.sh; agent-capability-steps.sh; docs-steps.sh; review-artifacts-v1.sh; inventory-perf-vm.py. The documentation runner's embedded Python now compiles. No running shell file was edited. After artifacts: run warm-handoff VM proof with reuse-only public fixture, then paired baseline/candidate inventory VM measurement. Review separate legacy size delta before an exact-cap commit. Run final scripts/verify fast through build-slot and attach verbatim output to both issues. Cleanup remains pending. No deployment or acceptance-host contact. [ui-pending-v11.patch](https://git.kayg.org/attachments/9a4da40e-52bb-4376-9194-75d8f6cd0722) [author-review.md](https://git.kayg.org/attachments/5f3116fa-5727-4929-a9b8-35f3da65fa9e)
kayg commented 2026-10-22 00:47:14 +00:00
Author
Owner
Copy link

Resource wait at 2026-10-22T00:47:12.450083+00:00: the single edge-autoupdate-resume build-slot wrapper PID 215909 has waited 37:23 for a shared slot. It has not started the corrected browser rerun; no new gate result is claimed. The three normal slots are occupied by other jobs. The runner resumes automatically when a slot is free; no owner action requested. Head remains 643a5af84, with pending UI and remaining proofs recorded in resume-v11.

Resource wait at 2026-10-22T00:47:12.450083+00:00: the single edge-autoupdate-resume build-slot wrapper PID 215909 has waited 37:23 for a shared slot. It has not started the corrected browser rerun; no new gate result is claimed. The three normal slots are occupied by other jobs. The runner resumes automatically when a slot is free; no owner action requested. Head remains 643a5af84, with pending UI and remaining proofs recorded in resume-v11.
kayg commented 2026-10-22 00:50:21 +00:00
Author
Owner
Copy link

Shared host free space reached 15 GB while this job remained queued. Reclaimed 8,046,137,410 bytes of this job’s incremental cache and 18 completed inactive test executables, under its Cargo cache lock. Active executable inodes were excluded. Raw evidence, source, target libraries, release artifacts and all other jobs were preserved. Free space afterward was 21 GB; later checks may relink removed test executables.

Shared host free space reached 15 GB while this job remained queued. Reclaimed 8,046,137,410 bytes of this job’s incremental cache and 18 completed inactive test executables, under its Cargo cache lock. Active executable inodes were excluded. Raw evidence, source, target libraries, release artifacts and all other jobs were preserved. Free space afterward was 21 GB; later checks may relink removed test executables.
kayg commented 2026-10-22 00:52:54 +00:00
Author
Owner
Copy link

Free space fell again to 12 GB while the job remained queued. Cleared the remaining completed debug cache (21,983,287,521 bytes) under its exclusive Cargo lock, preserving the lock path, release artifacts, comparison cache, fixtures, source and all evidence. Free space afterward was 40 GB. Upcoming Rust gates must rebuild debug artifacts; this is cache loss rather than a code or test failure. Only this job’s target/debug was changed.

Free space fell again to 12 GB while the job remained queued. Cleared the remaining completed debug cache (21,983,287,521 bytes) under its exclusive Cargo lock, preserving the lock path, release artifacts, comparison cache, fixtures, source and all evidence. Free space afterward was 40 GB. Upcoming Rust gates must rebuild debug artifacts; this is cache loss rather than a code or test failure. Only this job’s target/debug was changed.
kayg commented 2026-10-29 21:13:37 +00:00
Author
Owner
Copy link

Resumed implementation on shared build VM as agent. Branch edge-autoupdate-r2, base 643a5af84d; recovered WIP d4a1bf6ea with soft reset for atomic split. Current dev is 07c5da77b. Reading prior histories before continuing. Will preserve #255 Tokio/AsyncFd, push each gated slice, and prepare public artifacts plus exact perf-test-01 commands for orchestrator execution. No perf-host or acceptance-host contact, no deployment. #236 is closed by orchestrator; this continuation records the separately requested legacy updater work without changing issue state.

Resumed implementation on shared build VM as agent. Branch edge-autoupdate-r2, base 643a5af84d89aa110ae40c7a54ee40f3d79ef65c; recovered WIP d4a1bf6ea with soft reset for atomic split. Current dev is 07c5da77b. Reading prior histories before continuing. Will preserve #255 Tokio/AsyncFd, push each gated slice, and prepare public artifacts plus exact perf-test-01 commands for orchestrator execution. No perf-host or acceptance-host contact, no deployment. #236 is closed by orchestrator; this continuation records the separately requested legacy updater work without changing issue state.
kayg commented 2026-10-29 21:17:51 +00:00
Author
Owner
Copy link

Recovered WIP split and pushed: be2d93c36 shared keyed/bounded Hosts panel; c87b1c651 authenticated browser inventory fields; 6c9fa4178 explicit owner-present repair wizard/socket; 749e4e526 Hosts/palette integration and production browser fixture. Typecheck passes; 104 focused tests pass. Production Chromium desktop passes (32 rows, expansion 16→32, retained controls, unknown/current versions, root consent). Phone WebKit initially could not launch because pinned webkit-2311 was absent; installed that browser and will rerun separately. Receiver-free capability assertion is compiling before the correction. No timing evidence from this host.

Warm proof requirement found in the existing harness: signed_deploy_fixture asserts effective UID 0 and launches a system service with BindPaths=:/run, Restart=always and KillMode=control-group; helper deployment also requires UID 0. The current harness additionally restricts fixtures to retired /root/infraternal-bench paths. I will prepare public signed images/harness and adapt the fixture path to the authorized ~/infraternal-perf tree; the orchestrator must decide whether to permit privileged systemd execution on perf-test-01. Inventory measurements require neither root nor system services. No perf host contacted.

Recovered WIP split and pushed: be2d93c36 shared keyed/bounded Hosts panel; c87b1c651 authenticated browser inventory fields; 6c9fa4178 explicit owner-present repair wizard/socket; 749e4e526 Hosts/palette integration and production browser fixture. Typecheck passes; 104 focused tests pass. Production Chromium desktop passes (32 rows, expansion 16→32, retained controls, unknown/current versions, root consent). Phone WebKit initially could not launch because pinned webkit-2311 was absent; installed that browser and will rerun separately. Receiver-free capability assertion is compiling before the correction. No timing evidence from this host. Warm proof requirement found in the existing harness: signed_deploy_fixture asserts effective UID 0 and launches a system service with BindPaths=<owned-runtime>:/run, Restart=always and KillMode=control-group; helper deployment also requires UID 0. The current harness additionally restricts fixtures to retired /root/infraternal-bench paths. I will prepare public signed images/harness and adapt the fixture path to the authorized ~/infraternal-perf tree; the orchestrator must decide whether to permit privileged systemd execution on perf-test-01. Inventory measurements require neither root nor system services. No perf host contacted.
kayg commented 2026-10-29 21:28:33 +00:00
Author
Owner
Copy link

Warm-proof requirement correction: the updater fixture uses STAGING_KILL_MODE="process" (deploy_staging_tests.rs), preserving PTY shims across handoff. My earlier note incorrectly said control-group; that applies to a different local probe, not this update proof. The required privilege is still effective UID 0 plus systemd transient-service creation and BindPaths=:/run. Normal teardown stops that exact unit and its owned shims. No UID1000 manager or runtime bind is required for the selected reconnect case; the optional managed-host proof is separate. Production WebKit phone assertions now pass; screenshots are attached to #236. Merge iterate is building the full workspace.

Warm-proof requirement correction: the updater fixture uses STAGING_KILL_MODE="process" (deploy_staging_tests.rs), preserving PTY shims across handoff. My earlier note incorrectly said control-group; that applies to a different local probe, not this update proof. The required privilege is still effective UID 0 plus systemd transient-service creation and BindPaths=<owned-runtime>:/run. Normal teardown stops that exact unit and its owned shims. No UID1000 manager or runtime bind is required for the selected reconnect case; the optional managed-host proof is separate. Production WebKit phone assertions now pass; screenshots are attached to #236. Merge iterate is building the full workspace.
kayg commented 2026-10-29 21:36:17 +00:00
Author
Owner
Copy link

Current-dev integration finding: release_cli.rs auto-merged without a conflict, but dev’s installed-service resolver now returns PathBuf and D251 local_control expects &Path. Both CLI compile-out and Clippy fail E0308 at release_cli.rs:128 before correction. Added only the missing &data borrow in the main merge and updater-only comparison. No resolver, socket access rule, Tokio or AsyncFd change. Remaining iterate rows are running; the failed rows require a fresh check before the merge commit.

Current-dev integration finding: release_cli.rs auto-merged without a conflict, but dev’s installed-service resolver now returns PathBuf and D251 local_control expects &Path. Both CLI compile-out and Clippy fail E0308 at release_cli.rs:128 before correction. Added only the missing &data borrow in the main merge and updater-only comparison. No resolver, socket access rule, Tokio or AsyncFd change. Remaining iterate rows are running; the failed rows require a fresh check before the merge commit.
kayg commented 2026-10-29 21:44:25 +00:00
Author
Owner
Copy link

Merge fixture finding: workspace test setup_token_discovers_a_service_installed_through_a_versioned_binary_symlink failed its success assertion. D251 renders updates/current in the dry-run unit; dry-run intentionally does not create the restart symlink, but this test copied the unit without reproducing that installation step. Added only the missing fixture symlink (release builds), in both candidate and same-dev updater-only control. Shipping service discovery and restart behavior remain unchanged. Initial iterate passed fmt, native fmt, SSH helper/fixture/inode checks, shim process-per-user and cargo-deny; CLI compile-out, Clippy and workspace tests now rerun after the two integration corrections. #255 source comparison remains empty.

Merge fixture finding: workspace test setup_token_discovers_a_service_installed_through_a_versioned_binary_symlink failed its success assertion. D251 renders updates/current in the dry-run unit; dry-run intentionally does not create the restart symlink, but this test copied the unit without reproducing that installation step. Added only the missing fixture symlink (release builds), in both candidate and same-dev updater-only control. Shipping service discovery and restart behavior remain unchanged. Initial iterate passed fmt, native fmt, SSH helper/fixture/inode checks, shim process-per-user and cargo-deny; CLI compile-out, Clippy and workspace tests now rerun after the two integration corrections. #255 source comparison remains empty.
kayg commented 2026-10-29 21:59:36 +00:00
Author
Owner
Copy link

Merged dev 07c5da77b, preserving #255 Tokio 1.53.3 and exact owned AsyncFd sources (empty comparison). Merge resolutions are recorded in the commit. Fresh iterate passes all Rust rows except workspace test: 707 server cases passed, 56 ignored, one checkpoint parent failed because the invocation omitted its state-root variable. The exact parent and isolated child then both passed with the owned root restored. TypeScript full row passed. This is intermediate validation; final fast remains required.

Pushed head 8ab6d783f6. No deploy or perf-host contact.

merge-iterate-green.log
merge-checkpoint-green.log
merge-ts.log

Merged dev 07c5da77b, preserving #255 Tokio 1.53.3 and exact owned AsyncFd sources (empty comparison). Merge resolutions are recorded in the commit. Fresh iterate passes all Rust rows except workspace test: 707 server cases passed, 56 ignored, one checkpoint parent failed because the invocation omitted its state-root variable. The exact parent and isolated child then both passed with the owned root restored. TypeScript full row passed. This is intermediate validation; final fast remains required. Pushed head 8ab6d783f6e4e0bc4d1124fe49b48885eb14d09d. No deploy or perf-host contact. [merge-iterate-green.log](https://git.kayg.org/attachments/76cb900f-cada-4177-a745-7b8902dbced3) [merge-checkpoint-green.log](https://git.kayg.org/attachments/28d326f4-3b77-4d2d-a925-31602a049319) [merge-ts.log](https://git.kayg.org/attachments/39da87b9-5bf9-471a-9699-0b37625f4f64)
kayg commented 2026-10-29 22:02:53 +00:00
Author
Owner
Copy link

Protocol integration finding, reproduced by the receiver-free remote greeting assertion after the composition correction: MACHINE CAPABILITY (infraternal-protocol/src/machine.rs:4) and dev REMOTE_PATH_BACKUP (plugin-api/src/channel.rs:54) both equal 1<<6. Native dev peers therefore falsely appear update-capable. Proposed additive correction before implementation: preserve dev transport bits 0–7 exactly and allocate MACHINE bit 8, with no bit-6 alias; retain all machine envelope bytes/limits and Hello.version=1. The task records production has no updater; pre-release branch fixtures must be rebuilt, while ordinary older hosts correctly require manual repair. Add a disjoint-capability regression and update the two protocol contracts. This avoids misclassifying a shipping dev transport capability or weakening negotiation.

Protocol integration finding, reproduced by the receiver-free remote greeting assertion after the composition correction: MACHINE CAPABILITY (infraternal-protocol/src/machine.rs:4) and dev REMOTE_PATH_BACKUP (plugin-api/src/channel.rs:54) both equal 1<<6. Native dev peers therefore falsely appear update-capable. Proposed additive correction before implementation: preserve dev transport bits 0–7 exactly and allocate MACHINE bit 8, with no bit-6 alias; retain all machine envelope bytes/limits and Hello.version=1. The task records production has no updater; pre-release branch fixtures must be rebuilt, while ordinary older hosts correctly require manual repair. Add a disjoint-capability regression and update the two protocol contracts. This avoids misclassifying a shipping dev transport capability or weakening negotiation.
kayg commented 2026-10-29 22:05:00 +00:00
Author
Owner
Copy link

Corrected Hello allocation collision: MACHINE uses bit 8; dev native path backup retains bit 6. Disjointness regression failed at overlap 64 before correction. Protocol and plugin API fmt, Clippy/all-targets and tests passed. No envelope or Hello.version change; no bit-6 alias.

Pushed head df044123be. No deploy or perf-host contact.

capability-collision-red.log
capability-collision-green.log

Corrected Hello allocation collision: MACHINE uses bit 8; dev native path backup retains bit 6. Disjointness regression failed at overlap 64 before correction. Protocol and plugin API fmt, Clippy/all-targets and tests passed. No envelope or Hello.version change; no bit-6 alias. Pushed head df044123be73be98d57e3c0aeee9f8975356e8d4. No deploy or perf-host contact. [capability-collision-red.log](https://git.kayg.org/attachments/9946f890-6737-4e9d-b513-41bdd940b99c) [capability-collision-green.log](https://git.kayg.org/attachments/f7c03f48-e125-4d77-a2d3-4a407e19f1c7)
kayg commented 2026-10-29 22:09:03 +00:00
Author
Owner
Copy link

Receiver advertisement correction passed fmt, both all-target Clippy configurations, 151 receiver-free tests, 152 receiver-enabled tests, no-feature and release-without-remote compile checks, and runtime-disabled receiver reconstruction. Both greeting assertions failed before the composition correction, after the bit allocation collision was removed.

Pushed head d559760b0d. No deploy or perf-host contact.

receiver-isolated-red.log
daemon-receiver-bit8-red.log
receiver-green-bit8.log

Receiver advertisement correction passed fmt, both all-target Clippy configurations, 151 receiver-free tests, 152 receiver-enabled tests, no-feature and release-without-remote compile checks, and runtime-disabled receiver reconstruction. Both greeting assertions failed before the composition correction, after the bit allocation collision was removed. Pushed head d559760b0da98b2a955ef6415ff6a53f7bf0b969. No deploy or perf-host contact. [receiver-isolated-red.log](https://git.kayg.org/attachments/2fc6aa45-6172-4ed7-8262-b285aefb7976) [daemon-receiver-bit8-red.log](https://git.kayg.org/attachments/1ef34801-3fae-4bba-9450-aa4bf24c80a6) [receiver-green-bit8.log](https://git.kayg.org/attachments/aad9d2f4-7bea-4112-925f-bb7c09329e5f)
kayg commented 2026-10-29 22:14:03 +00:00
Author
Owner
Copy link

Repair parser coverage passed fmt, server all-target Clippy, 16 bootstrap API tests, and the existing SSH input corpus target Clippy. Shipping named features are unchanged; test-only decoder entry point shares the existing 32 KiB socket bound.

Pushed head 2e6bdced51. No deploy or perf-host contact.

request-coverage-gate.log
request-features.txt

Repair parser coverage passed fmt, server all-target Clippy, 16 bootstrap API tests, and the existing SSH input corpus target Clippy. Shipping named features are unchanged; test-only decoder entry point shares the existing 32 KiB socket bound. Pushed head 2e6bdced51125063fe5e92265cb5223ee9137794. No deploy or perf-host contact. [request-coverage-gate.log](https://git.kayg.org/attachments/e38796e6-2e9a-43cf-bc7e-95ee367ca219) [request-features.txt](https://git.kayg.org/attachments/7bc6986f-9608-4a9c-b278-97b469e2fc4e)
kayg commented 2026-10-29 22:16:56 +00:00
Author
Owner
Copy link

Added ignored perf-VM-only inventory harness: 128 admitted hosts, complete snapshot/metadata bytes, changed and unchanged durable observations; SQLite WAL/Normal pool eight, runtime four workers. Fmt and server all-target Clippy pass; 12 inventory tests pass, measurement stays ignored. Ordinary release dev/candidate harnesses will use identical feature recipes; no local performance claim.

Pushed head f4ccb9690b. No deploy or perf-host contact.

inventory-harness-gate.log

Added ignored perf-VM-only inventory harness: 128 admitted hosts, complete snapshot/metadata bytes, changed and unchanged durable observations; SQLite WAL/Normal pool eight, runtime four workers. Fmt and server all-target Clippy pass; 12 inventory tests pass, measurement stays ignored. Ordinary release dev/candidate harnesses will use identical feature recipes; no local performance claim. Pushed head f4ccb9690b9575f5598fdc30edf26374f3d0c3a5. No deploy or perf-host contact. [inventory-harness-gate.log](https://git.kayg.org/attachments/86d51ffa-7c65-45a2-9225-8094a08d5a98)
kayg commented 2026-10-29 22:20:13 +00:00
Author
Owner
Copy link

Staging fixture portability passes failing-first current-root assertion, two Rust boundary tests, two Python scope/canonical escape tests, three existing artifact tests, fmt and server all-target Clippy. Explicit current base requires job/signed/run; privileged systemd proof still belongs to orchestrator.

Pushed head 6daea97a6d. No deploy or perf-host contact.

staging-root-red.log
staging-root-green.log

Staging fixture portability passes failing-first current-root assertion, two Rust boundary tests, two Python scope/canonical escape tests, three existing artifact tests, fmt and server all-target Clippy. Explicit current base requires job/signed/run; privileged systemd proof still belongs to orchestrator. Pushed head 6daea97a6d4152046e3d6b5ea2095667d04d9398. No deploy or perf-host contact. [staging-root-red.log](https://git.kayg.org/attachments/c208f395-8d2d-457b-9d8c-c30b87275b93) [staging-root-green.log](https://git.kayg.org/attachments/3bed5130-d8aa-4acc-94f8-65c63ec48f26)
kayg commented 2026-10-29 22:20:22 +00:00
Author
Owner
Copy link

Documented retained running identities and update states, shared Hosts/palette repair, owner/mode/UID/route checks, one-use sign-in, failure cleanup and D303 local refusal codes. Fmt and whitespace checks pass. Explicit recovery, final production browser reruns, static comparisons and final fast follow.

Pushed head 8ca9575ea7. No deploy or perf-host contact.

host-docs-gate.log

Documented retained running identities and update states, shared Hosts/palette repair, owner/mode/UID/route checks, one-use sign-in, failure cleanup and D303 local refusal codes. Fmt and whitespace checks pass. Explicit recovery, final production browser reruns, static comparisons and final fast follow. Pushed head 8ca9575ea7530760b7a1db4076b4a29d5a15711d. No deploy or perf-host contact. [host-docs-gate.log](https://git.kayg.org/attachments/2ca84a29-03cf-4357-98ca-121a2fb9d958)
kayg commented 2026-10-29 22:21:50 +00:00
Author
Owner
Copy link

Head 8ca9575ea: explicit update_recovery passes: 26 passed, 0 failed, 1 ignored. Production Chromium desktop (1280×900) and WebKit phone (390×844, DPR3) pass in separate invocations, one worker, port 44211, RTT simulation disabled. Checked Hosts/palette retained identity/state, 16→32 expansion, keyed control retention and unchecked root consent. No visual-quality judgment or timing claim; screenshots are for owner review. All logged browser PIDs 794759, 795042 and MiniBrowser 795048 are absent (ps exit 1); owned test port is closed; no browser profile remains. T3 preview blank tab used for availability check was closed. No perf host contacted.

legacy-inventory-desktop.png
legacy-root-consent-desktop.png
legacy-inventory-phone.png
legacy-root-consent-phone.png
final-browser-desktop.log
final-browser-phone.log
final-browser-cleanup.txt
update-recovery-final.log

Head 8ca9575ea: explicit update_recovery passes: 26 passed, 0 failed, 1 ignored. Production Chromium desktop (1280×900) and WebKit phone (390×844, DPR3) pass in separate invocations, one worker, port 44211, RTT simulation disabled. Checked Hosts/palette retained identity/state, 16→32 expansion, keyed control retention and unchecked root consent. No visual-quality judgment or timing claim; screenshots are for owner review. All logged browser PIDs 794759, 795042 and MiniBrowser 795048 are absent (ps exit 1); owned test port is closed; no browser profile remains. T3 preview blank tab used for availability check was closed. No perf host contacted. ![legacy-inventory-desktop.png](https://git.kayg.org/attachments/53822f57-e8ab-458d-b074-b59e61e54d2a) ![legacy-root-consent-desktop.png](https://git.kayg.org/attachments/ee140615-6344-4b5e-b1fe-7aff59357bd5) ![legacy-inventory-phone.png](https://git.kayg.org/attachments/715fd1b1-35e5-4c78-83dc-b6362f50fe00) ![legacy-root-consent-phone.png](https://git.kayg.org/attachments/3a3b78d8-38cd-4cef-8cf7-1701e38cf9ec) [final-browser-desktop.log](https://git.kayg.org/attachments/c06e2343-097a-4c78-b1c2-37fc32f498c4) [final-browser-phone.log](https://git.kayg.org/attachments/ba6f2fa0-1563-4f15-9277-9cad8023b3dc) [final-browser-cleanup.txt](https://git.kayg.org/attachments/15fd795e-2980-453d-9d51-4e1876d9fffb) [update-recovery-final.log](https://git.kayg.org/attachments/fa6fbab7-8b31-4e2e-9a89-bda7fee4d2be)
kayg commented 2026-10-29 22:43:28 +00:00
Author
Owner
Copy link

Linux Unix socket path limit=107 bytes; normal eight-character temporary suffix: 111; selected four-hex suffix: 107. The runner checks the actual encoded path before copying or launching. It creates only an unused root (0700), retries collisions and removes only that exact directory. No fixture privilege or perf host used for this calculation.

Linux Unix socket path limit=107 bytes; normal eight-character temporary suffix: 111; selected four-hex suffix: 107. The runner checks the actual encoded path before copying or launching. It creates only an unused root (0700), retries collisions and removes only that exact directory. No fixture privilege or perf host used for this calculation.
kayg commented 2026-10-29 22:50:02 +00:00
Author
Owner
Copy link

Build checkpoint at pushed head 8ca9575ea. Same-recipe dev 07c5da77b controls complete: x86_64 21,400,400 B; aarch64 19,575,064 B. Production-trust checks pass. Wrapper/config hashes and all release profiles match across dev/updater-only/candidate. Updater-only builds now running; its source includes the same bit-8 and compiled-receiver corrections, so the later legacy delta excludes them. No cap changed yet. Warm runner also uses a short owned fixture root: the physical shim socket is 107 bytes; functional bind/connect succeeds at 107 and refuses the original 111-byte path. No perf VM contact or runtime performance claim. Candidate/staging artifacts, exact caps, final fast, archive handoff and cleanup remain.

static-sizes.txt
static-recipe.json
warm-path-bound.txt
warm-path-functional.txt
author-review-current.txt

Build checkpoint at pushed head 8ca9575ea. Same-recipe dev 07c5da77b controls complete: x86_64 21,400,400 B; aarch64 19,575,064 B. Production-trust checks pass. Wrapper/config hashes and all release profiles match across dev/updater-only/candidate. Updater-only builds now running; its source includes the same bit-8 and compiled-receiver corrections, so the later legacy delta excludes them. No cap changed yet. Warm runner also uses a short owned fixture root: the physical shim socket is 107 bytes; functional bind/connect succeeds at 107 and refuses the original 111-byte path. No perf VM contact or runtime performance claim. Candidate/staging artifacts, exact caps, final fast, archive handoff and cleanup remain. [static-sizes.txt](https://git.kayg.org/attachments/5088b5fb-8a64-4841-967c-6e687ffa4c71) [static-recipe.json](https://git.kayg.org/attachments/54b78b48-1954-4f4a-9f74-889a2fde4273) [warm-path-bound.txt](https://git.kayg.org/attachments/851de22c-2dc7-4edf-99b6-f36e142575ad) [warm-path-functional.txt](https://git.kayg.org/attachments/90d75346-87c9-4132-a8ce-7bb7f203d329) [author-review-current.txt](https://git.kayg.org/attachments/a4fcc1d4-5ca0-4505-9fb6-d0c53cb8231a)
kayg commented 2026-10-29 23:04:42 +00:00
Author
Owner
Copy link

Same-recipe updater-only control on current dev 07c5da77b: x86_64 22,036,328 B versus dev 21,400,400 B = +635,928 B. Production-trust check PASS. This control is d3b5dc0b8 merged with dev plus the same MACHINE bit-8/compiled-receiver corrections; legacy inventory/repair is excluded. This matches the approximately +636 KB updater scope accepted by D301. ARM control and both final candidate artifacts remain building; no cap changed and final fast remains pending.

Same-recipe updater-only control on current dev 07c5da77b: x86_64 22,036,328 B versus dev 21,400,400 B = +635,928 B. Production-trust check PASS. This control is d3b5dc0b8 merged with dev plus the same MACHINE bit-8/compiled-receiver corrections; legacy inventory/repair is excluded. This matches the approximately +636 KB updater scope accepted by D301. ARM control and both final candidate artifacts remain building; no cap changed and final fast remains pending.
kayg commented 2026-10-29 23:17:04 +00:00
Author
Owner
Copy link

Both ordinary updater-only controls complete with production-trust PASS: x86_64 22,036,328 B (+635,928 B versus dev 07c5da77b), aarch64 20,139,648 B (+564,584 B). Same pinned static recipe/profiles; source control tree a6a1e4485b2f8de6deb79248771de192a96e0f3a. Both deltas fit the D301 updater exception. Baseline inventory harness is building next, followed by public warm fixtures and final ordinary candidate images/harness. Separate legacy delta, exact-cap commit and final fast are still pending.

Both ordinary updater-only controls complete with production-trust PASS: x86_64 22,036,328 B (+635,928 B versus dev 07c5da77b), aarch64 20,139,648 B (+564,584 B). Same pinned static recipe/profiles; source control tree a6a1e4485b2f8de6deb79248771de192a96e0f3a. Both deltas fit the D301 updater exception. Baseline inventory harness is building next, followed by public warm fixtures and final ordinary candidate images/harness. Separate legacy delta, exact-cap commit and final fast are still pending.
kayg commented 2026-10-29 23:53:52 +00:00
Author
Owner
Copy link

Release-profile warm fixtures prepared at source 8ca9575ea, prepare-only returned before remote execution. Public fixture is public-transfer-57cb3fb2; its exact ignored reconnect test lists successfully using the packaged loader/libraries. No perf proof executed. Ordinary candidate static builds now running. Dev inventory harness lists its exact measurement test; compiled server/API features exclude staging-trust and its exact compiled-authorities regression passes. The dev test binary contains the marker literal in that regression, so static-image marker scanning is unsuitable for that test executable. The archive will retain feature receipts and the verifier result.

warm-handoff-prepare.log
inventory-harness-trust.txt

Release-profile warm fixtures prepared at source 8ca9575ea, prepare-only returned before remote execution. Public fixture is public-transfer-57cb3fb2; its exact ignored reconnect test lists successfully using the packaged loader/libraries. No perf proof executed. Ordinary candidate static builds now running. Dev inventory harness lists its exact measurement test; compiled server/API features exclude staging-trust and its exact compiled-authorities regression passes. The dev test binary contains the marker literal in that regression, so static-image marker scanning is unsuitable for that test executable. The archive will retain feature receipts and the verifier result. [warm-handoff-prepare.log](https://git.kayg.org/attachments/278aec53-757b-4a3a-98c5-da4999d7530f) [inventory-harness-trust.txt](https://git.kayg.org/attachments/3bbbc099-5ff7-4cf9-bf67-2f0d9780a97c)
kayg commented 2026-10-29 23:58:56 +00:00
Author
Owner
Copy link

Ordinary production-trust x86_64 candidate at 8ca9575ea: 22,084,480 B; dev 07c5da77b: 21,400,400 B; updater-only control: 22,036,328 B. Total +684,080 B = D301 updater +635,928 B + separately measured #236 legacy inventory/owner-present repair +48,152 B (below 64 KiB, above 16 KiB). Justification: authenticated retained version/capability/state, durable observation publication, owner/mode/UID/route-bound repair and existing SSH lifecycle authorization/reservation/cleanup safeguards. Same shipping dependency graph, Cargo features, profiles and compiler recipe; legacy-dependencies.diff is empty. No new polling worker or library. Do not attribute this additional cost to the updater-only exception. Existing recovery, observation, repair and production-browser gates are issue-attached; runtime scale evidence remains pending orchestrator. ARM candidate and final fast still building/pending; exact caps unchanged until both sizes are known.

Ordinary production-trust x86_64 candidate at 8ca9575ea: 22,084,480 B; dev 07c5da77b: 21,400,400 B; updater-only control: 22,036,328 B. Total +684,080 B = D301 updater +635,928 B + separately measured #236 legacy inventory/owner-present repair +48,152 B (below 64 KiB, above 16 KiB). Justification: authenticated retained version/capability/state, durable observation publication, owner/mode/UID/route-bound repair and existing SSH lifecycle authorization/reservation/cleanup safeguards. Same shipping dependency graph, Cargo features, profiles and compiler recipe; legacy-dependencies.diff is empty. No new polling worker or library. Do not attribute this additional cost to the updater-only exception. Existing recovery, observation, repair and production-browser gates are issue-attached; runtime scale evidence remains pending orchestrator. ARM candidate and final fast still building/pending; exact caps unchanged until both sizes are known.
kayg commented 2026-10-30 00:17:00 +00:00
Author
Owner
Copy link

Pushed exact-cap commit db7b79c6e1. Same-recipe stripped static production-trust sizes: x86_64 22,084,480 B (+684,080 against dev), aarch64 20,185,112 B (+610,048). Separate legacy inventory/repair costs: +48,152 / +45,464 B; updater-only costs: +635,928 / +564,584 B (D301). The separate legacy cost is justified by authenticated durable observations and owner/mode/UID/route-bound reuse of SSH installation/reservation/cleanup; no shipping dependency/feature/profile changes or polling task. PROCESS records all three variants, supersedes the old ceilings, and keeps the #211 trim follow-up.

Fmt, Bash syntax and whitespace checks pass. Both architectures pass production trust, stripped/static linkage and exact-byte checks; +1 byte is refused and -1 byte requires a downward ratchet.

production trust: PASS (staging-trust authority absent)
/home/agent/.cache/codex-scratch/edge-autoupdate-r2/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 22084480 bytes; cap: 22084480 bytes; delta: +0 bytes
binary exceeds the 22084480-byte size budget: 22084481 bytes
binary shrank to 22084479 bytes; ratchet the x86_64-unknown-linux-musl ceiling down from 22084480 bytes
CAP_BOUNDARY x86_64-unknown-linux-musl exact=PASS growth=REFUSED shrink=RATCHET_REQUIRED
production trust: PASS (staging-trust authority absent)
/home/agent/.cache/codex-scratch/edge-autoupdate-r2/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 20185112 bytes; cap: 20185112 bytes; delta: +0 bytes
binary exceeds the 20185112-byte size budget: 20185113 bytes
binary shrank to 20185111 bytes; ratchet the aarch64-unknown-linux-musl ceiling down from 20185112 bytes
CAP_BOUNDARY aarch64-unknown-linux-musl exact=PASS growth=REFUSED shrink=RATCHET_REQUIRED

Final ordinary inventory harness is still building. Perf archive/handoff, final scripts/verify fast and cleanup remain.

final-cap-gate.log
static-sizes.txt
final-size-comparison.json

Pushed exact-cap commit db7b79c6e156808d99e41d4e73b52c13e24bd8cd. Same-recipe stripped static production-trust sizes: x86_64 22,084,480 B (+684,080 against dev), aarch64 20,185,112 B (+610,048). Separate legacy inventory/repair costs: +48,152 / +45,464 B; updater-only costs: +635,928 / +564,584 B (D301). The separate legacy cost is justified by authenticated durable observations and owner/mode/UID/route-bound reuse of SSH installation/reservation/cleanup; no shipping dependency/feature/profile changes or polling task. PROCESS records all three variants, supersedes the old ceilings, and keeps the #211 trim follow-up. Fmt, Bash syntax and whitespace checks pass. Both architectures pass production trust, stripped/static linkage and exact-byte checks; +1 byte is refused and -1 byte requires a downward ratchet. ``` production trust: PASS (staging-trust authority absent) /home/agent/.cache/codex-scratch/edge-autoupdate-r2/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped PT_INTERP: absent; size: 22084480 bytes; cap: 22084480 bytes; delta: +0 bytes binary exceeds the 22084480-byte size budget: 22084481 bytes binary shrank to 22084479 bytes; ratchet the x86_64-unknown-linux-musl ceiling down from 22084480 bytes CAP_BOUNDARY x86_64-unknown-linux-musl exact=PASS growth=REFUSED shrink=RATCHET_REQUIRED production trust: PASS (staging-trust authority absent) /home/agent/.cache/codex-scratch/edge-autoupdate-r2/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped PT_INTERP: absent; size: 20185112 bytes; cap: 20185112 bytes; delta: +0 bytes binary exceeds the 20185112-byte size budget: 20185113 bytes binary shrank to 20185111 bytes; ratchet the aarch64-unknown-linux-musl ceiling down from 20185112 bytes CAP_BOUNDARY aarch64-unknown-linux-musl exact=PASS growth=REFUSED shrink=RATCHET_REQUIRED ``` Final ordinary inventory harness is still building. Perf archive/handoff, final scripts/verify fast and cleanup remain. [final-cap-gate.log](https://git.kayg.org/attachments/abc2b23a-7d6f-4f1d-b0b8-bca037d9a9fb) [static-sizes.txt](https://git.kayg.org/attachments/b58d8c04-3ba7-42b9-ae39-73dfab27214d) [final-size-comparison.json](https://git.kayg.org/attachments/0fdc3136-1261-44f4-8a10-8df67a056a1b)
kayg commented 2026-10-30 00:29:53 +00:00
Author
Owner
Copy link

Perf handoff ready at pushed head db7b79c6e1; final scripts/verify fast is running on that head. No runtime perf result is claimed yet. Artifact source is 8ca9575ea7; the later cap commit changes only ceilings/documentation.

Build host: 6by32-compute02
Archive: /home/agent/.cache/codex-scratch/edge-autoupdate-r2/e211-proof-8ca9575ea753.tar.xz
Bytes: 69779616
SHA-256: 51fb06283fc8434af6733f2e6fc36ebb7244b27b25a2ef412c783609b3ea7c9c

Orchestrator: copy this public archive to perf-test-01 under /home/agent/infraternal-perf/, verify the SHA above, then extract as agent:

mkdir -p /home/agent/infraternal-perf/e211/signed
tar -xJf /home/agent/infraternal-perf/e211-proof-8ca9575ea753.tar.xz -C /home/agent/infraternal-perf

Paired inventory command, as agent (no root):

/usr/local/bin/perf-run.sh -- python3 /home/agent/infraternal-perf/e211-proof-8ca9575ea753/run-inventory.py --on-perf-vm > /home/agent/infraternal-perf/e211-inventory-db7b79c6e.log 2>&1

Five adjacent alternating baseline/candidate pairs; 128 admitted records, zero connected channels; 128 snapshot samples each; candidate 128-way changed/unchanged observation bursts; metadata bytes separate from wait4 process peak RSS. Both ordinary harnesses use the same release profile/features and exclude staging-trust; source patches, feature receipts, loader/libs and machine/load capture are packaged. Each child is bounded at 120 seconds; total maximum remains below the 30-minute lock window.

Warm handoff requires the orchestrator's decision on privileged execution. The existing harness asserts effective UID 0 and creates its own transient systemd service with BindPaths=<owned run>/r:/run, Restart=always and KillMode=process so the 128 PTYs survive the handoff. The selected reconnect case uses one active stream and does not require a UID-1000 user manager. Python 3, systemd/systemd-run, procfs/cgroupfs and a working login shell are required. Agent should create the parent above before any root invocation. The fixture stays under /home/agent/infraternal-perf/e211/signed/r<4 hex>; its actual shim socket is 107 bytes. Runner checks the canonical root/path bound, uses only loopback HTTP, enforces a 1200-second harness deadline, and cleans only its own directory/bucket and services whose ExecStart is inside that exact root.

If the orchestrator authorizes root/systemd, the exact command is:

sudo -n /usr/local/bin/perf-run.sh -- python3 /home/agent/infraternal-perf/e211-proof-8ca9575ea753/run-warm.py --on-perf-vm > /home/agent/infraternal-perf/e211-warm-db7b79c6e.log 2>&1

Please attach both complete logs and command exit statuses to #211. All runtime timing/CPU/memory conclusions remain pending these VM runs. No perf host or acceptance host was contacted from this job; no deployment.

perf-archive.txt
MANIFEST.json
run-inventory.py.txt
run-warm.py.txt
baseline-inventory.patch.txt
updater-only.patch.txt

Perf handoff ready at pushed head db7b79c6e156808d99e41d4e73b52c13e24bd8cd; final scripts/verify fast is running on that head. No runtime perf result is claimed yet. Artifact source is 8ca9575ea7530760b7a1db4076b4a29d5a15711d; the later cap commit changes only ceilings/documentation. Build host: 6by32-compute02 Archive: `/home/agent/.cache/codex-scratch/edge-autoupdate-r2/e211-proof-8ca9575ea753.tar.xz` Bytes: 69779616 SHA-256: `51fb06283fc8434af6733f2e6fc36ebb7244b27b25a2ef412c783609b3ea7c9c` Orchestrator: copy this public archive to perf-test-01 under `/home/agent/infraternal-perf/`, verify the SHA above, then extract as agent: ```sh mkdir -p /home/agent/infraternal-perf/e211/signed tar -xJf /home/agent/infraternal-perf/e211-proof-8ca9575ea753.tar.xz -C /home/agent/infraternal-perf ``` Paired inventory command, as agent (no root): ```sh /usr/local/bin/perf-run.sh -- python3 /home/agent/infraternal-perf/e211-proof-8ca9575ea753/run-inventory.py --on-perf-vm > /home/agent/infraternal-perf/e211-inventory-db7b79c6e.log 2>&1 ``` Five adjacent alternating baseline/candidate pairs; 128 admitted records, zero connected channels; 128 snapshot samples each; candidate 128-way changed/unchanged observation bursts; metadata bytes separate from wait4 process peak RSS. Both ordinary harnesses use the same release profile/features and exclude staging-trust; source patches, feature receipts, loader/libs and machine/load capture are packaged. Each child is bounded at 120 seconds; total maximum remains below the 30-minute lock window. Warm handoff requires the orchestrator's decision on privileged execution. The existing harness asserts effective UID 0 and creates its own transient systemd service with `BindPaths=<owned run>/r:/run`, `Restart=always` and `KillMode=process` so the 128 PTYs survive the handoff. The selected reconnect case uses one active stream and does not require a UID-1000 user manager. Python 3, systemd/systemd-run, procfs/cgroupfs and a working login shell are required. Agent should create the parent above before any root invocation. The fixture stays under `/home/agent/infraternal-perf/e211/signed/r<4 hex>`; its actual shim socket is 107 bytes. Runner checks the canonical root/path bound, uses only loopback HTTP, enforces a 1200-second harness deadline, and cleans only its own directory/bucket and services whose ExecStart is inside that exact root. If the orchestrator authorizes root/systemd, the exact command is: ```sh sudo -n /usr/local/bin/perf-run.sh -- python3 /home/agent/infraternal-perf/e211-proof-8ca9575ea753/run-warm.py --on-perf-vm > /home/agent/infraternal-perf/e211-warm-db7b79c6e.log 2>&1 ``` Please attach both complete logs and command exit statuses to #211. All runtime timing/CPU/memory conclusions remain pending these VM runs. No perf host or acceptance host was contacted from this job; no deployment. [perf-archive.txt](https://git.kayg.org/attachments/9c870aa1-529c-4c95-8c22-ce81cbfb062c) [MANIFEST.json](https://git.kayg.org/attachments/90e0471f-aee1-4808-884b-434576191c84) [run-inventory.py.txt](https://git.kayg.org/attachments/e5b0ddcf-f26b-4282-8a0e-139534bae8e6) [run-warm.py.txt](https://git.kayg.org/attachments/8eea709e-0047-41e1-a8fe-250e9878c645) [baseline-inventory.patch.txt](https://git.kayg.org/attachments/1ae33e13-7d61-4aba-969e-418f3f6b7771) [updater-only.patch.txt](https://git.kayg.org/attachments/98fadb9d-de02-4849-b0af-6beaaf087542)
kayg commented 2026-10-30 00:34:50 +00:00
Author
Owner
Copy link

Final fast first attempt found eight CLI restart regressions under the runner-provided symlinked INFRATERNAL_TEST_STATE_ROOT. Protected executable checks refuse symlink ancestors; the reload test also compared the alias against canonical current_exe (e211 versus edge-autoupdate-r2/state), and the parent-escape test counted lexical depth. Two exact failing tests pass with the same compiled executable under a short, physical private root (rootless pinned-image admission and reload after inode replacement). This confirms runner configuration, not a shipping-code regression. No production check will be weakened. The corrected runner uses the owned physical ~/.cache/codex-scratch/e211r root; failed transcript will be retained, and full fast reruns on the unchanged pushed head db7b79c6e after this attempt exits. Perf archive/commands already on #211 remain unchanged.

physical-root-probe.log

Final fast first attempt found eight CLI restart regressions under the runner-provided symlinked INFRATERNAL_TEST_STATE_ROOT. Protected executable checks refuse symlink ancestors; the reload test also compared the alias against canonical current_exe (e211 versus edge-autoupdate-r2/state), and the parent-escape test counted lexical depth. Two exact failing tests pass with the same compiled executable under a short, physical private root (rootless pinned-image admission and reload after inode replacement). This confirms runner configuration, not a shipping-code regression. No production check will be weakened. The corrected runner uses the owned physical ~/.cache/codex-scratch/e211r root; failed transcript will be retained, and full fast reruns on the unchanged pushed head db7b79c6e after this attempt exits. Perf archive/commands already on #211 remain unchanged. [physical-root-probe.log](https://git.kayg.org/attachments/043b3b4f-5fd1-48c7-a711-ea8a8ab80d65)
kayg commented 2026-10-30 00:48:24 +00:00
Author
Owner
Copy link

Pushed fixture-only correction 83db05b380. The first full fast run failed CLI plugin compile-out/workspace CLI tests on the runner symlink root, plus the isolated shipping recipe fixture. All other Rust rows passed. The recipe fixture omitted the merged real driver's remap helper, stubbed required inline Python and had not isolated the newly added CLI group artifact check. It now supplies the real helper/interpreter for driver snippets, records admission arguments after only the known target-remap configuration prefixes, and isolates unrelated artifact checks as before. The actual production wrapper and artifact checks are unchanged; four production-mode/version cases, fmt and whitespace pass.

Full fast now reruns on this pushed head with the owned short physical root ~/.cache/codex-scratch/e211r. No production symlink checks relaxed, no test waived. The public perf archive remains valid: this commit changes only the isolated Python test, no shipping code or runtime harness. Exact archive/commands remain above; final gate and cleanup pending.

first-fast-symlink.log
static-recipe-fixture-red.log
static-recipe-fixture-green.log

Pushed fixture-only correction 83db05b38096ca48a398344138fc2bb012109ee8. The first full fast run failed CLI plugin compile-out/workspace CLI tests on the runner symlink root, plus the isolated shipping recipe fixture. All other Rust rows passed. The recipe fixture omitted the merged real driver's remap helper, stubbed required inline Python and had not isolated the newly added CLI group artifact check. It now supplies the real helper/interpreter for driver snippets, records admission arguments after only the known target-remap configuration prefixes, and isolates unrelated artifact checks as before. The actual production wrapper and artifact checks are unchanged; four production-mode/version cases, fmt and whitespace pass. Full fast now reruns on this pushed head with the owned short physical root ~/.cache/codex-scratch/e211r. No production symlink checks relaxed, no test waived. The public perf archive remains valid: this commit changes only the isolated Python test, no shipping code or runtime harness. Exact archive/commands remain above; final gate and cleanup pending. [first-fast-symlink.log](https://git.kayg.org/attachments/65cc8788-f9b4-4bc4-a808-788661369679) [static-recipe-fixture-red.log](https://git.kayg.org/attachments/75602fbf-708f-4600-9667-3600c0240fe5) [static-recipe-fixture-green.log](https://git.kayg.org/attachments/6995954e-757c-4128-9fc0-2c7f8be943b2)
kayg commented 2026-10-30 01:00:02 +00:00
Author
Owner
Copy link

Second full fast at 83db05b38: all Rust rows pass except workspace tests (server 706 passed, 3 failed, 57 ignored). The three failures are setup-token Unix sockets: runner TMPDIR plus the existing full UUID fixture name creates a 113-byte path, above Linux's 107-byte bound. All three exact tests pass with the same compiled executable using the owned physical ~/.cache/codex-scratch/e TMP root (0700, job marker); the longest setup-token path is exactly 107 bytes. The general test-state root stays physical ~/.cache/codex-scratch/e211r. No source/test change or waiver for this environment correction; the full gate is rerunning on the unchanged pushed head. Both roots are recorded for owned cleanup. Production-trust static builds/key checks and exact sizes passed in the second attempt; archive and perf commands remain valid.

second-fast-long-tmp.log
compact-tmp-probes.log

Second full fast at 83db05b38: all Rust rows pass except workspace tests (server 706 passed, 3 failed, 57 ignored). The three failures are setup-token Unix sockets: runner TMPDIR plus the existing full UUID fixture name creates a 113-byte path, above Linux's 107-byte bound. All three exact tests pass with the same compiled executable using the owned physical ~/.cache/codex-scratch/e TMP root (0700, job marker); the longest setup-token path is exactly 107 bytes. The general test-state root stays physical ~/.cache/codex-scratch/e211r. No source/test change or waiver for this environment correction; the full gate is rerunning on the unchanged pushed head. Both roots are recorded for owned cleanup. Production-trust static builds/key checks and exact sizes passed in the second attempt; archive and perf commands remain valid. [second-fast-long-tmp.log](https://git.kayg.org/attachments/b0ae3f4c-652b-4902-8414-b7b8a6746f95) [compact-tmp-probes.log](https://git.kayg.org/attachments/a6d10d8d-de7e-4e99-9c1a-59bc21e09dfb)
kayg commented 2026-10-30 01:12:53 +00:00
Author
Owner
Copy link

Implementation handoff: pushed head 83db05b380, clean and equal to origin/edge-autoupdate-r2. Merged dev 07c5da77b, preserved #255 exactly, split recovered UI/repair work into atomic commits, corrected disjoint/composed receiver capability, added parser/scale coverage and operations docs, and recorded exact size ceilings. The last commit completes only an isolated gate fixture; shipping code and public perf artifacts remain unchanged.

Final scripts/verify fast exit 0 on this head. Verbatim Rust summary and final TypeScript output below; the complete verbatim transcript is attached. No gate waiver. Earlier failed attempts remain attached with their runner path/root diagnoses.

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

src/mesh-review-resync.test.ts:
(pass) review watch applies same-revision authoritative resync [0.12ms]
(pass) authoritative resync keeps priority over an equal-revision pending list [1.43ms]

src/mesh-vectors.test.ts:
(pass) every shared Mesh action vector passes through the typed client unchanged [1.84ms]
(pass) shared Mesh event vectors drive the typed watch adapter [5.28ms]

 39 pass
 0 fail
 36135 expect() calls
Ran 39 tests across 10 files. [2.23s]

Ordinary stripped static sizes versus actual same-recipe dev: x86_64 22,084,480 B (+684,080); aarch64 20,185,112 B (+610,048). Separate legacy inventory/owner-present repair cost: +48,152 / +45,464 B; updater: +635,928 / +564,584 B (D301). Both exact caps have no allowance. Final built hashes match the public candidate images.

Explicit recovery previously passed 26 tests (1 VM-only ignored). Separate production Chromium desktop / WebKit phone functional reruns passed; screenshots are attached above for owner review. No self-assessed visual-quality claim.

Cleanup verified before deleting owned targets, comparison worktrees, private fixture roots and browser cache: no owned native executable running, browser PIDs 794759/795042/795048 absent, port 44211 closed. Public archive, expanded package, artifacts, evidence and runners retained. No deploy, issue closure, perf-host or acceptance-host contact.

Pending orchestrator: execute the exact paired inventory command and, if root/systemd is authorized, warm-handoff command already posted above. Archive /home/agent/.cache/codex-scratch/edge-autoupdate-r2/e211-proof-8ca9575ea753.tar.xz; SHA-256 51fb06283fc8434af6733f2e6fc36ebb7244b27b25a2ef412c783609b3ea7c9c. Independent code/screenshot review and runtime perf conclusions remain pending those external steps.

final-fast.log
final-fast-summary.txt
final-cleanup.txt
author-review-current.txt
static-format-checks.txt

Implementation handoff: pushed head 83db05b38096ca48a398344138fc2bb012109ee8, clean and equal to origin/edge-autoupdate-r2. Merged dev 07c5da77b, preserved #255 exactly, split recovered UI/repair work into atomic commits, corrected disjoint/composed receiver capability, added parser/scale coverage and operations docs, and recorded exact size ceilings. The last commit completes only an isolated gate fixture; shipping code and public perf artifacts remain unchanged. Final `scripts/verify fast` exit 0 on this head. Verbatim Rust summary and final TypeScript output below; the complete verbatim transcript is attached. No gate waiver. Earlier failed attempts remain attached with their runner path/root diagnoses. ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ src/mesh-review-resync.test.ts: (pass) review watch applies same-revision authoritative resync [0.12ms] (pass) authoritative resync keeps priority over an equal-revision pending list [1.43ms] src/mesh-vectors.test.ts: (pass) every shared Mesh action vector passes through the typed client unchanged [1.84ms] (pass) shared Mesh event vectors drive the typed watch adapter [5.28ms] 39 pass 0 fail 36135 expect() calls Ran 39 tests across 10 files. [2.23s] ``` Ordinary stripped static sizes versus actual same-recipe dev: x86_64 22,084,480 B (+684,080); aarch64 20,185,112 B (+610,048). Separate legacy inventory/owner-present repair cost: +48,152 / +45,464 B; updater: +635,928 / +564,584 B (D301). Both exact caps have no allowance. Final built hashes match the public candidate images. Explicit recovery previously passed 26 tests (1 VM-only ignored). Separate production Chromium desktop / WebKit phone functional reruns passed; screenshots are attached above for owner review. No self-assessed visual-quality claim. Cleanup verified before deleting owned targets, comparison worktrees, private fixture roots and browser cache: no owned native executable running, browser PIDs 794759/795042/795048 absent, port 44211 closed. Public archive, expanded package, artifacts, evidence and runners retained. No deploy, issue closure, perf-host or acceptance-host contact. Pending orchestrator: execute the exact paired inventory command and, if root/systemd is authorized, warm-handoff command already posted above. Archive `/home/agent/.cache/codex-scratch/edge-autoupdate-r2/e211-proof-8ca9575ea753.tar.xz`; SHA-256 `51fb06283fc8434af6733f2e6fc36ebb7244b27b25a2ef412c783609b3ea7c9c`. Independent code/screenshot review and runtime perf conclusions remain pending those external steps. [final-fast.log](https://git.kayg.org/attachments/f117b153-265c-4977-952d-7b8896c4cfe3) [final-fast-summary.txt](https://git.kayg.org/attachments/e1d97c84-67a9-48f1-8d96-f5a8f8e6c5ae) [final-cleanup.txt](https://git.kayg.org/attachments/cf19ba12-ed26-4d49-a64e-991bf79227bc) [author-review-current.txt](https://git.kayg.org/attachments/8b58706c-daf0-44ef-8e1d-41dfc1760527) [static-format-checks.txt](https://git.kayg.org/attachments/43c1b361-39e0-4910-921f-56ea2ef396f6)
kayg commented 2026-10-30 01:14:51 +00:00
Author
Owner
Copy link

Independent review started: branch review-edge-autoupdate-r2, target/base 83db05b380, comparison dev 8f88bf086. Reading decisions and issue histories, then checking update integrity, D295 recovery, warm handoff, lockstep, owner-present repair and receiver capabilities. No host contact, implementation changes or deployment. Logs under ~/.cache/codex-scratch/review-edge-autoupdate/.

Independent review started: branch review-edge-autoupdate-r2, target/base 83db05b38096ca48a398344138fc2bb012109ee8, comparison dev 8f88bf086. Reading decisions and issue histories, then checking update integrity, D295 recovery, warm handoff, lockstep, owner-present repair and receiver capabilities. No host contact, implementation changes or deployment. Logs under ~/.cache/codex-scratch/review-edge-autoupdate/.
kayg commented 2026-10-30 01:21:17 +00:00
Author
Owner
Copy link

EAR2-01 · P1 · D295 recovery stops after candidate consumes restore headroom

Location: crates/infraternal-server/src/update_recovery.rs:343-354 (free-space admission), :531-552 (restore_copy allocates another complete database).
Scenario: admit a switch on a private 32 MiB filesystem, retain a real 4 MiB SQLite preimage, enter the candidate and write until SQLITE_FULL, then start the predecessor. Admission only checks free space; candidate writes can consume it. Offline undo needs another full copy while retaining both live and saved images, so startup is refused repeatedly until an operator frees storage. Stable binary selection does not make the server runnable with its database.
Test: update_recovery::tests::review_d295_candidate_disk_full_still_restores_the_admitted_copy. Reused valid b1555e44f WIP test; ran in an unprivileged private mount namespace, no VM or host contact. Initial free=29,331,456 B, remaining=12,288 B, retained copy=4,210,688 B. Real SQLite error=13 (SQLITE_FULL); restore error="Not enough disk space to copy the database before updating". Result: FAILED, 0 passed / 1 failed.
Commit: 217daca96 on review-edge-autoupdate-r2 (pushed). No implementation fix. Raw receipt attached as disk-full-red.log.

EAR2-01 · P1 · D295 recovery stops after candidate consumes restore headroom Location: crates/infraternal-server/src/update_recovery.rs:343-354 (free-space admission), :531-552 (restore_copy allocates another complete database). Scenario: admit a switch on a private 32 MiB filesystem, retain a real 4 MiB SQLite preimage, enter the candidate and write until SQLITE_FULL, then start the predecessor. Admission only checks free space; candidate writes can consume it. Offline undo needs another full copy while retaining both live and saved images, so startup is refused repeatedly until an operator frees storage. Stable binary selection does not make the server runnable with its database. Test: update_recovery::tests::review_d295_candidate_disk_full_still_restores_the_admitted_copy. Reused valid b1555e44f WIP test; ran in an unprivileged private mount namespace, no VM or host contact. Initial free=29,331,456 B, remaining=12,288 B, retained copy=4,210,688 B. Real SQLite error=13 (SQLITE_FULL); restore error="Not enough disk space to copy the database before updating". Result: FAILED, 0 passed / 1 failed. Commit: 217daca96 on review-edge-autoupdate-r2 (pushed). No implementation fix. Raw receipt attached as disk-full-red.log.
kayg commented 2026-10-30 01:21:42 +00:00
Author
Owner
Copy link

EAR2-02 · P1 · specified dev merge is absent; committed logout can lose its revocation notification

Location: crates/infraternal-server/src/auth/sessions.rs:109-119, plus target ancestry.
Scenario: block logout behind a real SQLite writer, dispatch it, release the writer and observe the session deletion commit from a second connection; cancel the Rust caller before its acknowledgement. The notification is never published, so idle live browser/bootstrap sockets are not promptly told that authority changed. The new repair flow uses this old global notification path too.
Test: auth::tests::review_edge_revocation_tests::review_r2_missing_dev_committed_logout_keeps_revocation_wake (adapted from dev logout_commit_tests.rs). Result: FAILED, 0 passed / 1 failed, exact assertion "committed logout lost its notification when the waiter was cancelled".
Target 83db05b38 has merge base 07c5da77b with dev 8f88bf086. git log 07c5da77b..8f88bf086 lists the reviewed #240 account-notification, cancellation-retention and source-loss fixes; these are not integrated. The brief's statement that 8f88bf086 is merged is not true for this target. #255 external lockfile records and AsyncFd readiness source remain identical; this finding concerns #240.
Commit: 0a761350e on review-edge-autoupdate-r2. No implementation fix. Raw receipt logout-red.log attached.

EAR2-02 · P1 · specified dev merge is absent; committed logout can lose its revocation notification Location: crates/infraternal-server/src/auth/sessions.rs:109-119, plus target ancestry. Scenario: block logout behind a real SQLite writer, dispatch it, release the writer and observe the session deletion commit from a second connection; cancel the Rust caller before its acknowledgement. The notification is never published, so idle live browser/bootstrap sockets are not promptly told that authority changed. The new repair flow uses this old global notification path too. Test: auth::tests::review_edge_revocation_tests::review_r2_missing_dev_committed_logout_keeps_revocation_wake (adapted from dev logout_commit_tests.rs). Result: FAILED, 0 passed / 1 failed, exact assertion "committed logout lost its notification when the waiter was cancelled". Target 83db05b38 has merge base 07c5da77b with dev 8f88bf086. git log 07c5da77b..8f88bf086 lists the reviewed #240 account-notification, cancellation-retention and source-loss fixes; these are not integrated. The brief's statement that 8f88bf086 is merged is not true for this target. #255 external lockfile records and AsyncFd readiness source remain identical; this finding concerns #240. Commit: 0a761350e on review-edge-autoupdate-r2. No implementation fix. Raw receipt logout-red.log attached.
kayg commented 2026-10-30 01:22:32 +00:00
Author
Owner
Copy link

EAR2-03 · P2 · interrupted host selector permanently refuses subsequent updates

Location: crates/plugins/release/src/host_slots.rs:391-408 (Slots::select); host_watchdog.rs::recover_preselection does not retire current.lockstep.
Scenario: process stops after creating bin/current.lockstep but before renaming it to bin/current. The old selected binary remains usable. A newly constructed selector refuses every future update with AlreadyExists; receiver reconstruction/preselection recovery does not remove this orphan. There is no concurrent writer in the test. This leaves the host unable to return to server lockstep without manual filesystem cleanup.
Test: host_slots::tests::review_r2_interrupted_selector_does_not_permanently_stop_host_updates. Real filesystem writes and directory sync; no synthetic image executed. Result: FAILED, 0 passed / 1 failed, AlreadyExists (code 17).
Commit: 4e7352d33 on review-edge-autoupdate-r2. No implementation fix.

EAR2-03 · P2 · interrupted host selector permanently refuses subsequent updates Location: crates/plugins/release/src/host_slots.rs:391-408 (Slots::select); host_watchdog.rs::recover_preselection does not retire current.lockstep. Scenario: process stops after creating bin/current.lockstep but before renaming it to bin/current. The old selected binary remains usable. A newly constructed selector refuses every future update with AlreadyExists; receiver reconstruction/preselection recovery does not remove this orphan. There is no concurrent writer in the test. This leaves the host unable to return to server lockstep without manual filesystem cleanup. Test: host_slots::tests::review_r2_interrupted_selector_does_not_permanently_stop_host_updates. Real filesystem writes and directory sync; no synthetic image executed. Result: FAILED, 0 passed / 1 failed, AlreadyExists (code 17). Commit: 4e7352d33 on review-edge-autoupdate-r2. No implementation fix.
kayg commented 2026-10-30 01:26:09 +00:00
Author
Owner
Copy link

Review checkpoint at 8c14ef555 on review-edge-autoupdate-r2. All four logical commits pushed. Confirmed EAR2-01 P1 (disk-full offline restore), EAR2-02 P1 (#240 dev integration/logout publication) and EAR2-03 P2 (orphaned host selector). No implementation changes.

Reused prior WIP recovery checks: 5 passed / 0 failed / 1 ignored (the opt-in bounded filesystem test separately failed, as recorded). This includes four recovered interruption/pre-switch-data tests plus the existing backward-clock regression. Formatting and touched-server/release all-target Clippy pass; the recovered disk test needed only the lint-clean Cow::into_owned method reference.

Actual merge base with specified dev 8f88bf086 is 07c5da77b3. All external Cargo.lock package records are identical; expected workspace dependency edges differ. AsyncFd readiness, pinned compiler/linker wrappers and release profiles are identical. #255 is retained, #252 is in the actual merge base, and the later #240 integration is absent as EAR2-02 demonstrates. Source comparison receipt attached at final handoff.

Rebuilding ordinary production-trust merge-base controls sequentially for both architectures, then running final scripts/verify fast on the review head. No perf host, production host or test host contacted. Current runtime performance/warm proof remains the orchestrator's external step.

Review checkpoint at 8c14ef555 on review-edge-autoupdate-r2. All four logical commits pushed. Confirmed EAR2-01 P1 (disk-full offline restore), EAR2-02 P1 (#240 dev integration/logout publication) and EAR2-03 P2 (orphaned host selector). No implementation changes. Reused prior WIP recovery checks: 5 passed / 0 failed / 1 ignored (the opt-in bounded filesystem test separately failed, as recorded). This includes four recovered interruption/pre-switch-data tests plus the existing backward-clock regression. Formatting and touched-server/release all-target Clippy pass; the recovered disk test needed only the lint-clean Cow::into_owned method reference. Actual merge base with specified dev 8f88bf086 is 07c5da77b3e368d5cb97d9c47ea06fd3f807d975. All external Cargo.lock package records are identical; expected workspace dependency edges differ. AsyncFd readiness, pinned compiler/linker wrappers and release profiles are identical. #255 is retained, #252 is in the actual merge base, and the later #240 integration is absent as EAR2-02 demonstrates. Source comparison receipt attached at final handoff. Rebuilding ordinary production-trust merge-base controls sequentially for both architectures, then running final scripts/verify fast on the review head. No perf host, production host or test host contacted. Current runtime performance/warm proof remains the orchestrator's external step.
kayg commented 2026-10-30 01:27:38 +00:00
Author
Owner
Copy link

Current-target runtime proof remains an orchestrator step; this review contacts no host. Shipping Rust sources at 83db05b38 are identical to the prepared 8ca9575ea archive source (only docs/PROCESS.md, scripts/verify.d/rust.sh caps, and scripts/test-static-recipe.py changed).

Exact warm test: auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::review_warm_update_meets_local_reconnect_budget (128 live PTYs, one attached stream, signed manual handoff, CA remains unlocked, input/output continue, listener probes). Reuse the already prepared public archive e211-proof-8ca9575ea753.tar.xz, SHA-256 51fb06283fc8434af6733f2e6fc36ebb7244b27b25a2ef412c783609b3ea7c9c; copy/extract per the earlier #211 handoff. With the orchestrator's root/systemd authorization, exact on-VM command is:

sudo -n /usr/local/bin/perf-run.sh -- python3 /home/agent/infraternal-perf/e211-proof-8ca9575ea753/run-warm.py --on-perf-vm > /home/agent/infraternal-perf/e211-warm-review-r2.log 2>&1

Record exit status and attach the complete log. The archive runner owns only its transient fixture directory/services and has a bounded deadline. The earlier posted paired inventory run remains needed for #236 scale costs. These external results do not clear EAR2-01 or EAR2-02; their failing functional tests are already committed.

Current-target runtime proof remains an orchestrator step; this review contacts no host. Shipping Rust sources at 83db05b38 are identical to the prepared 8ca9575ea archive source (only docs/PROCESS.md, scripts/verify.d/rust.sh caps, and scripts/test-static-recipe.py changed). Exact warm test: auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::review_warm_update_meets_local_reconnect_budget (128 live PTYs, one attached stream, signed manual handoff, CA remains unlocked, input/output continue, listener probes). Reuse the already prepared public archive e211-proof-8ca9575ea753.tar.xz, SHA-256 51fb06283fc8434af6733f2e6fc36ebb7244b27b25a2ef412c783609b3ea7c9c; copy/extract per the earlier #211 handoff. With the orchestrator's root/systemd authorization, exact on-VM command is: ```sh sudo -n /usr/local/bin/perf-run.sh -- python3 /home/agent/infraternal-perf/e211-proof-8ca9575ea753/run-warm.py --on-perf-vm > /home/agent/infraternal-perf/e211-warm-review-r2.log 2>&1 ``` Record exit status and attach the complete log. The archive runner owns only its transient fixture directory/services and has a bounded deadline. The earlier posted paired inventory run remains needed for #236 scale costs. These external results do not clear EAR2-01 or EAR2-02; their failing functional tests are already committed.
kayg commented 2026-10-30 01:56:26 +00:00
Author
Owner
Copy link

Independent review size baseline completed on actual merge base 07c5da77b3 (against specified dev 8f88bf086): ordinary production-trust stripped static x86_64=21,400,400 B, aarch64=19,575,064 B. Both production-trust checks pass. Same shipping recipe, pinned toolchain and required target directory; architectures built sequentially through build-slot. Final scripts/verify fast now runs at pushed review head 8c14ef5558; deployment functional checks, formatting and CLI plugin compile-out have passed. Full transcript and fresh head size comparison will accompany final verdict. No additional findings or implementation changes.

Independent review size baseline completed on actual merge base 07c5da77b3e368d5cb97d9c47ea06fd3f807d975 (against specified dev 8f88bf086): ordinary production-trust stripped static x86_64=21,400,400 B, aarch64=19,575,064 B. Both production-trust checks pass. Same shipping recipe, pinned toolchain and required target directory; architectures built sequentially through build-slot. Final scripts/verify fast now runs at pushed review head 8c14ef5558084db24a18c989f5b008a374030f6b; deployment functional checks, formatting and CLI plugin compile-out have passed. Full transcript and fresh head size comparison will accompany final verdict. No additional findings or implementation changes.
kayg commented 2026-10-30 02:18:07 +00:00
Author
Owner
Copy link

Additional current-target runtime case remains pending; no VM contacted. The previously posted reconnect case returns after the healthy handoff (update_staging_tests.rs:690-693), so it does not qualify successor failure/recovery.

Exact existing full test: auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions. Use the same packaged public test executable/loader/libraries and signed A-E artifacts as the prepared archive above, with test arguments --ignored --exact auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions --nocapture. Keep INFRATERNAL_UPDATE_PROOF set, INFRATERNAL_STAGING_ACTIVE_STREAMS=1 (128 live PTYs retained), and unset INFRATERNAL_REVIEW_RECONNECT and INFRATERNAL_REVIEW_TRANSPORT. Retain the existing runner's owned short root, artifact environment, root/systemd isolation, deadline and cleanup; run only through perf-run.sh on the orchestrator's authorized VM.

Required assertions already in this test: signed update and explicit rollback; late exec refusal returns to the preceding version with CA unlocked and unchanged shim PIDs; successor E commits staging_upgrade_probe and then stops; predecessor is selected, Inbox says the update was undone, staging_upgrade_probe is absent, predecessor migrations run successfully, all shim PIDs survive, and the CA is locked after the process crash. This last crash boundary differs from the successful D217 in-memory handoff. Source: auth/update_staging_tests.rs:782-866. With the optional managed-host fixture, the same test also exercises a host's failed check-in.

Attach full output and exit status. This is pending runtime evidence, not a new confirmed finding or a VM pass. Existing EAR2-01/02/03 remain independently reproduced.

Additional current-target runtime case remains pending; no VM contacted. The previously posted reconnect case returns after the healthy handoff (update_staging_tests.rs:690-693), so it does not qualify successor failure/recovery. Exact existing full test: auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions. Use the same packaged public test executable/loader/libraries and signed A-E artifacts as the prepared archive above, with test arguments `--ignored --exact auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions --nocapture`. Keep INFRATERNAL_UPDATE_PROOF set, INFRATERNAL_STAGING_ACTIVE_STREAMS=1 (128 live PTYs retained), and unset INFRATERNAL_REVIEW_RECONNECT and INFRATERNAL_REVIEW_TRANSPORT. Retain the existing runner's owned short root, artifact environment, root/systemd isolation, deadline and cleanup; run only through perf-run.sh on the orchestrator's authorized VM. Required assertions already in this test: signed update and explicit rollback; late exec refusal returns to the preceding version with CA unlocked and unchanged shim PIDs; successor E commits staging_upgrade_probe and then stops; predecessor is selected, Inbox says the update was undone, staging_upgrade_probe is absent, predecessor migrations run successfully, all shim PIDs survive, and the CA is locked after the process crash. This last crash boundary differs from the successful D217 in-memory handoff. Source: auth/update_staging_tests.rs:782-866. With the optional managed-host fixture, the same test also exercises a host's failed check-in. Attach full output and exit status. This is pending runtime evidence, not a new confirmed finding or a VM pass. Existing EAR2-01/02/03 remain independently reproduced.
kayg commented 2026-10-30 02:31:50 +00:00
Author
Owner
Copy link

Independent review of target 83db05b380. Review branch review-edge-autoupdate-r2, pushed head 8c14ef5558. Verdict: do not merge. P0=0, P1=2, P2=1, P3=0. No implementation fixes.

Confirmed findings (all have committed failing tests; earlier comments carry raw failing receipts):

  • EAR2-01 / P1 / update_recovery.rs:330-336,528-541: candidate SQLite writes consume restore headroom; recovery refuses server startup with SQLITE_FULL. Test review_d295_candidate_disk_full_still_restores_the_admitted_copy. Private 32 MiB mount: admission free 29,331,456 B; recovery free 12,288 B; retained database 4,210,688 B. Commit 217daca96.
  • EAR2-02 / P1 / auth/sessions.rs:109-119: a committed logout loses the revocation wake when its Rust waiter is cancelled. Test review_r2_missing_dev_committed_logout_keeps_revocation_wake; independently observes the DELETE commit before cancellation. Commit 0a761350e. Actual merge base with specified dev 8f88bf086 is 07c5da77b3; the later #240 changes are absent.
  • EAR2-03 / P2 / release/src/host_slots.rs:413-418: process stop before selector rename leaves current.lockstep; a fresh selector refuses every later update with AlreadyExists. Old image stays runnable. Test review_r2_interrupted_selector_does_not_permanently_stop_host_updates. Commit 4e7352d33.
    These line references correct the approximate ranges in the initial EAR2-01/EAR2-03 comments.

Prior WIP b1555e44f: reused the valid bounded-filesystem failure test and four recovery checks. Focused recovery checks: 5 passed, 0 failed, 1 ignored; opt-in bounded-filesystem check explicitly run and failed separately. Review head changes only four test files (+285 lines), no shipping code.

Source checks: external Cargo.lock package records, AsyncFd readiness.rs, compiler/linker wrappers and release profiles match specified dev; local workspace dependency edges differ as expected. #255 and #252 remain; #240 does not. Signed manifest/channel/version checks, explicit rollback admission, bounded download/slot paths, repair owner/host/route/UID checks, live session authorization and reservations were inspected. No additional confirmed finding in these paths. Receiver capability requires both remote and release; runtime-disabled receiver retains discoverability for truthful Off reporting.

Limits: no perf, production or test host contacted. Healthy warm-handoff/CA/D217, full successor-failure recovery, and current full-scale inventory runtime measurements remain pending the orchestrator's exact VM commands already posted above; this review does not claim a runtime performance pass. UI screenshots previously attached on #236 were not independently judged for visual quality here.

Largest contributors: prior symbol attribution on #211 (earlier updater source, not a new attribution of this head) reports updater ~62 KB, release_update ~50 KB, CLI dispatch ~41 KB, restart control ~35 KB, websocket router ~35 KB, release_startup ~29 KB, update_recovery ~26 KB, host_receiver ~20 KB, service ~18 KB, host_slots ~14 KB, host catalog ~11 KB, unwind tables ~46 KB. No new external registry package versions or release-profile changes. Fresh exact stripped totals follow below.

Fresh same-recipe production-trust stripped review-head sizes (baseline is actual merge base 07c5da77b):

Architecture Baseline B Review head B Growth B
x86_64-unknown-linux-musl 21,400,400 22,084,392 +683,992
aarch64-unknown-linux-musl 19,575,064 20,185,024 +609,960

Both review artifacts are 88 B below the target sizes/caps stated in the brief (22,084,480 / 20,185,112 B). No shipping source change was made; cause of this small artifact difference is not isolated. Do not attribute the exact-cap refusal to target 83db05b38: this is the required gate on the test-only review head. Caps were not changed, and the gate remains failed. Both artifacts pass production trust/static linkage; x86 native protected-key memory passes; ARM protected-key runtime is not checked on this x86 build host. Growth stays within the brief's stated total envelope. The earlier issue's separate updater-only +635,928/+564,584 B and legacy +48,152/+45,464 B controls were not independently rebuilt in this review.

Fresh largest ELF section growth (x86 / ARM B): .text +539,490/+463,736; .eh_frame +46,184/+49,560; .gcc_except_table +44,320/+47,684; .rodata +33,568/+26,896; .data.rel.ro +13,824/+13,936. Full per-section data and artifact hashes attached. These are direct ELF measurements, unlike the earlier module attribution above.

Final verification: scripts/verify fast exits 1. Workspace test failure is the committed EAR2-03 regression (53 passed, 1 failed, 2 ignored in release); the workspace command stops there, so EAR2-02's standalone failing receipt remains separate. Static builds fail the exact-size ratchet at -88 B on each architecture, including the boundary-fixture assertion. Other Rust rows pass. No cap changed, failed test waived, or implementation fixed.

Separate TypeScript gate: exit 0 (the top-level fast dispatcher stops after Rust failure). Focused server --features remote bootstrap tests: 69 unit passed, 0 failed, 3 ignored, plus 2 integration passed, 0 failed. This includes foreign-owner/changed-route/mode/capable-host refusal, UID mismatch, predecessor-route refusal, concurrent removal, origin/owner/unlock/consent, and retained setup logout/replay checks.

scripts/verify fast final output, verbatim (full stdout/stderr transcript attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+
scripts/verify fast exit: 1

Evidence:
final-fast.log
final-ts.log
baseline-build.log
source-comparison.json
final-sizes.json
reused-recovery.log
final-bootstrap.log

Failing receipts already posted: EAR2-01 disk-full, EAR2-02 committed logout, EAR2-03 selector.

Cleanup: required target directory deleted; temporary baseline worktree removed; owned short/initial fixture roots and empty SSH fallback parent removed. No owned executable remained before cleanup. Requested review worktree/branch and external logs/artifacts retained. Branch is clean and pushed; no other branch pushed, host contacted, implementation changed, deployment performed or issue closed.

Independent review of target 83db05b38096ca48a398344138fc2bb012109ee8. Review branch review-edge-autoupdate-r2, pushed head 8c14ef5558084db24a18c989f5b008a374030f6b. Verdict: do not merge. P0=0, P1=2, P2=1, P3=0. No implementation fixes. Confirmed findings (all have committed failing tests; earlier comments carry raw failing receipts): - EAR2-01 / P1 / update_recovery.rs:330-336,528-541: candidate SQLite writes consume restore headroom; recovery refuses server startup with SQLITE_FULL. Test review_d295_candidate_disk_full_still_restores_the_admitted_copy. Private 32 MiB mount: admission free 29,331,456 B; recovery free 12,288 B; retained database 4,210,688 B. Commit 217daca96. - EAR2-02 / P1 / auth/sessions.rs:109-119: a committed logout loses the revocation wake when its Rust waiter is cancelled. Test review_r2_missing_dev_committed_logout_keeps_revocation_wake; independently observes the DELETE commit before cancellation. Commit 0a761350e. Actual merge base with specified dev 8f88bf086 is 07c5da77b3e368d5cb97d9c47ea06fd3f807d975; the later #240 changes are absent. - EAR2-03 / P2 / release/src/host_slots.rs:413-418: process stop before selector rename leaves current.lockstep; a fresh selector refuses every later update with AlreadyExists. Old image stays runnable. Test review_r2_interrupted_selector_does_not_permanently_stop_host_updates. Commit 4e7352d33. These line references correct the approximate ranges in the initial EAR2-01/EAR2-03 comments. Prior WIP b1555e44f: reused the valid bounded-filesystem failure test and four recovery checks. Focused recovery checks: 5 passed, 0 failed, 1 ignored; opt-in bounded-filesystem check explicitly run and failed separately. Review head changes only four test files (+285 lines), no shipping code. Source checks: external Cargo.lock package records, AsyncFd readiness.rs, compiler/linker wrappers and release profiles match specified dev; local workspace dependency edges differ as expected. #255 and #252 remain; #240 does not. Signed manifest/channel/version checks, explicit rollback admission, bounded download/slot paths, repair owner/host/route/UID checks, live session authorization and reservations were inspected. No additional confirmed finding in these paths. Receiver capability requires both remote and release; runtime-disabled receiver retains discoverability for truthful Off reporting. Limits: no perf, production or test host contacted. Healthy warm-handoff/CA/D217, full successor-failure recovery, and current full-scale inventory runtime measurements remain pending the orchestrator's exact VM commands already posted above; this review does not claim a runtime performance pass. UI screenshots previously attached on #236 were not independently judged for visual quality here. Largest contributors: prior symbol attribution on #211 (earlier updater source, not a new attribution of this head) reports updater ~62 KB, release_update ~50 KB, CLI dispatch ~41 KB, restart control ~35 KB, websocket router ~35 KB, release_startup ~29 KB, update_recovery ~26 KB, host_receiver ~20 KB, service ~18 KB, host_slots ~14 KB, host catalog ~11 KB, unwind tables ~46 KB. No new external registry package versions or release-profile changes. Fresh exact stripped totals follow below. Fresh same-recipe production-trust stripped review-head sizes (baseline is actual merge base 07c5da77b): | Architecture | Baseline B | Review head B | Growth B | | --- | ---: | ---: | ---: | | x86_64-unknown-linux-musl | 21,400,400 | 22,084,392 | +683,992 | | aarch64-unknown-linux-musl | 19,575,064 | 20,185,024 | +609,960 | Both review artifacts are 88 B below the target sizes/caps stated in the brief (22,084,480 / 20,185,112 B). No shipping source change was made; cause of this small artifact difference is not isolated. Do not attribute the exact-cap refusal to target 83db05b38: this is the required gate on the test-only review head. Caps were not changed, and the gate remains failed. Both artifacts pass production trust/static linkage; x86 native protected-key memory passes; ARM protected-key runtime is not checked on this x86 build host. Growth stays within the brief's stated total envelope. The earlier issue's separate updater-only +635,928/+564,584 B and legacy +48,152/+45,464 B controls were not independently rebuilt in this review. Fresh largest ELF section growth (x86 / ARM B): .text +539,490/+463,736; .eh_frame +46,184/+49,560; .gcc_except_table +44,320/+47,684; .rodata +33,568/+26,896; .data.rel.ro +13,824/+13,936. Full per-section data and artifact hashes attached. These are direct ELF measurements, unlike the earlier module attribution above. Final verification: scripts/verify fast exits 1. Workspace test failure is the committed EAR2-03 regression (53 passed, 1 failed, 2 ignored in release); the workspace command stops there, so EAR2-02's standalone failing receipt remains separate. Static builds fail the exact-size ratchet at -88 B on each architecture, including the boundary-fixture assertion. Other Rust rows pass. No cap changed, failed test waived, or implementation fixed. Separate TypeScript gate: exit 0 (the top-level fast dispatcher stops after Rust failure). Focused server --features remote bootstrap tests: 69 unit passed, 0 failed, 3 ignored, plus 2 integration passed, 0 failed. This includes foreign-owner/changed-route/mode/capable-host refusal, UID mismatch, predecessor-route refusal, concurrent removal, origin/owner/unlock/consent, and retained setup logout/replay checks. scripts/verify fast final output, verbatim (full stdout/stderr transcript attached): ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ scripts/verify fast exit: 1 ``` Evidence: [final-fast.log](https://git.kayg.org/attachments/0e6818c4-5d59-4efa-8110-7cb3ab1822c9) [final-ts.log](https://git.kayg.org/attachments/892d3caf-b912-4501-af0f-8f0fe82613ef) [baseline-build.log](https://git.kayg.org/attachments/636d3ac1-f005-4954-89f2-b9cd28bb9c6e) [source-comparison.json](https://git.kayg.org/attachments/299f9856-3e1f-4184-906f-574e3f17880e) [final-sizes.json](https://git.kayg.org/attachments/a476b96f-8cfd-4c2c-874c-3a69dd7dbcfb) [reused-recovery.log](https://git.kayg.org/attachments/9c347a39-a567-4075-a3c4-024336d7e41c) [final-bootstrap.log](https://git.kayg.org/attachments/9cbbeafd-5563-459a-b389-569a8bac0411) Failing receipts already posted: [EAR2-01 disk-full](https://git.kayg.org/attachments/a63df1f9-c108-4629-add5-22692f92f950), [EAR2-02 committed logout](https://git.kayg.org/attachments/19517c0e-11bf-45df-90d6-55f82f96d53d), [EAR2-03 selector](https://git.kayg.org/attachments/fab7bdeb-5cb7-4e98-ad93-a7a1e7700eda). Cleanup: required target directory deleted; temporary baseline worktree removed; owned short/initial fixture roots and empty SSH fallback parent removed. No owned executable remained before cleanup. Requested review worktree/branch and external logs/artifacts retained. Branch is clean and pushed; no other branch pushed, host contacted, implementation changed, deployment performed or issue closed.
kayg commented 2026-10-30 02:33:25 +00:00
Author
Owner
Copy link

Implementation fix round started on edge-autoupdate-r2, base 83db05b380; merged review-edge-autoupdate-r2 8c14ef5558 and its committed EAR2-01/02/03 regressions. Worktree moved from the clean previous job path to ~/wt-infraternal/edge-autoupdate-fix because the requested branch was already checked out there. Read the do-not-merge verdict and evidence. Will restore #240 by carefully merging origin/dev, repair disk-full recovery and interrupted selection, rerun #240 five times, remeasure exact static ceilings and run final fast. No external host contact or deployment; runtime VM proofs remain with orchestrator.

Implementation fix round started on edge-autoupdate-r2, base 83db05b38096ca48a398344138fc2bb012109ee8; merged review-edge-autoupdate-r2 8c14ef5558084db24a18c989f5b008a374030f6b and its committed EAR2-01/02/03 regressions. Worktree moved from the clean previous job path to ~/wt-infraternal/edge-autoupdate-fix because the requested branch was already checked out there. Read the do-not-merge verdict and evidence. Will restore #240 by carefully merging origin/dev, repair disk-full recovery and interrupted selection, rerun #240 five times, remeasure exact static ceilings and run final fast. No external host contact or deployment; runtime VM proofs remain with orchestrator.
kayg commented 2026-10-30 02:38:47 +00:00
Author
Owner
Copy link

EAR2-02 merge audit: origin/dev is 8f88bf086. Conflicts are auth/tests.rs, bootstrap_api_tests.rs, docs/PROCESS.md and scripts/verify.d/rust.sh; independent tests retained from both sides, existing candidate caps retained pending fresh measurement. Review logout test changes only revocation_events() to revocation_events(&f.user), preserving the commit/cancellation assertion. All production #240 additions are present. sessions.rs, account_events.rs, committed.rs, recovery.rs, recovery_rotation.rs, webauthn.rs, source-loss tests and proof-authority code are identical to dev. Remaining auth/WebSocket differences are existing update/private-action hooks and writer reservation. No #240 production line manually resolved. Compilation and five reviewer-union repetitions are next.

EAR2-02 merge audit: origin/dev is 8f88bf086. Conflicts are auth/tests.rs, bootstrap_api_tests.rs, docs/PROCESS.md and scripts/verify.d/rust.sh; independent tests retained from both sides, existing candidate caps retained pending fresh measurement. Review logout test changes only revocation_events() to revocation_events(&f.user), preserving the commit/cancellation assertion. All production #240 additions are present. sessions.rs, account_events.rs, committed.rs, recovery.rs, recovery_rotation.rs, webauthn.rs, source-loss tests and proof-authority code are identical to dev. Remaining auth/WebSocket differences are existing update/private-action hooks and writer reservation. No #240 production line manually resolved. Compilation and five reviewer-union repetitions are next.
kayg commented 2026-10-30 02:40:34 +00:00
Author
Owner
Copy link

EAR2-01 freshly reproduced on the dev-merged tree before recovery changes, in an isolated unprivileged 32 MiB tmpfs. Initial free 29,331,456 B; remaining 12,288 B; retained preimage 4,210,688 B; SQLITE_FULL causes predecessor restore refusal (0 passed, 1 failed). The copy is valid; allocation of a third database image while keeping failed live data causes the startup failure. No shared filesystem filled and no external host contacted. #240 source audit also attached.

disk-full-red.log
dev-auth-audit.json

EAR2-01 freshly reproduced on the dev-merged tree before recovery changes, in an isolated unprivileged 32 MiB tmpfs. Initial free 29,331,456 B; remaining 12,288 B; retained preimage 4,210,688 B; SQLITE_FULL causes predecessor restore refusal (0 passed, 1 failed). The copy is valid; allocation of a third database image while keeping failed live data causes the startup failure. No shared filesystem filled and no external host contacted. #240 source audit also attached. [disk-full-red.log](https://git.kayg.org/attachments/542caa7d-d990-4d1e-b95a-d70533557722) [dev-auth-audit.json](https://git.kayg.org/attachments/cb7b54cb-2813-45a2-ab47-5c96a04db648)
kayg commented 2026-10-30 02:47:16 +00:00
Author
Owner
Copy link

EAR2-02 committed and pushed in 2a4bf9f0a1: carefully merged dev 8f88bf086, preserving every #240 production addition. Conflicts and their resolutions are recorded in the merge body. Five consecutive complete #240 reviewer-union repetitions pass: 52 passed, 0 failed, 1 perf-only ignored each. Includes EAR2-02 committed logout, both 256-socket/61-account isolation cases, cancelled/refused commits, restored sources, busy-store handling and shared 1013 source-loss teardown. No assertion/deadline weakened, no load exception. Fmt, whitespace and remote+mesh all-target server Clippy pass.

union-sequence.log

EAR2-02 committed and pushed in 2a4bf9f0a182316a57ab6e4ad32d5f31aecbcd21: carefully merged dev 8f88bf086, preserving every #240 production addition. Conflicts and their resolutions are recorded in the merge body. Five consecutive complete #240 reviewer-union repetitions pass: 52 passed, 0 failed, 1 perf-only ignored each. Includes EAR2-02 committed logout, both 256-socket/61-account isolation cases, cancelled/refused commits, restored sources, busy-store handling and shared 1013 source-loss teardown. No assertion/deadline weakened, no load exception. Fmt, whitespace and remote+mesh all-target server Clippy pass. [union-sequence.log](https://git.kayg.org/attachments/99645b4d-e23b-4c02-8dae-2343a57b7bb7)
kayg commented 2026-10-30 03:01:30 +00:00
Author
Owner
Copy link

Fresh comparison controls on exact dev 8f88bf086, same pinned static recipe and one target at a time: x86_64 21,420,592 B, aarch64 19,592,504 B; production trust and static linkage pass. These match dev records. EAR2-03 freshly reproduced before its fix: AlreadyExists (0 passed, 1 failed). The added live-writer test also fails for missing kernel exclusion before the fix; after fixture permissions were corrected it reports AlreadyExists instead of WouldBlock. Seven slot tests pass with the candidate fix. Complete recovery/release tests and all-target Clippy are running before atomic commits. #240 runner and Clippy attachments omitted by the first rejected .sh upload are also supplied below as .txt/log.

baseline-build.log
selector-red.log
selector-lock-red.log
run-union.txt
merge-clippy.log

Fresh comparison controls on exact dev 8f88bf086, same pinned static recipe and one target at a time: x86_64 21,420,592 B, aarch64 19,592,504 B; production trust and static linkage pass. These match dev records. EAR2-03 freshly reproduced before its fix: AlreadyExists (0 passed, 1 failed). The added live-writer test also fails for missing kernel exclusion before the fix; after fixture permissions were corrected it reports AlreadyExists instead of WouldBlock. Seven slot tests pass with the candidate fix. Complete recovery/release tests and all-target Clippy are running before atomic commits. #240 runner and Clippy attachments omitted by the first rejected .sh upload are also supplied below as .txt/log. [baseline-build.log](https://git.kayg.org/attachments/4c835ea2-05ca-480f-90e7-b886747a46f7) [selector-red.log](https://git.kayg.org/attachments/627a50d7-30c5-4d4f-a2f3-8ebcee4c4c9c) [selector-lock-red.log](https://git.kayg.org/attachments/943707f8-0296-41ac-ad15-71625dd1df54) [run-union.txt](https://git.kayg.org/attachments/ebcbb61e-822b-4f4a-999f-f8d1d80c660d) [merge-clippy.log](https://git.kayg.org/attachments/b58abcc2-79e2-440b-b6cc-cbe92ce1a4c0)
kayg commented 2026-10-30 03:03:09 +00:00
Author
Owner
Copy link

Pushed atomic fixes: 5a4bca715 (EAR2-01) verifies the saved copy, reclaims failed live SQLite storage before replacement, retains preimage/armed marker across interruptions, and repairs stable selection after freeing space. Recovery suite: 30 passed, 0 failed, 2 ignored (disk case and VM-only measurement); isolated 32 MiB disk case run explicitly: 1 passed, 0 failed, same initial 29,331,456 B / remaining 12,288 B / preimage 4,210,688 B as the red run. Earlier D295 clock and retained-copy tests pass.

c37f8ce75 (EAR2-03) uses a kernel-released directory lock, retires only owned abandoned temporary symlinks, and refuses live writers/unexpected objects. Release suite: 56 unit passed, 0 failed, 2 ignored; integrations 1 passed plus 2 passed/2 ignored. Original review regression and new writer-exclusion/reselection/file-preservation checks pass. Both touched crates pass all-target Clippy, formatting and whitespace checks. No new dependency/feature/profile or runtime worker. Exact static measurements and final fast remain pending; no VM/runtime claim.

recovery-green.log
disk-full-green.log
recovery-clippy.log
release-green.log
release-clippy.log

Pushed atomic fixes: 5a4bca715 (EAR2-01) verifies the saved copy, reclaims failed live SQLite storage before replacement, retains preimage/armed marker across interruptions, and repairs stable selection after freeing space. Recovery suite: 30 passed, 0 failed, 2 ignored (disk case and VM-only measurement); isolated 32 MiB disk case run explicitly: 1 passed, 0 failed, same initial 29,331,456 B / remaining 12,288 B / preimage 4,210,688 B as the red run. Earlier D295 clock and retained-copy tests pass. c37f8ce75 (EAR2-03) uses a kernel-released directory lock, retires only owned abandoned temporary symlinks, and refuses live writers/unexpected objects. Release suite: 56 unit passed, 0 failed, 2 ignored; integrations 1 passed plus 2 passed/2 ignored. Original review regression and new writer-exclusion/reselection/file-preservation checks pass. Both touched crates pass all-target Clippy, formatting and whitespace checks. No new dependency/feature/profile or runtime worker. Exact static measurements and final fast remain pending; no VM/runtime claim. [recovery-green.log](https://git.kayg.org/attachments/8a0479ae-9d49-4140-ad22-89eaccdb9cb0) [disk-full-green.log](https://git.kayg.org/attachments/94a4e33d-6797-42e1-be68-115db66ef97e) [recovery-clippy.log](https://git.kayg.org/attachments/06ad8133-f6f0-42d3-ae08-af68d5b05b3b) [release-green.log](https://git.kayg.org/attachments/04b4a473-9074-488c-9e10-2217af46fc0d) [release-clippy.log](https://git.kayg.org/attachments/3e00dcbf-1588-4d64-8cb7-b2d0874c5392)
kayg commented 2026-10-30 03:16:40 +00:00
Author
Owner
Copy link

First repaired static measurement at c37f8ce75: x86_64 22,100,808 B versus dev 21,420,592 B = +680,216 B (3,864 below earlier +684,080 envelope); ARM 20,204,128 B versus dev 19,592,504 B = +611,624 B (1,576 above earlier +610,048 envelope). Both production-trust/static checks pass. No cap changed. Trimming the offline EAR2-01 restore path before recording exact caps: the retained preimage and armed marker make a second temporary replacement/rename unnecessary once the failed main file is discarded; startup can repeat a partial main write safely. Keep validation before reclamation, and re-run all recovery/disk-full tests, Clippy and both pinned static builds. No dependency/profile changes or host contact.

First repaired static measurement at c37f8ce75: x86_64 22,100,808 B versus dev 21,420,592 B = +680,216 B (3,864 below earlier +684,080 envelope); ARM 20,204,128 B versus dev 19,592,504 B = +611,624 B (1,576 above earlier +610,048 envelope). Both production-trust/static checks pass. No cap changed. Trimming the offline EAR2-01 restore path before recording exact caps: the retained preimage and armed marker make a second temporary replacement/rename unnecessary once the failed main file is discarded; startup can repeat a partial main write safely. Keep validation before reclamation, and re-run all recovery/disk-full tests, Clippy and both pinned static builds. No dependency/profile changes or host contact.
kayg commented 2026-10-30 03:19:21 +00:00
Author
Owner
Copy link

Pushed efed7d9e0: EAR2-01 offline restoration writes the new main file directly under the armed transaction marker, retaining the validated preimage and admission barrier. No extra temporary rename or resources retained across later writer-floor awaits. Added partial-main interruption coverage. Revalidation: recovery 30 passed/0 failed/2 ignored; isolated disk-full 1 passed/0 failed; all-target server Clippy/fmt pass. First over-envelope ARM measurement is attached, not hidden or admitted by a cap change. Fresh ARM measurement is running first; both final architectures will be measured before caps/final fast. No profile/dependency change or host contact.

candidate-before-trim.log
recovery-green.log
disk-full-green.log
recovery-clippy.log

Pushed efed7d9e0: EAR2-01 offline restoration writes the new main file directly under the armed transaction marker, retaining the validated preimage and admission barrier. No extra temporary rename or resources retained across later writer-floor awaits. Added partial-main interruption coverage. Revalidation: recovery 30 passed/0 failed/2 ignored; isolated disk-full 1 passed/0 failed; all-target server Clippy/fmt pass. First over-envelope ARM measurement is attached, not hidden or admitted by a cap change. Fresh ARM measurement is running first; both final architectures will be measured before caps/final fast. No profile/dependency change or host contact. [candidate-before-trim.log](https://git.kayg.org/attachments/e6ecd961-d0a7-4293-ab9f-2a462636500f) [recovery-green.log](https://git.kayg.org/attachments/fe43f2da-de8d-425b-bb7f-b3b1a4765d27) [disk-full-green.log](https://git.kayg.org/attachments/b4920014-9b7e-40a0-ba21-e8dc8c2e7dcc) [recovery-clippy.log](https://git.kayg.org/attachments/6fb87ed1-55ce-4ce2-93fd-36dfd4fa55f1)
kayg commented 2026-10-30 03:28:18 +00:00
Author
Owner
Copy link

Pushed 8817fe61e: shared EAR2-01 restore future via existing Operation type. ARM 20,199,808 B, +607,304 B versus dev 8f88bf086, 2,744 B below the prior +610,048 envelope. Sharing saves 3,936 B versus the direct-write-only control; the first repair was 20,204,128 B. No cap changed yet. Tradeoff: one allocation during rare offline restoration, no per-session/serving-path allocation. No dependency/profile/feature changes. Validation stays intact; recovery 30/0, isolated disk-full 1/0, fmt and all-target server Clippy pass. Production trust passes. Final x86 measurement is running before exact-cap commit and final fast. No runtime performance claim or host contact.

arm-shared-build.log
recovery-green.log
disk-full-green.log
recovery-clippy.log

Pushed 8817fe61e: shared EAR2-01 restore future via existing Operation type. ARM 20,199,808 B, +607,304 B versus dev 8f88bf086, 2,744 B below the prior +610,048 envelope. Sharing saves 3,936 B versus the direct-write-only control; the first repair was 20,204,128 B. No cap changed yet. Tradeoff: one allocation during rare offline restoration, no per-session/serving-path allocation. No dependency/profile/feature changes. Validation stays intact; recovery 30/0, isolated disk-full 1/0, fmt and all-target server Clippy pass. Production trust passes. Final x86 measurement is running before exact-cap commit and final fast. No runtime performance claim or host contact. [arm-shared-build.log](https://git.kayg.org/attachments/f4b37a9a-48de-45f6-86ef-3e80eeff159b) [recovery-green.log](https://git.kayg.org/attachments/2ff70e0f-40d4-45cf-b4f0-44f684bdaa57) [disk-full-green.log](https://git.kayg.org/attachments/ab3f369a-40f0-4a72-b3d5-be7b61d04530) [recovery-clippy.log](https://git.kayg.org/attachments/9500feb7-27f3-4f24-ad6e-fca30c1a7996)
kayg commented 2026-10-30 03:34:41 +00:00
Author
Owner
Copy link

Exact-size commit 31053e59b1 is pushed to edge-autoupdate-r2. Final shipping Rust source is 8817fe61e; the head changes only measured ceilings and their process documentation.

Pinned production-trust static recipe, sequential targets: x86_64 22,096,232 B (+675,640 against dev 8f88bf086); aarch64 20,199,808 B (+607,304). These reduce the earlier complete growth envelope by 8,440 / 2,744 B. Both caps equal the images exactly, with no allowance. Exact, +1, -1 and unsupported-target boundary checks pass; pinned recipe checks pass. No dependency, feature or release-profile changes.

Final scripts/verify fast is running on the pushed head through build-slot. Runtime VM proofs remain owed by the orchestrator; no perf or production host contacted.

final-size-comparison.json
cap-boundaries.log
static-recipe-tests.log
exact-static-gates.log
author-review.txt

Exact-size commit 31053e59b1406496e4f680e1701b3a92f6266840 is pushed to edge-autoupdate-r2. Final shipping Rust source is 8817fe61e; the head changes only measured ceilings and their process documentation. Pinned production-trust static recipe, sequential targets: x86_64 22,096,232 B (+675,640 against dev 8f88bf086); aarch64 20,199,808 B (+607,304). These reduce the earlier complete growth envelope by 8,440 / 2,744 B. Both caps equal the images exactly, with no allowance. Exact, +1, -1 and unsupported-target boundary checks pass; pinned recipe checks pass. No dependency, feature or release-profile changes. Final scripts/verify fast is running on the pushed head through build-slot. Runtime VM proofs remain owed by the orchestrator; no perf or production host contacted. [final-size-comparison.json](https://git.kayg.org/attachments/c3c632f5-cb6d-4564-8682-f7e15a9920e0) [cap-boundaries.log](https://git.kayg.org/attachments/4fea5dcd-ebf0-4df5-91ec-71435809fedb) [static-recipe-tests.log](https://git.kayg.org/attachments/d6721da3-1f6d-41fe-b145-4109c5c217b6) [exact-static-gates.log](https://git.kayg.org/attachments/ae220104-648e-4f38-a837-900a660ee4a9) [author-review.txt](https://git.kayg.org/attachments/6012b9db-eeec-49e0-95bc-133802484334)
kayg commented 2026-10-30 03:51:49 +00:00
Author
Owner
Copy link

Final-head gate first attempt exits 1: every Rust row passes except workspace test. Server has 752 passed / 1 failed / 59 ignored. Failure: websocket::writer_tests::authority_watchdog::cap_review_r3::sqlite_busy_timeout_recovers_detached_storm_without_unlocking, websocket_authority_tests.rs:526: pool.size() - pool.num_idle() observed 5, expected 4; the immediately preceding started-read count of 4 passed. EAR2-02 committed-logout and EAR2-03 selector reviews, plus earlier D295 reviews, pass. The separate bounded-filesystem EAR2-01 case passes.

The failing test body is identical to dev 8f88bf086. A detached-dev comparison of this test is now running through build-slot in the same shared-host window, under the #118 timeout-comparison rule; no assertion or test deadline changed. This is not yet attributed or waived. Both static gates pass exact caps, production trust and linkage; final candidate artifact copies retain the measured hashes. TypeScript is not reached when Rust fails. Full first transcript:

final-fast-first.log

Final-head gate first attempt exits 1: every Rust row passes except workspace test. Server has 752 passed / 1 failed / 59 ignored. Failure: websocket::writer_tests::authority_watchdog::cap_review_r3::sqlite_busy_timeout_recovers_detached_storm_without_unlocking, websocket_authority_tests.rs:526: pool.size() - pool.num_idle() observed 5, expected 4; the immediately preceding started-read count of 4 passed. EAR2-02 committed-logout and EAR2-03 selector reviews, plus earlier D295 reviews, pass. The separate bounded-filesystem EAR2-01 case passes. The failing test body is identical to dev 8f88bf086. A detached-dev comparison of this test is now running through build-slot in the same shared-host window, under the #118 timeout-comparison rule; no assertion or test deadline changed. This is not yet attributed or waived. Both static gates pass exact caps, production trust and linkage; final candidate artifact copies retain the measured hashes. TypeScript is not reached when Rust fails. Full first transcript: [final-fast-first.log](https://git.kayg.org/attachments/bcfae1bd-8340-4a1d-95e5-66f8684cca25)
kayg commented 2026-10-30 03:54:33 +00:00
Author
Owner
Copy link

Detached dev 8f88bf086 comparison of the exact watchdog case passes (1 passed / 0 failed, exit 0). Therefore no #118 baseline-failure waiver is claimed. The failed head run remains recorded; no assertion/deadline/code changed. A fresh full scripts/verify fast run is now started on unchanged pushed head 31053e59b through build-slot.

baseline-watchdog.log

Detached dev 8f88bf086 comparison of the exact watchdog case passes (1 passed / 0 failed, exit 0). Therefore no #118 baseline-failure waiver is claimed. The failed head run remains recorded; no assertion/deadline/code changed. A fresh full scripts/verify fast run is now started on unchanged pushed head 31053e59b through build-slot. [baseline-watchdog.log](https://git.kayg.org/attachments/d605f138-2f0b-4cbb-87aa-1a56ac3e663c)
kayg commented 2026-10-30 03:56:41 +00:00
Author
Owner
Copy link

The next full attempt exposed native Cargo target reuse between the detached-dev comparison and candidate: native builds resolved a dev infraternal-protocol artifact lacking the candidate machine module/Frame::Machine, despite both being present in candidate source. Static builds still pass and retain the exact recorded hashes. This attempt is failed, not waived. Clearing only this job target's dev-profile workspace packages (keeping registry dependency artifacts) and rebuilding the final gate on unchanged head; no repository change. Full failed transcript:

final-fast-cache-collision.log

The next full attempt exposed native Cargo target reuse between the detached-dev comparison and candidate: native builds resolved a dev infraternal-protocol artifact lacking the candidate machine module/Frame::Machine, despite both being present in candidate source. Static builds still pass and retain the exact recorded hashes. This attempt is failed, not waived. Clearing only this job target's dev-profile workspace packages (keeping registry dependency artifacts) and rebuilding the final gate on unchanged head; no repository change. Full failed transcript: [final-fast-cache-collision.log](https://git.kayg.org/attachments/6150f009-f475-42df-9143-4ec56b36cd0e)
kayg commented 2026-10-30 04:13:02 +00:00
Author
Owner
Copy link

Implementation finished and pushed: edge-autoupdate-r2, head 31053e59b1. Worktree clean; issues left open.

  • EAR2-01: validate retained SQLite preimage, reclaim failed main/journals before restore, and retain the armed restart boundary through interruption. Disk-full regression passes on the reviewer's 32 MiB fixture (12,288 B free, 4,210,688 B retained copy). Recovery suite 30 passed / 0 failed / 2 ignored; disk-full case explicitly run separately: 1 passed / 0 failed. Earlier D295 review tests, including backward-clock and repeated restore, remain passing.
  • EAR2-02: merged dev 8f88bf086 in 2a4bf9f0a. Merge commit records conflicted files and resolutions. Dev auth/WebSocket additions audited with no missing #240 lines; production commit-publication/account-events modules remain identical. Five reviewer-union repetitions: each 52 passed / 0 failed / 1 perf-only ignored. Final workspace server suite: 753 passed / 0 failed / 59 ignored.
  • EAR2-03: orphan selector symlink recovery under the existing directory's kernel lock; live writer excluded, unexpected files preserved. Release unit suite: 56 passed / 0 failed / 2 ignored, including all seven host-slot tests and the original review case.

Pinned static images, one architecture at a time, production trust/static linkage pass. Exact caps with zero allowance: x86_64 22,096,232 B and aarch64 20,199,808 B. Against fresh dev controls: +675,640 / +607,304 B, below the previous complete envelope by 8,440 / 2,744 B. No new dependencies, features or release-profile changes. Final images preserved outside the target at ~/.cache/codex-scratch/edge-autoupdate-fix/artifacts/candidate-{x86_64,aarch64}-unknown-linux-musl; hashes attached.

Final scripts/verify fast on this head exits 0, including TypeScript. Earlier watchdog pool-count failure, passing detached-dev diagnostic, and subsequent native target-reuse failure remain recorded above. After clearing native workspace artifacts, the unchanged watchdog test and full gate pass; no assertion/deadline changed and no baseline-failure waiver claimed.

Verbatim final gate summary and final TypeScript test output (complete unedited stdout/stderr attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+
 39 pass
 0 fail
 36135 expect() calls
Ran 39 tests across 10 files. [2.00s]
scripts/verify fast exit: 0

Cleanup verified: own CARGO_TARGET_DIR deleted, detached baseline worktree removed, owned short/bounded fixtures removed, no owned running executable before cleanup. Branch and origin head match. Evidence and final images retained. No perf/production host contacted or deployment performed. Runtime VM proofs remain owed by the orchestrator; this implementation handoff does not supply them.

final-fast.log
cleanup-proof.json
preserved-final-images.json
native-clean.log

final-size-comparison.json
cap-boundaries.log
static-recipe-tests.log
exact-static-gates.log
author-review.txt

Implementation finished and pushed: edge-autoupdate-r2, head 31053e59b1406496e4f680e1701b3a92f6266840. Worktree clean; issues left open. - EAR2-01: validate retained SQLite preimage, reclaim failed main/journals before restore, and retain the armed restart boundary through interruption. Disk-full regression passes on the reviewer's 32 MiB fixture (12,288 B free, 4,210,688 B retained copy). Recovery suite 30 passed / 0 failed / 2 ignored; disk-full case explicitly run separately: 1 passed / 0 failed. Earlier D295 review tests, including backward-clock and repeated restore, remain passing. - EAR2-02: merged dev 8f88bf086 in 2a4bf9f0a. Merge commit records conflicted files and resolutions. Dev auth/WebSocket additions audited with no missing #240 lines; production commit-publication/account-events modules remain identical. Five reviewer-union repetitions: each 52 passed / 0 failed / 1 perf-only ignored. Final workspace server suite: 753 passed / 0 failed / 59 ignored. - EAR2-03: orphan selector symlink recovery under the existing directory's kernel lock; live writer excluded, unexpected files preserved. Release unit suite: 56 passed / 0 failed / 2 ignored, including all seven host-slot tests and the original review case. Pinned static images, one architecture at a time, production trust/static linkage pass. Exact caps with zero allowance: x86_64 22,096,232 B and aarch64 20,199,808 B. Against fresh dev controls: +675,640 / +607,304 B, below the previous complete envelope by 8,440 / 2,744 B. No new dependencies, features or release-profile changes. Final images preserved outside the target at ~/.cache/codex-scratch/edge-autoupdate-fix/artifacts/candidate-{x86_64,aarch64}-unknown-linux-musl; hashes attached. Final scripts/verify fast on this head exits 0, including TypeScript. Earlier watchdog pool-count failure, passing detached-dev diagnostic, and subsequent native target-reuse failure remain recorded above. After clearing native workspace artifacts, the unchanged watchdog test and full gate pass; no assertion/deadline changed and no baseline-failure waiver claimed. Verbatim final gate summary and final TypeScript test output (complete unedited stdout/stderr attached): ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 39 pass 0 fail 36135 expect() calls Ran 39 tests across 10 files. [2.00s] scripts/verify fast exit: 0 ``` Cleanup verified: own CARGO_TARGET_DIR deleted, detached baseline worktree removed, owned short/bounded fixtures removed, no owned running executable before cleanup. Branch and origin head match. Evidence and final images retained. No perf/production host contacted or deployment performed. Runtime VM proofs remain owed by the orchestrator; this implementation handoff does not supply them. [final-fast.log](https://git.kayg.org/attachments/2a90c95a-4bb4-4361-8473-d3ab31b673ce) [cleanup-proof.json](https://git.kayg.org/attachments/54f38277-5d0f-4c54-9caf-a8e4a38ee6d4) [preserved-final-images.json](https://git.kayg.org/attachments/7e66cd69-4994-4f57-965c-35b31dcb7ece) [native-clean.log](https://git.kayg.org/attachments/04d5ede9-99e0-447c-8252-04f7770b0601) [final-size-comparison.json](https://git.kayg.org/attachments/c3c632f5-cb6d-4564-8682-f7e15a9920e0) [cap-boundaries.log](https://git.kayg.org/attachments/4fea5dcd-ebf0-4df5-91ec-71435809fedb) [static-recipe-tests.log](https://git.kayg.org/attachments/d6721da3-1f6d-41fe-b145-4109c5c217b6) [exact-static-gates.log](https://git.kayg.org/attachments/ae220104-648e-4f38-a837-900a660ee4a9) [author-review.txt](https://git.kayg.org/attachments/6012b9db-eeec-49e0-95bc-133802484334)
kayg commented 2026-10-30 04:14:16 +00:00
Author
Owner
Copy link

Final delta review started: branch review-edge-autoupdate-r3, base/target 31053e59b1. Reviewing EAR2-01/02/03 repairs, retained review tests, dev guarantees, interruption/resource exhaustion, owner-present repair and exact D301 sizes. No implementation fixes, deployment or external host contact. VM-only cases will be recorded here for the orchestrator.

Final delta review started: branch review-edge-autoupdate-r3, base/target 31053e59b1406496e4f680e1701b3a92f6266840. Reviewing EAR2-01/02/03 repairs, retained review tests, dev guarantees, interruption/resource exhaustion, owner-present repair and exact D301 sizes. No implementation fixes, deployment or external host contact. VM-only cases will be recorded here for the orchestrator.
kayg commented 2026-10-30 04:15:38 +00:00
Author
Owner
Copy link

EAR3-01 · P1 · crates/plugins/release/src/host_watchdog.rs:64-70 (PROGRAM)

Scenario: unhealthy host successor reaches its check-in deadline while storage is full. The watchdog claims its receipt, then writes receipt.failed before restoring bin/current. ENOSPC exits the set -e shell before selection/restart/cleanup. Unhealthy candidate stays selected; update-pending and the .rollback claim remain. Freeing storage afterward cannot resume the exited transient supervisor, and begin() refuses update-pending.

Test: scripts/release/review_update_failure_test.py::RollbackFailureReview.test_disk_or_inode_full_does_not_prevent_previous_selection. Committed and pushed immediately as 5b1390854 on review-edge-autoupdate-r3. Executes the exact production PROGRAM with only sleep and systemctl stubbed; all filesystem/checksum operations are real. Private unprivileged tmpfs, no external hosts: blocks=0 / free inodes=243 -> exit 1 at printf; free blocks=2043 / inodes=0 -> exit 2 creating failure record. Both fail predecessor-selection assertion (0 passed, 1 failed).

blocks inodes

New P1 in this final round: redesign needed under the owner brief. Implementation left unchanged. Remaining verification is in progress.

EAR3-01 · P1 · crates/plugins/release/src/host_watchdog.rs:64-70 (PROGRAM) Scenario: unhealthy host successor reaches its check-in deadline while storage is full. The watchdog claims its receipt, then writes receipt.failed before restoring bin/current. ENOSPC exits the set -e shell before selection/restart/cleanup. Unhealthy candidate stays selected; update-pending and the .rollback claim remain. Freeing storage afterward cannot resume the exited transient supervisor, and begin() refuses update-pending. Test: scripts/release/review_update_failure_test.py::RollbackFailureReview.test_disk_or_inode_full_does_not_prevent_previous_selection. Committed and pushed immediately as 5b1390854 on review-edge-autoupdate-r3. Executes the exact production PROGRAM with only sleep and systemctl stubbed; all filesystem/checksum operations are real. Private unprivileged tmpfs, no external hosts: blocks=0 / free inodes=243 -> exit 1 at printf; free blocks=2043 / inodes=0 -> exit 2 creating failure record. Both fail predecessor-selection assertion (0 passed, 1 failed). [blocks](https://git.kayg.org/attachments/92fe7cf6-1739-4759-8e7d-c0193d90028d) [inodes](https://git.kayg.org/attachments/4e83cbd7-33d5-4073-9d40-62bbb10ff5d1) New P1 in this final round: redesign needed under the owner brief. Implementation left unchanged. Remaining verification is in progress.
kayg commented 2026-10-30 04:18:09 +00:00
Author
Owner
Copy link

EAR3-02 · P2 · apps/tracer/src/stale-screen.ts:48-58 · #257 dev behavior missing

Scenario: an idle terminal is reattached at exactly its replay geometry. The target unconditionally starts the stale-screen timer and shows the note; current origin/dev 0c8639496 suppresses it. Test apps/tracer/src/stale-screen-dev-review.test.ts::review r3: same-size idle replay keeps the #257 no-note guarantee: 0 passed / 1 failed; expected [], got [true]. Committed/pushed immediately as 0d9c7fbc5. Functional state-machine evidence; no browser visual-quality claim.

stale-screen.log

Source audit: all external Cargo.lock package records and crates/infraternal-shim/src/readiness.rs are identical to current dev. Full lockfile is not byte-identical: expected workspace dependency edges for the updater differ. #240 commit-publication/account-event/session modules are identical. Earlier named review bodies are identical except EAR2-02 changes revocation_events() to revocation_events(&f.user), and the prior D295 disk test has a closure-to-method formatting change. No assertion was removed. Literal byte-identical requirement is therefore not satisfied, although the original assertions are retained.

EAR3-02 · P2 · apps/tracer/src/stale-screen.ts:48-58 · #257 dev behavior missing Scenario: an idle terminal is reattached at exactly its replay geometry. The target unconditionally starts the stale-screen timer and shows the note; current origin/dev 0c8639496 suppresses it. Test apps/tracer/src/stale-screen-dev-review.test.ts::review r3: same-size idle replay keeps the #257 no-note guarantee: 0 passed / 1 failed; expected [], got [true]. Committed/pushed immediately as 0d9c7fbc5. Functional state-machine evidence; no browser visual-quality claim. [stale-screen.log](https://git.kayg.org/attachments/9bcda719-e865-4df9-baf5-138c8f80920a) Source audit: all external Cargo.lock package records and crates/infraternal-shim/src/readiness.rs are identical to current dev. Full lockfile is not byte-identical: expected workspace dependency edges for the updater differ. #240 commit-publication/account-event/session modules are identical. Earlier named review bodies are identical except EAR2-02 changes revocation_events() to revocation_events(&f.user), and the prior D295 disk test has a closure-to-method formatting change. No assertion was removed. Literal byte-identical requirement is therefore not satisfied, although the original assertions are retained.
kayg commented 2026-10-30 04:19:45 +00:00
Author
Owner
Copy link

VM-only qualification for orchestrator (#211/#236), after a written redesign plan resolves EAR3-01. This review contacts no perf, production or test host.

Required whole-service fault matrix: interrupt download, manifest/image verification, durable image/database write, executable handoff, selector publication, service restart, listener/reconciliation health, and rollback. At each stage run process termination/power loss, block exhaustion, and inode exhaustion on an isolated bounded volume. Assert the predecessor remains signed/runnable, startup recovers without manual file deletion, and a subsequent signed offer can proceed. Local filesystem tests already disprove the universal guarantee: EAR3-01 leaves the unhealthy host image selected and a claimed pending transaction on either storage boundary. Unit state modeling cannot establish system-manager/power-loss recovery.

Managed-host proof must exercise the exact production transient PROGRAM under a real manager, including termination after receipt claim, failure-record fsync/rename, watchdog-current creation, selector rename, pending removal and service restart. After storage is freed, reconstruct the receiver and try a different signed update; record pending/claim state. The local shell reproduction stubs only deadline sleep and systemctl; it proves filesystem ordering, not actual restart behavior.

Retain the earlier pending VM-only evidence: scripts/release/staging-proof --updates --active-streams 128 --review-case routes; --review-case transport; --active-streams 1 --review-case reconnect; --review-case writer-cost; signed successor migration/startup refusal and managed-host deadline rollback. Use the existing script's documented managed-host and release-harness flags and the orchestrator's authorized isolated VM, one bounded lock hold at a time. No measurement from this shared build host is performance evidence.

For #236 additionally exercise disconnect/cancellation before credential use, after reservation and during install; replay a consumed owner proof/one-use SSH input from another socket, attempt API-key/unattended repair, and confirm that cancellation cannot mutate another attempt's reservation. Local backend/SSH tests cover ownership and cancellation; this review does not equate their success with a physical-presence or replay-security proof.

VM-only qualification for orchestrator (#211/#236), after a written redesign plan resolves EAR3-01. This review contacts no perf, production or test host. Required whole-service fault matrix: interrupt download, manifest/image verification, durable image/database write, executable handoff, selector publication, service restart, listener/reconciliation health, and rollback. At each stage run process termination/power loss, block exhaustion, and inode exhaustion on an isolated bounded volume. Assert the predecessor remains signed/runnable, startup recovers without manual file deletion, and a subsequent signed offer can proceed. Local filesystem tests already disprove the universal guarantee: EAR3-01 leaves the unhealthy host image selected and a claimed pending transaction on either storage boundary. Unit state modeling cannot establish system-manager/power-loss recovery. Managed-host proof must exercise the exact production transient PROGRAM under a real manager, including termination after receipt claim, failure-record fsync/rename, watchdog-current creation, selector rename, pending removal and service restart. After storage is freed, reconstruct the receiver and try a different signed update; record pending/claim state. The local shell reproduction stubs only deadline sleep and systemctl; it proves filesystem ordering, not actual restart behavior. Retain the earlier pending VM-only evidence: scripts/release/staging-proof --updates --active-streams 128 --review-case routes; --review-case transport; --active-streams 1 --review-case reconnect; --review-case writer-cost; signed successor migration/startup refusal and managed-host deadline rollback. Use the existing script's documented managed-host and release-harness flags and the orchestrator's authorized isolated VM, one bounded lock hold at a time. No measurement from this shared build host is performance evidence. For #236 additionally exercise disconnect/cancellation before credential use, after reservation and during install; replay a consumed owner proof/one-use SSH input from another socket, attempt API-key/unattended repair, and confirm that cancellation cannot mutate another attempt's reservation. Local backend/SSH tests cover ownership and cancellation; this review does not equate their success with a physical-presence or replay-security proof.
kayg commented 2026-10-30 04:21:43 +00:00
Author
Owner
Copy link

EAR3-03 · P1 · crates/infraternal-server/src/update_recovery.rs:445-448, stable():198-205

Scenario: after the admitted candidate starts and migrates, it consumes every inode while free data blocks remain. Predecessor enter() returns "Update recovery copy is unavailable" and the marker remains Armed, preventing startup and another prepare. The reclamation fix frees/reuses the live main inode but selector and phase publication still require new inodes. No external host or shared filesystem was filled.

Failing test: update_recovery::tests::inode_review::review_r3_inode_full_still_restores_and_allows_another_attempt, in update_recovery_inode_review_tests.rs. Private 32 MiB tmpfs, nr_inodes=256: available_inodes=0, available_blocks=8183; 0 passed / 1 failed. Immediately committed/pushed as 6877472c5. server-inodes.log

Correction to the earlier EAR3-01 location: the failing failure-record write is host_watchdog.rs:56, before selector restoration at :61-62; :64-70 was an inaccurate initial line reference.

Current new findings: P0=0, P1=2 (EAR3-01, EAR3-03), P2=1 (EAR3-02), P3=0. Per final-round brief: redesign needed. No implementation fix. Five #240 repetitions and final-head fast are next.

EAR3-03 · P1 · crates/infraternal-server/src/update_recovery.rs:445-448, stable():198-205 Scenario: after the admitted candidate starts and migrates, it consumes every inode while free data blocks remain. Predecessor enter() returns "Update recovery copy is unavailable" and the marker remains Armed, preventing startup and another prepare. The reclamation fix frees/reuses the live main inode but selector and phase publication still require new inodes. No external host or shared filesystem was filled. Failing test: update_recovery::tests::inode_review::review_r3_inode_full_still_restores_and_allows_another_attempt, in update_recovery_inode_review_tests.rs. Private 32 MiB tmpfs, nr_inodes=256: available_inodes=0, available_blocks=8183; 0 passed / 1 failed. Immediately committed/pushed as 6877472c5. [server-inodes.log](https://git.kayg.org/attachments/c6456c65-829a-4151-9bb0-175e562d77c0) Correction to the earlier EAR3-01 location: the failing failure-record write is host_watchdog.rs:56, before selector restoration at :61-62; :64-70 was an inaccurate initial line reference. Current new findings: P0=0, P1=2 (EAR3-01, EAR3-03), P2=1 (EAR3-02), P3=0. Per final-round brief: redesign needed. No implementation fix. Five #240 repetitions and final-head fast are next.
kayg commented 2026-10-30 04:26:03 +00:00
Author
Owner
Copy link

EAR3-03 location confirmed with a diagnostic interposer that logs selector syscalls without changing their results: initial current.partial symlink succeeds; after inode exhaustion the recovery symlink returns -1/errno 28. This is update_recovery.rs stable() following restore_copy(), not an inferred SQLite refusal. The original committed failing test does not depend on the interposer.

server-inodes-trace.log
source-comparison.json
stale-screen-dev.log

The #257 same-size regression passes unchanged against dev's source (1 passed / 0 failed), and fails against the target (0 passed / 1 failed). Current dev is 0c8639496; the target's merge base with it is 8f88bf086. No implementation was changed. Review head and remote branch both equal 6877472c51.

EAR3-03 location confirmed with a diagnostic interposer that logs selector syscalls without changing their results: initial current.partial symlink succeeds; after inode exhaustion the recovery symlink returns -1/errno 28. This is update_recovery.rs stable() following restore_copy(), not an inferred SQLite refusal. The original committed failing test does not depend on the interposer. [server-inodes-trace.log](https://git.kayg.org/attachments/3c3cc3b4-005b-4653-861f-bec14c23077d) [source-comparison.json](https://git.kayg.org/attachments/696486f8-1b32-4f9d-a247-48b67a22b7d0) [stale-screen-dev.log](https://git.kayg.org/attachments/2317edae-9265-469d-87af-e92a588cffcb) The #257 same-size regression passes unchanged against dev's source (1 passed / 0 failed), and fails against the target (0 passed / 1 failed). Current dev is 0c8639496; the target's merge base with it is 8f88bf086. No implementation was changed. Review head and remote branch both equal 6877472c518bf0324c6b1fe9b9e02bb5d69e1dc3.
kayg commented 2026-10-30 04:26:41 +00:00
Author
Owner
Copy link

Final review checkpoint on pushed head 6877472c51. Five independent #240 reviewer-union repetitions each pass 52/0 with one perf-only ignored. Includes EAR2-02 committed logout, 256 sockets/61 accounts, commit cancellation/refusal and source-loss 1013 handling. No deadline/assertion changed and no baseline waiver. Recovery ordinary suite 30/0, 3 ignored (the pre-existing disk/perf cases plus new explicit inode regression); EAR2-01 executed separately and passes with initial free 29,331,456 B, remaining 12,288 B and copy 4,210,688 B. The new P1 inode test was separately executed and fails as recorded. Fmt passes. Remaining agent-feature slot suite, full repair filters, final fast and fresh merge-base static comparison are pending.

union-1.log
union-2.log
union-3.log
union-4.log
union-5.log
recovery.log
server-blocks.log

Final review checkpoint on pushed head 6877472c518bf0324c6b1fe9b9e02bb5d69e1dc3. Five independent #240 reviewer-union repetitions each pass 52/0 with one perf-only ignored. Includes EAR2-02 committed logout, 256 sockets/61 accounts, commit cancellation/refusal and source-loss 1013 handling. No deadline/assertion changed and no baseline waiver. Recovery ordinary suite 30/0, 3 ignored (the pre-existing disk/perf cases plus new explicit inode regression); EAR2-01 executed separately and passes with initial free 29,331,456 B, remaining 12,288 B and copy 4,210,688 B. The new P1 inode test was separately executed and fails as recorded. Fmt passes. Remaining agent-feature slot suite, full repair filters, final fast and fresh merge-base static comparison are pending. [union-1.log](https://git.kayg.org/attachments/bab23629-4971-4abe-ae71-8ee8813eaad1) [union-2.log](https://git.kayg.org/attachments/005967ab-4f1d-465a-aa6d-f99b5ea4c23c) [union-3.log](https://git.kayg.org/attachments/7316818a-ab2e-4843-b6c4-2f673727a954) [union-4.log](https://git.kayg.org/attachments/e26775c7-3048-4f57-98d5-c8caf6c25440) [union-5.log](https://git.kayg.org/attachments/240a540d-bde6-42e3-b333-525f66d6e317) [recovery.log](https://git.kayg.org/attachments/978684cc-df3e-480c-911f-3c58735baaee) [server-blocks.log](https://git.kayg.org/attachments/78f90b9e-02cc-43a1-9898-acecdd3a336e)
kayg commented 2026-10-30 04:32:04 +00:00
Author
Owner
Copy link

Review branch advanced to 9972049625 and pushed. This fourth atomic commit fixes only a redundant diagnostic closure in the new EAR3-03 test after pedantic Clippy rejected it; the failing assertion/scenario and implementation are unchanged. Workspace Clippy then passes in the full gate. Full workspace tests are now running. The earlier dedicated Clippy failure is retained in the external review-clippy.log; no implementation finding is attributed to it.

Review branch advanced to 9972049625461637b42e42fd8b4e53f6ce17597a and pushed. This fourth atomic commit fixes only a redundant diagnostic closure in the new EAR3-03 test after pedantic Clippy rejected it; the failing assertion/scenario and implementation are unchanged. Workspace Clippy then passes in the full gate. Full workspace tests are now running. The earlier dedicated Clippy failure is retained in the external review-clippy.log; no implementation finding is attributed to it.
kayg commented 2026-10-30 04:41:14 +00:00
Author
Owner
Copy link

First full-gate workspace run: server 750 passed / 3 failed / 60 ignored. All failures are setup-token socket construction (runtime.rs:1222,1326,1398), reporting "path must be shorter than SUN_LEN". Our chosen TMPDIR ended in /r3: that gives 108-byte setup socket paths. An atomically-created owned single-character scratch root gives 107 bytes. All three cases pass unchanged there: 3 passed / 0 failed. This is a corrected invocation, not a code fix or a #118 load waiver. Full transcript remains retained; the final head gate will use the corrected root.

setup-short-root.log

Review head db301eb844 adds bounded-filesystem guards to both explicit resource fixtures before any filler is written. Guarded host inode case still fails at predecessor selection; no implementation changed.

First full-gate workspace run: server 750 passed / 3 failed / 60 ignored. All failures are setup-token socket construction (runtime.rs:1222,1326,1398), reporting "path must be shorter than SUN_LEN". Our chosen TMPDIR ended in /r3: that gives 108-byte setup socket paths. An atomically-created owned single-character scratch root gives 107 bytes. All three cases pass unchanged there: 3 passed / 0 failed. This is a corrected invocation, not a code fix or a #118 load waiver. Full transcript remains retained; the final head gate will use the corrected root. [setup-short-root.log](https://git.kayg.org/attachments/f657bd2c-81a9-457a-b413-61be4a5b0224) Review head db301eb8442307e8a37ba4d1418619d851b77533 adds bounded-filesystem guards to both explicit resource fixtures before any filler is written. Guarded host inode case still fails at predecessor selection; no implementation changed.
kayg commented 2026-10-30 04:57:36 +00:00
Author
Owner
Copy link

Supplemental checks at review head db301eb844: release with agent feature passes 56 unit tests plus 3 integrations (EAR2-03 passes); full repair backend/API filters 10/0; SSH repair 2/0. Guarded inode-full reproduction still fails 0/1, with 0 available inodes and 8,183 available blocks. No implementation change.

First complete fast gate exits 1: three setup Unix socket path-length failures (unchanged tests pass under corrected root), and static review-head sizes 22,096,384 / 20,199,896 B, exceeding pinned caps by 152 / 88 B. The transcript is retained. Fresh merge-base and untouched target images are being built to distinguish review branch artifacts from target 31053e59b; final-head gate remains pending.

repair-full.log
release-agent.log
ssh-repair.log
server-inodes-head.log
final-fast.log

Supplemental checks at review head db301eb8442307e8a37ba4d1418619d851b77533: release with agent feature passes 56 unit tests plus 3 integrations (EAR2-03 passes); full repair backend/API filters 10/0; SSH repair 2/0. Guarded inode-full reproduction still fails 0/1, with 0 available inodes and 8,183 available blocks. No implementation change. First complete fast gate exits 1: three setup Unix socket path-length failures (unchanged tests pass under corrected root), and static review-head sizes 22,096,384 / 20,199,896 B, exceeding pinned caps by 152 / 88 B. The transcript is retained. Fresh merge-base and untouched target images are being built to distinguish review branch artifacts from target 31053e59b; final-head gate remains pending. [repair-full.log](https://git.kayg.org/attachments/4afbfdc7-5d41-4487-a9f7-031f77a0a0a3) [release-agent.log](https://git.kayg.org/attachments/de0bb88a-cb40-4cde-afa3-53b89f67dff2) [ssh-repair.log](https://git.kayg.org/attachments/d477ffe9-85c1-47fd-b9d6-1cf8d89f9d0a) [server-inodes-head.log](https://git.kayg.org/attachments/cd3b74b7-a585-48ef-bae2-68d973fdd7c5) [final-fast.log](https://git.kayg.org/attachments/183c088e-fda8-4676-9013-b2761f75523d)
kayg commented 2026-10-30 05:08:42 +00:00
Author
Owner
Copy link

EAR3-04 · P3 · scripts/verify.d/rust.sh:68–69. The untouched target 31053e59b x86 static image measures 22,096,384 B, versus exact declared cap 22,096,232 B (+152 B), so static builds fails. Review branch produces the same size. Reproduction committed immediately as 6c64054c6 and pushed only review-edge-autoupdate-r3: scripts/release/review_update_size_test.py::DeclaredImageSizeReview.test_x86_image_matches_declared_size. ARM untouched measurement pending (review-head ARM is 20,199,896 B versus 20,199,808 B). This remains inside D301 growth envelope; no cap changed. Counts now 0 P0 / 2 P1 / 1 P2 / 1 P3; verdict remains redesign needed.

Fresh merge-base x86 succeeds after removing only this job's CLI package artifacts: 21,420,592 B. Initial comparison link reused build-script output for a newer update-note.ld absent in the older source; both failed and clean retry transcripts retained.

size-review-first.log
baseline-static.log
baseline-static-retry.log

EAR3-04 · P3 · scripts/verify.d/rust.sh:68–69. The untouched target 31053e59b x86 static image measures 22,096,384 B, versus exact declared cap 22,096,232 B (+152 B), so static builds fails. Review branch produces the same size. Reproduction committed immediately as 6c64054c6 and pushed only review-edge-autoupdate-r3: scripts/release/review_update_size_test.py::DeclaredImageSizeReview.test_x86_image_matches_declared_size. ARM untouched measurement pending (review-head ARM is 20,199,896 B versus 20,199,808 B). This remains inside D301 growth envelope; no cap changed. Counts now 0 P0 / 2 P1 / 1 P2 / 1 P3; verdict remains redesign needed. Fresh merge-base x86 succeeds after removing only this job's CLI package artifacts: 21,420,592 B. Initial comparison link reused build-script output for a newer update-note.ld absent in the older source; both failed and clean retry transcripts retained. [size-review-first.log](https://git.kayg.org/attachments/32277290-28c1-48b3-b652-5c5ce97b7700) [baseline-static.log](https://git.kayg.org/attachments/a344abd0-e0f4-4692-9e24-1b4b61b50759) [baseline-static-retry.log](https://git.kayg.org/attachments/2d6ef124-daef-4978-8be6-e082c7723cf0)
kayg commented 2026-10-30 05:32:53 +00:00
Author
Owner
Copy link

Final delta review: redesign needed. Target 31053e59b; review head 6c64054c62. Counts: 0 P0, 2 P1, 1 P2, 1 P3. No implementation changes, deployment or external-host contact.

  • EAR3-01, P1 — crates/plugins/release/src/host_watchdog.rs:56. Block-full or inode-full storage prevents the failure record before selector restoration. The watchdog exits with the unhealthy candidate selected, update-pending present and rollback receipt claimed. Failing test: scripts/release/review_update_failure_test.py::RollbackFailureReview.test_disk_or_inode_full_does_not_prevent_previous_selection. Exact production shell body, only sleep/systemctl stubbed; bounded private tmpfs.

  • EAR3-02, P2 — apps/tracer/src/stale-screen.ts:48–58. Same-size idle replay starts a stale note timer; current dev preserves no-note behavior (#257). Failing test: apps/tracer/src/stale-screen-dev-review.test.ts, “review r3: same-size idle replay keeps the #257 no-note guarantee”. Same test passes against dev source.

  • EAR3-03, P1 — crates/infraternal-server/src/update_recovery.rs:445–448 (stable). With zero free inodes, recovery restores the database but cannot create updates/current.partial. Predecessor startup fails and the marker remains Armed. Failing test: update_recovery::tests::inode_review::review_r3_inode_full_still_restores_and_allows_another_attempt. Bounded private 32MiB/256-inode tmpfs.

  • EAR3-04, P3 — scripts/verify.d/rust.sh:68–69. Untouched target static images differ from their exact pinned caps. Failing tests: scripts/release/review_update_size_test.py::DeclaredImageSizeReview.test_x86_image_matches_declared_size and test_arm_image_matches_declared_size. The final static gate independently checks the same real artifacts. No cap changed.

Earlier EAR2-01/02 pass. Five #240 union repetitions each pass 52 tests, 0 failed, 1 perf-only ignored. Recovery ordinary suite: 30 passed, 0 failed, 3 ignored; earlier block-full review test executed explicitly and passes. Literal byte identity is not fully met: logout adapts revocation_events() to revocation_events(&f.user), D295 disk fixture replaces a closure with a method call and updates ignore wording, and the interruption test adds cases; prior assertions are preserved. Source comparison receipt records exact exceptions.

Compared against origin/dev 0c8639496b: external Cargo.lock dependency records and relevant AsyncFd/readiness callers are identical. Full lockfile differs in workspace dependency edges; it is not byte-identical. #252 status source is identical; setup test has selector fixture integration. #240 production account/session/commit publication code is identical. #257 is not intact, as EAR3-02 demonstrates.

The first complete gate invocation used a fixture root one byte too long for three Unix sockets; all three unchanged tests pass with the corrected root. The first transcript is retained. An earlier review-test diagnostic hit Clippy's redundant-closure lint, corrected in a separate test-only commit. Neither is an implementation finding. The final-head gate below uses the corrected root.

Whole-service interruption/power-loss and resource-exhaustion matrix at download, verify, write, swap, selector, restart, health and rollback remains VM-only; exact scenarios are already posted above for the orchestrator. Local boundary tests disprove the universal recovery requirement. Local #236 owner/origin/reservation/SSH checks do not establish physical owner presence or full replay security; VM scenarios remain listed above.

Untouched target images: x86 22,096,384 B, ARM 20,199,896 B, respectively +152/+88 B over exact declared caps. They are byte-identical to the review-head images (SHA-256 receipt attached). Fresh x86 merge-base 8f88bf086 image: 21,420,592 B; growth +675,792 B versus accepted +684,080 B envelope, leaving 8,288 B. ARM growth +607,392 B against the recorded 19,592,504 B baseline and +610,048 B envelope, leaving 2,656 B; ARM baseline was not freshly rebuilt. Both exact-size tests fail; no cap changed. Initial baseline linking reused stale CLI build-script output naming an absent newer linker script; a clean CLI-package retry succeeds, with both transcripts retained.

Final-head server suite: 752 passed / 1 failed / 60 ignored. The failure is the existing websocket::writer_tests::authority_watchdog::cap_review_r3::sqlite_busy_timeout_recovers_detached_storm_without_unlocking assertion (observed pooled reads 5, expected 4). A direct isolated target rerun passes 1/0. This remains a failed final gate, without a baseline waiver. Detached dev comparison results follow.

Detached dev 0c8639496 passes five isolated repetitions of the concurrency test (1/0 each). This did not reproduce the full-gate failure and is not a waiver or a claim of a new branch regression. Tracer check initially could not resolve missing local type dependencies; after bun install --frozen-lockfile, bun run check exits 0. No tracked dependency file changed.

Supplemental host suite: 56 passed / 0 failed / 2 ignored plus 3 passing integrations; EAR2-03 passes. Repair backend/API filters: 10/0. SSH repair: 2/0. New guarded inode test: 0 passed / 1 failed.

Final scripts/verify fast on head 6c64054c62, verbatim summary (full output attached):

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | FAIL (101)   |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+
scripts/verify fast exit: 1

head-fast.log
busy-isolated.log
last-check-sequence.log
dev-busy-1.log
dev-busy-2.log
dev-busy-3.log
dev-busy-4.log
dev-busy-5.log
tracer-check.log
tracer-check-installed.log

size-review.log
static-comparison.json
target-x86_64-unknown-linux-musl.log
target-aarch64-unknown-linux-musl.log

repair-full.log
release-agent.log
ssh-repair.log
server-inodes-head.log
final-fast.log

Cleanup: no executable from the job target remained running before deletion. Job target and detached baseline/target/dev comparison worktrees removed; owned short fixture root removed. Review worktree, pushed review branch and external evidence retained. The earlier unmarked short fixture directory is retained rather than deleting a path without an ownership marker.

Final delta review: **redesign needed**. Target 31053e59b; review head 6c64054c620d2dc3908346d2fc832e382686002c. Counts: 0 P0, 2 P1, 1 P2, 1 P3. No implementation changes, deployment or external-host contact. - EAR3-01, P1 — crates/plugins/release/src/host_watchdog.rs:56. Block-full or inode-full storage prevents the failure record before selector restoration. The watchdog exits with the unhealthy candidate selected, update-pending present and rollback receipt claimed. Failing test: scripts/release/review_update_failure_test.py::RollbackFailureReview.test_disk_or_inode_full_does_not_prevent_previous_selection. Exact production shell body, only sleep/systemctl stubbed; bounded private tmpfs. - EAR3-02, P2 — apps/tracer/src/stale-screen.ts:48–58. Same-size idle replay starts a stale note timer; current dev preserves no-note behavior (#257). Failing test: apps/tracer/src/stale-screen-dev-review.test.ts, “review r3: same-size idle replay keeps the #257 no-note guarantee”. Same test passes against dev source. - EAR3-03, P1 — crates/infraternal-server/src/update_recovery.rs:445–448 (stable). With zero free inodes, recovery restores the database but cannot create updates/current.partial. Predecessor startup fails and the marker remains Armed. Failing test: update_recovery::tests::inode_review::review_r3_inode_full_still_restores_and_allows_another_attempt. Bounded private 32MiB/256-inode tmpfs. - EAR3-04, P3 — scripts/verify.d/rust.sh:68–69. Untouched target static images differ from their exact pinned caps. Failing tests: scripts/release/review_update_size_test.py::DeclaredImageSizeReview.test_x86_image_matches_declared_size and test_arm_image_matches_declared_size. The final static gate independently checks the same real artifacts. No cap changed. Earlier EAR2-01/02 pass. Five #240 union repetitions each pass 52 tests, 0 failed, 1 perf-only ignored. Recovery ordinary suite: 30 passed, 0 failed, 3 ignored; earlier block-full review test executed explicitly and passes. Literal byte identity is not fully met: logout adapts revocation_events() to revocation_events(&f.user), D295 disk fixture replaces a closure with a method call and updates ignore wording, and the interruption test adds cases; prior assertions are preserved. Source comparison receipt records exact exceptions. Compared against origin/dev 0c8639496b376362b27689122583c53ade4a4668: external Cargo.lock dependency records and relevant AsyncFd/readiness callers are identical. Full lockfile differs in workspace dependency edges; it is not byte-identical. #252 status source is identical; setup test has selector fixture integration. #240 production account/session/commit publication code is identical. #257 is not intact, as EAR3-02 demonstrates. The first complete gate invocation used a fixture root one byte too long for three Unix sockets; all three unchanged tests pass with the corrected root. The first transcript is retained. An earlier review-test diagnostic hit Clippy's redundant-closure lint, corrected in a separate test-only commit. Neither is an implementation finding. The final-head gate below uses the corrected root. Whole-service interruption/power-loss and resource-exhaustion matrix at download, verify, write, swap, selector, restart, health and rollback remains VM-only; exact scenarios are already posted above for the orchestrator. Local boundary tests disprove the universal recovery requirement. Local #236 owner/origin/reservation/SSH checks do not establish physical owner presence or full replay security; VM scenarios remain listed above. Untouched target images: x86 22,096,384 B, ARM 20,199,896 B, respectively +152/+88 B over exact declared caps. They are byte-identical to the review-head images (SHA-256 receipt attached). Fresh x86 merge-base 8f88bf086 image: 21,420,592 B; growth +675,792 B versus accepted +684,080 B envelope, leaving 8,288 B. ARM growth +607,392 B against the recorded 19,592,504 B baseline and +610,048 B envelope, leaving 2,656 B; ARM baseline was not freshly rebuilt. Both exact-size tests fail; no cap changed. Initial baseline linking reused stale CLI build-script output naming an absent newer linker script; a clean CLI-package retry succeeds, with both transcripts retained. Final-head server suite: 752 passed / 1 failed / 60 ignored. The failure is the existing websocket::writer_tests::authority_watchdog::cap_review_r3::sqlite_busy_timeout_recovers_detached_storm_without_unlocking assertion (observed pooled reads 5, expected 4). A direct isolated target rerun passes 1/0. This remains a failed final gate, without a baseline waiver. Detached dev comparison results follow. Detached dev 0c8639496 passes five isolated repetitions of the concurrency test (1/0 each). This did not reproduce the full-gate failure and is not a waiver or a claim of a new branch regression. Tracer check initially could not resolve missing local type dependencies; after bun install --frozen-lockfile, bun run check exits 0. No tracked dependency file changed. Supplemental host suite: 56 passed / 0 failed / 2 ignored plus 3 passing integrations; EAR2-03 passes. Repair backend/API filters: 10/0. SSH repair: 2/0. New guarded inode test: 0 passed / 1 failed. Final scripts/verify fast on head 6c64054c620d2dc3908346d2fc832e382686002c, verbatim summary (full output attached): ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | FAIL (101) | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ scripts/verify fast exit: 1 ``` [head-fast.log](https://git.kayg.org/attachments/6d709119-be22-4405-8d33-9d73223f5543) [busy-isolated.log](https://git.kayg.org/attachments/347bd4da-115e-4c83-856a-92fb097309f7) [last-check-sequence.log](https://git.kayg.org/attachments/001d701c-6a30-4860-b267-8a6808d7589d) [dev-busy-1.log](https://git.kayg.org/attachments/d57d2668-b3a3-411e-baea-d7a22432d7e2) [dev-busy-2.log](https://git.kayg.org/attachments/104510a0-6ad8-4e39-90ee-3d3e0d253dd3) [dev-busy-3.log](https://git.kayg.org/attachments/db258201-4e49-4566-ac29-d62e39c689f3) [dev-busy-4.log](https://git.kayg.org/attachments/4e17861e-8566-46b7-b5fc-ff22127d07f0) [dev-busy-5.log](https://git.kayg.org/attachments/36af2d5d-a301-442c-aef0-45d9954dd2db) [tracer-check.log](https://git.kayg.org/attachments/1ab4392e-d51b-433a-845c-cb3c2b17be95) [tracer-check-installed.log](https://git.kayg.org/attachments/ff8e57d9-8411-4d89-8662-e807f6698c47) [size-review.log](https://git.kayg.org/attachments/afe6107e-e976-4d44-8930-ae1f59f8903b) [static-comparison.json](https://git.kayg.org/attachments/cab906de-de52-42a1-b808-51d95fef6634) [target-x86_64-unknown-linux-musl.log](https://git.kayg.org/attachments/815114d9-1cf7-4fd0-a6be-efd52ec44827) [target-aarch64-unknown-linux-musl.log](https://git.kayg.org/attachments/cdfd1539-06ae-44b5-bff9-de45afebdad0) [repair-full.log](https://git.kayg.org/attachments/4afbfdc7-5d41-4487-a9f7-031f77a0a0a3) [release-agent.log](https://git.kayg.org/attachments/de0bb88a-cb40-4cde-afa3-53b89f67dff2) [ssh-repair.log](https://git.kayg.org/attachments/d477ffe9-85c1-47fd-b9d6-1cf8d89f9d0a) [server-inodes-head.log](https://git.kayg.org/attachments/cd3b74b7-a585-48ef-bae2-68d973fdd7c5) [final-fast.log](https://git.kayg.org/attachments/183c088e-fda8-4676-9013-b2761f75523d) Cleanup: no executable from the job target remained running before deletion. Job target and detached baseline/target/dev comparison worktrees removed; owned short fixture root removed. Review worktree, pushed review branch and external evidence retained. The earlier unmarked short fixture directory is retained rather than deleting a path without an ownership marker.
kayg commented 2026-10-30 05:35:05 +00:00
Author
Owner
Copy link

Plan job started on plan-211-update from origin/dev 0c8639496. Research only: read #211/#236 histories, D251/D295/D217/D301/D23/D148, review branches and calternal PR #765; then write docs/plans/211-edge-update.md. No product code, deployment or edits to existing branches. Will compare durable known-good selection with reserve-only recovery and state explicit memory/storage limits.

Plan job started on plan-211-update from origin/dev 0c8639496. Research only: read #211/#236 histories, D251/D295/D217/D301/D23/D148, review branches and calternal PR #765; then write docs/plans/211-edge-update.md. No product code, deployment or edits to existing branches. Will compare durable known-good selection with reserve-only recovery and state explicit memory/storage limits.
kayg commented 2026-10-30 05:40:20 +00:00
Author
Owner
Copy link

Research findings for the redesign: rollback must not be a write transaction. At 31053e59b, host_watchdog.rs persists a failure receipt and creates a selector before restart (EAR3-01); server update_recovery.rs restores data then creates current.partial/publishes a marker (EAR3-03). Keeping current on A until B passes health removes those rollback dependencies. A restricted read-only startup is still required; retained signed bytes alone do not make today's startup allocation-free. Atomic rename/preallocated inodes do not guarantee metadata/fsync success under ENOSPC, and no updater can guarantee execution under unrestricted global OOM.

Comparison: calternal PR #765's initial one-pointer trial design is useful, but its subsequent final review rejects stopping healthy recovery when a reserve cannot refill. Apply that lesson: storage pressure blocks the next update, never healthy recovered service. The draft also distinguishes D301's updater +635,928 B from #236 legacy repair +48,152 B = +684,080 B, and includes all EA-01..06/EAR2-01..03/EAR3-01..04 findings. Owner decisions are proposals; DECISIONS.md is unchanged.

Research findings for the redesign: rollback must not be a write transaction. At 31053e59b, host_watchdog.rs persists a failure receipt and creates a selector before restart (EAR3-01); server update_recovery.rs restores data then creates current.partial/publishes a marker (EAR3-03). Keeping current on A until B passes health removes those rollback dependencies. A restricted read-only startup is still required; retained signed bytes alone do not make today's startup allocation-free. Atomic rename/preallocated inodes do not guarantee metadata/fsync success under ENOSPC, and no updater can guarantee execution under unrestricted global OOM. Comparison: calternal PR #765's initial one-pointer trial design is useful, but its subsequent final review rejects stopping healthy recovery when a reserve cannot refill. Apply that lesson: storage pressure blocks the next update, never healthy recovered service. The draft also distinguishes D301's updater +635,928 B from #236 legacy repair +48,152 B = +684,080 B, and includes all EA-01..06/EAR2-01..03/EAR3-01..04 findings. Owner decisions are proposals; DECISIONS.md is unchanged.
kayg commented 2026-10-30 05:45:28 +00:00
Author
Owner
Copy link

Design document committed and pushed: plan-211-update @ 39f9a149b3, based on dev 0c8639496. Only docs/plans/211-edge-update.md changed. Three A4 pages at 10pt prose / 9pt tables: print check.

Coverage checks: 13/13 named independent review findings, 13 interruption rows with separate block-full/inode-full columns, memory limits, preserved D295 historical-state manual rollback (distinct from calternal), #236 owner-present repair, source/line counts, binary-size provenance and four owner questions. Whitespace and repository artifact gate pass. Full scripts/verify fast is running through the shared build-slot wrapper; no final-gate pass or VM proof claimed yet. Read-only startup, WAL preservation and owner answers are implementation prerequisites, not shipped behavior.

Design document committed and pushed: plan-211-update @ 39f9a149b35822f4268555e82e74f219aee157df, based on dev 0c8639496. Only docs/plans/211-edge-update.md changed. Three A4 pages at 10pt prose / 9pt tables: [print check](https://git.kayg.org/attachments/f4c0e0dd-d796-434c-8481-b5f84390c9ee). Coverage checks: 13/13 named independent review findings, 13 interruption rows with separate block-full/inode-full columns, memory limits, preserved D295 historical-state manual rollback (distinct from calternal), #236 owner-present repair, source/line counts, binary-size provenance and four owner questions. Whitespace and repository artifact gate pass. Full scripts/verify fast is running through the shared build-slot wrapper; no final-gate pass or VM proof claimed yet. Read-only startup, WAL preservation and owner answers are implementation prerequisites, not shipped behavior.
kayg commented 2026-10-30 05:47:32 +00:00
Author
Owner
Copy link

Size-comparison refinement pushed at 7cc5334b29: the four reference modules total 1,521 physical lines including inline test tails, but 1,297 before those tails (702+200+95+300). The plan now compares the proposed 600–900 core-line budget against the latter and explicitly requires counting plugin adapters separately; total reduction is unproved. Updated three-page print check: https://git.kayg.org/attachments/67f7929b-1403-49e9-8326-ffe5f759179a . Full fast gate remains in progress; no product changes.

Size-comparison refinement pushed at 7cc5334b2977a8b2a92a35857194912859a9752a: the four reference modules total 1,521 physical lines including inline test tails, but 1,297 before those tails (702+200+95+300). The plan now compares the proposed 600–900 core-line budget against the latter and explicitly requires counting plugin adapters separately; total reduction is unproved. Updated three-page print check: https://git.kayg.org/attachments/67f7929b-1403-49e9-8326-ffe5f759179a . Full fast gate remains in progress; no product changes.
kayg commented 2026-10-30 05:52:02 +00:00
Author
Owner
Copy link

Final document pushed at c9c1877e92. Follow-up c94a043df preserves failed-image pause by inferring abandoned prepared attempts without requiring a rollback receipt; c9c1877e9 condenses prose back to three pages. Final A4 print check (10pt prose, 9pt tables): https://git.kayg.org/attachments/319d2060-19fa-4c24-8e41-6095abd86274 . Earlier print attachments are superseded.

Only docs/plans/211-edge-update.md differs from dev; whitespace/artifact checks pass. Full fast is now executing native lifecycle tests after passing fmt, CLI compile-out and Clippy. VM proofs are specified, not executed. Final gate output and cleanup follow separately.

Final document pushed at c9c1877e9233f93afbeec7a7d3630c927b447ae1. Follow-up c94a043df preserves failed-image pause by inferring abandoned prepared attempts without requiring a rollback receipt; c9c1877e9 condenses prose back to three pages. Final A4 print check (10pt prose, 9pt tables): https://git.kayg.org/attachments/319d2060-19fa-4c24-8e41-6095abd86274 . Earlier print attachments are superseded. Only docs/plans/211-edge-update.md differs from dev; whitespace/artifact checks pass. Full fast is now executing native lifecycle tests after passing fmt, CLI compile-out and Clippy. VM proofs are specified, not executed. Final gate output and cleanup follow separately.
kayg commented 2026-10-30 06:07:15 +00:00
Author
Owner
Copy link

Gate update at c9c1877e92: first scripts/verify fast completed; all rows passed except workspace test replay_size_review, whose fixture rejected a 108-byte AF_UNIX socket path. No source edits. With a short owned scratch root, the same real-binary raw and snapshot replay checks both pass. Full gate rerun now uses that root. Static binaries matched exact caps: x86_64 21,431,472 B; ARM 19,605,896 B.

First gate transcript · Corrected replay invocation

Gate update at c9c1877e9233f93afbeec7a7d3630c927b447ae1: first scripts/verify fast completed; all rows passed except workspace test replay_size_review, whose fixture rejected a 108-byte AF_UNIX socket path. No source edits. With a short owned scratch root, the same real-binary raw and snapshot replay checks both pass. Full gate rerun now uses that root. Static binaries matched exact caps: x86_64 21,431,472 B; ARM 19,605,896 B. [First gate transcript](https://git.kayg.org/attachments/e1a1aaba-9ae7-4266-b1fc-4d9d19d60f73) · [Corrected replay invocation](https://git.kayg.org/attachments/26d857ea-defb-42ec-ac6c-6efc5c6bb403)
kayg commented 2026-10-30 06:18:03 +00:00
Author
Owner
Copy link

Research plan finished and pushed: plan-211-update@c9c1877e9233f93afbeec7a7d3630c927b447ae1, based on origin/dev@0c8639496b376362b27689122583c53ade4a4668. Only docs/plans/211-edge-update.md changed; three printed pages, 13 reviewer findings and 13 interruption rows with disk/inode outcomes.

Recommendation: retain immutable known-good binary/database A throughout B’s trial, commit one prepared pointer only after real health, and make fallback startup read-only without mandatory persistent writes. Keep D217 handoff and #236 owner-present repair safeguards; shrink before extending D301. The document explicitly limits the guarantee to available execution resources and records four owner questions. It proposes, but does not run, the orchestrator’s VM proofs. No product code or existing branches changed.

Design source · Three-page print · Complete final gate output

Final scripts/verify fast passed after correcting the invocation’s AF_UNIX fixture path; the first failed invocation and corrected targeted check are recorded above on #211. Static sizes: x86_64 21,431,472 B and ARM 19,605,896 B, exact current-dev caps. No performance claim from this build host. Final gate summary/output verbatim:

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 39 pass
 0 fail
 50325 expect() calls
Ran 39 tests across 10 files. [3.63s]
scripts/verify fast exit: 0
Research plan finished and pushed: `plan-211-update@c9c1877e9233f93afbeec7a7d3630c927b447ae1`, based on `origin/dev@0c8639496b376362b27689122583c53ade4a4668`. Only `docs/plans/211-edge-update.md` changed; three printed pages, 13 reviewer findings and 13 interruption rows with disk/inode outcomes. Recommendation: retain immutable known-good binary/database A throughout B’s trial, commit one prepared pointer only after real health, and make fallback startup read-only without mandatory persistent writes. Keep D217 handoff and #236 owner-present repair safeguards; shrink before extending D301. The document explicitly limits the guarantee to available execution resources and records four owner questions. It proposes, but does not run, the orchestrator’s VM proofs. No product code or existing branches changed. [Design source](https://git.kayg.org/kayg/infraternal/src/branch/plan-211-update/docs/plans/211-edge-update.md) · [Three-page print](https://git.kayg.org/attachments/319d2060-19fa-4c24-8e41-6095abd86274) · [Complete final gate output](https://git.kayg.org/attachments/14e5a9ee-2f78-437f-9882-786d970e5b02) Final `scripts/verify fast` passed after correcting the invocation’s AF_UNIX fixture path; the first failed invocation and corrected targeted check are recorded above on #211. Static sizes: x86_64 21,431,472 B and ARM 19,605,896 B, exact current-dev caps. No performance claim from this build host. Final gate summary/output verbatim: ``` +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ 39 pass 0 fail 50325 expect() calls Ran 39 tests across 10 files. [3.63s] scripts/verify fast exit: 0 ```
kayg commented 2026-10-30 06:38:38 +00:00
Author
Owner
Copy link

Implementation started on edge-update-v2 from origin/dev 2fb412d01b (fresh worktree; exact base from git rev-parse recorded below). Approved 2026-10-30 design: plan-211-update c9c1877e9, owner accepts D301 overrun; root is allowed on build/QA VMs where needed. Preserve known-good selection through health, one prepared pointer commit, no mandatory recovery writes, read-only fallback, host lockstep and owner-present repair. Reference reuse will be selected deliberately from 31053e59b, never a branch merge. No perf host contact or deployment; VM-only proof commands/artifacts will be handed to the orchestrator. Repository is public; no credentials will be posted.
2fb412d01d

Implementation started on edge-update-v2 from origin/dev 2fb412d01b (fresh worktree; exact base from git rev-parse recorded below). Approved 2026-10-30 design: plan-211-update c9c1877e9, owner accepts D301 overrun; root is allowed on build/QA VMs where needed. Preserve known-good selection through health, one prepared pointer commit, no mandatory recovery writes, read-only fallback, host lockstep and owner-present repair. Reference reuse will be selected deliberately from 31053e59b, never a branch merge. No perf host contact or deployment; VM-only proof commands/artifacts will be handed to the orchestrator. Repository is public; no credentials will be posted. 2fb412d01dcecb81f1f556d18d0350e70644a615
kayg commented 2026-10-30 06:43:53 +00:00
Author
Owner
Copy link

Storage slice committed as 7b464a597: private complete-generation metadata, kernel-owned preparation and one prepared-pointer rename. Restart reads only current; ENOSPC/EDQUOT/EIO before rename, after rename and at parent fsync reconcile actual selection without a flip-back write. Seven new tests pass; release suite 14 passed/1 measurement ignored, existing integration checks 3 passed/2 subprocess helpers ignored; touched release Clippy and fmt pass. No runtime availability claim: watchdog, read-only serving, signed/handoff/host integration and full failure-table coverage remain outstanding. Auth/websocket/replay remain identical to task-base dev. No prior review assertion has been declared obsolete.

Storage slice committed as 7b464a597: private complete-generation metadata, kernel-owned preparation and one prepared-pointer rename. Restart reads only current; ENOSPC/EDQUOT/EIO before rename, after rename and at parent fsync reconcile actual selection without a flip-back write. Seven new tests pass; release suite 14 passed/1 measurement ignored, existing integration checks 3 passed/2 subprocess helpers ignored; touched release Clippy and fmt pass. No runtime availability claim: watchdog, read-only serving, signed/handoff/host integration and full failure-table coverage remain outstanding. Auth/websocket/replay remain identical to task-base dev. No prior review assertion has been declared obsolete.
kayg commented 2026-10-30 06:48:26 +00:00
Author
Owner
Copy link

SQLite storage slice committed as 73d19309f (preceded by process-lock regression 3d1aea6a3). Reused only reference copy_main/RAII finish code; excluded encrypted deserialization. Optional feature uses the already-pinned libsqlite3-sys 0.30.1 engine. Added guarded PERSIST_WAL and NO_CKPT_ON_CLOSE controls. Three actual-SQLite tests pass: online-copy isolation; committed WAL after close; committed WAL after abrupt child exit. Three repeated read-only opens with main/WAL/SHM 0400 and directory 0500 create no files and leave every byte unchanged. Eight generation tests, existing release tests, touched shim/release Clippy and fmt pass. This proves the primitive, not full read-only runtime startup or power-cut recovery. Auth/websocket/replay and dev dependency versions remain unchanged. Runtime/watchdog/host integration and remaining review/failure-table coverage are still pending.

SQLite storage slice committed as 73d19309f (preceded by process-lock regression 3d1aea6a3). Reused only reference copy_main/RAII finish code; excluded encrypted deserialization. Optional feature uses the already-pinned libsqlite3-sys 0.30.1 engine. Added guarded PERSIST_WAL and NO_CKPT_ON_CLOSE controls. Three actual-SQLite tests pass: online-copy isolation; committed WAL after close; committed WAL after abrupt child exit. Three repeated read-only opens with main/WAL/SHM 0400 and directory 0500 create no files and leave every byte unchanged. Eight generation tests, existing release tests, touched shim/release Clippy and fmt pass. This proves the primitive, not full read-only runtime startup or power-cut recovery. Auth/websocket/replay and dev dependency versions remain unchanged. Runtime/watchdog/host integration and remaining review/failure-table coverage are still pending.
kayg commented 2026-10-30 06:55:04 +00:00
Author
Owner
Copy link

Shared verification slice committed/pushed as b8ec50323: copied reference 31053e59b release verifier and bounded digest helper deliberately, with server re-exports and the original tests moved intact. API tests: 36 passed/1 ignored plus 2 integration passed; server release filter: 27 passed/4 ignored. Feature-off API check and API/server all-target Clippy/fmt pass. No production auth, websocket, replay or dependency version changed. Generation/SQLite primitives remain unconnected to runtime; the supervised trial, read-only core, transfer/host integration, #236 repair, full failure table and VM acceptance are still outstanding. Porting the independent EAR2-02/EAR3-02 dev preservation regressions next; no prior assertion is marked obsolete.

Shared verification slice committed/pushed as b8ec50323: copied reference 31053e59b release verifier and bounded digest helper deliberately, with server re-exports and the original tests moved intact. API tests: 36 passed/1 ignored plus 2 integration passed; server release filter: 27 passed/4 ignored. Feature-off API check and API/server all-target Clippy/fmt pass. No production auth, websocket, replay or dependency version changed. Generation/SQLite primitives remain unconnected to runtime; the supervised trial, read-only core, transfer/host integration, #236 repair, full failure table and VM acceptance are still outstanding. Porting the independent EAR2-02/EAR3-02 dev preservation regressions next; no prior assertion is marked obsolete.
kayg commented 2026-10-30 07:03:03 +00:00
Author
Owner
Copy link

Independent dev-preservation regressions are committed/pushed at 4177bdab2 (migration-journal isolation at 3fdacaeb5). EAR2-02 cancelled-logout and EAR3-02 same-size idle replay assertions pass; production auth/websocket/replay are unchanged. The #240 account-revocation union passed 5/5: each run has 35 distinct passing tests, 43 executions across account_events, per_account_revocation, review_account_scope, logout_commit, review_edge_revocation_tests, and review_r2; only the existing publication measurement remains ignored. All external Cargo.lock records match task-base dev exactly. Tracer TypeScript check passes after installing its unchanged frozen dependencies. Exact pinned static baseline/head measurements are running serially on 6by32-compute02; full fast gate follows. The runtime/host redesign remains incomplete; this is not a MERGE-ready updater or #236 repair implementation.

Independent dev-preservation regressions are committed/pushed at 4177bdab2 (migration-journal isolation at 3fdacaeb5). EAR2-02 cancelled-logout and EAR3-02 same-size idle replay assertions pass; production auth/websocket/replay are unchanged. The #240 account-revocation union passed 5/5: each run has 35 distinct passing tests, 43 executions across account_events, per_account_revocation, review_account_scope, logout_commit, review_edge_revocation_tests, and review_r2; only the existing publication measurement remains ignored. All external Cargo.lock records match task-base dev exactly. Tracer TypeScript check passes after installing its unchanged frozen dependencies. Exact pinned static baseline/head measurements are running serially on 6by32-compute02; full fast gate follows. The runtime/host redesign remains incomplete; this is not a MERGE-ready updater or #236 repair implementation.
kayg commented 2026-10-30 07:07:05 +00:00
Author
Owner
Copy link

Runtime integration constraint: current dev runtime.rs open_database uses SqliteSynchronous::Normal (line 778 in this worktree). The pinned SQLite engine explicitly documents WAL NORMAL as syncing before checkpoint, while FULL syncs after each commit (libsqlite3-sys 0.30.1 sqlite3.c:60689-60705). PERSIST_WAL/NO_CKPT_ON_CLOSE preserve sidecars; they do not strengthen commit durability. The new primitive tests use the engine's default FULL setting and prove read-only crash reads, not current production power-cut durability. The plan's acknowledged committed-B WAL assertions therefore still need explicit runtime durability/admission integration and the orchestrator's power-cut/performance proof; do not infer them from the primitive checks. No production synchronous setting or performance profile has been changed by this branch.

Runtime integration constraint: current dev runtime.rs open_database uses SqliteSynchronous::Normal (line 778 in this worktree). The pinned SQLite engine explicitly documents WAL NORMAL as syncing before checkpoint, while FULL syncs after each commit (libsqlite3-sys 0.30.1 sqlite3.c:60689-60705). PERSIST_WAL/NO_CKPT_ON_CLOSE preserve sidecars; they do not strengthen commit durability. The new primitive tests use the engine's default FULL setting and prove read-only crash reads, not current production power-cut durability. The plan's acknowledged committed-B WAL assertions therefore still need explicit runtime durability/admission integration and the orchestrator's power-cut/performance proof; do not infer them from the primitive checks. No production synchronous setting or performance profile has been changed by this branch.
kayg commented 2026-10-30 07:09:49 +00:00
Author
Owner
Copy link

Resuming implementation on edge-update-v2 at 4177bdab29, based on dev 2fb412d01d. Existing commits are foundational primitives and dev regression guards only; runtime update/recovery/lockstep/repair integration is not complete or merge-ready. The #240 reviewer union passed all five repetitions (35 unique tests / 43 executions per repetition). Sequential pinned baseline/head static builds are in progress. Continuing the approved c9c1877e9 plan and original review triggers; no perf VM contact or VM proof runs.

Resuming implementation on edge-update-v2 at 4177bdab2950442d1fcf0320ca1b41a53fcdabe3, based on dev 2fb412d01dcecb81f1f556d18d0350e70644a615. Existing commits are foundational primitives and dev regression guards only; runtime update/recovery/lockstep/repair integration is not complete or merge-ready. The #240 reviewer union passed all five repetitions (35 unique tests / 43 executions per repetition). Sequential pinned baseline/head static builds are in progress. Continuing the approved c9c1877e9 plan and original review triggers; no perf VM contact or VM proof runs.
kayg commented 2026-10-30 07:14:08 +00:00
Author
Owner
Copy link

Startup binding implementation detail for the approved fixed current/generations format: retain the existing public MANIFEST, MANIFEST.sig and signed VERSION names beside each generation executable. Preflight will verify both the selected exact image descriptor and /proc/self/exe against the same signed architecture artifact, signed version and launch.json version before exposing its pinned state directory. It must perform reads only and must never select current.prepared. This is a preflight primitive; runtime boot adoption, read-only serving and supervised health remain separate unfinished integration.

Startup binding implementation detail for the approved fixed current/generations format: retain the existing public MANIFEST, MANIFEST.sig and signed VERSION names beside each generation executable. Preflight will verify both the selected exact image descriptor and /proc/self/exe against the same signed architecture artifact, signed version and launch.json version before exposing its pinned state directory. It must perform reads only and must never select current.prepared. This is a preflight primitive; runtime boot adoption, read-only serving and supervised health remain separate unfinished integration.
kayg commented 2026-10-30 07:19:24 +00:00
Author
Owner
Copy link

Two foundational admission gaps reproduced before fixes: exhausted_writer_reservation_cannot_admit_a_trial failed (0 passed, 1 failed) because generation::Owner::prepare accepted writer_floor=2147483647; candidate_without_signed_metadata_cannot_be_prepared failed (0 passed, 1 failed) because publication synced image/DB/config but did not require the signed launch files. Preparation now refuses exhausted reservations and persists MANIFEST/MANIFEST.sig/VERSION with the launch set. Signed preflight functional tests: 4 passed, 0 failed (selected and actual image binding, version mismatch, candidate cold-entry refusal, unsafe metadata). Full touched-crate gates remain pending the sequential size build. These checks are primitives, not runtime startup/health acceptance.

Two foundational admission gaps reproduced before fixes: exhausted_writer_reservation_cannot_admit_a_trial failed (0 passed, 1 failed) because generation::Owner::prepare accepted writer_floor=2147483647; candidate_without_signed_metadata_cannot_be_prepared failed (0 passed, 1 failed) because publication synced image/DB/config but did not require the signed launch files. Preparation now refuses exhausted reservations and persists MANIFEST/MANIFEST.sig/VERSION with the launch set. Signed preflight functional tests: 4 passed, 0 failed (selected and actual image binding, version mismatch, candidate cold-entry refusal, unsafe metadata). Full touched-crate gates remain pending the sequential size build. These checks are primitives, not runtime startup/health acceptance.
kayg commented 2026-10-30 07:39:30 +00:00
Author
Owner
Copy link

Pushed portable-fixtures checkpoint 7845bc030a on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.

Pushed portable-fixtures checkpoint 7845bc030af3c4a3337d33f1924f6f1bdad98a1d on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.
kayg commented 2026-10-30 07:39:45 +00:00
Author
Owner
Copy link

Pushed writer-floor checkpoint 7dadfe720d on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.

Pushed writer-floor checkpoint 7dadfe720ddc070a404ba1f6946709c59f73dc76 on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.
kayg commented 2026-10-30 07:39:56 +00:00
Author
Owner
Copy link

Correction to the automatic checkpoint comments for 7845bc030 and 7dadfe720: their formatting, touched-crate Clippy and relevant functional tests passed. The sentence about launch-parser compile validation was premature template text; that separate parser checkpoint has not run yet. These two commits do not add the parser target. Its actual compile result will be recorded when reached.

Correction to the automatic checkpoint comments for 7845bc030 and 7dadfe720: their formatting, touched-crate Clippy and relevant functional tests passed. The sentence about launch-parser compile validation was premature template text; that separate parser checkpoint has not run yet. These two commits do not add the parser target. Its actual compile result will be recorded when reached.
kayg commented 2026-10-30 07:40:13 +00:00
Author
Owner
Copy link

Pushed signed-startup checkpoint d7e3413c44 on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.

Pushed signed-startup checkpoint d7e3413c4493d6a22ec8e6e557744e8fc5353e14 on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.
kayg commented 2026-10-30 07:42:09 +00:00
Author
Owner
Copy link

Pushed launch-parser checkpoint 2b77f504b5 on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.

Pushed launch-parser checkpoint 2b77f504b5f7d26e2177b479f91a698715b6dc39 on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit; launch-parser also passed the new harness compile check. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.
kayg commented 2026-10-30 07:43:42 +00:00
Author
Owner
Copy link

Pushed exhaustion-regressions checkpoint 6b4cab3dc9 on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.

Pushed exhaustion-regressions checkpoint 6b4cab3dc9a0d10084b73c2ebb4d7938ed5c3682 on edge-update-v2. Formatting, touched-crate all-target Clippy and relevant functional tests passed immediately before this commit. Exhaustion fixtures remain VM-only and were not run here. Runtime update/recovery/lockstep/repair integration remains incomplete; this is not merge-ready. Full branch-head scripts/verify fast is still required.
kayg commented 2026-10-30 07:53:04 +00:00
Author
Owner
Copy link

Resuming implementation on edge-update-v2 at 35b2234b7b; original dev base 2fb412d01d. The approved runtime updater remains incomplete: the current commits provide generation/SQLite/verifier primitives and retained dev regressions. Running the branch-head fast gate before further integration. No perf VM contact or execution.

Correction to earlier checkpoint template: the premature parser-compilation claim also applies to d7e3413c4, as well as 7845bc030 and 7dadfe720. The actual parser check passed before 2b77f504b; later recorded checks are valid.

Resuming implementation on edge-update-v2 at 35b2234b7b792e4ee8911754b7c1f0c4ace46cf9; original dev base 2fb412d01dcecb81f1f556d18d0350e70644a615. The approved runtime updater remains incomplete: the current commits provide generation/SQLite/verifier primitives and retained dev regressions. Running the branch-head fast gate before further integration. No perf VM contact or execution. Correction to earlier checkpoint template: the premature parser-compilation claim also applies to d7e3413c4, as well as 7845bc030 and 7dadfe720. The actual parser check passed before 2b77f504b; later recorded checks are valid.
kayg commented 2026-10-30 08:01:21 +00:00
Author
Owner
Copy link

Next approved reuse slice: retain only 31053e59b's activity.rs foreground/quiet-window coordinator, then port its two checkpoint-input continuity triggers onto dev's current socket fixture. Production websocket changes will be limited to handshake/attach/open/input foreground fencing required by plan invariant 2. Dev's while_authorized_operation account cursor, source-loss handling, renewal and replay logic will remain intact; the retained typed frame will stay inside that existing guard and recheck authority after cancellation. No old websocket file or branch merge. The new hooks compile out with the release feature. The first run of the retained socket tests will precede these hooks to verify their ordering failure.

This remains incomplete updater work; no runtime or VM acceptance claim.

Next approved reuse slice: retain only 31053e59b's activity.rs foreground/quiet-window coordinator, then port its two checkpoint-input continuity triggers onto dev's current socket fixture. Production websocket changes will be limited to handshake/attach/open/input foreground fencing required by plan invariant 2. Dev's while_authorized_operation account cursor, source-loss handling, renewal and replay logic will remain intact; the retained typed frame will stay inside that existing guard and recheck authority after cancellation. No old websocket file or branch merge. The new hooks compile out with the release feature. The first run of the retained socket tests will precede these hooks to verify their ordering failure. This remains incomplete updater work; no runtime or VM acceptance claim.
kayg commented 2026-10-30 08:15:31 +00:00
Author
Owner
Copy link

Checkpoint verified: edge-update-v2 head 35b2234b7b. scripts/verify fast exited 0. The complete unmodified transcript is attached below; Rust summary and final protocol-test output are quoted verbatim. No baseline exceptions were needed.

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

 39 pass
 0 fail
 50325 expect() calls
Ran 39 tests across 10 files. [4.76s]

verify-fast.log

Static images reproduced 21,443,728 / 19,614,152 B exactly (x86_64 / ARM; production trust, PT_INTERP absent). This is an incomplete foundation checkpoint, not an implemented updater or acceptance of runtime watchdog, read-only service, host lockstep or #236 repair. Continuing the approved foreground integration next.

Checkpoint verified: edge-update-v2 head 35b2234b7b792e4ee8911754b7c1f0c4ace46cf9. `scripts/verify fast` exited 0. The complete unmodified transcript is attached below; Rust summary and final protocol-test output are quoted verbatim. No baseline exceptions were needed. ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | PASS | +---------------------------+--------------+ ``` ```text 39 pass 0 fail 50325 expect() calls Ran 39 tests across 10 files. [4.76s] ``` [verify-fast.log](https://git.kayg.org/attachments/5750ac9a-645c-4993-bb2e-28aebc4132dd) Static images reproduced 21,443,728 / 19,614,152 B exactly (x86_64 / ARM; production trust, PT_INTERP absent). This is an incomplete foundation checkpoint, not an implemented updater or acceptance of runtime watchdog, read-only service, host lockstep or #236 repair. Continuing the approved foreground integration next.
kayg commented 2026-10-30 08:18:39 +00:00
Author
Owner
Copy link

Orchestrator-only storage primitive archive from clean head 35b2234b7b. SHA256 c7796db4738bf2945a2219a6be25fcea5d56fd1afb08a850fd92cb9ab8891970. No VM contact or execution by this job.

After copying the archive to a disposable perf working directory, extract it there and run:

tar -I zstd -xf storage-primitives-35b2234b7b79.tar.zst
/usr/local/bin/perf-run.sh -- ./storage-primitives-35b2234b7b79/run-functional
sudo /usr/local/bin/perf-run.sh -- unshare --mount ./storage-primitives-35b2234b7b79/run-exhaustion

The root command creates private 32 MiB/256-inode ext4 and tmpfs mounts and fills blocks/inodes separately, retaining fillers through repeated selection and immutable A reads. It runs only the two ignored storage primitive tests, not integrated daemon recovery. SCOPE.txt names the missing runtime/watchdog/reboot/power-cut/lockstep/repair acceptance. This is not the full failure-table archive; the required root warm-handoff proof is also not yet packaged.

Compile-out passed. The parser completed 10,000 bounded functional inputs with no failure; this was an uninstrumented run, with explicit missing sanitizer/coverage warnings, and is not coverage or performance evidence. Its remote-only dependency combination emitted the six already known dead-code warnings; the full fast gate was warning-clean under its checked feature set.

Orchestrator-only storage primitive archive from clean head 35b2234b7b792e4ee8911754b7c1f0c4ace46cf9. SHA256 `c7796db4738bf2945a2219a6be25fcea5d56fd1afb08a850fd92cb9ab8891970`. No VM contact or execution by this job. After copying the archive to a disposable perf working directory, extract it there and run: ```bash tar -I zstd -xf storage-primitives-35b2234b7b79.tar.zst /usr/local/bin/perf-run.sh -- ./storage-primitives-35b2234b7b79/run-functional sudo /usr/local/bin/perf-run.sh -- unshare --mount ./storage-primitives-35b2234b7b79/run-exhaustion ``` The root command creates private 32 MiB/256-inode ext4 and tmpfs mounts and fills blocks/inodes separately, retaining fillers through repeated selection and immutable A reads. It runs only the two ignored storage primitive tests, not integrated daemon recovery. `SCOPE.txt` names the missing runtime/watchdog/reboot/power-cut/lockstep/repair acceptance. This is not the full failure-table archive; the required root warm-handoff proof is also not yet packaged. Compile-out passed. The parser completed 10,000 bounded functional inputs with no failure; this was an uninstrumented run, with explicit missing sanitizer/coverage warnings, and is not coverage or performance evidence. Its remote-only dependency combination emitted the six already known dead-code warnings; the full fast gate was warning-clean under its checked feature set.
kayg commented 2026-10-30 08:20:21 +00:00
Author
Owner
Copy link

Correction to the preceding storage-archive comment: the upload was rejected with HTTP 422, so that comment did not attach an archive. The public /api/v1/settings/attachment response permits .gz/.tgz but not .zst (max_size 2048 MiB). The archive is 38,903,341 B; the rejected extension is the cause. Repacking the same fixture bytes as .tar.gz and will post the downloadable archive, new SHA256 and corrected extraction command. Do not use the preceding .tar.zst command as a completed handoff. This does not affect the successful fast-gate log attachment.

Correction to the preceding storage-archive comment: the upload was rejected with HTTP 422, so that comment did not attach an archive. The public /api/v1/settings/attachment response permits .gz/.tgz but not .zst (max_size 2048 MiB). The archive is 38,903,341 B; the rejected extension is the cause. Repacking the same fixture bytes as .tar.gz and will post the downloadable archive, new SHA256 and corrected extraction command. Do not use the preceding .tar.zst command as a completed handoff. This does not affect the successful fast-gate log attachment.
kayg commented 2026-10-30 08:31:17 +00:00
Author
Owner
Copy link

Corrected downloadable archive: the permitted .tar.gz upload succeeded. Its executable/library bytes are identical to the rejected .zst archive; the archive SHA and extraction command below supersede the earlier comment.

storage-primitives-35b2234b7b79.tar.gz
package-gates.log
Orchestrator-only storage primitive archive from clean head 35b2234b7b. SHA256 df54a4876e27ae565fb6d41462961c5b3092a73785ab9cbaed5b106216edff77. No VM contact or execution by this job.

After copying the archive to a disposable perf working directory, extract it there and run:

tar -xzf storage-primitives-35b2234b7b79.tar.gz
/usr/local/bin/perf-run.sh -- ./storage-primitives-35b2234b7b79/run-functional
sudo /usr/local/bin/perf-run.sh -- unshare --mount ./storage-primitives-35b2234b7b79/run-exhaustion

The root command creates private 32 MiB/256-inode ext4 and tmpfs mounts and fills blocks/inodes separately, retaining fillers through repeated selection and immutable A reads. It runs only the two ignored storage primitive tests, not integrated daemon recovery. SCOPE.txt names the missing runtime/watchdog/reboot/power-cut/lockstep/repair acceptance. This is not the full failure-table archive; the required root warm-handoff proof is also not yet packaged.

Compile-out passed. The parser completed 10,000 bounded functional inputs with no failure; this was an uninstrumented run, with explicit missing sanitizer/coverage warnings, and is not coverage or performance evidence. Its remote-only dependency combination emitted the six already known dead-code warnings; the full fast gate was warning-clean under its checked feature set.

Corrected downloadable archive: the permitted .tar.gz upload succeeded. Its executable/library bytes are identical to the rejected .zst archive; the archive SHA and extraction command below supersede the earlier comment. [storage-primitives-35b2234b7b79.tar.gz](https://git.kayg.org/attachments/2ed99c50-6f54-456a-9ca8-79f40fb08da7) [package-gates.log](https://git.kayg.org/attachments/788f2d23-e7cf-454c-b0c7-db96972dbe4c) Orchestrator-only storage primitive archive from clean head 35b2234b7b792e4ee8911754b7c1f0c4ace46cf9. SHA256 `df54a4876e27ae565fb6d41462961c5b3092a73785ab9cbaed5b106216edff77`. No VM contact or execution by this job. After copying the archive to a disposable perf working directory, extract it there and run: ```bash tar -xzf storage-primitives-35b2234b7b79.tar.gz /usr/local/bin/perf-run.sh -- ./storage-primitives-35b2234b7b79/run-functional sudo /usr/local/bin/perf-run.sh -- unshare --mount ./storage-primitives-35b2234b7b79/run-exhaustion ``` The root command creates private 32 MiB/256-inode ext4 and tmpfs mounts and fills blocks/inodes separately, retaining fillers through repeated selection and immutable A reads. It runs only the two ignored storage primitive tests, not integrated daemon recovery. `SCOPE.txt` names the missing runtime/watchdog/reboot/power-cut/lockstep/repair acceptance. This is not the full failure-table archive; the required root warm-handoff proof is also not yet packaged. Compile-out passed. The parser completed 10,000 bounded functional inputs with no failure; this was an uninstrumented run, with explicit missing sanitizer/coverage warnings, and is not coverage or performance evidence. Its remote-only dependency combination emitted the six already known dead-code warnings; the full fast gate was warning-clean under its checked feature set.
kayg commented 2026-10-30 08:39:22 +00:00
Author
Owner
Copy link

Resuming edge-update-v2 from base 2fb412d01d; current pushed head 942fdceaa. Retained only the approved foreground coordinator from 31053e59b, behind socket-host. No production websocket hooks yet. Per-slice cargo fmt --all --check, API clippy (socket-host,release-verify) with -D warnings and API library tests exited 0: 41 passed; 0 failed; 2 ignored. Runtime generation startup/watchdog/read-only integration, host lockstep/repair and full failure-table proof remain incomplete. Next: reproduce held-checkpoint foreground input failure before hooks. Previous full fast gate applies only to 35b2234b7.

Resuming edge-update-v2 from base 2fb412d01dcecb81f1f556d18d0350e70644a615; current pushed head 942fdceaa. Retained only the approved foreground coordinator from 31053e59b, behind socket-host. No production websocket hooks yet. Per-slice cargo fmt --all --check, API clippy (socket-host,release-verify) with -D warnings and API library tests exited 0: 41 passed; 0 failed; 2 ignored. Runtime generation startup/watchdog/read-only integration, host lockstep/repair and full failure-table proof remain incomplete. Next: reproduce held-checkpoint foreground input failure before hooks. Previous full fast gate applies only to 35b2234b7.
kayg commented 2026-10-30 08:50:10 +00:00
Author
Owner
Copy link

Foreground integration red evidence at 942fdceaa: the retained plain-input test failed with input crossed the held foreground fence; the WAL/session-renewal case failed with checkpoint renewal closed the original browser. The original hook revision then passed both tests and server all-target clippy. A revision reusing the existing decoded frame (no duplicate parse per keystroke), plus a preservation test for logout while the frame is retained, is queued for verification. Dev while_authorized_operation/account publication/source-loss/renewal machinery is unchanged. These are functional ordering checks, not perf-VM latency evidence. Runtime startup/watchdog/read-only and host lockstep/repair remain incomplete.

Foreground integration red evidence at 942fdceaa: the retained plain-input test failed with `input crossed the held foreground fence`; the WAL/session-renewal case failed with `checkpoint renewal closed the original browser`. The original hook revision then passed both tests and server all-target clippy. A revision reusing the existing decoded frame (no duplicate parse per keystroke), plus a preservation test for logout while the frame is retained, is queued for verification. Dev while_authorized_operation/account publication/source-loss/renewal machinery is unchanged. These are functional ordering checks, not perf-VM latency evidence. Runtime startup/watchdog/read-only and host lockstep/repair remain incomplete.
kayg commented 2026-10-30 09:14:29 +00:00
Author
Owner
Copy link

Default-feature server-suite finding: 423 passed; 2 failed; 25 ignored. Both failures are review_subscription_refusal::{oversized_refusal_cannot_reinstall_a_queued_mesh_subscription,review_oversized_replacement_ends_the_previous_mesh_subscription}, line 179: actual plugin unavailable, expected mesh unavailable. Reproduced the identical pair on untouched dev 2fb412d01 and this branch in one build slot: each targeted run has 1 passed; 2 failed. This is an error-text assertion, not a timeout/load exception, and is not being counted as green. The test file and production subscription code are unchanged. Next run uses shipping remote features (as the full workspace gate does); no unrelated production behavior or assertions are changed. Foreground tests themselves passed all 3, and server all-target clippy passed.

subscription-baseline-default.log
subscription-branch-default.log
foreground-server-suite.log

Default-feature server-suite finding: 423 passed; 2 failed; 25 ignored. Both failures are review_subscription_refusal::{oversized_refusal_cannot_reinstall_a_queued_mesh_subscription,review_oversized_replacement_ends_the_previous_mesh_subscription}, line 179: actual `plugin unavailable`, expected `mesh unavailable`. Reproduced the identical pair on untouched dev 2fb412d01 and this branch in one build slot: each targeted run has 1 passed; 2 failed. This is an error-text assertion, not a timeout/load exception, and is not being counted as green. The test file and production subscription code are unchanged. Next run uses shipping remote features (as the full workspace gate does); no unrelated production behavior or assertions are changed. Foreground tests themselves passed all 3, and server all-target clippy passed. [subscription-baseline-default.log](https://git.kayg.org/attachments/d83c6612-fde0-485d-98c1-59af6710e591) [subscription-branch-default.log](https://git.kayg.org/attachments/c08b37eb-fc23-479f-a27a-e1d6e2d3d63d) [foreground-server-suite.log](https://git.kayg.org/attachments/a4b18320-c90b-4672-8c70-c34aae61b932)
kayg commented 2026-10-30 09:24:39 +00:00
Author
Owner
Copy link

Continuing edge-update-v2 at 942fdceaac (base dev 2fb412d01d). Foreground socket hooks remain uncommitted while their broad gate runs. All three targeted tests passed, including cancellation by committed logout while input waits behind the checkpoint fence. The hooks classify the existing decoded frame once; while_authorized_operation remains byte-identical to base dev.

The standalone server remote feature enables host remote without host mesh and hits two unchanged unnecessary_wraps lints in infraternal-agent/src/plugins.rs:123/133. The gate is now using remote,infraternal-agent/mesh to match shipping host capabilities; clippy passed and the full server suite is running. The previously reported pair of default-feature subscription assertion failures remains a reproduced dev-baseline finding, not a passing gate.

Next slice: real-SQLite read-only auth tests before runtime integration. The branch is still an incomplete generation foundation; no integrated updater or failure-table acceptance is claimed.

Continuing edge-update-v2 at 942fdceaaca5ac260c1d7bfb69200225b742fb73 (base dev 2fb412d01dcecb81f1f556d18d0350e70644a615). Foreground socket hooks remain uncommitted while their broad gate runs. All three targeted tests passed, including cancellation by committed logout while input waits behind the checkpoint fence. The hooks classify the existing decoded frame once; while_authorized_operation remains byte-identical to base dev. The standalone server remote feature enables host remote without host mesh and hits two unchanged unnecessary_wraps lints in infraternal-agent/src/plugins.rs:123/133. The gate is now using remote,infraternal-agent/mesh to match shipping host capabilities; clippy passed and the full server suite is running. The previously reported pair of default-feature subscription assertion failures remains a reproduced dev-baseline finding, not a passing gate. Next slice: real-SQLite read-only auth tests before runtime integration. The branch is still an incomplete generation foundation; no integrated updater or failure-table acceptance is claimed.
kayg commented 2026-10-30 09:30:32 +00:00
Author
Owner
Copy link

Foreground socket slice pushed: e3f0d1330 (D251, #211). The existing decoded frame waits within dev's account-scoped authorization watchdog until preparation cancels and joins; a fresh deadline check follows fence release. Handshake/attach/open lifetimes use the retained coordinator. The shared sequence bounds preserve dev's input admission and prevent acknowledged replay postponing updates. No prior review test is obsolete in this slice.

Shipping-feature server clippy and fmt passed. Full server suite:

test result: ok. 672 passed; 0 failed; 52 ignored; 0 measured; 0 filtered out; finished in 308.56s

The duration is a functional gate transcript, not a performance claim. Both previously reported default-feature subscription assertions pass with shipping features. The five #240 repetitions are still running. Read-only auth acceptance tests have now been added as a separate uncommitted red slice; generation runtime/watchdog/failure-table/repair work remains incomplete.

foreground-server-remote-suite.log
checkpoint-single-decode.log

Foreground socket slice pushed: e3f0d1330 (D251, #211). The existing decoded frame waits within dev's account-scoped authorization watchdog until preparation cancels and joins; a fresh deadline check follows fence release. Handshake/attach/open lifetimes use the retained coordinator. The shared sequence bounds preserve dev's input admission and prevent acknowledged replay postponing updates. No prior review test is obsolete in this slice. Shipping-feature server clippy and fmt passed. Full server suite: ``` test result: ok. 672 passed; 0 failed; 52 ignored; 0 measured; 0 filtered out; finished in 308.56s ``` The duration is a functional gate transcript, not a performance claim. Both previously reported default-feature subscription assertions pass with shipping features. The five #240 repetitions are still running. Read-only auth acceptance tests have now been added as a separate uncommitted red slice; generation runtime/watchdog/failure-table/repair work remains incomplete. [foreground-server-remote-suite.log](https://git.kayg.org/attachments/a78d5541-248f-4832-9bfd-943ebf593e12) [checkpoint-single-decode.log](https://git.kayg.org/attachments/37086943-7dbc-491b-b2b0-90a40f45d2e4)
kayg commented 2026-10-30 09:35:50 +00:00
Author
Owner
Copy link

Foreground preservation gate finished with exit 0. All five #240 reviewer-union repetitions passed (45 passed across six filters in each repetition; one intentionally ignored measurement). Server no-default-feature compile-out also passed. This validates pushed socket slice e3f0d1330; later read-only work will require fresh preservation checks. The full fast gate still applies only to foundation head 35b2234b7, not this head.

socket-240-summary.txt

Foreground preservation gate finished with exit 0. All five #240 reviewer-union repetitions passed (45 passed across six filters in each repetition; one intentionally ignored measurement). Server no-default-feature compile-out also passed. This validates pushed socket slice e3f0d1330; later read-only work will require fresh preservation checks. The full fast gate still applies only to foundation head 35b2234b7, not this head. [socket-240-summary.txt](https://git.kayg.org/attachments/9a671cca-1f5f-4215-ac84-122832e5680b)
kayg commented 2026-10-30 09:42:46 +00:00
Author
Owner
Copy link

Read-only auth red evidence, on pushed socket head e3f0d1330 plus the explicit constructor seam and new acceptance tests: opening initialized SQLite under PRAGMA query_only=ON fails with SQLite code 8 (attempt to write a readonly database). The exact constructor test reports 0 passed, 1 failed. HTTP identity/mutation and pending-cookie checks independently fail at that same constructor step.

The shared build slot is queued. The already compiled exact single tests ran directly under the shared rules' single-unit-test exception, without a build or suite bypass. Full server auth/clippy gates remain slot-wrapped. Proposed implementation now skips migrations only on explicit read-only admission, validates the complete checksum journal with bounded SELECTs, reads sessions without sliding/deletion and refuses HTTP mutations before handlers. Normal migration and committed logout publication remain in their existing paths. This is an uncommitted slice, not production fallback or completed runtime recovery.

readonly-auth-single-red.log

Read-only auth red evidence, on pushed socket head e3f0d1330 plus the explicit constructor seam and new acceptance tests: opening initialized SQLite under PRAGMA query_only=ON fails with SQLite code 8 (attempt to write a readonly database). The exact constructor test reports 0 passed, 1 failed. HTTP identity/mutation and pending-cookie checks independently fail at that same constructor step. The shared build slot is queued. The already compiled exact single tests ran directly under the shared rules' single-unit-test exception, without a build or suite bypass. Full server auth/clippy gates remain slot-wrapped. Proposed implementation now skips migrations only on explicit read-only admission, validates the complete checksum journal with bounded SELECTs, reads sessions without sliding/deletion and refuses HTTP mutations before handlers. Normal migration and committed logout publication remain in their existing paths. This is an uncommitted slice, not production fallback or completed runtime recovery. [readonly-auth-single-red.log](https://git.kayg.org/attachments/2d5a6879-6726-41c8-9606-9acd9fef0a77)
kayg commented 2026-10-30 10:01:15 +00:00
Author
Owner
Copy link

Build capacity checkpoint: the slot-wrapped read-only auth gate has been queued since 09:35:21 UTC; at 10:00:56 UTC its log is still empty. No second heavy command was started, and no shared lock/process was changed. The already compiled single-test red evidence is attached above. Foreground socket slice e3f0d1330 is pushed and its five #240 repetitions passed; the auth changes remain uncommitted pending their gate. Runtime tests and the #236 route-binding reuse audit were prepared while waiting. Continuing to wait for the existing build-slot wrapper; this is not a test failure or a completed slice.

Build capacity checkpoint: the slot-wrapped read-only auth gate has been queued since 09:35:21 UTC; at 10:00:56 UTC its log is still empty. No second heavy command was started, and no shared lock/process was changed. The already compiled single-test red evidence is attached above. Foreground socket slice e3f0d1330 is pushed and its five #240 repetitions passed; the auth changes remain uncommitted pending their gate. Runtime tests and the #236 route-binding reuse audit were prepared while waiting. Continuing to wait for the existing build-slot wrapper; this is not a test failure or a completed slice.
kayg commented 2026-10-30 10:03:09 +00:00
Author
Owner
Copy link

Required integration oracles beyond the current primitives (#211):

  1. A stale current.prepared cannot prove A is frozen: cancellation or kernel-refused exec can resume A and acknowledge new WAL writes while a prospective pointer remains. Under later full-storage restart, startup must not open that now-mutable selected A immutable and omit its WAL. Add the exact sequence (prepare; refuse/abort exec; A acknowledges a new edit; storage becomes full; cold restart) before admission integration. Frozen retained state and mutable selected state need explicit, validated distinction; temporary names alone never confer state authority.
  2. Prior checksum/manual rollback regressions require a durable digest for the retained database/configuration, not just signed executable verification. Current Generation has only id/version/predecessor/writer_floor, and startup preflight authenticates executable/VERSION only. Candidate launch metadata can retain its predecessor snapshot digest (after checkpoint/fences, before trial), so B's later mutable edits do not invalidate the retained-A integrity binding. Do not checksum mutable current data as if it were a permanently immutable image. B->C preparation failure must retain B->A rollback binding.
  3. Continuous kernel ownership across service -> independent watchdog -> committed service needs descriptor transfer, not dropping/reacquiring across a second-writer gap. Current Owner is only a storage primitive, not runtime ownership. Owner::commit currently leaves prepared=true and expects one owner per transaction; integrate rearming/transfer deliberately.
  4. Real 32 MiB filesystem cases cannot contain two ~22 MiB shipping images plus paired databases. Test state-full and image-full volumes explicitly. Root-only bind mounts of separately owned/signed image files can keep actual executable identities while a bounded data volume fills, or candidate admission should refuse before staging on a single 32 MiB volume. Do not use tiny stand-in binaries as proof of the shipping runtime.
    These are implementation requirements/proposed test oracles, not implemented or proven behavior.
Required integration oracles beyond the current primitives (#211): 1. A stale current.prepared cannot prove A is frozen: cancellation or kernel-refused exec can resume A and acknowledge new WAL writes while a prospective pointer remains. Under later full-storage restart, startup must not open that now-mutable selected A immutable and omit its WAL. Add the exact sequence (prepare; refuse/abort exec; A acknowledges a new edit; storage becomes full; cold restart) before admission integration. Frozen retained state and mutable selected state need explicit, validated distinction; temporary names alone never confer state authority. 2. Prior checksum/manual rollback regressions require a durable digest for the retained database/configuration, not just signed executable verification. Current Generation has only id/version/predecessor/writer_floor, and startup preflight authenticates executable/VERSION only. Candidate launch metadata can retain its predecessor snapshot digest (after checkpoint/fences, before trial), so B's later mutable edits do not invalidate the retained-A integrity binding. Do not checksum mutable current data as if it were a permanently immutable image. B->C preparation failure must retain B->A rollback binding. 3. Continuous kernel ownership across service -> independent watchdog -> committed service needs descriptor transfer, not dropping/reacquiring across a second-writer gap. Current Owner is only a storage primitive, not runtime ownership. Owner::commit currently leaves prepared=true and expects one owner per transaction; integrate rearming/transfer deliberately. 4. Real 32 MiB filesystem cases cannot contain two ~22 MiB shipping images plus paired databases. Test state-full and image-full volumes explicitly. Root-only bind mounts of separately owned/signed image files can keep actual executable identities while a bounded data volume fills, or candidate admission should refuse before staging on a single 32 MiB volume. Do not use tiny stand-in binaries as proof of the shipping runtime. These are implementation requirements/proposed test oracles, not implemented or proven behavior.
kayg commented 2026-10-30 10:13:32 +00:00
Author
Owner
Copy link

Auth slice pushed: 22a9b107c. Explicit read-only auth validates the complete bounded migration journal without a migration writer, reads live or restricted pending sessions without sliding/deleting rows, skips background renewal and refuses HTTP mutations without Set-Cookie. Normal origin checks, migration ordering, normal session statements, committed logout publication and live-expiry reads remain in their existing paths. No prior review test is obsolete.

Per-slice gate exited 0: fmt, shipping-feature server all-target clippy with -D warnings, five new read-only tests, broader auth suite, server compile-out.

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 3.03s
test result: ok. 233 passed; 0 failed; 19 ignored; 0 measured; 477 filtered out; finished in 251.16s
Read-only auth slice gates: PASS

Durations above are functional transcripts, not performance evidence. The full fast gate remains at the earlier foundation head and will be rerun after integration. This constructor alone is not production fallback: physically read-only runtime admission, sockets, watchdog, lockstep and #236 repair remain incomplete. Next: actual router restart with frozen main DB versus committed latest-WAL state, with unchanged file names/bytes.

readonly-auth-gates.log
readonly-auth-suite.log

Auth slice pushed: 22a9b107c. Explicit read-only auth validates the complete bounded migration journal without a migration writer, reads live or restricted pending sessions without sliding/deleting rows, skips background renewal and refuses HTTP mutations without Set-Cookie. Normal origin checks, migration ordering, normal session statements, committed logout publication and live-expiry reads remain in their existing paths. No prior review test is obsolete. Per-slice gate exited 0: fmt, shipping-feature server all-target clippy with -D warnings, five new read-only tests, broader auth suite, server compile-out. ``` test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 724 filtered out; finished in 3.03s test result: ok. 233 passed; 0 failed; 19 ignored; 0 measured; 477 filtered out; finished in 251.16s Read-only auth slice gates: PASS ``` Durations above are functional transcripts, not performance evidence. The full fast gate remains at the earlier foundation head and will be rerun after integration. This constructor alone is not production fallback: physically read-only runtime admission, sockets, watchdog, lockstep and #236 repair remain incomplete. Next: actual router restart with frozen main DB versus committed latest-WAL state, with unchanged file names/bytes. [readonly-auth-gates.log](https://git.kayg.org/attachments/c5d5d3a5-6940-4a33-86a2-fbcca4048077) [readonly-auth-suite.log](https://git.kayg.org/attachments/a8636239-cee9-4a26-b784-154a47d09eea)
kayg commented 2026-10-30 10:25:05 +00:00
Author
Owner
Copy link

Continuing implementation on edge-update-v2, base dev 2fb412d01d, pushed head 22a9b107c. Current slice: physical read-only HTTP/router startup over frozen predecessor and persistent committed WAL. The fallback constructor is not yet wired to production generation startup; socket/plugin admission, watchdog/health/commit and #236 repair remain outstanding. One broad gate is queued through build-slot; the new single-unit regression is being compiled under the shared single-test exception. No external host contact or deployment.

Continuing implementation on edge-update-v2, base dev 2fb412d01dcecb81f1f556d18d0350e70644a615, pushed head 22a9b107c. Current slice: physical read-only HTTP/router startup over frozen predecessor and persistent committed WAL. The fallback constructor is not yet wired to production generation startup; socket/plugin admission, watchdog/health/commit and #236 repair remain outstanding. One broad gate is queued through build-slot; the new single-unit regression is being compiled under the shared single-test exception. No external host contact or deployment.
kayg commented 2026-10-30 10:36:40 +00:00
Author
Owner
Copy link

Read-only storage/router slice pushed at 2fca4ec1b. The physical regression first failed on normal startup with SQLITE_READONLY (code 8). The explicit constructor now reads initialized frozen-main or committed latest-WAL state without migrations, chmod/create, setup tokens, connection recovery or optional workers. Three restarts in each mode preserve every filename and byte and the directory permissions. No prior review test is obsolete.

Per-slice gate exited 0: fmt, shipping-feature server all-target clippy (-D warnings), physical regression, runtime filter and server compile-out:

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 730 filtered out; finished in 3.33s
test result: ok. 104 passed; 0 failed; 13 ignored; 0 measured; 614 filtered out; finished in 8.28s
Read-only storage/router slice gates: PASS

Durations are functional gate transcripts, not performance evidence. One earlier clippy invocation rejected the lifecycle test's length; the explicit test-local lint allowance was added and the complete per-slice gate rerun. Existing pinned SQLite/WAL support is enabled through the release feature; no dependency versions changed. Full fast, current-head sizes and automatic generation admission remain outstanding. The plugin admission regression is now red independently (unsupported feature remained enabled); socket/plugin integration and the watchdog/lockstep/repair work remain incomplete.

readonly-runtime-single-red.log
readonly-runtime-recheck.log
readonly-runtime-suite.log

Read-only storage/router slice pushed at 2fca4ec1b. The physical regression first failed on normal startup with SQLITE_READONLY (code 8). The explicit constructor now reads initialized frozen-main or committed latest-WAL state without migrations, chmod/create, setup tokens, connection recovery or optional workers. Three restarts in each mode preserve every filename and byte and the directory permissions. No prior review test is obsolete. Per-slice gate exited 0: fmt, shipping-feature server all-target clippy (-D warnings), physical regression, runtime filter and server compile-out: ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 730 filtered out; finished in 3.33s test result: ok. 104 passed; 0 failed; 13 ignored; 0 measured; 614 filtered out; finished in 8.28s Read-only storage/router slice gates: PASS ``` Durations are functional gate transcripts, not performance evidence. One earlier clippy invocation rejected the lifecycle test's length; the explicit test-local lint allowance was added and the complete per-slice gate rerun. Existing pinned SQLite/WAL support is enabled through the release feature; no dependency versions changed. Full fast, current-head sizes and automatic generation admission remain outstanding. The plugin admission regression is now red independently (unsupported feature remained enabled); socket/plugin integration and the watchdog/lockstep/repair work remain incomplete. [readonly-runtime-single-red.log](https://git.kayg.org/attachments/b24ad23f-8068-447e-82b5-04f9b3cee4d0) [readonly-runtime-recheck.log](https://git.kayg.org/attachments/f851e292-c4e1-4dca-afc6-2728d6032458) [readonly-runtime-suite.log](https://git.kayg.org/attachments/d7feadab-3462-40dc-875c-e0889b5a31d5)
kayg commented 2026-10-30 10:44:19 +00:00
Author
Owner
Copy link

Continuous-owner reuse audit (#211, plan invariant 1): generation::Owner currently stores nix::fcntl::Flock. The pinned nix 0.30 source fcntl.rs:1041-1046 implements Drop by explicitly calling flock(fd, LOCK_UN). A duplicated or SCM_RIGHTS-transferred descriptor shares that open file description, so merely retaining a duplicate in the watchdog does not preserve exclusivity when the service drops its Flock guard. Before runtime transfer integration, add a real descriptor-lifetime regression (duplicate held lock; drop original owner; reject a competing acquisition until the last duplicate closes) and use close-only lock ownership. No transfer is currently implemented; this is a source-backed integration requirement, not a proven runtime failure or completed fix.

Continuous-owner reuse audit (#211, plan invariant 1): generation::Owner currently stores nix::fcntl::Flock<File>. The pinned nix 0.30 source fcntl.rs:1041-1046 implements Drop by explicitly calling flock(fd, LOCK_UN). A duplicated or SCM_RIGHTS-transferred descriptor shares that open file description, so merely retaining a duplicate in the watchdog does not preserve exclusivity when the service drops its Flock guard. Before runtime transfer integration, add a real descriptor-lifetime regression (duplicate held lock; drop original owner; reject a competing acquisition until the last duplicate closes) and use close-only lock ownership. No transfer is currently implemented; this is a source-backed integration requirement, not a proven runtime failure or completed fix.
kayg commented 2026-10-30 10:50:07 +00:00
Author
Owner
Copy link

Read-only feature admission pushed in two logical steps: 418f58ed0 (default-off Plugin capability and inventory opt-in), c931cf504 (runtime discovery, stored-switch filtering, switch/node refusal). The real-SQLite regression first failed because an unsupported feature remained enabled. Recovery now keeps the inventory reader only when its stored setting permits, preserves every stored switch, rejects switches before a writer wait and refuses node observers/authority-change callbacks. Core uses the generic capability, not plugin names. No prior review test is obsolete.

Per-slice fmt and API/remote/server all-target clippy (-D warnings) passed. API: 41 passed, 0 failed, 2 ignored. Inventory: 4 remote + 23 server passed, 0 failed, 2 server measurements ignored. Server plugin lifecycle: 9 passed, 0 failed. Server no-default and release-only compile-out plus remote compile-out passed. Two earlier standalone remote invocations omitted its existing test-support and host/runtime features; the successful combined invocation matches the shipping dependency graph. No production feature/dependency change was made to satisfy those test-only compilation requirements.

The next physical socket test is red at the absent /v1/ws route (404); socket integration remains uncommitted while its broader gate runs. Full fast, final sizes and generation/watchdog/lockstep/repair integration remain outstanding.

readonly-plugins-single-red.log
readonly-plugins-shipping-gates.log
readonly-plugins-api-suite.log
readonly-plugins-inventory-suite.log
readonly-plugins-server-suite.log

Read-only feature admission pushed in two logical steps: 418f58ed0 (default-off Plugin capability and inventory opt-in), c931cf504 (runtime discovery, stored-switch filtering, switch/node refusal). The real-SQLite regression first failed because an unsupported feature remained enabled. Recovery now keeps the inventory reader only when its stored setting permits, preserves every stored switch, rejects switches before a writer wait and refuses node observers/authority-change callbacks. Core uses the generic capability, not plugin names. No prior review test is obsolete. Per-slice fmt and API/remote/server all-target clippy (-D warnings) passed. API: 41 passed, 0 failed, 2 ignored. Inventory: 4 remote + 23 server passed, 0 failed, 2 server measurements ignored. Server plugin lifecycle: 9 passed, 0 failed. Server no-default and release-only compile-out plus remote compile-out passed. Two earlier standalone remote invocations omitted its existing test-support and host/runtime features; the successful combined invocation matches the shipping dependency graph. No production feature/dependency change was made to satisfy those test-only compilation requirements. The next physical socket test is red at the absent /v1/ws route (404); socket integration remains uncommitted while its broader gate runs. Full fast, final sizes and generation/watchdog/lockstep/repair integration remain outstanding. [readonly-plugins-single-red.log](https://git.kayg.org/attachments/7cb02b72-5e5c-4f7e-b873-ac3f1449538c) [readonly-plugins-shipping-gates.log](https://git.kayg.org/attachments/4c424ea5-38f3-4d3e-a687-fcb04ca0f86b) [readonly-plugins-api-suite.log](https://git.kayg.org/attachments/9a255aca-39d6-49e4-b904-7db598bb70fa) [readonly-plugins-inventory-suite.log](https://git.kayg.org/attachments/3cb7b7ca-c76f-4fc0-91f1-2e9f0335b261) [readonly-plugins-server-suite.log](https://git.kayg.org/attachments/79daac70-738d-406f-bfa0-c11a6dc92e91)
kayg commented 2026-10-30 10:59:32 +00:00
Author
Owner
Copy link

Continuing edge-update-v2 at c931cf5049, task base dev 2fb412d01d. Read-only socket gate exited 0: 679 server tests passed, 0 failed, 52 existing measurements ignored; physical six-restart HTTP/socket fixture passed, fmt/clippy and both server compile-out checks passed. Five fresh #240 reviewer-union repetitions and the release crate gate are now queued serially through build-slot before committing the pending slices.

Retained-state regression now reproduces the previously recorded missing integrity binding: candidate_launch_retains_predecessor_database_and_configuration_digests failed because launch.json lacked a retained database digest. Proposed implementation stores the checkpointed predecessor database/config digests in its successor launch metadata; selected mutable data is not permanently checksummed. Preparation and commit recheck the frozen predecessor; historical selection verifies that binding without writes and rejects nonempty WAL. Current tests additionally check changed retained files and failed B->C preparation preserving B->A. These changes remain uncommitted pending their broader gate. Production generation admission, watchdog transfer, lockstep, #236 repair and final acceptance remain incomplete. No VM proof or final fast-gate claim.

Continuing edge-update-v2 at c931cf50491b8c75710e358e0d8d415162b7f2cf, task base dev 2fb412d01dcecb81f1f556d18d0350e70644a615. Read-only socket gate exited 0: 679 server tests passed, 0 failed, 52 existing measurements ignored; physical six-restart HTTP/socket fixture passed, fmt/clippy and both server compile-out checks passed. Five fresh #240 reviewer-union repetitions and the release crate gate are now queued serially through build-slot before committing the pending slices. Retained-state regression now reproduces the previously recorded missing integrity binding: candidate_launch_retains_predecessor_database_and_configuration_digests failed because launch.json lacked a retained database digest. Proposed implementation stores the checkpointed predecessor database/config digests in its successor launch metadata; selected mutable data is not permanently checksummed. Preparation and commit recheck the frozen predecessor; historical selection verifies that binding without writes and rejects nonempty WAL. Current tests additionally check changed retained files and failed B->C preparation preserving B->A. These changes remain uncommitted pending their broader gate. Production generation admission, watchdog transfer, lockstep, #236 repair and final acceptance remain incomplete. No VM proof or final fast-gate claim.
kayg commented 2026-10-30 11:01:46 +00:00
Author
Owner
Copy link

Read-only socket slice committed and pushed at 03511ac2b. Recovery uses the shared authenticated socket/parser and plugin dispatcher, ephemeral non-resumable Welcome, no metadata cleanup/renewal/inventory writer, read-action admission and stream-scoped terminal refusal. Physical HTTP/socket regression: 3 frozen-main + 3 latest-WAL restarts preserve all filenames, bytes and permissions. No prior review test is obsolete.

Per-slice gate exited 0: fmt, shipping-feature all-target clippy (-D warnings), physical regression, full server library suite and no-default/release-only compile-out.

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 730 filtered out; finished in 52.61s
test result: ok. 679 passed; 0 failed; 52 ignored; 0 measured; 0 filtered out; finished in 441.18s
Read-only socket integration gates: PASS

Durations above are functional transcripts only. Full fast, exact final sizes, automatic generation admission, watchdog, lockstep and #236 repair are still outstanding. The next release-crate gate caught a test's underscore-field access; the ownership descriptor now has an explicit duplication accessor and the complete release gate/five #240 repetitions are being rerun. No final acceptance claim.

readonly-sockets-single-red.log
readonly-sockets-recheck.log
readonly-sockets-server-suite.log

Read-only socket slice committed and pushed at 03511ac2b. Recovery uses the shared authenticated socket/parser and plugin dispatcher, ephemeral non-resumable Welcome, no metadata cleanup/renewal/inventory writer, read-action admission and stream-scoped terminal refusal. Physical HTTP/socket regression: 3 frozen-main + 3 latest-WAL restarts preserve all filenames, bytes and permissions. No prior review test is obsolete. Per-slice gate exited 0: fmt, shipping-feature all-target clippy (-D warnings), physical regression, full server library suite and no-default/release-only compile-out. ``` test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 730 filtered out; finished in 52.61s test result: ok. 679 passed; 0 failed; 52 ignored; 0 measured; 0 filtered out; finished in 441.18s Read-only socket integration gates: PASS ``` Durations above are functional transcripts only. Full fast, exact final sizes, automatic generation admission, watchdog, lockstep and #236 repair are still outstanding. The next release-crate gate caught a test's underscore-field access; the ownership descriptor now has an explicit duplication accessor and the complete release gate/five #240 repetitions are being rerun. No final acceptance claim. [readonly-sockets-single-red.log](https://git.kayg.org/attachments/78160082-9c49-4655-b066-e9a87fc26392) [readonly-sockets-recheck.log](https://git.kayg.org/attachments/07718bfe-6417-411e-8b05-011baf296038) [readonly-sockets-server-suite.log](https://git.kayg.org/attachments/f115724d-2e67-4950-ba42-897b2eb63e9a)
kayg commented 2026-10-30 11:08:52 +00:00
Author
Owner
Copy link

Two prerequisite slices committed/pushed: 8d34e1554 fixes installation lock lifetime; 6ef607371 binds retained predecessor database/configuration bytes. The old Flock drop explicitly unlocked a still-duplicated descriptor (red regression); close-only File ownership now refuses competitors until the last duplicate closes. The new snapshot regression also first failed at absent launch metadata. Preparation/commit and historical selection verify retained digests and reject nonempty WAL. Mutable selected B edits remain valid; failed B->C preparation preserves B->A state and binding. Neither slice is production watchdog/manual-rollback integration. No prior review test is obsolete.

Per-slice fmt, release all-target clippy (-D warnings), full release tests and compile-out exited 0:

test result: ok. 27 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 2.28s
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.59s
test result: ok. 2 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.08s

Functional transcripts only. The subsequent #240 run passed two complete repetitions; a third compiled listener source while it was being edited and failed on a misplaced field, so it does not satisfy five complete repetitions. The field was corrected and the new listener gate is running; five fresh repetitions will follow settled edits. Full fast/final sizes and the core integration requirements remain outstanding.

lock-descriptor-single-red.log
lock-descriptor-single-green.log
retained-binding-single-red.log
retained-binding-single-green.log
lock-descriptor-release-suite.log

Two prerequisite slices committed/pushed: 8d34e1554 fixes installation lock lifetime; 6ef607371 binds retained predecessor database/configuration bytes. The old Flock drop explicitly unlocked a still-duplicated descriptor (red regression); close-only File ownership now refuses competitors until the last duplicate closes. The new snapshot regression also first failed at absent launch metadata. Preparation/commit and historical selection verify retained digests and reject nonempty WAL. Mutable selected B edits remain valid; failed B->C preparation preserves B->A state and binding. Neither slice is production watchdog/manual-rollback integration. No prior review test is obsolete. Per-slice fmt, release all-target clippy (-D warnings), full release tests and compile-out exited 0: ``` test result: ok. 27 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 2.28s test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.59s test result: ok. 2 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.08s ``` Functional transcripts only. The subsequent #240 run passed two complete repetitions; a third compiled listener source while it was being edited and failed on a misplaced field, so it does not satisfy five complete repetitions. The field was corrected and the new listener gate is running; five fresh repetitions will follow settled edits. Full fast/final sizes and the core integration requirements remain outstanding. [lock-descriptor-single-red.log](https://git.kayg.org/attachments/58817ca0-e040-4dd5-acaa-793b417dfc0b) [lock-descriptor-single-green.log](https://git.kayg.org/attachments/5028b613-9456-433f-9720-9247339349e4) [retained-binding-single-red.log](https://git.kayg.org/attachments/d64a8601-fcff-4564-9d0e-7d7d219242ac) [retained-binding-single-green.log](https://git.kayg.org/attachments/9f742a10-d404-400f-9104-969cade02528) [lock-descriptor-release-suite.log](https://git.kayg.org/attachments/65a7ed35-d93a-4f3c-8652-cc1d6a8413be)
kayg commented 2026-10-30 11:13:44 +00:00
Author
Owner
Copy link

Listener handoff reuse committed/pushed deliberately from 31053e59b: df4ec4ec2 descriptor boundary, 4b77d253f independent listener-v1 note parser, 084f581e6 listener owners/server runtime, 31c23dce5 CLI import/export and capability advertisement. No branch merge or old transaction/copy-back protocol was imported. Existing sealed exec and private CA stdin handoff remain; legacy signed predecessors without listener-v1 close/rebind.

Real exec tests preserve queued connections after serving-owner teardown, closed stdin and CLOEXEC; reject ephemeral exports and parent manifests inherited by children. Gate exited 0: fmt; shim/server/CLI all-target clippy (-D warnings); descriptor 2/0; listener 3/0; capability 2/0; remote runtime 51/0 (4 measurements ignored); combined runtime 61/0 (4 ignored); CLI restart 28/0 (1 helper ignored); CLI remote server 6/0; server no-default/release-only compile-out.

Inherited listener and descriptor gates: PASS

No prior review test is obsolete. Functional transcripts, not latency evidence. A local-only exact-head warm-handoff archive is building for the orchestrator; no VM proof runs here. Production generation admission, independent watchdog/health/commit, host lockstep, #236 owner-present repair, full failure table and final gates/sizes remain unfinished.

listener-gates.log
listener-remote-runtime-suite.log
listener-restart-suite.log
listener-cli-remote-suite.log

Listener handoff reuse committed/pushed deliberately from 31053e59b: df4ec4ec2 descriptor boundary, 4b77d253f independent listener-v1 note parser, 084f581e6 listener owners/server runtime, 31c23dce5 CLI import/export and capability advertisement. No branch merge or old transaction/copy-back protocol was imported. Existing sealed exec and private CA stdin handoff remain; legacy signed predecessors without listener-v1 close/rebind. Real exec tests preserve queued connections after serving-owner teardown, closed stdin and CLOEXEC; reject ephemeral exports and parent manifests inherited by children. Gate exited 0: fmt; shim/server/CLI all-target clippy (-D warnings); descriptor 2/0; listener 3/0; capability 2/0; remote runtime 51/0 (4 measurements ignored); combined runtime 61/0 (4 ignored); CLI restart 28/0 (1 helper ignored); CLI remote server 6/0; server no-default/release-only compile-out. ``` Inherited listener and descriptor gates: PASS ``` No prior review test is obsolete. Functional transcripts, not latency evidence. A local-only exact-head warm-handoff archive is building for the orchestrator; no VM proof runs here. Production generation admission, independent watchdog/health/commit, host lockstep, #236 owner-present repair, full failure table and final gates/sizes remain unfinished. [listener-gates.log](https://git.kayg.org/attachments/7c0786f3-9d4e-4f70-bd09-53e86c369159) [listener-remote-runtime-suite.log](https://git.kayg.org/attachments/c5387918-650b-42c3-9134-7bdeb5bb6231) [listener-restart-suite.log](https://git.kayg.org/attachments/23c33506-c394-422f-b1c3-dc3c718590a8) [listener-cli-remote-suite.log](https://git.kayg.org/attachments/a72e67bf-bded-4d76-811b-d37b2566ccdc)
kayg commented 2026-10-30 11:21:50 +00:00
Author
Owner
Copy link

Orchestrator VM-only warm-handoff proof is ready at exact source 31c23dce59 (listener import/export head). Built locally; no VM execution or remote host contact.

Archive: warm-handoff-31c23dce5971.tar.gz, 194,926,033 bytes.
SHA-256: 7e943c4890a0a4ff978d003a8fb1345b9a1d2bc830b5fd4d41731edc1a100a1b.

On the disposable perf VM, after copying the archive:

sha256sum warm-handoff-31c23dce5971.tar.gz
tar -xzf warm-handoff-31c23dce5971.tar.gz
sudo ./warm-handoff-31c23dce5971/prepare
sudo /usr/local/bin/perf-run.sh -- ./warm-handoff-31c23dce5971/run

The root driver runs exactly auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions with a 20-minute hang bound, records host/kernel/load/source, and cleans only its own root fixture and units whose ExecStart names that fixture. A per-run public staging authority is included; no private signing material is packaged. Shipping trust is not changed. This establishes only whatever the existing signed-deploy warm-handoff test proves when run: it is not the full generation/watchdog/storage failure table, 128-attached-route latency qualification, host lockstep or #236 repair proof. Later source changes require refreshed final-head proof archives.

warm-handoff-31c23dce5971.tar.gz
package-warm-proof.log

Orchestrator VM-only warm-handoff proof is ready at exact source 31c23dce5971 (listener import/export head). Built locally; no VM execution or remote host contact. Archive: warm-handoff-31c23dce5971.tar.gz, 194,926,033 bytes. SHA-256: 7e943c4890a0a4ff978d003a8fb1345b9a1d2bc830b5fd4d41731edc1a100a1b. On the disposable perf VM, after copying the archive: ```sh sha256sum warm-handoff-31c23dce5971.tar.gz tar -xzf warm-handoff-31c23dce5971.tar.gz sudo ./warm-handoff-31c23dce5971/prepare sudo /usr/local/bin/perf-run.sh -- ./warm-handoff-31c23dce5971/run ``` The root driver runs exactly auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions with a 20-minute hang bound, records host/kernel/load/source, and cleans only its own root fixture and units whose ExecStart names that fixture. A per-run public staging authority is included; no private signing material is packaged. Shipping trust is not changed. This establishes only whatever the existing signed-deploy warm-handoff test proves when run: it is not the full generation/watchdog/storage failure table, 128-attached-route latency qualification, host lockstep or #236 repair proof. Later source changes require refreshed final-head proof archives. [warm-handoff-31c23dce5971.tar.gz](https://git.kayg.org/attachments/f47113f0-ed43-4cb0-b333-6a35b8346237) [package-warm-proof.log](https://git.kayg.org/attachments/e57143b2-61a8-46ff-8d1b-713e03453cf0)
kayg commented 2026-10-30 11:26:09 +00:00
Author
Owner
Copy link

Cancellable SQLite backup primitive committed/pushed at ea50c1f49. The new entry point checks cancellation between 64-page batches and finishes/rolls back the engine backup before returning its exclusive SQLx guards; existing all-pages API retained. The real-engine regression cancels an incomplete 2 MiB copy, verifies unchanged A and rolled-back B, writes to A, then finishes a fresh copy without stale locks. The initial red compile identified the missing entry point. No prior review test is obsolete. Blocking-owner/control-I/O integration is still required before this is production preparation.

Per-slice fmt, shim all-target clippy (-D warnings), 5 SQLite tests (1 subprocess helper ignored), and shim compile-out passed. Five fresh complete #240 reviewer-union repetitions now pass on the settled source (six filters per repetition), after the earlier two-pass run was invalidated by source edits. The normal authorization watchdog function remains byte-identical to task-base dev.

Cancellable backup slice gates: PASS
Account-revocation reviewer union repetition 1: PASS
Account-revocation reviewer union repetition 2: PASS
Account-revocation reviewer union repetition 3: PASS
Account-revocation reviewer union repetition 4: PASS
Account-revocation reviewer union repetition 5: PASS
Authorization watchdog remains byte-identical to task-base dev.
Cancellable backup and five account-revocation preservation gates: PASS

Functional transcripts only. Full fast and current-head production-trust sizes have not yet been rerun. No generation-runtime/watchdog/lockstep/repair completion claim. The separate warm archive and exact root VM commands were posted above.

cancellable-backup-single-red.log
cancellable-backup-single-green.log
cancellable-backup-suite.log
cancellable-backup-gates.log

Cancellable SQLite backup primitive committed/pushed at ea50c1f49. The new entry point checks cancellation between 64-page batches and finishes/rolls back the engine backup before returning its exclusive SQLx guards; existing all-pages API retained. The real-engine regression cancels an incomplete 2 MiB copy, verifies unchanged A and rolled-back B, writes to A, then finishes a fresh copy without stale locks. The initial red compile identified the missing entry point. No prior review test is obsolete. Blocking-owner/control-I/O integration is still required before this is production preparation. Per-slice fmt, shim all-target clippy (-D warnings), 5 SQLite tests (1 subprocess helper ignored), and shim compile-out passed. Five fresh complete #240 reviewer-union repetitions now pass on the settled source (six filters per repetition), after the earlier two-pass run was invalidated by source edits. The normal authorization watchdog function remains byte-identical to task-base dev. ``` Cancellable backup slice gates: PASS Account-revocation reviewer union repetition 1: PASS Account-revocation reviewer union repetition 2: PASS Account-revocation reviewer union repetition 3: PASS Account-revocation reviewer union repetition 4: PASS Account-revocation reviewer union repetition 5: PASS Authorization watchdog remains byte-identical to task-base dev. Cancellable backup and five account-revocation preservation gates: PASS ``` Functional transcripts only. Full fast and current-head production-trust sizes have not yet been rerun. No generation-runtime/watchdog/lockstep/repair completion claim. The separate warm archive and exact root VM commands were posted above. [cancellable-backup-single-red.log](https://git.kayg.org/attachments/270846f9-6827-4cc7-ae23-9e842231c721) [cancellable-backup-single-green.log](https://git.kayg.org/attachments/e7122ba5-3102-4895-b396-938bb56ce011) [cancellable-backup-suite.log](https://git.kayg.org/attachments/1d55f69b-ac73-409f-bc57-53c22ec5d1c1) [cancellable-backup-gates.log](https://git.kayg.org/attachments/a96ee26c-0cbc-48ad-971d-1f66f60cf758)
kayg commented 2026-10-30 11:32:59 +00:00
Author
Owner
Copy link

Resuming edge-update-v2 at ea50c1f493; task base dev 2fb412d01d. Continuing the blocking SQLite copy owner and cancellation coverage. Production generation coordination/watchdog, lockstep and #236 remain unfinished; no complete-updater claim. No perf VM contact.

Resuming edge-update-v2 at ea50c1f493c6f08c30385a04ab8a9621b392d732; task base dev 2fb412d01dcecb81f1f556d18d0350e70644a615. Continuing the blocking SQLite copy owner and cancellation coverage. Production generation coordination/watchdog, lockstep and #236 remain unfinished; no complete-updater claim. No perf VM contact.
kayg commented 2026-10-30 11:36:04 +00:00
Author
Owner
Copy link

Pushed blocking-copy owner 01388458d on edge-update-v2. Both dedicated SQLx connections and all caller-supplied fences live on the blocking owner through SQLite completion and awaited connection closes, including dropped handles/polled wait futures. Successful completion returns the still-held fences.

Real SQLite + Unix-stream ordering tests: 3 passed; existing checkpoint/browser input tests: 3 passed. fmt, server all-target clippy, no-default/release-only checks passed. Gate output: Blocking SQLite copy owner gates: PASS.

blocking-copy-single-red.log
blocking-copy-gates.log

This slice is not production coordinator/watchdog integration. No review test declared obsolete; full updater, #236 and final exact-head fast/size qualification remain outstanding.

Pushed blocking-copy owner 01388458d on edge-update-v2. Both dedicated SQLx connections and all caller-supplied fences live on the blocking owner through SQLite completion and awaited connection closes, including dropped handles/polled wait futures. Successful completion returns the still-held fences. Real SQLite + Unix-stream ordering tests: 3 passed; existing checkpoint/browser input tests: 3 passed. fmt, server all-target clippy, no-default/release-only checks passed. Gate output: `Blocking SQLite copy owner gates: PASS`. [blocking-copy-single-red.log](https://git.kayg.org/attachments/ad203b12-af7b-4bce-954a-1b1923fa59be) [blocking-copy-gates.log](https://git.kayg.org/attachments/d8a64cea-81a1-44cc-80b7-47ee101f0e44) This slice is not production coordinator/watchdog integration. No review test declared obsolete; full updater, #236 and final exact-head fast/size qualification remain outstanding.
kayg commented 2026-10-30 11:40:30 +00:00
Author
Owner
Copy link

Pushed schema slice 5cfbcca61 on edge-update-v2 (base dev 2fb412d01). Migration 0031 adds the exact consumed invitation → minted certificate binding required by the approved #211/#236 plan. Historical consumed tokens remain unknown; no inferred backfill. 0001–0030 are unchanged. Repair remains unwired.

Red: SQLite reports no such column. Green: all 6 migration checks pass, including upgraded histories, old checksum retention, 32-byte blob constraints and refusal of unconsumed bindings; migration compatibility and 7 read-only checks pass. fmt and all-target server clippy pass. Invitation certificate schema gates: PASS.

invitation-certificate-schema-red.log
invitation-certificate-schema-gates.log

Pushed schema slice 5cfbcca61 on edge-update-v2 (base dev 2fb412d01). Migration 0031 adds the exact consumed invitation → minted certificate binding required by the approved #211/#236 plan. Historical consumed tokens remain unknown; no inferred backfill. 0001–0030 are unchanged. Repair remains unwired. Red: SQLite reports no such column. Green: all 6 migration checks pass, including upgraded histories, old checksum retention, 32-byte blob constraints and refusal of unconsumed bindings; migration compatibility and 7 read-only checks pass. fmt and all-target server clippy pass. `Invitation certificate schema gates: PASS`. [invitation-certificate-schema-red.log](https://git.kayg.org/attachments/136de235-f1d8-46ae-bfdf-2ef924292e16) [invitation-certificate-schema-gates.log](https://git.kayg.org/attachments/90c23455-2995-45e4-9c66-43617a1f516c)
kayg commented 2026-10-30 11:48:55 +00:00
Author
Owner
Copy link

Pushed a07b03746 on edge-update-v2. Redemption now binds consumed invitation digest to the exact signer-produced certificate atomically with certificate insertion. Authorized reissue clears the previous binding; insertion failure rolls consumption back; predecessor certificates remain valid. This is a prerequisite for route-bound owner-present repair, not completed repair.

Focused real-SQLite regression went red with missing fingerprint and now passes. Full server library: 688 passed; 0 failed; 52 ignored; fmt, all-target clippy and no-default/release-only checks pass. Invitation certificate writer gates: PASS. No prior review test obsolete.

invitation-certificate-writer-red.log
invitation-certificate-writer-gates.log
invitation-writer-server-suite.log

Pushed a07b03746 on edge-update-v2. Redemption now binds consumed invitation digest to the exact signer-produced certificate atomically with certificate insertion. Authorized reissue clears the previous binding; insertion failure rolls consumption back; predecessor certificates remain valid. This is a prerequisite for route-bound owner-present repair, not completed repair. Focused real-SQLite regression went red with missing fingerprint and now passes. Full server library: `688 passed; 0 failed; 52 ignored`; fmt, all-target clippy and no-default/release-only checks pass. `Invitation certificate writer gates: PASS`. No prior review test obsolete. [invitation-certificate-writer-red.log](https://git.kayg.org/attachments/cbad602a-d669-4d1b-9db2-67ef464e0867) [invitation-certificate-writer-gates.log](https://git.kayg.org/attachments/70ffafc9-121b-4425-976b-09baff932257) [invitation-writer-server-suite.log](https://git.kayg.org/attachments/ce5b4e77-4ac6-422e-881c-7f1df1f9cc9a)
kayg commented 2026-10-30 11:51:38 +00:00
Author
Owner
Copy link

Pushed 823d5d152 on edge-update-v2. Added a single public-ledger read matching exact reserved digest + host + consumed certificate, with live certificate/host checks. It rejects an unrelated predecessor, renewal, stale token after reissue and unknown historical consumption while retaining prior public authority. This grants no repair authority; actual route/status and owner/origin/UID/reservation checks still require production coordinator wiring.

4 binding tests + 3 authority tests pass; fmt, all-target clippy and compile-outs pass. The first remote-review filter selected zero tests; corrected to independent_review: 3 real transport tests pass, 1 measurement ignored. Exact invitation certificate proof gates: PASS. No prior review test obsolete.

invitation-certificate-proof-red.log
invitation-certificate-proof-gates.log
invitation-proof-remote-review.log

Pushed 823d5d152 on edge-update-v2. Added a single public-ledger read matching exact reserved digest + host + consumed certificate, with live certificate/host checks. It rejects an unrelated predecessor, renewal, stale token after reissue and unknown historical consumption while retaining prior public authority. This grants no repair authority; actual route/status and owner/origin/UID/reservation checks still require production coordinator wiring. 4 binding tests + 3 authority tests pass; fmt, all-target clippy and compile-outs pass. The first remote-review filter selected zero tests; corrected to independent_review: 3 real transport tests pass, 1 measurement ignored. `Exact invitation certificate proof gates: PASS`. No prior review test obsolete. [invitation-certificate-proof-red.log](https://git.kayg.org/attachments/a01eb41a-a8c2-41d6-b97d-1e56846219df) [invitation-certificate-proof-gates.log](https://git.kayg.org/attachments/72851998-d93d-48fd-88af-1244b3a5468d) [invitation-proof-remote-review.log](https://git.kayg.org/attachments/8f7bda01-7373-4c23-adc5-b04f64e5eb58)
kayg commented 2026-10-30 12:02:03 +00:00
Author
Owner
Copy link

Pushed 800910486 on edge-update-v2. Reused audited bounded SCM_RIGHTS transport under generic descriptor names, keeping existing PTY aliases and checks. A real child process receives the held directory lock, original owner closes, child transfers it back and exits; competing lock acquisition stays refused until the returned descriptor closes. This proves descriptor lifetime only; production watchdog and private transaction/image/sender authority remain unfinished.

Production shim clippy/fmt pass; process transfer 1 pass / 1 helper ignored; preserved PTY tests 3 pass; SQLite 5 pass / 1 helper ignored; shim no-default and server release-only checks pass. Cross-process directory-lock descriptor transfer gates: PASS.

Extra opt-in process-per-user all-target clippy fails in terminal.rs/user_host.rs. Both sources are byte-identical to task-base dev; reproduced the same errors on detached dev with process-per-user. Dev lacks the new sqlite-backup feature, so the reproduction uses its available process-per-user feature. These research failures are not claimed green and were not edited. Full shipping nix graph already enables uio; release-only feature now enables that existing facility explicitly. No new crate/helper binary, no obsolete review test.

generation-lock-transfer-red.log
descriptor-transfer-gates.log
descriptor-transfer-dev-research-clippy.log
descriptor-transfer-research-clippy.log

Pushed 800910486 on edge-update-v2. Reused audited bounded SCM_RIGHTS transport under generic descriptor names, keeping existing PTY aliases and checks. A real child process receives the held directory lock, original owner closes, child transfers it back and exits; competing lock acquisition stays refused until the returned descriptor closes. This proves descriptor lifetime only; production watchdog and private transaction/image/sender authority remain unfinished. Production shim clippy/fmt pass; process transfer 1 pass / 1 helper ignored; preserved PTY tests 3 pass; SQLite 5 pass / 1 helper ignored; shim no-default and server release-only checks pass. `Cross-process directory-lock descriptor transfer gates: PASS`. Extra opt-in process-per-user all-target clippy fails in terminal.rs/user_host.rs. Both sources are byte-identical to task-base dev; reproduced the same errors on detached dev with process-per-user. Dev lacks the new sqlite-backup feature, so the reproduction uses its available process-per-user feature. These research failures are not claimed green and were not edited. Full shipping nix graph already enables uio; release-only feature now enables that existing facility explicitly. No new crate/helper binary, no obsolete review test. [generation-lock-transfer-red.log](https://git.kayg.org/attachments/76f021c2-ed8e-4b55-9194-82bb4c402efe) [descriptor-transfer-gates.log](https://git.kayg.org/attachments/3a160050-37c8-4193-9161-a71efac6fe95) [descriptor-transfer-dev-research-clippy.log](https://git.kayg.org/attachments/795f2afc-d480-4b03-b8f5-bd8a565efc46) [descriptor-transfer-research-clippy.log](https://git.kayg.org/attachments/aef5c4e1-79b1-4bfa-9662-4f4e9f4912a6)
kayg commented 2026-10-30 12:05:39 +00:00
Author
Owner
Copy link

VM-only watchdog transport probe ready for the orchestrator. Source checkpoint 800910486; this archive contains a syntax-checked Python capability probe, not shipping updater acceptance. It has not been run on the build host or any VM by this job. Production integration must not rely on its systemd descriptor/cgroup assumption until the VM result is known.

watchdog-transport-800910486.tar.gz: 4121 bytes; SHA256 9ac5dfc5ccd5bc53d229ba58d91cf636282b7c8a9bcff2eb50d4045b8f395cfd

watchdog-transport-800910486.tar.gz

On a disposable systemd QA/perf VM, from the directory containing the downloaded archive:

printf '%s  %s\n' 9ac5dfc5ccd5bc53d229ba58d91cf636282b7c8a9bcff2eb50d4045b8f395cfd watchdog-transport-800910486.tar.gz | sha256sum -c -
tar -xzf watchdog-transport-800910486.tar.gz
sha256sum -c watchdog-transport-800910486/SHA256SUMS
sudo /usr/local/bin/perf-run.sh -- python3 ./watchdog-transport-800910486/probe.py

The controller creates two uniquely named 60-second transient services and its own UUID fixture under /root/infraternal-bench/edge-update-transport. It transfers a held directory lock to the watchdog through systemd-run --pipe, stops the candidate's entire cgroup including its watchdog launcher client, proves the independent watchdog/socket/lock remain alive, transfers the lock back, stops the watchdog and proves acquisition stays refused until the last returned descriptor closes. Cleanup verifies only its own units inactive/failed or absent and reports their names/fixture if cleanup fails. Return all output and exit status on #211. This measures no performance and proves no health, generation startup or rollback behavior.

The separate shipping warm-handoff request remains waiting on the orchestrator (exact head 31c23dce59; SHA256 7e943c4890a0a4ff978d003a8fb1345b9a1d2bc830b5fd4d41731edc1a100a1b):

sha256sum warm-handoff-31c23dce5971.tar.gz
tar -xzf warm-handoff-31c23dce5971.tar.gz
sudo ./warm-handoff-31c23dce5971/prepare
sudo /usr/local/bin/perf-run.sh -- ./warm-handoff-31c23dce5971/run

It is an intermediate existing warm-continuity proof, not complete generation-table/#236 acceptance. Final-head archives will still need refreshing after integration.

VM-only watchdog transport probe ready for the orchestrator. Source checkpoint 800910486; this archive contains a syntax-checked Python capability probe, not shipping updater acceptance. It has not been run on the build host or any VM by this job. Production integration must not rely on its systemd descriptor/cgroup assumption until the VM result is known. watchdog-transport-800910486.tar.gz: 4121 bytes; SHA256 9ac5dfc5ccd5bc53d229ba58d91cf636282b7c8a9bcff2eb50d4045b8f395cfd [watchdog-transport-800910486.tar.gz](https://git.kayg.org/attachments/e4da0a33-a228-40bf-91d3-ef12d04f50a3) On a disposable systemd QA/perf VM, from the directory containing the downloaded archive: ```sh printf '%s %s\n' 9ac5dfc5ccd5bc53d229ba58d91cf636282b7c8a9bcff2eb50d4045b8f395cfd watchdog-transport-800910486.tar.gz | sha256sum -c - tar -xzf watchdog-transport-800910486.tar.gz sha256sum -c watchdog-transport-800910486/SHA256SUMS sudo /usr/local/bin/perf-run.sh -- python3 ./watchdog-transport-800910486/probe.py ``` The controller creates two uniquely named 60-second transient services and its own UUID fixture under `/root/infraternal-bench/edge-update-transport`. It transfers a held directory lock to the watchdog through `systemd-run --pipe`, stops the candidate's entire cgroup including its watchdog launcher client, proves the independent watchdog/socket/lock remain alive, transfers the lock back, stops the watchdog and proves acquisition stays refused until the last returned descriptor closes. Cleanup verifies only its own units inactive/failed or absent and reports their names/fixture if cleanup fails. Return all output and exit status on #211. This measures no performance and proves no health, generation startup or rollback behavior. The separate shipping warm-handoff request remains waiting on the orchestrator (exact head 31c23dce5971; SHA256 7e943c4890a0a4ff978d003a8fb1345b9a1d2bc830b5fd4d41731edc1a100a1b): ```sh sha256sum warm-handoff-31c23dce5971.tar.gz tar -xzf warm-handoff-31c23dce5971.tar.gz sudo ./warm-handoff-31c23dce5971/prepare sudo /usr/local/bin/perf-run.sh -- ./warm-handoff-31c23dce5971/run ``` It is an intermediate existing warm-continuity proof, not complete generation-table/#236 acceptance. Final-head archives will still need refreshing after integration.
kayg commented 2026-10-30 12:10:42 +00:00
Author
Owner
Copy link

Resuming edge-update-v2 at 8009104868, task-base dev 2fb412d01d. Existing serial dev/checkpoint static measurement remains running; no source edits during the build. Next slice is durable SQLite writer-floor reservation needed before generation trial/manual rollback. Production generation coordinator/watchdog, host lockstep and #236 repair remain incomplete. No perf VM contact or complete-updater claim.

Resuming edge-update-v2 at 80091048682343af67f0f650ce17762bd2be30ef, task-base dev 2fb412d01dcecb81f1f556d18d0350e70644a615. Existing serial dev/checkpoint static measurement remains running; no source edits during the build. Next slice is durable SQLite writer-floor reservation needed before generation trial/manual rollback. Production generation coordinator/watchdog, host lockstep and #236 repair remain incomplete. No perf VM contact or complete-updater claim.
kayg commented 2026-10-30 12:22:28 +00:00
Author
Owner
Copy link

Pushed exact-cap checkpoint dce807ec0. Clean source 800910486, pinned serial production-trust builds on 6by32-compute02: x86 21,467,400 / ARM 19,642,912 bytes. Same-recipe task-base dev 2fb412d01: 21,431,472 / 19,605,896; deltas +35,928 / +37,016. Exact caps and PROCESS now match both artifacts under the accepted D301 exception. Both exact-size reviewer tests and exact/one-byte-over/downward-ratchet boundary checks pass; fmt and shell syntax pass. Dependency versions/profiles unchanged.

This is unfinished generation ownership/certificate-binding work, not complete updater cost, trim evidence, or acceptance. Runtime/watchdog, host lockstep, #236 and final-head fast/VM proofs remain outstanding. Continuing durable writer reservation next. Attachment endpoint refused the .tsv extension (HTTP 422); the identical measurement table is attached as .txt.

owner-checkpoint-sizes.txt
owner-checkpoint-static.log
owner-checkpoint-size-boundaries.log

Pushed exact-cap checkpoint dce807ec0. Clean source 800910486, pinned serial production-trust builds on 6by32-compute02: x86 21,467,400 / ARM 19,642,912 bytes. Same-recipe task-base dev 2fb412d01: 21,431,472 / 19,605,896; deltas +35,928 / +37,016. Exact caps and PROCESS now match both artifacts under the accepted D301 exception. Both exact-size reviewer tests and exact/one-byte-over/downward-ratchet boundary checks pass; fmt and shell syntax pass. Dependency versions/profiles unchanged. This is unfinished generation ownership/certificate-binding work, not complete updater cost, trim evidence, or acceptance. Runtime/watchdog, host lockstep, #236 and final-head fast/VM proofs remain outstanding. Continuing durable writer reservation next. Attachment endpoint refused the .tsv extension (HTTP 422); the identical measurement table is attached as .txt. [owner-checkpoint-sizes.txt](https://git.kayg.org/attachments/56669b61-37e0-481e-84dd-7e1847a0280b) [owner-checkpoint-static.log](https://git.kayg.org/attachments/d193f02c-e9ff-4119-ba26-2dea2bd8dc27) [owner-checkpoint-size-boundaries.log](https://git.kayg.org/attachments/a0c692b4-bb97-40af-bcf6-646e64423b0d)
kayg commented 2026-10-30 12:29:05 +00:00
Author
Owner
Copy link

Pushed 6585e7b8b on edge-update-v2. Real SQLite writer-floor reservations now commit before reply with FULL WAL and a top-level BEGIN IMMEDIATE; no per-writer marker I/O. Historical rollback copies advance above deleted current writer IDs while retaining the original snapshot unchanged. Invalid/duplicate/regressed sequence state, nested transactions, exhausted space and physical read-only storage refuse admission. Normal auth/websocket/replay sources were not edited in this slice. Production coordinator and writable startup integration are still absent.

Red: no ID interval was durably reserved before trial. Green: 10 writer tests pass, including abrupt process exit and concurrent reservations; 20 generation and 8 read-only tests pass; fmt/clippy and no-default/release-only checks pass. First clippy run caught one items-after-statements import in the new test fixture; moved it to module scope without weakening lints. Durable generation writer-floor gates: PASS. Marker-specific obsolete fixtures and retained nonreuse/refusal invariants are named in the commit. No independent review or interruption-table oracle is obsolete.

Five #240 reviewer union repetitions and the full fast milestone gate are now running at this exact head; no full gate claim yet. No perf VM contact.

writer-floor-red.log
writer-floor-green.log
writer-floor-gates.log

Pushed 6585e7b8b on edge-update-v2. Real SQLite writer-floor reservations now commit before reply with FULL WAL and a top-level BEGIN IMMEDIATE; no per-writer marker I/O. Historical rollback copies advance above deleted current writer IDs while retaining the original snapshot unchanged. Invalid/duplicate/regressed sequence state, nested transactions, exhausted space and physical read-only storage refuse admission. Normal auth/websocket/replay sources were not edited in this slice. Production coordinator and writable startup integration are still absent. Red: no ID interval was durably reserved before trial. Green: 10 writer tests pass, including abrupt process exit and concurrent reservations; 20 generation and 8 read-only tests pass; fmt/clippy and no-default/release-only checks pass. First clippy run caught one items-after-statements import in the new test fixture; moved it to module scope without weakening lints. `Durable generation writer-floor gates: PASS`. Marker-specific obsolete fixtures and retained nonreuse/refusal invariants are named in the commit. No independent review or interruption-table oracle is obsolete. Five #240 reviewer union repetitions and the full fast milestone gate are now running at this exact head; no full gate claim yet. No perf VM contact. [writer-floor-red.log](https://git.kayg.org/attachments/919e2bcb-dea3-4725-905a-3497ea154959) [writer-floor-green.log](https://git.kayg.org/attachments/bb3d2743-71c2-4063-b4e5-02d1fa5668f0) [writer-floor-gates.log](https://git.kayg.org/attachments/fe04f066-227a-43d8-a7e4-557adff60396)
kayg commented 2026-10-30 12:36:11 +00:00
Author
Owner
Copy link

Follow-up finding before integration: the new borrowed-connection reservation at 6585e7b8b used SQLx 0.8.6 custom begin_with. Existing plugin-api/storage.rs documents its acknowledged-BEGIN -> lock_handle await gap. A real cancellation regression now reproduces it at poll 4: Err(InvalidSavePointStatement) on the next reservation. The reservation APIs have no production callers yet. Correcting with the normal writer path pattern: refuse nesting, create an ordinary RAII transaction, then acquire the writer lock with UPDATE before sequence reads. No normal writer-path edit. Green verification is running; no fix claim yet.

The five #240 unions at 6585e7b8b passed: each has six filters, 45 executions, 37 distinct passing tests. Dev authorization watchdog, websocket input/transport and stale-screen implementation are byte-identical. I intentionally interrupted the incomplete fast gate by stopping only my build-slot scope run-p1572418-i9958216.scope; its script/cargo processes are gone. The attached partial gate is not a PASS receipt. Full fast will be rerun after the cancellation correction. No source edits occurred during the gate.

writer-floor-cancellation-red.log
writer-240-6585e7b8b.tar.gz
writer-milestone-fast-interrupted.log

Follow-up finding before integration: the new borrowed-connection reservation at 6585e7b8b used SQLx 0.8.6 custom begin_with. Existing plugin-api/storage.rs documents its acknowledged-BEGIN -> lock_handle await gap. A real cancellation regression now reproduces it at poll 4: Err(InvalidSavePointStatement) on the next reservation. The reservation APIs have no production callers yet. Correcting with the normal writer path pattern: refuse nesting, create an ordinary RAII transaction, then acquire the writer lock with UPDATE before sequence reads. No normal writer-path edit. Green verification is running; no fix claim yet. The five #240 unions at 6585e7b8b passed: each has six filters, 45 executions, 37 distinct passing tests. Dev authorization watchdog, websocket input/transport and stale-screen implementation are byte-identical. I intentionally interrupted the incomplete fast gate by stopping only my build-slot scope run-p1572418-i9958216.scope; its script/cargo processes are gone. The attached partial gate is not a PASS receipt. Full fast will be rerun after the cancellation correction. No source edits occurred during the gate. [writer-floor-cancellation-red.log](https://git.kayg.org/attachments/6aab250e-1196-43b6-8437-839e8ca70e3f) [writer-240-6585e7b8b.tar.gz](https://git.kayg.org/attachments/69185bb1-4123-4b73-9fe4-f1a2d22c281e) [writer-milestone-fast-interrupted.log](https://git.kayg.org/attachments/cbb46b2b-bf32-478e-bbf8-85d53322350a)
kayg commented 2026-10-30 12:40:45 +00:00
Author
Owner
Copy link

Pushed cancellation correction c66e24296 on edge-update-v2. Ordinary RAII BEGIN plus the existing writer-locking UPDATE pattern replaces custom begin_with, and the nesting check follows awaited connection work so a dropped owner's queued rollback settles first. No per-writer hot-path or normal auth/websocket/replay edit.

The same cancellation oracle that failed at poll 4 now passes all 24 cuts. Writer suite: 11 pass / 1 private helper ignored; generation: 20 pass / 2 VM-only ignored; read-only: 8 pass. fmt, both touched-crate clippy runs and no-default/release-only compile-outs pass. Durable generation writer-floor gates: PASS. The intermediate early depth check also failed the unchanged oracle because rollback is queued; that transcript is attached. No test weakened or review oracle obsolete.

Full fast and five account-revocation unions are restarted at c66e24296; no current full-gate claim yet. Production coordinator, startup admission, watchdog, host lockstep, #236 and failure-table integration remain unfinished.

writer-floor-cancellation-green.log
writer-floor-cancellation-queued-rollback.log
writer-floor-cancellation-gates.log

Pushed cancellation correction c66e24296 on edge-update-v2. Ordinary RAII BEGIN plus the existing writer-locking UPDATE pattern replaces custom begin_with, and the nesting check follows awaited connection work so a dropped owner's queued rollback settles first. No per-writer hot-path or normal auth/websocket/replay edit. The same cancellation oracle that failed at poll 4 now passes all 24 cuts. Writer suite: 11 pass / 1 private helper ignored; generation: 20 pass / 2 VM-only ignored; read-only: 8 pass. fmt, both touched-crate clippy runs and no-default/release-only compile-outs pass. `Durable generation writer-floor gates: PASS`. The intermediate early depth check also failed the unchanged oracle because rollback is queued; that transcript is attached. No test weakened or review oracle obsolete. Full fast and five account-revocation unions are restarted at c66e24296; no current full-gate claim yet. Production coordinator, startup admission, watchdog, host lockstep, #236 and failure-table integration remain unfinished. [writer-floor-cancellation-green.log](https://git.kayg.org/attachments/529e8a37-83f4-45fc-91d9-926a09ae463c) [writer-floor-cancellation-queued-rollback.log](https://git.kayg.org/attachments/8c91eb2d-312f-483b-bce4-55152e79c7fe) [writer-floor-cancellation-gates.log](https://git.kayg.org/attachments/32da572b-09ad-4bbb-ad2c-16ffa47072e6)
kayg commented 2026-10-30 12:52:07 +00:00
Author
Owner
Copy link

Resuming implementation on edge-update-v2 at c66e242963, from task-base dev 2fb412d01d. Five account-revocation reviewer unions and dev preservation assertions have finished; the exact-head full fast gate remains running. No source edits while it runs. Next production integration boundary is generation-only writable storage admission before any state/configuration/CA initialization, retaining physical read-only fallback. Adoption must keep the original live A database authoritative: a stale copied adoption snapshot cannot replace acknowledged A writes. Updater/watchdog, host lockstep and owner-present repair remain unfinished. No perf VM contact or deployment.

Resuming implementation on edge-update-v2 at c66e2429630de1ed8845679e821b0f6c47b07f89, from task-base dev 2fb412d01dcecb81f1f556d18d0350e70644a615. Five account-revocation reviewer unions and dev preservation assertions have finished; the exact-head full fast gate remains running. No source edits while it runs. Next production integration boundary is generation-only writable storage admission before any state/configuration/CA initialization, retaining physical read-only fallback. Adoption must keep the original live A database authoritative: a stale copied adoption snapshot cannot replace acknowledged A writes. Updater/watchdog, host lockstep and owner-present repair remain unfinished. No perf VM contact or deployment.
kayg commented 2026-10-30 12:54:18 +00:00
Author
Owner
Copy link

Adoption implementation choice for the approved frozen-original-A contract (D295/#211): the initial generation must bind A's original private state directory rather than select a copied database while legacy A keeps serving. Proposed additive local launch field original_state records the absolute canonical original directory plus its device/inode; only an initial generation with no predecessor may use it. Successors always use their own physical state copies. Preflight pins the original directory by descriptor, refuses replaced/aliased/shared state, and validates signed metadata before any state opens. Generation boot configuration remains in its metadata directory; no fake database, writable hardlink, shared migration, or external-directory deletion. This prevents adoption from losing ACKed writes between selector installation and first trial. No frozen wire contract, library, engine, or legacy CLI behavior changes. The coordinator must establish FULL WAL and keep the old init owner until fixed-path installation succeeds; the locator alone does not prove that integration.

Adoption implementation choice for the approved frozen-original-A contract (D295/#211): the initial generation must bind A's original private state directory rather than select a copied database while legacy A keeps serving. Proposed additive local launch field `original_state` records the absolute canonical original directory plus its device/inode; only an initial generation with no predecessor may use it. Successors always use their own physical state copies. Preflight pins the original directory by descriptor, refuses replaced/aliased/shared state, and validates signed metadata before any state opens. Generation boot configuration remains in its metadata directory; no fake database, writable hardlink, shared migration, or external-directory deletion. This prevents adoption from losing ACKed writes between selector installation and first trial. No frozen wire contract, library, engine, or legacy CLI behavior changes. The coordinator must establish FULL WAL and keep the old init owner until fixed-path installation succeeds; the locator alone does not prove that integration.
kayg commented 2026-10-30 12:54:49 +00:00
Author
Owner
Copy link

Refinement before implementation: do not persist st_dev in the original-state locator. Linux may renumber mount devices across reboot, so that would refuse a valid boot. Bind the canonical absolute path and existing directory inode, then retain its open descriptor for the process lifetime. Refuse symlink paths, inode replacement, shared directories and aliased database files. No implementation yet; the earlier exact-head full gate remains running.

Refinement before implementation: do not persist st_dev in the original-state locator. Linux may renumber mount devices across reboot, so that would refuse a valid boot. Bind the canonical absolute path and existing directory inode, then retain its open descriptor for the process lifetime. Refuse symlink paths, inode replacement, shared directories and aliased database files. No implementation yet; the earlier exact-head full gate remains running.
kayg commented 2026-10-30 12:57:09 +00:00
Author
Owner
Copy link

Exact-head c66e242963 #240 reviewer union: all five repetitions pass, each with 45 successful executions / 37 distinct tests across six filters. The dev authorization watchdog body, websocket input/transport files and stale-screen implementation remain byte-identical to task-base 2fb412d01. Full fast remains running; this is not a complete task/final gate claim.

writer-240-c66e24296.tar.gz

Exact-head c66e2429630de1ed8845679e821b0f6c47b07f89 #240 reviewer union: all five repetitions pass, each with 45 successful executions / 37 distinct tests across six filters. The dev authorization watchdog body, websocket input/transport files and stale-screen implementation remain byte-identical to task-base 2fb412d01. Full fast remains running; this is not a complete task/final gate claim. [writer-240-c66e24296.tar.gz](https://git.kayg.org/attachments/b77a2db5-fdea-4d9f-8c0f-d82eac97899c)
kayg commented 2026-10-30 13:17:22 +00:00
Author
Owner
Copy link

Pushed exact-size correction 1143d49c8 on edge-update-v2. Clean c66e24296 pinned serial static builds: x86 21,467,400 bytes (unchanged), ARM 19,643,296 (+384 versus stale checkpoint cap). Against reproduced dev 2fb412d01: +35,928 / +37,400 bytes. Both production-trust/linkage/metadata checks pass. Runtime key memory passes on x86; ARM execution is pending. Exact caps, independent reviewer assertion and PROCESS table now match under the accepted D301 exception. Both image assertions and exact/one-byte-over/downward-ratchet checks pass. No dependency/profile changes or obsolete reviewer oracle.

Full fast at c66e24296 exited 1 solely on the stale ARM cap; the full unmodified transcript is attached. Rust summary, verbatim:


+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| static builds             | FAIL (1)     |
+---------------------------+--------------+

Server library: 702 pass / 53 ignored. Five #240 repetitions each passed 45 executions / 37 distinct tests; dev preservation assertions pass. This is not a passing full gate or task completion. Corrected branch-head fast and substantial production integration remain outstanding. Removed only this job's now-idle 13 GB incremental cache; target is back to 55 GB. No VM contact.

x86 SHA256 cf38f663d2d8cdbc224c8102498670166bfb40ca0394896cdd293b14ca5a74ad
ARM SHA256 7c62899153d4fd615640a9c42cbae73c0d62226fb0579bb5afd544757624bf59

writer-c66e24296-fast-size-failure.log
writer-checkpoint-size-red.log
writer-checkpoint-size-green.log

Pushed exact-size correction 1143d49c8 on edge-update-v2. Clean c66e24296 pinned serial static builds: x86 21,467,400 bytes (unchanged), ARM 19,643,296 (+384 versus stale checkpoint cap). Against reproduced dev 2fb412d01: +35,928 / +37,400 bytes. Both production-trust/linkage/metadata checks pass. Runtime key memory passes on x86; ARM execution is pending. Exact caps, independent reviewer assertion and PROCESS table now match under the accepted D301 exception. Both image assertions and exact/one-byte-over/downward-ratchet checks pass. No dependency/profile changes or obsolete reviewer oracle. Full fast at c66e24296 exited 1 solely on the stale ARM cap; the full unmodified transcript is attached. Rust summary, verbatim: ```text +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | static builds | FAIL (1) | +---------------------------+--------------+ ``` Server library: 702 pass / 53 ignored. Five #240 repetitions each passed 45 executions / 37 distinct tests; dev preservation assertions pass. This is not a passing full gate or task completion. Corrected branch-head fast and substantial production integration remain outstanding. Removed only this job's now-idle 13 GB incremental cache; target is back to 55 GB. No VM contact. x86 SHA256 cf38f663d2d8cdbc224c8102498670166bfb40ca0394896cdd293b14ca5a74ad ARM SHA256 7c62899153d4fd615640a9c42cbae73c0d62226fb0579bb5afd544757624bf59 [writer-c66e24296-fast-size-failure.log](https://git.kayg.org/attachments/caf05d82-e14a-42bd-b790-08aa6d4f0e8c) [writer-checkpoint-size-red.log](https://git.kayg.org/attachments/c427915a-4435-4fc8-aa76-68e2fc52f108) [writer-checkpoint-size-green.log](https://git.kayg.org/attachments/fce1bb63-a67b-43e3-95a9-3048eb9532c0)
kayg commented 2026-10-30 13:18:15 +00:00
Author
Owner
Copy link

Pushed preflight ordering correction 63acaca30e. Store.selected opened database/configuration descriptors before its signed-image validator; the approved plan requires authentication first, even before metadata-only state opens. The new regression fails on the old order and passes for both missing-state cases after the fix. Private image checks still run first; incomplete state remains refused.

Release-plugin library: 28 pass / 3 ignored. fmt, all-target clippy, no-default compile-out and diff checks pass. No prior review oracle obsolete. This is a startup primitive correction; runtime startup/adoption/watchdog/host lockstep/#236 remain unfinished, and corrected-head full fast is still pending.

startup-order-red.log
startup-order-green.log

Pushed preflight ordering correction 63acaca30e7dfcc48d1ca5f104b2e0c1ba5c007d. Store.selected opened database/configuration descriptors before its signed-image validator; the approved plan requires authentication first, even before metadata-only state opens. The new regression fails on the old order and passes for both missing-state cases after the fix. Private image checks still run first; incomplete state remains refused. Release-plugin library: 28 pass / 3 ignored. fmt, all-target clippy, no-default compile-out and diff checks pass. No prior review oracle obsolete. This is a startup primitive correction; runtime startup/adoption/watchdog/host lockstep/#236 remain unfinished, and corrected-head full fast is still pending. [startup-order-red.log](https://git.kayg.org/attachments/06050385-fe80-4f0a-a597-04a4f9042bbf) [startup-order-green.log](https://git.kayg.org/attachments/760d4dcd-7c48-4624-85c2-7dbcd7efa09c)
kayg commented 2026-10-30 13:20:07 +00:00
Author
Owner
Copy link

Pushed aec3550bd4: pinned generation state paths now end in /. so existing O_NOFOLLOW private-directory admission sees the held directory, including after its original pathname is renamed. The same regression fails with NotADirectory before the fix and reads the exact snapshot afterward. No relaxed file checks or ordinary-path fallback.

Release-plugin library: 29 pass / 3 ignored; fmt, all-target clippy, no-default compile-out and diff checks pass. First clippy run caught expect() in the fixture; replaced with its module's permitted unwrap(), with unchanged assertion and lints. No prior oracle obsolete. Runtime integration and final-head fast remain outstanding.

pinned-state-root-red.log
pinned-state-root-green.log
pinned-state-root-clippy-first.log

Pushed aec3550bd4f0fa658d7fb8fb7f254541ca9997a5: pinned generation state paths now end in /. so existing O_NOFOLLOW private-directory admission sees the held directory, including after its original pathname is renamed. The same regression fails with NotADirectory before the fix and reads the exact snapshot afterward. No relaxed file checks or ordinary-path fallback. Release-plugin library: 29 pass / 3 ignored; fmt, all-target clippy, no-default compile-out and diff checks pass. First clippy run caught expect() in the fixture; replaced with its module's permitted unwrap(), with unchanged assertion and lints. No prior oracle obsolete. Runtime integration and final-head fast remain outstanding. [pinned-state-root-red.log](https://git.kayg.org/attachments/e4ff085a-9736-458f-8b67-8c1193d80fd2) [pinned-state-root-green.log](https://git.kayg.org/attachments/23062dfd-4ced-4881-8f9b-434e61bb19a9) [pinned-state-root-clippy-first.log](https://git.kayg.org/attachments/cdfca4d6-b14f-4179-acc5-c16d72d4ed93)
kayg commented 2026-10-30 13:36:41 +00:00
Author
Owner
Copy link

Pushed 99ae5dcd11: initial generation manifests can pin A's original live private state directory instead of a stale adoption copy. Initial-only canonical path + inode; no persisted device number. Successors require their own private state. Selection/preflight create no state files; publication syncs existing main/WAL/SHM and parent. Retained digests bind original DB + generation boot config, and signed preflight retains independent descriptors.

Seven added checks cover post-adoption acknowledged WAL, separate candidate schema/data changes with A unchanged, root/path refusals, retained integrity and signed descriptor lifetime. Original parser/adoption test is red before support. Existing preflight regressions caught an internal FD path missing /. during implementation; corrected it without changing those tests.

Release plugin: 36 pass / 3 ignored; server generation: 23 pass / 1 private helper ignored; read-only: 8 pass. fmt, release/server all-target clippy, compile-outs and parser target pass. Parser target emits the same six narrow-graph dead-code warnings as prior package-gates.log. No prior review oracle obsolete. This is state-format support, not completed init adoption, updater or acceptance: existing-pool FULL admission, boot/config/CA isolation, fixed init, watchdog, host lockstep, #236 and corrected-head full fast remain outstanding. No VM contact.

adoption-original-red.log
adoption-original-first-green.log
adoption-original-pinned-path-first.log
adoption-original-parser-gates.log
adoption-original-server-gates.log

Pushed 99ae5dcd11513605dfc028ee34176fb9f570cb29: initial generation manifests can pin A's original live private state directory instead of a stale adoption copy. Initial-only canonical path + inode; no persisted device number. Successors require their own private state. Selection/preflight create no state files; publication syncs existing main/WAL/SHM and parent. Retained digests bind original DB + generation boot config, and signed preflight retains independent descriptors. Seven added checks cover post-adoption acknowledged WAL, separate candidate schema/data changes with A unchanged, root/path refusals, retained integrity and signed descriptor lifetime. Original parser/adoption test is red before support. Existing preflight regressions caught an internal FD path missing /. during implementation; corrected it without changing those tests. Release plugin: 36 pass / 3 ignored; server generation: 23 pass / 1 private helper ignored; read-only: 8 pass. fmt, release/server all-target clippy, compile-outs and parser target pass. Parser target emits the same six narrow-graph dead-code warnings as prior package-gates.log. No prior review oracle obsolete. This is state-format support, not completed init adoption, updater or acceptance: existing-pool FULL admission, boot/config/CA isolation, fixed init, watchdog, host lockstep, #236 and corrected-head full fast remain outstanding. No VM contact. [adoption-original-red.log](https://git.kayg.org/attachments/28147abd-5f9c-4429-8526-a66e528496b0) [adoption-original-first-green.log](https://git.kayg.org/attachments/3bac3c58-6e60-4930-8600-80cf4da8baca) [adoption-original-pinned-path-first.log](https://git.kayg.org/attachments/36a3f035-129c-41ee-8b0a-ff5cc88a6724) [adoption-original-parser-gates.log](https://git.kayg.org/attachments/3a6d4257-1aee-4a13-ba98-9d558b9b607a) [adoption-original-server-gates.log](https://git.kayg.org/attachments/1f5b23e0-b2db-469e-bcf9-838ad3062f22)
kayg commented 2026-10-30 13:38:43 +00:00
Author
Owner
Copy link

Continuing edge-update-v2 at pushed head 99ae5dcd11, task-base dev 2fb412d01d. Approved plan reread. Next slice proves runtime replacement connections retain FULL generation WAL without changing legacy NORMAL close behavior; existing-pool upgrade/coordinator remains separate. Final full fast is still outstanding (prior run failed stale ARM cap); no task-completion claim, deployment or VM contact.

Continuing edge-update-v2 at pushed head 99ae5dcd11513605dfc028ee34176fb9f570cb29, task-base dev 2fb412d01dcecb81f1f556d18d0350e70644a615. Approved plan reread. Next slice proves runtime replacement connections retain FULL generation WAL without changing legacy NORMAL close behavior; existing-pool upgrade/coordinator remains separate. Final full fast is still outstanding (prior run failed stale ARM cap); no task-completion claim, deployment or VM contact.
kayg commented 2026-10-30 13:45:36 +00:00
Author
Owner
Copy link

Runtime connection admission finding (#211): open_database creates legacy NORMAL workers without the generation persistent-WAL/no-close-checkpoint controls. Setting future SQLx connect options to FULL does not install those controls: the real replacement-connection regression fails with “FULL replacement removed committed WAL on close”. The legacy explicit-close control passes. With the FULL-only after_connect hook, both pass, including three physically read-only reopen cycles with byte-identical main/WAL/SHM and latest acknowledged data. Initial fixture used pool-return shutdown and its legacy close assertion was nondeterministic; explicit awaited connection close isolates the engine lifetime and yields the intended red/green. Full server gates are running. No existing-pool upgrade, init adoption or complete updater claim.

Runtime connection admission finding (#211): open_database creates legacy NORMAL workers without the generation persistent-WAL/no-close-checkpoint controls. Setting future SQLx connect options to FULL does not install those controls: the real replacement-connection regression fails with “FULL replacement removed committed WAL on close”. The legacy explicit-close control passes. With the FULL-only after_connect hook, both pass, including three physically read-only reopen cycles with byte-identical main/WAL/SHM and latest acknowledged data. Initial fixture used pool-return shutdown and its legacy close assertion was nondeterministic; explicit awaited connection close isolates the engine lifetime and yields the intended red/green. Full server gates are running. No existing-pool upgrade, init adoption or complete updater claim.
kayg commented 2026-10-30 15:46:30 +00:00
Author
Owner
Copy link

Resuming edge-update-v2 at pushed head 7cc1a3cba9 (worktree clean); task base dev 2fb412d01d. origin/dev is now 63d8a03dc; the four new commits touch only DECISIONS.md and docs/PROCESS.md, so product code and binary inputs are unchanged. The branch will take origin/dev before the final size and gate runs.

The previous run stopped at a usage limit after 7cc1a3cba ("Retain committed WAL on every FULL runtime replacement connection"). Its red/green logs are runtime-wal-* (comment above). Server library: 704 passed / 53 ignored at that commit.

Reconstructed state against plan c9c1877e9:

  • Done (primitives): generation store/pointer, persistent WAL, read-only auth/router/sockets/plugins, listener handoff, cancellable copy owner, writer floors, signed preflight, original-state adoption, invitation certificate binding.
  • Not done: generation boot entry, update coordinator (prepare under fences, exec trial, health, commit), supervised watchdog, abandoned-trial inference and version pause, retention, manual rollback transaction, host lockstep, #236 owner-present repair wiring, failure-table coverage per row, perf relay kit, final sizes and fast gate.

Continuing in that order. No deployment and no perf-host contact.

Resuming edge-update-v2 at pushed head 7cc1a3cba94ee7ca990eb75831bc9e10bcbd3c8a (worktree clean); task base dev 2fb412d01dcecb81f1f556d18d0350e70644a615. origin/dev is now 63d8a03dc; the four new commits touch only DECISIONS.md and docs/PROCESS.md, so product code and binary inputs are unchanged. The branch will take origin/dev before the final size and gate runs. The previous run stopped at a usage limit after 7cc1a3cba ("Retain committed WAL on every FULL runtime replacement connection"). Its red/green logs are runtime-wal-* (comment above). Server library: 704 passed / 53 ignored at that commit. Reconstructed state against plan c9c1877e9: - Done (primitives): generation store/pointer, persistent WAL, read-only auth/router/sockets/plugins, listener handoff, cancellable copy owner, writer floors, signed preflight, original-state adoption, invitation certificate binding. - Not done: generation boot entry, update coordinator (prepare under fences, exec trial, health, commit), supervised watchdog, abandoned-trial inference and version pause, retention, manual rollback transaction, host lockstep, #236 owner-present repair wiring, failure-table coverage per row, perf relay kit, final sizes and fast gate. Continuing in that order. No deployment and no perf-host contact.
kayg commented 2026-10-30 15:51:10 +00:00
Author
Owner
Copy link

Integration design for the remaining runtime steps. Every choice stays inside plan c9c1877e9. No new dependency, engine or wire contract. The boot format below becomes frozen once committed.

Fixed boot format (frozen):
  ExecStart = <R>/current/infraternal __generation-server <R>
  <R>/current -> generations/<id>; <R>/current.prepared only during a trial.
  generations/<id>/{infraternal,MANIFEST,MANIFEST.sig,VERSION,config,launch.json,infraternal.sqlite[-wal,-shm],ssh-trust/}
  config = bounded JSON boot configuration (server args minus --data). The state dir is the generation dir
  (initial adoption: original --data dir through original_state).

Phases
 P (online, cancellable by input, A serving): verified image set staged -> generation dir created with image,
   metadata, config, ssh-trust copy; writer floor reserved in A (FULL); watchdog spawned (not armed).
 D (after the existing drain/runtime shutdown, before exec; not cancellable, short):
   raw engine: checkpoint(TRUNCATE) A -> online backup A->B -> sync -> StateDigest(A) -> publish+prepare
   pointer -> ARM watchdog (lock dup via SCM_RIGHTS, pid) -> exec B (sealed, CA-v1 + listener-v1)
   with argv `__generation-trial <R> <id> <channel-fd>`.
   Any failure -> existing recovery exec of A (warm), A boots and serves (read-only when storage refuses).
 Trial (B, same PID): trial preflight (current.prepared==id, current==predecessor, signed /proc/self/exe),
   open own copy FULL+persistent WAL, migrate, build router/plugins, bind inherited listeners but defer
   every public accept (HTTP + host transports) -> HEALTH on inherited channel -> wait COMMITTED+lock fd ->
   serve. EOF/FAILED -> exit non-zero (init restarts A through unchanged current).
 Watchdog (`__generation-watchdog`, same binary): systemd-run --scope when under systemd, else detached
   setsid child; inherits one end of a datagram socketpair; pidfd on A's PID; monotonic deadline
   (server 120 s, host 30 s). HEALTH while pidfd alive -> Owner::commit; Durable -> COMMITTED + lock
   SCM_RIGHTS -> exit. Uncertain/timeout/channel loss -> SIGKILL via pidfd, join pidfd, close lock, exit.
   Peer exit -> close lock, exit. Never commits after B's death. Dead watchdog = closed channel = B exits.
 Boot (`__generation-server`): preflight current; abandoned trial inferred from current.prepared != current
   (no write needed); writable admission = acquire installation lock (bounded wait for a live watchdog),
   FULL + persistent WAL + writer floor admit; any refusal -> read-only router (frozen=false, WAL kept).
   Pause of the abandoned version recorded only when writable; read-only startup runs no updater.

Rejected: online backup before drain with writer fences (A writes between copy and exec would be lost
 or need a pool-wide freeze that blocks control I/O, EA-01); named watchdog socket (inode creation under
 ENOSPC, needs sender authentication; inheritance already authenticates); systemd-run --pipe (unproven fd
 relay, client process stays in the unit cgroup); watchdog restart of A by itself (two boot owners).
Integration design for the remaining runtime steps. Every choice stays inside plan c9c1877e9. No new dependency, engine or wire contract. The boot format below becomes frozen once committed. ```text Fixed boot format (frozen): ExecStart = <R>/current/infraternal __generation-server <R> <R>/current -> generations/<id>; <R>/current.prepared only during a trial. generations/<id>/{infraternal,MANIFEST,MANIFEST.sig,VERSION,config,launch.json,infraternal.sqlite[-wal,-shm],ssh-trust/} config = bounded JSON boot configuration (server args minus --data). The state dir is the generation dir (initial adoption: original --data dir through original_state). Phases P (online, cancellable by input, A serving): verified image set staged -> generation dir created with image, metadata, config, ssh-trust copy; writer floor reserved in A (FULL); watchdog spawned (not armed). D (after the existing drain/runtime shutdown, before exec; not cancellable, short): raw engine: checkpoint(TRUNCATE) A -> online backup A->B -> sync -> StateDigest(A) -> publish+prepare pointer -> ARM watchdog (lock dup via SCM_RIGHTS, pid) -> exec B (sealed, CA-v1 + listener-v1) with argv `__generation-trial <R> <id> <channel-fd>`. Any failure -> existing recovery exec of A (warm), A boots and serves (read-only when storage refuses). Trial (B, same PID): trial preflight (current.prepared==id, current==predecessor, signed /proc/self/exe), open own copy FULL+persistent WAL, migrate, build router/plugins, bind inherited listeners but defer every public accept (HTTP + host transports) -> HEALTH on inherited channel -> wait COMMITTED+lock fd -> serve. EOF/FAILED -> exit non-zero (init restarts A through unchanged current). Watchdog (`__generation-watchdog`, same binary): systemd-run --scope when under systemd, else detached setsid child; inherits one end of a datagram socketpair; pidfd on A's PID; monotonic deadline (server 120 s, host 30 s). HEALTH while pidfd alive -> Owner::commit; Durable -> COMMITTED + lock SCM_RIGHTS -> exit. Uncertain/timeout/channel loss -> SIGKILL via pidfd, join pidfd, close lock, exit. Peer exit -> close lock, exit. Never commits after B's death. Dead watchdog = closed channel = B exits. Boot (`__generation-server`): preflight current; abandoned trial inferred from current.prepared != current (no write needed); writable admission = acquire installation lock (bounded wait for a live watchdog), FULL + persistent WAL + writer floor admit; any refusal -> read-only router (frozen=false, WAL kept). Pause of the abandoned version recorded only when writable; read-only startup runs no updater. Rejected: online backup before drain with writer fences (A writes between copy and exec would be lost or need a pool-wide freeze that blocks control I/O, EA-01); named watchdog socket (inode creation under ENOSPC, needs sender authentication; inheritance already authenticates); systemd-run --pipe (unproven fd relay, client process stays in the unit cgroup); watchdog restart of A by itself (two boot owners). ```
kayg commented 2026-10-30 16:51:08 +00:00
Author
Owner
Copy link

Progress on edge-update-v2. Pushed:

  • bc46682e3 store: trial selection, owner import, read-only abandoned inference, retention bound (EA-03). Release generation filter: 36 passed / 2 VM-only ignored.
  • 34ff9b6bf server runtime: FULL generation storage with the launch floor as the writability probe; trial gate holding HTTP and host QUIC/TCP accepts until commit; read-only serving. Server library: 707 passed / 0 failed / 53 ignored.
  • 979c96334 shim pidfd_send_signal wrapper (3 tests).
  • a9063bcf2 verify_signed / selected_digest (release library 43 passed / 3 ignored).
  • 19b66242a CLI: frozen __generation-server <root> boot, phase P staging on a restart request, phase D after drain (checkpoint, online backup, digest, one pointer, armed watchdog), __generation-trial, __generation-watchdog (scope under init, pidfd, monotonic 120 s). CLI binary: 121 passed / 1 ignored; no-default: 37 passed.

Finding fixed inside 19b66242a: the B database created by SQLx got the umask mode, so publication's private-file check would have refused every real trial. B's file is now created 0600 first.

Every gate above ran on this host; logs are in the job's evidence directory. Next: an end-to-end proof with staging-signed static images and a supervising init loop (adopt, healthy update, failed trial, full storage), then the updater/rollback/history, host lockstep, #236 wiring, the relay kit and the final gates. No deployment and no perf-host contact.

Progress on edge-update-v2. Pushed: - bc46682e3 store: trial selection, owner import, read-only abandoned inference, retention bound (EA-03). Release generation filter: 36 passed / 2 VM-only ignored. - 34ff9b6bf server runtime: FULL generation storage with the launch floor as the writability probe; trial gate holding HTTP and host QUIC/TCP accepts until commit; read-only serving. Server library: 707 passed / 0 failed / 53 ignored. - 979c96334 shim pidfd_send_signal wrapper (3 tests). - a9063bcf2 verify_signed / selected_digest (release library 43 passed / 3 ignored). - 19b66242a CLI: frozen `__generation-server <root>` boot, phase P staging on a restart request, phase D after drain (checkpoint, online backup, digest, one pointer, armed watchdog), `__generation-trial`, `__generation-watchdog` (scope under init, pidfd, monotonic 120 s). CLI binary: 121 passed / 1 ignored; no-default: 37 passed. Finding fixed inside 19b66242a: the B database created by SQLx got the umask mode, so publication's private-file check would have refused every real trial. B's file is now created 0600 first. Every gate above ran on this host; logs are in the job's evidence directory. Next: an end-to-end proof with staging-signed static images and a supervising init loop (adopt, healthy update, failed trial, full storage), then the updater/rollback/history, host lockstep, #236 wiring, the relay kit and the final gates. No deployment and no perf-host contact.
kayg commented 2026-10-30 17:19:31 +00:00
Author
Owner
Copy link

Paused for handover on owner request. Head fd1892201a (WIP, pushed to edge-update-v2). Nothing is running: no builds, tests or proof units; the temporary user units are removed (before/after diff empty) and no generation processes remain.

Done this run (gated commits): bc46682e3 (trial selection, owner import, abandoned inference, retention bound), 34ff9b6bf (FULL generation storage, trial accept gate, read-only serving), 979c96334 (pidfd signal), a9063bcf2 (verify_signed / selected_digest), 19b66242a (boot/trial/watchdog entries, phases P and D).

WIP fd1892201 (not slice-gated): server init --updates-dir adoption and generation unit (Restart=always); restart control under the installation root; watchdog launched from the selected generation's image path (the fix found end to end); scripts/release/generation-proof.

End-to-end with a staging-signed static build under a real user systemd unit:

  • pass: adopt, healthy update (~1 s to commit, 0 failed health polls), candidate exiting 0, stalled candidate (recovered at 122.5 s), watchdog death, repeated recovery.
  • owner-busy: script bug (opens a directory with open()).

Next: fix owner-busy and gate this slice; then the updater (download/resume, quiet window, version pause, status/update/rollback/history API), the manual rollback transaction, host lockstep, #236 repair wiring, storage/inode-full rows in a root container, the relay kit, the failure-table mapping, sizes/caps, verify fast, and taking origin/dev (docs only).

Paused for handover on owner request. Head fd1892201a181a6fb24ef3938d1dd833645f4e45 (WIP, pushed to edge-update-v2). Nothing is running: no builds, tests or proof units; the temporary user units are removed (before/after diff empty) and no generation processes remain. Done this run (gated commits): bc46682e3 (trial selection, owner import, abandoned inference, retention bound), 34ff9b6bf (FULL generation storage, trial accept gate, read-only serving), 979c96334 (pidfd signal), a9063bcf2 (verify_signed / selected_digest), 19b66242a (boot/trial/watchdog entries, phases P and D). WIP fd1892201 (not slice-gated): `server init --updates-dir` adoption and generation unit (Restart=always); restart control under the installation root; watchdog launched from the selected generation's image path (the fix found end to end); scripts/release/generation-proof. End-to-end with a staging-signed static build under a real user systemd unit: - pass: adopt, healthy update (~1 s to commit, 0 failed health polls), candidate exiting 0, stalled candidate (recovered at 122.5 s), watchdog death, repeated recovery. - owner-busy: script bug (opens a directory with open()). Next: fix owner-busy and gate this slice; then the updater (download/resume, quiet window, version pause, status/update/rollback/history API), the manual rollback transaction, host lockstep, #236 repair wiring, storage/inode-full rows in a root container, the relay kit, the failure-table mapping, sizes/caps, verify fast, and taking origin/dev (docs only).
kayg commented 2026-10-31 16:12:45 +00:00
Author
Owner
Copy link

J12 implementation resumed on edge-update-v2, base fd1892201a. Read common brief, architecture/process, accepted plan c9c1877e9 and D243/D251/D295. Recreated missing local worktree. First: reproduce and fix owner-busy directory-open bug in its own commit; then continue remaining plan. Build/test on claude@infraternal-dev-01-compute01, root only for disposable systemd e2e with cleanup. Cold build; no completion or deployment claim.

J12 implementation resumed on edge-update-v2, base fd1892201a181a6fb24ef3938d1dd833645f4e45. Read common brief, architecture/process, accepted plan c9c1877e9 and D243/D251/D295. Recreated missing local worktree. First: reproduce and fix owner-busy directory-open bug in its own commit; then continue remaining plan. Build/test on claude@infraternal-dev-01-compute01, root only for disposable systemd e2e with cleanup. Cold build; no completion or deployment claim.
kayg commented 2026-10-31 16:15:04 +00:00
Author
Owner
Copy link

J12 finding: reproduced owner-busy on compute01 at scripts/release/generation-proof:281: IsADirectoryError from open(directory, rb). Local fix uses os.open(O_RDONLY|O_DIRECTORY|O_CLOEXEC) and os.close. Initial scripts/verify fast stopped before compilation because the rsynced directory had no Git metadata (artifact gate requires merge-base). While establishing metadata, compute01 SSH became unreachable: No route to host. No passing gate/e2e or product completion is claimed; investigating connectivity.

J12 finding: reproduced owner-busy on compute01 at scripts/release/generation-proof:281: IsADirectoryError from open(directory, rb). Local fix uses os.open(O_RDONLY|O_DIRECTORY|O_CLOEXEC) and os.close. Initial scripts/verify fast stopped before compilation because the rsynced directory had no Git metadata (artifact gate requires merge-base). While establishing metadata, compute01 SSH became unreachable: No route to host. No passing gate/e2e or product completion is claimed; investigating connectivity.
kayg commented 2026-10-31 16:20:44 +00:00
Author
Owner
Copy link

J12: owner confirms compute01 is down and awaiting restart; retaining all x86 static/systemd work there. Reread the new mandatory build-slot rules; future heavy VM commands use ~/infraternal-ops/build-slot. Architecture-neutral release-plugin acceptance compilation is running on dev-02-std through build-slot (-j3, nice 10). The directory lock/release probe for the script fix passes there; this is not the real-systemd 7/7 proof. New updater acceptance tests cover exact abandoned-version pause across restart, explicit exact-version retry, verified readiness/toast deduplication, no private paths, and disabled-feature refusal. No new gate/size/completion claim.

J12: owner confirms compute01 is down and awaiting restart; retaining all x86 static/systemd work there. Reread the new mandatory build-slot rules; future heavy VM commands use ~/infraternal-ops/build-slot. Architecture-neutral release-plugin acceptance compilation is running on dev-02-std through build-slot (-j3, nice 10). The directory lock/release probe for the script fix passes there; this is not the real-systemd 7/7 proof. New updater acceptance tests cover exact abandoned-version pause across restart, explicit exact-version retry, verified readiness/toast deduplication, no private paths, and disabled-feature refusal. No new gate/size/completion claim.
kayg commented 2026-10-31 16:29:38 +00:00
Author
Owner
Copy link

J12 updater core: initial 5 SQLite acceptance tests pass on ARM (abandoned exact-version pause across writable restart, explicit exact-version retry once, verification refusal, ready-toast dedup/private-path exclusion, disabled-feature refusal). Retained release-version ordering test was red with missing newer(), then passed after deliberate reuse of the 31053e59b helper; no engine/dependency choice. Release all-target Clippy passed after limiting unused-helper allowance to the build-script grammar module. Added the next tests for failure notice before rediscovery and health-vs-handoff acknowledgement; they are queued through build-slot. Compute01 is back; the initial-slice full fast gate is queued there, and a staging ARM build is queued for real systemd proof. Core remains unwired; no task completion/size/7-of-7 claim.

J12 updater core: initial 5 SQLite acceptance tests pass on ARM (abandoned exact-version pause across writable restart, explicit exact-version retry once, verification refusal, ready-toast dedup/private-path exclusion, disabled-feature refusal). Retained release-version ordering test was red with missing newer(), then passed after deliberate reuse of the 31053e59b helper; no engine/dependency choice. Release all-target Clippy passed after limiting unused-helper allowance to the build-script grammar module. Added the next tests for failure notice before rediscovery and health-vs-handoff acknowledgement; they are queued through build-slot. Compute01 is back; the initial-slice full fast gate is queued there, and a staging ARM build is queued for real systemd proof. Core remains unwired; no task completion/size/7-of-7 claim.
kayg commented 2026-10-31 16:43:33 +00:00
Author
Owner
Copy link

J12 continuation: isolated first commit d78a6ca58 pushed on edge-update-v2 (base fd1892201). The generation-proof owner-busy case used buffered open on a directory and never reached systemd recovery. Replaced it with an O_DIRECTORY/O_CLOEXEC raw descriptor and matched os.close calls; no product behavior changed.

VM probe on dev-02-std, verbatim:

RED: buffered open rejects directory
GREEN: directory lock excludes second owner and closes cleanly

The full real-systemd seven-case run is queued through the build-slot wrapper. First root-run attempt refused claude-owned fixture files before installing any unit; the retry uses root-owned signed public bundles. No 7/7 claim yet. Compute01 recovered; cold scripts/verify fast is still running through build-slot, with the Nix repair log ending DONE.

J12 continuation: isolated first commit d78a6ca58 pushed on edge-update-v2 (base fd1892201). The generation-proof owner-busy case used buffered open on a directory and never reached systemd recovery. Replaced it with an O_DIRECTORY/O_CLOEXEC raw descriptor and matched os.close calls; no product behavior changed. VM probe on dev-02-std, verbatim: ``` RED: buffered open rejects directory GREEN: directory lock excludes second owner and closes cleanly ``` The full real-systemd seven-case run is queued through the build-slot wrapper. First root-run attempt refused claude-owned fixture files before installing any unit; the retry uses root-owned signed public bundles. No 7/7 claim yet. Compute01 recovered; cold scripts/verify fast is still running through build-slot, with the Nix repair log ending DONE.
kayg commented 2026-10-31 16:50:53 +00:00
Author
Owner
Copy link

J12 writable update state/request slice pushed at 615ce4a60. This is not automatic-update completion: runtime engine, background lifecycle and host wiring remain pending. The schema is plugin-owned optional maintenance; read-only recovery and boot selection never require it. Exact abandoned-version pauses survive collection/restart, readiness is verified before notices, and actual engine selection (not a handoff acknowledgement) completes history. Requests and settings recheck current owner/passkey freshness at commit; historical rollback discloses loss of later sign-in/access changes.

ARM gate through build-slot: 43 unit tests, 11 new updater acceptance tests, 1 pool integration and 2 restart integrations passed; 5 pre-existing subprocess/measurement helpers ignored. All-target Clippy with -D warnings and no-default-features check passed. Receipt: dev-02-std:~/.cache/j12-edge-update-evidence/updater-suite-3.log (UPDATER_SUITE_EXIT=0).

Next rollback test failed as expected with missing copy_historical_database (ROLLBACK_RED_EXIT=101). Implementing an immutable historical source copied into a new supervised generation, retaining the entry generation as fallback and current writer-ID reservations. No cap or production setting changed. Real-systemd proof remains queued.

J12 writable update state/request slice pushed at 615ce4a60. This is not automatic-update completion: runtime engine, background lifecycle and host wiring remain pending. The schema is plugin-owned optional maintenance; read-only recovery and boot selection never require it. Exact abandoned-version pauses survive collection/restart, readiness is verified before notices, and actual engine selection (not a handoff acknowledgement) completes history. Requests and settings recheck current owner/passkey freshness at commit; historical rollback discloses loss of later sign-in/access changes. ARM gate through build-slot: 43 unit tests, 11 new updater acceptance tests, 1 pool integration and 2 restart integrations passed; 5 pre-existing subprocess/measurement helpers ignored. All-target Clippy with -D warnings and no-default-features check passed. Receipt: dev-02-std:~/.cache/j12-edge-update-evidence/updater-suite-3.log (`UPDATER_SUITE_EXIT=0`). Next rollback test failed as expected with missing copy_historical_database (ROLLBACK_RED_EXIT=101). Implementing an immutable historical source copied into a new supervised generation, retaining the entry generation as fallback and current writer-ID reservations. No cap or production setting changed. Real-systemd proof remains queued.
kayg commented 2026-10-31 17:01:21 +00:00
Author
Owner
Copy link

J12 systemd proof on ARM (cua+sudo, build-slot) reached 6/7 after moving public signed fixtures under /root/.cache. The loader correctly refuses a world-writable ancestor (/var/tmp); this was fixture placement, not a trust-policy change. Actual outcomes: adoption pass; healthy commit pass (0 failed 10 ms HTTP polls, retained database unchanged); candidate exit pass; stalled trial restored selected generation after 122.3 s; watchdog death pass; repeated recovery pass.

The final case exposed a second fixture bug after d78a6ca58: owner-busy tried to acquire the healthy service's lifetime installation lock, correctly receiving EAGAIN before exercising recovery. The corrected fixture first stops the unit, acquires the competing owner, then starts it. A fresh all-seven run is active; no 7/7 claim yet.

Rollback preparation pushed as 660ac45e3. Five real SQLite/generation tests pass, including a new immutable historical authorization/data test and real-watchdog fresh-generation rollback commit. CLI all-target Clippy -D warnings passes (ROLLBACK_SUITE_EXIT=0). Rollback controls still need runtime wiring.

Current lifecycle/worker verification encountered shared ARM block exhaustion: /dev/vda3 246G, 236G used, 42M available, 100%; inodes only 10% used. Compiler exited; removed only this job's 2.4G target/debug/incremental and retried through build-slot with CARGO_INCREMENTAL=0. Other jobs untouched.

Initial compute01 fast gate (inherited source plus isolated script fix) reported cli_review::ctrl_c_in_json_mode_ends_with_an_interrupted_envelope_and_exit_130: "still running after SIGINT". Gate continues; attribution is pending an unmodified origin/dev control. This is not a passing final gate.

J12 systemd proof on ARM (cua+sudo, build-slot) reached 6/7 after moving public signed fixtures under /root/.cache. The loader correctly refuses a world-writable ancestor (/var/tmp); this was fixture placement, not a trust-policy change. Actual outcomes: adoption pass; healthy commit pass (0 failed 10 ms HTTP polls, retained database unchanged); candidate exit pass; stalled trial restored selected generation after 122.3 s; watchdog death pass; repeated recovery pass. The final case exposed a second fixture bug after d78a6ca58: owner-busy tried to acquire the healthy service's lifetime installation lock, correctly receiving EAGAIN before exercising recovery. The corrected fixture first stops the unit, acquires the competing owner, then starts it. A fresh all-seven run is active; no 7/7 claim yet. Rollback preparation pushed as 660ac45e3. Five real SQLite/generation tests pass, including a new immutable historical authorization/data test and real-watchdog fresh-generation rollback commit. CLI all-target Clippy -D warnings passes (ROLLBACK_SUITE_EXIT=0). Rollback controls still need runtime wiring. Current lifecycle/worker verification encountered shared ARM block exhaustion: /dev/vda3 246G, 236G used, 42M available, 100%; inodes only 10% used. Compiler exited; removed only this job's 2.4G target/debug/incremental and retried through build-slot with CARGO_INCREMENTAL=0. Other jobs untouched. Initial compute01 fast gate (inherited source plus isolated script fix) reported cli_review::ctrl_c_in_json_mode_ends_with_an_interrupted_envelope_and_exit_130: "still running after SIGINT". Gate continues; attribution is pending an unmodified origin/dev control. This is not a passing final gate.
kayg commented 2026-10-31 17:05:20 +00:00
Author
Owner
Copy link

J12 real-systemd generation proof: 7/7 pass on infraternal-dev-02-std (aarch64), cua+sudo through the mandatory build-slot wrapper. This is the staging artifact proof, not final branch-head qualification: concrete updater engine/host wiring remains pending. Public fixture image SHA256: 083643bc5ba9f800f577223bb2d4684b589215e57c28b5102f6d1dd4ba948df2. Corrected owner fixture pushed as 4a123a0b1. All throwaway units, proof processes and /root/.cache/j12-generation-proof files removed; post-run systemctl/unit-file/process checks found none.

Verbatim e2e output:

{"case": "adopt", "original_state": {"inode": 262028, "path": "/root/.cache/j12-generation-proof/r/8467d5cd/d"}, "result": "pass", "seconds": 0.8, "selection": "generations/a334ae16ae5e4565", "unit": "infraternal-gp-8467d5cd"}
{"case": "healthy", "failed_polls": 0, "longest_outage_ms": 0.0, "reply": "Server replacement requested cold (CA locked)\n\nNext  infraternal status", "result": "pass", "retained_unchanged": true, "seconds": 2.5, "unit": "infraternal-gp-7c43bfc7"}
{"abandoned": "generations/46ec9dbd3536493c", "case": "candidate-exit", "reply": "Server replacement requested cold (CA locked)\n\nNext  infraternal status", "result": "pass", "seconds": 3.5, "unit": "infraternal-gp-8510b03c"}
{"case": "stalled", "recovered_after_s": 122.3, "result": "pass", "seconds": 123.8, "unit": "infraternal-gp-dbda8609"}
{"case": "watchdog-death", "result": "pass", "seconds": 10.3, "unit": "infraternal-gp-e4d59671"}
{"case": "owner-busy", "read_only_after_s": 130.2, "result": "pass", "seconds": 132.1, "unit": "infraternal-gp-80ae5315"}
{"case": "repeated-recovery", "restarts": 3, "result": "pass", "seconds": 3.7, "unit": "infraternal-gp-d5e28910"}

Lifecycle and worker slices pushed as 492e82764 / 6bc1ee6d0. Three lifecycle tests and 14 updater acceptance tests pass (plus the release package existing 43 unit/3 integration tests). Both packages pass all-target Clippy -D warnings and no-default-features checks. Background engine wiring remains incomplete; no completion or size claim.

J12 real-systemd generation proof: **7/7 pass** on infraternal-dev-02-std (aarch64), cua+sudo through the mandatory build-slot wrapper. This is the staging artifact proof, not final branch-head qualification: concrete updater engine/host wiring remains pending. Public fixture image SHA256: `083643bc5ba9f800f577223bb2d4684b589215e57c28b5102f6d1dd4ba948df2`. Corrected owner fixture pushed as 4a123a0b1. All throwaway units, proof processes and /root/.cache/j12-generation-proof files removed; post-run systemctl/unit-file/process checks found none. Verbatim e2e output: ```json {"case": "adopt", "original_state": {"inode": 262028, "path": "/root/.cache/j12-generation-proof/r/8467d5cd/d"}, "result": "pass", "seconds": 0.8, "selection": "generations/a334ae16ae5e4565", "unit": "infraternal-gp-8467d5cd"} {"case": "healthy", "failed_polls": 0, "longest_outage_ms": 0.0, "reply": "Server replacement requested cold (CA locked)\n\nNext infraternal status", "result": "pass", "retained_unchanged": true, "seconds": 2.5, "unit": "infraternal-gp-7c43bfc7"} {"abandoned": "generations/46ec9dbd3536493c", "case": "candidate-exit", "reply": "Server replacement requested cold (CA locked)\n\nNext infraternal status", "result": "pass", "seconds": 3.5, "unit": "infraternal-gp-8510b03c"} {"case": "stalled", "recovered_after_s": 122.3, "result": "pass", "seconds": 123.8, "unit": "infraternal-gp-dbda8609"} {"case": "watchdog-death", "result": "pass", "seconds": 10.3, "unit": "infraternal-gp-e4d59671"} {"case": "owner-busy", "read_only_after_s": 130.2, "result": "pass", "seconds": 132.1, "unit": "infraternal-gp-80ae5315"} {"case": "repeated-recovery", "restarts": 3, "result": "pass", "seconds": 3.7, "unit": "infraternal-gp-d5e28910"} ``` Lifecycle and worker slices pushed as 492e82764 / 6bc1ee6d0. Three lifecycle tests and 14 updater acceptance tests pass (plus the release package existing 43 unit/3 integration tests). Both packages pass all-target Clippy -D warnings and no-default-features checks. Background engine wiring remains incomplete; no completion or size claim.
kayg commented 2026-10-31 17:23:12 +00:00
Author
Owner
Copy link

J12 continuation at 4a123a0b1 on edge-update-v2. Preserved the two pending admission regression files from the handoff. Implementing final receiver-side owner/settings rechecks and an enabled-epoch lease: disable must wait for a transition already admitted by the receiver; re-enable must never revive a stale scope. Prior real-systemd staging proof remains 7/7 (comment 70954); this is not final-head qualification. compute01 is reachable and all new heavy work uses build-slot. Stopped only the obsolete J12 initial-source fast gate after its recorded SIGINT-test failure; the unmodified-dev attribution probe is queued. Current admission suite is queued on compute01. ARM free space fell to 1.6 GB; moved current validation back to compute01 without touching other jobs.

J12 continuation at 4a123a0b1 on edge-update-v2. Preserved the two pending admission regression files from the handoff. Implementing final receiver-side owner/settings rechecks and an enabled-epoch lease: disable must wait for a transition already admitted by the receiver; re-enable must never revive a stale scope. Prior real-systemd staging proof remains 7/7 (comment 70954); this is not final-head qualification. compute01 is reachable and all new heavy work uses build-slot. Stopped only the obsolete J12 initial-source fast gate after its recorded SIGINT-test failure; the unmodified-dev attribution probe is queued. Current admission suite is queued on compute01. ARM free space fell to 1.6 GB; moved current validation back to compute01 without touching other jobs.
kayg commented 2026-10-31 17:48:18 +00:00
Author
Owner
Copy link

J12 admission slice pushed as 5062fd29c on edge-update-v2. Final receiver admission now binds the original requester proof and rechecks owner, unlocked/unexpired/fresh passkey session, feature enablement, channel and quiet-window settings after preparation. The configuration permit and enabled-epoch lease survive worker cancellation; disable waits for already-admitted work and an old scope stays invalid after re-enable. Regression coverage includes erased requester proof (must not become a local-owner request).

VM gate through build-slot on dev-02-std: 43 release unit + 16 updater acceptance + 3 existing integration tests and 3 server lifecycle tests pass; all-target Clippy -D warnings and no-default-features checks pass for both packages. Receipt: ~/.cache/j12-edge-update-evidence/admission-green{,-2}.log; ADMISSION_SUITE_EXIT=0. This is a slice gate, not final scripts/verify fast or final-head systemd qualification. Concrete generation receiver/download integration remains local WIP.

compute01 static/SIGINT attribution work remains assigned there. Its slots were busy; ARM storage recovered to 37 GB. The first ARM lock listing hid root-owned slot paths, so the neutral check queued briefly before receiving slot 3/3.

J12 admission slice pushed as 5062fd29c on edge-update-v2. Final receiver admission now binds the original requester proof and rechecks owner, unlocked/unexpired/fresh passkey session, feature enablement, channel and quiet-window settings after preparation. The configuration permit and enabled-epoch lease survive worker cancellation; disable waits for already-admitted work and an old scope stays invalid after re-enable. Regression coverage includes erased requester proof (must not become a local-owner request). VM gate through build-slot on dev-02-std: 43 release unit + 16 updater acceptance + 3 existing integration tests and 3 server lifecycle tests pass; all-target Clippy -D warnings and no-default-features checks pass for both packages. Receipt: ~/.cache/j12-edge-update-evidence/admission-green{,-2}.log; ADMISSION_SUITE_EXIT=0. This is a slice gate, not final scripts/verify fast or final-head systemd qualification. Concrete generation receiver/download integration remains local WIP. compute01 static/SIGINT attribution work remains assigned there. Its slots were busy; ARM storage recovered to 37 GB. The first ARM lock listing hid root-owned slot paths, so the neutral check queued briefly before receiving slot 3/3.
kayg commented 2026-10-31 18:02:37 +00:00
Author
Owner
Copy link

J12 watchdog child ownership fix pushed as bb3fc44bb. Reproduced a real unjoined child after abandoning preparation: waitpid returned Ok(Exited(...)), rather than ECHILD. Retain a kill-and-join guard through unarmed/armed ownership; successful exec still leaves the same-PID successor responsible for reaping.

Gate on dev-02-std through build-slot: 11 watchdog tests and 5 generation-update tests pass (including real health commit and historical rollback); CLI all-target Clippy -D warnings passes. WATCHDOG_SUITE_EXIT=0; receipt ~/.cache/j12-edge-update-evidence/watchdog-child-green.log.

Two further readiness regressions are RED: discovery stages again with a queued exact request; a request arriving during staging replaces its ready B notice with C. Added pre-I/O and publication-transaction busy checks; package gate pending. Its first retry could not start because shared /tmp was full before nix develop (No space left on device); removed only J12 obsolete ARM static/release target outputs (~983 MB), and retried. Shared volume had independently recovered to 25 GB by cleanup. Final fast/static, complete automatic/manual/host wiring and final-head systemd qualification remain unfinished.

J12 watchdog child ownership fix pushed as bb3fc44bb. Reproduced a real unjoined child after abandoning preparation: waitpid returned Ok(Exited(...)), rather than ECHILD. Retain a kill-and-join guard through unarmed/armed ownership; successful exec still leaves the same-PID successor responsible for reaping. Gate on dev-02-std through build-slot: 11 watchdog tests and 5 generation-update tests pass (including real health commit and historical rollback); CLI all-target Clippy -D warnings passes. WATCHDOG_SUITE_EXIT=0; receipt ~/.cache/j12-edge-update-evidence/watchdog-child-green.log. Two further readiness regressions are RED: discovery stages again with a queued exact request; a request arriving during staging replaces its ready B notice with C. Added pre-I/O and publication-transaction busy checks; package gate pending. Its first retry could not start because shared /tmp was full before nix develop (No space left on device); removed only J12 obsolete ARM static/release target outputs (~983 MB), and retried. Shared volume had independently recovered to 25 GB by cleanup. Final fast/static, complete automatic/manual/host wiring and final-head systemd qualification remain unfinished.
kayg commented 2026-10-31 18:04:03 +00:00
Author
Owner
Copy link

J12 exact-request readiness fix pushed as 47ff4d3c8. Both RED triggers now pass: an already queued exact request prevents discovery I/O, and a request arriving during staging is rechecked in the publication transaction so readiness/notice stays on its requested image. No configuration writer permit is held over network I/O.

Completed gate through build-slot on dev-02-std: 43 release unit + 18 updater acceptance + 3 existing integration tests pass; all-target Clippy -D warnings passes. REQUEST_SUITE_EXIT=0; receipt ~/.cache/j12-edge-update-evidence/exact-request-green-2.log. Download cache bounds and actual engine/event/host integration remain pending; these passing state tests do not establish those guarantees. Concrete signed-image/generation receiver integration is now syncing to the ARM worktree for its first compile/tests, with the reference owned-I/O helper and scheduler/cancellation tests retained. Final fast/static and final-head systemd gates remain owed.

J12 exact-request readiness fix pushed as 47ff4d3c8. Both RED triggers now pass: an already queued exact request prevents discovery I/O, and a request arriving during staging is rechecked in the publication transaction so readiness/notice stays on its requested image. No configuration writer permit is held over network I/O. Completed gate through build-slot on dev-02-std: 43 release unit + 18 updater acceptance + 3 existing integration tests pass; all-target Clippy -D warnings passes. REQUEST_SUITE_EXIT=0; receipt ~/.cache/j12-edge-update-evidence/exact-request-green-2.log. Download cache bounds and actual engine/event/host integration remain pending; these passing state tests do not establish those guarantees. Concrete signed-image/generation receiver integration is now syncing to the ARM worktree for its first compile/tests, with the reference owned-I/O helper and scheduler/cancellation tests retained. Final fast/static and final-head systemd gates remain owed.
kayg commented 2026-10-31 18:23:15 +00:00
Author
Owner
Copy link

J12 continuation on edge-update-v2 at 47ff4d3c8. Concrete generation-engine integration compiles on dev-02-std through build-slot; 20 CLI generation/watchdog tests and both owned-I/O scheduler/cancellation tests pass.

Five new RED regressions reproduced in generation-engine-red.log: the image store retains 3 images where the bound is 2 after repeated check-ins; collection accepts an unsafe alias; collection failure does not refuse new staging; a current release.updates subscription receives no initial state; a quiet-window edit during preparation returns permanent settings refusal rather than postponement. The successor manual-request discovery regression already passes. Reused the reference rename-before-unlink collector and subscription lifecycle; added collection admission and window-only postponement. Full package/Clippy/feature gate is queued, with no GREEN claim yet.

compute01 is reachable. Complete-reference 31053e59b production static builds are queued through build-slot there, x86 then ARM, using the pinned recipe and identical explicit release identity edge-20261031T000000Z. Final implementation comparison, final scripts/verify fast and final-head real-systemd 7/7 remain owed. No caps changed.

J12 continuation on edge-update-v2 at 47ff4d3c8. Concrete generation-engine integration compiles on dev-02-std through build-slot; 20 CLI generation/watchdog tests and both owned-I/O scheduler/cancellation tests pass. Five new RED regressions reproduced in generation-engine-red.log: the image store retains 3 images where the bound is 2 after repeated check-ins; collection accepts an unsafe alias; collection failure does not refuse new staging; a current release.updates subscription receives no initial state; a quiet-window edit during preparation returns permanent settings refusal rather than postponement. The successor manual-request discovery regression already passes. Reused the reference rename-before-unlink collector and subscription lifecycle; added collection admission and window-only postponement. Full package/Clippy/feature gate is queued, with no GREEN claim yet. compute01 is reachable. Complete-reference 31053e59b production static builds are queued through build-slot there, x86 then ARM, using the pinned recipe and identical explicit release identity edge-20261031T000000Z. Final implementation comparison, final scripts/verify fast and final-head real-systemd 7/7 remain owed. No caps changed.
kayg commented 2026-10-31 18:39:21 +00:00
Author
Owner
Copy link

J12 staging-kit slices pushed on edge-update-v2 through 7064bd087:

  • c4ae5ed06: generation-proof signing now requires a complete source revision and signs SOURCE with every fixture image. dev-02-std real Ed25519 verification: signed source bundle proof: 3/3 pass.
  • a8bff3339 / 7064bd087: staging-proof uses plain SSH to claude@infraternal-perf-01-backup01, uploads public artifacts before perf-run --root, retains installed wrapper snapshots on failures, and cleans only the unique run root. Each Cargo preparation command uses build-slot on the build VM. Removed the obsolete private lock/retired root target and corrected inner receipt labels.

VM checks: all three generated shell layers pass sh -n; Python syntax and the existing real signature/checksum staging_artifacts_test.py pass. This repairs the kit launcher; it does not establish perf acceptance or port the missing reviewer transport/latency/retention/reconnect cases. Full signed live-session proof remains owed. No measurement has been run on the shared build hosts.

Rust integration GREEN gate has waited for an ARM slot since 18:22 UTC (23:52 IST); complete-reference static builds remain queued on compute01. Neither has produced a result, and no final fast/size claim is made.

J12 staging-kit slices pushed on edge-update-v2 through 7064bd087: - c4ae5ed06: generation-proof signing now requires a complete source revision and signs SOURCE with every fixture image. dev-02-std real Ed25519 verification: `signed source bundle proof: 3/3 pass`. - a8bff3339 / 7064bd087: staging-proof uses plain SSH to claude@infraternal-perf-01-backup01, uploads public artifacts before perf-run --root, retains installed wrapper snapshots on failures, and cleans only the unique run root. Each Cargo preparation command uses build-slot on the build VM. Removed the obsolete private lock/retired root target and corrected inner receipt labels. VM checks: all three generated shell layers pass sh -n; Python syntax and the existing real signature/checksum staging_artifacts_test.py pass. This repairs the kit launcher; it does not establish perf acceptance or port the missing reviewer transport/latency/retention/reconnect cases. Full signed live-session proof remains owed. No measurement has been run on the shared build hosts. Rust integration GREEN gate has waited for an ARM slot since 18:22 UTC (23:52 IST); complete-reference static builds remain queued on compute01. Neither has produced a result, and no final fast/size claim is made.
kayg commented 2026-10-31 19:00:00 +00:00
Author
Owner
Copy link

J12 matched complete-reference sizes finished on compute01 via build-slot, source 31053e59b, production trust, unchanged pinned static recipe, explicit release identity edge-20261031T000000Z: x86_64 22,096,448 bytes (SHA256 f4a35bb86ad6214b8447dcde111d7753f12848e6e37494c580afd802e9fcbd41); aarch64 20,200,024 bytes (SHA256 aaaa570fa4ba1814fcff3f6102238b92c7dddf803b3d38b82966af3655c28117). REFERENCE_SIZE_EXIT=0. Preserved binaries and size-reference.log in compute01:~/.cache/j12-edge-update-evidence/reference/ and parent; deleted the temporary reference target. Interim implementation comparison is now queued using the same identity/recipe and the job's single target; it is not final-head sizing.

All 19 restart tests pass after moving only this job's target under its private cache ancestor; no validation was weakened. Remaining integration Clippy/feature check caught two adapter lint issues; corrected and rerun queued. Historical rollback bookkeeping and retry-history bounds have regression tests queued after that check. Further local assertions cover the actual historical trial copy and retained directory aliases. Final fast/systemd qualification and remaining host/resource/perf-kit work are still owed; no completion or cap change.

J12 matched complete-reference sizes finished on compute01 via build-slot, source 31053e59b, production trust, unchanged pinned static recipe, explicit release identity edge-20261031T000000Z: x86_64 22,096,448 bytes (SHA256 f4a35bb86ad6214b8447dcde111d7753f12848e6e37494c580afd802e9fcbd41); aarch64 20,200,024 bytes (SHA256 aaaa570fa4ba1814fcff3f6102238b92c7dddf803b3d38b82966af3655c28117). REFERENCE_SIZE_EXIT=0. Preserved binaries and size-reference.log in compute01:~/.cache/j12-edge-update-evidence/reference/ and parent; deleted the temporary reference target. Interim implementation comparison is now queued using the same identity/recipe and the job's single target; it is not final-head sizing. All 19 restart tests pass after moving only this job's target under its private cache ancestor; no validation was weakened. Remaining integration Clippy/feature check caught two adapter lint issues; corrected and rerun queued. Historical rollback bookkeeping and retry-history bounds have regression tests queued after that check. Further local assertions cover the actual historical trial copy and retained directory aliases. Final fast/systemd qualification and remaining host/resource/perf-kit work are still owed; no completion or cap change.
kayg commented 2026-10-31 19:04:03 +00:00
Author
Owner
Copy link

J12 three gated slices pushed on edge-update-v2: e6c965c46 owns synchronous image I/O while yielding serving workers (scheduler/cancellation 2/2); 609ad6ecf preserves exact intent when only the quiet window changes; 3556e569d delivers authenticated release.updates state, one ready toast and subscription withdrawal. Primitives gate: API 2, signed images 4, server lifecycle 3, release 43 unit/22 acceptance/3 integrations, CLI generation 20, restart 19; all-target Clippy and no-default checks pass (GENERATION_ENGINE_GREEN_REST_EXIT=0). These are slice gates, not final fast/systemd qualification.

Four subsequent regressions were reproduced before fixes: historical rollback advertises the old forward applying row as automatic; 105 explicit retries retain 105 rows; a retained image alias bypasses the collector's type check; real copied rollback trial retains B applying instead of A rollback applying/B applied. RED exit=101 in each case. Implemented trial-copy-only bookkeeping, history pruning after reconciliation, and alias checking before the keep exemption. Full follow-up green gate queued on ARM via build-slot; runtime engine/image integration and those fixes remain uncommitted until it passes. Receipt: generation-engine-green-rest-3.log. No current authority is overlaid onto restored historical users/sessions/settings.

J12 three gated slices pushed on edge-update-v2: e6c965c46 owns synchronous image I/O while yielding serving workers (scheduler/cancellation 2/2); 609ad6ecf preserves exact intent when only the quiet window changes; 3556e569d delivers authenticated release.updates state, one ready toast and subscription withdrawal. Primitives gate: API 2, signed images 4, server lifecycle 3, release 43 unit/22 acceptance/3 integrations, CLI generation 20, restart 19; all-target Clippy and no-default checks pass (GENERATION_ENGINE_GREEN_REST_EXIT=0). These are slice gates, not final fast/systemd qualification. Four subsequent regressions were reproduced before fixes: historical rollback advertises the old forward applying row as automatic; 105 explicit retries retain 105 rows; a retained image alias bypasses the collector's type check; real copied rollback trial retains B applying instead of A rollback applying/B applied. RED exit=101 in each case. Implemented trial-copy-only bookkeeping, history pruning after reconciliation, and alias checking before the keep exemption. Full follow-up green gate queued on ARM via build-slot; runtime engine/image integration and those fixes remain uncommitted until it passes. Receipt: generation-engine-green-rest-3.log. No current authority is overlaid onto restored historical users/sessions/settings.
kayg commented 2026-10-31 19:10:10 +00:00
Author
Owner
Copy link

J12 integration and rollback fixes are gated and pushed at 819b99b69. HISTORY_INTEGRATION_GREEN_EXIT=0 on ARM through build-slot: owned-I/O 2, signed image/collection 4, release 43 unit + 24 updater acceptance + 3 integrations, CLI generation 20, all-target Clippy -D warnings and no-default checks. Four preserved RED triggers now pass, including the actual copied historical rollback trial and 105 explicit retries bounded to 100 history rows. The restored historical users/sessions/settings are not overlaid with current authority.

Plan-target finding (not waived): provisional physical core accounting at 819b99b69 totals 2,568 lines including comments/blanks, before separate optional updater/image/socket adapters and before host integration. Modules: generation 581; startup 152; generation_state 101; CLI boot 507; update preparation 494; watchdog 368 (fixture helper excluded); runtime 146; writer reservation 112; copy owner 107. This exceeds the plan's 600–900 replacement-core target and even its 1,297-line reference accounting. The roles differ, so this is explicit inclusive accounting, not a claimed like-for-like reduction. core-line-accounting.json is saved with evidence. No target was silently relaxed.

Matched implementation size build is queued on compute01 against exact committed 819b99b69 with the reference recipe/identity. Prior pre-history interim queue was stopped before acquiring a slot and superseded; size-implementation-819b99b69.log is authoritative. Staging-only origin regression is queued on ARM so automatic discovery can use disposable signed fixtures while shipping images keep the production origin. Host lockstep/repair, failure-table VM coverage, remaining perf kit drivers, final fast and final-head systemd proof remain unfinished.

J12 integration and rollback fixes are gated and pushed at 819b99b69. HISTORY_INTEGRATION_GREEN_EXIT=0 on ARM through build-slot: owned-I/O 2, signed image/collection 4, release 43 unit + 24 updater acceptance + 3 integrations, CLI generation 20, all-target Clippy -D warnings and no-default checks. Four preserved RED triggers now pass, including the actual copied historical rollback trial and 105 explicit retries bounded to 100 history rows. The restored historical users/sessions/settings are not overlaid with current authority. Plan-target finding (not waived): provisional physical core accounting at 819b99b69 totals 2,568 lines including comments/blanks, before separate optional updater/image/socket adapters and before host integration. Modules: generation 581; startup 152; generation_state 101; CLI boot 507; update preparation 494; watchdog 368 (fixture helper excluded); runtime 146; writer reservation 112; copy owner 107. This exceeds the plan's 600–900 replacement-core target and even its 1,297-line reference accounting. The roles differ, so this is explicit inclusive accounting, not a claimed like-for-like reduction. core-line-accounting.json is saved with evidence. No target was silently relaxed. Matched implementation size build is queued on compute01 against exact committed 819b99b69 with the reference recipe/identity. Prior pre-history interim queue was stopped before acquiring a slot and superseded; size-implementation-819b99b69.log is authoritative. Staging-only origin regression is queued on ARM so automatic discovery can use disposable signed fixtures while shipping images keep the production origin. Host lockstep/repair, failure-table VM coverage, remaining perf kit drivers, final fast and final-head systemd proof remain unfinished.
kayg commented 2026-10-31 19:27:36 +00:00
Author
Owner
Copy link

J12 resumes edge-update-v2 at 06a82e7fb. compute01 is reachable; mandatory build-slot remains in force. Prior fixes and 7/7 staging proof are already recorded. Continuing from the committed automatic/rollback qualification runner and pending protocol/host-metadata tests, preserving the handoff edits. Complete-reference size receipts exist; implementation sizing is still queued. Final fast, final-head systemd qualification, host lockstep, resource failure coverage and perf acceptance remain owed.

J12 resumes edge-update-v2 at 06a82e7fb. compute01 is reachable; mandatory build-slot remains in force. Prior fixes and 7/7 staging proof are already recorded. Continuing from the committed automatic/rollback qualification runner and pending protocol/host-metadata tests, preserving the handoff edits. Complete-reference size receipts exist; implementation sizing is still queued. Final fast, final-head systemd qualification, host lockstep, resource failure coverage and perf acceptance remain owed.
kayg commented 2026-10-31 19:38:55 +00:00
Author
Owner
Copy link

J12 host-wire foundations pushed at eb4ecf8c3 (30f7f7af3 protocol bounds; eb4ecf8c3 strict metadata). ARM build-slot gate: protocol 12 tests, host metadata 4 tests, both all-target Clippy -D warnings, release no-default check and staging CLI build pass (HOST_CODEC_GREEN_EXIT=0, PROOF_BUILD_EXIT=0). Runtime host transport is still pending.

New real-systemd updater proof on dev-02-std passes 2/2: real automatic discovery through the generation receiver, and root-queued historical rollback through a fresh generation. Both verify selected AND executing image identity; rollback restores the historical marker and discards the later committed marker. This local-owner fixture does not prove browser-owner admission. Initial installation refusal came from cp -a preserving claude ownership inside the root fixture; corrected only fixture ownership. No trust check weakened. The separate seven-case rerun is queued; production static sizing at 06a82e7fb is running on compute01 through build-slot. No final fast or completion claim.

build-slot: [19:33:22] all 3 slots busy, waiting...
build-slot: [19:36:07] got slot 3/3
{"automatic": "edge-20261030T000002Z", "case": "automatic", "executing_identity_verified": true, "result": "pass"}
{"automatic": "edge-20261030T000002Z", "case": "rollback", "executing_identity_verified": true, "historical_data_restored": true, "result": "pass", "rollback": "edge-20261030T000001Z"}
J12 host-wire foundations pushed at eb4ecf8c3 (30f7f7af3 protocol bounds; eb4ecf8c3 strict metadata). ARM build-slot gate: protocol 12 tests, host metadata 4 tests, both all-target Clippy -D warnings, release no-default check and staging CLI build pass (HOST_CODEC_GREEN_EXIT=0, PROOF_BUILD_EXIT=0). Runtime host transport is still pending. New real-systemd updater proof on dev-02-std passes **2/2**: real automatic discovery through the generation receiver, and root-queued historical rollback through a fresh generation. Both verify selected AND executing image identity; rollback restores the historical marker and discards the later committed marker. This local-owner fixture does not prove browser-owner admission. Initial installation refusal came from cp -a preserving claude ownership inside the root fixture; corrected only fixture ownership. No trust check weakened. The separate seven-case rerun is queued; production static sizing at 06a82e7fb is running on compute01 through build-slot. No final fast or completion claim. ```text build-slot: [19:33:22] all 3 slots busy, waiting... build-slot: [19:36:07] got slot 3/3 {"automatic": "edge-20261030T000002Z", "case": "automatic", "executing_identity_verified": true, "result": "pass"} {"automatic": "edge-20261030T000002Z", "case": "rollback", "executing_identity_verified": true, "historical_data_restored": true, "result": "pass", "rollback": "edge-20261030T000001Z"} ```
kayg commented 2026-10-31 19:47:44 +00:00
Author
Owner
Copy link

J12 current staging binary systemd qualification is 7/7 pass on dev-02-std via cua+sudo/build-slot, source eb4ecf8c3. Healthy handoff reports 0 failed 10 ms probes and unchanged retained database; stopped candidate recovery 122.5 s; competing owner read-only service 130.4 s; three repeated recoveries pass. This supplements the new automatic/historical rollback proof (2/2), rather than replacing admission/resource/perf acceptance. Corrected invocation uses /bin/true for the exiting fixture: it passes --version then exits during trial. The first /bin/false invocation refused at preflight and is retained as a failed receipt.

Cleanup verified: no infraternal-gp units/unit files, no process argv referencing the unique fixture root; removed /root/.cache/j12-current.

Interim matched x86 image at 06a82e7fb: 22,021,640 B, SHA256 89b6c98a73d97fa16db705bd1de638523800ac3389a5cf6981ccfdf0649455ea. Complete reference 31053e59b: 22,096,448 B => -74,808 B. ARM is building; host runtime is still incomplete, so this is not final sizing. No caps changed.

Verbatim seven-case output:

{"case": "adopt", "original_state": {"inode": 262602, "path": "/root/.cache/j12-current/seven-rerun/f984f6a7/d"}, "result": "pass", "seconds": 1.3, "selection": "generations/645398cd4c2f4530", "unit": "infraternal-gp-f984f6a7"}
{"case": "healthy", "failed_polls": 0, "longest_outage_ms": 0.0, "reply": "Server replacement requested cold (CA locked)\n\nNext  infraternal status", "result": "pass", "retained_unchanged": true, "seconds": 3.7, "unit": "infraternal-gp-b6f83b1b"}
{"abandoned": "generations/91a5892857374d25", "case": "candidate-exit", "reply": "Server replacement requested cold (CA locked)\n\nNext  infraternal status", "result": "pass", "seconds": 3.8, "unit": "infraternal-gp-c34f876c"}
{"case": "stalled", "recovered_after_s": 122.5, "result": "pass", "seconds": 124.6, "unit": "infraternal-gp-696ccb0d"}
{"case": "watchdog-death", "result": "pass", "seconds": 4.8, "unit": "infraternal-gp-e2406aa8"}
{"case": "owner-busy", "read_only_after_s": 130.4, "result": "pass", "seconds": 132.1, "unit": "infraternal-gp-c8c87533"}
{"case": "repeated-recovery", "restarts": 3, "result": "pass", "seconds": 5.4, "unit": "infraternal-gp-ce96b1aa"}
J12 current staging binary systemd qualification is **7/7 pass** on dev-02-std via cua+sudo/build-slot, source eb4ecf8c3. Healthy handoff reports 0 failed 10 ms probes and unchanged retained database; stopped candidate recovery 122.5 s; competing owner read-only service 130.4 s; three repeated recoveries pass. This supplements the new automatic/historical rollback proof (2/2), rather than replacing admission/resource/perf acceptance. Corrected invocation uses /bin/true for the exiting fixture: it passes --version then exits during trial. The first /bin/false invocation refused at preflight and is retained as a failed receipt. Cleanup verified: no infraternal-gp units/unit files, no process argv referencing the unique fixture root; removed /root/.cache/j12-current. Interim matched x86 image at 06a82e7fb: 22,021,640 B, SHA256 89b6c98a73d97fa16db705bd1de638523800ac3389a5cf6981ccfdf0649455ea. Complete reference 31053e59b: 22,096,448 B => -74,808 B. ARM is building; host runtime is still incomplete, so this is not final sizing. No caps changed. Verbatim seven-case output: ```text {"case": "adopt", "original_state": {"inode": 262602, "path": "/root/.cache/j12-current/seven-rerun/f984f6a7/d"}, "result": "pass", "seconds": 1.3, "selection": "generations/645398cd4c2f4530", "unit": "infraternal-gp-f984f6a7"} {"case": "healthy", "failed_polls": 0, "longest_outage_ms": 0.0, "reply": "Server replacement requested cold (CA locked)\n\nNext infraternal status", "result": "pass", "retained_unchanged": true, "seconds": 3.7, "unit": "infraternal-gp-b6f83b1b"} {"abandoned": "generations/91a5892857374d25", "case": "candidate-exit", "reply": "Server replacement requested cold (CA locked)\n\nNext infraternal status", "result": "pass", "seconds": 3.8, "unit": "infraternal-gp-c34f876c"} {"case": "stalled", "recovered_after_s": 122.5, "result": "pass", "seconds": 124.6, "unit": "infraternal-gp-696ccb0d"} {"case": "watchdog-death", "result": "pass", "seconds": 4.8, "unit": "infraternal-gp-e2406aa8"} {"case": "owner-busy", "read_only_after_s": 130.4, "result": "pass", "seconds": 132.1, "unit": "infraternal-gp-c8c87533"} {"case": "repeated-recovery", "restarts": 3, "result": "pass", "seconds": 5.4, "unit": "infraternal-gp-ce96b1aa"} ```
kayg commented 2026-10-31 19:53:16 +00:00
Author
Owner
Copy link

J12 transport foundation pushed at 2c9301f046. The real-mTLS identity exchange first failed with UnexpectedEof; it now passes with reply-owned effects. Unnegotiated machine frames remain refused before feature dispatch. One exchange remains fenced through its reply write; session-only dispatch stays inert. Concrete host receiver/sender and capability advertisement are still pending.

ARM gates via build-slot: 8 mTLS daemon tests + 10 worker tests pass; remote+mesh all-target Clippy -D warnings and infraternal-agent/CLI no-default checks pass (MACHINE_TRANSPORT_GREEN_EXIT=0). Full infraternal-agent library with remote,mesh and three test threads:

test result: ok. 151 passed; 0 failed; 20 ignored; 0 measured; 0 filtered out; finished in 11.41s

The first broad invocation failed three AF_UNIX fixtures because their default paths exceeded SUN_LEN; the corrected invocation uses the existing INFRATERNAL_TEST_STATE_ROOT short-root support, with no product/test weakening. Receipts: ARM ~/.cache/j12-edge-update-evidence/machine-transport-{red-2,green-2,full-short}.log. Local continuation ledger: ~/.cache/codex-scratch/j12/continuation.md. Current next RED tests exercise the server actor on ledger-admitted real mTLS, including cancelled-request fencing. The matched ARM size build is still running on compute01; final fast/resource/perf/host acceptance remains unfinished.

J12 transport foundation pushed at 2c9301f04656bd16c526429845f27cb585c4a781. The real-mTLS identity exchange first failed with UnexpectedEof; it now passes with reply-owned effects. Unnegotiated machine frames remain refused before feature dispatch. One exchange remains fenced through its reply write; session-only dispatch stays inert. Concrete host receiver/sender and capability advertisement are still pending. ARM gates via build-slot: 8 mTLS daemon tests + 10 worker tests pass; remote+mesh all-target Clippy -D warnings and infraternal-agent/CLI no-default checks pass (MACHINE_TRANSPORT_GREEN_EXIT=0). Full infraternal-agent library with remote,mesh and three test threads: ```text test result: ok. 151 passed; 0 failed; 20 ignored; 0 measured; 0 filtered out; finished in 11.41s ``` The first broad invocation failed three AF_UNIX fixtures because their default paths exceeded SUN_LEN; the corrected invocation uses the existing INFRATERNAL_TEST_STATE_ROOT short-root support, with no product/test weakening. Receipts: ARM ~/.cache/j12-edge-update-evidence/machine-transport-{red-2,green-2,full-short}.log. Local continuation ledger: ~/.cache/codex-scratch/j12/continuation.md. Current next RED tests exercise the server actor on ledger-admitted real mTLS, including cancelled-request fencing. The matched ARM size build is still running on compute01; final fast/resource/perf/host acceptance remains unfinished.
kayg commented 2026-10-31 20:04:26 +00:00
Author
Owner
Copy link

J12 continuation at pushed 2c9301f04. Matched interim production images at 06a82e7fb completed on compute01 through build-slot: x86_64 22,021,640 B vs complete reference 22,096,448 B (−74,808 B); aarch64 20,150,168 B vs 20,200,024 B (−49,856 B). Identical edge-20261031T000000Z identity/pinned recipe/production trust. These precede host runtime completion and are not final acceptance sizes. IMPLEMENTATION_SIZE_EXIT=0; receipts and binaries preserved in compute01 ~/.cache/j12-edge-update-evidence/. No caps changed.

Server actor WIP adds installed-authority machine exchange and real-mTLS round-trip/cancelled-waiter/provisioning refusal tests. Its gate is queued through build-slot on compute01 (server-machine-green.log). ARM job target removed to relieve shared disk pressure; further builds use compute01 and one target. No active root proof units/files remain; prior systemd 7/7 + automatic/rollback 2/2 evidence is retained. Final fast, complete host/resource/perf work and final-head sizing remain owed.

J12 continuation at pushed 2c9301f04. Matched interim production images at 06a82e7fb completed on compute01 through build-slot: x86_64 22,021,640 B vs complete reference 22,096,448 B (−74,808 B); aarch64 20,150,168 B vs 20,200,024 B (−49,856 B). Identical edge-20261031T000000Z identity/pinned recipe/production trust. These precede host runtime completion and are not final acceptance sizes. IMPLEMENTATION_SIZE_EXIT=0; receipts and binaries preserved in compute01 ~/.cache/j12-edge-update-evidence/. No caps changed. Server actor WIP adds installed-authority machine exchange and real-mTLS round-trip/cancelled-waiter/provisioning refusal tests. Its gate is queued through build-slot on compute01 (server-machine-green.log). ARM job target removed to relieve shared disk pressure; further builds use compute01 and one target. No active root proof units/files remain; prior systemd 7/7 + automatic/rollback 2/2 evidence is retained. Final fast, complete host/resource/perf work and final-head sizing remain owed.
kayg commented 2026-10-31 20:18:57 +00:00
Author
Owner
Copy link

J12 crash-safety snapshots pushed on edge-update-v2 through b328e1ff3; these are explicitly WIP, not gated completion commits. 54b8ceb9c adds the server actor/NodeChannel installed-authority exchange with real-mTLS cancelled-flight and scope regressions. 0ccc9c9ec retains the accepted reference's bounded exact-server sender and 11 regression cases; concrete catalog/receiver integration remains pending. b328e1ff3 prepares a disposable ext4 systemd runtime storage proof (256 MiB/256 inodes, original A and committed B, blocks/inodes independently, three restarts with fillers, WAL/selected/executing identity checks and capacity-restored update). Both Python drivers pass syntax compilation on compute01; the new runtime proof has not executed.

The actor/bridge gate has been waiting for a mandatory build slot since 20:05 UTC; sender checks follow it sequentially under the same wrapper. Active parent PID2912540; compute01 ~/.cache/j12-edge-update-evidence/server-machine-green-2.log. No slot bypass, control-host build or final fast claim. Formatting/gate results will replace these provisional statuses. Prior final-head-independent systemd 7/7 and automatic/rollback 2/2 receipts remain as previously quoted; full host/resource/perf acceptance and final sizes remain owed.

J12 crash-safety snapshots pushed on edge-update-v2 through b328e1ff3; these are explicitly WIP, not gated completion commits. 54b8ceb9c adds the server actor/NodeChannel installed-authority exchange with real-mTLS cancelled-flight and scope regressions. 0ccc9c9ec retains the accepted reference's bounded exact-server sender and 11 regression cases; concrete catalog/receiver integration remains pending. b328e1ff3 prepares a disposable ext4 systemd runtime storage proof (256 MiB/256 inodes, original A and committed B, blocks/inodes independently, three restarts with fillers, WAL/selected/executing identity checks and capacity-restored update). Both Python drivers pass syntax compilation on compute01; the new runtime proof has not executed. The actor/bridge gate has been waiting for a mandatory build slot since 20:05 UTC; sender checks follow it sequentially under the same wrapper. Active parent PID2912540; compute01 ~/.cache/j12-edge-update-evidence/server-machine-green-2.log. No slot bypass, control-host build or final fast claim. Formatting/gate results will replace these provisional statuses. Prior final-head-independent systemd 7/7 and automatic/rollback 2/2 receipts remain as previously quoted; full host/resource/perf acceptance and final sizes remain owed.
kayg commented 2026-10-31 20:32:49 +00:00
Author
Owner
Copy link

J12 partial actor gate on compute01 completed: new real-mTLS machine tests 3/3; broad remote-runtime suite 54 passed, 0 failed, 4 ignored; bridge provisioning/no-authority/local scope test 1/1. The command then failed dependency Clippy at the unchanged remote-only inspect_kernel_state/retire_kernel_state unnecessary_wraps cases already observed earlier. Server mesh does not enable infraternal-agent/mesh; the retry uses the shipping feature union and adds a remote-without-SSH tests compile check. Gate PID3251079 is queued through build-slot; server-machine-green-3.log. No GREEN or final-fast claim yet.

New ext4 runtime proof failed BEFORE exhaustion, so it establishes no full-disk guarantee. Its external system-Python SQLite writer close removed WAL/SHM while the Rust server was live; a diagnostic reproduced WAL 1,186,592 B/SHM 32,768 B while the writer was open, then absent sidecars on close. The first run also recorded a service SIGBUS. This is being treated as an invalid fixture boundary pending qualification, not silently weakening the nonempty-WAL oracle. The draft now uses a test-only helper linked to the pinned engine with the same persistent-WAL/no-close-checkpoint controls; compile/run still owed. Logs: local evidence/generation-storage-proof-fixture-red.log and storage-debug-python-close.log. ARM cleanup verified no proof units/unit files/mounts/processes; unique root fixture removed, no owned coredump file found.

A tests-first retention check is queued after sender validation: abandoned image staging currently contains filenames excluded from the metadata-only collector allowlist. The test retains strict type/mode/owner/nlink/UUID/active-lock controls and will be observed before any collector change.

J12 partial actor gate on compute01 completed: new real-mTLS machine tests 3/3; broad remote-runtime suite 54 passed, 0 failed, 4 ignored; bridge provisioning/no-authority/local scope test 1/1. The command then failed dependency Clippy at the unchanged remote-only inspect_kernel_state/retire_kernel_state unnecessary_wraps cases already observed earlier. Server mesh does not enable infraternal-agent/mesh; the retry uses the shipping feature union and adds a remote-without-SSH tests compile check. Gate PID3251079 is queued through build-slot; server-machine-green-3.log. No GREEN or final-fast claim yet. New ext4 runtime proof failed BEFORE exhaustion, so it establishes no full-disk guarantee. Its external system-Python SQLite writer close removed WAL/SHM while the Rust server was live; a diagnostic reproduced WAL 1,186,592 B/SHM 32,768 B while the writer was open, then absent sidecars on close. The first run also recorded a service SIGBUS. This is being treated as an invalid fixture boundary pending qualification, not silently weakening the nonempty-WAL oracle. The draft now uses a test-only helper linked to the pinned engine with the same persistent-WAL/no-close-checkpoint controls; compile/run still owed. Logs: local evidence/generation-storage-proof-fixture-red.log and storage-debug-python-close.log. ARM cleanup verified no proof units/unit files/mounts/processes; unique root fixture removed, no owned coredump file found. A tests-first retention check is queued after sender validation: abandoned image staging currently contains filenames excluded from the metadata-only collector allowlist. The test retains strict type/mode/owner/nlink/UUID/active-lock controls and will be observed before any collector change.
kayg commented 2026-10-31 20:44:15 +00:00
Author
Owner
Copy link

J12 crash-safety snapshots are pushed through a6b59fe8d on edge-update-v2 (48419a25a feature-safe fixtures, f1d1621e7 pinned-WAL proof helper, a6b59fe8d two queued regressions). These remain WIP, not gated completion. Current compute01 wrapper PID3387163 (parent3387160), server-machine-green-4.log, queued through build-slot. A shell quoting error stopped the previous retry after the expected remote-without-SSH RED; wrapper fixed locally, transferred and bash -n checked on the VM. No source mutation while a build is running.

Investigation update to the prior WAL fixture finding: there may be a product cause, not merely an external-engine fixture mismatch. Store::selected reads generation completeness by opening/closing the live SQLite inode outside SQLite's VFS. POSIX closes can release every process record lock for that inode; this could let another SQLite process treat a still-live database as last-close and remove sidecars. A targeted regression now observes the kernel SQLite lock from a separate Python fcntl process before/after selection inspection, without opening another SQLite engine. It is queued before any product change. Do not consider the pinned helper a waiver of this possible lock-loss defect. The original SIGBUS and WAL-close diagnostics remain preserved. ARM root systemd cleanup is complete and no ARM commands remain active.

J12 crash-safety snapshots are pushed through a6b59fe8d on edge-update-v2 (48419a25a feature-safe fixtures, f1d1621e7 pinned-WAL proof helper, a6b59fe8d two queued regressions). These remain WIP, not gated completion. Current compute01 wrapper PID3387163 (parent3387160), server-machine-green-4.log, queued through build-slot. A shell quoting error stopped the previous retry after the expected remote-without-SSH RED; wrapper fixed locally, transferred and bash -n checked on the VM. No source mutation while a build is running. Investigation update to the prior WAL fixture finding: there may be a product cause, not merely an external-engine fixture mismatch. Store::selected reads generation completeness by opening/closing the live SQLite inode outside SQLite's VFS. POSIX closes can release every process record lock for that inode; this could let another SQLite process treat a still-live database as last-close and remove sidecars. A targeted regression now observes the kernel SQLite lock from a separate Python fcntl process before/after selection inspection, without opening another SQLite engine. It is queued before any product change. Do not consider the pinned helper a waiver of this possible lock-loss defect. The original SIGBUS and WAL-close diagnostics remain preserved. ARM root systemd cleanup is complete and no ARM commands remain active.
kayg commented 2026-10-31 20:56:04 +00:00
Author
Owner
Copy link

J12 resumed at a6b59fe8d after rereading the updated brief/accepted plan. Compute01 is reachable; the existing build-slot gate PID3387163 is still queued (server-machine-green-4.log), with no VM source changes during the gate. Added a queued live-original-adoption lock diagnostic alongside the existing selection/SHM regressions.

A short rootless kernel probe on compute01 confirms the mechanism independently of the product build: both the SQLite main-file shared lock and SHM byte-128 lifetime lock block a separate process before a raw open/fsync/close, and become obtainable afterwards. Receipt ~/.cache/j12-edge-update-evidence/sqlite-close-lock-proof.log. This confirms the POSIX close hazard; product regressions are still pending, so it is not a passing product gate. Production initial adoption is in the separate installer process; selection/admission occur in the serving process. The fix/review must preserve that distinction and SQLite FULL durability, rather than masking the original WAL/SIGBUS evidence with a new fixture.

J12 resumed at a6b59fe8d after rereading the updated brief/accepted plan. Compute01 is reachable; the existing build-slot gate PID3387163 is still queued (server-machine-green-4.log), with no VM source changes during the gate. Added a queued live-original-adoption lock diagnostic alongside the existing selection/SHM regressions. A short rootless kernel probe on compute01 confirms the mechanism independently of the product build: both the SQLite main-file shared lock and SHM byte-128 lifetime lock block a separate process before a raw open/fsync/close, and become obtainable afterwards. Receipt ~/.cache/j12-edge-update-evidence/sqlite-close-lock-proof.log. This confirms the POSIX close hazard; product regressions are still pending, so it is not a passing product gate. Production initial adoption is in the separate installer process; selection/admission occur in the serving process. The fix/review must preserve that distinction and SQLite FULL durability, rather than masking the original WAL/SIGBUS evidence with a new fixture.
kayg commented 2026-10-31 21:04:23 +00:00
Author
Owner
Copy link

J12 crash-safety snapshots are pushed through 025a980d7: 7082d4250 makes post-exhaustion recovery progress to a distinct signed version (four-bundle public signature check 4/4 and driver syntax pass on compute01); 5f4e3020d prepares metadata-only live SQLite checks and directory-name durability; 5ea902402 prepares exact abandoned-image collection; 025a980d7 preserves the original-state publication diagnostic. These remain explicitly WIP, awaiting product RED/GREEN results. The fixes have NOT been copied into the queued baseline gate, so it will still exercise the original failure paths. Current compute01 gate PID3387163 remains waiting for a mandatory build slot (about25minutes), server-machine-green-4.log. No slot bypass or local build/test. Final fast, exact-head e2e, full storage/host/perf acceptance and final sizes remain owed.

J12 crash-safety snapshots are pushed through 025a980d7: 7082d4250 makes post-exhaustion recovery progress to a distinct signed version (four-bundle public signature check 4/4 and driver syntax pass on compute01); 5f4e3020d prepares metadata-only live SQLite checks and directory-name durability; 5ea902402 prepares exact abandoned-image collection; 025a980d7 preserves the original-state publication diagnostic. These remain explicitly WIP, awaiting product RED/GREEN results. The fixes have NOT been copied into the queued baseline gate, so it will still exercise the original failure paths. Current compute01 gate PID3387163 remains waiting for a mandatory build slot (about25minutes), server-machine-green-4.log. No slot bypass or local build/test. Final fast, exact-head e2e, full storage/host/perf acceptance and final sizes remain owed.
kayg commented 2026-10-31 21:25:23 +00:00
Author
Owner
Copy link

J12 actor/sender slice gates completed on compute01 after ~41 minutes queued. Actor: real-mTLS machine tests 3/3; broad remote runtime 54 passed, 0 failed, 4 ignored; both bridge scope tests pass, including installed authority ending at revocation. API no-default, production-union server all-target Clippy, server no-default and remote-without-SSH tests compile all pass: SERVER_MACHINE_GREEN_EXIT=0. Sender: 11 passed, 0 failed; all-target release Clippy and no-default pass: HOST_SENDER_GREEN_EXIT=0. Retrieved formatter outputs; bridge formatting pushed in ac0a8c7e8. These validate the actor/sender slices, not the newer unexecuted storage fixes or completed host wiring.

The abandoned-image regression then failed at its intended assertion: “dead image owners must not leak unbounded candidate payloads” (IMAGE_STAGING_RED_EXIT=101). This confirms the collector filename gap. The prepared exact-name allowlist fix remains local/pushed WIP and has not contaminated the baseline run. Pinned storage helper compilation and live SQLite lock regressions now follow in server-machine-green-4.log under the same slot. Receipt will be copied locally when the gate ends; final fast/e2e/sizes remain pending.

J12 actor/sender slice gates completed on compute01 after ~41 minutes queued. Actor: real-mTLS machine tests 3/3; broad remote runtime 54 passed, 0 failed, 4 ignored; both bridge scope tests pass, including installed authority ending at revocation. API no-default, production-union server all-target Clippy, server no-default and remote-without-SSH tests compile all pass: SERVER_MACHINE_GREEN_EXIT=0. Sender: 11 passed, 0 failed; all-target release Clippy and no-default pass: HOST_SENDER_GREEN_EXIT=0. Retrieved formatter outputs; bridge formatting pushed in ac0a8c7e8. These validate the actor/sender slices, not the newer unexecuted storage fixes or completed host wiring. The abandoned-image regression then failed at its intended assertion: “dead image owners must not leak unbounded candidate payloads” (IMAGE_STAGING_RED_EXIT=101). This confirms the collector filename gap. The prepared exact-name allowlist fix remains local/pushed WIP and has not contaminated the baseline run. Pinned storage helper compilation and live SQLite lock regressions now follow in server-machine-green-4.log under the same slot. Receipt will be copied locally when the gate ends; final fast/e2e/sizes remain pending.
kayg commented 2026-10-31 21:31:00 +00:00
Author
Owner
Copy link

J12 baseline RED run completed and receipt is local evidence/server-machine-green-4.log. Intended failures observed: abandoned image staging; selection inspection releases the live SQLite process lock; admission releases SHM byte-128 lifetime lock (observer obtains it, Some(0) vs expected Some(2)); same-process original-state publication releases the database lock; positive host-catalog admission remains unconnected. The pinned storage helper builds and is Clippy-clean (STORAGE_FIXTURE_BUILD_EXIT=0). The runtime RED also printed an unrelated embedded libtest --fd refusal; the lock assertion itself failed as intended.

Publication distinction: production adoption is in the separate installer process; candidate publication occurs after the serving engine drains/closes. The updated qualification performs actual adoption in a child installer while the parent holds SQLite DB/SHM locks, and checks both locks before/after. It retains database/sidecar content syncs and documents the no-live-SQLite-handles precondition on the publishing process. It does not bypass durability or claim in-process publication is safe. Runtime storage tests now use the existing unavailable-daemon fixture instead of spawning a library test executable as the CLI.

Prepared GREEN also applies the already-pushed metadata-only live checks/collector allowlist, adds external SQLite writer-close/WAL-read assertions, and fills the test-only catalog verifier through the existing signed-manifest engine. Compute01 queued gate PID3964597, ~/.cache/j12-edge-update-evidence/storage-locks-catalog-green.{sh,log}. No GREEN claim yet; actual host catalog/receiver wiring, real storage systemd proof and final gates/sizes remain unfinished.

J12 baseline RED run completed and receipt is local evidence/server-machine-green-4.log. Intended failures observed: abandoned image staging; selection inspection releases the live SQLite process lock; admission releases SHM byte-128 lifetime lock (observer obtains it, Some(0) vs expected Some(2)); same-process original-state publication releases the database lock; positive host-catalog admission remains unconnected. The pinned storage helper builds and is Clippy-clean (STORAGE_FIXTURE_BUILD_EXIT=0). The runtime RED also printed an unrelated embedded libtest --fd refusal; the lock assertion itself failed as intended. Publication distinction: production adoption is in the separate installer process; candidate publication occurs after the serving engine drains/closes. The updated qualification performs actual adoption in a child installer while the parent holds SQLite DB/SHM locks, and checks both locks before/after. It retains database/sidecar content syncs and documents the no-live-SQLite-handles precondition on the publishing process. It does not bypass durability or claim in-process publication is safe. Runtime storage tests now use the existing unavailable-daemon fixture instead of spawning a library test executable as the CLI. Prepared GREEN also applies the already-pushed metadata-only live checks/collector allowlist, adds external SQLite writer-close/WAL-read assertions, and fills the test-only catalog verifier through the existing signed-manifest engine. Compute01 queued gate PID3964597, ~/.cache/j12-edge-update-evidence/storage-locks-catalog-green.{sh,log}. No GREEN claim yet; actual host catalog/receiver wiring, real storage systemd proof and final gates/sizes remain unfinished.
kayg commented 2026-10-31 21:40:20 +00:00
Author
Owner
Copy link

J12 continuation at edge-update-v2@99f126e67. Compute01 is reachable; existing storage-locks-catalog-green gate PID3964597 remains queued through the mandatory build-slot wrapper. Re-read the current common brief and accepted c9c1877e9 plan. Preserving its immutable source snapshot; next work is concrete bounded running-server host catalog, host receiver/lifecycle integration, runtime storage qualification, perf kit and exact-head size/fast evidence. No completion claim and no caps changed.

J12 continuation at edge-update-v2@99f126e67. Compute01 is reachable; existing storage-locks-catalog-green gate PID3964597 remains queued through the mandatory build-slot wrapper. Re-read the current common brief and accepted c9c1877e9 plan. Preserving its immutable source snapshot; next work is concrete bounded running-server host catalog, host receiver/lifecycle integration, runtime storage qualification, perf kit and exact-head size/fast evidence. No completion claim and no caps changed.
kayg commented 2026-10-31 21:53:12 +00:00
Author
Owner
Copy link

J12 crash-safety checkpoint: pushed test-only inventory observation regressions and a refusing adapter on edge-update-v2. They cover transfer receipt vs running identity, convergence retention and revoked-host late-write refusal; no production host observation writes are enabled. Appended expected-RED run to the existing compute01 slot-owned gate after its storage/proof tasks. PID3964597 still queued (~22 minutes), compute01 reachable with 95 GB free; no slot bypass. Head and exact gate receipts will follow once executed. Final fast, host integration, storage/perf and final sizes remain owed.

J12 crash-safety checkpoint: pushed test-only inventory observation regressions and a refusing adapter on edge-update-v2. They cover transfer receipt vs running identity, convergence retention and revoked-host late-write refusal; no production host observation writes are enabled. Appended expected-RED run to the existing compute01 slot-owned gate after its storage/proof tasks. PID3964597 still queued (~22 minutes), compute01 reachable with 95 GB free; no slot bypass. Head and exact gate receipts will follow once executed. Final fast, host integration, storage/perf and final sizes remain owed.
kayg commented 2026-10-31 22:16:12 +00:00
Author
Owner
Copy link

J12 resource update: compute01 wrapper PID3964597 has waited ~45 minutes for build-slot; its log still contains only the initial “all 4 slots busy” message. Slot ownership has turned over (earlier holder processes ended; current lslocks reports four new active owners), so SSH/store/disk are not the blocker. The wrapper retries slots every 15 s without FIFO ordering. No slot bypass or competing duplicate runner launched. Pushed head923e83261 remains clean and test-only; no new GREEN/final gate claims. Existing source snapshots and expected-RED inventory extension are retained in ~/.cache/j12-edge-update-evidence/storage-locks-catalog-green.sh.

J12 resource update: compute01 wrapper PID3964597 has waited ~45 minutes for build-slot; its log still contains only the initial “all 4 slots busy” message. Slot ownership has turned over (earlier holder processes ended; current lslocks reports four new active owners), so SSH/store/disk are not the blocker. The wrapper retries slots every 15 s without FIFO ordering. No slot bypass or competing duplicate runner launched. Pushed head923e83261 remains clean and test-only; no new GREEN/final gate claims. Existing source snapshots and expected-RED inventory extension are retained in ~/.cache/j12-edge-update-evidence/storage-locks-catalog-green.sh.
kayg commented 2026-10-31 22:42:22 +00:00
Author
Owner
Copy link

J12 checkpoint: pushed an additional test-only host catalog boundary case (unsafe version/architecture must cause zero filesystem/network acquisition). The positive runtime catalog/lifetime test and inventory observation RED tests remain queued after storage qualification. Compute01 wrapper3964597 now ~73min waiting for build-slot; no new product RED/GREEN or final-fast result. ARM fallback checked read-only: only33GBfree, so no second cold target started. Existing compute target retained; no root units or deployments. Branch remains WIP, with full host/storage/perf/size acceptance owed.

J12 checkpoint: pushed an additional test-only host catalog boundary case (unsafe version/architecture must cause zero filesystem/network acquisition). The positive runtime catalog/lifetime test and inventory observation RED tests remain queued after storage qualification. Compute01 wrapper3964597 now ~73min waiting for build-slot; no new product RED/GREEN or final-fast result. ARM fallback checked read-only: only33GBfree, so no second cold target started. Existing compute target retained; no root units or deployments. Branch remains WIP, with full host/storage/perf/size acceptance owed.
kayg commented 2026-10-31 22:50:19 +00:00
Author
Owner
Copy link

J12 blocked handoff at pushed edge-update-v2@99415e9c4 (clean worktree), not completion. This continuation added two explicitly test-only WIP slices: 923e83261 honest inventory identity/convergence/revocation tests against refusing adapters, and 99415e9c4 malformed host-catalog identifiers refusing acquisition side effects.

The inherited compute01 gate never acquired a slot after 4751 s (~79 min). Confirmed wrapper3964597 had only its sleep child, then stopped that waiter and verified QUEUED_WAITER_STOPPED=1. No owned background build/server/root fixture remains. At least15 compute01 waiters were observed; the wrapper has no FIFO ordering. ARM fallback has33GBfree, so no second cold target was started. No slot bypass, deployment, dependency/profile/cap change or new production host behavior.

Queued gate output verbatim (this is NOT a passing product gate):

build-slot: [22:30:33] all 4 slots busy, waiting...

No new GREEN, scripts/verify fast, exact-head e2e or final D243 result. Previously recorded7/7 systemd +2/2 automatic/rollback evidence remains historical; full host catalog/receiver/lifecycle, real storage proof, failure/perf kit and final sizes remain unfinished.

Resume command on compute01:

nohup ~/infraternal-ops/build-slot nix develop git+file:///home/claude/infraternal?ref=nix-devshell -c bash /home/claude/.cache/j12-edge-update-evidence/storage-locks-catalog-green.sh > /home/claude/.cache/j12-edge-update-evidence/storage-locks-catalog-green.log 2>&1 < /dev/null &

The pending script, source snapshots, appended catalog/inventory RED cases and the ONE target are preserved on compute01. It has not mutated the VM checkout yet. Formatted GREEN archives precede newer local catalog/lib test additions: merge formatting carefully rather than overwriting them. Local recovery ledger: /home/kayg/.cache/codex-scratch/j12/continuation.md; queue receipt: evidence/storage-locks-catalog-queue-stopped.log.

J12 blocked handoff at pushed `edge-update-v2@99415e9c4` (clean worktree), not completion. This continuation added two explicitly test-only WIP slices: `923e83261` honest inventory identity/convergence/revocation tests against refusing adapters, and `99415e9c4` malformed host-catalog identifiers refusing acquisition side effects. The inherited compute01 gate never acquired a slot after **4751 s (~79 min)**. Confirmed wrapper3964597 had only its sleep child, then stopped that waiter and verified `QUEUED_WAITER_STOPPED=1`. No owned background build/server/root fixture remains. At least15 compute01 waiters were observed; the wrapper has no FIFO ordering. ARM fallback has33GBfree, so no second cold target was started. No slot bypass, deployment, dependency/profile/cap change or new production host behavior. Queued gate output verbatim (this is NOT a passing product gate): ``` build-slot: [22:30:33] all 4 slots busy, waiting... ``` **No new GREEN, `scripts/verify fast`, exact-head e2e or final D243 result.** Previously recorded7/7 systemd +2/2 automatic/rollback evidence remains historical; full host catalog/receiver/lifecycle, real storage proof, failure/perf kit and final sizes remain unfinished. Resume command on compute01: ``` nohup ~/infraternal-ops/build-slot nix develop git+file:///home/claude/infraternal?ref=nix-devshell -c bash /home/claude/.cache/j12-edge-update-evidence/storage-locks-catalog-green.sh > /home/claude/.cache/j12-edge-update-evidence/storage-locks-catalog-green.log 2>&1 < /dev/null & ``` The pending script, source snapshots, appended catalog/inventory RED cases and the ONE target are preserved on compute01. It has not mutated the VM checkout yet. Formatted GREEN archives precede newer local catalog/lib test additions: merge formatting carefully rather than overwriting them. Local recovery ledger: `/home/kayg/.cache/codex-scratch/j12/continuation.md`; queue receipt: `evidence/storage-locks-catalog-queue-stopped.log`.
kayg commented 2026-10-31 22:51:09 +00:00
Author
Owner
Copy link

J12 resumed from71958 at edge-update-v2@99415e9c4. Rebasing onto owner-assigned origin/dev4ac9a0429, then resuming storage/host RED-GREEN qualification with worktree nix develop and the new FIFO build-slot wrapper. Queued work will remain pending until its turn. No new gate claim; final fast, systemd, host/storage and D243 results remain owed.

J12 resumed from71958 at edge-update-v2@99415e9c4. Rebasing onto owner-assigned origin/dev4ac9a0429, then resuming storage/host RED-GREEN qualification with worktree nix develop and the new FIFO build-slot wrapper. Queued work will remain pending until its turn. No new gate claim; final fast, systemd, host/storage and D243 results remain owed.
kayg commented 2026-10-31 23:06:56 +00:00
Author
Owner
Copy link

J12 rebased cleanly onto origin/dev4ac9a0429 and pushed edge-update-v2@516d743497be62b9382f589982114841135b4220 with an exact lease. Compute01 source matches that head; worktree nix develop is used. Resumed FIFO gate PID786532 advanced from position8 to2; it remains queued and will not be stopped for waiting. One existing target; disk recovered to188GBfree. Reordered the pending script to observe catalog/inventory RED immediately after focused storage/helper qualification, restoring those inputs before broad GREEN checks. Source/inputs remain immutable during actual build. No new GREEN/finalfast/systemd/size claim yet. Recovery ledger updated with livePID, script order and cautions about older formatter archives.

J12 rebased cleanly onto origin/dev4ac9a0429 and pushed `edge-update-v2@516d743497be62b9382f589982114841135b4220` with an exact lease. Compute01 source matches that head; worktree `nix develop` is used. Resumed FIFO gate PID786532 advanced from position8 to2; it remains queued and will not be stopped for waiting. One existing target; disk recovered to188GBfree. Reordered the pending script to observe catalog/inventory RED immediately after focused storage/helper qualification, restoring those inputs before broad GREEN checks. Source/inputs remain immutable during actual build. No new GREEN/finalfast/systemd/size claim yet. Recovery ledger updated with livePID, script order and cautions about older formatter archives.
kayg commented 2026-10-31 23:25:01 +00:00
Author
Owner
Copy link

J12 continuation at edge-update-v2@516d743497be62b9382f589982114841135b4220 (rebased onto assigned dev4ac9a0429). Recovered the completed FIFO run: storage selection/adoption/runtime lock regressions and CLI generation21/21 pass; catalog/runtime and inventory RED cases fail as intended against refusing adapters. Broad gate then stopped on three test-only Clippy errors (similar_names and two unreadable_literal). Prepared those repairs plus the in-progress catalog/inventory implementations; next FIFO run is resume-storage-host-green.log on compute01, using worktree nix develop and the one retained target. No final fast/systemd/size/completion claim.

J12 continuation at edge-update-v2@516d743497be62b9382f589982114841135b4220 (rebased onto assigned dev4ac9a0429). Recovered the completed FIFO run: storage selection/adoption/runtime lock regressions and CLI generation21/21 pass; catalog/runtime and inventory RED cases fail as intended against refusing adapters. Broad gate then stopped on three test-only Clippy errors (similar_names and two unreadable_literal). Prepared those repairs plus the in-progress catalog/inventory implementations; next FIFO run is resume-storage-host-green.log on compute01, using worktree nix develop and the one retained target. No final fast/systemd/size/completion claim.
kayg commented 2026-10-31 23:40:14 +00:00
Author
Owner
Copy link

J12 crash-safety snapshots pushed through d68955a337: ca73a7985 fixes the three strict test lint errors; 02db57119 wires the bounded exact-running-version host catalog/sender and authenticated inventory observations, with migration0032; d68955a33 keeps inventory readable without schema writes when read-only recovery precedes those columns. These are WIP pending qualification. The FIFO runner1243823 has advanced from position9 to8 (resume-storage-host-green.log), remains queued and will not be stopped for waiting. Its phases retain separate immutable source snapshots, then focused/broad gates, production host feature checks and signed staging artifacts for systemd proofs. One target: ~/.cache/j12-edge-update-evidence/target. No root units/mounts/jobs active; no new final-fast, exact-head systemd or D243 result. Host receiver/delayed-selection watchdog and remaining full acceptance/perf coverage remain unfinished.

J12 crash-safety snapshots pushed through d68955a3371d939634966b7a8ab8ed0599e702ea: ca73a7985 fixes the three strict test lint errors; 02db57119 wires the bounded exact-running-version host catalog/sender and authenticated inventory observations, with migration0032; d68955a33 keeps inventory readable without schema writes when read-only recovery precedes those columns. These are WIP pending qualification. The FIFO runner1243823 has advanced from position9 to8 (resume-storage-host-green.log), remains queued and will not be stopped for waiting. Its phases retain separate immutable source snapshots, then focused/broad gates, production host feature checks and signed staging artifacts for systemd proofs. One target: ~/.cache/j12-edge-update-evidence/target. No root units/mounts/jobs active; no new final-fast, exact-head systemd or D243 result. Host receiver/delayed-selection watchdog and remaining full acceptance/perf coverage remain unfinished.
kayg commented 2026-11-01 00:06:21 +00:00
Author
Owner
Copy link

J12 first FIFO run acquired slot 4 after 31 minutes and completed functional qualification: release unit 57 passed / 3 ignored; updater integration 24/24; host wire 4/4; catalog 4/4; inventory observations 3/3; generation runtime 3/3 (read-only and WAL/lock preservation included); CLI generation 21/21. Release all-target Clippy passed. Server all-target Clippy then stopped on current-toolchain duplicate_mod: both signing-fixture consumers loaded the same support file. No final native/full-fast claim. Receipt: compute01 ~/.cache/j12-edge-update-evidence/resume-storage-host-green.log. That run has ended; no leftover build from it.

Pushed snapshots through b4b347dcc1: 22e22d382 adds the scoped 128-row inventory perf kit; 2849e79b3 releases cached host payloads when a release worker retires, including an unpolled worker, while retaining per-transfer ownership; b4b347dcc shares the existing signing fixture at crate scope instead of suppressing duplicate_mod. These new production/retirement/perf changes still await qualification.

Current compute01 FIFO runner 1663637 is queued at position 14, resume-qualified.log, with one retained target. Source is the exact pushed b4b347dcc snapshot; nix develop is from the worktree. It will not be stopped for waiting. The runner permits at most 3 native attempts and a bounded 5-minute repair interval only after a compiler/test command has ended, so a small gate repair need not requeue an entire job. Native GREEN waits briefly for formatter output to be committed and synchronized before signed static staging artifacts are built. Root systemd work has not started. Final fast, exact-head 7/7, storage/perf/host receiver and final D243 measurements remain owed; no caps changed.

J12 first FIFO run acquired slot 4 after 31 minutes and completed functional qualification: release unit 57 passed / 3 ignored; updater integration 24/24; host wire 4/4; catalog 4/4; inventory observations 3/3; generation runtime 3/3 (read-only and WAL/lock preservation included); CLI generation 21/21. Release all-target Clippy passed. Server all-target Clippy then stopped on current-toolchain duplicate_mod: both signing-fixture consumers loaded the same support file. No final native/full-fast claim. Receipt: compute01 ~/.cache/j12-edge-update-evidence/resume-storage-host-green.log. That run has ended; no leftover build from it. Pushed snapshots through b4b347dcc1090f031d7c152d12d3216b08085eb3: 22e22d382 adds the scoped 128-row inventory perf kit; 2849e79b3 releases cached host payloads when a release worker retires, including an unpolled worker, while retaining per-transfer ownership; b4b347dcc shares the existing signing fixture at crate scope instead of suppressing duplicate_mod. These new production/retirement/perf changes still await qualification. Current compute01 FIFO runner 1663637 is queued at position 14, resume-qualified.log, with one retained target. Source is the exact pushed b4b347dcc snapshot; nix develop is from the worktree. It will not be stopped for waiting. The runner permits at most 3 native attempts and a bounded 5-minute repair interval only after a compiler/test command has ended, so a small gate repair need not requeue an entire job. Native GREEN waits briefly for formatter output to be committed and synchronized before signed static staging artifacts are built. Root systemd work has not started. Final fast, exact-head 7/7, storage/perf/host receiver and final D243 measurements remain owed; no caps changed.
kayg commented 2026-11-01 00:26:05 +00:00
Author
Owner
Copy link

J12 continuation: edge-update-v2 remains pushed/clean at b4b347dcc1, rebased onto assigned dev 4ac9a0429. Owned compute01 FIFO1663637 is still queued (now position6, ~25min); it has not been stopped. One target remains ~/.cache/j12-edge-update-evidence/target; log resume-qualified.log.

Prepared next failing-first host adapter slice outside the checkout: reuse the generation owner/prepared-pointer/commit protocol with an explicit file-backed host store entry. Hosts retain private identity.json plus boot configuration; no fabricated SQLite database or flip-before-health legacy watchdog. Three regressions require unchanged selection until commit, retained credential mutation refusal, and writable credential alias refusal. Only a refusing open_host adapter exists in that draft; no production host wiring or GREEN claim. The queued runner will run this expected-RED slice after its native qualification and signed static proof artifact build, restoring the qualified source afterward. Existing server startup format remains unchanged.

Root systemd/storage work has not started. Final fast, exact-head7/7, host receiver/adoption/lifecycle, full failure/perf coverage and matched final sizes remain outstanding. Current branch caps/dependencies/profiles are unchanged.

J12 continuation: edge-update-v2 remains pushed/clean at b4b347dcc1090f031d7c152d12d3216b08085eb3, rebased onto assigned dev 4ac9a0429. Owned compute01 FIFO1663637 is still queued (now position6, ~25min); it has not been stopped. One target remains ~/.cache/j12-edge-update-evidence/target; log resume-qualified.log. Prepared next failing-first host adapter slice outside the checkout: reuse the generation owner/prepared-pointer/commit protocol with an explicit file-backed host store entry. Hosts retain private identity.json plus boot configuration; no fabricated SQLite database or flip-before-health legacy watchdog. Three regressions require unchanged selection until commit, retained credential mutation refusal, and writable credential alias refusal. Only a refusing open_host adapter exists in that draft; no production host wiring or GREEN claim. The queued runner will run this expected-RED slice after its native qualification and signed static proof artifact build, restoring the qualified source afterward. Existing server startup format remains unchanged. Root systemd/storage work has not started. Final fast, exact-head7/7, host receiver/adoption/lifecycle, full failure/perf coverage and matched final sizes remain outstanding. Current branch caps/dependencies/profiles are unchanged.
kayg commented 2026-11-01 00:58:24 +00:00
Author
Owner
Copy link

J12 FIFO1663637 acquired compute01 slot3 after ~53min; it was never stopped for waiting. New host state regressions produced the intended RED (not compiler errors): 12passed/5failed, all five failures because the refusing adapter still requires infraternal.sqlite. Covered trial/commit, retained credential mutation, hard-link refusal, original live credential adoption, and signed executing-image preflight; oversized credentials already refuse. Raw log: ~/.cache/j12-edge-update-evidence/resume-qualified.log.

Baseline functional qualification has passed release57/3ignored, updater25/25, hostwire4/4, catalog5/5, observation5/5, inventory7/1ignored, generation runtime3/3. CLI, all-target Clippy and compile-out checks are still running; this is not a final native/fast PASS.

After inspecting RED, implemented the next local file-backed host generation adapter and uploaded its immutable five-file source archive for the post-native phase. It reuses the installation lock/prepared-pointer/health commit machinery, binds identity.json plus configuration (8KiB identity bound), and performs no host SQLite creation. Existing server serialized fields/startup format and WAL checks remain. This new adapter is still awaiting GREEN; it is not receiver/lifecycle wiring. The runner restores baseline source before native compilation, and extracts the green source only after native commands end. It will rebuild proof harnesses before signing current source artifacts. No root proof has started, no caps changed. One target retained as before. Final fast, actual host receiver/adoption/check-in, broader failure/perf acceptance and final D243 remain outstanding.

J12 FIFO1663637 acquired compute01 slot3 after ~53min; it was never stopped for waiting. New host state regressions produced the intended RED (not compiler errors): 12passed/5failed, all five failures because the refusing adapter still requires infraternal.sqlite. Covered trial/commit, retained credential mutation, hard-link refusal, original live credential adoption, and signed executing-image preflight; oversized credentials already refuse. Raw log: ~/.cache/j12-edge-update-evidence/resume-qualified.log. Baseline functional qualification has passed release57/3ignored, updater25/25, hostwire4/4, catalog5/5, observation5/5, inventory7/1ignored, generation runtime3/3. CLI, all-target Clippy and compile-out checks are still running; this is not a final native/fast PASS. After inspecting RED, implemented the next local file-backed host generation adapter and uploaded its immutable five-file source archive for the post-native phase. It reuses the installation lock/prepared-pointer/health commit machinery, binds identity.json plus configuration (8KiB identity bound), and performs no host SQLite creation. Existing server serialized fields/startup format and WAL checks remain. This new adapter is still awaiting GREEN; it is not receiver/lifecycle wiring. The runner restores baseline source before native compilation, and extracts the green source only after native commands end. It will rebuild proof harnesses before signing current source artifacts. No root proof has started, no caps changed. One target retained as before. Final fast, actual host receiver/adoption/check-in, broader failure/perf acceptance and final D243 remain outstanding.
kayg commented 2026-11-01 01:09:15 +00:00
Author
Owner
Copy link

Pushed gated host state adapter bdfe33dd5d, preceded by separate formatting commit8e1bfe53e. RED-to-GREEN is recorded in resume-qualified.log: five intended missing-SQLite failures became six passing host cases (including oversized credentials). The adapter uses the existing delayed-pointer commit protocol with identity.json/configuration, preserving the live original identity during adoption and rejecting post-preparation changes and shared writable inodes. Signed preflight still authenticates the executing image before state opens. This is a storage adapter, not completed host receiver/adoption/lifecycle integration.

Follow-up gate passed release63/3ignored, updater25/25, hostwire4/4, CLI generation21/21, release/CLI all-target Clippy, no-default and release-only compilation, fmt, and rebuilt proof harnesses. Marker verbatim:

HOST_STATE_GREEN_EXIT=0

Baseline native qualification also passed the server all-target lint and catalog/inventory/runtime suites described above. Compile-out checks emit existing warnings; no full-fast or final size claim.

Compute01 source/metadata now exactly match pushed bdfe33dd5 (clean), and the same held FIFO slot is building signed static proof artifacts with SOURCE bound to that SHA. Private signing material remains on compute01. Native inventory kit preparation follows without another build. No root proof is active yet. Next compile boundary: expose shared generation storage to host-only release builds without server SQLx/socket runtime dependencies; expected RED runs after artifacts. Final fast, exact-head systemd results, receiver/lifecycle, complete failure/perf acceptance and matched final D243 remain pending.

Pushed gated host state adapter bdfe33dd5dd9f1837c23f6b853fb94642e7e7eb4, preceded by separate formatting commit8e1bfe53e. RED-to-GREEN is recorded in resume-qualified.log: five intended missing-SQLite failures became six passing host cases (including oversized credentials). The adapter uses the existing delayed-pointer commit protocol with identity.json/configuration, preserving the live original identity during adoption and rejecting post-preparation changes and shared writable inodes. Signed preflight still authenticates the executing image before state opens. This is a storage adapter, not completed host receiver/adoption/lifecycle integration. Follow-up gate passed release63/3ignored, updater25/25, hostwire4/4, CLI generation21/21, release/CLI all-target Clippy, no-default and release-only compilation, fmt, and rebuilt proof harnesses. Marker verbatim: ``` HOST_STATE_GREEN_EXIT=0 ``` Baseline native qualification also passed the server all-target lint and catalog/inventory/runtime suites described above. Compile-out checks emit existing warnings; no full-fast or final size claim. Compute01 source/metadata now exactly match pushed bdfe33dd5 (clean), and the same held FIFO slot is building signed static proof artifacts with SOURCE bound to that SHA. Private signing material remains on compute01. Native inventory kit preparation follows without another build. No root proof is active yet. Next compile boundary: expose shared generation storage to host-only release builds without server SQLx/socket runtime dependencies; expected RED runs after artifacts. Final fast, exact-head systemd results, receiver/lifecycle, complete failure/perf acceptance and matched final D243 remain pending.
kayg commented 2026-11-01 01:16:42 +00:00
Author
Owner
Copy link

J12 continuation recovered existing work at bdfe33dd5 (rebased onto assigned dev4ac9a0429). Host-only feature split is qualified and pushed as26b79e67a: host-only tests/Clippy, default release suites/all-target Clippy, no-default and dependency-tree boundary pass on compute01. Markers verbatim:

HOST_FEATURE_SERVER_RUNTIME_DEPENDENCIES=0
HOST_FEATURE_GREEN_EXIT=0
J12_RESUME_GATE_EXIT=0

Root systemd/storage runner2417169 remains FIFO queued at position13; it will remain queued until execution. Signed proof bundles bind bdfe33dd5; results will be historical to that SHA, not final head acceptance. Root log /root/.cache/j12-systemd-resume.log. Native log ~/.cache/j12-edge-update-evidence/resume-qualified.log; one target ~/.cache/j12-edge-update-evidence/target. Continuing host receiver/lifecycle integration; final full-fast, exact final head proofs, complete failure/perf acceptance and D243 remain owed. No cap/profile/dependency changes.

J12 continuation recovered existing work at bdfe33dd5 (rebased onto assigned dev4ac9a0429). Host-only feature split is qualified and pushed as26b79e67a: host-only tests/Clippy, default release suites/all-target Clippy, no-default and dependency-tree boundary pass on compute01. Markers verbatim: ``` HOST_FEATURE_SERVER_RUNTIME_DEPENDENCIES=0 HOST_FEATURE_GREEN_EXIT=0 J12_RESUME_GATE_EXIT=0 ``` Root systemd/storage runner2417169 remains FIFO queued at position13; it will remain queued until execution. Signed proof bundles bind bdfe33dd5; results will be historical to that SHA, not final head acceptance. Root log /root/.cache/j12-systemd-resume.log. Native log ~/.cache/j12-edge-update-evidence/resume-qualified.log; one target ~/.cache/j12-edge-update-evidence/target. Continuing host receiver/lifecycle integration; final full-fast, exact final head proofs, complete failure/perf acceptance and D243 remain owed. No cap/profile/dependency changes.
kayg commented 2026-11-01 01:21:26 +00:00
Author
Owner
Copy link

J12 128-host inventory kit executed on the pinned perf VM through perf-run (cpus1–3,6GiB cap; quiet snapshots preserved). Exact packaged harness from bdfe33dd5; this measures durable inventory rows/observations, NOT128 infraternal agent daemons or terminal/handoff continuity.

Verbatim measurement:

INVENTORY_SCALE scope=durable_rows_not_daemon_processes hosts=128 resident_delta_bytes=13635584 resident_delta_bytes_per_host=106528 resident_delta_bytes_at_128=13635584 machine=infraternal-perf-01-backup01 load=0.15 0.06 0.02 1/211 109841
INVENTORY_SCALE phase=snapshot hosts=128 samples=128 p50_us=6153 p95_us=8141 max_us=9025
INVENTORY_SCALE response_bytes=28545 metadata_bytes=11008 metadata_bytes_per_host=86 sqlite=wal synchronous=normal pool=8 runtime_workers=4 reconnect_burst=128
INVENTORY_SCALE phase=capability_change hosts=128 samples=128 p50_us=23759 p95_us=44009 max_us=61915
INVENTORY_SCALE phase=capability_unchanged hosts=128 samples=128 p50_us=16911 p95_us=31182 max_us=45551
test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 783 filtered out; finished in 1.16s

Harness SHA, machine/load and before/after receipts are attached. The runner removed its per-run database directory; no benchmark process remains. Full warm/failure/performance acceptance is still owed. Root systemd FIFO2417169 and receiver RED/GREEN FIFO2504101 remain queued; neither will be stopped for waiting. Receiver regression source is outside the VM checkout until its slot begins. Final fast and D243 remain owed; no caps changed.

J12 128-host inventory kit executed on the pinned perf VM through perf-run (cpus1–3,6GiB cap; quiet snapshots preserved). Exact packaged harness from bdfe33dd5; this measures durable inventory rows/observations, NOT128 infraternal agent daemons or terminal/handoff continuity. Verbatim measurement: ``` INVENTORY_SCALE scope=durable_rows_not_daemon_processes hosts=128 resident_delta_bytes=13635584 resident_delta_bytes_per_host=106528 resident_delta_bytes_at_128=13635584 machine=infraternal-perf-01-backup01 load=0.15 0.06 0.02 1/211 109841 INVENTORY_SCALE phase=snapshot hosts=128 samples=128 p50_us=6153 p95_us=8141 max_us=9025 INVENTORY_SCALE response_bytes=28545 metadata_bytes=11008 metadata_bytes_per_host=86 sqlite=wal synchronous=normal pool=8 runtime_workers=4 reconnect_burst=128 INVENTORY_SCALE phase=capability_change hosts=128 samples=128 p50_us=23759 p95_us=44009 max_us=61915 INVENTORY_SCALE phase=capability_unchanged hosts=128 samples=128 p50_us=16911 p95_us=31182 max_us=45551 test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 783 filtered out; finished in 1.16s ``` Harness SHA, machine/load and before/after receipts are attached. The runner removed its per-run database directory; no benchmark process remains. Full warm/failure/performance acceptance is still owed. Root systemd FIFO2417169 and receiver RED/GREEN FIFO2504101 remain queued; neither will be stopped for waiting. Receiver regression source is outside the VM checkout until its slot begins. Final fast and D243 remain owed; no caps changed.
run.log
1.8 KiB
perf-run-20261101T021906-109809.after.txt
1.3 KiB
perf-run-20261101T021906-109809.before.txt
678 B
harness-sha256.txt
571 B
kayg commented 2026-11-01 01:44:50 +00:00
Author
Owner
Copy link

J12 crash-safety checkpoint pushed as ac93ace80b on edge-update-v2. This is test-only WIP: seven generation::download acquisition regressions plus a refusing adapter, not a completed receiver. It will be replaced by a gated implementation after observing RED. Existing signed root proof artifacts still bind bdfe33dd5; qualified host feature split remains26b79e67a.

Compute01 root systemd/storage FIFO2417169/waiter2417180 is now position3; receiver RED/GREEN FIFO2504101 is position6. Both remain queued and will not be stopped for waiting. No root units/mounts are installed yet. Native checkout remains the qualified26b79e67a snapshot until the receiver script acquires its slot and applies its immutable RED archive. One retained target ~/.cache/j12-edge-update-evidence/target. Logs: /root/.cache/j12-systemd-resume.log and ~/.cache/j12-edge-update-evidence/receiver-red-green.log.

Local recovery ledger ~/.cache/codex-scratch/j12/continuation.md; design-only host lifecycle notes host-integration-notes.md and unexecuted worker-retirement regression draft plugin-shutdown-red-tests.rs live beside it. No production host receiver/adoption/check-in/lifecycle claims, final fast or D243 result. Inventory perf receipts are on the preceding issue comment, scoped to rows/observations rather than running host daemons. Continuing the authorized plan without a completion handoff.

J12 crash-safety checkpoint pushed as ac93ace80b2e2a406ced8f746a13313329c4c7a7 on edge-update-v2. This is test-only WIP: seven generation::download acquisition regressions plus a refusing adapter, not a completed receiver. It will be replaced by a gated implementation after observing RED. Existing signed root proof artifacts still bind bdfe33dd5; qualified host feature split remains26b79e67a. Compute01 root systemd/storage FIFO2417169/waiter2417180 is now position3; receiver RED/GREEN FIFO2504101 is position6. Both remain queued and will not be stopped for waiting. No root units/mounts are installed yet. Native checkout remains the qualified26b79e67a snapshot until the receiver script acquires its slot and applies its immutable RED archive. One retained target ~/.cache/j12-edge-update-evidence/target. Logs: /root/.cache/j12-systemd-resume.log and ~/.cache/j12-edge-update-evidence/receiver-red-green.log. Local recovery ledger ~/.cache/codex-scratch/j12/continuation.md; design-only host lifecycle notes host-integration-notes.md and unexecuted worker-retirement regression draft plugin-shutdown-red-tests.rs live beside it. No production host receiver/adoption/check-in/lifecycle claims, final fast or D243 result. Inventory perf receipts are on the preceding issue comment, scoped to rows/observations rather than running host daemons. Continuing the authorized plan without a completion handoff.
kayg commented 2026-11-01 03:30:34 +00:00
Author
Owner
Copy link

J12 resumed on edge-update-v2 at ac93ace80b (rebased onto assigned dev 4ac9a0429). compute01 FIFO receiver gate now reports HOST_DOWNLOAD_GREEN_EXIT=0. The subsequent shutdown regression reproduced 2/2 failures before implementation; new implementation passes 12 plugin-control and 55 remote-client tests (8 ignored), with Clippy repairs pending. This is not final qualification.

Systemd proof at bdfe33dd5 reports generation supervision 7/7, automatic/historical rollback 2/2, and both 32MiB/256-inode primitives passing. Real 256MiB ext4 storage startup fails: block filler leaves two 1KiB fragments, and zero-inode startup changes WAL bytes before any read-only fixture read. A separate diagnostic confirms WAL changed during startup, not the reader. Fixing early capacity admission before writable startup and the filler tail; keeping the strict zero-capacity and unchanged-WAL oracles. No final fast/size claim.

Logs on compute01: ~/.cache/j12-edge-update-evidence/receiver-qualified-retry-2.log; root /root/.cache/j12-systemd-resume.log and j12-storage-diagnostic.log. Diagnostic own units/mounts/files were cleaned; original proof cache retained temporarily for rerun. Full host lifecycle/check-in/version following and final perf/size/fast remain outstanding.

J12 resumed on edge-update-v2 at ac93ace80b2e2a406ced8f746a13313329c4c7a7 (rebased onto assigned dev 4ac9a0429). compute01 FIFO receiver gate now reports HOST_DOWNLOAD_GREEN_EXIT=0. The subsequent shutdown regression reproduced 2/2 failures before implementation; new implementation passes 12 plugin-control and 55 remote-client tests (8 ignored), with Clippy repairs pending. This is not final qualification. Systemd proof at bdfe33dd5 reports generation supervision 7/7, automatic/historical rollback 2/2, and both 32MiB/256-inode primitives passing. Real 256MiB ext4 storage startup fails: block filler leaves two 1KiB fragments, and zero-inode startup changes WAL bytes before any read-only fixture read. A separate diagnostic confirms WAL changed during startup, not the reader. Fixing early capacity admission before writable startup and the filler tail; keeping the strict zero-capacity and unchanged-WAL oracles. No final fast/size claim. Logs on compute01: ~/.cache/j12-edge-update-evidence/receiver-qualified-retry-2.log; root /root/.cache/j12-systemd-resume.log and j12-storage-diagnostic.log. Diagnostic own units/mounts/files were cleaned; original proof cache retained temporarily for rerun. Full host lifecycle/check-in/version following and final perf/size/fast remain outstanding.
kayg commented 2026-11-01 03:53:06 +00:00
Author
Owner
Copy link

J12 resumed on edge-update-v2 at ac93ace80b (rebased onto assigned dev 4ac9a0429). compute01 FIFO receiver gate now reports HOST_DOWNLOAD_GREEN_EXIT=0. The subsequent shutdown regression reproduced 2/2 failures before implementation; new implementation passes 12 plugin-control and 55 remote-client tests (8 ignored), with Clippy repairs pending. This is not final qualification.

Systemd proof at bdfe33dd5 reports generation supervision 7/7, automatic/historical rollback 2/2, and both 32MiB/256-inode primitives passing. Real 256MiB ext4 storage startup fails: block filler leaves two 1KiB fragments, and zero-inode startup changes WAL bytes before any read-only fixture read. A separate diagnostic confirms WAL changed during startup, not the reader. Fixing early capacity admission before writable startup and the filler tail; keeping the strict zero-capacity and unchanged-WAL oracles. No final fast/size claim.

Logs on compute01: ~/.cache/j12-edge-update-evidence/receiver-qualified-retry-2.log; root /root/.cache/j12-systemd-resume.log and j12-storage-diagnostic.log. Diagnostic own units/mounts/files were cleaned; original proof cache retained temporarily for rerun. Full host lifecycle/check-in/version following and final perf/size/fast remain outstanding.

J12 resumed on edge-update-v2 at ac93ace80b2e2a406ced8f746a13313329c4c7a7 (rebased onto assigned dev 4ac9a0429). compute01 FIFO receiver gate now reports HOST_DOWNLOAD_GREEN_EXIT=0. The subsequent shutdown regression reproduced 2/2 failures before implementation; new implementation passes 12 plugin-control and 55 remote-client tests (8 ignored), with Clippy repairs pending. This is not final qualification. Systemd proof at bdfe33dd5 reports generation supervision 7/7, automatic/historical rollback 2/2, and both 32MiB/256-inode primitives passing. Real 256MiB ext4 storage startup fails: block filler leaves two 1KiB fragments, and zero-inode startup changes WAL bytes before any read-only fixture read. A separate diagnostic confirms WAL changed during startup, not the reader. Fixing early capacity admission before writable startup and the filler tail; keeping the strict zero-capacity and unchanged-WAL oracles. No final fast/size claim. Logs on compute01: ~/.cache/j12-edge-update-evidence/receiver-qualified-retry-2.log; root /root/.cache/j12-systemd-resume.log and j12-storage-diagnostic.log. Diagnostic own units/mounts/files were cleaned; original proof cache retained temporarily for rerun. Full host lifecycle/check-in/version following and final perf/size/fast remain outstanding.
kayg commented 2026-11-01 05:17:28 +00:00
Author
Owner
Copy link

J12 checkpoint: edge-update-v2 pushed through eaa85d22ab. Qualified slices:

  • 6198311c3 signed bounded host download/resume; host/default release tests and Clippy, HOST_DOWNLOAD_GREEN_EXIT=0.
  • 7912efce2 synchronous plugin retirement; 12 control + 55 remote-client tests (8 ignored), remote/mesh Clippy, no-default and formatting, PLUGIN_SHUTDOWN_GREEN_EXIT=0. Full handoff consumer remains unfinished.
  • eaa85d22a early read-only capacity admission and true block-fragment exhaustion; release70/0/3ignored and CLI generation20/0, Clippy and formatting pass, STORAGE_ADMISSION_NATIVE_EXIT=0. Signed x86 staging image rebuilt at this exact source: SYSTEMD_ARTIFACTS_BUILD_EXIT=0, sha256 97a00894d7135141ae428b2af83de9880bb0db84fb0ccd96221b9b4c9940eef9. Root real-systemd/storage qualification launched via build-slot; result pending.

Sender still has an obsolete unverified-image seeding path; new failing-first regression requires owner-present adoption/manual-update inventory, without requesting payload or offering a seed. Native RED queued after static build ended. No active compiler source mutation. Full host lifecycle/check-in/version-follow, acceptance/perf/browser, final D243 matched sizes and scripts/verify fast remain outstanding. No cap/profile changes.

Control execution tool host restarted twice; recovered by inspecting state rather than duplicating runs. VM J12 checkout lacks origin: sync from existing VM repository by explicit object SHA (latest SHA verified against local eaa85d22a); nix develop remains in the J12 checkout. One target retained at /home/claude/.cache/j12-edge-update-evidence/target. Latest receipts: storage-admission-artifact-build.log, owner-adoption-red-driver.log; root j12-systemd-storage-admission.log.

J12 checkpoint: edge-update-v2 pushed through eaa85d22ab4a2bbd11d0e948c8d802c7be3e5222. Qualified slices: - 6198311c3 signed bounded host download/resume; host/default release tests and Clippy, HOST_DOWNLOAD_GREEN_EXIT=0. - 7912efce2 synchronous plugin retirement; 12 control + 55 remote-client tests (8 ignored), remote/mesh Clippy, no-default and formatting, PLUGIN_SHUTDOWN_GREEN_EXIT=0. Full handoff consumer remains unfinished. - eaa85d22a early read-only capacity admission and true block-fragment exhaustion; release70/0/3ignored and CLI generation20/0, Clippy and formatting pass, STORAGE_ADMISSION_NATIVE_EXIT=0. Signed x86 staging image rebuilt at this exact source: SYSTEMD_ARTIFACTS_BUILD_EXIT=0, sha256 97a00894d7135141ae428b2af83de9880bb0db84fb0ccd96221b9b4c9940eef9. Root real-systemd/storage qualification launched via build-slot; result pending. Sender still has an obsolete unverified-image seeding path; new failing-first regression requires owner-present adoption/manual-update inventory, without requesting payload or offering a seed. Native RED queued after static build ended. No active compiler source mutation. Full host lifecycle/check-in/version-follow, acceptance/perf/browser, final D243 matched sizes and scripts/verify fast remain outstanding. No cap/profile changes. Control execution tool host restarted twice; recovered by inspecting state rather than duplicating runs. VM J12 checkout lacks origin: sync from existing VM repository by explicit object SHA (latest SHA verified against local eaa85d22a); nix develop remains in the J12 checkout. One target retained at /home/claude/.cache/j12-edge-update-evidence/target. Latest receipts: storage-admission-artifact-build.log, owner-adoption-red-driver.log; root j12-systemd-storage-admission.log.
kayg commented 2026-11-01 06:22:50 +00:00
Author
Owner
Copy link

J12 resumed after the control-host interruption. edge-update-v2 rebased and pushed at a9832afdd onto origin/dev f4b61cd6c3. Historical J12 cap conflicts preserve current-dev gate values; owner removal of D243 approval thresholds acknowledged, measured deltas still required.

Completed before interruption: exact eaa85d22a signed proof passes systemd 7/7, automatic/historical rollback 2/2, bounded 32MiB/256-inode primitives 2/2, and real ext4 blocks/inodes against original A and committed B 4/4. Every storage case preserves retained DB/config and acknowledged WAL edits across three restarts with fillers, then updates after capacity returns. Root cleanup verified: no proof units/mounts/processes/fixture directories and task root build-slot shim removed. Raw receipt: local evidence/systemd-storage-eaa85d22a.log. Initial longer scratch root gave a 110-byte setup-token socket pathname; the same signed image passes with an 85-byte path under /root/.cache/j12-gp2. No product oracle weakened.

Owner-adoption sender slice was qualified/pushed as 598929808 before rebase (now a9832afdd): unverified images report needs_manual_update without any payload/seed offer; release tests/Clippy/compile-out pass.

The interrupted checkpoint scripts/verify fast completed and FAILed: J12 hosted skill test expected obsolete "unreviewed" wording; default x86/ARM sizes were 22,163,112 / 20,270,520 B above old branch ceilings. Fixing the skill regression against the actual current safety instructions; CLI package gate queued on the new dev base through build-slot. No baseline-failure exemption claimed. Final matched D243 control and final fast still owed.

Remaining: managed-host receiver registration, controlled lifecycle/owner adoption and authenticated delayed check-in/version following; complete failure/perf/browser acceptance and final exact-head gates. One compute01 target retained at /home/claude/.cache/j12-edge-update-evidence/target. No own old background gates remain; new cli-skill-green.log is the current queued gate.

J12 resumed after the control-host interruption. edge-update-v2 rebased and pushed at a9832afdd onto origin/dev f4b61cd6c3f52078cad7573c5367d7a6e75f84f0. Historical J12 cap conflicts preserve current-dev gate values; owner removal of D243 approval thresholds acknowledged, measured deltas still required. Completed before interruption: exact eaa85d22a signed proof passes systemd 7/7, automatic/historical rollback 2/2, bounded 32MiB/256-inode primitives 2/2, and real ext4 blocks/inodes against original A and committed B 4/4. Every storage case preserves retained DB/config and acknowledged WAL edits across three restarts with fillers, then updates after capacity returns. Root cleanup verified: no proof units/mounts/processes/fixture directories and task root build-slot shim removed. Raw receipt: local evidence/systemd-storage-eaa85d22a.log. Initial longer scratch root gave a 110-byte setup-token socket pathname; the same signed image passes with an 85-byte path under /root/.cache/j12-gp2. No product oracle weakened. Owner-adoption sender slice was qualified/pushed as 598929808 before rebase (now a9832afdd): unverified images report needs_manual_update without any payload/seed offer; release tests/Clippy/compile-out pass. The interrupted checkpoint scripts/verify fast completed and FAILed: J12 hosted skill test expected obsolete "unreviewed" wording; default x86/ARM sizes were 22,163,112 / 20,270,520 B above old branch ceilings. Fixing the skill regression against the actual current safety instructions; CLI package gate queued on the new dev base through build-slot. No baseline-failure exemption claimed. Final matched D243 control and final fast still owed. Remaining: managed-host receiver registration, controlled lifecycle/owner adoption and authenticated delayed check-in/version following; complete failure/perf/browser acceptance and final exact-head gates. One compute01 target retained at /home/claude/.cache/j12-edge-update-evidence/target. No own old background gates remain; new cli-skill-green.log is the current queued gate.
systemd-storage-eaa85d22a.log
6.2 KiB
kayg commented 2026-11-01 06:40:10 +00:00
Author
Owner
Copy link

J12 resume: edge-update-v2 remains based on origin/dev f4b61cd6c3; qualified CLI regression fix is pushed as fb2d9aa2cc. Current controlled remote-runtime regressions reproduced RED (2 failed, Unsupported/no registration), then GREEN remote-client 57 passed/8 ignored and plugin-control 12 passed. Clippy identified one unused compatibility helper; fixed locally, qualification retry queued through FIFO build-slot and left waiting. This boundary retains the runtime lock after canceling transports and joining synchronous plugin retirement; caller still must join dedicated-runtime blocking work before sealed exec. Production host lifecycle/version-follow is not yet wired.

Existing exact eaa85d22a systemd/storage 7/7 +2/2 +2/2 +4/4 and cleanup receipt remain historical, not final head evidence. Final fast, matched D243 sizes and remaining host/perf/failure acceptance remain owed. Current own queue log: /home/claude/.cache/j12-edge-update-evidence/controlled-retry.log; one retained target /home/claude/.cache/j12-edge-update-evidence/target. Continuing implementation; no pending queue canceled and no completion claim.

J12 resume: edge-update-v2 remains based on origin/dev f4b61cd6c3f52078cad7573c5367d7a6e75f84f0; qualified CLI regression fix is pushed as fb2d9aa2ccec3e34a1748baf4014431028a571a0. Current controlled remote-runtime regressions reproduced RED (2 failed, Unsupported/no registration), then GREEN remote-client 57 passed/8 ignored and plugin-control 12 passed. Clippy identified one unused compatibility helper; fixed locally, qualification retry queued through FIFO build-slot and left waiting. This boundary retains the runtime lock after canceling transports and joining synchronous plugin retirement; caller still must join dedicated-runtime blocking work before sealed exec. Production host lifecycle/version-follow is not yet wired. Existing exact eaa85d22a systemd/storage 7/7 +2/2 +2/2 +4/4 and cleanup receipt remain historical, not final head evidence. Final fast, matched D243 sizes and remaining host/perf/failure acceptance remain owed. Current own queue log: /home/claude/.cache/j12-edge-update-evidence/controlled-retry.log; one retained target /home/claude/.cache/j12-edge-update-evidence/target. Continuing implementation; no pending queue canceled and no completion claim.
kayg commented 2026-11-01 06:51:34 +00:00
Author
Owner
Copy link

J12 crash-safety snapshot: wip/j12-edge-update-v2@db340b4f60 preserves unqualified local continuation; qualified edge-update-v2 remains fb2d9aa2c. The controlled runtime retry is still in compute01 FIFO queue (last reported position7), /home/claude/.cache/j12-edge-update-evidence/controlled-retry.log; it will not be canceled for waiting. First implementation already passed57 remote-client +12 control tests; retry corrects a dead-code Clippy error. One target remains /home/claude/.cache/j12-edge-update-evidence/target.

Draft next slices: host machine dispatcher uses signed bounded Receiving, never seeds unadopted hosts, refuses paused versions and invalidated settings epochs, and leaves handoff delivery inert until reply write. Seven dispatcher regressions are written but not yet executed. Activity can compile without SQLx, the CLI server feature activation is explicit, and standalone terminal open/attach/input fences are drafted. Staging kit now drafts reuse of CARGO_TARGET_DIR without debug-profile overrides. These drafts are NOT production host adoption/check-in/lifecycle integration or passing acceptance. No final fast/size claim; historical root systemd/storage receipt remains on72277. Continuing while the mandatory queue waits.

J12 crash-safety snapshot: wip/j12-edge-update-v2@db340b4f60a341598262fa2d84fb2b77d47b241e preserves unqualified local continuation; qualified edge-update-v2 remains fb2d9aa2c. The controlled runtime retry is still in compute01 FIFO queue (last reported position7), /home/claude/.cache/j12-edge-update-evidence/controlled-retry.log; it will not be canceled for waiting. First implementation already passed57 remote-client +12 control tests; retry corrects a dead-code Clippy error. One target remains /home/claude/.cache/j12-edge-update-evidence/target. Draft next slices: host machine dispatcher uses signed bounded Receiving, never seeds unadopted hosts, refuses paused versions and invalidated settings epochs, and leaves handoff delivery inert until reply write. Seven dispatcher regressions are written but not yet executed. Activity can compile without SQLx, the CLI server feature activation is explicit, and standalone terminal open/attach/input fences are drafted. Staging kit now drafts reuse of CARGO_TARGET_DIR without debug-profile overrides. These drafts are NOT production host adoption/check-in/lifecycle integration or passing acceptance. No final fast/size claim; historical root systemd/storage receipt remains on72277. Continuing while the mandatory queue waits.
kayg commented 2026-11-01 07:13:02 +00:00
Author
Owner
Copy link

J12 resumed on edge-update-v2 at 1f234086f (based on assigned origin/dev f4b61cd6c). Prior controlled runtime gate completed: CONTROLLED_RUNTIME_GREEN_EXIT=0, remote-client 57 passed/8 ignored, plugin-control 12 passed, Clippy and no-default check green. Continuing from local preserved continuation: regression for retained runtime ownership on refused exec, then managed host lifecycle wiring. Historical systemd/storage proofs remain historical; final head fast, systemd, perf acceptance and matched D243 measurements are still owed. One compute01 target retained at /home/claude/.cache/j12-edge-update-evidence/target. No active old J12 gate found.

J12 resumed on edge-update-v2 at 1f234086f (based on assigned origin/dev f4b61cd6c). Prior controlled runtime gate completed: CONTROLLED_RUNTIME_GREEN_EXIT=0, remote-client 57 passed/8 ignored, plugin-control 12 passed, Clippy and no-default check green. Continuing from local preserved continuation: regression for retained runtime ownership on refused exec, then managed host lifecycle wiring. Historical systemd/storage proofs remain historical; final head fast, systemd, perf acceptance and matched D243 measurements are still owed. One compute01 target retained at /home/claude/.cache/j12-edge-update-evidence/target. No active old J12 gate found.
kayg commented 2026-11-01 07:24:22 +00:00
Author
Owner
Copy link

J12 checkpoint pushed 9f294de05 on edge-update-v2. Atomic qualified slices: a6fd1819d extracts standalone activity feature without SQLx; 9f294de05 adds signed bounded host dispatcher, owner-adoption refusal, paused-version/downgrade checks, setting-epoch invalidation, and writer-owned COMMIT delivery. This is the receiver adapter, not complete process owner/adoption/version-follow wiring. compute01 via build-slot: host release 56 passed; host all-target Clippy; activity 4 passed; remote-only CLI check and normal host dependency-tree boundary pass.

Broader host-enabled daemon suite failed 154 passed/1 failed/20 ignored at immediate post-drop runtime lock probe. Concurrent fork/exec suites can briefly inherit CLOEXEC descriptors; the same existing generation-watchdog tests already use a bounded release probe. Keeping strict held-lock assertions, adding bounded eventual-release check and explicit refused-exec resume regression. FIFO runner 4114570 (child wrapper queued) remains waiting, not stopped; log ~/.cache/j12-edge-update-evidence/host-resume-retry.log. It sequentially qualifies resume, host-enabled suite, then new host-generation preparation RED. New inheritance/preparation drafts remain unqualified. One target retained at ~/.cache/j12-edge-update-evidence/target. No root units/mounts active. Final exact-head systemd/fast/perf/D243 still owed.

J12 checkpoint pushed 9f294de05 on edge-update-v2. Atomic qualified slices: a6fd1819d extracts standalone activity feature without SQLx; 9f294de05 adds signed bounded host dispatcher, owner-adoption refusal, paused-version/downgrade checks, setting-epoch invalidation, and writer-owned COMMIT delivery. This is the receiver adapter, not complete process owner/adoption/version-follow wiring. compute01 via build-slot: host release 56 passed; host all-target Clippy; activity 4 passed; remote-only CLI check and normal host dependency-tree boundary pass. Broader host-enabled daemon suite failed 154 passed/1 failed/20 ignored at immediate post-drop runtime lock probe. Concurrent fork/exec suites can briefly inherit CLOEXEC descriptors; the same existing generation-watchdog tests already use a bounded release probe. Keeping strict held-lock assertions, adding bounded eventual-release check and explicit refused-exec resume regression. FIFO runner 4114570 (child wrapper queued) remains waiting, not stopped; log ~/.cache/j12-edge-update-evidence/host-resume-retry.log. It sequentially qualifies resume, host-enabled suite, then new host-generation preparation RED. New inheritance/preparation drafts remain unqualified. One target retained at ~/.cache/j12-edge-update-evidence/target. No root units/mounts active. Final exact-head systemd/fast/perf/D243 still owed.
kayg commented 2026-11-01 07:53:56 +00:00
Author
Owner
Copy link

J12 crash-safety checkpoint pushed edge-update-v2@d2e90cba0 (UNQUALIFIED WIP; preceding qualified head9f294de05). Retained-runtime resume regression observed expected RED (unsupported adapter,1 failed), then GREEN3 functional controlled-runtime cases. Clippy refused the newly used _guard field name; renamed it to guard without suppression. Current retry231890 remains FIFO queued (~12min, now fourth), not canceled; log ~/.cache/j12-edge-update-evidence/host-qualified-retry.log. It sequentially reruns resume + broad host-enabled suite, then host preparation, descriptor import, metadata and trial-callback RED/GREEN phases. Every new feature still has a refusing adapter until its intended assertion failure is observed; no production host lifecycle claim.

Review finding for upcoming wiring: terminal activity alone cannot fence all candidate node callbacks; e.g. preferred_server lazily restores Mesh state. Generic runtime admission must defer ordinary/control callbacks, route restoration and observation callbacks until durable private check-in, while leaving the release machine check-in available. New failing-first tests cover that boundary. Runtime lock duplicates must keep CLOEXEC until all process-spawning workers join; final exec alone enables inheritance. Drafts are preserved in the WIP, not declared GREEN.

No root units/mounts/proofs active. One target remains /home/claude/.cache/j12-edge-update-evidence/target. Local recovery ledger ~/.cache/codex-scratch/j12/continuation.md describes the queued immutable sources, flags and all outstanding work. Final full fast, exact-head7/7/storage, complete host/adoption/version follow, full failure/perf acceptance and D243 measurements still owed. WIP will be split into gated atomic commits before finish.

J12 crash-safety checkpoint pushed edge-update-v2@d2e90cba0 (UNQUALIFIED WIP; preceding qualified head9f294de05). Retained-runtime resume regression observed expected RED (unsupported adapter,1 failed), then GREEN3 functional controlled-runtime cases. Clippy refused the newly used _guard field name; renamed it to guard without suppression. Current retry231890 remains FIFO queued (~12min, now fourth), not canceled; log ~/.cache/j12-edge-update-evidence/host-qualified-retry.log. It sequentially reruns resume + broad host-enabled suite, then host preparation, descriptor import, metadata and trial-callback RED/GREEN phases. Every new feature still has a refusing adapter until its intended assertion failure is observed; no production host lifecycle claim. Review finding for upcoming wiring: terminal activity alone cannot fence all candidate node callbacks; e.g. preferred_server lazily restores Mesh state. Generic runtime admission must defer ordinary/control callbacks, route restoration and observation callbacks until durable private check-in, while leaving the release machine check-in available. New failing-first tests cover that boundary. Runtime lock duplicates must keep CLOEXEC until all process-spawning workers join; final exec alone enables inheritance. Drafts are preserved in the WIP, not declared GREEN. No root units/mounts/proofs active. One target remains /home/claude/.cache/j12-edge-update-evidence/target. Local recovery ledger ~/.cache/codex-scratch/j12/continuation.md describes the queued immutable sources, flags and all outstanding work. Final full fast, exact-head7/7/storage, complete host/adoption/version follow, full failure/perf acceptance and D243 measurements still owed. WIP will be split into gated atomic commits before finish.
kayg commented 2026-11-01 07:59:39 +00:00
Author
Owner
Copy link

J12 continued from pushed edge-update-v2@d2e90cba0 (qualified predecessor9f294de05), based on assigned origin/dev f4b61cd6c. Re-read the common brief, accepted plan and issue notes. Existing compute01 FIFO231890 is still waiting and remains intact; no build/source mutation while a compiler owns the checkout. Continuing signed host preparation, runtime descriptor handoff and candidate callback admission before lifecycle integration. Historical systemd/storage receipts are not final-head acceptance; no completion claim. One target remains ~/.cache/j12-edge-update-evidence/target; gate log host-qualified-retry.log. D243 caps remain removed, final matched deltas still owed.

J12 continued from pushed edge-update-v2@d2e90cba0 (qualified predecessor9f294de05), based on assigned origin/dev f4b61cd6c. Re-read the common brief, accepted plan and issue notes. Existing compute01 FIFO231890 is still waiting and remains intact; no build/source mutation while a compiler owns the checkout. Continuing signed host preparation, runtime descriptor handoff and candidate callback admission before lifecycle integration. Historical systemd/storage receipts are not final-head acceptance; no completion claim. One target remains ~/.cache/j12-edge-update-evidence/target; gate log host-qualified-retry.log. D243 caps remain removed, final matched deltas still owed.
kayg commented 2026-11-01 08:12:27 +00:00
Author
Owner
Copy link

J12 qualified slices pushed through adef69265:12ec43e79 retained-runtime resume, c8286a948 standalone terminal activity/input fences,81cfe04b5 retained-target proof packaging,a49ddf7f9 signed private host-generation preparation,adef69265 runtime descriptor transfer. compute01 FIFO231890 acquired and remains active. Observed failing adapters before implementation. Gates: retained3; daemon156 then158 passed/20ignored; host-only release59; default release81/3ignored; corresponding Clippy/fmt and packaging regression passed. These are boundaries, not complete production host lifecycle.

Harness finding: archive extraction preserved old mtimes and Cargo selected zero new tests; rejected that RED, changed new-phase extraction to refresh mtimes, and reran to the intended 2pass/1fail preparation assertion. CLI metadata then observed descriptor/command/presenter RED and positive GREEN tests; host-only Clippy found existing Mesh cleanup functions unnecessarily fallible without Mesh. Selecting existing Kernel::NONE in that build and retrying, rather than suppressing lint. Next generic candidate callback gate remains refusing stub until RED.

Owner-adoption investigation: daemon is non-dumpable, so a same-UID installer cannot reliably authenticate /proc/PEER/exe. Proposed generic same-UID local-only action boundary lets runtime verify its own executing image; remote public/private dispatch must exclude that surface. Ruling/remaining plan recorded in local continuation ledger. Full host lifecycle, final exact-head systemd/fast/perf/failure and matched D243 remain owed. No root units/mounts active; one retained target remains ~/.cache/j12-edge-update-evidence/target.

J12 qualified slices pushed through adef69265:12ec43e79 retained-runtime resume, c8286a948 standalone terminal activity/input fences,81cfe04b5 retained-target proof packaging,a49ddf7f9 signed private host-generation preparation,adef69265 runtime descriptor transfer. compute01 FIFO231890 acquired and remains active. Observed failing adapters before implementation. Gates: retained3; daemon156 then158 passed/20ignored; host-only release59; default release81/3ignored; corresponding Clippy/fmt and packaging regression passed. These are boundaries, not complete production host lifecycle. Harness finding: archive extraction preserved old mtimes and Cargo selected zero new tests; rejected that RED, changed new-phase extraction to refresh mtimes, and reran to the intended 2pass/1fail preparation assertion. CLI metadata then observed descriptor/command/presenter RED and positive GREEN tests; host-only Clippy found existing Mesh cleanup functions unnecessarily fallible without Mesh. Selecting existing Kernel::NONE in that build and retrying, rather than suppressing lint. Next generic candidate callback gate remains refusing stub until RED. Owner-adoption investigation: daemon is non-dumpable, so a same-UID installer cannot reliably authenticate /proc/PEER/exe. Proposed generic same-UID local-only action boundary lets runtime verify its own executing image; remote public/private dispatch must exclude that surface. Ruling/remaining plan recorded in local continuation ledger. Full host lifecycle, final exact-head systemd/fast/perf/failure and matched D243 remain owed. No root units/mounts active; one retained target remains ~/.cache/j12-edge-update-evidence/target.
kayg commented 2026-11-01 08:40:40 +00:00
Author
Owner
Copy link

J12 crash-safety push: edge-update-v2@e952d6f26 is explicitly UNQUALIFIED WIP for the generic candidate callback gate; qualified predecessor199ab3dd5. Metadata slice199ab3dd5 passed descriptor/CLI/presenter regressions, host-only and default all-target CLI Clippy, compile-out/no-SQLx tree and formatting. Earlier qualified boundary commits are on72464.

FIFO629795 is still queued (now second, ~23min); log ~/.cache/j12-edge-update-evidence/runtime-owner-continuation.log. Kept it waiting, no own queued run canceled. Previous FIFO231890 completed all qualified phases, then exited on a test-fixture compile error (temporary static action-array lifetime), which is corrected in queued source. That error was not treated as valid RED.

Queued phases: runtime-gate RED/GREEN, local-only owner API RED/GREEN, real socket writer-owned owner effects RED/GREEN, release.down transfer-lock cleanup RED/GREEN. GREEN implementations for these remain absent until intended assertions fail. New disable regression uses an actual Receiving directory lock: current ordering calls lifecycle cleanup while still owning its own transfer. Future host drain copies credentials only after all runtime workers join, avoiding a canceled input attempt leaving a prospective pointer and false failed-version pause. Detailed ledger ~/.cache/codex-scratch/j12/continuation.md; scripts/sources same scratch and VM evidence directory. One target ~/.cache/j12-edge-update-evidence/target retained. No root units/mounts active; full lifecycle and final fast/systemd/perf/size acceptance still owed. WIP will be split with an exact lease.

J12 crash-safety push: edge-update-v2@e952d6f26 is explicitly UNQUALIFIED WIP for the generic candidate callback gate; qualified predecessor199ab3dd5. Metadata slice199ab3dd5 passed descriptor/CLI/presenter regressions, host-only and default all-target CLI Clippy, compile-out/no-SQLx tree and formatting. Earlier qualified boundary commits are on72464. FIFO629795 is still queued (now second, ~23min); log ~/.cache/j12-edge-update-evidence/runtime-owner-continuation.log. Kept it waiting, no own queued run canceled. Previous FIFO231890 completed all qualified phases, then exited on a test-fixture compile error (temporary static action-array lifetime), which is corrected in queued source. That error was not treated as valid RED. Queued phases: runtime-gate RED/GREEN, local-only owner API RED/GREEN, real socket writer-owned owner effects RED/GREEN, release.down transfer-lock cleanup RED/GREEN. GREEN implementations for these remain absent until intended assertions fail. New disable regression uses an actual Receiving directory lock: current ordering calls lifecycle cleanup while still owning its own transfer. Future host drain copies credentials only after all runtime workers join, avoiding a canceled input attempt leaving a prospective pointer and false failed-version pause. Detailed ledger ~/.cache/codex-scratch/j12/continuation.md; scripts/sources same scratch and VM evidence directory. One target ~/.cache/j12-edge-update-evidence/target retained. No root units/mounts active; full lifecycle and final fast/systemd/perf/size acceptance still owed. WIP will be split with an exact lease.
kayg commented 2026-11-01 08:46:41 +00:00
Author
Owner
Copy link

Resuming J12 on edge-update-v2 at e952d6f26 (qualified predecessor 199ab3dd5), based on dev f4b61cd6c. Existing compute01 FIFO wrapper 629795 is still queued and will be left waiting. Continuing callback admission/local owner dispatch/host cleanup RED→GREEN slices before production host lifecycle integration. Retained target: /home/claude/.cache/j12-edge-update-evidence/target; log: runtime-owner-continuation.log in the same evidence directory. Final current-head systemd, verify fast and matched D243 deltas remain owed.

Resuming J12 on edge-update-v2 at e952d6f26 (qualified predecessor 199ab3dd5), based on dev f4b61cd6c. Existing compute01 FIFO wrapper 629795 is still queued and will be left waiting. Continuing callback admission/local owner dispatch/host cleanup RED→GREEN slices before production host lifecycle integration. Retained target: /home/claude/.cache/j12-edge-update-evidence/target; log: runtime-owner-continuation.log in the same evidence directory. Final current-head systemd, verify fast and matched D243 deltas remain owed.
kayg commented 2026-11-01 09:09:28 +00:00
Author
Owner
Copy link

J12 crash checkpoint edge-update-v2@f58a0d053 replaces earlier callback-stub WIP e952d6f26; still UNQUALIFIED, predecessor199ab3dd5 is qualified. compute01 FIFO629795 acquired, observed intended callback RED3/3, then activity41 and socket-host44 passed (1ignored). Strict Clippy caught2newtest assert_is_empty lints; corrected, queued retry PID1033805 (runtime-owner-retry.log), currently~18min wait. Not canceled. One retained target ~/.cache/j12-edge-update-evidence/target. Retry chains local-only owner API/presentation, actual local socket writer effects, transfer-lock disable cleanup, and newly prepared immutable host boot configuration/signed original-image adoption regressions. These later GREEN implementations are absent until RED. All phase scripts/test drafts and current ledger in ~/.cache/codex-scratch/j12 locally /VM evidence directory. Production host lifecycle/readonly/30scheckin/watchdog/adoptedbootstraprepair remain unwired. Final exact-head systemd7/7, fast, matchedD243 and fullperf/failureacceptance still owed; historical receipts are not final acceptance. No root units/mounts/processes active.

J12 crash checkpoint edge-update-v2@f58a0d053 replaces earlier callback-stub WIP e952d6f26; still UNQUALIFIED, predecessor199ab3dd5 is qualified. compute01 FIFO629795 acquired, observed intended callback RED3/3, then activity41 and socket-host44 passed (1ignored). Strict Clippy caught2newtest assert_is_empty lints; corrected, queued retry PID1033805 (runtime-owner-retry.log), currently~18min wait. Not canceled. One retained target ~/.cache/j12-edge-update-evidence/target. Retry chains local-only owner API/presentation, actual local socket writer effects, transfer-lock disable cleanup, and newly prepared immutable host boot configuration/signed original-image adoption regressions. These later GREEN implementations are absent until RED. All phase scripts/test drafts and current ledger in ~/.cache/codex-scratch/j12 locally /VM evidence directory. Production host lifecycle/readonly/30scheckin/watchdog/adoptedbootstraprepair remain unwired. Final exact-head systemd7/7, fast, matchedD243 and fullperf/failureacceptance still owed; historical receipts are not final acceptance. No root units/mounts/processes active.
kayg commented 2026-11-01 09:38:13 +00:00
Author
Owner
Copy link

J12 checkpoint: no source changes since pushed WIPf58a0d053 /qualified199ab3dd5. compute01 FIFO1033805 remains live, now FIRST, ~47min waiting (log runtime-owner-retry.log). Four slots still have live builds/tests;52GBfree, so no disk admission block. No queued work canceled or duplicated. While waiting, prepared additional failing-first node readonly admission/terminal refusal and existing readonly runtime-lock cases after the previously recorded phases. Their GREEN code remains absent until valid assertion RED. Prepared one-target matched static-size runner (paired-static-sizes.sh; NOT RUN) instead of old second-target reference script. Ledger/test drafts/scripts in ~/.cache/codex-scratch/j12, mirrored phase inputs oncompute01 ~/.cache/j12-edge-update-evidence. No new qualification/final acceptance claim; production host lifecycle and final exact-head systemd/fast/sizes/perf still owed.

J12 checkpoint: no source changes since pushed WIPf58a0d053 /qualified199ab3dd5. compute01 FIFO1033805 remains live, now FIRST, ~47min waiting (log runtime-owner-retry.log). Four slots still have live builds/tests;52GBfree, so no disk admission block. No queued work canceled or duplicated. While waiting, prepared additional failing-first node readonly admission/terminal refusal and existing readonly runtime-lock cases after the previously recorded phases. Their GREEN code remains absent until valid assertion RED. Prepared one-target matched static-size runner (paired-static-sizes.sh; NOT RUN) instead of old second-target reference script. Ledger/test drafts/scripts in ~/.cache/codex-scratch/j12, mirrored phase inputs oncompute01 ~/.cache/j12-edge-update-evidence. No new qualification/final acceptance claim; production host lifecycle and final exact-head systemd/fast/sizes/perf still owed.
kayg commented 2026-11-01 09:52:43 +00:00
Author
Owner
Copy link

J12 resumed from pushed edge-update-v2@8098ec52b, based on origin/dev f4b61cd6c. Local owner API is qualified; socket writer-owned effects currently have a failed lost-peer oracle (160 pass/1 fail/20 ignored). Investigating explicit kernel peer shutdown before releasing the blocked handler; no final acceptance claim. Prior FIFO ended, no pending old J12 jobs found. Continuing host lifecycle integration and outstanding exact-head systemd/fast/perf/matched D243 gates. One target retained at /home/claude/.cache/j12-edge-update-evidence/target.

J12 resumed from pushed edge-update-v2@8098ec52b, based on origin/dev f4b61cd6c. Local owner API is qualified; socket writer-owned effects currently have a failed lost-peer oracle (160 pass/1 fail/20 ignored). Investigating explicit kernel peer shutdown before releasing the blocked handler; no final acceptance claim. Prior FIFO ended, no pending old J12 jobs found. Continuing host lifecycle integration and outstanding exact-head systemd/fast/perf/matched D243 gates. One target retained at /home/claude/.cache/j12-edge-update-evidence/target.
kayg commented 2026-11-01 10:57:27 +00:00
Author
Owner
Copy link

J12 crash-safety checkpoint: edge-update-v2@d57401c48 is UNQUALIFIED WIP for local socket writer-owned effects; qualified predecessor8098ec52b. Current compute01 FIFO PID1837190 remains live, now fifth after ~27min; not canceled or duplicated. Log ~/.cache/j12-edge-update-evidence/local-worker-retry.log. Previous broad socket run160 passed/1 failed/20 ignored: lost-peer test expected close after drop while parallel fork/exec can transiently retain a duplicate; retry explicitly shuts down both kernel directions before releasing its blocked callback. No GREEN claim yet.

While queued, repaired a future publication-fence test draft whose assertions were inserted into the wrong test, added immutable boot-coordinate rejection tests, read-only callback/registration refusal cases, and a real read-only Service startup regression (no plugins.sock, no credential allocation, existing read-only exclusive lifetime lock). Those later phases remain RED drafts with no GREEN implementations until observed assertion failures. Phase scripts/test inputs are in local ~/.cache/codex-scratch/j12 and compute01 evidence directory; latest ledger continuation.md and final-acceptance-checklist.md. Current FIFO chains disable/boot/adopt/read-only/publication/service phases once it acquires. One target remains /home/claude/.cache/j12-edge-update-evidence/target. No root units/mounts/proofs active. Complete host lifecycle and final exact-head systemd7/7, fast, matchedD243 and full perf/failure acceptance remain owed. WIP will be split before finish.

J12 crash-safety checkpoint: edge-update-v2@d57401c48 is UNQUALIFIED WIP for local socket writer-owned effects; qualified predecessor8098ec52b. Current compute01 FIFO PID1837190 remains live, now fifth after ~27min; not canceled or duplicated. Log ~/.cache/j12-edge-update-evidence/local-worker-retry.log. Previous broad socket run160 passed/1 failed/20 ignored: lost-peer test expected close after drop while parallel fork/exec can transiently retain a duplicate; retry explicitly shuts down both kernel directions before releasing its blocked callback. No GREEN claim yet. While queued, repaired a future publication-fence test draft whose assertions were inserted into the wrong test, added immutable boot-coordinate rejection tests, read-only callback/registration refusal cases, and a real read-only Service startup regression (no plugins.sock, no credential allocation, existing read-only exclusive lifetime lock). Those later phases remain RED drafts with no GREEN implementations until observed assertion failures. Phase scripts/test inputs are in local ~/.cache/codex-scratch/j12 and compute01 evidence directory; latest ledger continuation.md and final-acceptance-checklist.md. Current FIFO chains disable/boot/adopt/read-only/publication/service phases once it acquires. One target remains /home/claude/.cache/j12-edge-update-evidence/target. No root units/mounts/proofs active. Complete host lifecycle and final exact-head systemd7/7, fast, matchedD243 and full perf/failure acceptance remain owed. WIP will be split before finish.
kayg commented 2026-11-01 11:03:28 +00:00
Author
Owner
Copy link

J12 qualified socket slice pushed as d4179c052 on edge-update-v2 (replaces unqualified d57401c48 WIP with an exact lease). Full host-enabled daemon suite161 passed/0failed/20ignored, strict all-target Clippy and formatting pass, LOCAL_WORKER_GREEN_EXIT=0. Same-UID local writer preserves AfterReply until the complete reply write; remote local-only invocation refuses; lost-peer effects remain inert even with a duplicated peer descriptor. Historical old lost-peer test passes alone1/1 but failed in concurrent suite; explicit kernel shutdown removes its transient fork/exec ownership ambiguity.

Next real transfer-lock regression observed expected RED at release.down self-held Receiving lock; moving transfer drop before lifecycle.set_enabled passes60/60 host release tests. Clippy caught new test expect_used, corrected to allowed unwrap; retry PID2439838 now FIFO queued6 (host-disable-retry.log), not canceled. Following phase scripts now retain their acquired slot and await a corrected immutable GREEN archive after a qualification refusal rather than losing the slot for a lint repair. Future boot/adoption/read-only/publication/service regressions remain unqualified drafts; full host lifecycle and exact-head final gates still owed. No root jobs; one retained target /home/claude/.cache/j12-edge-update-evidence/target. Current source and scripts preserved locally and on compute01 evidence path.

J12 qualified socket slice pushed as d4179c052 on edge-update-v2 (replaces unqualified d57401c48 WIP with an exact lease). Full host-enabled daemon suite161 passed/0failed/20ignored, strict all-target Clippy and formatting pass, LOCAL_WORKER_GREEN_EXIT=0. Same-UID local writer preserves AfterReply until the complete reply write; remote local-only invocation refuses; lost-peer effects remain inert even with a duplicated peer descriptor. Historical old lost-peer test passes alone1/1 but failed in concurrent suite; explicit kernel shutdown removes its transient fork/exec ownership ambiguity. Next real transfer-lock regression observed expected RED at release.down self-held Receiving lock; moving transfer drop before lifecycle.set_enabled passes60/60 host release tests. Clippy caught new test expect_used, corrected to allowed unwrap; retry PID2439838 now FIFO queued6 (host-disable-retry.log), not canceled. Following phase scripts now retain their acquired slot and await a corrected immutable GREEN archive after a qualification refusal rather than losing the slot for a lint repair. Future boot/adoption/read-only/publication/service regressions remain unqualified drafts; full host lifecycle and exact-head final gates still owed. No root jobs; one retained target /home/claude/.cache/j12-edge-update-evidence/target. Current source and scripts preserved locally and on compute01 evidence path.
kayg commented 2026-11-01 11:28:45 +00:00
Author
Owner
Copy link

J12 crash-safety checkpoint edge-update-v2@1b29acdf3 is UNQUALIFIED WIP for transfer-drop-before-disable cleanup; qualified predecessord4179c052. The new regression observed expected self-held directory-lock RED, then60/60 host tests passed; only its expect_used test lint needed correction. Native qualification retry PID2439838 remains FIFO queued, now FIRST after ~30min (host-disable-retry.log). Not canceled; four slots have live build/test trees. No completion claim.

While waiting, pruned only J12's unused incremental/example build artifacts, preserving native dependencies/tests and the one retained target; VM free space recovered above admission threshold. Future immutable drafts/scripts cover boot coordinates, signed original-image adoption, node read-only callbacks/late registration, existing-only runtime lock, certificate publication freeze, read-only Service allocation, and local-only adoption dispatch. No GREEN implementations for those before actual RED. Phase qualification failures now await corrected archives within the acquired slot. Pending-download ownership and host watchdog scope/deadline/renewal audits are recorded in ~/.cache/codex-scratch/j12/host-integration-notes.md; current ledger continuation.md. Local adoption tests are appended after service recovery in the queued chain.

Proof scope clarification: original dispatch asks for the perf-VM kit; accepted plan labels whole-VM power cuts/reboots "Orchestrator, VM only". Package those isolated-VM cases, do not reboot/power-cut a shared build host. Exact-head assigned systemd/storage proof, fast, matchedD243 and actual performed/perf-kit-unrun distinction still required. Production host lifecycle remains unwired; current historical systemd receipts are not final. No root units/mounts active. One target /home/claude/.cache/j12-edge-update-evidence/target remains.

J12 crash-safety checkpoint edge-update-v2@1b29acdf3 is UNQUALIFIED WIP for transfer-drop-before-disable cleanup; qualified predecessord4179c052. The new regression observed expected self-held directory-lock RED, then60/60 host tests passed; only its expect_used test lint needed correction. Native qualification retry PID2439838 remains FIFO queued, now FIRST after ~30min (host-disable-retry.log). Not canceled; four slots have live build/test trees. No completion claim. While waiting, pruned only J12's unused incremental/example build artifacts, preserving native dependencies/tests and the one retained target; VM free space recovered above admission threshold. Future immutable drafts/scripts cover boot coordinates, signed original-image adoption, node read-only callbacks/late registration, existing-only runtime lock, certificate publication freeze, read-only Service allocation, and local-only adoption dispatch. No GREEN implementations for those before actual RED. Phase qualification failures now await corrected archives within the acquired slot. Pending-download ownership and host watchdog scope/deadline/renewal audits are recorded in ~/.cache/codex-scratch/j12/host-integration-notes.md; current ledger continuation.md. Local adoption tests are appended after service recovery in the queued chain. Proof scope clarification: original dispatch asks for the perf-VM kit; accepted plan labels whole-VM power cuts/reboots "Orchestrator, VM only". Package those isolated-VM cases, do not reboot/power-cut a shared build host. Exact-head assigned systemd/storage proof, fast, matchedD243 and actual performed/perf-kit-unrun distinction still required. Production host lifecycle remains unwired; current historical systemd receipts are not final. No root units/mounts active. One target /home/claude/.cache/j12-edge-update-evidence/target remains.
kayg commented 2026-11-01 11:35:28 +00:00
Author
Owner
Copy link

J12 resumed from pushed edge-update-v2@1b29acdf3, qualified predecessor d4179c052, assigned dev f4b61cd6c. Re-read common brief/current notes and accepted plan. Existing compute01 FIFO PID2439838 remains live and untouched; host-disable-retry.log still waiting. Continuing local preparation while preserving immutable phase inputs and the one target /home/claude/.cache/j12-edge-update-evidence/target. No root units/mounts active. Production host lifecycle and final exact-head systemd/fast/matched D243 acceptance remain outstanding; no completion claim.

J12 resumed from pushed edge-update-v2@1b29acdf3, qualified predecessor d4179c052, assigned dev f4b61cd6c. Re-read common brief/current notes and accepted plan. Existing compute01 FIFO PID2439838 remains live and untouched; host-disable-retry.log still waiting. Continuing local preparation while preserving immutable phase inputs and the one target /home/claude/.cache/j12-edge-update-evidence/target. No root units/mounts active. Production host lifecycle and final exact-head systemd/fast/matched D243 acceptance remain outstanding; no completion claim.
kayg commented 2026-11-01 11:38:28 +00:00
Author
Owner
Copy link

J12 qualified disable slice e37570afd pushed (replaces WIP1b29acdf3 with exact lease). compute01 FIFO2439838 acquired: host release 60 passed/0failed, strict all-target Clippy and formatting passed; HOST_DISABLE_GREEN_EXIT=0. The next host boot test phase failed before assertions because its standalone remote test feature set omitted test-support and Tokio rt-multi-thread. Corrected the phase commands and idempotent module registration; new FIFO2903358 /host-boot-retry.log queued, not canceled. No boot RED/GREEN claim yet; future production host lifecycle and final fast/systemd/sizes remain owed. No root units/mounts active; one target unchanged.

J12 qualified disable slice e37570afd pushed (replaces WIP1b29acdf3 with exact lease). compute01 FIFO2439838 acquired: host release 60 passed/0failed, strict all-target Clippy and formatting passed; HOST_DISABLE_GREEN_EXIT=0. The next host boot test phase failed before assertions because its standalone remote test feature set omitted test-support and Tokio rt-multi-thread. Corrected the phase commands and idempotent module registration; new FIFO2903358 /host-boot-retry.log queued, not canceled. No boot RED/GREEN claim yet; future production host lifecycle and final fast/systemd/sizes remain owed. No root units/mounts active; one target unchanged.
kayg commented 2026-11-01 12:00:47 +00:00
Author
Owner
Copy link

J12 checkpoint edge-update-v2@4b92ec1a6 qualified the offline perf-kit packager (remote unit RED missing helper → GREEN archive roundtrip/tamper-before-perf-run; measured=false). The next pushed WIP preserves an UNQUALIFIED standalone remote-test repair plus a restored generation perf fixture; these will be split after native qualification. Test repair addresses the actual agent-only compile failures (Tokio rt-multi-thread and cfg(test) history helpers). Perf fixture reuses old route pumps, keeps 128 routes attached, starts signed A via the fixed generation entry, and covers quiet update/rollback/failure/retention; it has NOT compiled/run yet.

FIFO2903358 remains live, now position11, ~25min waiting, host-boot-retry.log. No cancellation/duplicate run. It chains boot/adoption/read-only/publication/service/local-adoption qualification, then the drafted perf-fixture compile gate. Production host lifecycle and final exact-head fast/systemd7/7/matched D243 remain owed. One target unchanged; no root units/mounts active. Local continuation and phase archives preserved under ~/.cache/codex-scratch/j12 and VM ~/.cache/j12-edge-update-evidence.

J12 checkpoint edge-update-v2@4b92ec1a6 qualified the offline perf-kit packager (remote unit RED missing helper → GREEN archive roundtrip/tamper-before-perf-run; measured=false). The next pushed WIP preserves an UNQUALIFIED standalone remote-test repair plus a restored generation perf fixture; these will be split after native qualification. Test repair addresses the actual agent-only compile failures (Tokio rt-multi-thread and cfg(test) history helpers). Perf fixture reuses old route pumps, keeps 128 routes attached, starts signed A via the fixed generation entry, and covers quiet update/rollback/failure/retention; it has NOT compiled/run yet. FIFO2903358 remains live, now position11, ~25min waiting, host-boot-retry.log. No cancellation/duplicate run. It chains boot/adoption/read-only/publication/service/local-adoption qualification, then the drafted perf-fixture compile gate. Production host lifecycle and final exact-head fast/systemd7/7/matched D243 remain owed. One target unchanged; no root units/mounts active. Local continuation and phase archives preserved under ~/.cache/codex-scratch/j12 and VM ~/.cache/j12-edge-update-evidence.
kayg commented 2026-11-01 16:48:54 +00:00
Author
Owner
Copy link

J12b resumed in isolated control worktree /home/kayg/Developer/Worktrees/infraternal-j12b, branch j12b-edge-update, from pushed edge-update-v2@1d534607c. Current origin/dev base target a26615c50e. Read common brief and issue history; no production or signer deployment. Plan (estimate 4 hours active implementation plus mandatory build-slot/gate queue time): (1) rebase and inventory qualified vs refusing adapters; (2) complete existing approved host boot/adoption/lifecycle path with failing-first checks, reusing generation storage/watchdog/runtime; (3) wire existing version source if its backend status/check is in approved reporting scope; (4) VM detached build-slot focused/full-fast and exact-head proof/size evidence; atomic commits and own-branch push; (5) remove owned targets and finish with verbatim gate. No new infrastructure. Existing old boot run ended at expected RED, no pending PID found. Will stop/report before exceeding 2x estimate. Existing historical evidence is not final-head acceptance.

J12b resumed in isolated control worktree /home/kayg/Developer/Worktrees/infraternal-j12b, branch j12b-edge-update, from pushed edge-update-v2@1d534607c. Current origin/dev base target a26615c50e76ed86f36d25aa094283cf840d5320. Read common brief and issue history; no production or signer deployment. Plan (estimate 4 hours active implementation plus mandatory build-slot/gate queue time): (1) rebase and inventory qualified vs refusing adapters; (2) complete existing approved host boot/adoption/lifecycle path with failing-first checks, reusing generation storage/watchdog/runtime; (3) wire existing version source if its backend status/check is in approved reporting scope; (4) VM detached build-slot focused/full-fast and exact-head proof/size evidence; atomic commits and own-branch push; (5) remove owned targets and finish with verbatim gate. No new infrastructure. Existing old boot run ended at expected RED, no pending PID found. Will stop/report before exceeding 2x estimate. Existing historical evidence is not final-head acceptance.
kayg commented 2026-11-01 17:01:14 +00:00
Author
Owner
Copy link

J12b inventory finding: pushed continuation has receiver and server sender/catalog boundaries, but crates/infraternal/src/remote.rs still calls run_with_installation without RuntimeControl, so production host lifecycle registration/adoption/trial remains unwired. Boot-coordinate/adoption qualification is necessary before that wiring. Version reporting/check IS in scope: existing release.updates.get/check + release.updates events and remote.host.list.agent_version can feed #216 without new endpoints or layout. Added production-source wire-shape regressions; implementation awaits observed RED. Initial rebased host_boot filter accidentally ran against the pre-test VM copy (0 tests); rejected that result and corrected immutable source transfer. Corrected RED/GREEN chain is FIFO queued as PID2054155, log /home/claude/.cache/j12b-evidence/boot.log; source RED PID2136113. One inherited target moved, not duplicated: /home/claude/worktrees/j12b/target. Current branch rebased head a92dd3ee3. No lifecycle/UI completion or final-gate claim.

J12b inventory finding: pushed continuation has receiver and server sender/catalog boundaries, but crates/infraternal/src/remote.rs still calls run_with_installation without RuntimeControl, so production host lifecycle registration/adoption/trial remains unwired. Boot-coordinate/adoption qualification is necessary before that wiring. Version reporting/check IS in scope: existing release.updates.get/check + release.updates events and remote.host.list.agent_version can feed #216 without new endpoints or layout. Added production-source wire-shape regressions; implementation awaits observed RED. Initial rebased host_boot filter accidentally ran against the pre-test VM copy (0 tests); rejected that result and corrected immutable source transfer. Corrected RED/GREEN chain is FIFO queued as PID2054155, log /home/claude/.cache/j12b-evidence/boot.log; source RED PID2136113. One inherited target moved, not duplicated: /home/claude/worktrees/j12b/target. Current branch rebased head a92dd3ee3. No lifecycle/UI completion or final-gate claim.
kayg commented 2026-11-01 17:07:00 +00:00
Author
Owner
Copy link

J12b crash-safety snapshot pushed j12b-edge-update@70210192b (WIP, based on dev a26615c50). It preserves boot-coordinate implementation, adoption/read-only refusing adapters and production version source work; these will be split after qualification. Version source observed RED 0pass/4fail, then GREEN 29pass/0fail across the version module. Explicit source RED queue was retired because this is a 265ms light unit check (run on compute01); no Rust build-slot bypass. Native FIFO2054155 remains queued, now ~13min, log /home/claude/.cache/j12b-evidence/boot.log. Immutable native phases observe assertion RED before implementation; boot/adoption/read-only/recovery-lock qualification then UI typecheck/production-build alignment/captures are chained in the same slot. ARM currently has only13GBfree, below the25GB floor, so no extra target was created there. One target /home/claude/worktrees/j12b/target. No root services/mounts or deployment. Production host lifecycle, final fast, exact-head systemd/storage, matched sizes and performed-vs-unrun proof evidence remain owed.

J12b crash-safety snapshot pushed j12b-edge-update@70210192b (WIP, based on dev a26615c50). It preserves boot-coordinate implementation, adoption/read-only refusing adapters and production version source work; these will be split after qualification. Version source observed RED 0pass/4fail, then GREEN 29pass/0fail across the version module. Explicit source RED queue was retired because this is a 265ms light unit check (run on compute01); no Rust build-slot bypass. Native FIFO2054155 remains queued, now ~13min, log /home/claude/.cache/j12b-evidence/boot.log. Immutable native phases observe assertion RED before implementation; boot/adoption/read-only/recovery-lock qualification then UI typecheck/production-build alignment/captures are chained in the same slot. ARM currently has only13GBfree, below the25GB floor, so no extra target was created there. One target /home/claude/worktrees/j12b/target. No root services/mounts or deployment. Production host lifecycle, final fast, exact-head systemd/storage, matched sizes and performed-vs-unrun proof evidence remain owed.
kayg commented 2026-11-01 17:32:04 +00:00
Author
Owner
Copy link

J12b qualified and pushed two atomic slices on j12b-edge-update: 6db2a1859 binds immutable boot metadata to original bootstrap coordinates; bee16db0f authenticates original-image adoption while retaining the live identity directory and legacy boot owner. Actual RED→GREEN receipts in /home/claude/.cache/j12b-evidence: boot 1pass/3fail → remote library 100pass/14ignored, strict Clippy/fmt; adoption 1pass/1fail → host-only release 62pass/0fail, strict Clippy/fmt. These are prerequisites, not complete lifecycle or final acceptance.

Version adapter disposal regression observed 4pass/1fail (late check returned unknown after view disposal), then all version module tests 30pass/0fail after the fix. Typecheck and production-browser captures still pending. Initial extra disposal attempt accidentally used the original stub source restored by the boot snapshot; rejected that result and reran against the implemented source before fixing.

One qualification script error sent the unchanged read-only stub archive after a local Python syntax failure. The VM correctly failed 4 recovery assertions; no GREEN was claimed. Corrected implementation is queued as compute01 PID2452917, node-retry.log (same evidence directory); it chains existing-lock recovery, allocation-free service startup, local-only adoption, boot/uninstall compatibility, renewal publication fence, initial host lifecycle regression, then UI checks. No duplicate active run. The original PID2054155 has exited.

Production host lifecycle remains unwired. Preparing the concrete owner around the existing receiver/store/watchdog, with durable enable/disable and attempt-specific retry. No new updater engine/framework. No root services or mounts. One retained target: /home/claude/worktrees/j12b/target. ARM has 24GB free, still below the mandatory25GB admission floor; no second target created. Full fast, exact-head systemd/storage, matched sizes and performed-versus-unrun proof evidence remain owed.

J12b qualified and pushed two atomic slices on j12b-edge-update: 6db2a1859 binds immutable boot metadata to original bootstrap coordinates; bee16db0f authenticates original-image adoption while retaining the live identity directory and legacy boot owner. Actual RED→GREEN receipts in /home/claude/.cache/j12b-evidence: boot 1pass/3fail → remote library 100pass/14ignored, strict Clippy/fmt; adoption 1pass/1fail → host-only release 62pass/0fail, strict Clippy/fmt. These are prerequisites, not complete lifecycle or final acceptance. Version adapter disposal regression observed 4pass/1fail (late check returned unknown after view disposal), then all version module tests 30pass/0fail after the fix. Typecheck and production-browser captures still pending. Initial extra disposal attempt accidentally used the original stub source restored by the boot snapshot; rejected that result and reran against the implemented source before fixing. One qualification script error sent the unchanged read-only stub archive after a local Python syntax failure. The VM correctly failed 4 recovery assertions; no GREEN was claimed. Corrected implementation is queued as compute01 PID2452917, node-retry.log (same evidence directory); it chains existing-lock recovery, allocation-free service startup, local-only adoption, boot/uninstall compatibility, renewal publication fence, initial host lifecycle regression, then UI checks. No duplicate active run. The original PID2054155 has exited. Production host lifecycle remains unwired. Preparing the concrete owner around the existing receiver/store/watchdog, with durable enable/disable and attempt-specific retry. No new updater engine/framework. No root services or mounts. One retained target: /home/claude/worktrees/j12b/target. ARM has 24GB free, still below the mandatory25GB admission floor; no second target created. Full fast, exact-head systemd/storage, matched sizes and performed-versus-unrun proof evidence remain owed.
kayg commented 2026-11-01 17:52:19 +00:00
Author
Owner
Copy link

J12b continuation from qualified j12b-edge-update@541c0aa71. compute01 FIFO2663368 is still live, now first in queue after about14min; no duplicate native run and no pending run abandoned. Service recovery RED/GREEN remains pending; subsequent local-adoption, generation-unit, publication-fence and concrete lifecycle phases are staged, not qualified.

Review findings before production wiring: generation credentials must use Selected.state_directory() while uninstall/runtime ownership retains the original bootstrap Context; read-only transport must advertise no persistent renewal callback; host watchdog must use its own fixed entry and choose system/user scope from the installation UID. Added failing-first cleanup regressions: a live Receiving owner prevents deletion; unknown entries remain untouched; legacy uninstall preserves unrelated updates data while adopted uninstall removes generation credentials. These are not new infrastructure.

One target remains /home/claude/worktrees/j12b/target. Logs/evidence remain /home/claude/.cache/j12b-evidence. No final fast, production lifecycle, screenshots or exact-head proof claim yet.

J12b continuation from qualified j12b-edge-update@541c0aa71. compute01 FIFO2663368 is still live, now first in queue after about14min; no duplicate native run and no pending run abandoned. Service recovery RED/GREEN remains pending; subsequent local-adoption, generation-unit, publication-fence and concrete lifecycle phases are staged, not qualified. Review findings before production wiring: generation credentials must use Selected.state_directory() while uninstall/runtime ownership retains the original bootstrap Context; read-only transport must advertise no persistent renewal callback; host watchdog must use its own fixed entry and choose system/user scope from the installation UID. Added failing-first cleanup regressions: a live Receiving owner prevents deletion; unknown entries remain untouched; legacy uninstall preserves unrelated updates data while adopted uninstall removes generation credentials. These are not new infrastructure. One target remains /home/claude/worktrees/j12b/target. Logs/evidence remain /home/claude/.cache/j12b-evidence. No final fast, production lifecycle, screenshots or exact-head proof claim yet.
kayg commented 2026-11-01 18:02:46 +00:00
Author
Owner
Copy link

J12b qualified UI wiring pushed as f3ea0d589. The production source now reads release.updates.get/check and paginated account-scoped remote.host.list concurrently, subscribes after discovery, keeps unknown host versions unknown, and disposes listeners/late facts without timers. Existing interfaces and UI are reused.

ARM64 VM through build-slot: bun run check passed; version unit tests30 passed/0failed; production-build version browser suite15 passed in2.5m, including ±0.5px alignment and44px touch-target assertions. Captures below are the existing mock-backed browser scenarios, NOT a real-backend integration claim. Desktop PNG is2× device scale; phone is3×. Independent visual approval remains owed. Full log: dev-02 ~/.cache/j12b-evidence/ui.log; captures: ui/version-pill. Native FIFO2663368 is still queued first on compute01; no final fast/production host lifecycle claim.

J12b qualified UI wiring pushed as f3ea0d589. The production source now reads release.updates.get/check and paginated account-scoped remote.host.list concurrently, subscribes after discovery, keeps unknown host versions unknown, and disposes listeners/late facts without timers. Existing interfaces and UI are reused. ARM64 VM through build-slot: bun run check passed; version unit tests30 passed/0failed; production-build version browser suite15 passed in2.5m, including ±0.5px alignment and44px touch-target assertions. Captures below are the existing mock-backed browser scenarios, NOT a real-backend integration claim. Desktop PNG is2× device scale; phone is3×. Independent visual approval remains owed. Full log: dev-02 ~/.cache/j12b-evidence/ui.log; captures: ui/version-pill. Native FIFO2663368 is still queued first on compute01; no final fast/production host lifecycle claim.
j12b-desktop.png
531 KiB
j12b-phone.png
417 KiB
j12b-desktop.png j12b-phone.png
kayg commented 2026-11-01 18:24:55 +00:00
Author
Owner
Copy link

J12b continuation: qualified head 86f0e95d4 on j12b-edge-update, based on dev a26615c50. Read-only renewal qualification passed 176 daemon tests plus strict Clippy/fmt (201ecac85). Local-only bounded signed-offer adoption observed expected discovery RED, then 64/64 host-release tests and strict Clippy/fmt; fixed one declaration-order lint before committing. Remote action authorization still excludes adoption.

The existing slot owner PID2663368 remains active; no duplicate run. Boot-command/uninstall compatibility has now observed RED 0passed/2failed, GREEN implementation sent for qualification. Following phases are credential publication fence, exclusive partial cleanup, and concrete production lifecycle wiring. One retained target /home/claude/worktrees/j12b/target; logs /home/claude/.cache/j12b-evidence/service-retry.log and per-phase RED logs. No production deployment or root units/mounts. Full fast/exact-head acceptance remain outstanding.

J12b continuation: qualified head 86f0e95d4 on j12b-edge-update, based on dev a26615c50. Read-only renewal qualification passed 176 daemon tests plus strict Clippy/fmt (201ecac85). Local-only bounded signed-offer adoption observed expected discovery RED, then 64/64 host-release tests and strict Clippy/fmt; fixed one declaration-order lint before committing. Remote action authorization still excludes adoption. The existing slot owner PID2663368 remains active; no duplicate run. Boot-command/uninstall compatibility has now observed RED 0passed/2failed, GREEN implementation sent for qualification. Following phases are credential publication fence, exclusive partial cleanup, and concrete production lifecycle wiring. One retained target /home/claude/worktrees/j12b/target; logs /home/claude/.cache/j12b-evidence/service-retry.log and per-phase RED logs. No production deployment or root units/mounts. Full fast/exact-head acceptance remain outstanding.
kayg commented 2026-11-01 18:36:50 +00:00
Author
Owner
Copy link

J12b qualified/pushed 56956068d (fixed generation boot/uninstall ownership), 44a8edc93 (foreground-fenced credential publication), 7f41f8d3f (exclusive checked transfer cleanup). Boot: RED0/2 → remote103pass/14ignored, strict Clippy/fmt. Credential publication: RED0/1 → remote identity13pass/0fail, binary Clippy/fmt. Cleanup: RED0/1 → host release65pass/0fail, strict Clippy/fmt. Correction: 44a8edc93's commit text says12 remote tests; actual receipt is13.

Additional real-process regression observed RED: dropping an armed handoff guard before exec closed its channel and stopped the still-selected process. Guard cleanup now sends the existing explicit ABORT frame before descriptor release; abrupt kernel channel shutdown retains the original candidate-stop oracle. First host-only GREEN run69pass/1fail caught that old fixture using ordinary guard drop instead of abrupt channel loss; corrected it to shutdown both socket directions, preserving that failure trigger. Retrying in the same acquired slot, no duplicate build.

Minimal host build also exposed descriptor transfer compiled only via SQLite/research features. A narrow feature now exposes the existing audited helper without adding server storage. Host lifecycle is wired in the unqualified draft, not claimed complete. All receipts remain compute01 ~/.cache/j12b-evidence; one target ~/worktrees/j12b/target. Exact-head full fast/systemd/storage/static and offline perf-kit remain owed. No production deployment/root units/mounts.

J12b qualified/pushed 56956068d (fixed generation boot/uninstall ownership), 44a8edc93 (foreground-fenced credential publication), 7f41f8d3f (exclusive checked transfer cleanup). Boot: RED0/2 → remote103pass/14ignored, strict Clippy/fmt. Credential publication: RED0/1 → remote identity13pass/0fail, binary Clippy/fmt. Cleanup: RED0/1 → host release65pass/0fail, strict Clippy/fmt. Correction: 44a8edc93's commit text says12 remote tests; actual receipt is13. Additional real-process regression observed RED: dropping an armed handoff guard before exec closed its channel and stopped the still-selected process. Guard cleanup now sends the existing explicit ABORT frame before descriptor release; abrupt kernel channel shutdown retains the original candidate-stop oracle. First host-only GREEN run69pass/1fail caught that old fixture using ordinary guard drop instead of abrupt channel loss; corrected it to shutdown both socket directions, preserving that failure trigger. Retrying in the same acquired slot, no duplicate build. Minimal host build also exposed descriptor transfer compiled only via SQLite/research features. A narrow feature now exposes the existing audited helper without adding server storage. Host lifecycle is wired in the unqualified draft, not claimed complete. All receipts remain compute01 ~/.cache/j12b-evidence; one target ~/worktrees/j12b/target. Exact-head full fast/systemd/storage/static and offline perf-kit remain owed. No production deployment/root units/mounts.
kayg commented 2026-11-01 18:51:37 +00:00
Author
Owner
Copy link

J12b qualification update: db14d1552 on j12b-edge-update wires the concrete host daemon lifecycle to the existing signed receiver/store/watchdog and runtime activity fences. Minimal host binary: 70 passed; default host binary: 128 passed, 1 ignored; both strict all-target Clippy configurations and fmt passed on compute01 under the retained build-slot lease. Raw receipt: /home/claude/.cache/j12b-evidence/service-retry.log (HOST_GREEN_EXIT=0). No real host upgrade is claimed by these unit/transport receipts.

The inherited staging generation harness needed missing browser pump helpers and current-dev fixture patterns restored. Actual RED: idle quiet window timed out and the control-probe watch closed (1 passed, 2 failed). The fix is qualifying independently before commit. No production transport change is included in that slice.

Current dev advanced to 65d9861914e8cd4a734d533d64ed1f4ea5c34119; I will rebase there before the final exact-head fast gate. Remaining work: final gate, matched static size receipts, systemd/storage/updater functional receipts, offline perf kits, cleanup. No perf VM contact or deployment.

J12b qualification update: `db14d1552` on `j12b-edge-update` wires the concrete host daemon lifecycle to the existing signed receiver/store/watchdog and runtime activity fences. Minimal host binary: **70 passed**; default host binary: **128 passed, 1 ignored**; both strict all-target Clippy configurations and fmt passed on compute01 under the retained build-slot lease. Raw receipt: `/home/claude/.cache/j12b-evidence/service-retry.log` (`HOST_GREEN_EXIT=0`). No real host upgrade is claimed by these unit/transport receipts. The inherited staging generation harness needed missing browser pump helpers and current-dev fixture patterns restored. Actual RED: idle quiet window timed out and the control-probe watch closed (1 passed, 2 failed). The fix is qualifying independently before commit. No production transport change is included in that slice. Current dev advanced to `65d9861914e8cd4a734d533d64ed1f4ea5c34119`; I will rebase there before the final exact-head fast gate. Remaining work: final gate, matched static size receipts, systemd/storage/updater functional receipts, offline perf kits, cleanup. No perf VM contact or deployment.
kayg commented 2026-11-01 18:56:15 +00:00
Author
Owner
Copy link

Final-gate finding on rebased 6ef72af939c4a604fcb03cc4bc619d3c979c00d1: the workspace feature union enables placeholders, exposing a missing global release declaration when host-updates supplies the local CLI plugin. Existing regression cli::actions::release_tests::server_commands_bind_release_without_losing_hosted_skills fails at actions.rs:756, hosted release action (127 passed, 1 failed, 1 ignored). Focused default-binary qualification had not enabled that union. Receipt: verify-fast-6ef72af939c4a604fcb03cc4bc619d3c979c00d1.log on compute01.

Fix prepared: retain executable host commands and append the existing metadata-only global declarations when placeholders are requested. No action routing or authorization changes. The running gate is allowed to finish its remaining rows before a corrected exact-head rerun.

Final-gate finding on rebased `6ef72af939c4a604fcb03cc4bc619d3c979c00d1`: the workspace feature union enables `placeholders`, exposing a missing global release declaration when `host-updates` supplies the local CLI plugin. Existing regression `cli::actions::release_tests::server_commands_bind_release_without_losing_hosted_skills` fails at `actions.rs:756`, `hosted release action` (127 passed, 1 failed, 1 ignored). Focused default-binary qualification had not enabled that union. Receipt: `verify-fast-6ef72af939c4a604fcb03cc4bc619d3c979c00d1.log` on compute01. Fix prepared: retain executable host commands and append the existing metadata-only global declarations when placeholders are requested. No action routing or authorization changes. The running gate is allowed to finish its remaining rows before a corrected exact-head rerun.
kayg commented 2026-11-01 19:06:24 +00:00
Author
Owner
Copy link

Second full-gate finding: plugin_control::recovery_tests::recovery_service_uses_existing_read_only_lock_without_local_socket_allocation reached its real terminal-refusal probe, then UnixListener::bind refused the long target-relative base/sessions/sessions/<UUID>.sock path with path must be shorter than SUN_LEN (176 passed, 1 failed, 21 ignored). a76a29bef shortens only the fixture's private base/runtime folder names; the real rendezvous, lifetime-lock/no-write checks and real listener remain intact.

The preceding CLI failure occurs in the gate's explicit --features placeholders binary configuration, not an incidental workspace feature union. 8a47961c8 preserves the existing global metadata declarations alongside executable host actions. Both fixes await the corrected exact-head fast rerun after the current run finishes; they are not claimed GREEN yet.

Second full-gate finding: `plugin_control::recovery_tests::recovery_service_uses_existing_read_only_lock_without_local_socket_allocation` reached its real terminal-refusal probe, then `UnixListener::bind` refused the long target-relative `base/sessions/sessions/<UUID>.sock` path with `path must be shorter than SUN_LEN` (176 passed, 1 failed, 21 ignored). `a76a29bef` shortens only the fixture's private base/runtime folder names; the real rendezvous, lifetime-lock/no-write checks and real listener remain intact. The preceding CLI failure occurs in the gate's **explicit** `--features placeholders` binary configuration, not an incidental workspace feature union. `8a47961c8` preserves the existing global metadata declarations alongside executable host actions. Both fixes await the corrected exact-head fast rerun after the current run finishes; they are not claimed GREEN yet.
kayg commented 2026-11-01 19:28:41 +00:00
Author
Owner
Copy link

First rebased full fast run completed: exit 1. Static x86 and ARM production builds, trust/linkage/key-memory checks passed. Formatting reported three inherited test files whose formatted copies had not been committed; formatting-only 54e730f2a fixes them separately from the two behavioral fixture/discovery fixes. The full failed receipt is attached as verify-fast-6ef72af939c4a604fcb03cc4bc619d3c979c00d1.log.

Corrected exact-head full fast now running on 54e730f2afe61113f5fe6ec501d1c2a997b18910 in the same acquired compute01 build slot. No-default-feature tests: 37 passed. The raw log will also be scanned for inner failures: the existing rust_check_cli_plugin_compile_out function continued after the placeholder test failure and its final successful command made that row say PASS. That reporting defect is recorded here; it is not used to claim the failed inner assertion passed. Scope remains #211, without a verification-framework refactor.

Matched production sizes will reuse the successful exact-head gate binaries and rebuild only dev 65d9861914e8cd4a734d533d64ed1f4ea5c34119 under the same recipe. Functional systemd/storage/updater proofs and offline kits follow; no perf VM contact, deployment or whole-VM interruption.

First rebased full fast run completed: exit 1. Static x86 and ARM production builds, trust/linkage/key-memory checks passed. Formatting reported three inherited test files whose formatted copies had not been committed; formatting-only `54e730f2a` fixes them separately from the two behavioral fixture/discovery fixes. The full failed receipt is attached as `verify-fast-6ef72af939c4a604fcb03cc4bc619d3c979c00d1.log`. Corrected exact-head full fast now running on `54e730f2afe61113f5fe6ec501d1c2a997b18910` in the same acquired compute01 build slot. No-default-feature tests: 37 passed. The raw log will also be scanned for inner failures: the existing `rust_check_cli_plugin_compile_out` function continued after the placeholder test failure and its final successful command made that row say PASS. That reporting defect is recorded here; it is not used to claim the failed inner assertion passed. Scope remains #211, without a verification-framework refactor. Matched production sizes will reuse the successful exact-head gate binaries and rebuild only dev `65d9861914e8cd4a734d533d64ed1f4ea5c34119` under the same recipe. Functional systemd/storage/updater proofs and offline kits follow; no perf VM contact, deployment or whole-VM interruption.
kayg commented 2026-11-01 19:36:44 +00:00
Author
Owner
Copy link

Corrected-head fast finding on 54e730f2a: CLI discovery and the read-only runtime/socket regression now pass. The workspace then reached mesh fixtures and found a real migration-number collision: shipped/current-dev 0031_terminal_startup_hints.sql and the unshipped #211 invitation-certificate migration both used 31. Ten mesh fixtures failed with UNIQUE constraint failed: _sqlx_migrations.version; raw receipt remains verify-fast-54e730f2afe61113f5fe6ec501d1c2a997b18910.log.

Fix pushed as 7d8ea8959df9b123aa33cdbc2ef9cca448e71904: preserve all shipped migration bytes/numbers; move the two unshipped #211 migrations to 32 (invitation certificate) and 33 (update observations). Update the existing contiguous-chain oracle and extend deployed checksum/ownership preservation to schema 31. No live database migration or production access occurred. The current fast run is finishing its static rows before another exact-head full run; no GREEN claim yet.

Corrected-head fast finding on `54e730f2a`: CLI discovery and the read-only runtime/socket regression now pass. The workspace then reached mesh fixtures and found a real migration-number collision: shipped/current-dev `0031_terminal_startup_hints.sql` and the unshipped #211 invitation-certificate migration both used 31. Ten mesh fixtures failed with `UNIQUE constraint failed: _sqlx_migrations.version`; raw receipt remains `verify-fast-54e730f2afe61113f5fe6ec501d1c2a997b18910.log`. Fix pushed as `7d8ea8959df9b123aa33cdbc2ef9cca448e71904`: preserve all shipped migration bytes/numbers; move the two **unshipped** #211 migrations to 32 (invitation certificate) and 33 (update observations). Update the existing contiguous-chain oracle and extend deployed checksum/ownership preservation to schema 31. No live database migration or production access occurred. The current fast run is finishing its static rows before another exact-head full run; no GREEN claim yet.
kayg commented 2026-11-01 19:56:49 +00:00
Author
Owner
Copy link

Third exact-head fast progress: all ten mesh setup failures are fixed; the deployed-history checksum/ownership regression now passes through shipped schema 31. The complete server suite then exposed an inherited checkpoint fixture assumption: checkpoint_fixture(true) unwrapped absent INFRATERNAL_TEST_STATE_ROOT before creating its WAL database. Its child and parent renewal regression failed before the intended ordering assertions.

Fix 398ffaab9466504fd43e14d0a453adb7a7ee80c1 supplies an OS temporary-root fallback while retaining the private UUID directory, on-disk WAL database, real writer fence, ordering checks and cleanup. No production behavior or test oracle is removed. The current run is still finishing remaining server cases; all new findings are being collected before the next complete exact-head run.

Estimate update: another 60–90 minutes for the corrected full gate, matched sizes, disposable systemd/storage/updater receipts, offline kit packaging and cleanup. The original four-hour estimate is likely to be exceeded because the full gate first reached inherited integration/fixture defects. Scope is unchanged and remains below the eight-active-hour stop/report bound. No extra infrastructure, perf VM access, production access or deployment.

Third exact-head fast progress: all ten mesh setup failures are fixed; the deployed-history checksum/ownership regression now passes through shipped schema 31. The complete server suite then exposed an inherited checkpoint fixture assumption: `checkpoint_fixture(true)` unwrapped absent `INFRATERNAL_TEST_STATE_ROOT` before creating its WAL database. Its child and parent renewal regression failed before the intended ordering assertions. Fix `398ffaab9466504fd43e14d0a453adb7a7ee80c1` supplies an OS temporary-root fallback while retaining the private UUID directory, on-disk WAL database, real writer fence, ordering checks and cleanup. No production behavior or test oracle is removed. The current run is still finishing remaining server cases; all new findings are being collected before the next complete exact-head run. Estimate update: another **60–90 minutes** for the corrected full gate, matched sizes, disposable systemd/storage/updater receipts, offline kit packaging and cleanup. The original four-hour estimate is likely to be exceeded because the full gate first reached inherited integration/fixture defects. Scope is unchanged and remains below the eight-active-hour stop/report bound. No extra infrastructure, perf VM access, production access or deployment.
kayg commented 2026-11-01 20:00:51 +00:00
Author
Owner
Copy link

The complete server library run on 7d8ea8959 finished 738 passed, 2 failed, 55 ignored. Two remaining fixtures, both now fixed on branch:

  • 398ffaab9: ordinary checkpoint/WAL writer test child had no INFRATERNAL_TEST_STATE_ROOT; private temporary-root fallback retains the actual writer-fence trigger.
  • acd7b780c97242787b28076bbc8a690fdd9d3625: the retained hostname/canvas upgrade oracle still expected 31 applied migrations. Require 33 and explicit versions 32/33, retaining the original 28 checksums, hostname behavior and canvas data assertions; update its printed receipt accordingly.

Fresh contiguous schema and deployed-history preservation (including schema 31) already pass. The current full run is finishing static rows; the next exact-head gate includes both remaining fixture corrections. No additional production behavior changed in these two commits.

The complete server library run on `7d8ea8959` finished **738 passed, 2 failed, 55 ignored**. Two remaining fixtures, both now fixed on branch: - `398ffaab9`: ordinary checkpoint/WAL writer test child had no `INFRATERNAL_TEST_STATE_ROOT`; private temporary-root fallback retains the actual writer-fence trigger. - `acd7b780c97242787b28076bbc8a690fdd9d3625`: the retained hostname/canvas upgrade oracle still expected 31 applied migrations. Require 33 and explicit versions 32/33, retaining the original 28 checksums, hostname behavior and canvas data assertions; update its printed receipt accordingly. Fresh contiguous schema and deployed-history preservation (including schema 31) already pass. The current full run is finishing static rows; the next exact-head gate includes both remaining fixture corrections. No additional production behavior changed in these two commits.
kayg commented 2026-11-01 20:23:12 +00:00
Author
Owner
Copy link

Full server run on acd7b780c: 739 passed, 1 failed, 55 ignored. All checkpoint cases and the historical hostname/canvas migration now pass. Remaining failure: the detached-authority SQLite storm observed started=4 but pool.size()-pool.num_idle()=5, at websocket_authority_tests.rs:525.

fa875f0b3733ef997b6299d55478b90173b4286b drains SQLx's asynchronous initialization connection returns before placing the exclusive lock and enabling the storm observations. The original four-started/four-non-idle assertions, held lock, permit counts and busy-timeout cleanup oracle remain intact. This changes only fixture ordering; no production authority path changes. The complete failed receipt is attached as verify-fast-acd7b780c97242787b28076bbc8a690fdd9d3625.log.

The exact-head full fast rerun is starting on fa875f0b3 in the same acquired slot. No pending phase is being abandoned; functional VM proofs and offline kits still follow a clean gate.

Full server run on `acd7b780c`: **739 passed, 1 failed, 55 ignored**. All checkpoint cases and the historical hostname/canvas migration now pass. Remaining failure: the detached-authority SQLite storm observed `started=4` but `pool.size()-pool.num_idle()=5`, at `websocket_authority_tests.rs:525`. `fa875f0b3733ef997b6299d55478b90173b4286b` drains SQLx's asynchronous initialization connection returns before placing the exclusive lock and enabling the storm observations. The original four-started/four-non-idle assertions, held lock, permit counts and busy-timeout cleanup oracle remain intact. This changes only fixture ordering; no production authority path changes. The complete failed receipt is attached as `verify-fast-acd7b780c97242787b28076bbc8a690fdd9d3625.log`. The exact-head full fast rerun is starting on `fa875f0b3` in the same acquired slot. No pending phase is being abandoned; functional VM proofs and offline kits still follow a clean gate.
kayg commented 2026-11-01 20:45:00 +00:00
Author
Owner
Copy link

J12b exact-head fast gate passed on compute01 inside the retained build-slot. Head fa875f0b3733ef997b6299d55478b90173b4286b, base 65d9861914e8cd4a734d533d64ed1f4ea5c34119. Raw output attached as verify-fast-fa875f0b3733ef997b6299d55478b90173b4286b.log (asset 30779, 537611 bytes). Scanned the complete log: no failed test/error/fmt markers.

Verbatim Rust gate output:

| Rust gate                 | Result       |
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| static builds             | PASS         |

Verbatim final output:

 39 pass
 0 fail
 59970 expect() calls
Ran 39 tests across 10 files. [7.01s]

Paired static size controls and disposable server generation/storage/updater proofs are still running sequentially in the same lease. Offline perf artifacts will be prepared only; no perf VM or production contact. Enrolled-host signed-upgrade E2E and the full resource/power-cut matrix remain unqualified.

J12b exact-head fast gate passed on compute01 inside the retained build-slot. Head `fa875f0b3733ef997b6299d55478b90173b4286b`, base `65d9861914e8cd4a734d533d64ed1f4ea5c34119`. Raw output attached as `verify-fast-fa875f0b3733ef997b6299d55478b90173b4286b.log` (asset 30779, 537611 bytes). Scanned the complete log: no failed test/error/fmt markers. Verbatim Rust gate output: ```text | Rust gate | Result | | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | static builds | PASS | ``` Verbatim final output: ```text 39 pass 0 fail 59970 expect() calls Ran 39 tests across 10 files. [7.01s] ``` Paired static size controls and disposable server generation/storage/updater proofs are still running sequentially in the same lease. Offline perf artifacts will be prepared only; no perf VM or production contact. Enrolled-host signed-upgrade E2E and the full resource/power-cut matrix remain unqualified.
kayg commented 2026-11-01 20:47:35 +00:00
Author
Owner
Copy link

J12b exact-head scripts/verify fast, full verbatim output. Head fa875f0b3733ef997b6299d55478b90173b4286b. Exit status 0. Raw file also attached (asset 30779).

complete fast gate output 

==> Repository artifact size gate
repository artifact gate: PASS (190 changed path(s), merge base 65d9861914e8)

==> Release deployment functional checks
.....Release build failed for aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa; gate log retained
.Build deferred: host capacity limit reached
.........
----------------------------------------------------------------------
Ran 15 tests in 0.733s

OK
.
----------------------------------------------------------------------
Ran 1 test in 0.086s

OK
bun test v1.4.2 (744846f84)

scripts/release/deploy-review.test.ts:
REMOTE_ADMISSION unsigned_x86_payload=true refused=true
(pass) remote admission refuses an x86 payload outside the signed manifest [281.91ms]
{"state": "deployed", "ca_unlocked": true}
WEB_ONLY_RECORD candidate_binary_recorded=false
(pass) web-only deployment does not record the candidate as the running binary [321.20ms]
ALIAS_RECOVERY restart_requests=2
(pass) alias restoration failure still requests the retained warm rollback [310.75ms]

 3 pass
 0 fail
 3 expect() calls
Ran 3 tests across 1 file. [921.00ms]
PASS proxy_forwarding samples=3 timed=false

==> fmt
(fmt: 4s)

==> VT native fmt
(VT native fmt: 0s)

==> CLI plugin compile-out
disabled CLI plugin dependencies: absent from normal dependency graph
warning: function `print_progress` is never used
   --> crates/infraternal/src/cli/output.rs:597:8
    |
597 | pub fn print_progress<T: Serialize>(result: &CommandResult<T>, json: bool, to_stderr: bool) {
    |        ^^^^^^^^^^^^^^
    |
    = note: `#[warn(dead_code)]` (part of `#[warn(unused)]`) on by default

warning: `infraternal` (bin "infraternal" test) generated 1 warning
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.12s
     Running unittests src/main.rs (target/debug/deps/infraternal-fb404c5b2aff3832)

running 37 tests
test cli::actions::tests::agent_session_integration_target_is_gated_by_agent_plugin ... ok
test cli::actions::default_build_tests::default_build_registers_no_unbuilt_command ... ok
test cli::actions::key_memory_registry_tests::key_memory_diagnostic_follows_remote_feature ... ok
test cli::actions::tests::every_registered_action_has_description_and_step_by_step_guidance ... ok
test cli::actions::tests::hidden_session_shim_is_registered_to_its_runtime_handler ... ok
test cli::actions::tests::no_default_plugins_register_no_component_commands ... ok
test cli::actions::tests::server_only_dependencies_are_removed_with_server_plugin ... ok
test cli::actions::tests::compiled_out_mesh_has_no_registered_commands ... ok
test cli::command_tree::tests::compiled_out_plugin_has_no_help_or_parse_path ... ok
test cli::command_tree::tests::node_build_omits_and_refuses_server_commands ... ok
test cli::command_tree::tests::hidden_session_shim_parser_uses_the_registered_input_schema ... ok
test cli::command_tree::tests::every_command_in_the_tree_takes_json ... ok
test cli::command_tree::tests::skill_parser_accepts_a_multi_part_command_and_write_directory ... ok
test cli::command_tree::tests::root_help_lines_fit_80_columns ... ok
test cli::command_tree::tests::public_help_is_plain_words ... ok
test cli::command_tree::tests::root_help_uses_registered_descriptions_and_long_action_guidance ... ok
{"schema_version":1,"command":"x","ok":false,"state":"failed","message":"It broke.","next":[],"details":"because","error":{"code":"failed","detail":"because"},"data":{}}
{"schema_version":1,"command":"x","ok":true,"state":"ready","message":"Done.","next":[],"data":{}}
test cli::output::tests::json_is_one_line_with_stable_fields_and_omits_absent_ones ... ok
test cli::output::tests::a_failure_says_why_and_what_to_do ... ok
test cli::output::tests::finishing_a_command_stamps_ok_and_the_error_from_the_exit ... ok
test cli::output::tests::exit_codes_follow_d303 ... ok
test cli::output::tests::plain_text_answers_first_then_aligned_blocks_then_next ... ok
test cli::output::tests::registered_action_output_schemas_accept_typed_json_envelopes ... ok
test cli::output::tests::tables_omit_empty_columns_and_rows_and_single_rows_have_no_header ... ok
test cli::command_tree::tests::unbuilt_placeholders_are_neither_shown_nor_parsed ... ok
test cli::output::tests::a_body_replaces_the_generic_rendering_of_data ... ok
test cli::usage::tests::missing_arguments_are_listed_by_name ... ok
test cli::usage::tests::an_unknown_option_is_named_without_its_value ... ok
test dispatch_tests::hidden_session_shim_dispatches_from_the_registered_action ... ok
test cli::skills::tests::writing_skills_creates_one_file_per_visible_action ... ok
test cli::usage::tests::a_wrong_command_names_only_a_plain_word ... ok
test cli::output::tests::terminal_output_has_a_mark_and_colour_and_wraps_to_the_width ... ok
test failure_data_tests::skill_errors_keep_the_registered_result_data_shape ... ok
test failure_data_tests::unavailable_results_keep_registered_data_shapes ... ok
test shim_cli::tests::spawned_decode_refuses_changes_to_the_fixed_shape_before_startup ... ok
test shim_cli::tests::spawned_shapes_reuse_full_shim_options_and_defaults ... ok
test startup_tests::process_dumpability_is_disabled_before_dispatch ... ok
test cli::command_tree::tests::packaged_node_dependency_closure_omits_server_storage_and_release ... ok

test result: ok. 37 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s

    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.24s
     Running unittests src/main.rs (target/debug/deps/infraternal-8cd1e3fcf062a008)

running 129 tests
test cli::actions::tests::every_registered_action_has_description_and_step_by_step_guidance ... ok
test cli::actions::tests::enabled_mesh_plugin_registers_its_component_commands ... ok
test cli::actions::tests::hidden_ssh_session_bridge_is_registered_to_its_runtime_handler ... ok
test cli::actions::tests::hidden_session_shim_is_registered_to_its_runtime_handler ... ok
test cli::actions::tests::host_release_commands_are_available_without_creating_a_server ... ok
test cli::actions::key_memory_registry_tests::key_memory_diagnostic_follows_remote_feature ... ok
test cli::command_tree::tests::hidden_session_shim_parser_uses_the_registered_input_schema ... ok
test cli::command_tree::backmerge_tests::removal_and_retention_inputs_keep_the_production_runtime_bindings ... ok
test cli::command_tree::backmerge_tests::restart_inherits_private_state_before_or_after_the_command ... ok
test cli::actions::tests::registered_actions_include_plugin_permission_contract_fields ... ok
test cli::actions::factory_tests::plugin_command_materializes_only_its_owner_and_discovery_remains_complete ... ok
test cli::actions::release_tests::server_commands_bind_release_without_losing_hosted_skills ... ok
test cli::command_tree::tests::every_command_in_the_tree_takes_json ... ok
test cli::command_tree::tests::hidden_ssh_session_action_parses_existing_session_rendezvous ... ok
test cli::command_tree::tests::root_help_lines_fit_80_columns ... ok
test cli::output::tests::a_body_replaces_the_generic_rendering_of_data ... ok
test cli::output::tests::a_failure_says_why_and_what_to_do ... ok
test cli::output::tests::exit_codes_follow_d303 ... ok
test cli::output::tests::json_is_one_line_with_stable_fields_and_omits_absent_ones ... ok
{"schema_version":1,"command":"x","ok":false,"state":"failed","message":"It broke.","next":[],"details":"because","error":{"code":"failed","detail":"because"},"data":{}}
{"schema_version":1,"command":"x","ok":true,"state":"ready","message":"Done.","next":[],"data":{}}
test cli::output::tests::finishing_a_command_stamps_ok_and_the_error_from_the_exit ... ok
test cli::output::tests::plain_text_answers_first_then_aligned_blocks_then_next ... ok
test cli::command_tree::tests::parser_uses_plugin_inputs_and_accepts_json_after_a_leaf_command ... ok
test cli::output::tests::tables_omit_empty_columns_and_rows_and_single_rows_have_no_header ... ok
test cli::output::tests::terminal_output_has_a_mark_and_colour_and_wraps_to_the_width ... ok
test cli::output::tests::registered_action_output_schemas_accept_typed_json_envelopes ... ok
test cli::skills::tests::generated_skill_contains_front_matter_inputs_outputs_and_safety ... ok
test cli::actions::hosted_tests::production_descriptors_share_cli_registry_and_skills ... ok
test cli::command_tree::tests::unbuilt_placeholders_are_neither_shown_nor_parsed ... ok
test cli::usage::tests::a_wrong_command_names_only_a_plain_word ... ok
test cli::command_tree::tests::server_init_parses_confirmation_plan_and_server_configuration ... ok
test cli::usage::tests::missing_arguments_are_listed_by_name ... ok
test embedded_cli::tests::dispatch_keeps_public_help_operator_modes_and_foreign_commands ... ok
test component_cli::host_release_metadata_tests::host_release_cli_has_a_pure_presenter_without_installing_an_embedded_receiver ... ok
test cli::usage::tests::an_unknown_option_is_named_without_its_value ... ok
test cli::skills::tests::writing_skills_creates_one_file_per_visible_action ... ok
test dispatch_tests::hidden_session_shim_dispatches_from_the_registered_action ... ok
test failure_data_tests::server_errors_keep_the_registered_result_data_shapes ... ok
test cli::command_tree::tests::root_help_uses_registered_descriptions_and_long_action_guidance ... ok
test cli::command_tree::tests::skill_parser_accepts_a_multi_part_command_and_write_directory ... ok
test generation_cli::tests::boot_configuration_round_trips_and_serves_from_the_generation_state ... ok
test generation_cli::tests::boot_configuration_refuses_unknown_relative_or_oversized_input ... ok
test failure_data_tests::skill_errors_keep_the_registered_result_data_shape ... ok
test cli::command_tree::tests::public_help_is_plain_words ... ok
test generation_cli::tests::trial_accepts_only_an_inherited_seqpacket_channel_and_closes_its_number ... ok
test generation_cli::tests::generation_entries_are_recognized_only_with_their_exact_shape ... ok

running 1 test
test failure_data_tests::unavailable_results_keep_registered_data_shapes ... ok
test generation_watchdog::tests::abandoned_armed_handoff_keeps_the_recovering_process_alive ... ok
test generation_update::tests::staging_copies_a_bounded_private_set_and_authenticates_it_first ... ok
test generation_watchdog::tests::candidate_exit_before_health_ends_supervision_without_selection ... ok
test generation_watchdog::tests::frames_are_bounded_and_identifiers_strict ... ok
test generation_watchdog::tests::health_for_another_candidate_is_refused_and_stopped ... ok
test generation_watchdog::tests::health_from_the_live_candidate_commits_once_and_hands_it_the_installation ... ok
test generation_watchdog::tests::closed_channel_before_health_stops_the_candidate ... ok
test generation_watchdog::tests::predecessor_changed_during_trial_cannot_commit ... ok
test generation_watchdog::tests::unarmed_watchdog_exits_when_preparation_is_cancelled ... ok
test generation_watchdog::tests::unarmed_watchdog_is_joined_when_preparation_is_abandoned ... ok
test generation_watchdog::tests::watchdog_death_ends_the_trial_and_releases_the_installation ... ok
test host_update::tests::local_host_switches_refuse_foreign_and_unsafe_installation_state ... ok
test install::tests::dry_run_prints_a_process_surviving_user_unit ... ok
test install::tests::system_units_mark_the_scope_used_by_first_run_status ... ok
test embedded_cli::tests::inherited_flags_keep_public_parser_validation_and_values ... ok
test generation_watchdog::tests::refused_exec_stands_the_watchdog_down_without_stopping_the_recovering_service ... ok
test remote::tests::join_dns_failure_reports_resolution_instead_of_generic_refusal ... ok
test host_update::tests::local_host_switches_persist_and_invalidate_old_admission_epochs ... ok
test remote::tests::local_identity_load_refuses_symlink_and_shared_file ... ok
test remote::tests::join_refuses_the_same_host_id_from_another_server ... ok
test remote::tests::oversized_or_invalid_invitation_fails_before_local_state_is_created ... ok
test remote::tests::preparation_refuses_shared_and_symlinked_data_directories ... ok
test remote::tests::ordinary_join_keeps_the_foreground_connection_default ... ok
test remote::tests::publication_is_private_and_never_replaces_existing_identity ... ok
test remote::tests::join_re_enrolls_for_a_moved_server_but_not_a_renamed_one ... ok
test remote::tests::ssh_installation_can_enroll_before_starting_the_service ... ok
test remote::tests::uid_and_privilege_mismatch_fails_before_key_generation ... ok
test remote::tests::join_re_enrolls_the_same_hosts_identity_and_refuses_another_host ... ok
test remote_server::tests::failed_cold_configuration_still_disposes_handoff_stdin ... ok
test remote::tests::renewal_publication_replaces_only_certificate_and_preserves_private_metadata ... ok
test remote_server::tests::missing_ca_refuses_before_database_or_listener_creation ... ok
test remote::tests::replace_aborts_when_the_identity_changed_since_it_was_read ... ok
test remote_server::tests::service_dry_run_preserves_remote_listener_and_private_trust_path ... ok
test remote_server::tests::failed_restart_endpoint_does_not_prevent_http_serving ... ok
test remote_server::tests::independent_review_remote_operator_commands_accept_json_output ... ok
test remote_server::tests::remote_activation_is_explicit_and_ca_override_requires_listener ... ok
test generation_update::tests::drained_copy_keeps_every_acknowledged_write_and_leaves_a_self_contained ... ok
test remote_service::tests::successful_link_return_is_a_service_failure ... ok
test generation_update::tests::historical_copy_keeps_the_snapshot_immutable_and_discards_later_authority_edits ... ok
test cli::command_tree::tests::packaged_node_dependency_closure_omits_server_storage_and_release ... ok
test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 128 filtered out; finished in 0.70s

test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok
test generation_watchdog::tests::health_deadline_stops_the_candidate_and_keeps_the_known_good_selection ... ok
test restart::tests::early_hangup_is_queued_until_control_installs_its_handler ... ok
test restart::tests::private_control_endpoint_cannot_be_stolen_or_created_by_a_client ... ok
test restart::tests::private_path_prefix_cannot_authorize_a_parent_directory_escape ... ok
test remote_service::tests::link_failure_does_not_wait_forever_for_blocking_work ... ok
test remote_service::tests::polling_panic_reaches_bounded_shutdown ... ok
test restart::tests::replacement_never_exports_to_a_general_purpose_binary ... ok
test restart::tests::path_review::late_recovery_from_path_invocation_keeps_install_target ... ok
test restart::tests::reload_reopens_install_path_when_the_running_inode_was_replaced ... ok
test restart::tests::reviewer_fifo_replacement_is_refused_without_waiting_for_a_writer ... ok
test restart::tests::root_owned_marked_target_requires_protected_root_parents ... ok
test restart::tests::default_restart_opens_the_receiver_target_exactly_once ... ok
test restart::tests::runtime_directory_symlinks_and_public_permissions_are_refused ... ok
test restart::tests::real_fd_exec_pins_replacement_and_cold_rollback_uses_null_stdin ... ok
test restart::tests::restart_requests_use_the_servers_binary_and_reject_untrusted_paths ... ok
test restart::tests::restart_request_logs_kernel_peer_target_and_cold_outcome ... ok
test restart_binary::audit_tests::symlink_parent_escape_and_writable_candidates_are_refused ... ok
test restart::tests::cold_exec_with_closed_stdin_keeps_the_image_pinned_and_maps_null ... ok
test restart_binary::audit_tests::unusable_admitted_image_keeps_the_existing_service_running ... ok
test restart_binary::audit_tests::verification_twenty_megabytes ... ignored, optimized weighted 20 MiB signature and admission measurement
test restart_binary::audit_tests::unsigned_or_tampered_replacement_is_refused_before_exec ... ok
test restart_image::tests::snapshot_refuses_every_mutation_and_preserves_source_offset ... ok
test server_data_resolution_tests::explicit_data_directory_wins_over_the_installed_service ... ok
test server_data_resolution_tests::installed_service_data_directory_is_selected_when_no_override_is_given ... ok
test server_data_resolution_tests::missing_install_uses_the_existing_default_directory ... ok
test setup_token_tests::setup_token_command_reads_only_the_expected_socket_response ... ok
test shim_cli::tests::spawned_decode_refuses_changes_to_the_fixed_shape_before_startup ... ok
test shim_cli::tests::spawned_shapes_reuse_full_shim_options_and_defaults ... ok
test ssh_internal::tests::connect_requires_exactly_a_host_and_numeric_port ... ok
test ssh_internal::tests::connector_is_available_only_on_the_initiating_build ... ok
test ssh_internal::tests::session_accepts_only_the_two_spawned_shapes ... ok
test startup_tests::process_dumpability_is_disabled_before_dispatch ... ok
test startup_tests::shared_reactor_preserves_borrows_errors_and_panic_cleanup ... ok
test restart::tests::rootless_even_marked_replacement_is_cold_and_open_fd_pins_the_inode ... ok
test restart_image::tests::probe_never_inherits_the_control_descriptor ... ok
test restart::tests::deleted_path_review::relative_recovery_after_atomic_install_keeps_live_install_path ... ok
test restart::tests::runtime_shutdown_never_waits_forever_on_a_blocking_waiter ... ok
test restart::tests::closed_reply_and_missing_reload_target_do_not_end_restart_control ... ok
test generation_update::tests::copy_refusals_abort_before_trial_and_leave_a_usable ... ok
test restart_binary::audit_tests::admitted_inode_cannot_change_in_place_before_execution ... ok
test restart_binary::audit_tests::pathname_replacement_keeps_the_admitted_inode ... ok
test restart::recovery_tests::verified_exec_and_late_refusal_preserve_listener_and_ca ... ok

test result: ok. 128 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 12.19s

    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.14s
     Running unittests src/lib.rs (target/debug/deps/infraternal_agent-91a6a2a28aa23421)

running 1 test
test cli::tests::agent_actions_are_complete_and_unavailable_until_lifecycle_exists ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 92 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_mesh-de37f027424e663d)

running 1 test
test cli::tests::mesh_actions_are_complete_with_optional_ssh_connectivity ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_backup-61ccebc6320c477e)

running 1 test
test cli::tests::backup_actions_are_complete_and_unavailable_until_runtime_exists ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_relay-a3947e601fdae371)

running 1 test
test cli::tests::relay_actions_are_complete_and_unavailable_until_runtime_exists ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-865357dcee79bc13)

running 1 test
test cli::tests::ssh_actions_are_complete_and_marked_unavailable ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 46 filtered out; finished in 0.01s

(CLI plugin compile-out: 13s)

==> clippy
    Checking infraternal-server v0.1.0 (/home/claude/worktrees/j12b/crates/infraternal-server)
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 38.75s
(clippy: 39s)

==> SSH runtime test helper
    Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.24s
(SSH runtime test helper: 1s)

==> real-binary fixture paths
....
----------------------------------------------------------------------
Ran 4 tests in 0.016s

OK
(real-binary fixture paths: 0s)

==> test
   Compiling infraternal-server v0.1.0 (/home/claude/worktrees/j12b/crates/infraternal-server)
    Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 30s
     Running unittests src/main.rs (target/debug/deps/infraternal-25458fcc450f3d55)

running 129 tests
test cli::actions::key_memory_registry_tests::key_memory_diagnostic_follows_remote_feature ... ok
test cli::actions::tests::host_release_commands_are_available_without_creating_a_server ... ok
test cli::actions::tests::enabled_mesh_plugin_registers_its_component_commands ... ok
test cli::actions::tests::every_registered_action_has_description_and_step_by_step_guidance ... ok
test cli::actions::release_tests::server_commands_bind_release_without_losing_hosted_skills ... ok
test cli::command_tree::tests::hidden_session_shim_parser_uses_the_registered_input_schema ... ok
test cli::command_tree::tests::every_command_in_the_tree_takes_json ... ok
test cli::command_tree::backmerge_tests::restart_inherits_private_state_before_or_after_the_command ... ok
test cli::actions::tests::hidden_ssh_session_bridge_is_registered_to_its_runtime_handler ... ok
test cli::command_tree::backmerge_tests::removal_and_retention_inputs_keep_the_production_runtime_bindings ... ok
test cli::actions::tests::registered_actions_include_plugin_permission_contract_fields ... ok
test cli::actions::factory_tests::plugin_command_materializes_only_its_owner_and_discovery_remains_complete ... ok
test cli::actions::default_build_tests::default_build_registers_no_unbuilt_command ... ok
test cli::command_tree::tests::parser_uses_plugin_inputs_and_accepts_json_after_a_leaf_command ... ok
test cli::command_tree::tests::hidden_ssh_session_action_parses_existing_session_rendezvous ... ok
test cli::output::tests::a_body_replaces_the_generic_rendering_of_data ... ok
test cli::output::tests::a_failure_says_why_and_what_to_do ... ok
test cli::command_tree::tests::root_help_lines_fit_80_columns ... ok
test cli::output::tests::json_is_one_line_with_stable_fields_and_omits_absent_ones ... ok
test cli::output::tests::plain_text_answers_first_then_aligned_blocks_then_next ... ok
test cli::actions::tests::hidden_session_shim_is_registered_to_its_runtime_handler ... ok
test cli::output::tests::exit_codes_follow_d303 ... ok
{"schema_version":1,"command":"x","ok":false,"state":"failed","message":"It broke.","next":[],"details":"because","error":{"code":"failed","detail":"because"},"data":{}}
{"schema_version":1,"command":"x","ok":true,"state":"ready","message":"Done.","next":[],"data":{}}
test cli::output::tests::finishing_a_command_stamps_ok_and_the_error_from_the_exit ... ok
test cli::command_tree::tests::public_help_is_plain_words ... ok
test cli::command_tree::tests::server_init_parses_confirmation_plan_and_server_configuration ... ok
test cli::output::tests::terminal_output_has_a_mark_and_colour_and_wraps_to_the_width ... ok
test cli::usage::tests::a_wrong_command_names_only_a_plain_word ... ok
test cli::usage::tests::an_unknown_option_is_named_without_its_value ... ok
test cli::skills::tests::generated_skill_contains_front_matter_inputs_outputs_and_safety ... ok
test cli::usage::tests::missing_arguments_are_listed_by_name ... ok
test cli::output::tests::registered_action_output_schemas_accept_typed_json_envelopes ... ok
test cli::output::tests::tables_omit_empty_columns_and_rows_and_single_rows_have_no_header ... ok
test component_cli::host_release_metadata_tests::host_release_cli_has_a_pure_presenter_without_installing_an_embedded_receiver ... ok
test embedded_cli::tests::dispatch_keeps_public_help_operator_modes_and_foreign_commands ... ok
test cli::command_tree::tests::root_help_uses_registered_descriptions_and_long_action_guidance ... ok
test cli::command_tree::tests::unbuilt_placeholders_are_neither_shown_nor_parsed ... ok
test cli::command_tree::tests::skill_parser_accepts_a_multi_part_command_and_write_directory ... ok
test failure_data_tests::unavailable_results_keep_registered_data_shapes ... ok
test generation_cli::tests::generation_entries_are_recognized_only_with_their_exact_shape ... ok
test generation_cli::tests::boot_configuration_refuses_unknown_relative_or_oversized_input ... ok
test generation_cli::tests::boot_configuration_round_trips_and_serves_from_the_generation_state ... ok
test dispatch_tests::hidden_session_shim_dispatches_from_the_registered_action ... ok
test failure_data_tests::skill_errors_keep_the_registered_result_data_shape ... ok
test generation_cli::tests::trial_accepts_only_an_inherited_seqpacket_channel_and_closes_its_number ... ok
test generation_update::tests::staging_copies_a_bounded_private_set_and_authenticates_it_first ... ok
test generation_watchdog::tests::abandoned_armed_handoff_keeps_the_recovering_process_alive ... ok

running 1 test
test generation_watchdog::tests::candidate_exit_before_health_ends_supervision_without_selection ... ok
test generation_watchdog::tests::frames_are_bounded_and_identifiers_strict ... ok
test generation_watchdog::tests::closed_channel_before_health_stops_the_candidate ... ok
test generation_watchdog::tests::health_for_another_candidate_is_refused_and_stopped ... ok
test embedded_cli::tests::inherited_flags_keep_public_parser_validation_and_values ... ok
test generation_watchdog::tests::predecessor_changed_during_trial_cannot_commit ... ok
test cli::skills::tests::writing_skills_creates_one_file_per_visible_action ... ok
test failure_data_tests::server_errors_keep_the_registered_result_data_shapes ... ok
test generation_watchdog::tests::health_from_the_live_candidate_commits_once_and_hands_it_the_installation ... ok
test generation_watchdog::tests::unarmed_watchdog_exits_when_preparation_is_cancelled ... ok
test generation_watchdog::tests::unarmed_watchdog_is_joined_when_preparation_is_abandoned ... ok
test generation_watchdog::tests::watchdog_death_ends_the_trial_and_releases_the_installation ... ok
test install::tests::dry_run_prints_a_process_surviving_user_unit ... ok
test install::tests::system_units_mark_the_scope_used_by_first_run_status ... ok
test host_update::tests::local_host_switches_refuse_foreign_and_unsafe_installation_state ... ok
test generation_watchdog::tests::refused_exec_stands_the_watchdog_down_without_stopping_the_recovering_service ... ok
test remote::tests::join_dns_failure_reports_resolution_instead_of_generic_refusal ... ok
test remote::tests::join_refuses_the_same_host_id_from_another_server ... ok
test remote::tests::local_identity_load_refuses_symlink_and_shared_file ... ok
test remote::tests::ordinary_join_keeps_the_foreground_connection_default ... ok
test remote::tests::oversized_or_invalid_invitation_fails_before_local_state_is_created ... ok
test remote::tests::preparation_refuses_shared_and_symlinked_data_directories ... ok
test host_update::tests::local_host_switches_persist_and_invalidate_old_admission_epochs ... ok
test remote::tests::join_re_enrolls_for_a_moved_server_but_not_a_renamed_one ... ok
test remote::tests::join_re_enrolls_the_same_hosts_identity_and_refuses_another_host ... ok
test remote::tests::ssh_installation_can_enroll_before_starting_the_service ... ok
test remote::tests::uid_and_privilege_mismatch_fails_before_key_generation ... ok
test remote::tests::publication_is_private_and_never_replaces_existing_identity ... ok
test remote_server::tests::failed_cold_configuration_still_disposes_handoff_stdin ... ok
test remote_server::tests::failed_restart_endpoint_does_not_prevent_http_serving ... ok
test remote_server::tests::missing_ca_refuses_before_database_or_listener_creation ... ok
test remote_server::tests::remote_activation_is_explicit_and_ca_override_requires_listener ... ok
test remote_server::tests::service_dry_run_preserves_remote_listener_and_private_trust_path ... ok
test remote_server::tests::independent_review_remote_operator_commands_accept_json_output ... ok
test remote::tests::renewal_publication_replaces_only_certificate_and_preserves_private_metadata ... ok
test remote_service::tests::successful_link_return_is_a_service_failure ... ok
test remote::tests::replace_aborts_when_the_identity_changed_since_it_was_read ... ok
test generation_update::tests::drained_copy_keeps_every_acknowledged_write_and_leaves_a_self_contained ... ok
test cli::command_tree::tests::packaged_node_dependency_closure_omits_server_storage_and_release ... ok
test generation_update::tests::historical_copy_keeps_the_snapshot_immutable_and_discards_later_authority_edits ... ok
test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 128 filtered out; finished in 0.62s

test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok
test restart::tests::early_hangup_is_queued_until_control_installs_its_handler ... ok
test generation_watchdog::tests::health_deadline_stops_the_candidate_and_keeps_the_known_good_selection ... ok
test restart::tests::private_control_endpoint_cannot_be_stolen_or_created_by_a_client ... ok
test restart::tests::private_path_prefix_cannot_authorize_a_parent_directory_escape ... ok
test remote_service::tests::link_failure_does_not_wait_forever_for_blocking_work ... ok
test remote_service::tests::polling_panic_reaches_bounded_shutdown ... ok
test restart::tests::replacement_never_exports_to_a_general_purpose_binary ... ok
test restart::tests::path_review::late_recovery_from_path_invocation_keeps_install_target ... ok
test restart::tests::default_restart_opens_the_receiver_target_exactly_once ... ok
test restart::tests::reviewer_fifo_replacement_is_refused_without_waiting_for_a_writer ... ok
test restart::tests::root_owned_marked_target_requires_protected_root_parents ... ok
test restart::tests::reload_reopens_install_path_when_the_running_inode_was_replaced ... ok
test restart::tests::runtime_directory_symlinks_and_public_permissions_are_refused ... ok
test restart::tests::real_fd_exec_pins_replacement_and_cold_rollback_uses_null_stdin ... ok
test restart::tests::restart_requests_use_the_servers_binary_and_reject_untrusted_paths ... ok
test restart::tests::cold_exec_with_closed_stdin_keeps_the_image_pinned_and_maps_null ... ok
test restart_binary::audit_tests::symlink_parent_escape_and_writable_candidates_are_refused ... ok
test restart::tests::restart_request_logs_kernel_peer_target_and_cold_outcome ... ok
test restart_binary::audit_tests::unusable_admitted_image_keeps_the_existing_service_running ... ok
test restart_binary::audit_tests::verification_twenty_megabytes ... ignored, optimized weighted 20 MiB signature and admission measurement
test restart_binary::audit_tests::unsigned_or_tampered_replacement_is_refused_before_exec ... ok
test restart_image::tests::snapshot_refuses_every_mutation_and_preserves_source_offset ... ok
test server_data_resolution_tests::explicit_data_directory_wins_over_the_installed_service ... ok
test server_data_resolution_tests::installed_service_data_directory_is_selected_when_no_override_is_given ... ok
test server_data_resolution_tests::missing_install_uses_the_existing_default_directory ... ok
test setup_token_tests::setup_token_command_reads_only_the_expected_socket_response ... ok
test shim_cli::tests::spawned_decode_refuses_changes_to_the_fixed_shape_before_startup ... ok
test shim_cli::tests::spawned_shapes_reuse_full_shim_options_and_defaults ... ok
test ssh_internal::tests::connect_requires_exactly_a_host_and_numeric_port ... ok
test ssh_internal::tests::connector_is_available_only_on_the_initiating_build ... ok
test ssh_internal::tests::session_accepts_only_the_two_spawned_shapes ... ok
test startup_tests::process_dumpability_is_disabled_before_dispatch ... ok
test startup_tests::shared_reactor_preserves_borrows_errors_and_panic_cleanup ... ok
test restart::tests::rootless_even_marked_replacement_is_cold_and_open_fd_pins_the_inode ... ok
test restart::tests::closed_reply_and_missing_reload_target_do_not_end_restart_control ... ok
test restart::tests::deleted_path_review::relative_recovery_after_atomic_install_keeps_live_install_path ... ok
test restart_image::tests::probe_never_inherits_the_control_descriptor ... ok
test restart_binary::audit_tests::admitted_inode_cannot_change_in_place_before_execution ... ok
test restart::tests::runtime_shutdown_never_waits_forever_on_a_blocking_waiter ... ok
test restart_binary::audit_tests::pathname_replacement_keeps_the_admitted_inode ... ok
test restart::recovery_tests::verified_exec_and_late_refusal_preserve_listener_and_ca ... ok
test generation_update::tests::copy_refusals_abort_before_trial_and_leave_a_usable ... ok

test result: ok. 128 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 10.18s

     Running tests/agent_daemon.rs (target/debug/deps/agent_daemon-310ae250182580e9)

running 1 test
test real_binary_preserves_input_and_output_across_24_abrupt_stops ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 33.69s

     Running tests/agent_queues.rs (target/debug/deps/agent_queues-fb844b642b243cfa)

running 1 test
test saturated_terminal_queues_preserve_every_byte_and_daemon_liveness ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.13s

     Running tests/agent_review.rs (target/debug/deps/agent_review-139a088f6597e3a1)

running 8 tests
test reaped_shim_exit_survives_credit_after_starvation_deadline ... ok
test last_typist_selects_its_own_real_pty_dimensions ... ok
test stalled_terminal_never_delays_control_or_sibling_dispatch ... ok
test initial_attach_requires_explicit_credit_before_replay ... ok
test retained_unwritten_input_survives_interleaved_ack_restart ... ok
test two_writers_keep_independent_ack_and_exact_input_after_restart ... ok
test local_session_counts_and_memory_refusals_follow_real_lifecycle ... ok
test repeated_tiny_credit_pauses_preserve_shell_progress ... ok

test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.78s

     Running tests/agent_sessions.rs (target/debug/deps/agent_sessions-54af51157c7587d4)

running 4 tests
test fixture_state::deep_root_keeps_real_sockets_private_and_cleans_up_on_drop ... ok
test detached_shim_is_discovered_and_replays_from_the_last_observed_offset ... ok
test latency_fixture_accepts_the_unsolicited_startup_inventory ... ok
test restart_discovery_keeps_a_live_shim_and_drops_clean_exit_and_sigkill ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.85s

     Running tests/cli_envelope.rs (target/debug/deps/cli_envelope-d2a343ba0d781d22)

running 8 tests
test a_missing_server_is_not_found_exit_4 ... ok
test status_exits_0_on_a_machine_with_nothing_installed ... ok
test an_unknown_command_is_a_usage_envelope_that_does_not_echo_odd_input ... ok
test bare_infraternal_is_the_overview_and_points_to_help ... ok
test component_commands_fail_in_the_envelope_when_the_agent_is_not_there ... ok
test status_exits_5_when_something_that_should_run_is_down ... ok
test read_only_commands_answer_in_the_envelope ... ok
test every_command_reports_a_usage_error_in_the_envelope_naming_the_argument ... ok

test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.34s

     Running tests/cli_review.rs (target/debug/deps/cli_review-ef1c24e02ea22921)

running 17 tests
test a_dry_run_plan_keeps_its_line_breaks ... ok
test a_group_with_one_command_says_so_in_the_singular ... ok
test a_failing_command_in_json_mode_prints_exactly_one_envelope ... ok
test a_missing_runtime_directory_is_not_called_a_bad_reply ... ok
test no_compiled_python_is_tracked ... ok
test a_usage_error_in_text_mode_does_not_echo_the_odd_input ... ok
test an_unknown_skill_is_not_found_exit_4 ... ok
test root_help_fits_80_columns ... ok
test a_malformed_host_id_is_a_usage_error_exit_2 ... ok
test root_help_lists_server_init ... ok
test json_help_and_version_are_envelopes_too ... ok
test a_dumb_terminal_gets_neither_colour_nor_marks ... ok
test user_facing_text_never_says_agent_alone ... ok
test status_is_not_down_when_the_service_manager_cannot_be_asked ... ok
test a_subcommand_does_not_advertise_options_it_ignores ... ok
test an_empty_no_color_is_ignored ... ok
test ctrl_c_in_json_mode_ends_with_an_interrupted_envelope_and_exit_130 ... ok

test result: ok. 17 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.83s

     Running tests/cli_review_r2.rs (target/debug/deps/cli_review_r2-dee3eec26bce7a83)

running 11 tests
test three_pages_preserve_order_and_only_the_final_cursor ... ok
test a_paged_listing_is_still_one_envelope ... ok
test status_text_does_not_call_an_unanswered_unit_not_running ... ok
test an_unknown_skill_does_not_echo_what_was_typed ... ok
test a_failed_later_page_emits_only_the_failure_envelope ... ok
test a_later_runtime_handler_is_not_bypassed_by_the_interrupt_handler ... ok
test usage_errors_under_json_are_one_envelope_and_exit_2 ... ok
test help_and_version_under_json_are_one_envelope_and_exit_0 ... ok
test a_mistyped_word_that_looks_like_a_token_is_not_echoed ... ok
test ctrl_c_in_a_script_loop_stops_the_loop ... ok
test ctrl_c_while_the_result_is_being_written_never_leaves_a_broken_line ... ok

test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.01s

     Running tests/cli_review_r3.rs (target/debug/deps/cli_review_r3-26df53f57990ed19)

running 4 tests
test signal_fixture ... ok
test a_pending_blocked_interrupt_emits_notice_and_terminates_by_sigint ... ok
test a_pending_interrupt_during_final_output_preserves_result_and_sigint_status ... ok
test inherited_ignored_sigint_stays_ignored_during_cli_output ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s

     Running tests/cli_review_r3_arguments.rs (target/debug/deps/cli_review_r3_arguments-cd5aa22ec36b5fca)

running 1 test
test inherited_fd_is_rejected_instead_of_ignored_by_remote_commands ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s

     Running tests/cli_sessions.rs (target/debug/deps/cli_sessions-fa0c3e0c997a60d4)

running 7 tests
test generated_sessions_skill_does_not_expose_the_private_list_cursor ... ok
test sessions_never_accept_attach ... ok
test sessions_read_requires_last_before_connecting ... ok
test sessions_invalid_targets_have_usage_envelope_and_fix ... ok
test literal_program_pipe_rejects_invalid_input_before_startup ... ok
test sessions_commands_are_registered_and_have_generated_skills ... ok
test saved_shell_automation_uses_an_owner_only_socket_directory ... ok

test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.27s

     Running tests/idle_canary.rs (target/debug/deps/idle_canary-19c3b762e6c29083)

running 1 test
test one_hertz_wakeup_is_detected_past_the_legacy_half_second_window ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.11s

     Running tests/key_memory.rs (target/debug/deps/key_memory-9849bd2bae091d09)

running 1 test
test diagnostic_requires_locked_pages_and_supports_json_without_public_help ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s

     Running tests/remote_output.rs (target/debug/deps/remote_output-b21573144a7812bd)

running 1 test
test remote_refusal_matches_its_declared_cli_output ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/replay_size.rs (target/debug/deps/replay_size-36edce63d6e02425)

running 1 test
test replay_fences_report_pre_resize_geometry_across_viewers ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.53s

     Running tests/replay_size_review.rs (target/debug/deps/replay_size_review-1628616ffcee501e)

running 1 test
test adopted_raw_and_snapshot_replays_keep_pre_resize_geometry ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.08s

     Running tests/session_bounds_review.rs (target/debug/deps/session_bounds_review-0899089f32f63ead)

running 1 test
test attached_window_recovers_final_output_and_exit_after_shim_link_detaches ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.01s

     Running tests/session_exit_events.rs (target/debug/deps/session_exit_events-583999bf2a00d621)

running 1 test
test idle_daemon_discovers_unattached_and_adopted_shim_exit_without_requests ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.46s

     Running tests/session_retention.rs (target/debug/deps/session_retention-ff4e034d9f8c8fda)

running 1 test
test bounded_owned_exit_reconnects_as_ended_with_status ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.64s

     Running tests/setup_output.rs (target/debug/deps/setup_output-e0fd218c7b486c95)

running 6 tests
test unreadable_system_service_data_prints_one_sudo_command_line ... ok
test setup_output_keeps_legacy_and_versioned_readers ... ok
test setup_token_permission_hint_covers_a_private_socket_in_a_readable_directory ... ok
test setup_token_finds_the_data_dir_from_a_system_service_without_flags ... ok
test setup_token_reads_a_traversable_directory_without_listing_access ... ok
test setup_token_discovers_a_service_installed_through_a_versioned_binary_symlink ... ok

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s

     Running tests/shim.rs (target/debug/deps/shim-199a435a9f7a2bb8)

running 24 tests
test disallowed_signal_only_disconnects_peer ... ok
test double_fork_survives_parent_death ... ok
test malformed_shared_successor_does_not_evict_the_live_shared_peer ... ok
test detached_shell_exit_reaps_even_with_a_live_background_descendant ... ok
test detached_shell_exit_reaps_shim_within_one_second ... ok
test parked_shared_writer_does_not_stop_detached_pty_progress ... ok
test independent_shared_writers_wait_for_the_same_global_queue ... ok
test attached_backpressure_and_detached_progress ... ok
test dropped_deferred_peers_release_slots_before_the_pty_drains ... ok
test replacement_connection_and_malformed_limit ... ok
test shared_writer_refusals_and_full_peer_limit_preserve_the_live_writer ... ok
test delivered_exit_cannot_release_another_owning_window ... ok
test real_shell_reconnect_resize_and_delivered_exit ... ok
test fresh_shared_peer_negotiates_while_another_shared_input_is_deferred ... ok
test shared_writer_coexists_and_replayed_input_is_written_once ... ok
test writer_replacement_is_per_mode_and_fresh_ordinary_writers_stay_optional ... ok
test shared_writer_restores_durable_geometry_after_another_writer_types ... ok
test unowned_normal_exit_retires_promptly_and_records_status ... ok
test owned_exit_releases_promptly_on_window_close ... ok
active
test user_scope_survives_parent_unit_stop ... ok
test shared_input_waits_for_global_queue_space_without_losing_the_suffix ... ok
test owned_exit_maximum_retires_with_status_even_with_an_unread_data_peer ... ok
test legacy_output_subscription_unblocks_deferred_shared_input ... ok
test ring_wrap_snapshot_repaints_real_vim ... ok

test result: ok. 24 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.59s

     Running tests/ssh_askpass.rs (target/debug/deps/ssh_askpass-1f659a54851bb0ab)

running 4 tests
test encrypted_key_without_passphrase_never_prompts_on_a_controlling_terminal ... ignored, run under the disposable controlling-terminal harness
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test real_cli_askpass_refuses_unregistered_parent_and_cleans_helper ... ok
test real_cli_unlocks_an_encrypted_synthetic_key_on_private_pipes ... ok

test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 1.33s

     Running tests/ssh_connector_policy.rs (target/debug/deps/ssh_connector_policy-1cc966f4e059d4ca)

running 1 test
test connector_preserves_configured_bind_address_refusal ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.01s

     Running tests/status_restart.rs (target/debug/deps/status_restart-5436d652e5de306a)

running 1 test
test service_states_are_truthful_in_text_and_json ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.09s

     Running tests/user_host.rs (target/debug/deps/user_host-1d74198984b655c9)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/vt_credit.rs (target/debug/deps/vt_credit-ace287a28420d63f)

running 1 test
test unaffordable_repaints_park_until_sufficient_credit ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.81s

     Running tests/vt_reconnect.rs (target/debug/deps/vt_reconnect-18de3902538e2af8)

running 1 test
test snapshot_limits_never_close_live_reconnect ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.58s

     Running unittests src/lib.rs (target/debug/deps/infraternal_agent-c1440fea876b55cc)

running 198 tests
test automation::operations::tests::private_names_keep_the_existing_shape_and_strict_validation ... ok
test automation::tests::cross_account_session_name_has_the_same_not_found_reply_as_absent ... ok
test automation::operations::tests::read_last_line_keeps_a_trailing_blank_line ... ok
test automation::tests::reply_decoder_keeps_additive_fields_and_refuses_malformed_fields ... ok
test cli::tests::agent_actions_are_complete_and_unavailable_until_lifecycle_exists ... ok
test daemon::gone_tests::scale_review::two_hundred_vanished_sessions_preserve_the_same_channel ... ignored, scale measurement; run alone under CPUWeight=10000
test daemon::authenticated_tests::authenticated_uid_refusal_precedes_state_and_io ... ok
test automation::tests::caller_tree_is_kernel_derived_and_account_scoped ... ok
test automation::tests::rejects_unknown_fields_types_bounds_and_path_names ... ok
test daemon::readiness_tests::a_saturated_census_queue_cannot_establish_the_open_fence ... ok
test daemon::census_retry_tests::full_control_lane_retries_retirement_census_on_capacity_without_requests ... ok
test daemon::gone_tests::a_vanished_session_gets_a_final_close_and_the_channel_stays_up ... ok
test daemon::readiness_tests::census_and_open_result_share_fifo_order ... ok
test daemon::readiness_tests::control_precedes_bulk_without_reordering_snapshot_notice ... ok
test daemon::readiness_tests::replay_complete_preserves_the_full_output_cursor_as_decimal ... ok
test daemon::readiness_tests::replay_geometry_is_frozen_before_queued_resize_and_delayed_output ... ok
test daemon::readiness_tests::replay_prefix_stops_at_the_shim_hello_head ... ok
test daemon::readiness_tests::reply_lane_memory_at_1000_channels ... ignored, queue-only scale diagnostic; run alone without build/browser overlap, not whole-daemon memory
test daemon::liveness_tests::terminal_probe_waits_for_the_shim_fence_and_keeps_stream_identity ... ok
test daemon::liveness_tests::input_state_probe_preserves_written_ack_before_input ... ok
test daemon::liveness_tests::input_state_probe_preserves_written_ack_after_input ... ok
test daemon::readiness_tests::uninstall_handoff_runs_only_after_a_successful_real_socket_write ... ok
test daemon::liveness_tests::detached_ping_preserves_written_ack_without_output_credit ... ok
test daemon::readiness_tests::a_shut_down_peer_refuses_the_write_while_a_forked_copy_holds_it ... ok
test daemon::liveness_tests::frozen_terminal_input_keeps_its_sequence_until_preparation_releases_it ... ok
test daemon::readiness_exit_tests::ownership_eof_does_not_discard_private_terminal_output ... ok
test daemon::readiness_tests::saturated_action_replies_preserve_connection ... ok
test daemon::readiness_tests::saturated_ping_replies_preserve_connection ... ok
test daemon::remote_tests::cancelling_remote_dispatch_retires_the_borrowed_authenticated_channel ... ok
test daemon::remote_tests::authenticated_machine_exchange_releases_effect_only_after_written_reply ... ok
test daemon::readiness_tests::fixture_fence_processes_messages_before_the_control_pong ... ok
test daemon::session_commands::measurements::command_coordination_cost_against_existing_fifo ... ignored, release command coordination diagnostic, not end-to-end throughput; run without own build overlap
test daemon::session_commands::reply_capacity_tests::full_reply_reservations_cannot_spend_keyboard_capacity ... ok
test daemon::session_commands::reply_capacity_tests::sixteen_replies_and_eight_typing_commands_retain_their_order ... ok
test daemon::session_commands::tests::credit_allowance_does_not_cross_ordered_command_barriers ... ok
test daemon::session_commands::tests::credit_bursts_do_not_consume_ordered_input_capacity ... ok
test daemon::session_commands::tests::input_and_resize_keep_their_shared_fifo_order_around_credit ... ok
test daemon::session_commands::tests::probe_at_full_command_capacity_preserves_accepted_input ... ok
test daemon::session_commands::tests::review_reply_at_full_command_capacity_preserves_accepted_input ... ok
test daemon::session_commands::tests::zero_credit_is_idle_and_overflow_refuses_without_mutating_accounting ... ok
test daemon::stream_memory_tests::terminal_stream_memory_at_200 ... ignored, weighted release measurement of 200 idle relay tasks
test daemon::session_commands::tests::credit_above_one_wire_word_is_exact_and_idle_after_drain ... ok
test daemon::terminal_events::tests::ordinary_exit_omits_retired_and_snapshot_sequences_stay_numeric ... ok
test daemon::terminal_events::tests::census_uses_uuid_strings_and_replay_keeps_all_cursor_bits ... ok
test daemon::remote_tests::reattach_dispatch_serves_while_another_runtime_holds_the_lifetime_lock ... ok
test daemon::remote_tests::unnegotiated_machine_frame_never_reaches_enabled_feature ... ok
test daemon::terminal_events::tests::reply_compatibility_notice_contains_only_session_identity ... ok
test lifecycle::tests::window_ownership_and_process_identity_bound_live_counts ... ok
test lifecycle::tests::directory_inode_changes_do_not_retire_the_same_process ... ok
test daemon::remote_tests::wrong_enrolled_uid_is_refused_before_state_creation ... ok
test lifecycle::tests::process_birth_parser_handles_command_bytes_and_numeric_bounds ... ok
test plugin_control::local_owner_tests::lost_local_owner_reply_never_runs_its_restart_effect ... ok
test plugin_control::shutdown_tests::shutdown_joins_an_entered_synchronous_callback_before_returning ... ok
test plugin_control::shutdown_tests::shutting_down_an_unpolled_surface_never_constructs_its_plugins ... ok
test plugin_control::local_owner_tests::local_owner_action_keeps_remote_refusal_and_runs_only_after_socket_write ... ok
test plugin_control::tests::dropping_a_listener_does_not_unlink_a_replacement_file ... ok
test lifecycle::tests::nondumpable_process_keeps_its_authenticated_lifetime ... ok
test plugin_control::tests::empty_catalog_preserves_control_contract_without_an_os_worker ... ok
test plugin_control::tests::admission_observes_the_same_plugin_settings_as_actions ... ok
test plugin_control::recovery_tests::recovery_service_uses_existing_read_only_lock_without_local_socket_allocation ... ok
test plugin_control::tests::retained_runtime_registry_keeps_lifetime_ownership_after_listener_abort ... ok
test plugin_control::tests::local_public_actions_refuse_controls_and_active_socket_replacement ... ok
test plugin_control::tests::retained_path_and_observed_transport_cross_the_lazy_worker ... ok
test plugin_control::tests::synchronous_plugin_work_does_not_park_the_current_thread_reactor ... ok
test process_exits::platform::tests::resource_failures_do_not_silently_disable_exit_tracking ... ok
test plugins::host_release_metadata_tests::host_release_authorization_metadata_is_declared_without_a_default_receiver ... ok
test plugin_control::tests::local_frame_reader_retains_fragmentation_and_refuses_trailing_frames ... ok
test plugin_control::tests::worker_preserves_trusted_context_and_writer_owned_effect ... ok
test process_exits_tests::shared_exit_queue_at_200_processes ... ignored, 200 live process lifetimes; run in a weighted benchmark scope
test process_exits_tests::process_descriptor_is_cloexec_and_rejects_invalid_pid ... ok
test relay::tests::attachment_has_no_implicit_output_or_snapshot_credit ... ok
test process_exits_tests::exited_before_registration_is_not_a_live_registration ... ok
test relay::tests::input_overlap_gap_and_restart_from_confirmed_offset ... ok
test relay::tests::output_partial_credit_and_dedup ... ok
test relay::tests::output_payload_move_measurement ... ignored, release ownership versus payload-copy measurement
test relay::tests::overflowing_ranges_never_mutate_cursors ... ok
test relay::tests::positive_insufficient_credit_arms_a_one_shot_deadline ... ok
test relay::tests::returned_credit_cancels_starvation_and_state_has_no_payload_buffer ... ok
test relay::tests::starvation_is_one_shot_and_snapshot_length_does_not_advance_sequence ... ok
test relay::tests::expired_credit_resumes_retained_bytes_at_the_same_cursor ... ok
test remote_client::controlled_tests::admitted_exec_transfers_runtime_ownership_without_an_unlock_window ... ok
test remote_client::controlled_tests::inherited_runtime_ownership_refuses_an_unrelated_file_and_invalid_descriptor ... ok
test process_exits::platform::tests::unavailable_kernel_has_no_timer_or_descriptor ... ok
test remote_client::controlled_tests::controlled_offline_shutdown_unlinks_listener_and_retains_runtime_lock ... ok
test remote_client::controlled_tests::stopping_before_first_poll_never_constructs_host_plugins ... ok
test remote_client::dial_runtime::tests::owned_driver_clock_advances_with_its_timer_runtime ... ok
test remote_client::controlled_tests::refused_exec_resume_keeps_the_same_runtime_owner ... ok
test daemon::remote_tests::wrong_open_uid_is_rejected_while_control_remains_usable ... ok
test remote_client::server_path::tests::a_future_mesh_lease_and_silent_cut_keep_their_port_reserved ... ok
test process_exits_tests::shared_queue_detects_exit_and_does_not_repeat_or_retain_descriptors ... ok
test remote_client::server_path::tests::a_latched_mesh_reply_wakes_retry_without_selecting_the_path ... ok
test remote_client::server_path::tests::backed_discovery_ends_with_its_owned_session ... ok
test remote_client::controlled_tests::read_only_runtime_never_advertises_persistent_certificate_renewal ... ok
test remote_client::server_path::tests::backed_candidate_refusal_keeps_new_datagrams_on_mesh_discovery ... ok
test remote_client::server_path::tests::backup_published_during_candidate_proof_keeps_enrolled_control_live ... ok
test daemon::remote_tests::control_greeting_precedes_actions_and_odd_writers_are_refused ... ok
test remote_client::server_path::tests::component_down_activates_the_warm_fallback_without_a_new_connection ... ok
test remote_client::server_path::tests::component_down_keeps_its_reason_when_the_mesh_also_stops_answering ... ok
test remote_client::server_path::tests::failed_control_worker_returns_to_retry_owner ... ok
test remote_client::server_path::tests::healthy_mesh_path_is_never_declared_interrupted ... ignored, Timing assertion: run on the perf VM under the shared benchmark lock.
test remote_client::server_path::tests::component_down_returns_the_live_connection_to_the_enrolled_address ... ok
test remote_client::server_path::tests::candidate_proof_keeps_probing_after_its_first_packet_is_lost ... ok
test remote_client::server_path::tests::invalid_mesh_hint_cannot_complete_fresh_path_proof ... ok
test remote_client::server_path::tests::pending_enrolled_proof_does_not_hide_a_latched_mesh_hint ... ok
test remote_client::server_path::tests::healthy_mesh_preserves_every_control_reply_on_the_admitted_connection ... ok
test remote_client::server_path::tests::pending_enrolled_proof_does_not_hide_the_mesh_discovery_clock ... ok
test remote_client::server_path::tests::backed_discovery_keeps_control_cancellation_and_udp_recovery_bounded ... ok
test remote_client::server_path::tests::retained_mesh_proposal_connects_when_the_fallback_port_is_unavailable ... ok
test remote_client::server_path::tests::review_silent_mesh_interruption_returns_to_fallback_within_local_reconnect_budget ... ignored, Run alone on the perf VM under the shared benchmark lock.
test remote_client::server_path::tests::silent_mesh_handshake_keeps_the_shared_timeout_classification ... ok
test remote_client::server_path::tests::unadvertised_path_proof_keeps_the_existing_enrolled_connection ... ok
test remote_client::server_path::tests::dropped_return_replies_keep_the_admitted_connection ... ok
test remote_client::server_path::tests::interrupted_mesh_is_retried_on_the_same_connection ... ok
test remote_client::server_path::tests::returning_publishes_the_selected_path_before_its_proof_finishes ... ok
test remote_client::server_path::tests::unnegotiated_backup_preserves_the_enrolled_retry_cooling ... ok
test remote_client::server_path::tests::unavailable_credentials_do_not_end_server_link ... ok
test automation::operations::tests::lists_500_sessions_across_bounded_pages_without_loss ... ok
test remote_client::server_path::tests::proposed_mesh_moves_the_live_connection_and_a_silent_cut_returns_it ... ok
test remote_client::supervisor::review_tests::six_hour_server_outage_keeps_one_retry_owner_with_bounded_attempts ... ok
test remote_client::supervisor::tests::a_burst_then_a_stable_link_is_summarised_by_the_timer ... ok
test remote_client::supervisor::tests::every_error_kind_and_successful_return_retries ... ok
test remote_client::supervisor::tests::failed_attempt_cost_does_not_extend_the_retry_period ... ok
test remote_client::supervisor::tests::healthy_link_has_no_watchdog_deadline ... ok
test remote_client::supervisor::tests::link_close_notes_print_once_per_window_and_summarise_repeats ... ok
test remote_client::supervisor::tests::watchdog_restarts_a_stalled_offline_attempt ... ok
test remote_client::tests::capability_fixture_retries_a_port_held_by_the_other_transport ... ok
test remote_client::server_path::tests::unanswered_mesh_address_keeps_the_live_connection ... ok
test remote_client::tests::idle_timers::copy_cost::fresh_admission_accepts_dormant_replies_but_refuses_pending_recovery ... ok
test remote_client::tests::idle_timers::copy_cost::fresh_copy_from_admission_at_one_thousand_transports ... ignored, Separate fresh-copy cohort on the perf VM under its shared benchmark lock.
test remote_client::tests::idle_timers::copy_cost::mesh_probe_and_copy_cost_at_one_thousand_transports ... ignored, Optimized transport-only measurement on the perf VM under its shared benchmark lock.
test remote_client::tests::idle_timers::copy_cost::physical_counters_include_both_source_paths ... ok
test remote_client::tests::idle_timers::copy_cost::receive_diagnostic::monotonic_origin_bounds_fail_closed_without_losing_receive_receipts ... ok
test remote_client::tests::idle_timers::copy_cost::receive_diagnostic::receive_diagnostic_counts_gro_and_only_fixed_sampled_ports ... ok
test remote_client::tests::idle_timers::copy_cost::receive_diagnostic::receive_diagnostic_gap_bins_have_explicit_bounds ... ok
test remote_client::tests::idle_timers::copy_cost::runtime_configuration_trial_at_one_thousand_transports ... ignored, Explicit runtime scheduling control on the perf VM; ordinary runtime and guards unchanged.
test remote_client::tests::idle_timers::copy_cost::socket_configuration_trial_at_one_thousand_transports ... ignored, Explicit socket-configuration diagnostic on the perf VM; ordinary scale gates stay unchanged.
test remote_client::tests::idle_timers::copy_cost::udp_drop_receipt_counts_only_owned_live_sockets ... ok
test remote_client::tests::idle_timers::mesh_idle_timer_cost_at_one_thousand_connections ... ignored, Release-only perf VM measurement under the shared benchmark lock.
test remote_client::server_path::tests::untrusted_server_on_the_mesh_address_never_takes_the_connection ... ok
test remote_client::tests::prefixed_control_keeps_coalesced_suffix_and_suppresses_only_its_greeting ... ok
test remote_client::tests::rootless_uid_mismatch_is_refused_before_dial ... ok
test remote_client::tests::raw_tcp_control_preserves_mux_envelopes_and_buffered_suffix ... ok
test remote_client::tests::supervisor_300ms_quic_and_blocked_udp_fallback ... ignored, supervisor establishment diagnostic; run alone without builds or browsers
test remote_client::supervisor::review_tests::terminated_factory_is_replaced_without_overlapping_live_workers ... ok
test remote_client::tests::tcp_proxy_preserves_spacing_between_packets_already_in_flight ... ok
test remote_client::tests::tcp_winner_cancels_silent_udp_drivers_without_waiting_for_drain ... ok
test remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports ... ok
test remote_client::tests::delayed_proxy_keeps_replies_bound_to_the_original_udp_client ... ok
test daemon::readiness_tests::the_unhealthy_handoff_case_survives_concurrent_spawns ... ok
test remote_cursor::tests::exact_unsigned_cursor_and_whole_object_are_required ... ok
test remote_native_tests::bound_writer_uses_raw_frames_and_rejects_cross_writer_transmit ... ok
test remote_native_tests::control_must_be_host_initiated_stream_zero_and_terminal_halves_cannot_impersonate_it ... ok
test remote_client::tests::unavailable_local_credentials_retry_without_creating_state ... ok
test remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission ... ok
test remote_native_tests::primed::negotiated_connection_keeps_unmarked_new_writers_ordinary ... ok
test remote_native_tests::primed::ordinary_native_writer_refuses_the_additive_cursor_request ... ok
test remote_native_tests::partial_native_write_cancellation_retires_both_directions ... ok
test remote_native_tests::primed::prime_marker_is_canonical_and_requires_negotiated_permission ... ok
test remote_native_tests::terminal::gone_review::retired_native_session_delivers_saved_status_then_final_close_before_retirement ... ok
test remote_native_tests::primed::primed_writer_acknowledges_before_reading_credit_funded_cursor ... ok
test remote_native_tests::terminal::credits::private_credit_burst_waits_for_its_shim_without_retiring_native_stream ... ok
test remote_native_tests::terminal::gone_review::retiring_native_handshake_preserves_final_answer_with_inflight_commands ... ok
test remote_native_tests::terminal::gone_review::vanished_native_session_delivers_final_close_before_stream_retirement ... ok
test remote_native_tests::terminal::real_pty_resumes_native_writer_after_25_connection_replacements ... ignored, real CLI/shim oracle; set INFRATERNAL_TEST_BINARY and run alone under CPUWeight10000
test remote_client::server_path::tests::component_down_proves_tcp_fallback_when_enrolled_udp_is_unavailable ... ok
test sessions::tests::borrowed_reader_payload_uses_reusable_cancel_safe_storage ... ok
test sessions::tests::cancelled_fragmented_shim_read_retains_header_and_body_progress ... ok
test sessions::tests::ordinary_native_writer_negotiates_queue_backpressure_without_shared_selection ... ok
test sessions::tests::bounds::discovery_recovers_more_than_128_authenticated_sockets ... ok
test sessions::tests::reader_borrow_measurement ... ignored, release borrowed versus owned asynchronous receive measurement
test sessions::tests::refused_socket_is_removed_but_insecure_directory_is_rejected ... ok
test sessions::tests::sequenced_attach_intersects_caps_and_legacy_attach_stays_zero ... ok
test sessions::tests::shared_writer_helper_negotiates_before_sending_its_selector ... ok
test sessions::tests::symlink_state_cannot_redirect_private_runtime_storage ... ok
test startup_guard::tests::discovery_never_edits_and_exec_is_guarded_in_place ... ok
test startup_guard::tests::guard_works_for_shell_variants_and_does_not_rewrite_compound_text ... ok
test startup_guard::tests::helper_output_keeps_response_and_exit_status_bounds ... ok
test sessions::tests::post_listen_chmod_wakes_a_connection_refused_at_bind ... ok
test startup_guard::tests::real_shell_guards_keep_strict_startup_alive_and_manual_invocation_available ... ignored, requires Nix bash, zsh, fish, tmux and zellij; run the D315 shell matrix explicitly
test startup_guard::tests::refuses_symlinks_parent_traversal_and_forged_proposals ... ok
test remote_client::tests::tcp_proxy_flushes_bounded_flood_before_half_close ... ok
test startup_guard::tests::stale_apply_and_ambiguous_undo_leave_files_untouched ... ok
test transport::remote_deadline_tests::queued_suffix_cannot_complete_an_expired_cancelled_frame ... ok
test startup_guard::tests::inherited_acl_is_refused_without_changing_the_original ... ok
test remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch ... ok
test transport_diagnostics::quic_300ms_and_1000_connection_pairs ... ignored, diagnostic only; run alone without build or browser overlap
test transport_diagnostics::quic_bulk_50m_exact_bytes ... ignored, size investigation diagnostic; run alone without build or browser overlap
test transport_diagnostics::quic_bulk_50m_kernel_latency ... ignored, Exact 50MiB kernel-latency control on the perf VM in an owned network namespace.
test transport_diagnostics::tcp_300ms_and_1000_connection_pairs ... ignored, diagnostic only; run alone without build or browser overlap
test transport::remote_deadline_tests::remote_partial_frame_deadline_survives_receive_cancellation ... ok
test transport::remote_deadline_tests::coalesced_partial_suffix_keeps_its_arrival_deadline ... ok
test transport::remote_deadline_tests::wholly_idle_remote_channel_has_no_frame_expiry ... ok
test remote_native_tests::terminal::gone_review::retired_native_status_bounds_final_reply_drain_for_a_stuck_peer ... ok
test remote_native_tests::terminal::gone_review::vanished_native_session_bounds_final_reply_drain_for_a_stuck_peer ... ok
test remote_client::supervisor::review_tests::durable_state::acknowledged_network_access_survives_superseded_worker_completion ... ok
test daemon::remote_tests::silent_authenticated_peer_has_a_greeting_deadline ... ok
test remote_client::supervisor::review_tests::watchdog_bounds_workers_when_local_path_discovery_stalls ... ok
test plugin_control::tests::accepted_public_transaction_outlives_the_framing_deadline ... ok

test result: ok. 177 passed; 0 failed; 21 ignored; 0 measured; 0 filtered out; finished in 11.40s

     Running tests/transport.rs (target/debug/deps/transport-4502ae5111e1f5af)

running 3 tests
test oversized_header_and_truncated_frame_are_rejected ... ok
test replacing_the_callers_descriptor_cannot_redirect_registered_io ... ok
test fragmented_headers_coalesced_frames_and_reusable_transmit ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running unittests src/lib.rs (target/debug/deps/infraternal_mesh-a04b5a96f95d79a2)

running 1 test
test cli::tests::mesh_actions_are_complete_with_optional_ssh_connectivity ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/default_arrow.rs (target/debug/deps/default_arrow-7639d45879e9a75b)

running 1 test
test omitted_arrow_ports_default_to_all_services ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/properties.rs (target/debug/deps/properties-c6a9f9dc8cc13f8c)

running 14 tests
test exhausted_versions_reject_mutations_without_changing_state ... ok
test overlaps_are_reported_without_silent_range_changes ... ok
test directional_grants_union_and_minimal_updates ... ok
test join_to_same_tag_grants_both_initiation_directions ... ok
test names_versions_and_backend_status ... ok
test checkpoint_after_suffix_change_restores_without_reallocating_addresses ... ok
test arrow_replacement_is_atomic_and_unrelated_nodes_keep_their_versions ... ok
test public_checkpoint_preserves_addresses_rules_versions_and_overlap ... ok
test private_material_never_enters_debug_or_coordination_serialization ... ok
test rotation_waits_for_overlap_and_delivery_and_removal_drops_every_key ... ok
test server_rotation_has_continuous_keys_for_every_node_during_delivery ... ok
test protocol_port_unions_never_grant_an_unlisted_service ... ok
test addresses_are_unique_stable_and_not_recycled ... ok
test seeded_random_sequences_equal_full_compile_and_deny_without_grants ... ok

test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.50s

     Running tests/rotation_time.rs (target/debug/deps/rotation_time-66d8934728f4dce0)

running 1 test
test unrepresentable_rotation_overlap_rejects_before_mutation ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-1006a5db3e014a93)

running 60 tests
test action::tests::any_of_permissions_are_machine_readable_and_empty_authority_is_rejected ... ok
test action::tests::registry_keeps_plugin_ownership_and_exact_command_paths ... ok
test action::tests::registry_rejects_inconsistent_json_schemas ... ok
test action::tests::command_result_schema_has_required_stable_fields_and_optional_next_step ... ok
test action::tests::command_result_schema_keeps_action_data_typed_inside_stable_envelope ... ok
test activity::tests::enabling_observation_starts_fresh_and_tracks_existing_handshakes ... ok
test action::tests::registry_rejects_missing_action_guidance_and_command_collisions ... ok
test action::tests::only_hidden_internal_routes_may_use_the_reserved_prefix ... ok
test activity::tests::input_and_cancelled_connections_postpone_quiet_work ... ok
test host_name::tests::addresses_and_hostnames_give_a_machine_name ... ok
test host_name::tests::numeric_invalid_and_unnamed_inputs_give_no_name ... ok
test host_name::tests::odd_and_overlong_hostnames_give_no_name ... ok
test admission::tests::memory_refusal_round_trips_without_losing_legacy_error ... ok
test local_actions_tests::local_owner_dispatch_obeys_trial_readiness_before_preparing_any_effect ... ok
test local_actions_tests::local_owner_presentation_can_follow_only_a_public_status_read ... ok
test component_tests::destructive_actions_require_a_dry_run_and_every_action_has_instructions ... ok
test local_actions_tests::owner_action_is_local_only_and_retains_writer_owned_effects ... ok
test machine_tests::machine_dispatch_refuses_disabled_or_ambiguous_handlers_before_effects ... ok
test machine_tests::machine_update_capability_is_disjoint_from_transport_capabilities ... ok
test node_recovery_tests::recovery_defers_route_restore_link_context_and_observation_callbacks ... ok
test activity::tests::interrupted_fences_wake_retained_input_and_attach_without_polling ... ok
test node_recovery_tests::recovery_refuses_later_registration_of_a_mutating_plugin ... ok
test owned_io::tests::cold_image_io_also_works_on_a_current_thread_runtime ... ok
test machine_tests::machine_dispatch_bounds_both_input_and_plugin_reply ... ok
test present::tests::a_table_has_a_header_only_from_two_rows ... ok
test node_recovery_tests::recovery_keeps_safe_reads_but_refuses_writes_terminal_open_and_machine_work ... ok
test node_recovery_tests::recovery_retires_plugins_that_did_not_opt_into_read_only_before_any_callback ... ok
test present::tests::a_table_fits_its_width_by_wrapping_only_the_last_column ... ok
test component_tests::component_declarations_cannot_create_servers ... ok
test present::tests::pairs_align_values_and_wrap_under_them ... ok
test present::tests::sizes_and_ages_use_units_a_person_would_say ... ok
test present::tests::tint_wraps_text_after_padding_is_measured ... ok
test present::tests::wide_leading_columns_are_cut_with_an_ellipsis ... ok
test release_manifest::tests::noncanonical_or_cross_channel_identity_is_refused ... ok
test release_verify::tests::compiled_authorities_keep_production_and_isolate_staging ... ok
test owned_io::tests::image_io_keeps_control_progress_and_abort_join_owns_its_completion ... ok
test release_verify::tests::verification_twenty_megabytes_fifty_runs ... ignored, run release-profile measurements in a weighted scope
test release_version::tests::accepts_only_worker_version_forms ... ok
test release_verify::tests::per_run_signature_obeys_the_compiled_feature_boundary ... ok
test routing::tests::topic_is_borrowed_and_other_filter_fields_are_left_to_the_plugin ... ok
test routing::tests::invalid_or_oversized_topics_are_refused ... ok
test runtime_gate_tests::trial_runtime_gate_defers_route_restore_and_observation_callbacks ... ok
test local_actions_tests::local_owner_metadata_cannot_alias_a_remotely_declared_action ... ok
test release_version::tests::ordered_updates_never_compare_stable_numbers_lexically_or_overflow ... ok
test runtime_gate_tests::trial_runtime_gate_keeps_private_health_check_in_available ... ok
test storage::tests::writer_begin_at_1000_nodes ... ignored, Measure only on the perf VM under its benchmark lock, 31 batches of 1000 writes.
test server_path::tests::legacy_link_omits_the_optional_source_port ... ok
test tests::machine_actions_are_declared_without_entering_human_discovery ... ok
test runtime_gate_tests::trial_runtime_gate_refuses_public_and_control_actions_before_callbacks ... ok
test tests::operator_presentation_cannot_follow_a_private_control_action ... ok
test tests::registry_rejects_oversized_json_before_plugin_dispatch ... ok
test tests::public_dispatch_cannot_call_a_machine_control_action ... ok
test tests::notifications_are_declared_json_bounded_and_drained_once ... ok
test tests::registry_routes_only_declared_actions ... ok
test activity::tests::exclusive_admission_closes_the_idle_check_race_and_recovers_on_drop ... ok
test tests::deferred_plugin_effect_waits_for_successful_reply_and_drops_on_cancellation ... ok
test storage::tests::cancelled_begin_never_leaves_an_open_writer_transaction ... ok
test release_verify::tests::openssh_signatures_preserve_descriptor_and_reject_every_byte_mutation ... ok
test release_verify::tests::trust_namespace_hash_trailing_data_and_manifest_ambiguity_are_refused ... ok
test release_manifest::tests::signed_identity_and_exact_bytes_are_required ... ok

test result: ok. 58 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.11s

     Running tests/routing_review.rs (target/debug/deps/routing_review-a11d1d83d5553d48)

running 2 tests
test review_topic_borrows_plain_and_owns_escaped ... ok
test review_topic_refuses_oversize_duplicate_and_deep_input ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_backup-8dfda7c124aad611)

running 1 test
test cli::tests::backup_actions_are_complete_and_unavailable_until_runtime_exists ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_canvas-c0d30dbb16e448be)

running 15 tests
test model::tests::graph_pin_coordinates_include_both_limits_but_refuse_the_next_integer ... ok
test model::tests::host_id_requires_canonical_lowercase_hyphenated_text ... ok
test model::tests::reference_document_has_strict_shape_and_bounds ... ok
test reducer::tests::nullable_resize_preserves_existing_values_and_absent_fields ... ok
test model::tests::session_name_pin_is_optional_and_boolean ... ok
test reducer::tests::view_metadata_targets_and_column_neighbours_are_semantic ... ok
test reducer::tests::sample_corpus_preserves_strict_variant_fields_and_round_trips ... ok
test reducer::tests::concurrent_builtin_view_creation_preserves_existing_contents ... ok
test socket::tests::descriptor_declares_server_only_actions_and_strict_subscription ... ok
test socket::tests::session_binding_accepts_json_string_escapes ... ok
test reducer::tests::split_divides_only_its_own_band ... ok
test socket::tests::result_json_preserves_both_wire_shapes ... ok
test socket::tests::ordinary_session_binding_borrows_and_escaped_binding_decodes_identically ... ok
test reducer::tests::repeated_open_close_does_not_exhaust_column_capacity ... ok
test reducer::tests::independent_edits_commute_and_close_wins_in_both_orders ... ok

test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_host_facts-0bba384e60ab6feb)

running 14 tests
test memory::tests::custom_policy_rounds_up_and_validates_all_settings_before_use ... ok
test tests::descriptor_declares_default_settings_actions_and_no_hidden_role_dependency ... ok
test tests::linux_load_average_text_ignores_proc_metadata_and_rejects_invalid_values ... ok
test tests::os_release_uses_distribution_name_and_version_without_shell_evaluation ... ok
test session_counts_tests::host_owned_session_counts_are_additive_and_refresh_on_request ... ok
test tests::action_decoders_reject_unknown_and_oversized_fields ... ok
test tests::runtime_disable_drops_cached_facts_and_reenable_collects_them_again ... ok
test tests::macos_load_average_decodes_the_bounded_64_bit_sysctl_shape ... ok
test tests::compatibility_fields_are_kept_in_the_rust_shape_and_architecture_on_wire ... ok
test tests::os_release_parser_rejects_unbounded_input_and_ignores_untrusted_lines ... ok
test tests::static_facts_report_the_machines_hostname ... ok
test tests::static_facts_are_cached_and_live_counters_are_collected_only_when_requested ... ok
test memory::tests::default_floor_refuses_only_below_headroom_even_above_128_sessions ... ok
test tests::configured_memory_floor_refuses_with_current_host_counters ... ok

test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_mesh-6802892557379433)

running 76 tests
test firewall::tests::already_removed_owned_table_does_not_block_component_cleanup ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test firewall::tests::initial_apply_without_adoption_refuses_a_foreign_table ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test firewall::tests::real_nft_ownership_atomicity_and_scaled_apply ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test connection_state::tests::narrowing_depends_on_services_and_direction_not_the_fallback_label ... ok
test iptables::tests::real_nf_tables_ownership_partial_family_and_scaled_apply ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test access_updates::tests::malformed_ranges_refuse_before_any_rule_changes ... ok
test iptables::tests::initiating_prefixes_cover_only_owned_intervals_even_at_family_boundaries ... ok
test access_updates::tests::grouping_never_crosses_an_unchanged_protected_peer ... ok
test iptables::tests::replacement_retains_established_rules_and_does_not_duplicate_hooks ... ok
test access_updates::tests::compact_rules_reconstruct_the_exact_config_and_preserve_server_access ... ok
test netlink::tests::malformed_lengths_and_padding_are_rejected ... ok
test netlink::tests::nested_attributes_roundtrip_without_copying_payloads ... ok
test netlink::tests::host_prefix_decoder_refuses_ambiguous_or_malformed_ownership ... ok
test node::rotation_tests::nf_tables_restart_fences_retained_replacement_address ... ignored, Run in a disposable user/network namespace, #173.
test node::rotation_tests::nft_restart_fences_retained_replacement_address ... ignored, Run in a disposable user/network namespace, #173.
test access_updates::tests::identity_changes_and_snapshots_keep_the_original_encoding ... ok
test node::tests::chunked_snapshot_is_atomic_and_applies_1000_kernel_peers ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN; use release for timing.
test netlink::tests::public_host_prefixes_decode_both_families_without_claiming_subnets ... ok
test node::tests::explicit_up_recovers_disabled_intent_before_reusing_identity ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test node::tests::externally_removed_interface_does_not_block_down ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test node::tests::server_identity_cannot_change_inside_a_staged_snapshot ... ok
test node_actions::identity_upgrade_tests::ordinary_identity_reply_retains_the_legacy_shape ... ok
test netlink::tests::connection_tuple_uses_initiating_service_and_refuses_ambiguous_selectors ... ok
test node_actions::peer_page_tests::poll_cost ... ignored, measurement
test node_actions::tests::applied_server_route_and_observed_link_survive_only_explicit_component_up ... ignored, Run inside a dedicated kernel namespace with CAP_NET_ADMIN.
test node_actions::tests::failed_cleanup_reports_stopping_and_reconnect_keeps_explicit_off ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test node_actions::tests::node_actions_refuse_alternate_forms_duplicates_and_unbounded_input ... ok
test node_actions::tests::node_actions_register_without_kernel_work_and_hide_machine_calls ... ok
test firewall::tests::removal_plan_cannot_add_permissions_or_change_identity ... ok
test iptables::tests::contiguous_open_members_use_ranges_without_opening_gaps ... ok
test node_coordination::tests::refused_listener_replacement_preserves_the_current_lease ... ok
test firewall::tests::rule_count_is_independent_of_membership_and_policy_data_is_in_sets ... ok
test node_actions::peer_page_tests::peer_pages_cover_every_peer_once_within_the_frame ... ok
test node_coordination::tests::a_reported_hostname_names_a_host_added_by_address ... ok
test node_coordination::tests::explicit_off_waits_for_up_and_reconnect_requests_a_snapshot ... ok
test node_presentation::tests::a_wide_table_stays_within_the_width ... ok
test node_presentation::tests::an_unproven_peer_gets_a_hint_that_names_it ... ok
test node_presentation::tests::legacy_status_remains_readable_and_invalid_link_is_refused ... ok
test node_presentation::tests::peers_show_units_ages_and_no_hint_when_every_path_is_direct ... ok
test node_state::order_tests::accepted_snapshot_persistence_at_1000_peers ... ignored, Run release on the locked performance VM; public-state persistence at 1000 peers.
test node_presentation::tests::status_explains_the_observed_server_transport ... ok
test node_state::order_tests::exact_legacy_binding_upgrade_preserves_the_revision_fence ... ok
test node_state::order_tests::explicit_off_can_replace_a_corrupt_public_snapshot ... ok
test node_state::order_tests::stale_and_conflicting_snapshots_cannot_replace_acknowledged_intent ... ok
test node_coordination::tests::legacy_host_daemon_and_ip_record_do_not_leave_a_uuid_mesh_name ... ok
test node_coordination::tests::peer_route_precedes_configuration_and_retires_with_the_node ... ok
test node_state::restore_tests::public_state_restore_at_1000_peers ... ignored, Run only on the perf VM under its lock; INFRATERNAL_STATE_RESTORE_MODE=reader|slice, separate processes.
test node_state::restore_tests::restore_rejects_invalid_schema_trailing_data_and_unsafe_descriptors ... ok
test node_state::tests::explicit_off_survives_restart_and_snapshot_contains_only_public_fields ... ok
test node_state::tests::route_recording_preserves_the_legacy_accepted_state_format ... ok
test node_state::tests::unsafe_route_journal_and_existing_temporary_files_are_preserved ... ok
test node_state::tests::unsafe_snapshots_and_preexisting_temporary_files_are_not_followed_or_removed ... ok
test presence::tests::a_mesh_that_is_off_shows_nobody_online ... ok
test presence::tests::a_page_cursor_is_followed ... ok
test presence::tests::a_reading_expires_when_the_node_stops_answering ... ok
test presence::tests::a_recent_handshake_is_online_on_a_direct_path ... ok
test presence::tests::an_unreadable_node_is_no_reading ... ok
test presence::tests::no_handshake_a_stale_one_or_a_future_one_is_offline ... ok
test presence::tests::nodes_go_offline_twenty_seconds_after_the_last_good_reading ... ok
test presence::tests::receiving_a_keepalive_does_not_shorten_the_session_window ... ok
test presence::tests::replace_reports_only_visible_changes ... ok
test presence::tests::the_edge_of_the_session_window_is_still_online ... ok
test node_coordination::tests::a_name_a_person_chose_is_kept ... ok
test presence::tests::traffic_proves_a_session_until_it_ends ... ok
test presence::tests::the_server_and_a_peer_passing_traffic_are_online ... ok
test settings::tests::settings_objects_are_bounded_and_strict_before_storage ... ok
test store::naming_tests::a_numeric_or_invalid_address_gives_no_name ... ok
test store::naming_tests::an_address_or_hostname_gives_the_machines_name ... ok
test node_coordination::tests::placeholder_names_become_the_machines_names ... ok
test node_coordination::tests::server_listener_belongs_to_applied_enabled_worker ... ok
test node_coordination::tests::removed_binding_can_attach_only_after_authorized_reenrollment ... ok
test node_coordination::tests::refused_delta_recovers_immediately_and_closed_channel_retires_worker ... ok
test node_state::order_tests::concurrent_workers_serialize_revision_check_and_publication ... ok
test node_coordination::tests::two_hosts_reporting_the_same_hostname_receive_distinct_names ... ok
test node_state::order_tests::worker_start_stop_apply_interleavings_never_decrease_acknowledged_revision ... ok
test node_state::restore_tests::public_restore_retains_large_intent_and_matches_reader ... ok

test result: ok. 62 passed; 0 failed; 14 ignored; 0 measured; 0 filtered out; finished in 0.95s

     Running tests/access_updates.rs (target/debug/deps/access_updates-6c0b75916bade2fb)

running 8 tests
test nf_tables_compact_delta_preserves_identity_and_refuses_invalid_bases ... ignored, Run in an isolated user/network namespace with CAP_NET_ADMIN.
test nft_compact_delta_preserves_identity_and_refuses_invalid_bases ... ignored, Run in an isolated user/network namespace with CAP_NET_ADMIN.
test ordinary_up_and_identity_keep_the_legacy_reply_shape ... ignored, requires an isolated user/network namespace
test compact_identity_support_requires_an_explicit_strict_probe ... ok
test range_objects_reject_unknown_duplicate_and_positional_fields ... ok
test default_tightening_at_1000_peers_fits_one_round_trip ... ok
test negotiated_access_chunk_is_accepted_by_the_strict_action_parser ... ok
test uniform_changes_fit_one_frame_after_churn_with_distinct_kept_services ... ok

test result: ok. 5 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/authorized_local_binding.rs (target/debug/deps/authorized_local_binding-b6b26d570b067f6d)

running 2 tests
test nf_tables_local_binding_and_address_recovery ... ignored, Run in a disposable user/network namespace, #173.
test nft_local_binding_and_address_recovery ... ignored, Run in a disposable user/network namespace, #173.

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/canonical_host_binding.rs (target/debug/deps/canonical_host_binding-0ec32ae358bf6ad1)

running 1 test
test enrollment_requires_canonical_host_uuid_spelling ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s

     Running tests/configuration.rs (target/debug/deps/configuration-0de68586e97bee0e)

running 5 tests
test edition_default_is_explicit_and_build_selected ... ok
test chunks_fit_body_budget_and_one_peer_delta_does_not_repeat_the_snapshot ... ok
test port_grant_narrows_allow_opens_deny_and_preserves_direction ... ok
test compiled_chunks_identify_the_server_and_old_snapshots_have_no_proposal ... ok
test large_valid_port_policy_is_split_without_a_port_count_cap ... ok

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.50s

     Running tests/kernel.rs (target/debug/deps/kernel-732bb29c82236aac)

running 6 tests
test bulk_retirement_preserves_identity_and_routes_at_1000_peers ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test created_interface_is_marked_for_restart_adoption ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test policy_table_route_conflict_is_refused ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test real_kernel_chunked_peers ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test real_kernel_ephemeral_identity ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.
test retired_host_routes_can_be_replayed ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/naming.rs (target/debug/deps/naming-67721c923ce04b05)

running 4 tests
test a_squatter_yields_to_a_host_added_later_and_the_renames_are_audited ... ok
test the_servers_names_are_kept_for_the_server ... ok
test a_viewer_without_host_facts_does_not_see_reported_hostnames ... ok
test a_person_takes_an_automatic_name_and_the_machine_moves_aside ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s

     Running tests/policy_enrollment_binding.rs (target/debug/deps/policy_enrollment_binding-84309e9d9646f2a1)

running 4 tests
test noncanonical_host_binding_is_refused ... ok
test host_binding_requires_global_authority_and_existing_unrevoked_host ... ok
test refused_enrollment_preserves_removal_and_revision ... ok
test explicit_binding_preserves_identity_and_clears_removal_only_on_enrollment ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s

     Running tests/policy_enrollment_identity.rs (target/debug/deps/policy_enrollment_identity-8f6318f610da3137)

running 1 test
test unbound_enrollment_public_key_is_not_host_authority ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s

     Running tests/policy_snapshot_ordering.rs (target/debug/deps/policy_snapshot_ordering-0c4e4947e7b6f346)

running 6 tests
test nf_tables_equal_version_conflicting_snapshot_is_refused ... ignored, Run in a disposable user/network namespace, #173.
test nf_tables_snapshot_cannot_replace_local_node_identity ... ignored, Run in a disposable user/network namespace, #173.
test nf_tables_split_snapshot_replay_requires_complete_identical_contents ... ignored, Run in a disposable user/network namespace, #173.
test nft_equal_version_conflicting_snapshot_is_refused ... ignored, Run in a disposable user/network namespace, #173.
test nft_snapshot_cannot_replace_local_node_identity ... ignored, Run in a disposable user/network namespace, #173.
test nft_split_snapshot_replay_requires_complete_identical_contents ... ignored, Run in a disposable user/network namespace, #173.

test result: ok. 0 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/presence.rs (target/debug/deps/presence-416ba096352b47ca)

running 2 tests
test nodes_the_server_sees_are_online_with_their_path_and_named_by_machine ... ok
test an_unchanged_reading_is_not_announced_and_a_lost_session_goes_offline ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.17s

     Running tests/restart_route_ownership.rs (target/debug/deps/restart_route_ownership-50aed494b291fb2d)

running 1 test
test orphan_route_retirement_preserves_foreign_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_authorized_reenrollment.rs (target/debug/deps/review_authorized_reenrollment-240f0b9bcc475ff4)

running 2 tests
test nf_tables_authorized_reenrollment_reaches_the_live_node ... ignored, Run in a disposable user/network namespace, #173.
test nft_authorized_reenrollment_reaches_the_live_node ... ignored, Run in a disposable user/network namespace, #173.

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_endpoint_transaction.rs (target/debug/deps/review_endpoint_transaction-1d8c533a7bd82181)

running 1 test
test refused_endpoint_persistence_preserves_kernel_endpoint ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_firewall_marker.rs (target/debug/deps/review_firewall_marker-25ac92a90d00110e)

running 2 tests
test nf_tables_marker_substring_is_not_chain_ownership ... ignored, Run in a disposable user/network namespace, #173.
test nft_marker_substring_is_not_table_ownership ... ignored, Run in a disposable user/network namespace, #173.

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_ingress_translation.rs (target/debug/deps/review_ingress_translation-d9d8ebc8fe85d913)

running 2 tests
test nf_tables_translated_underlay_ingress_is_refused ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.
test nft_translated_underlay_ingress_is_refused ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_local_delivery.rs (target/debug/deps/review_local_delivery-e49642105fa6a9b5)

running 2 tests
test nf_tables_node_local_mesh_delivery_remains_available ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.
test nft_node_local_mesh_delivery_remains_available ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_mesh_presence_r4.rs (target/debug/deps/review_mesh_presence_r4-ed87dd29fd72e578)

running 3 tests
test a_counter_reset_discards_the_previous_peers_keepalive_classification ... ok
test a_passive_keepalive_does_not_turn_later_silence_into_a_false_offline ... ok
test a_peer_with_25_second_keepalives_stays_online_when_server_keepalives_suppress_its_sends ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_mesh_view_truth.rs (target/debug/deps/review_mesh_view_truth-3c87c5e84e154ac7)

running 6 tests
test an_address_that_is_an_ip_never_becomes_a_name ... ok
test a_hand_set_name_equal_to_the_placeholder_is_kept ... ok
test a_remote_machine_cannot_be_called_server ... ok
test a_remote_machine_cannot_take_the_servers_hostname ... ok
test a_host_record_name_beats_another_machines_reported_hostname ... ok
test a_peer_does_not_stay_online_past_its_session_when_the_server_node_stops_answering ... ok

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.32s

     Running tests/review_mesh_view_truth_r2.rs (target/debug/deps/review_mesh_view_truth_r2-3dc0c6323fa7aba1)

running 9 tests
test a_hex_ipv4_spelling_never_becomes_a_name ... ok
test evidence_a_silent_peer_expires_with_its_session_without_flapping ... ok
test the_previous_release_starts_on_a_database_this_release_migrated ... ignored, deploy gate, not code: production rollback restores the database copy (#236)
test an_idle_healthy_peer_without_its_own_keepalive_stays_online ... ok
test no_viewer_sees_a_remote_machine_called_server ... ok
test a_node_moved_aside_keeps_its_name_on_its_next_attach ... ok
test a_person_can_take_a_name_a_machine_reported ... ok
test a_viewer_without_host_facts_still_sees_distinct_names ... ok
test evidence_migrations_0026_and_0029_upgrade_a_realistic_database_without_churn ... ok

test result: ok. 8 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.30s

     Running tests/review_mesh_view_truth_r3.rs (target/debug/deps/review_mesh_view_truth_r3-a6fc40ee7cc78c2d)

running 5 tests
test an_idle_peer_that_started_its_session_stays_online_until_it_rekeys ... ok
test a_dead_peer_expires_at_session_end_without_inferring_a_sending_promise ... ok
test a_scoped_manager_cannot_rename_a_node_outside_their_scope_by_taking_its_name ... ok
test a_non_owner_cannot_confirm_the_servers_hidden_hostname ... ok
test a_node_moved_aside_by_a_person_is_audited_under_that_person ... ok

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s

     Running tests/review_mesh_view_truth_r4.rs (target/debug/deps/review_mesh_view_truth_r4-14ae25f6e4aea803)

running 7 tests
test a_name_chosen_while_rewound_survives_rolling_forward_and_reattaching ... ok
test a_global_manager_cannot_probe_a_hidden_name_by_exhausting_move_aside_names ... ok
test evidence_server_hostname_moves_only_with_server_rename_authority ... ok
test a_scoped_manager_cannot_confirm_a_hidden_reported_hostname ... ok
test evidence_a_refused_move_rolls_back_inventory_audit_and_revision ... ok
test rewind_reconciles_same_spelling_choices_without_freezing_untouched_names ... ok
test hidden_names_are_indistinguishable_for_every_non_global_node_manager ... ok

test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.82s

     Running tests/review_restart_routes.rs (target/debug/deps/review_restart_routes-795ecc3a32dd4868)

running 1 test
test restart_retires_orphan_peer_host_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_retire_ownership.rs (target/debug/deps/review_retire_ownership-1fe996dbb91c0fcc)

running 7 tests
test retire_checks_every_object_before_deleting_any ... ignored, Run as root in a disposable network namespace with nft.
test retire_decides_every_object_and_leaves_a_foreign_table ... ignored, Run as root in a disposable network namespace with WireGuard and nft.
test retire_leaves_a_foreign_interface_without_failing_the_uninstall ... ignored, Run as root in a disposable network namespace.
test retire_leaves_a_marked_interface_this_installation_never_recorded ... ignored, Run as root in a disposable network namespace.
test retire_leaves_another_installations_interface_and_filter ... ignored, Run as root in a disposable network namespace with WireGuard and nft.
test retire_removes_the_interface_and_filter_this_installation_created ... ignored, Run as root in a disposable network namespace with WireGuard and nft.
test retire_with_a_record_leaves_a_foreign_interface_and_names_it ... ignored, Run as root in a disposable network namespace with WireGuard and nft.

test result: ok. 0 passed; 0 failed; 7 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_reverse_recreation.rs (target/debug/deps/review_reverse_recreation-d57fce130b610727)

running 4 tests
test nf_tables_ipv4_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173.
test nf_tables_ipv6_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173.
test nft_ipv4_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173.
test nft_ipv6_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173.

test result: ok. 0 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_revoked_host_policy.rs (target/debug/deps/review_revoked_host_policy-3915d7cdf7df35ec)

running 1 test
test revoked_host_is_not_retained_in_compiled_peer_policy ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.13s

     Running tests/review_route_inventory.rs (target/debug/deps/review_route_inventory-079332a95aa11fed)

running 2 tests
test refused_recovery_inventory_save_does_not_retire_kernel_peers_or_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.
test restart_preserves_unrecorded_direct_host_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_route_scope.rs (target/debug/deps/review_route_scope-30e7cc6ce86bb003)

running 1 test
test restart_preserves_operator_gateway_host_route ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN.

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_shutdown_budget.rs (target/debug/deps/review_shutdown_budget-3250236508bffc56)

running 1 test
test shipping_mesh_down_1000_peers_finishes_within_one_second ... ignored, Run in a dedicated user/network namespace under CPUWeight=10000 with INFRATERNAL_BIN pointing to the shipping release binary.

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_shutdown_restart.rs (target/debug/deps/review_shutdown_restart-b0c60e43a05ca892)

running 3 tests
test crash_child ... ignored, Child-only fixture for the weighted user/network namespace restart proof.
test refused_journal_retirement_keeps_stopping_until_explicit_retry ... ignored, Run inside a dedicated user/network namespace under CPUWeight=10000.
test restart_finishes_interrupted_down_at_1000_peers ... ignored, Run inside a dedicated user/network namespace under CPUWeight=10000.

test result: ok. 0 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/settings.rs (target/debug/deps/settings-5025fdff01951a79)

running 1 test
test default_switch_requires_owner_freshness_and_the_preview_revision ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s

     Running tests/store.rs (target/debug/deps/store-20d436fbf2a30450)

running 6 tests
test required_server_membership_cannot_be_deleted ... ok
test absent_discovery_preserves_the_last_known_endpoint ... ok
test key_replacement_preserves_identity_and_addresses_after_restart ... ok
test removed_host_cannot_restore_membership_without_authorized_enrollment ... ok
test scale_preview_pages_do_not_allocate_the_pair_matrix ... ok
test attach_cancelled_at_any_await_leaves_the_store_writable ... ok

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.98s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_relay-383c990964aaac19)

running 1 test
test cli::tests::relay_actions_are_complete_and_unavailable_until_runtime_exists ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_release-5ef5523a0f0a2ea2)

running 90 tests
test generation::download::tests::invalid_signed_offer_never_acquires_or_modifies_download_storage ... ok
test generation::download::tests::signed_version_file_must_bind_the_offered_version_before_acquisition ... ok
test generation::download::tests::unsafe_download_entries_are_neither_followed_nor_removed ... ok
test generation::download::tests::chunk_gaps_rewinds_excess_and_corrupted_complete_image_are_refused ... ok
test generation::download::tests::clear_download_requires_exclusive_ownership_and_preserves_unknown_entries ... ok
test generation::download::tests::signed_download_resumes_after_disconnect_without_selecting_or_reading_credentials ... ok
test generation::download::tests::interrupted_oversized_or_shared_payload_is_not_repaired_or_resumed ... ok
test generation::host_tests::oversized_host_credentials_are_refused_before_adoption_publishes_selection ... ok
test generation::host_prepare::tests::host_preparation_rejects_unsigned_or_unrequested_backwards_transitions ... ok
test generation::host_prepare::tests::host_preparation_rejects_a_changed_execution_snapshot_before_creating_candidate ... ok
test generation::download::tests::a_new_signed_offer_retires_only_the_previous_transfer ... ok
test generation::host_prepare::tests::adopting_host_refuses_replacement_and_unauthenticated_images_without_new_generations ... ok
test generation::host_prepare::tests::adopting_host_publishes_signed_a_and_retains_live_credential_location ... ok
test generation::host_tests::host_adoption_retains_the_live_identity_location_until_preparation ... ok
test generation::host_tests::shared_host_identity_cannot_become_a_writable_candidate ... ok
test generation::startup::tests::metadata_aliases_and_oversized_signatures_are_refused ... ok
test generation::startup::tests::pinned_state_root_supports_private_directory_checks_after_a_rename ... ok
test generation::startup::tests::signed_adoption_pins_original_database_and_boot_configuration_independently ... ok
test generation::tests::abrupt_owner_process_exit_releases_the_installation_lock ... ok
test generation::startup::tests::signed_selection_pins_state_without_creating_or_repairing_files ... ok
test generation::host_tests::changed_retained_host_identity_refuses_commit_without_reselecting ... ok
test generation::host_prepare::tests::prepared_host_keeps_a_selected_and_uses_independent_credential_inodes ... ok
test generation::tests::adoption::installer_publication ... ok
test generation::host_tests::host_trial_keeps_known_good_identity_and_selection_until_commit ... ok
test generation::startup::tests::trial_entry_binds_only_the_prepared_candidate_while_boot_keeps_the_predecessor ... ok
test generation::tests::adoption::typed_original_binding_normalizes_once_and_never_accepts_shared_roots ... ok
test generation::tests::adoption::adoption_keeps_original_acknowledged_edits_in_the_selected_pair ... ok
test generation::startup::tests::uncommitted_signed_candidate_and_changed_version_file_cannot_boot ... ok
test generation::tests::bounded_launch_parser_refuses_unsafe_components_and_ambiguous_objects ... ok
test generation::tests::adoption::initial_state_locator_cannot_be_reused_for_a_successor_or_alias ... ok
test generation::tests::concurrent_owner_is_refused_and_kernel_releases_abandoned_ownership ... ok
test generation::tests::duplicated_lock_descriptor_keeps_installation_owned_until_its_last_close ... ok
test generation::tests::a_second_preparation_cannot_replace_the_live_transaction ... ok
test generation::tests::exhaustion::candidate_sqlite_full_does_not_require_predecessor_restore_space ... ignored, orchestrator only: disposable 32 MiB / 256 inode filesystem
test generation::tests::exhaustion::zero_inodes_need_no_current_partial_or_rollback_receipt ... ignored, orchestrator only: disposable 32 MiB / 256 inode filesystem

running 1 test
test generation::tests::exhausted_writer_reservation_cannot_admit_a_trial ... ok
test generation::tests::adoption::replaced_or_shared_original_state_refuses_boot_without_repair_writes ... ok
test generation::tests::candidate_without_signed_metadata_cannot_be_prepared ... ok
test generation::tests::adoption::retained_adopted_state_uses_the_original_database_and_generation_configuration ... ok
test generation::tests::adoption::installer_publication ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 89 filtered out; finished in 0.11s

test generation::tests::candidate_launch_retains_predecessor_database_and_configuration_digests ... ok
test generation::tests::failed_validation_never_changes_the_selected_generation ... ok
test generation::tests::dropped_trial_and_repeated_recovery_never_publish_or_write_a_selector ... ok
test generation::tests::incomplete_next_publication_preserves_selected_pair_and_retained_predecessor ... ok
test generation::tests::known_good_remains_selected_until_health_authorizes_one_pointer_commit ... ok
test generation::tests::predecessor_changes_and_uncheckpointed_wal_refuse_trial_or_commit ... ok
test generation::tests::inspecting_live_selection_preserves_sqlite_process_locks ... ok
test generation::tests::unrelated_predecessor_and_aliases_cannot_enter_a_transaction ... ok
test generation::trial_tests::transferred_ownership_must_name_this_installation_and_hold_its_lock ... ok
test generation::tests::adoption::adoption_and_failed_trial_keep_the_same_live_sqlite_acknowledgments ... ok
test generation::tests::selected_authenticates_before_touching_database_or_configuration ... ok
test host_receiver::tests::checkin_receipt_requires_the_process_owners_durable_commit ... ok
test generation::trial_tests::collection_refuses_without_a_verified_selection_and_deletes_nothing ... ok
test host_receiver::tests::corrupt_payload_and_positional_public_actions_are_refused ... ok
test host_receiver::tests::disabling_releases_the_transfer_owner_before_durable_partial_cleanup ... ok
test host_receiver::tests::down_up_cannot_revive_a_prepared_reply_from_an_old_epoch ... ok
test host_receiver::tests::dropped_commit_reply_never_requests_a_handoff ... ok
test host_receiver::tests::local_adoption_is_discoverable_locally_but_absent_from_remote_authorization ... ok
test host_receiver::tests::local_adoption_refuses_paths_unknown_fields_and_nonobject_envelopes_before_lifecycle ... ok
test host_receiver::tests::unadopted_or_paused_hosts_never_acquire_an_image ... ok
test host_receiver::tests::epoch_change_during_partial_download_refuses_further_acknowledgement ... ok
test generation::trial_tests::abandoned_attempt_is_inferred_from_the_pointer_without_any_write ... ok
test host_sender::tests::a_noncontiguous_ack_never_commits ... ok
test host_sender::tests::an_unknown_architecture_never_requests_a_payload ... ok
test host_sender::tests::disabled_host_reports_its_version_without_claiming_a_failed_transfer ... ok
test generation::trial_tests::collection_bounds_retention_to_the_selected_pair_and_its_predecessor ... ok
test host_sender::tests::offsets_follow_the_frozen_little_endian_wire_contract ... ok
test host_sender::tests::legacy_host_records_manual_update_without_exchange_or_download ... ok
test generation::trial_tests::trial_names_only_the_prepared_candidate_of_the_selected_predecessor ... ok
test host_sender::tests::temporary_setup_is_not_a_legacy_daemon ... ok
test host_receiver::tests::verified_commit_enqueues_only_after_complete_reply_write ... ok
test host_sender::tests::transfer_commit_retains_the_old_identity_until_a_new_checkin ... ok
test host_sender::tests::unverified_managed_image_requires_owner_adoption_without_seed_offer ... ok
test host_sender::tests::sixty_four_connections_share_eight_workers_and_resume_independent_file_offsets ... ok
test latest::tests::abandoned_image_staging_is_reclaimed_after_its_owner_dies ... ok
test generation::trial_tests::watchdog_resumes_only_the_prepared_trial_and_commits_it_once ... ok
test generation::tests::retained_integrity_checks_historical_state_without_freezing_selected_writes ... ok
test service::tests::authority_is_rechecked_after_the_setting_write_before_commit ... ok
test service::tests::channel_reads_at_fifty_concurrent_callers ... ignored, run alone under CPUWeight=10000; measures SQLite action overhead, not terminal or full authenticated socket latency
test service::tests::api_setting_requires_owner_and_current_fresh_session ... ok
test service::tests::default_stable_refuses_silent_edge_and_persists_explicit_opt_in ... ok
test service::tests::object_input_rejects_duplicates_unknown_fields_and_alternate_representations ... ok
test service::tests::disabled_feature_starts_no_lookup_and_rejects_settings ... ok
test latest::tests::startup_reclaims_only_owned_inactive_private_metadata ... ok
test generation::startup::tests::host_preflight_authenticates_executing_bytes_before_pinning_private_credentials ... ok
test generation::startup::tests::changed_executing_image_or_signed_launch_version_is_refused ... ok
test latest::tests::cancellation_joins_verification ... ok
test host_sender::tests::an_explicit_ack_refusal_waits_for_a_node_event ... ok
test host_sender::tests::stopping_a_host_follower_cancels_its_retry ... ok
test generation::tests::pointer_rename_and_sync_refusal_reconcile_actual_selection ... ok
test host_sender::tests::transient_exchange_recovers_without_a_node_event_and_then_quiesces ... ok

test result: ok. 87 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 3.47s

     Running tests/generation_updater.rs (target/debug/deps/generation_updater-482ebb327cb53966)

running 25 tests
test disabled_worker_performs_no_schema_maintenance_or_discovery ... ok
test a_request_trigger_revoking_owner_rolls_back_both_request_and_revocation ... ok
test a_ready_image_emits_one_toast_and_keeps_private_paths_out_of_status ... ok
test channel_switch_retires_ready_images_and_queued_requests_in_the_same_transaction ... ok
test changing_only_the_quiet_window_postpones_and_preserves_the_exact_request ... ok
test disabling_the_feature_after_download_refuses_handoff ... ok
test discovery_never_stages_an_older_same_channel_release ... ok
test an_exact_request_arriving_during_staging_keeps_its_readiness_and_notice ... ok
test failed_collection_refuses_new_staging_without_hiding_selected_service ... ok
test committed_manual_request_is_retired_before_successor_discovery ... ok
test abandoned_trial_pauses_only_that_version_across_a_second_writable_boot ... ok
test failed_trial_notice_is_available_before_discovery_runs_again ... ok
test retiring_an_unpolled_release_worker_releases_hosts_without_dropping_declarations ... ok
test explicit_retry_requires_the_exact_ready_version_and_consumes_the_request_once ... ok
test discovery_preserves_a_queued_exact_image_until_its_request_is_admitted ... ok
test rollback_discloses_historical_data_and_requires_a_current_fresh_owner ... ok
test verification_failure_never_publishes_readiness_or_a_toast ... ok
test historical_rollback_reconciles_bookkeeping_without_overlaying_restored_authority ... ok
test configuration_changes_during_preparation_refuse_final_handoff ... ok
test foreground_postponement_preserves_the_exact_manual_request_for_retry ... ok
test handoff_acknowledgement_is_not_a_successful_health_check ... ok
test worker_discovers_once_then_wakes_for_an_exact_manual_request ... ok
test authority_changes_during_generation_preparation_refuse_final_handoff ... ok
test update_subscription_delivers_state_and_one_ready_toast_then_withdraws ... ok
test retry_history_stays_bounded_without_retiring_the_live_admission ... ok

test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.48s

     Running tests/host_wire.rs (target/debug/deps/host_wire-9246a9753e4d1ea9)

running 4 tests
test artifact_names_come_only_from_supported_architectures ... ok
test metadata_refuses_positional_unknown_duplicate_and_oversized_bodies ... ok
test offsets_keep_the_frozen_nonzero_little_endian_bytes ... ok
test maximally_escaped_signed_text_fits_the_frozen_offer_envelope ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s

     Running tests/review_pool.rs (target/debug/deps/review_pool-c11d6904b63ce4e2)

running 1 test
test pending_channel_writers_preserve_authority_read_capacity ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.60s

     Running tests/review_restart.rs (target/debug/deps/review_restart-ffcb35acdbfc8d3f)

running 4 tests
test partial_metadata_restart_child ... ignored, subprocess helper for metadata restart verification
test restricted_umask_lookup_child ... ignored, subprocess helper for restricted-umask lookup verification
test lookup_creates_private_staging_under_owner_restrictive_umask ... ok
test restarted_latest_reclaims_metadata_after_process_stop ... ok

test result: ok. 2 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.14s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_remote-c41c172c6167f938)

running 122 tests
test host_boot::tests::boot_metadata_refuses_noncanonical_home_and_foreign_installation_before_io ... ok
test host_boot::tests::boot_metadata_rejects_unknown_fields_and_unsupported_formats ... ok
test host_boot::tests::private_boot_metadata_refuses_aliases_shared_modes_and_oversized_input ... ok
test host_boot::tests::retained_configuration_keeps_original_owner_and_session_coordinates ... ok
test inventory::authority_tests::inventory_events_keep_the_subscription_generation ... ok
test inventory::authority_tests::revocation_cancels_a_result_waiting_for_socket_credit ... ok
test inventory::tests::inventory_descriptor_is_valid_for_server_startup ... ok
test remote_bindings::receive_cost_tests::repeated_mesh_ingress_cost_at_one_thousand_retained_histories ... ignored, Component timing on the authorized perf VM under its fair lock; not transport acceptance.
test inventory::tests::list_input_refuses_parallel_authority_and_noncanonical_cursors ... ok
test remote_bindings::tests::alias_retirement_restores_the_previous_reply_socket ... ok
test remote_bindings::tests::an_encrypted_duplicate_cannot_move_the_reply_route ... ok
test remote_bindings::tests::a_negotiated_peer_copies_output_without_a_worker_and_off_cancels_it ... ok
test remote_bindings::tests::backup_withdrawal_reconciles_idle_peers_without_canceling_another_return ... ok
test remote_bindings::tests::lease_installed_during_a_pending_poll_cannot_lose_the_receive_wakeup ... ok
test remote_bindings::tests::dropping_one_peer_removes_alternative_work_while_another_peer_lives ... ok
test remote_bindings::tests::enrolled_dual_replies_preserve_primary_and_mesh_sources ... ok
test remote_bindings::tests::peer_route_preserves_the_logical_tuple_and_replays_on_return ... ok
test remote_bindings::tests::replies_follow_the_last_heard_address_and_leases_retire_their_routes ... ok
test remote_bindings::tests::a_lease_added_while_waiting_is_polled_without_another_primary_datagram ... ok
test remote_bindings::tests::retiring_mesh_lease_cancels_only_queued_alternative_reply ... ok
test remote_path_copies::tests::arming_after_pending_wakes_the_owned_endpoint_and_clear_drops_it ... ok
test remote_path_copies::tests::cancelling_retired_work_keeps_the_next_send_receive_wakeup ... ok
test remote_path_proof::tests::fixed_header_mac_matches_independent_sha256_vectors ... ok
test remote_path_proof::tests::mixed_aggregation_preserves_all_neighboring_quic_bytes ... ok
test remote_path_proof::tests::only_current_session_response_answers_a_sent_probe ... ok
test remote_bindings::tests::unknown_mesh_reply_waits_for_duplicate_coordinates_and_off_retires_it ... ok
test remote_path_socket::tests::a_probe_request_latches_before_its_waiter_is_polled ... ok
test remote_path_socket::tests::an_old_ack_only_send_does_not_start_a_backpressured_probe_deadline ... ignored, timed watchdog ordering proof; run under the perf VM benchmark lock
test remote_path_socket::tests::an_unrelated_reply_cannot_discard_ciphertext_needed_after_a_cut ... ok
test remote_path_socket::tests::backpressure_never_starts_or_replaces_the_probe_send_clock ... ok
test remote_bindings::tests::retiring_one_route_preserves_another_peers_enrolled_return ... ok
test remote_path_socket::tests::cancelling_old_requests_cannot_clear_a_new_probe_generation ... ok
test remote_bindings::tests::wildcard_reply_uses_the_destination_of_the_latest_peer_packet ... ok
test remote_path_socket::tests::exporting_path_keys_never_holds_the_receive_proof_lock ... ok
test remote_path_socket::tests::dedicated_receive_preserves_segmented_sends_in_single_datagram_buffers ... ok
test remote_path_socket::tests::mesh_route_maps_only_the_trusted_tuple_and_resends_unanswered_datagrams ... ok
test remote_path_socket::tests::segmented_replay_evicts_enough_old_datagrams_to_keep_the_byte_bound ... ok
test remote_peer_routes::bench::complete_tag_lookup_at_1000_peers ... ignored, Measure only on the perf VM under its benchmark lock.
test remote_peer_routes::bench::routing_lookup_at_1000_nodes ... ignored, Measure only on the perf VM under its benchmark lock.
test remote_peer_routes::copy_scan_tests::copy_poll_cost_at_one_thousand_retained_histories ... ignored, 31 bookkeeping samples per profile on the authorized perf VM under its fair lock; not transport acceptance.
test remote_path_socket::tests::send_gate_releases_only_one_successful_transmission ... ok
test remote_peer_routes::tests::alternative_admission_never_evicts_pending_enrolled_return ... ok
test remote_peer_routes::copy_scan_tests::history_mutation_after_an_idle_poll_still_sends_every_due_datagram ... ok
test remote_peer_routes::tests::alternative_backpressure_keeps_one_copy_and_hints_preserve_its_deadline ... ok
test remote_peer_routes::tests::ciphertext_history_at_1000_peers ... ignored, Measure only on the perf VM: 31 batches of 20000 fresh/duplicate pairs across 1000 peers.
test remote_peer_routes::tests::alternative_queue_shares_bounds_and_never_becomes_return_history ... ok
test remote_bindings::tests::a_copy_poll_bounds_work_before_servicing_receive ... ok
test remote_peer_routes::tests::completed_return_entries_stay_consumed_when_new_mesh_history_arrives ... ok
test remote_peer_routes::tests::completed_backup_copies_cannot_be_replayed_as_a_second_return_burst ... ok
test remote_peer_routes::tests::output_evicting_the_oldest_copy_still_copies_one_bounded_batch ... ok
test remote_peer_routes::tests::ciphertext_history_normalizes_gro_batches_and_stays_bounded ... ok
test remote_peer_routes::tests::retiring_an_old_lease_cannot_remove_a_reused_tuple ... ok
test remote_peer_routes::tests::shared_copy_clock_preserves_each_datagrams_deadline ... ok
test remote_quic::design_scale_review::authenticated_mesh_health_at_design_scale ... ignored, Perf VM only: distinct physical tuple health at 1000 mTLS connections.
test remote_quic::design_scale_review::authenticated_mesh_health_at_design_scale_100ms ... ignored, Perf VM only: authenticated physical health at 100ms cadence.
test remote_quic::design_scale_review::review_fast_mesh_health_at_design_scale ... ignored, Perf VM only: fast detector at 1000 mTLS connections.
test remote_quic::design_scale_review::review_production_adaptive_health_at_design_scale ... ignored, Perf VM only: production adaptive detector at 1000 mTLS connections.
test remote_peer_routes::tests::unsuccessful_backups_preserve_originals_for_explicit_recovery ... ok
test remote_peer_routes::tests::replay_is_bounded_for_large_segmented_transmits ... ok
test remote_path_socket::tests::negotiated_copies_use_the_enrolled_socket_and_retire_on_return ... ok
test remote_quic::probe_tests::copy_first_ack_only_probes_keep_authenticated_mesh_guard_live ... ignored, Physical 15ms/30ms guard comparison on the perf VM under its benchmark lock.
test remote_quic::probe_tests::copy_first_ack_only_requested_ack_delay_five_ms_comparison ... ignored, ACK-delay hypothesis comparison on the quiet perf VM under its benchmark lock.
test remote_bindings::tests::admitted_path_proofs_survive_mesh_retirement_and_old_key_lease_drop ... ok
test remote_bindings::tests::negotiated_enrolled_return_replay_is_bounded_and_consumed_once ... ok
test remote_bindings::tests::legacy_enrolled_return_replay_is_bounded_and_consumed_once ... ok
test remote_quic::probe_tests::review_invalid_mesh_packets_cannot_borrow_enrolled_authentication ... ignored, Perf VM only: real socket scheduling and path-response deadline.
test remote_path_socket::tests::a_delayed_probe_waiter_keeps_first_send_clock_after_ack_only_traffic ... ok
test remote_quic::mtu_tests::both_directions_keep_a_mesh_safe_payload_after_discovery ... ok
test remote_quic::tests::mesh_liveness_keeps_authentication_and_refuses_invalid_intervals ... ok
test remote_path_socket::tests::an_old_ack_only_send_cannot_complete_probe_emission ... ok
test remote_quic::probe_tests::lost_path_proof_spends_its_reserved_retry_margin ... ok
test remote_quic::tests::wrong_server_name_never_yields_authenticated_connection ... ok
test remote_quic::tests::repeated_native_id_has_distinct_server_writer_authority_and_preserves_suffix ... ok
test remote_renewal::tests::credential_snapshot_does_not_block_async_reconnect ... ok
test remote_quic::tests::host_cannot_open_a_second_server_control_stream ... ok
test remote_tls::tests::outgoing_tcp_detects_a_vanished_peer_without_application_traffic ... ok
test remote_quic::probe_tests::copy_first_real_mesh_originals_do_not_strand_the_authenticated_mesh_guard ... ok
test remote_tls::tests::mutual_tls_delivers_exact_bytes_and_verified_leaf_fingerprints ... ok
test remote_bindings::tests::alternating_fresh_hints_cannot_amplify_retained_ciphertext ... ok
test remote_tls::tests::untrusted_client_never_reaches_server_admission ... ok
test runtime_lock::tests::a_live_legacy_runtime_cannot_publish_an_unheld_lifetime_file ... ok
test runtime_lock::tests::cleanup_admission_prevents_starting_even_if_runtime_lock_was_removed ... ok
test runtime_lock::tests::dump_datagrams_split_exactly ... ok
test runtime_lock::tests::dump_records_accept_only_known_shapes ... ok
test runtime_lock::tests::existing_recovery_lock_is_read_only_exclusive_and_never_created ... ok
test runtime_lock::tests::fixture_state::deep_root_keeps_real_sockets_private_and_cleans_up_on_drop ... ok
test runtime_lock::tests::foreign_inode_twin_inner ... ignored, runs inside the namespace prepared by the foreign-inode test
2
test runtime_lock::tests::internal_dispatch_checks_exact_argument_counts ... ok
test runtime_lock::tests::internal_dispatch_reads_only_the_normal_command_name ... ok
test remote_quic::probe_tests::healthy_path_proofs_keep_the_configured_polling_interval ... ok
test runtime_lock::tests::legacy_inspection_finds_a_real_bound_socket ... ok
test runtime_lock::tests::legacy_inspection_is_independent_of_the_bound_name ... ok
test runtime_lock::tests::lifetime_contention_preserves_would_block ... ok
test runtime_lock::tests::lifetime_precedes_bind_and_survives_until_last_description_closes ... ok
test runtime_lock::tests::lock_links_and_replacements_are_refused ... ok
test runtime_lock::tests::managed_start_refuses_another_host_and_an_unfinished_receipt ... ok
test remote_tls::tests::untrusted_server_or_wrong_server_name_is_refused_before_bytes ... ok
test runtime_lock::tests::split_device_inner ... ignored, runs inside the namespace prepared by the split-device test
test runtime_lock::tests::session_inspection_finds_bound_endpoints_by_identity ... ok
test runtime_lock::tests::unavailable_lock_support_does_not_claim_a_live_holder ... ok
test uninstall::tests::a_failed_kernel_check_stops_cleanup_before_the_service ... ok
test remote_tls::tests::cancelled_partial_write_cannot_reuse_the_channel ... ok
test uninstall::tests::bootstrap_lock_delays_uninstall_without_omitting_its_handler ... ok
test uninstall::tests::file_removal_keeps_what_setup_did_not_create ... ok
test uninstall::tests::generation_boot_adoption_cleanup_preserves_foreign_updates ... ok

running 1 test
test runtime_lock::tests::foreign_inode_twin_inner ... 
running 1 test
test runtime_lock::tests::split_device_inner ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s

ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s

test runtime_lock::tests::legacy_bound_endpoint_on_a_split_device_filesystem_is_kept ... ok
test runtime_lock::tests::stale_session_endpoint_is_not_held_live_by_a_foreign_inode_twin ... ok
test uninstall::tests::replies_name_the_objects_left_as_valid_json ... ok
test uninstall::tests::manual_uninstall_refuses_another_hosts_installation ... ok
test uninstall::tests::generation_boot_adoption_preserves_legacy_launcher_and_uninstall_authority ... ok
test uninstall::tests::review_planted_plan_is_never_followed ... ok
test uninstall::tests::review_failed_launcher_leaves_no_plan ... ok
test remote_quic::probe_tests::enrolled_copy_replies_cannot_keep_a_dead_mesh_path_alive ... ok
test uninstall::tests::uninstall_never_accepts_request_selected_paths_or_foreign_identity ... ok
test uninstall::tests::accepted_handoff_runs_on_a_thread_without_an_async_runtime ... ok
test runtime_lock::tests::after_close_waits_for_a_slow_socket_snapshot ... ok
test uninstall::tests::retirement_signals_the_shell_after_its_foreground_job_exits ... ok
test remote_quic::probe_tests::a_queued_probe_cannot_expire_before_the_socket_emits_it ... ok
test remote_quic::tests::acknowledged_idle_survives_and_replayed_packets_cannot_mask_failure ... ok
test remote_quic::tests::one_way_authenticated_output_keeps_the_path_fresh ... ok
test remote_tls::tests::stalled_write_retires_both_directions_without_idle_polling ... ok
test uninstall::tests::uninstall_and_setup_exclude_each_other ... ok

test result: ok. 107 passed; 0 failed; 15 ignored; 0 measured; 0 filtered out; finished in 5.38s

     Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-8d082a4bdba0dbd9)

running 50 tests
test auth_evidence::tests::partial_and_malformed_receipts_are_not_method_evidence ... ok
test auth_evidence::tests::receipt_is_identical_at_every_chunk_boundary ... ok
test auth_evidence::tests::selected_local_authentication_diagnostics_keep_method_at_every_boundary ... ok
test auth_evidence::tests::later_local_key_receipt_supersedes_an_earlier_banner ... ok
test auth_once::tests::caller_cannot_choose_or_extend_the_expiry_clock ... ok
test auth_once::tests::each_method_consumes_once_and_expiry_erases_both_methods ... ok
test auth_order::tests::pending_forwards_the_caller_deadline_to_its_selected_session ... ok
test auth_order::tests::only_exact_generated_read_only_checks_can_choose_credentials ... ok
test auth_once::tests::invalid_material_is_refused_before_any_helper_or_scheduling ... ok
test config::tests::flattened_quoted_public_filenames_are_refused_when_existing_trust_would_be_lost ... ok
test config::tests::trust_lookup_uses_every_explicit_alias_verbatim ... ok
test bootstrap::proof_tests::failed_published_facts_clean_only_the_private_probe_and_never_commit ... ok
test bootstrap::proof_tests::published_proofs_start_together_and_commit_requires_both ... ok
test config::tests::unresolved_or_relative_public_paths_cannot_admit_first_contact ... ok
test install::tests::compaction_drops_only_comment_lines_and_indentation ... ok
test bootstrap::proof_tests::review_stopped_commit_channel_finishes_the_private_probe ... ok
test install::tests::embedded_setup_programs_have_no_constructs_compaction_would_change ... ok
test bootstrap::proof_tests::review_stalled_commit_cannot_outlive_attempt_cap ... ok
test bootstrap::proof_tests::review_commit_clamps_outliers_and_releases_immediately ... ok
test duplex::tests::duplex_preserves_binary_bytes_in_both_directions ... ok
test config::tests::malformed_public_policy_is_refused_before_it_can_change_command_arguments ... ok
test cli::tests::ssh_actions_are_complete_and_marked_unavailable ... ok
test duplex::tests::closed_receipt_channel_is_reported_as_unreachable ... ok
test payload::tests::payload_hash_cache_at_1600_adds ... ignored, #190 public payload hash/cache measurements on the locked perf VM only
test install::tests::transfer_caps_accept_only_the_fixed_record ... ok
test manifest::tests::node_provisioning_declares_an_existing_server_and_only_node_components ... ok
test model::failure_serialization_tests::uuid_reference_uses_the_outcome_specific_wire_key ... ok
test model::failure_serialization_tests::wire_format_is_exact_and_failure_stays_small ... ok
test payload::tests::concurrent_adds_share_the_cached_digest_allocation ... ok
test payload::tests::settings_changes_keep_at_most_four_entries ... ok
test config::tests::configured_private_sources_are_excluded_and_public_trust_is_retained ... ok
test prompt::tests::reply_fixture ... ignored, private subprocess for the one-reply peer oracle
test payload_encoding::tests::small_payloads_retain_raw_streaming ... ok
test session_bridge::tests::failed_dispatcher_does_not_publish_a_session ... ok
test prompt_image::tests::helper_identity_refuses_in_place_and_path_replacement ... ok
test session_bridge::tests::publication_and_dispatcher_greeting_share_the_first_write ... ok
test setup::tests::exhausted_setup_failure_retains_reason_without_offering_retry ... ok
test setup::tests::host_status_outlives_its_subscriber_and_keeps_exact_identity ... ok
test socket_connector::tests::connected_socket_has_nodelay_before_any_application_bytes ... ok
test payload::tests::replacement_and_removal_never_reuse_a_path_name_digest ... ok
test socket_connector::tests::invalid_endpoint_cannot_send_a_descriptor ... ok
test test_common::deep_scratch_fallback_is_private_short_and_owned ... ok
test socket_connector::tests::descriptor_delivery_keeps_the_exact_peer_after_helper_copy_closes ... ok
test transport::secret_tests::secret_input_has_a_fixed_bound_and_accepts_only_strings ... ok
test stdio::tests::pipes_preserve_bytes_and_do_not_escape_into_child_exec ... ok
test payload_encoding::tests::binary_replacement_never_reuses_the_previous_encoding ... ok
test payload_encoding::tests::gzip_roundtrip_and_repeated_adds_share_one_encoding ... ok
test session_bridge::tests::publication_prefix_preserves_every_dispatcher_byte_across_reads ... ok
test payload::tests::same_size_in_place_edits_with_restored_mtime_invalidate_the_digest ... ok
test prompt::tests::helper_reply_requires_the_registered_parent_and_is_served_once ... ok

test result: ok. 48 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.74s

     Running tests/already_added_breakit.rs (target/debug/deps/already_added_breakit-ce6c620dce3c3962)

running 1 test
test a_host_key_challenge_never_serializes_as_a_host_id ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/auth_order.rs (target/debug/deps/auth_order-8e85048c5ebab929)

running 11 tests
test authentication_never_replays_a_mutating_first_command_or_reuses_a_failed_scope ... ok
test automatic_checked_channel_selects_bridge_after_read_only_authentication ... ok
test later_command_auth_errors_never_restart_the_selected_method_sequence ... ok
test manual_hosts_try_available_methods_without_a_separate_none_refusal ... ok
test manual_method_trust_refusal_never_loads_later_credentials ... ok
test only_exhausted_auth_returns_typed_choose_method ... ok
test ownership_checks_authenticate_once_without_replaying_a_different_check ... ok
test successful_authentication_is_reported_and_later_secrets_are_never_requested ... ok
test ownership_check_fallback_repeats_only_the_allowlisted_read_only_command ... ok
test trust_network_and_remote_command_failures_stop_without_loading_local_secrets ... ok
test cancelling_authentication_consumes_the_attempt_without_requesting_secrets ... ok

test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/build_removal.rs (target/debug/deps/build_removal-30a0cc1acc5feaf3)

running 1 test
test build_without_default_plugins_excludes_ssh_dependency ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s

     Running tests/concurrency.rs (target/debug/deps/concurrency-bbc1bc9092aff035)

running 8 tests
test a_thousand_admitted_targets_keep_eight_active_backend_calls ... ignored, explicit CPUWeight10000 scale measurement with a controlled unavailable backend
test entire_batch_validates_before_start_and_duplicates_are_refused ... ok
test an_interrupted_disable_keeps_admission_closed_until_its_adapter_retires ... ok
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test authenticated_batches_retain_an_opaque_session_for_trusted_issuance ... ok
test concurrency_is_eight_across_batches_and_all_ten_hosts_fail_independently ... ok
test turning_off_drains_queued_work_and_reenable_never_resumes_old_batches ... ok
test component_off_retires_a_real_native_helper ... ok

test result: ok. 7 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.02s

     Running tests/config_isolation.rs (target/debug/deps/config_isolation-2da6cb6f83b54eb6)

running 3 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test synthetic_master_socket_is_private_at_creation ... ok
test configured_identity_paths_are_not_inherited_by_the_command_child ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s

     Running tests/credentials.rs (target/debug/deps/credentials-cb856c698b8d8ca2)

running 5 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test credential_helper_refuses_host_trust_and_permission_prompts ... ok
test password_helpers_prepare_a_fresh_private_root_and_remove_only_their_directory ... ok
test password_socket_refuses_an_unrelated_same_user_process ... ok
test kernel_running_helper_is_materialized_in_its_private_scope ... ok

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.39s

     Running tests/diagnostics.rs (target/debug/deps/diagnostics-963255bde00ff4d6)

running 12 tests
test effective_configuration_never_scans_a_proxy_or_invalid_endpoint ... ok
test control_probe_statuses_preserve_actionable_setup_messages ... ok
test engine_failures_keep_their_ssh_boundary_without_remote_bytes ... ok
test every_failed_step_names_the_step_and_a_next_action ... ok
test dynamic_public_trust_is_retained_without_becoming_file_only_admission ... ok
test bootstrap_status_mapping_covers_each_step_and_approved_mode ... ok
test failed_join_retains_only_the_allowlisted_host_dns_error ... ok
test failure_diagnostics_distinguish_auth_trust_transport_and_channel_without_raw_text ... ok
test remote_command_text_is_not_ssh_authority_and_never_enters_logs ... ok
test status_mapping_preserves_authentication_and_missing_payload_classification ... ok
test mesh_policy_requires_both_discovery_facts_and_a_transport_refusal ... ok
test script_status_diagnostics_are_honest_for_all_nonzero_codes ... ok

test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/event_metadata.rs (target/debug/deps/event_metadata-6c590fa3b00a3c8b)

running 1 test
test unsupported_host_reports_method_and_retry_never_replays_it_as_current ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/foreground.rs (target/debug/deps/foreground-7c2b761a52f2b118)

running 2 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test configured_backgrounding_is_overridden_for_owned_bootstrap_commands ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s

     Running tests/host_trust.rs (target/debug/deps/host_trust-4889cdefe4e54511)

running 2 tests
test configured_known_hosts_command_revocation_cannot_offer_first_contact ... ignored, run through research/ssh-client/measure.py with its synthetic public host key
test first_contact_needs_fresh_authority_and_never_replaces_existing_trust ... ignored, run through research/ssh-client/measure.py --negative-trust-oracle with its memory-held synthetic key

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/install.rs (target/debug/deps/install-d6f01f69ae41df83)

running 96 tests
test breakit2_stage_refuses_parent_that_cannot_be_rolled_back ... ok
test command_failure_names_upload_join_install_and_start_separately ... ok
test buffering_setup_reader_receives_no_payload_until_selection ... ok
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test acknowledged_linger_noop_does_not_own_later_external_enable ... ok
test cleanup_receipt_cannot_authorize_a_replaced_unowned_directory ... ok
test active_transaction_is_live_between_ssh_setup_commands ... ok
test breakit2_rollback_preserves_foreign_launcher_new ... ok
test breakit2_rollback_preserves_foreign_unit_new ... ok
test breakit2_interrupted_lock_creation_allows_cleanup_and_retry ... ok
test active_service_stop_failure_never_replaces_live_artifacts ... ok
test compound_join_failure_preserves_the_original_status_and_boundary ... ok
test compound_restaging_refuses_a_foreign_journal_before_upload ... ok
test declared_transfer_sends_the_payload_before_any_selection_receipt ... ok
test declared_transfer_refuses_a_different_selection_or_a_named_refusal ... ok
test duplex_check_refuses_named_failures_and_oversized_records_before_staging ... ok
test earlier_attempt_classification_preserves_status_boundary_and_authentication ... ok
test earlier_attempt_records_reject_suffixes_truncation_and_unbounded_counts ... ok
test compressed_stage_roundtrips_and_rejects_corruption_before_execution ... ok
test control_cleanup_never_follows_a_socket_symlink_or_removes_regular_data ... ok
test early_staging_preserves_canonical_foreign_root_refusal ... ok
test compound_setup_keeps_owned_rollback_and_linger_warning ... ok
test every_setup_command_fits_one_kernel_argument_in_both_modes ... ok
test commit_signal_retains_journal_until_proof_and_on_cancel ... ok
test denied_linger_request_does_not_undo_a_later_external_enable ... ok
test checked_staging_survives_a_buffering_payload_reader_and_reuses_the_cache ... ok
test foreign_data_refusal_retains_exit_status_and_actionable_directory ... ok
test enrollment_process_exit_71_is_not_reported_as_directory_refusal ... ok
test framed_receipts_preserve_upload_failures_and_reject_extra_output ... ok
test compound_activation_and_start_failures_keep_exact_step_and_rollback ... ok
test concurrent_attempts_cannot_replace_or_clean_each_others_transaction ... ok
test fresh_cleanup_refuses_a_shared_writable_receipt_parent_before_mutation ... ok
test framed_join_refusal_keeps_status_separate_from_upload ... ok
test fresh_cleanup_resumes_after_base_removal_and_retires_its_receipt ... ok
test foreign_files_and_another_attempt_lock_are_never_removed ... ok
test crash_mid_install_can_roll_back_and_retry ... ok
test failed_upgrade_preserves_previous_binary_state_and_unit ... ok
test fresh_cleanup_resumes_after_owner_marker_removal_with_a_fresh_session ... ok
test facts_timeout_retires_stale_plugin_control_socket_before_retry ... ok
test fresh_receipt_is_removed_before_transaction_rollback ... ok
test fresh_runtime_symlink_never_removes_foreign_empty_directories ... ok
test fresh_rollback_resumes_after_transaction_directory_removal ... ok
test earlier_binary_cache_is_refreshed_before_owned_recovery ... ok
test full_stage_frees_payload_before_allocating_a_cleanup_receipt ... ok
test earlier_control_socket_receipt_recovers_before_a_new_setup ... ok
test framed_upload_keeps_invitation_after_verified_raw_and_compressed_payloads ... ok
test fresh_runtime_empty_directories_do_not_block_rollback_and_retry ... ok
test installed_infraternal_agent_always_restarts_without_start_limit ... ok
test fresh_runtime_unexpected_data_keeps_ownership_and_cleanup_receipt ... ok
test interrupted_acquisition_cleanup_receipt_can_resume ... ok
test full_payload_restaging_preserves_the_running_session_build ... ok
test interrupted_linger_reply_retains_intent_for_cleanup ... ok
test fresh_failure_removes_owned_artifacts_and_success_can_rejoin ... ok
test missing_payload_preserves_the_bootstrap_binary_remedy ... ok
test linked_owner_marker_is_refused_before_retiring_the_transaction ... ok
test interrupted_upgrade_after_acknowledged_stop_restarts_the_previous_service ... ok
test interrupted_rollback_never_deletes_already_restored_state_on_retry ... ok
test optional_session_payload_is_architecture_scoped_and_refuses_symlinks ... ok
test interrupted_restore_recreates_links_without_deleting_the_original ... ok
test payload_reuse_never_adopts_a_foreign_cache_directory ... ok
test interrupted_control_cleanup_is_resumed_only_by_its_original_attempt ... ok
test one_command_channel_carries_check_verified_upload_and_bridge_bytes ... ok
test known_failed_setup_finishes_without_a_second_confirmation ... ok
test partial_full_upload_rebridges_from_a_verified_image ... ok
test linger_policy_denial_is_a_warning_and_owned_changes_are_reversible ... ok
test malformed_or_exposed_cleanup_receipts_never_remove_the_owned_root ... ok
test reported_cache_digest_selects_reuse_without_sending_payload ... ok
test refused_previous_service_stop_only_removes_staging ... ok
test review_inode_reuse_after_diagnostics_preserves_live_replacement ... ignored, scripts/test-ssh-inode-reuse reports unsupported filesystems as ignored
test pending_fresh_cleanup_refuses_replacement_staging_until_finished ... ok
test negotiated_transfer_delivers_the_invitation_after_a_buffering_head ... ok
test retry_cleanup_uses_fresh_session_and_preserves_privilege_consent ... ok
test review_interrupted_transaction_receipt_allows_owned_cleanup ... ok
test review_unrelated_user_relative_socket_does_not_block_stale_cleanup ... ignored, requires sudo -n to create an isolated listener as uid 65534
test rejoin_preserves_existing_host_identity_in_the_private_staging_state ... ok
test live_setup_retry_preserves_the_bridge_and_host_identity_state ... ok
test setup_receipts_require_exact_order_and_preserve_failure_boundaries ... ok
test retry_resends_payload_when_cache_content_changes ... ok
test retry_reuses_verified_payload_after_owned_rollback ... ok
test review_live_relative_control_socket_preserves_its_receipt ... ok
test setup_transaction_holds_a_live_lock_between_shell_commands ... ok
test rollback_stop_refusal_retains_artifacts_for_later_cleanup ... ok
test session_restaging_uses_one_compound_command ... ok
test review_restart_recovers_cleanup_after_base_retirement ... ok
test review_restart_recovers_cleanup_after_owner_retirement ... ok
test staged_shell_bridge_keeps_protocol_bytes_and_releases_setup_guard ... ok
test negotiated_retry_reuses_only_a_verified_cache_after_activation_refusal ... ok
test writable_installation_is_refused_before_upload_or_cleanup ... ok
test turning_off_paused_host_provisioning_preserves_earlier_leftovers ... ok
test streaming::decoded_image_and_hash_advance_before_the_transfer_tail_is_released ... ok
test start_fresh_resumes_the_same_attempt_after_owner_confirmation ... ok
test streamed_digest_refuses_a_short_file_or_a_changed_stream_before_launch ... ok
test stale_previous_attempt_socket_can_be_retired_without_manual_cleanup ... ok
test stopped_control_socket_modes_from_service_manager_are_recoverable ... ok
test restart_recovers_partial_stage_retirement ... ok
test successful_stage_releases_the_parent_lock_from_its_lease_child ... ok

test result: ok. 94 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 12.32s

     Running tests/mesh_ssh.rs (target/debug/deps/mesh_ssh-98605c9c411d4239)

running 2 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test network_identity_connect_check_and_changed_key_refusal ... ignored, requires the Go interoperability fixture; run research/ssh-client/mesh-fixture/run

test result: ok. 1 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/model.rs (target/debug/deps/model-1f8035fea2f716a8)

running 6 tests
test addresses_never_become_options_or_shell_syntax ... ok
test check_is_exact_bounded_and_rejects_every_truncation ... ok
test consent_and_credential_references_are_the_only_request_authority ... ok
test start_fresh_is_declared_as_an_owned_host_provisioning_action ... ok
test root_consent_is_required_before_ssh_and_uid_zero_cannot_be_rootless ... ok
test passwordless_sudo_keeps_default_rootless_without_explicit_consent ... ok

test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/payload_source.rs (target/debug/deps/payload_source-50a43745d9affa68)

running 2 tests
test stalled_download_retains_the_named_step_before_the_attempt_deadline ... ok
test verification_failure_names_step_and_stops_before_upload ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/previous_attempt_liveness_review.rs (target/debug/deps/previous_attempt_liveness_review-219fee4d1b33b83f)

running 2 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test home_alias_keeps_open_setup_descriptor_live ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s

     Running tests/previous_attempt_shell.rs (target/debug/deps/previous_attempt_shell-42d05ae4a42e7c63)

running 2 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test shared_ownership_shell_preserves_recovery_and_refusal_invariants ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.53s

     Running tests/probe_check.rs (target/debug/deps/probe_check-5fbb2fac3f3545dc)

running 4 tests
test breakit2_no_systemd_names_the_required_manager ... ok
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test shell_startup_refusal_names_an_interactive_only_remedy ... ok
test manager_availability_does_not_request_its_private_environment ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s

     Running tests/process.rs (target/debug/deps/process-6a3b26d9c4993af7)

running 11 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test completed_helper_retires_descendants_with_closed_pipes ... ok
test cancellation_retires_the_helper_descendant_too ... ok
test review_compound_refusal_preserves_receipt_when_invitation_pipe_closes ... ok
test unavailable_negotiated_codec_never_sends_invitation ... ok
test oversized_remote_output_is_bounded_and_active_timeout_is_enforced ... ok
test negotiated_sources_require_an_exact_receipt_before_private_input ... ok
test declared_payload_flows_before_receipts_and_private_input_waits ... ok
test reviewer_ssh_helper_does_not_inherit_server_reload_mask ... ok
test group_identity_is_retained_until_inherited_pipes_finish ... ok
test declared_selection_mismatch_and_missing_verification_withhold_private_input ... ok

test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.03s

     Running tests/proxy_policy.rs (target/debug/deps/proxy_policy-5a404786fe615a44)

running 2 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test unchecked_proxy_hops_are_refused_before_credential_helpers_or_network ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/publication.rs (target/debug/deps/publication-f9f86d5fcda71e08)

running 5 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test refused_publication_reports_failure_to_the_waiting_wizard ... ok
test encoding_warmup_resolves_admitted_source_images_instead_of_configured_paths ... ok
test signed_session_is_typable_before_full_resolution_and_late_failure_retries_the_same_shell ... ok
test retry_reopens_ssh_after_transport_loss_and_keeps_the_published_shell ... ok

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s

     Running tests/real_ssh.rs (target/debug/deps/real_ssh-9bdf06e45ca1ac49)

running 1 test
test actual_ssh_authentication_check_and_strict_host_key_rejection ... ignored, run through research/ssh-client/measure.py with the synthetic rootless sshd fixture

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/recovery_support.rs (target/debug/deps/recovery_support-310b557e0a74410c)

running 13 tests
test cleanup_script_requires_the_shipped_helper_level ... ok
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test review_stale_receipt_recovers_without_host_python ... ignored, requires sudo -n Docker and the local debian:trixie-slim image
test review_cached_helper_without_session_mode_asks_for_a_refresh ... ok
test review_live_session_socket_in_plain_home_blocks_cleanup ... ok
test legacy_control_socket_in_spaced_home_preserves_receipt ... ok
test legacy_control_socket_in_newline_home_preserves_receipt ... ok
test review_bound_control_socket_before_listen_preserves_receipt ... ok
test review_live_session_socket_in_newline_home_blocks_cleanup ... ok
test legacy_control_socket_through_absolute_alias_preserves_receipt ... ok
test cleanup_holds_runtime_lock_until_all_receipts_retire ... ok
test private_legacy_control_socket_preserves_receipt ... ok
test unrelated_same_user_relative_socket_does_not_block_cleanup ... ok

test result: ok. 12 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.73s

     Running tests/shadow_banner.rs (target/debug/deps/shadow_banner-ab487dca6798c1f0)

running 2 tests
test common::deep_scratch_fallback_is_private_short_and_owned ... ok
test a_long_pre_authentication_banner_does_not_refuse_the_host ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s

     Running tests/shell_quoting.rs (target/debug/deps/shell_quoting-42d9866df6c92776)

running 1 test
test nested_scripts_preserve_bytes_without_expanding_public_text ... ignored, run on the owned disposable target with all supported login shells installed

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/single_connection.rs (target/debug/deps/single_connection-68345a87d0e88e77)

running 1 test
test one_physical_connection_erases_helpers_and_refuses_reconnect ... ignored, run through the rootless real-sshd fixture, selecting this test only

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/source_completeness.rs (target/debug/deps/source_completeness-858598e4554b88d3)

running 1 test
test declared_public_modules_have_committed_sources ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/trust_round2.rs (target/debug/deps/trust_round2-50158a5a11224e3b)

running 2 tests
test long_data_directory_does_not_bound_the_ssh_helper_socket ... ignored, scripts/test-ssh-host-trust.py supplies the real multi-key target
test multi_key_target_trusts_once_and_reconnects_without_a_loop ... ignored, scripts/test-ssh-host-trust.py supplies a real multi-key sshd and memory-held credentials

test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-219a640828ab7102)

running 12 tests
test machine_tests::reserved_identity_request_is_decoded_without_changing_protocol_hello ... ok
test machine_tests::reserved_chunk_and_metadata_bounds_refuse_oversized_bodies ... ok
test machine_tests::split_machine_header_refuses_oversized_chunk_before_body_buffering ... ok
test stream_tests::split_mux_header_preserves_trailing_close ... ok
test tests::mux_round_trip_and_incremental_decoders_preserve_frame_order ... ok
test machine_tests::every_reserved_kind_round_trips_and_requires_stream_zero ... ok
test tests::rejects_oversized_noncanonical_and_malformed_frames_before_buffering_body ... ok
test tests::marked_input_preserves_legacy_bytes_and_bounds_reply_body ... ok
test stream_tests::all_short_frame_splits_match_direct_decoding ... ok
test tests::oversized_encode_keeps_the_reusable_output_unchanged ... ok
test tests::golden_vectors_encode_and_decode_every_contract_frame ... ok
test stream_tests::maximum_sized_fragmented_frame_is_not_rejected ... ok

test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running unittests src/lib.rs (target/debug/deps/infraternal_server-ec6c22ddc80b7140)

running 795 tests
test auth::account_events::tests::coalesced_changes_remain_pending_for_each_affected_account ... ok
test auth::account_events::tests::a_closed_cursor_cannot_remove_its_replacement_channel ... ok
test auth::account_events::tests::last_subscriber_removes_only_its_account ... ok
test auth::account_events::tests::many_accounts_do_not_share_generations_or_retain_inactive_entries ... ok
test auth::account_events::tests::publication_wakes_outside_the_registry_lock ... ok
test auth::account_events::tests::concurrent_final_drops_remove_the_account_before_receiver_fields_drop ... ok
test auth::account_events::tests::cancellation_preserves_an_unread_generation ... ok
test auth::account_events::tests::a_dropped_source_reports_unavailable_instead_of_consuming_a_change ... ok
test auth::cookies::measurement::cookie_latency_at_50_sessions ... ignored, local optimized cookie reader measurement at 50 browser sessions
test auth::cookies::tests::joined_split_reordered_and_other_cookies ... ok
test auth::cookies::tests::duplicates_missing_invalid_and_nontext_fail_closed ... ok
test auth::account_events::tests::refused_transaction_commit_wakes_neither_account_source ... ok
test auth::account_events::tests::concurrent_registration_and_cleanup_keep_the_existing_generation ... ok
test auth::account_events::tests::cancelled_commit_waiter_still_commits_and_wakes_both_account_sources ... ok
test auth::account_events::review_revocation_r2::review_r2_cancelled_refused_commit_never_publishes ... ok
test auth::account_events::review_revocation_r2::review_r2_timed_out_commit_waiter_preserves_publication_order ... ok
test auth::account_events::review_revocation_r2::review_r2_aborted_commit_task_preserves_publication_order ... ok
test auth::account_events::review_revocation_r2::review_r2_panicking_commit_waiter_preserves_publication_order ... ok
test auth::migration_compat_tests::dirty_production_migration_is_refused_without_retagging ... ok
test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok
test auth::http::hostname_tests::authenticated_session_response_includes_system_hostname ... ok
test auth::migration_compat_tests::live_production_retirement_history_survives_dev_upgrade ... ok
test auth::migration_compat_tests::fresh_history_has_unique_versions_and_both_schemas ... ok
test auth::migration_compat_tests::dev_history_keeps_its_mesh_checksum_and_data ... ok
test auth::migration_data_tests::original_migration_metadata_and_checksums_are_unchanged ... ok
test auth::migration_compat_tests::occupied_destination_leaves_the_production_ledger_unchanged ... ok
test auth::migration_data_tests::quoted_text_and_comment_looking_literals_keep_their_values ... ok
test auth::migration_compat_tests::committed_retag_can_resume_after_interruption_and_concurrent_startup ... ok
test auth::tests::account_identity_migration_backfills_legacy_users ... ok
test auth::tests::aaguid_projection_rejects_malformed_cbor_corpus ... ok
test auth::migration_compat_tests::unrecognized_checksum_is_refused_without_retagging ... ok
test auth::migration_compat_tests::production_history_keeps_index_checksum_and_data ... ok
test auth::tests::account_identity_schema_has_unique_usernames_and_display_names ... ok
test auth::tests::aaguid_migration_preserves_legacy_credentials_and_sessions ... ok
test auth::migration_data_tests::fresh_schemas_defaults_indexes_and_foreign_keys_match_original_sql ... ok
test auth::migration_data_tests::deployed_histories_upgrade_without_retagging_or_losing_ownership ... ok
test auth::crypto::verifier_tests::browser_secret_hashing_is_canonical_and_bounded ... ok
test auth::crypto::verifier_tests::fixture_waits_while_production_hashing_refuses_capacity ... ok
test auth::tests::ca_administration_tests::actual_ca_unlock_cost_at_1000_administrator_records ... ignored, release real authority diagnostic at1000 memberships/copies; no concurrent own build/browser
test auth::crypto::verifier_tests::recovery_capacity_denial_is_not_a_legacy_credential_signal ... ok
test auth::tests::ca_administration_tests::actual_passkey_unlocks_cold_ca_once_and_leaves_no_extra_browser_session ... ok
test auth::tests::ca_administration_tests::audit_tests::private_copy_persistence_contains_only_ciphertext_and_public_metadata ... ok
test auth::tests::ca_administration_tests::audit_tests::unlock_audit_cost_at_1000_memberships ... ignored, real 100-unlock/1000-membership audit formatting diagnostic; no own builds or browsers
test auth::tests::ca_administration_tests::administrator_with_stale_tap_must_make_a_new_verified_proof_to_unlock ... ok
test auth::tests::ca_administration_tests::audit_tests::unlock_audit_records_principal_time_outcome_without_material ... ok
test auth::tests::account_logout_does_not_notify_another_account ... ok
test auth::tests::ca_administration_tests::bootstrap_requires_a_fresh_real_proof_and_publishes_only_wrapped_ca_material ... ok
test auth::tests::ca_administration_tests::concurrent_bootstrap_ceremonies_retain_one_issuer_and_replay_is_refused ... ok
test auth::tests::audit_ceremony_browser_binding ... ok
test auth::tests::ca_administration_tests::foreign_browser_cannot_consume_the_original_ca_unlock_ceremony ... ok
test auth::tests::ca_administration_tests::http_tests::ca_body_admission_at_1000_requests ... ignored, 1000-request body admission diagnostic; run alone without builds
test auth::tests::ca_administration_tests::http_tests::audit_tests::ca_start_budget_is_shared_by_routes_and_cookies_but_not_status_or_finish ... ok
test auth::tests::ca_administration_tests::http_tests::audit_tests::sequential_unlock_starts_require_a_temporal_budget ... ok
test auth::tests::audit_logout_survives_admission_exhaustion ... ok
test auth::tests::ca_administration_tests::http_tests::ca_finish_body_deadline_returns_its_admission_slot ... ok
test auth::tests::ca_administration_tests::changed_generation_expired_session_or_removed_credential_cannot_unlock ... ok
test auth::tests::ca_administration_tests::http_tests::ca_http_exact_origin_and_live_cookie_are_required ... ok
test auth::tests::ca_administration_tests::http_tests::ca_http_parser_is_bounded_and_errors_do_not_reflect_wrapping_material ... ok
test auth::tests::ca_administration_tests::http_tests::ca_http_real_passkey_unlock_returns_only_lock_status_without_a_session_cookie ... ok
test auth::tests::audit_no_public_credential_listing ... ok
test auth::tests::ca_administration_tests::http_tests::ca_http_refuses_origin_and_cookie_before_decoding_wrapping_material ... ok
test auth::tests::ca_administration_tests::http_tests::ca_status_distinguishes_initial_setup_from_locked_retained_trust ... ok
test auth::tests::ca_administration_tests::http_tests::first_machine_certificate_setup_starts_a_fresh_passkey_ceremony ... ok
test auth::tests::ca_administration_tests::http_tests::independent_review_ca_body_reads_share_the_eight_request_admission_limit ... ok
test auth::tests::ca_administration_tests::http_tests::independent_review_ca_headers_are_refused_before_reading_an_unfinished_body ... ok
test auth::tests::ca_administration_tests::new_administrator_device_rewraps_pending_copy_and_role_generation_never_resurrects_it ... ok
test auth::tests::ca_administration_tests::ordinary_login_ceremony_has_no_ca_unlock_purpose ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::bootstrap_cli::fresh_release_bootstrap_join_renew_revoke_cuts_a_live_connection ... ignored, configured release E2E requires INFRATERNAL_REMOTE_TEST_BINARY and exclusive4701/7443
test auth::tests::ca_administration_tests::shipping_cli_tests::configured_release_cli_cold_lock_real_passkey_unlock_and_cold_restart ... ignored, configured release CLI proof needs INFRATERNAL_REMOTE_TEST_BINARY and exclusive4701/7443
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::attach_ack_survives_later_sibling_ack_before_waiter_polls ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::delayed_ack_preserves_highest_input_offset ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::input_ack_survives_later_sibling_ack_before_waiter_polls ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::pump_attach_waits_for_control_probe_before_next_mutation ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::pump_returns_consumed_output_and_snapshot_credit_to_the_same_stream ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::pump_survives_an_idle_quiet_window_without_application_output ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_update_preserves_passkey_ca_and_all_live_routes ... ignored, exclusive perf VM; requires signed generation fixtures and a scoped release origin
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions ... ignored, exclusive perf VM staging proof; requires signed run artifacts and systemd
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::staging_browser_services_probes_between_commands ... ignored, root shipping binary functional proof; requires INFRATERNAL_TEST_BINARY and private CA test root
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::staging_root_accepts_legacy_and_job_scoped_roots ... ok
test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::staging_root_rejects_unscoped_and_escaping_paths ... ok
test auth::tests::audit_recovery_after_page_discard_can_resume_at_original_deadline ... ok
test auth::tests::ca_administration_tests::pending_administrator_cannot_replace_the_last_retained_wrapped_copy ... ok
test auth::tests::ca_administration_tests::published_issuer_without_memory_projection_is_recovered_as_locked_trust ... ok
test auth::tests::ca_administration_tests::role_changes_require_fresh_purpose_bound_proofs_and_recheck_owner_permission ... ok
test auth::tests::ca_membership_tests::administrator_guard_cost_at_1000_memberships ... ignored, optimized administrator guard diagnostic at1000 memberships; no own build/browser overlap
test auth::tests::ca_administration_tests::role_grant_is_pending_and_revoke_removes_old_copy_without_restoring_old_authority ... ok
test auth::tests::ca_membership_tests::administrator_bootstrap_is_explicit_and_owner_flag_cannot_replace_revoked_role ... ok
test auth::tests::discoverable_latency_at_pending_capacity ... ignored, run --release --ignored --nocapture without concurrent builds
test auth::tests::audit_recovery_pending_is_visible_to_signed_in_device ... ok
test auth::tests::ca_membership_tests::administrator_copy_refuses_deleted_passkey_or_session ... ok
test auth::tests::ca_membership_tests::administrator_copy_refuses_pending_expired_stale_or_future_session ... ok
test auth::tests::ca_administration_tests::revoked_membership_or_original_session_cannot_finish_an_existing_ca_ceremony ... ok
test auth::tests::ca_administration_tests::wrong_wrapping_key_or_missing_user_verification_leaves_ca_locked ... ok
test auth::tests::logout_commit::logout_publication_measurement ... ignored, measurement only; run on a perf VM under perf-run.sh
test auth::tests::audit_recovery_session_expiring_during_verification_keeps_delay ... ok
test auth::tests::authenticated_prf_metadata_preserves_legacy_envelopes ... ok
test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok
test auth::tests::provider_labels_cover_the_cited_registry_without_guessing ... ok
test auth::tests::provider_session_latency_at_50_devices ... ignored, local auth session scale measurement; run without concurrent builds
test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok
test auth::tests::discoverable_login_handle_credential_counter_and_replay ... ok
test auth::tests::read_only_plugin_tests::recovery_keeps_inventory_but_refuses_feature_switches_without_storage_writes ... ok
test auth::tests::enrollment_prf_input_matches_discoverable_login ... ok
test auth::tests::read_only_tests::read_only_auth_opens_without_migrations_and_preserves_session_expiry ... ok
test auth::tests::host_facts_review_tests::pending_host_facts_read_keeps_control_ping_responsive ... ok
test auth::tests::read_only_tests::read_only_auth_refuses_a_changed_or_incomplete_schema_without_repair ... ok
test auth::tests::read_only_tests::read_only_http_reads_identity_and_refuses_mutation_without_expiring_the_cookie ... ok
test auth::tests::read_only_tests::read_only_pending_cookie_keeps_its_restriction_and_expiry_without_cleanup ... ok
test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok
test auth::tests::logout_commit::logout_commit_failure_does_not_publish_revocation_or_report_success ... ok
test auth::tests::read_only_tests::read_only_auth_rejects_checksum_mismatch_and_dirty_or_extra_migrations ... ok
test auth::tests::logout_commit::review_account_scope_committed_logout_keeps_wake_when_waiter_is_cancelled ... ok
test auth::tests::logout_commit::review_account_scope_statement_rollback_is_quiet_and_later_commit_wakes_once ... ok
test auth::tests::pending_unlock_expires_without_terminal_authority ... ok
test auth::tests::public_status_and_discoverable_http_login ... ok
test auth::tests::recovery_session_delay_latency_at_capacity ... ignored, release-only recovery measurement at 50 live sessions; run without concurrent compilation
test auth::tests::public_status_result_fields_are_listed_in_the_auth_contract ... ok
test auth::tests::read_only_tests::runtime_tests::fallback_router_restarts_without_writes_and_keeps_frozen_or_latest_wal_identity ... ok
test auth::tests::recovery_verifier_latency_at_capacity ... ignored, release-only v2 diagnostic at 50 live session rows; record host load separately
test auth::tests::recovery_audit_commits_once_with_start_cancel_and_complete ... ok
test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok
test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok
test auth::tests::remote_removal_tests::fresh_removal_revokes_offline_host_and_cannot_replay ... ok
test auth::tests::remote_removal_tests::logout_or_role_loss_after_removal_start_preserves_host ... ok
test auth::tests::recovery_http_live_same_account_is_immediate ... ok
test auth::tests::recovery_http_other_expired_pending_and_missing_sessions_wait ... ok
test auth::tests::recovery_live_session_cannot_accelerate_an_active_delayed_request ... ok
test auth::tests::recovery_live_session_revoked_during_verification_cannot_waive_delay ... ok
test auth::tests::recovery_unknown_identity_pays_the_same_database_and_verifier_work ... ok
test auth::tests::recovery_username_identity_is_additive_and_ambiguous_forms_fail ... ok
test auth::tests::redacted_unknown_and_failed_registrations_do_not_claim_a_provider ... ok
test auth::tests::registration_aaguid_survives_none_attestation_and_binds_session_provider ... ok
test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok
test auth::tests::review3_tests::review3_backend_reply_has_a_deadline ... ok
test auth::tests::review3_tests::review3_busy_expiry ... ok
test auth::tests::review3_tests::review3_busy_logout ... ok
test auth::tests::review3_tests::review3_busy_recovery ... ok
test auth::tests::review3_tests::review4_slow_open_at_user_capacity ... ignored, release-only connect scale measurement; run without concurrent builds
test auth::tests::review3_tests::review3_completion_and_cleanup_are_transaction_bound ... ok
test auth::tests::review3_tests::review3_expired_handshake_must_not_welcome ... ok
test auth::tests::review3_tests::review3_identified_privacy_timing_and_binding_replays ... ok
test auth::tests::review3_tests::review3_pending_routes_and_idle_expiry_recovery ... ok
test auth::tests::review3_tests::review3_revoked_handshake_must_not_welcome ... ok
test auth::tests::review3_tests::review3_revoked_resume_must_not_welcome ... ok
test auth::tests::review3_tests::review3_unwrap_cannot_be_skipped ... ok
test auth::tests::review3_tests::review3_waiting_handshake_loses_authority ... ok
test auth::tests::review3_tests::review4_open_reply_and_revocation_preserve_authority ... ok
test auth::tests::review_edge_revocation_tests::review_r2_missing_dev_committed_logout_keeps_revocation_wake ... ok
test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok
test auth::tests::review_old_words_race_rotation ... ok
test auth::tests::reviewer_tests::reviewer_disk_cancel_complete_races ... ok
test auth::tests::reviewer_tests::reviewer_disk_restart_and_concurrent_resume ... ok
test auth::tests::reviewer_tests::reviewer_http_denials_and_recovery_admission ... ok
test auth::tests::reviewer_tests::reviewer_http_expired_capability_cannot_complete_after_writer_wait ... ok
test auth::tests::setup_check_is_non_consuming_and_closes_after_owner_creation ... ok
test auth::tests::setup_identity_validation_and_uniqueness ... ok
test auth::tests::reviewer_tests::reviewer_http_expired_ceremony_cannot_complete_after_writer_wait ... ok
test auth::tests::setup_start_accepts_username_and_display_name ... ok
test auth::tests::reviewer_tests::reviewer_server_clock_rollback_retains_deadline_and_reports_more_than_day ... ok
test auth::tests::socket_tests::authority_stall_soak::authority_fast_read_echo_rtt ... ignored, measurement for #240; run explicitly on the perf VM
test auth::tests::socket_tests::authority_stall_soak::authority_stall_soak ... ignored, measurement for #240; run explicitly on the perf VM
test auth::tests::rotation_tests::recovery_phrase_routes_are_removed_and_words_fail_closed ... ok
test auth::tests::rotation_tests::recovery_rotation_cannot_follow_a_cookie_account_switch ... ok
test auth::tests::rotation_tests::recovery_rotation_denies_pending_expired_and_stale_sessions ... ok
test auth::tests::rotation_tests::recovery_rotation_requires_session_and_replaces_legacy_envelope ... ok
test auth::tests::rotation_tests::reviewer_concurrent_signed_in_rotations_commit_once ... ok
test auth::tests::server_setup_terminal_echo_and_resume_preserve_offsets_once ... ok
test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok
test auth::tests::setup_restart_rotation_expiry_and_parallel_redemption ... ok
test auth::tests::socket_tests::authenticated_idle_socket_survives_the_former_read_timeout ... ok
test auth::tests::socket_tests::canvas::canvas_real_socket_commits_and_runtime_disable_preserve_control ... ok
test auth::tests::socket_tests::claude_review_visible_liveness::claude_review_watch_expires_host_made_visible_by_membership_edit ... ok
test auth::tests::socket_tests::clean_control_close_is_not_an_internal_error ... ok
test auth::tests::socket_tests::close_logging::agent_stream_loss_logs_its_safe_close_reason_and_reaches_the_browser ... ok
test auth::tests::socket_tests::close_logging::authority_read_timeout_during_a_frame_logs_authority_unavailable ... ok
test auth::tests::socket_tests::close_logging::browser_websocket_close_logs_its_code_and_safe_reason_for_attached_sessions ... ok
test auth::tests::socket_tests::close_logging::failed_client_resume_attempt_logs_each_retained_session ... ok
test auth::tests::socket_tests::close_logging::revocation_wake_on_busy_store_logs_authority_unavailable_not_resume_refused ... ok
test auth::tests::socket_tests::close_logging::revoked_busy_wake_records_stream_end_within_the_existing_wait ... ok
test auth::tests::socket_tests::close_logging::revoked_session_during_transient_stall_logs_resume_refused ... ok
test auth::tests::socket_tests::mesh_latency::mesh_snapshot_keystroke_latency_at_10000_nodes ... ignored, weighted real-binary 300 ms Mesh/PTY measurement
test auth::tests::socket_tests::close_logging::rootless_attach_without_a_live_peer_logs_the_host_and_keeps_the_socket_up ... ok
test auth::tests::socket_tests::close_logging::session_lookup_store_error_logs_authority_unavailable ... ok
test auth::tests::socket_tests::close_logging::unrelated_logout_during_transient_stall_keeps_the_terminal_socket ... ok
test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok
test auth::tests::socket_tests::fragmented_wire_frame_has_a_completion_deadline ... ok
test auth::tests::socket_tests::fresh_delete::review_mesh_delete_requires_fresh_passkey_tap ... ok
test auth::tests::socket_tests::half_open_sockets_obey_user_limit ... ok
test auth::tests::socket_tests::plugin_lifecycle::mesh_destructive_metadata_matches_frozen_confirmation_requirements ... ok
test auth::tests::socket_tests::incomplete_rfc_message_still_loses_authority_on_revocation ... ok
test auth::tests::socket_tests::mesh_calls_and_subscriptions_deliver_scoped_live_inventory ... ok
test auth::tests::socket_tests::plugin_lifecycle::plugin_exchange_correlates_results_after_subscription_events ... ok
test auth::tests::socket_tests::non_owner_without_host_configure_permission_is_refused_before_leg_b ... ok

running 1 test
test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.91s

test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok

running 1 test
test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.94s

test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_needing_session_renewal_interrupts_the_database_writer_fence ... ok

running 1 test
test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.74s

test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::revoked_session_cannot_release_retained_input_after_preparation ... ok
test auth::tests::socket_tests::per_account_revocation::account_logout_wakes_only_its_16_sockets_among_256 ... ok
test auth::tests::socket_tests::per_account_revocation::account_recovery_wakes_only_its_16_sockets_among_256 ... ok
test auth::tests::socket_tests::per_account_revocation::another_live_session_on_the_affected_account_keeps_its_proof_lease ... ok
test auth::tests::socket_tests::per_account_revocation::coalesced_session_logout_cannot_hide_an_earlier_revoked_proof_lease ... ok
test auth::tests::socket_tests::plugin_lifecycle::disabling_mesh_joins_pending_writer_and_refuses_nonowner_switches ... ok
test auth::tests::socket_tests::plugin_lifecycle::mesh_coordinator_requires_an_existing_server_role ... ok
test auth::tests::socket_tests::plugin_lifecycle::mesh_lifecycle_withdrawals_survive_calls_but_never_end_a_replacement ... ok
test auth::tests::socket_tests::plugin_lifecycle::mesh_plugin_discovery_disable_and_restart_preserve_control_socket ... ok
test auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket ... ok
test auth::tests::socket_tests::restart_open_liveness_review::responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment ... ok
test auth::tests::socket_tests::review_account_scope::account_deletion_retires_open_sockets_without_affecting_other_accounts ... ok
test auth::tests::socket_tests::review_account_scope::lagged_cursors_survive_65536_overwrites_and_unknown_scope_wakes_every_account ... ok
test auth::tests::socket_tests::review_account_scope::lost_recovery_source_closes_with_1013_without_another_authority_read ... ok
test auth::tests::socket_tests::review_account_scope::lost_revocation_source_closes_with_1013_without_another_authority_read ... ok
test auth::tests::socket_tests::review_account_scope::reassigned_session_cannot_authorize_work_for_its_former_account ... ok
test auth::tests::socket_tests::review_account_scope::review_r2_lost_recovery_source_reports_unavailable_or_reads_authority ... ok
test auth::tests::socket_tests::review_account_scope::simultaneous_recovery_a_and_logout_b_preserve_both_scopes ... ok
test auth::tests::socket_tests::review_account_scope::two_accounts_revoked_before_either_cursor_runs_both_refuse ... ok
test auth::tests::socket_tests::review_authority_cap::every_socket_in_a_full_place_storm_fails_closed_without_a_reply ... ok
test auth::tests::socket_tests::review_authority_cap::retries_whose_select_waits_stay_within_the_authority_cap ... ok
test auth::tests::socket_tests::review_authority_retry::renewing_retries_do_not_drain_the_pool_during_a_write_stall ... ok
test auth::tests::socket_tests::review_authority_retry::session_expiring_during_the_wait_is_not_revived_or_served ... ok
test auth::tests::socket_tests::review_busy_wake::idle_busy_revocation_wake_sends_server_busy_close_code ... ok
test auth::tests::socket_tests::review_busy_wake::sixteen_woken_sockets_recover_application_authority_after_a_short_stall ... ok
test auth::tests::socket_tests::review_close_log::attaches_to_unowned_session_ids_cannot_flood_the_close_log ... ok
test auth::tests::socket_tests::review_input_credit::pending_browser_input_counts_against_slots_and_cancels_on_drop ... ok
test auth::tests::socket_tests::review_input_credit::pending_browser_input_has_a_wire_byte_bound ... ok
test auth::tests::socket_tests::review_control::pending_mesh_writers_preserve_authority_pool_capacity ... ok
test auth::tests::socket_tests::review_control::review_pending_mesh_write_keeps_control_dispatch_available ... ok
test auth::tests::socket_tests::review_fresh_wait::review_mesh_delete_refused_when_freshness_expires_during_writer_wait ... ok
test auth::tests::socket_tests::review_input_credit::browser_input_overload_retires_only_the_terminal_stream ... ok
test auth::tests::socket_tests::review_input_credit::browser_output_credit_refusal_logs_the_stream_reason ... ok
test auth::tests::socket_tests::review_input_credit::idle_browser_probes_do_not_renew_or_poll_session_authority ... ok
test auth::tests::socket_tests::review_input_credit::idle_probe_authority_cancels_waiting_write_on_committed_revocation ... ok
test auth::tests::socket_tests::review_input_credit::idle_probe_authority_refreshes_expiry_after_authorized_activity ... ok
test auth::tests::socket_tests::review_input_credit::idle_server_probes_do_not_renew_session_authority ... ok
test auth::tests::socket_tests::review_input_credit::review_full_input_writer_preserves_browser_control_progress ... ok
test auth::tests::socket_tests::review_liveness::review_mesh_watch_reports_liveness_expiry_without_another_edit ... ok
test auth::tests::socket_tests::review_mobile_visibility::review_hidden_socket_cannot_park_absolute_session_expiry ... ok
test auth::tests::socket_tests::socket_authority_latency_at_user_capacity ... ignored, release-only measurement without concurrent compilation
test auth::tests::socket_tests::review_mobile_visibility::review_hidden_socket_cannot_park_logout_revocation ... ok
test auth::tests::socket_tests::review_subscription_refusal::oversized_refusal_cannot_reinstall_a_queued_mesh_subscription ... ok
test auth::tests::socket_tests::review_subscription_refusal::review_oversized_replacement_ends_the_previous_mesh_subscription ... ok
test auth::tests::socket_tests::review_subscription_refusal::saturated_refusal_cannot_reinstall_a_queued_mesh_subscription ... ok
test auth::tests::socket_tests::revoked_idle_socket_loses_all_authority ... ok
test auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket has been running for over 60 seconds
test auth::tests::socket_tests::session_gone::an_ended_or_unknown_session_gets_the_final_close_without_losing_the_socket has been running for over 60 seconds
test auth::tests::socket_tests::session_gone::the_infraternal_agent_saying_gone_reaches_the_browser_as_the_final_close has been running for over 60 seconds
test auth::tests::socket_tests::session_gone::transient_host_close_absorbs_inflight_credit_resize_and_input has been running for over 60 seconds
test auth::tests::socket_tests::startup_guard::startup_guard_refuses_unowned_sessions_and_unconfirmed_edits has been running for over 60 seconds
test auth::tests::socket_tests::terminal_exit::retired_exit_preserves_status_without_claiming_final_output_delivery has been running for over 60 seconds
test auth::tests::socket_tests::terminal_exit::terminal_exit_persists_once_under_current_ownership_and_session has been running for over 60 seconds
test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_beyond_the_wait_still_fails_closed has been running for over 60 seconds
test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_shorter_than_the_wait_keeps_the_socket_and_its_order has been running for over 60 seconds
test auth::tests::socket_tests::transient_authority_stall::teardown_does_not_renew_the_session has been running for over 60 seconds
test auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket ... ok
test auth::tests::socket_tests::session_gone::an_ended_or_unknown_session_gets_the_final_close_without_losing_the_socket ... ok
test auth::tests::socket_tests::session_gone::the_infraternal_agent_saying_gone_reaches_the_browser_as_the_final_close ... ok
test auth::tests::socket_tests::session_gone::transient_host_close_absorbs_inflight_credit_resize_and_input ... ok
test auth::tests::socket_tests::startup_guard::startup_guard_refuses_unowned_sessions_and_unconfirmed_edits ... ok
test auth::tests::socket_tests::terminal_exit::retired_exit_preserves_status_without_claiming_final_output_delivery ... ok
test auth::tests::socket_tests::terminal_exit::terminal_exit_persists_once_under_current_ownership_and_session ... ok
test auth::tests::verified_passkey_tests::canceled_proof_before_writer_admission_leaves_no_new_session_or_pending_ceremony ... ok
test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_beyond_the_wait_still_fails_closed ... ok
test auth::tests::verified_passkey_tests::proof_only_ceremony_expiring_during_writer_wait_cannot_commit_a_counter_or_session ... ok
test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_shorter_than_the_wait_keeps_the_socket_and_its_order ... ok
test auth::tests::verified_passkey_tests::proof_only_verification_preserves_monotone_registered_credential_counter ... ok
test auth::tests::socket_tests::transient_authority_stall::teardown_does_not_renew_the_session ... ok
test auth::tests::verified_passkey_tests::verified_passkey_has_live_registered_identity_and_creates_no_session ... ok
test auth::tests::verified_passkey_tests::proof_only_verification_refuses_missing_uv_or_deleted_credential ... ok
test auth::tests::socket_tests::transient_authority_stall::teardown_with_a_busy_store_does_not_wait_for_authority ... ok
test auth::tests::socket_tests::transient_authority_stall::terminal_stream_survives_authority_stalls_without_loss_or_reorder ... ok
test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok
test auth::tests::terminal_refusal_tests::memory_refusal_preserves_reason_and_counters_to_browser ... ok
test auth::tests::tls_tests::proxy_tls_registration_session_split_cookies ... ok
test auth::tests::tls_tests::standalone_tls_registration_session_split_cookies ... ok
test bootstrap_api::tests::a_client_request_during_a_pending_confirmation_keeps_the_batch ... ok
test bootstrap_api::tests::admission_stream_is_ordered_and_logout_retires_an_idle_socket ... ok
test bootstrap_api::tests::bootstrap_logout_before_subscription_closes_idle_upgrade ... ok
test bootstrap_api::tests::component_off_interrupts_a_stalled_host_key_confirmation_lookup ... ok
test bootstrap_api::tests::component_off_interrupts_a_stalled_progress_send ... ok
test bootstrap_api::tests::component_off_retires_idle_sockets_and_refuses_new_admission ... ok
test bootstrap_api::tests::control_frames_do_not_cancel_bootstrap_or_starve_progress ... ok
test bootstrap_api::tests::host_key_confirmation_rechecks_the_exact_live_owner_capability ... ok
test bootstrap_api::tests::logout_interrupts_a_stalled_host_key_confirmation_lookup ... ok
test bootstrap_api::tests::origin_owner_unlock_and_whole_request_consent_are_required ... ok
test bootstrap_api::tests::review_account_scope_logout_after_subscription_retires_idle_bootstrap ... ok
test bootstrap_api::tests::review_account_scope_lost_bootstrap_source_retires_instead_of_spinning ... ok
test bootstrap_api::tests::start_fresh_request_is_bound_to_a_target_and_public_challenge ... ok
test bootstrap_runtime::failure_log_tests::one_line_contains_only_classified_public_coordinates ... ok
test bootstrap_runtime::failure_log_tests::start_fresh_logs_only_the_exact_public_ownership_journal_and_outcome ... ok
test bootstrap_api::tests::review_r2_restored_bootstrap_source_still_reports_unavailable ... ok
test bootstrap_runtime::remote_backend::admission_tests::installed_admission_waits_for_the_active_route ... ok
test bootstrap_runtime::remote_backend::admission_tests::missing_route_uses_link_scaled_bound_without_inventory_extensions ... ok
test bootstrap_runtime::remote_backend::admission_tests::review_commit_budget_allows_final_proof_after_both_route_phases ... ok
test bootstrap_runtime::remote_backend::admission_tests::review_commit_budget_allows_final_proof_at_600_ms ... ok
test bootstrap_runtime::remote_backend::admission_tests::review_commit_budget_is_monotonic_for_zero_and_outlier_samples ... ok
test bootstrap_runtime::remote_backend::canary_tests::cancellation_keeps_the_owned_session_available_for_cleanup ... ok
test bootstrap_runtime::remote_backend::canary_tests::failed_attachment_finishes_the_private_command ... ok
test bootstrap_runtime::remote_backend::canary_tests::private_writers_reserve_the_browser_allocator_without_publishing_sessions ... ok
test bootstrap_runtime::remote_backend::canary_tests::readiness_accepts_authoritative_snapshot_output ... ok
test bootstrap_runtime::remote_backend::canary_tests::readiness_accepts_primary_exit_without_reattaching_to_a_retired_session ... ok
test bootstrap_runtime::remote_backend::canary_tests::readiness_input_preserves_the_terminal_actor_and_host_connection ... ok
test bootstrap_runtime::remote_backend::tests::already_added_breakit::a_non_owner_session_never_learns_the_owners_host_id ... ok
test bootstrap_runtime::remote_backend::tests::already_added_breakit::a_revoked_host_never_names_its_id ... ok
test bootstrap_runtime::remote_backend::tests::already_added_breakit::the_typed_address_decides_which_host_is_named_when_two_match ... ok
test bootstrap_runtime::remote_backend::tests::automatic_cleanup_requires_the_exact_failed_server_host_binding ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_concurrent_same_destination_issues_only_one_invitation ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_live::breakit2_live_ssh_install_join_and_terminal ... ignored, #169 live disposable Docker target; invoke docs/verification/addhost-breakit2/measure.py
test bootstrap_runtime::remote_backend::tests::breakit2_live::compound_retry_fixture_reaches_install_boundary ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_live::live_fixture_keeps_authority_after_connection_retirement ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_live::live_fixture_keeps_the_full_image_and_selects_the_explicit_session_image ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_live::provisioning_https_uses_production_tcp_admission ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_live::retry_lock_timing_runs_inside_the_nested_setup_shell ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_live::retry_setup_timing_preserves_transfer_upload_status ... ok
test bootstrap_runtime::remote_backend::tests::breakit2_unpublished_invitation_retires_durable_authority ... ok
test bootstrap_api::tests::revocation_interrupts_a_stalled_progress_send ... ok
test bootstrap_runtime::remote_backend::tests::cancelled_invitation_after_commit_retires_its_host_record ... ok
test bootstrap_runtime::remote_backend::tests::destination_reservation_admission_at_1600_pending_hosts ... ignored, #169 local bounded-journal scale evidence under CPUWeight scope
test bootstrap_runtime::remote_backend::tests::cold_ca_refuses_before_invitation_or_upload ... ok
test bootstrap_runtime::remote_backend::tests::failed_upload_retires_only_the_new_host ... ok
test bootstrap_runtime::remote_backend::tests::foreign_or_revoked_authority_never_opens_ssh ... ok
test bootstrap_runtime::remote_backend::tests::readding_a_live_host_reports_already_added_before_issuing_a_certificate ... ok
test bootstrap_api::tests::settings_public_key_requires_exact_origin_and_live_unlocked_owner ... ok
test bootstrap_runtime::remote_backend::tests::unpublished_attempt_drop_releases_only_its_ownership ... ok
test bootstrap_runtime::tests::pending_integration_refuses_enrollment_vault_and_discovery ... ok
test ca::tests::signed_identity_has_only_server_constructed_host_authority_and_seven_days ... ok
test ca::tests::signing_boundary_at_1000_public_identities ... ignored, explicit signing-boundary diagnostic; not live renewal or connected-agent RSS
test ca::tests::source_mismatch_locked_and_uncovered_validity_fail_closed ... ok
test ca::wrapping::tests::bounded_decoder_rejects_duplicate_unknown_fields_and_exact_oversize ... ok
test ca::wrapping::tests::ciphertext_nonce_salt_and_issuer_tampering_fail_authenticated_decryption ... ok
test ca::wrapping::tests::creation_rejects_unbound_membership_and_malformed_copies_cannot_open ... ok
test ca::wrapping::tests::encrypted_copy_cost_at_1000_administrators ... ignored, optimized CA copy diagnostic; no own builds/browser overlap
test ca::wrapping::tests::invalid_issuer_key_binding_is_refused_before_a_copy_is_persisted ... ok
test ca::wrapping::tests::wrapped_seed_roundtrip_validates_the_same_issuer_key ... ok
test ca::wrapping::tests::wrong_key_member_epoch_or_issuer_cannot_unwrap_a_copy ... ok
test ca_bootstrap::tests::generated_remote_leaf_is_verifiable_after_cold_restart ... ok
test ca_copies::tests::copy_store_cost_at_1000_administrators ... ignored, release-only private CA-copy disk diagnostic; no own build/browser overlap
test ca_copies::tests::encrypted_copy_is_private_durable_and_bound_to_member_generation ... ok
test ca_copies::tests::removal_is_member_generation_scoped_and_idempotent ... ok
test ca_copies::tests::unsafe_copy_directory_or_file_is_refused_without_following_symlinks ... ok
test ca_handoff::shipping_tests::browser_client::tests::probes_are_answered_without_assertion_reads_and_drop_closes_the_socket ... ok
test ca_handoff::shipping_tests::shipping_child ... ok
test ca_handoff::shipping_tests::shipping_restart_reload_rollback_and_cold_start ... ignored, explicit shipping-binary integration/benchmark; set INFRATERNAL_TEST_BINARY
test ca_handoff::tests::exec_child ... ok
test ca_handoff::tests::failed_null_open_or_duplication_closes_private_stdin ... ok
test bootstrap_api::tests::setup_logout_before_subscription_closes_idle_upgrade ... ok
test ca_handoff::tests::real_exec_failures_and_killed_receiver_never_unlock_a_cold_successor ... ok
test ca_handoff::tests::real_exec_retains_unlock_but_another_process_cannot_import_the_channel ... ok
test ca_handoff::tests::serialized_seed_frame_is_locked_and_excluded_from_core_dumps ... ok
test ca_handoff::tests::socketpair_preserves_unlock_and_cold_start_still_locks ... ok
test ca_handoff::tests::truncated_wrong_generation_and_wrong_version_leave_successor_locked ... ok
test ca_handoff_binary::tests::listener_capability_is_independent_of_ca_custody ... ok
test ca_handoff_binary::tests::marker_is_an_exact_versioned_note_not_a_byte_substring ... ok
test ca_http::intake_tests::chunked_intake_is_bounded_before_parsing ... ok
test ca_memory::tests::accepted_unlock_notifies_and_memory_handoff_preserves_signing_without_a_timer ... ok
test ca_memory::tests::cold_start_retains_public_trust_and_denied_unlock_leaves_signing_locked ... ok
test ca_handoff::tests::parser_property_corpus_is_bounded_and_never_accepts_trailing_bytes ... ok
test ca_update_audit_tests::every_ciphertext_byte_and_tag_mutation_refuses_without_material_in_errors ... ok
test ca_update_audit_tests::handoff_descriptor_is_close_on_exec_and_prepare_failure_preserves_source ... ok
test ca_memory::tests::unavailable_secure_heap_refuses_root_and_warns_for_nonroot ... ok
test ca_update_audit_tests::handoff_memory_protection_failure_keeps_the_existing_signer ... ok
test ca_update_audit_tests::secure_heap_capacity_at_10000_live_keys ... ignored, isolated secure heap sizing at 10000 live keys; run with no own builds/browser overlap
test ca_update_audit_tests::unlocked_signer_requires_persistent_locked_pages ... ok
test canvas_store::tests::cancelled_commit_still_invalidates_a_durable_change ... ok
test canvas_store::tests::cas_retry_and_foreign_account_isolation ... ok
test canvas_store::tests::permanent_receipts_keep_the_original_json_digest_recipe ... ok
test csr::tests::incomplete_suffix_oversized_forged_and_wrong_algorithm_requests_are_refused ... ok
test csr::tests::nonminimal_outer_lengths_and_real_oversized_requests_are_refused ... ok
test csr::tests::signed_cached_noncanonical_or_incomplete_shapes_are_refused ... ok
test csr::tests::signed_constructed_primitive_attribute_is_refused ... ok
test csr::tests::signed_noncanonical_ignored_values_are_refused ... ok
test csr::tests::verified_host_key_is_admitted_without_trusting_requested_identity ... ok
test embedded::exit_latency_tests::shim_sigkill_to_server_inventory_latency ... ignored, real daemon artifact and 200 shim exits; run with INFRATERNAL_BIN in a weighted scope
test embedded::priming::flights::tests::queued_sibling_failure_stays_owned_until_the_actor_observes_it ... ok
test embedded::priming::flights::tests::stop_preserves_finished_success_and_identifies_unpolled_cancellation ... ok
test embedded::priming::header_tests::blocked_promotion_header_does_not_stop_actor_control_progress ... ok
test ca_update_audit_tests::no_timer_locks_signing_and_wrong_issuer_cannot_replace_the_unlocked_source ... ok
test embedded::priming::header_tests::promoted_owned_attach_opens_a_missing_native_writer_binding ... ok
test embedded::priming::tests::abandoned_preparation_cancels_even_before_the_owned_task_first_polls ... ok
test embedded::priming::tests::flow_control_blocked_shadow_does_not_stop_actor_control_progress ... ok
test embedded::priming::tests::later_input_is_hedged_without_resending_the_first_suffix ... ok
test embedded::priming::tests::overlap_and_stale_snapshot_do_not_spend_browser_credit ... ok
test embedded::priming::header_tests::promotion_never_publishes_an_unstarted_shadow_flight_as_credited ... ok
test embedded::priming::tests::snapshot_notice_precedes_repaint_and_duplicates_spend_no_browser_credit ... ok
test embedded::priming::tests::shadow_input_and_snapshot_credit_have_independent_bounded_windows ... ok
test embedded::priming::tests::stream_reuse_waits_for_the_retired_flight_to_join ... ok
test embedded::regressions::agent_link_loss_invalidates_the_last_live_session_snapshot ... ok
test embedded::regressions::actor_batch_probes_every_ready_route_without_payload_notifications ... ok
test embedded::regressions::child_spawn_disposes_inherited_stdin ... ok
test embedded::regressions::credited_bulk_output_survives_forwarder_io_pause ... ok
test embedded::regressions::credited_output_queue_at_stream_capacity ... ignored, debug actor memory/scheduling measurement; run without concurrent builds
test embedded::regressions::expired_route_retires_full_consumer ... ok
test embedded::regressions::expired_route_waits_for_browser_authority_before_rebind ... ok
test embedded::regressions::full_output_queue_must_not_block_shared_actor ... ok
test embedded::regressions::greeted_links_that_die_young_escalate_the_actor_retry_delay ... ok
test bootstrap_api::tests::setup_status_tests::late_setup_subscriber_receives_failure_and_retry_completion ... ok
test embedded::regressions::healthy_receiver_survives_ready_native_output_burst ... ok
test embedded::regressions::credit_tests::retained_input_credit_parks_only_the_full_writer_until_its_ack ... ok
test embedded::regressions::idle_route_proofs_do_not_queue_payload_notifications_at_capacity ... ok
test embedded::regressions::liveness_doubt_breakit_r2_tests::a_pinned_dead_host_retires_within_two_ceilings_without_doubt ... ok
test embedded::regressions::liveness_doubt_breakit_r2_tests::a_window_that_reconnects_mid_doubt_is_told_and_recovered ... ok
test embedded::regressions::liveness_doubt_breakit_r2_tests::doubt_retry_sends_one_notice_per_window_per_episode ... ok
test embedded::regressions::liveness_doubt_breakit_tests::a_window_full_at_doubt_start_is_told_on_a_later_tick ... ok
test embedded::regressions::liveness_doubt_breakit_tests::doubt_and_retire_times_per_rtt ... ok
test embedded::regressions::liveness_doubt_breakit_tests::inflated_host_link_still_retires_a_dead_host_within_four_seconds ... ok
test embedded::regressions::liveness_doubt_breakit_tests::queued_path_at_the_ceiling_does_not_flap_doubt_every_probe ... ok
test bootstrap_api::tests::setup_status_tests::review_account_scope_lost_setup_source_reports_unavailable_and_retires ... ok
test embedded::regressions::native_input_retention_leaves_terminal_probes_to_the_route ... ok
test embedded::regressions::output_and_snapshot_spend_remaining_restart_credit ... ok
test embedded::regressions::path_tests::full_ack_releases_retention_and_duplicate_input_is_not_replayed ... ok
test embedded::regressions::path_tests::full_retention_replays_as_legal_frames_with_contiguous_offsets ... ok
test embedded::regressions::path_tests::initial_attachment_keeps_input_cut_through_before_its_first_ack ... ok
test embedded::regressions::path_tests::input_retention_cost_at_200_terminals ... ignored, Run alone on the perf VM under the shared benchmark lock.
test embedded::regressions::path_tests::input_retention_refuses_excess_before_advancing_the_cursor ... ok
test embedded::regressions::path_tests::replacement_replays_only_the_unacknowledged_suffix_and_queued_input ... ok
test embedded::regressions::path_tests::reply_queue_deadline_and_live_reply_do_not_change_typing_offsets ... ok
test embedded::regressions::path_tests::review_pending_input_limit_retires_only_its_attachment ... ok
test embedded::regressions::path_tests::review_reply_bypasses_queued_typing_without_losing_its_cursor_or_bytes ... ok
test embedded::regressions::plugin_control_notice_preserves_capability_invalidation ... ok
test embedded::regressions::query_reply_compatibility_notice_is_strict_and_session_bound ... ok
test embedded::regressions::real_agent_canonical_uuid_result_is_accepted ... ok
test embedded::regressions::real_agent_open_uses_uid_and_character_dimensions ... ok
test embedded::regressions::reattach_must_restore_output_credit ... ok
test embedded::regressions::recovered_route_ignores_stale_browser_rebind ... ok
test embedded::regressions::recovery_event_then_snapshot_keeps_embedded_connection_live ... ok
test embedded::regressions::recovery_notices_preserve_order_credit_and_session_isolation ... ok
test embedded::regressions::replay_complete_notices_preserve_optional_geometry_through_server ... ok
test embedded::regressions::replay_geometry_rejects_values_outside_u16 ... ok
test embedded::regressions::resumed_writer_closes_previous_route_before_shared_stream_reuse ... ok
test embedded::regressions::resumed_writer_for_other_session_preserves_live_route ... ok
test embedded::regressions::saturated_control_pong_does_not_retire_connection ... ok
test embedded::regressions::server_reload_mask_is_not_inherited_by_embedded_children ... ok
test embedded::regressions::stream_close_must_not_restart_all_sessions ... ok
test embedded::regressions::uncredited_output_or_repaint_is_rejected_before_queueing ... ok
test embedded::regressions::healthy_streams_progress_at_user_attachment_capacity ... ok
test embedded::reply_order_tests::browser_reply_follows_typing_across_both_forwarding_tasks ... ok
test embedded::reply_order_tests::full_reply_reservations_preserve_keyboard_bytes_and_all_eight_slots ... ok
test embedded::writes::tests::bounded_lane_metadata_and_flight_sizes ... ok
test embedded::writes::tests::cached_promotion_ack_never_replays_inside_the_actor ... ok
test embedded::writes::tests::enabling_owned_writes_preserves_unsent_replacement_input ... ok
test embedded::writes::tests::full_control_lane_keeps_all_terminal_owner_slots_available ... ok
test embedded::writes::tests::promotion_headers_preserve_attach_credit_ack_input_order ... ok
test embedded::writes::tests::saturated_control_queue_preserves_fifo_and_shutdown_owns_flights ... ok
test embedded::writes::tests::socket_completion_cannot_spend_unacknowledged_writer_credit ... ok
test enrollment::authority::tests::admission_uses_enrolled_uid_and_exact_public_identity_validity ... ok
test enrollment::authority::tests::renewal_preserves_overlap_and_refuses_changed_key_or_expired_predecessor ... ok
test embedded::regressions::liveness_doubt_breakit_tests::retired_doubt_never_confirms_a_replacement_link_mid_replay ... ok
test enrollment::authority::tests::revocation_is_owner_bound_and_denies_admission_and_renewal_after_commit ... ok
test bootstrap_api::tests::setup_status_tests::review_r2_restored_setup_source_still_reports_unavailable ... ok
test enrollment::binding_tests::redemption_binds_only_the_certificate_minted_by_that_consumption ... ok
test enrollment::binding_tests::replacement_proof_rechecks_certificate_and_host_validity ... ok
test enrollment::binding_tests::replacement_proof_requires_its_consumed_invitation_and_exact_certificate ... ok
test enrollment::binding_tests::unknown_historical_consumption_never_proves_replacement ... ok
test enrollment::bootstrap_retirement::ownership_regression::retirement_requires_an_unfinished_intent ... ok
test enrollment::bootstrap_retirement::tests::proven_completion_is_owner_bound_and_survives_restart ... ok
test enrollment::bootstrap_retirement::tests::retirement_consumes_only_its_owned_intent_with_the_tombstone ... ok
test enrollment::bootstrap_retirement::tests::startup_preserves_a_published_live_session_and_its_setup_intent ... ok
test enrollment::bootstrap_retirement::tests::startup_retires_only_unfinished_provisioning_and_is_idempotent ... ok
test enrollment::migration_tests::hostname_migration_allocates_around_retained_names ... ok
test enrollment::migration_tests::canvas_layout_migration_upgrades_production_v27_and_fresh_schema_in_order ... ok
test enrollment::migration_tests::hostname_migration_upgrades_release6_copy_without_changing_canvas_or_checksums ... ok
test embedded::regressions::half_open_infraternal_agent_route_loses_inventory_without_eof ... ok
test generation_copy::tests::dropping_copy_request_keeps_io_live_and_fences_owned_until_engine_finishes ... ok
test generation_copy::tests::dropping_polled_copy_waiter_keeps_io_live_and_fences_owned_until_engine_finishes ... ok
test generation_copy::tests::successful_copy_returns_the_still_owned_fence ... ok

running 1 test
test enrollment::migration_tests::invitation_certificate_migration_preserves_unknown_history_and_bounds_new_bindings ... ok

running 1 test
test enrollment::migration_tests::old_uuid_mesh_placeholders_upgrade_to_audited_unnamed_labels ... ok

running 1 test
test enrollment::migration_tests::remote_identity_and_sessions_upgrade_dev_v11_and_remain_idempotent ... ok
test bootstrap_api::tests::setup_status_tests::setup_replay_outlives_its_socket_and_logout_retires_delivery ... ok
test generation_writers::tests::ambiguous_or_mistyped_sequence_refuses_admission_without_repair ... ok
test generation_writers::tests::committed_reservation_survives_process_death_without_connection_close ... ok
test generation_writers::tests::concurrent_reservations_serialize_distinct_committed_intervals ... ok
test generation_writers::tests::exhausted_reservation_preserves_previous_sequence ... ok
test embedded::regressions::unresponsive_child_is_killed_and_reaped_within_the_shutdown_bound ... ok
test generation_runtime::tests::trial_defers_every_public_accept_until_its_commit_opens_the_gate ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.68s

test generation_runtime::tests::trial_defers_every_public_accept_until_its_commit_opens_the_gate ... ok
test generation_writers::tests::missing_or_regressed_sequence_refuses_to_infer_deleted_writer_history ... ok
test generation_writers::tests::nested_or_nondurable_reservation_cannot_claim_commit ... ok
test generation_writers::tests::physically_read_only_admission_refuses_reservation_without_file_changes ... ok
test generation_writers::tests::historical_rollback_skips_deleted_current_writers_without_changing_snapshot ... ok
test generation_writers::tests::writer_reservation_crash_helper ... ignored, private subprocess for committed writer-floor crash validation
test listener_handoff::tests::ephemeral_listener_export_is_refused ... ok

running 1 test
test bootstrap_runtime::remote_backend::tests::review_cleanup::review_cancelled_committed_invitation_survives_temporary_writer_contention ... ok
test bootstrap_runtime::remote_backend::tests::retirement_contention::cancelled_invitation_retires_after_sqlite_busy_timeout ... ok

running 1 test
test liveness::tests::a_doubt_recovered_at_the_ceiling_pins_until_the_path_drains ... ok

running 1 test
test listener_handoff::tests::listener_survives_exec_after_serving_owner_drops ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.00s

test liveness::tests::a_recovered_doubt_below_the_ceiling_keeps_early_notice ... ok
test liveness::tests::a_reply_during_doubt_clears_it_and_renews_the_route ... ok
test listener_handoff::tests::parent_manifest_is_not_a_child_handoff ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.01s

test liveness::tests::an_unanswered_host_link_retires_at_the_startup_grace_without_doubt ... ok
test listener_handoff::tests::parent_manifest_is_not_a_child_handoff ... ok
test liveness::tests::delayed_server_probe_does_not_expire_an_answered_route ... ok
test liveness::tests::healthy_reply_survives_a_150ms_server_stall ... ok
test liveness::tests::browser_doubts_one_mobile_delay_and_retires_only_after_two_allowances ... ok
test liveness::tests::host_and_browser_allowance_cover_one_loss_recovery ... ok
test liveness::tests::host_allowance_has_a_floor_a_settled_long_haul_value_and_a_ceiling ... ok
test liveness::tests::jitter_allowance_decays_after_the_link_settles ... ok

running 1 test
test liveness::tests::host_link_doubts_on_the_first_miss_and_retires_on_the_second ... ok
test liveness::tests::missing_replies_expire_even_with_probes_in_flight ... ok
test liveness::tests::pipelined_requests_do_not_renew_an_outstanding_deadline ... ok
test liveness::tests::quiet_dead_browser_retires_within_two_floors_plus_one_interval ... ok
test liveness::tests::ready_reply_only_pulls_forward_an_answered_probe_after_one_tick ... ok
test liveness::tests::recent_application_progress_preserves_the_first_tick_cadence ... ok
test liveness::tests::restarting_monitoring_never_reuses_an_old_issued_probe ... ok
test liveness::tests::serial_probe_accepts_a_timely_rtt_step_without_renewing_unsolicited_replies ... ok
test liveness::tests::late_native_probe_keeps_its_unissued_reply_allowance ... ok
test liveness::tests::serial_probe_deadline_includes_only_one_gap_and_the_estimated_allowance ... ok
test liveness::tests::suspended_browser_keeps_its_lease_and_relearns_the_mobile_path ... ok
test liveness::tests::variation_uses_the_previous_smoothed_sample ... ok
test liveness::tests::terminal_routes_still_end_their_lease_on_the_first_miss ... ok

running 1 test
test listener_handoff::tests::listener_survives_exec_after_serving_owner_drops ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.00s

test listener_handoff::tests::listener_survives_exec_after_serving_owner_drops ... ok
test generation_writers::tests::reservation_is_committed_before_reply_and_survives_reopen ... ok
test generation_writers::tests::writable_admission_applies_manifest_floor_without_repeated_reservation ... ok
test mesh_api_tests::identity::identity_migration_preserves_inventory_and_retired_audit_ids ... ok
test generation_runtime::tests::writable_generation_storage_is_full_retains_wal_and_admits_the_launch_floor ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 1.10s

test generation_runtime::tests::writable_generation_storage_is_full_retains_wal_and_admits_the_launch_floor ... ok
test generation_runtime::tests::read_only_serving_answers_from_physically_read_only_state_and_creates_nothing ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 1.17s

test generation_runtime::tests::read_only_serving_answers_from_physically_read_only_state_and_creates_nothing ... ok
test bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority ... ok
test mesh_api_tests::claude_review::claude_review_late_committing_observation_does_not_rewind_last_seen ... ok
test mesh_api_tests::concurrent_tag_edits_serialize_revisions_and_unique_names ... ok
test mesh_api_tests::identity::retired_identity_survives_database_reopen_and_exhaustion_is_atomic ... ok
test mesh_api_tests::mesh_api_scale_benchmark ... ignored, scale measurement; run on infraternal-dev under the weighted user scope
test bootstrap_runtime::key_authority_tests::key_export_rechecks_role_session_and_cold_lock ... ok
test mesh_api_tests::claude_review::claude_review_scoped_grant_cannot_target_node_in_unscoped_tag ... ok
test mesh_api_tests::parser_rejects_unknown_fields_user_endpoints_and_invalid_bounds ... ok
test mesh_api_tests::identity::review_deleted_node_identity_is_not_reused ... ok
test mesh_api_tests::invalidation::review_membership_change_notifies_other_visible_tag ... ok
test mesh_api_tests::invalidation::filtered_view_invalidations_follow_every_affected_host_tag ... ok
test mesh_api_tests::inventory_lifecycle_preserves_policy_identity_and_audits_every_edit ... ok
test mesh_api_tests::membership::review_scoped_membership_cannot_claim_hidden_node ... ok
test mesh_api_tests::shared_mesh_vectors_cover_each_production_action_and_wire_shape ... ok
test mesh_api_tests::pagination::continuation_restarts_on_change_and_rechecks_permissions ... ok
test mesh_api_tests::membership::scoped_membership_checks_pre_edit_host_scope ... ok
test mesh_api_tests::review_filtered::review_global_viewers_do_not_refresh_unrelated_filtered_inventory ... ok
test mesh_api_tests::review_null_policy::review_null_port_policy_does_not_create_unrestricted_grant ... ok
test mesh_api_tests::review_null_scope::review_null_role_scopes_preserve_denied_inventory_access ... ok
test mesh_api_tests::pagination::an_unsendable_object_returns_a_sanitized_service_error ... ok
test generation_writers::tests::cancelled_reservation_never_leaves_a_writer_transaction_without_an_owner ... ok
test mesh_api_tests::scoped_grant_role_filters_inventory_and_cannot_cross_tags ... ok
test mesh_api_tests::storage_diagnostics::changed_storage_failure_reports_the_previous_count ... ok
test mesh_api_tests::storage_diagnostics::coordinator_loading_preserves_missing_server_and_sql_reasons ... ok
test mesh_api_tests::storage_diagnostics::invalid_stored_column_is_skipped_without_panicking ... ok
test mesh_api_tests::storage_diagnostics::coordinator_clones_share_failure_counts_and_report_recovery ... ok
test mesh_api_tests::storage_diagnostics::coordinator_stored_column_refuses_without_panic_and_recovers_after_repair ... ok
test mesh_api_tests::storage_diagnostics::invalid_stored_host_is_reported_once_by_id ... ok
test mesh_api_tests::watch_deadline::watch_deadline_scale_benchmark ... ignored, weighted local scale measurement; run optimized without concurrent compilation
test mesh_api_tests::storage_diagnostics::malformed_host_keeps_healthy_inventory_readable ... ok
test mesh_api_tests::review_frame_budget::review_mesh_design_point_frames_fit_shared_socket_budget ... ok
test plugins::node_lifecycle::tests::disabling_replacement_and_retirement_join_the_correct_node_worker ... ok
test node_bridge::scope_tests::installed_machine_support_ends_with_its_current_authority ... ok
test plugins::server_lifecycle_tests::recovery_and_pre_admission_enable_never_launch_server_workers ... ok
test plugins::server_lifecycle_tests::server_worker_starts_once_after_listener_admission_and_disable_joins_it ... ok
test release_build_tests::release_build_marker_is_explicit ... ok
test plugins::server_lifecycle_tests::admitted_handoff_fences_disable_and_an_old_scope_never_revives ... ok
test release_host_catalog::tests::host_offer_refuses_other_versions_architectures_tampering_and_unsafe_metadata ... ok
test release_host_catalog::tests::runtime_catalog_refuses_unsafe_requests_without_filesystem_or_network_work ... ok
test mesh_api_tests::storage_diagnostics::malformed_unrelated_host_preserves_scoped_inventory ... ok
test release_host_catalog::tests::signed_host_offer_binds_exact_version_architecture_size_and_independent_file_offsets ... ok
test release_http::tests::bounded_body_status_and_existing_destination_are_refused ... ok
test node_bridge::scope_tests::peer_bits_cannot_grant_installed_machine_authority ... ok
test release_host_catalog::tests::catalog_records_transfer_progress_without_inventing_a_running_identity ... ok
test release_http::tests::https_cannot_silently_accept_a_plaintext_bucket ... ok
test release_http::tests::unsupported_scheme_credentials_query_and_fragment_never_connect ... ok
test release_host_catalog::tests::runtime_catalog_uses_running_selection_and_bounds_cached_and_seed_payloads ... ok

running 1 test
test release_images::tests::staging_origin_override_is_unavailable_in_shipping_images ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.00s

test release_images::tests::staging_origin_override_is_unavailable_in_shipping_images ... ok
test release_images::tests::collection_refuses_aliases_and_preserves_every_explicit_keep ... ok
test release_latest::tests::bench_bounded_metadata_verification ... ignored, local weighted-scope verification latency benchmark
test release_latest::tests::bench_latest_fifty_callers ... ignored, local weighted-scope 50-caller real-engine RSS measurement
test release_images::tests::signed_payload_version_and_source_are_bound_to_the_same_manifest ... ok
test release_images::tests::unsafe_metadata_links_permissions_and_sizes_are_refused ... ok
test release_latest::tests::edge_pointer_is_verified_in_its_own_channel ... ok
test release_latest::tests::stable_empty_reports_opt_in_without_edge_request ... ok
test mesh_api_tests::storage_diagnostics::repeated_storage_failure_has_bounded_diagnostics ... ok
test release_payload::tests::a_missing_payload_never_enables_development_fallback ... ok
test release_payload::tests::a_valid_older_release_replayed_under_the_requested_version_is_refused ... ok
test release_payload::tests::cache_symlinks_and_shared_files_are_refused ... ok
test release_payload::tests::cross_architecture_cold_and_warm_cache_measurements ... ignored, run release-profile measurements in a weighted scope
test release_latest::tests::pointer_authenticates_signed_version_and_refuses_replays_tampering_and_duplicates ... ok
test release_payload::tests::concurrent_session_requests_publish_one_verified_artifact ... ok
test release_payload::tests::dangling_session_cache_symlink_is_refused_without_publication ... ok
test release_payload::tests::development_session_fallback_only_uses_trusted_local_artifacts_for_missing_release ... ok
test release_payload::tests::missing_wrong_version_tampered_network_and_development_only_fallback ... ok
test release_payload::tests::partial_download_restart_child ... ignored, subprocess helper for release-cache restart verification
test release_payload::tests::eight_concurrent_add_hosts_share_one_verified_download ... ok
test release_payload::tests::edge_add_host_keeps_exact_server_version_and_verified_cache ... ok
test mesh_api_tests::storage_diagnostics::settings_storage_failure_has_a_safe_original_reason ... ok
test release_payload::tests::refused_session_release_never_uses_development_fallback ... ok
test release_payload::tests::resolver_startup_removes_only_owned_inactive_private_staging ... ok
test release_payload::tests::session_staging_cleanup_preserves_active_and_unknown_files ... ok
test release_payload::tests::advertised_session_missing_digest_or_signature_never_falls_back ... ok
test release_payload::tests::signed_download_cache_hit_offline_and_tampered_cache ... ok
test release_payload::tests::signed_session_absence_is_cached_and_reauthenticated_offline ... ok
test remote_accept::tests::anonymous_capacity_and_single_source_cannot_consume_known_reserve ... ok
test release_payload::tests::session_payloads_are_signed_on_both_architectures_and_reused_offline ... ok
test remote_admission::tests::source_admission_cost_at_1000_sources ... ignored, optimized source admission diagnostic; no own build overlap
test release_payload::tests::session_cache_refuses_shared_payloads_symlinks_and_unsafe_absence ... ok
test remote_admission::tests::ports_do_not_change_source_capacity_and_mapped_addresses_share_it ... ok
test release_payload::tests::signed_session_version_replay_and_untrusted_key_are_refused ... ok
test mesh_api_tests::storage_diagnostics::unrelated_success_does_not_reset_a_persistent_write_failure ... ok
test release_payload::tests::restarted_resolution_reclaims_partial_downloads_after_process_stop ... ok
test release_images::tests::image_store_remains_bounded_across_twenty_check_ins ... ok
test remote_agent_state::tests::inventory_identity_preserves_convergence_and_changed_versions_need_a_new_check ... ok
test remote_agent_state::tests::late_capability_observation_does_not_erase_convergence_and_legacy_is_unknown ... ok
test remote_guard::cut_tests::cancellation_survives_last_transport_until_durable_tombstone ... ok
test remote_agent_state::tests::malformed_identity_or_phase_preserves_the_last_authenticated_observation ... ok
test remote_http::tests::enrollment_api_at_1000_hosts ... ignored, explicit real HTTP-adapter/SQLite signing measurement at 1000 hosts; not transport or whole-daemon evidence
test mesh_api_tests::storage_diagnostics::storage_failures_have_safe_reasons_and_recover_after_repair ... ok
test remote_agent_state::tests::transfer_receipt_does_not_claim_a_new_running_version_and_revocation_prevents_late_writes ... ok
test remote_enrollment::tests::cold_locked_signer_preserves_admission_and_token_until_authenticated_unlock ... ok
test remote_guard::cut_tests::provisional_ssh_authority_requires_exact_pending_owner_and_uid ... ok
test remote_enrollment::tests::invalid_csr_does_not_burn_token_and_join_returns_only_committed_authority ... ok
test remote_agent_state::tests::pre_migration_recovery_inventory_remains_readable_without_schema_writes ... ok
test remote_enrollment::tests::invalid_invitations_never_load_the_private_signer ... ok
test remote_inventory::measurements::inventory_and_reconnect_at_128_hosts ... ignored, perf VM only: 128-host inventory and durable observation measurement
test remote_http::tests::invitation_publication_rechecks_session_after_host_creation ... ok
test remote_http::tests::enrollment_http_is_bound_single_use_and_preserves_token_while_locked ... ok
test mesh_api_tests::storage_diagnostics::sqlite_admission_failures_have_distinct_safe_reasons ... ok
test remote_http::tests::revocation::claude_review_anonymous_stalled_joins_cannot_block_owner_revocation ... ok
test remote_http::tests::revocation::permission_revoked_while_waiting_for_sqlite_writer_refuses_tombstone ... ok
test remote_http::tests::revocation::cold_signer_does_not_block_owner_revocation_or_cancellation ... ok
test remote_inventory::name_tests::an_ip_added_host_uses_its_cached_hostname_and_old_facts_do_not_clear_it ... ok
test remote_http::tests::revocation::abandoned_revocation_write_cannot_leave_committed_authority_live ... ok
test remote_removal::review_tests::accepted_uninstall_names_the_objects_it_leaves ... ok
test remote_removal::review_tests::no_commands_for_a_host_setup_did_not_install ... ok
test remote_removal::review_tests::review_manual_commands_are_gated_on_this_hosts_bootstrap_owner ... ok
test remote_removal::review_tests::review_manual_commands_stop_only_this_installations_sessions ... ok
test remote_removal::review_tests::review_manual_rootful_commands_delete_only_marked_kernel_objects ... ok
test remote_removal_http::tests::removal_parsers_refuse_positional_duplicate_and_unbounded_inputs ... ok
test remote_http::tests::revocation::revocation_rechecks_locked_expired_logged_out_and_wrong_owner_sessions ... ok
test remote_inventory::name_tests::reported_names_yield_to_records_and_collision_suffixes_and_server_identity_hold ... ok
test remote_inventory::name_tests::late_hostname_inventory_renames_the_attached_mesh_node_and_notifies_viewers ... ok
test remote_inventory::name_tests::inventory_hostname_changes_publish_once_and_preserve_hand_names ... ok
test remote_inventory::tests::admitted_hosts_are_account_scoped_offline_and_revocation_filtered ... ok
test remote_inventory::tests::unredeemed_invitations_are_not_admitted_and_cursors_are_canonical ... ok
test remote_mesh_revocation_tests::committed_host_revocation_pushes_peer_withdrawal_without_polling ... ok
test remote_runtime::tests::additional_listeners::additional_listener_refuses_unenrolled_certificate_before_proof_reply ... ok
test remote_runtime::tests::cancelled_native_read_retains_dequeued_packet ... ok
test remote_runtime::tests::candidate_proofs::quic_candidate_proof_waits_for_hello_and_preserves_its_suffix ... ok
test remote_runtime::tests::candidate_proofs::candidate_proof_refuses_a_second_probe_and_invalid_hello ... ok
test remote_runtime::tests::candidate_proofs::tls_candidate_proof_waits_for_hello_and_preserves_its_suffix ... ok
test remote_runtime::tests::ephemeral_listener_pair_retries_real_udp_collision_without_leaking_tcp ... ok
test remote_runtime::tests::explicit_listener_pair_never_moves_an_occupied_operator_port ... ok
test remote_runtime::tests::independent_review::admitted_frame_write_fence_cost ... ignored, write-fence CPU diagnostic; run release alone, not whole-transport evidence
test remote_runtime::tests::additional_listeners::initial_overlay_admission_has_no_underlay_guess ... ok
test remote_runtime::tests::additional_listeners::additional_listener_keeps_underlay_address_and_retires_with_its_lease ... ok
test remote_runtime::tests::additional_listeners::admitted_connection_moves_to_a_leased_address_and_back_without_readmission ... ok
test remote_runtime::tests::additional_listeners::ipv6_wildcard_listener_reuses_binding_and_preserves_ipv4_discovery ... ok
test remote_runtime::tests::late_native_detach_after_peer_stop_keeps_the_control_connection ... ok
test remote_runtime::tests::late_native_detach_after_peer_close_keeps_the_control_connection ... ok
test remote_runtime::tests::additional_listeners::leased_tcp_admits_current_identity_releases_lease_and_keeps_primary_usable ... ok
test remote_runtime::tests::additional_listeners::wildcard_listener_reuses_binding_and_tracks_destination_lease_counts ... ok
test remote_runtime::tests::ping_flood::primary_ping_during_terminal_flood ... ignored, 10-minute real PTY measurement; pinned VM lock and INFRATERNAL_PING_BINARY required
test remote_runtime::tests::quic_actor_binds_durable_writer_and_recovery_offsets ... ok
test remote_runtime::tests::independent_review::review_expired_identity_must_refuse_new_attachment_on_existing_transport ... ok
test remote_runtime::tests::remote_peer_routing_capability_does_not_retain_the_host_registry ... ok
test remote_runtime::tests::renewal_checks::renewal_refuses_same_issuer_wrong_key_purpose_or_lifetime_before_publication ... ok
test remote_runtime::tests::renewal_checks::renewal_validates_host_dates_json_and_durable_publication_before_ack ... ok
test remote_runtime::tests::machine::admitted_machine_round_trip_preserves_the_exact_bounded_body ... ok
test remote_runtime::tests::machine::cancelled_machine_waiter_cannot_admit_a_second_flight_before_its_reply ... ok
test remote_runtime::tests::revocation::guard_bookkeeping_at_1000_hosts ... ignored, guard component diagnostic; run alone without builds or browser measurements
test remote_runtime::tests::retired_native_writer_frames_cannot_close_or_ack_its_replacement ... ok
test remote_runtime::tests::revocation::retirement::registry_retention_at_1000_actual_tls_hosts ... ignored, 1000-host registry diagnostic; optimized, FD limit8192, no own build/browser overlap
test remote_runtime::tests::machine::peer_capability_cannot_turn_provisioning_into_installed_machine_authority ... ok
test remote_runtime::tests::claude_review_idle_anonymous_sockets_cannot_starve_host_handshakes ... ok
test remote_runtime::tests::independent_review::committed_tombstone_cannot_forward_input_before_finalizer_returns ... ok
test remote_runtime::tests::independent_review::review_revocation_must_cancel_input_on_existing_tls_transport ... ok
test remote_runtime::tests::revocation::expired_identity_must_refuse_new_attachment_on_existing_transport ... ok
test remote_runtime::tests::revocation::revocation_closes_admitted_idle_quic_connection ... ok
test remote_runtime::tests::revocation::retirement::revoked_host_releases_its_registry_entry_and_retained_actor ... ok
test remote_runtime::tests::ssh_bridge::ssh_greeting_keeps_full_capabilities_and_coalesced_frames ... ok
test remote_runtime::tests::ssh_bridge::component_off_retires_ssh_fallback_after_installed_admission ... ok
test remote_runtime::tests::ssh_bridge::ssh_bridge_does_not_invent_node_path_capabilities ... ok
test remote_runtime::tests::revocation::revocation_must_cancel_input_on_existing_tls_transport ... ok
test remote_runtime::tests::ssh_bridge::refused_installed_reattachment_restores_the_ssh_writer ... ok
test remote_runtime::tests::standby::control_pause::cancelled_control_packet_survives_pause_and_resumes_before_queued_sibling ... ok
test remote_runtime::tests::ssh_bridge::ssh_greeting_refuses_invalid_first_frames_and_releases_its_master ... ok
test remote_runtime::tests::ssh_bridge::ssh_bridge_retires_only_after_installed_writer_acknowledges ... ok
test remote_runtime::tests::standby::a_second_parked_fallback_cannot_replace_the_first ... ok
test remote_runtime::tests::standby::control_queue::saturated_native_control_queue_does_not_hide_primary_terminal_output ... ok
test remote_runtime::tests::standby::control_queue::scheduled_probe_preserves_primary_at_full_native_control_capacity ... ok
test remote_runtime::tests::revocation::admitted_guard_expires_and_prior_revocation_cannot_reregister ... ok
test remote_runtime::tests::standby::parked_fallback_is_cancelled_by_ledger_revocation ... ok
test remote_inventory::pagination_tests::long_destinations_stay_bounded_and_all_pages_are_complete ... ok
test remote_runtime::tests::standby::primed_fallback_activates_after_the_primary_closes ... ok
test remote_runtime::tests::standby::primed_fallback_hedges_when_credit_arrives_behind_a_blocked_primary_write ... ok
test remote_runtime::tests::standby::primed_fallback_hedges_while_primary_native_send_buffer_is_full ... ok
test remote_standby::tests::bounded_standby_options_reject_ambiguous_or_unrecognized_fields ... ok
test remote_standby::tests::cancelled_queue_admission_releases_parking_before_actor_poll ... ok
test remote_runtime::tests::tcp_actor_uses_enrolled_uid_and_replays_admission_hello ... ok
test remote_standby_request::tests::requests_require_objects_and_exact_fields ... ok
test remote_standby::tests::parking_is_per_identity_bounded_and_released_on_drop ... ok
test remote_startup::tests::normal_cold_start_uses_public_trust_without_loading_or_generating_ca_key ... ok
test remote_startup::tests::symlink_shared_oversized_or_special_trust_files_fail_closed ... ok
test remote_runtime::tests::standby::primed_hedge_survives_blocked_control_call ... ok
test remote_startup::tests::wrong_issuer_key_name_or_unpinned_https_refuses_startup ... ok
test remote_runtime::tests::standby::primed_standby_greets_without_replacing_the_live_actor_before_activation ... ok
test runtime::remote_demo_tests::cold_start::normal_cli_cold_start_keeps_enrolled_remote_terminal_while_signing_locked ... ignored, normal CLI cold-start proof requires static INFRATERNAL_REMOTE_TEST_BINARY and exclusive 4701/7443
test runtime::remote_demo_tests::cold_start::release_transition_recovers_enrolled_host_after_long_outage ... ignored, requires isolated release binaries and a ten-minute outage
test runtime::remote_demo_tests::real_host::o1_rootless_join_terminal_and_cleanup ... ignored, authorised o1 proof requires pinned INFRATERNAL_O1_KNOWN_HOSTS and aarch64 INFRATERNAL_REMOTE_TEST_BINARY; exclusive 4701/7443
test runtime::remote_demo_tests::real_host::o1_runtime_path_admits_real_unix_socket_address ... ok
test runtime::remote_demo_tests::remote_cli_enrollment_and_browser_terminal_two_processes ... ignored, two-process proof requires INFRATERNAL_REMOTE_TEST_BINARY and exclusive port 4701
test runtime::generation_tests::legacy_runtime_remains_normal_and_checkpoints_on_last_close ... ok
test remote_runtime::tests::standby::tcp_fallback_parks_without_a_host_actor_and_activates_on_the_existing_tls_channel ... ok
test runtime::generation_tests::full_runtime_replacement_preserves_latest_wal_without_restart_writes ... ok
test runtime::remote_demo_tests::renewal_cli::cli_live_renewal_cost_and_durable_identity_on_unchanged_transport ... ignored, real CLI renewal measurement requires release binary and exclusive port4701; no own compilation/browser overlap
test runtime::remote_demo_tests::renewal_cli::flood::remote_cli_renewal_under_50m_load_preserves_every_byte_and_writer ... ignored, real CLI 50MiB renewal proof: exclusive4701 and release binary; no own build/browser overlap
test runtime::remote_demo_tests::shipping_route::independent_review_configured_server_mounts_ca_unlock_routes ... ok
test runtime::remote_demo_tests::renewal::half_life_requests_proof_on_live_authenticated_control ... ok
test runtime::reviewer_admission::reviewer_recovery_source_limit_covers_all_routes_without_forwarding_bypass ... ok
test runtime::temporal_admission_tests::ca_budget_cost_at_capacity ... ignored, isolated debug admission diagnostic at 4096 principals; run without own build overlap
test runtime::remote_demo_tests::shipping_route::review_default_server_must_register_remote_join ... ok
test runtime::tests::empty_no_color_does_not_disable_terminal_logs ... ok
test remote_runtime::tests::standby::detached_primed_writers_release_native_binding_budget ... ok
test runtime::tests::proxy_mode_requires_an_explicit_peer_allowlist ... ok
test runtime::tests::proxy_networks_match_only_their_address_family_and_prefix ... ok
test runtime::remote_demo_tests::renewal_ack::unlock_renews_live_identity_only_after_publication_ack_with_terminal_intact ... ok
test runtime::remote_demo_tests::renewal_ack::failed_publication_retains_original_admission_without_interrupting_terminal ... ok
test runtime::tests::setup_socket_cleanup_preserves_symlinks_and_regular_files ... ok
test runtime::tests::setup_token_socket_is_private_and_requires_explicit_request ... ok
test remote_runtime::tests::standby::liveness_doubt::one_missed_primary_reply_shows_reconnecting_and_only_a_second_retires_the_link ... ok
test runtime::tests::router_migrates_private_storage_and_serves_health ... ok
test server_tls::tests::standalone_https_disables_nagle_before_application_bytes ... ok
test runtime::temporal_admission_tests::windows_principals_and_capacity_remain_bounded ... ok
test runtime::tests::production_router_exposes_bootstrap_owner_admission ... ok
test remote_runtime::tests::revocation::retirement::old_expiry_cannot_remove_a_fresh_tls_replacement ... ok
test runtime::tests::startup_with_owner_unlinks_stale_setup_token_socket ... ok
test ssh_key::tests::concurrent_initialization_retains_one_identity_and_unwrap_cannot_replace_it ... ok
test ssh_key::tests::lock_generation_exhaustion_never_wraps_into_an_unlocked_source ... ok
test ssh_key::tests::lock_during_administrator_unwrap_cannot_reinstall_private_material ... ok
test stream_close::tests::a_close_naming_no_owned_session_prints_none_for_session_and_host ... ok
test stream_close::tests::a_dead_logger_is_counted_and_summarised_by_the_callers ... ok
test stream_close::tests::a_full_queue_drops_and_counts_instead_of_blocking ... ok
test ssh_key::tests::first_start_is_wrapped_once_and_every_cold_start_is_locked ... ok
test stream_close::tests::an_unavailable_agent_stream_is_reported_as_a_link_drop ... ok
test ssh_key::tests::malformed_existing_storage_is_refused_without_generating_a_replacement ... ok
test stream_close::tests::close_line_has_session_counters_and_never_copies_untrusted_close_text ... ok
test stream_close::tests::close_path_cost ... ignored, manual microbenchmark
test stream_close::tests::different_accounts_and_reason_categories_each_get_their_first_line ... ok
test stream_close::tests::mixed_reasons_and_closers_in_one_window_are_named_as_mixed ... ok
test stream_close::tests::one_close_line_and_one_summary_bound_an_account_storm ... ok
test stream_close::tests::client_chosen_session_ids_share_their_accounts_window ... ok
test terminal_queries::census_tests::census_cleanup_is_host_scoped_and_preserves_detached_live_queries ... ok
test stream_close::tests::the_thread_writes_the_first_close_and_summarises_the_rest_on_shutdown ... ok
test terminal_queries::lifecycle_tests::ended_sessions_release_query_slots ... ok
test terminal_queries::overflow_tests::oversized_osc_does_not_hide_the_next_query ... ok
test terminal_queries::review_tests::a_lagging_viewer_cannot_renew_a_deadline_after_the_first_viewer_answered ... ok
test stream_close::tests::a_full_table_keeps_rate_limiting_a_storm ... ok
test terminal_queries::review_tests::trimmed_output_refuses_its_answer_without_reopening_an_accepted_position ... ok
test terminal_queries::review_tests::two_positions_in_one_chunk_are_claimed_in_order_without_reopening_either ... ok
test terminal_queries::tests::deadline_includes_incomplete_query ... ok
test terminal_queries::tests::every_observed_output_position_can_identify_a_renderer_answer ... ok
test terminal_queries::tests::gaps_and_replay_never_authorize_unobserved_or_expired_positions ... ok
test ssh_key::tests::material_refuses_invalid_pem_and_non_ed25519_algorithms ... ok
test terminal_queries::tests::marked_flood_never_allocates_queries ... ok
test terminal_queries::tests::renderer_owns_reply_contents_but_size_and_identity_are_bounded ... ok
test terminal_queries::tests::only_one_reply_across_viewers_and_replay ... ok
test terminal_queries::tests::review_renderer_supported_query_forms_are_admitted ... ok
test terminal_queries::tests::style_controls_cannot_evict_queries_and_live_claims_never_reopen ... ok
test terminal_startup::tests::request_decoder_keeps_operation_fields_strict ... ok
test ssh_key::tests::unavailable_or_empty_custody_publishes_no_key ... ok
test terminal_startup::tests::switches_preserve_account_and_host_scope_across_concurrent_updates ... ok
test terminal_startup::tests::only_one_caller_claims_and_disabled_hints_do_not_consume_notice ... ok
test websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session ... ok
test websocket::cookie_tests::split_cookie_fields_preserve_socket_session ... ok
test websocket::link_notice_tests::doubt_notices_reach_only_viewers_that_announced_them_and_never_await_an_ack ... ok
test web_assets::tests::encodings_and_identity_have_correct_headers_and_sizes ... ok
test web_assets::tests::spa_and_mutable_assets_revalidate_and_missing_brotli_uses_gzip ... ok
test websocket::receive_tests::browser_websocket_close_keeps_its_code_and_discards_unknown_reason_text ... ok
test ssh_key::tests::update_handoff_preserves_unlocked_identity_but_cold_restart_does_not ... ok
test websocket::receive_tests::receive_failures_keep_protocol_size_and_idle_classifications ... ok
test websocket::recovery_notification_bench::recovery_notification_state_at_socket_capacity ... ignored, notification state sizing diagnostic, not allocator-inclusive RSS certification
test websocket::receive_tests::buffered_control_frames_cannot_monopolize_a_transport_turn ... ok
test runtime::key_runtime_tests::configured_startup_generates_once_and_settings_shares_its_cold_lock ... ok
test websocket::session_inventory_tests::inventory_reconciliation_at_200_sessions_and_50_accounts ... ignored, independent scale diagnostic; run in a weighted scope
test terminal_queries::corpus_tests::output_chunking_preserves_bounded_query_state ... ok
test websocket::session_inventory_tests::census_waiting_for_database_does_not_close_a_newly_created_live_session ... ok
test websocket::probe_authority::review_r2_restore::review_r2_revoked_lease_with_restored_source_never_polls_work ... ok
test websocket::write_tests::a_stalled_group_has_one_absolute_write_budget ... ok
test websocket::write_tests::ready_proofs_keep_message_boundaries_and_order_with_one_flush ... ok
test websocket::probe_authority::review_closed_watch::closed_revocation_watch_is_unavailable_and_never_polls_the_write ... ok
test websocket::session_inventory_tests::pending_agent_inventory_hides_cached_rows_until_the_first_census ... ok
test websocket::session_inventory_tests::reconciliation_before_saved_exit_keeps_the_authoritative_exit_status ... ok
test websocket::session_inventory_tests::available_snapshot_reports_live_rows_and_bounded_saved_exit_statuses ... ok
test websocket::writer_tests::authority_watchdog::authority_deadline_preserves_subsecond_session_expiry ... ok
test websocket::writer_tests::authority_watchdog::cap_review_r3::cancelled_storm_returns_every_place_without_duplication ... ok
test websocket::session_inventory_tests::restart_reconciliation_keeps_live_rows_and_closes_missing_rows ... ok
test websocket::writer_tests::authority_watchdog::cap_review_r3::deadline_storm_retains_exactly_four_places_then_recovers ... ok
test runtime::tests::restart_serves_fresh_setup_token_and_completes_owner_enrollment ... ok
test websocket::writer_tests::authority_watchdog::cap_review_r3::pool_acquire_timeout_recovers_places_without_releasing_the_connection ... ok
test websocket::writer_tests::authority_watchdog::cap_review_r3::ready_result_observed_after_deadline_retries_current_authority ... ok
test websocket::writer_tests::authority_watchdog::periodic_authority_read_fails_closed_at_the_bounded_wait ... ok
test websocket::writer_tests::authority_watchdog::periodic_authority_read_keeps_its_connection_owner_runnable ... ok
test websocket::writer_tests::authority_watchdog::periodic_authority_read_rejects_revocation_committed_by_its_operation ... ok
test websocket::writer_tests::authority_watchdog::periodic_authority_read_rejects_expiry_committed_by_its_operation ... ok
test websocket::writer_tests::authority_watchdog::periodic_authority_read_stops_side_effects_at_expiry ... ok
test websocket::writer_tests::authority_watchdog::periodic_authority_read_stops_side_effects_on_revocation ... ok
test websocket::writer_tests::writer_admission_at_user_capacity ... ignored, release-only scale measurement; run without concurrent builds
test terminal_queries::review_tests::all_session_tables_remain_bounded_at_the_registry_limit ... ok
test websocket_transport::queue_tests::full_browser_transport_proof_queue_keeps_connection_usable ... ok
test websocket_transport::queue_tests::full_browser_wire_proof_queue_keeps_connection_usable ... ok
test websocket_transport::tests::each_receive_end_has_a_structured_terminal_close_reason ... ok
test websocket_transport::tests::no_probe_in_an_active_idle_active_window ... ok
test websocket_transport::tests::visibility_notices_are_small_typed_transport_messages ... ok
test websocket::writer_tests::second_device_does_not_inherit_first_device_input_ack ... ok
test websocket::writer_tests::busy_edges::wall_expiry_and_monotonic_deadlines_keep_their_separate_roles ... ok
test websocket::writer_tests::resume_refusals_distinguish_connection_state_and_lost_token_rotation ... ok
test websocket::writer_tests::writer_ownership_capacity_unsigned_offsets_and_identity_reuse ... ok
test mesh_api_tests::watch_deadline::watch_deadline_matches_complete_filtered_snapshots ... ok
test remote_runtime::tests::standby::parked_fallback_survives_greeting_deadline_and_activates_without_another_hello ... ok
test websocket::writer_tests::busy_edges::revoked_probe_across_attempt_backoff_and_total_wait_edges ... ok
test websocket::writer_tests::busy_edges::expiry_crossing_a_stalled_read_refuses_both_deadline_callers ... ok
test websocket::writer_tests::authority_watchdog::cap_review_r3::sqlite_busy_timeout_recovers_detached_storm_without_unlocking ... ok

test result: ok. 740 passed; 0 failed; 55 ignored; 0 measured; 0 filtered out; finished in 408.09s

     Running tests/canvas_convergence.rs (target/debug/deps/canvas_convergence-47a9f10cfa376a13)

running 20 tests
test competing_bootstraps_merge_targets_and_retry_after_restart ... ok
test a_tiled_import_cannot_duplicate_an_existing_graph_kind ... ok
test imports_use_account_wide_target_identity_and_keep_spanning_column_geometry ... ok
test identical_and_empty_second_devices_do_not_advance_revision ... ok
test loading_repairs_only_matching_recovery_views_and_converges_clients ... ok
test merge_bounds_refuse_without_losing_the_existing_layout ... ok
test initialize_and_apply_repair_before_writing_and_notify_subscribers ... ok
test no_op_imports_keep_retry_receipts_and_do_not_clear_operation_history ... ok
test importing_an_orphaned_recovery_view_does_not_create_another_recovery_name ... ok
test simultaneous_first_devices_merge_disjoint_targets_into_one_view ... ok
test import_prefers_matching_names_before_the_first_view_of_its_kind ... ok
test session_import_identity_ignores_labels_but_checks_account_ownership ... ok
test stale_noop_still_checks_numeric_bounds_before_committing ... ok
test owned_session_reference_and_all_bounds_are_transactional ... ok
test split_retry_is_durable_and_changed_idempotency_input_is_refused ... ok
test permanent_receipts_do_not_copy_large_bootstrap_documents ... ok
test two_devices_serialize_stale_edits_and_replay_every_committed_revision ... ok
test encoded_document_budget_is_enforced_by_the_host_transaction ... ok
test no_op_import_receipts_still_have_a_bounded_quota ... ok
test close_beats_move_resize_in_both_orders_and_survives_compaction ... ok

test result: ok. 20 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.88s

     Running tests/canvas_receipt_count.rs (target/debug/deps/canvas_receipt_count-f70e20109308ab77)

running 1 test
test historical_receipts_backfill_and_follow_transactions_and_account_removal ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s

     Running tests/canvas_receipt_review.rs (target/debug/deps/canvas_receipt_review-4392b8cc5e7f9212)

running 1 test
test historical_no_revision_receipts_preserve_replay_and_the_last_real_edit ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.34s

     Running tests/canvas_recovery_review.rs (target/debug/deps/canvas_recovery_review-fbc02020fcb88cc5)

running 5 tests
test independent_loads_and_base_edit_repair_exactly_once ... ok
test repair_rebases_a_cursor_that_already_names_its_next_revision ... ok
test queued_close_of_unique_recovered_window_survives_repair ... ok
test queued_resize_keeps_its_membership_after_a_separate_read_repair ... ok
test recovery_at_column_capacity_keeps_the_account_readable ... ok

test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s

     Running tests/canvas_replay_noop.rs (target/debug/deps/canvas_replay_noop-a84933d472e1ae44)

running 1 test
test committed_noop_is_explicit_without_sending_all_closed_ids_to_clients ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s

     Running tests/canvas_retired_reference.rs (target/debug/deps/canvas_retired_reference-1e95d5ff57d72ba7)

running 2 tests
test retired_reference_does_not_block_an_unrelated_edit ... ok
test retarget_checks_account_ownership_even_after_close ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s

     Running tests/canvas_socket.rs (target/debug/deps/canvas_socket-87aa76da1f60dd7a)

running 1 test
test snapshot_then_ordered_commit_events_and_revocation_cancel_output ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s

     Running tests/canvas_text_bounds.rs (target/debug/deps/canvas_text_bounds-2114018d89bcf99b)

running 2 tests
test text_uses_the_browser_utf16_bound ... ok
test imported_name_respects_the_browser_utf16_bound ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/catalog_startup.rs (target/debug/deps/catalog_startup-c30b8dd5906b186b)

running 1 test
test explicit_catalog_startup_remains_public_and_validates_before_storage ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s

     Running tests/enrollment.rs (target/debug/deps/enrollment-a0b41c51d00e71d8)

running 6 tests
test enrollment_storage_at_500_hosts ... ignored, explicit 500-host storage measurement; not a remote transport budget
test malformed_capabilities_and_certificate_overflow_are_refused_before_mutation ... ok
test invitation_is_hashed_replaced_and_bound_to_owner_host_mode_and_exact_expiry ... ok
test invalid_certificate_and_failed_insert_preserve_the_invitation ... ok
test concurrent_redemption_has_one_winner_and_one_certificate ... ok
test revocation_tombstone_refuses_existing_and_new_invitations_after_restart ... ok

test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.30s

     Running tests/generation_storage_fixture.rs (target/debug/deps/generation_storage_fixture-172f80ec5c0500b9)

running 1 test
test retained_wal_marker ... ignored, orchestrator only: disposable bounded systemd installation

test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/mesh_parser.rs (target/debug/deps/mesh_parser-5549003fbc7ccdd7)

running 2 tests
test review_grant_parser_rejects_unknown_nested_port_fields ... ok
test nested_endpoint_and_policy_fields_are_strict_without_rejecting_valid_ports ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/mesh_review_plugin.rs (target/debug/deps/mesh_review_plugin-165dd8c08d59e990)

running 1 test
test review_mesh_dependency_is_removable_at_build_time ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s

     Running tests/mesh_review_policy.rs (target/debug/deps/mesh_review_policy-42d39494f3c4cd12)

running 1 test
test review_null_port_policy_is_refused ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/mesh_review_role_scope.rs (target/debug/deps/mesh_review_role_scope-b668bf71ee899387)

running 2 tests
test review_explicit_null_role_scopes_do_not_become_global_authority ... ok
test role_scopes_require_an_array_when_provided ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/native_probe_correlation_review.rs (target/debug/deps/native_probe_correlation_review-2a578093d866dbca)

running 25 tests
test liveness::tests::healthy_reply_survives_a_150ms_server_stall ... ok
test liveness::tests::a_recovered_doubt_below_the_ceiling_keeps_early_notice ... ok
test liveness::tests::delayed_server_probe_does_not_expire_an_answered_route ... ok
test liveness::tests::an_unanswered_host_link_retires_at_the_startup_grace_without_doubt ... ok
test liveness::tests::a_doubt_recovered_at_the_ceiling_pins_until_the_path_drains ... ok
test liveness::tests::a_reply_during_doubt_clears_it_and_renews_the_route ... ok
test liveness::tests::browser_doubts_one_mobile_delay_and_retires_only_after_two_allowances ... ok
test liveness::tests::pipelined_requests_do_not_renew_an_outstanding_deadline ... ok
test liveness::tests::ready_reply_only_pulls_forward_an_answered_probe_after_one_tick ... ok
test liveness::tests::quiet_dead_browser_retires_within_two_floors_plus_one_interval ... ok
test liveness::tests::recent_application_progress_preserves_the_first_tick_cadence ... ok
test liveness::tests::host_and_browser_allowance_cover_one_loss_recovery ... ok
test liveness::tests::serial_probe_accepts_a_timely_rtt_step_without_renewing_unsolicited_replies ... ok
test liveness::tests::host_link_doubts_on_the_first_miss_and_retires_on_the_second ... ok
test liveness::tests::suspended_browser_keeps_its_lease_and_relearns_the_mobile_path ... ok
test liveness::tests::serial_probe_deadline_includes_only_one_gap_and_the_estimated_allowance ... ok
test unissued_native_probe_reply_cannot_extend_readiness ... ok
test liveness::tests::jitter_allowance_decays_after_the_link_settles ... ok
test liveness::tests::late_native_probe_keeps_its_unissued_reply_allowance ... ok
test liveness::tests::missing_replies_expire_even_with_probes_in_flight ... ok
test liveness::tests::restarting_monitoring_never_reuses_an_old_issued_probe ... ok
test liveness::tests::terminal_routes_still_end_their_lease_on_the_first_miss ... ok
test liveness::tests::variation_uses_the_previous_smoothed_sample ... ok
test liveness::tests::host_allowance_has_a_floor_a_settled_long_haul_value_and_a_ceiling ... ok
test healthy_real_socket_survives_a_150ms_server_stall ... ok

test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s

     Running tests/plugin_host_review.rs (target/debug/deps/plugin_host_review-1d5f6bb39dba7846)

running 7 tests
test review_core_topic_remains_core_owned_even_when_declared ... ok
test review_undeclared_topic_is_left_to_the_core ... ok
test review_completed_call_survives_normal_worker_exit ... ok
test review_reenable_preserves_cancelled_calls_until_delivery ... ok
test review_disable_withdraws_view_and_keeps_socket ... ok
test review_disable_answers_inflight_call ... ok
test review_exited_worker_ends_its_subscriptions ... ok

test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.51s

     Running tests/plugin_settings_review.rs (target/debug/deps/plugin_settings_review-d06d01ab81cf5c3e)

running 3 tests
test plugin_settings_enforce_boolean_and_role_plugin_identity ... ok
test failed_plugin_save_restores_previous_state_without_workers ... ok
test plugin_switches_survive_database_reopen ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.64s

     Running tests/remote_plugin_contract.rs (target/debug/deps/remote_plugin_contract-c9821223920a5fb2)

running 1 test
test independent_review_core_build_without_features_omits_remote_transport ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.44s

     Running tests/review_mesh_host_removal.rs (target/debug/deps/review_mesh_host_removal-ecc8b31c20ea04b8)

running 1 test
test revoked_remote_host_is_withdrawn_from_mesh_peer_policy ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s

     Running unittests src/main.rs (target/debug/deps/infraternal_session-9eac3c8a322fcdd7)

running 2 tests
test tests::unsupported_commands_cannot_start_operator_roles_or_open_state ... ok

running 1 test
test tests::fresh_exec_closes_dumpability_before_private_startup ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s

test tests::fresh_exec_closes_dumpability_before_private_startup ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_shim-7416a2c023fe6f4f)

running 114 tests
test frame::checks::codec_reuse_measurement ... ignored, release codec and allocation-path measurement
test frame::checks::golden::every_frozen_message ... ok
test frame::checks::tests::invalid_lengths_types_and_utf8 ... ok
test frame::checks::approximate_snapshot_codec_is_bounded_and_canonical ... ok
test frame::checks::shared_writer_selector_is_fixed_length_and_fragment_safe ... ok
test frame::checks::tests::golden_and_fragmented ... ok
test ended::tests::bounded_record_preserves_status_and_rejects_malformed_or_linked_data ... ok
test frame::checks::borrowed_and_owned_decoders_agree_at_every_fragment_boundary ... ok
test frame::checks::deferred_frame_keeps_its_borrowed_storage_and_ordered_trailing_bytes ... ok
test locale::tests::absent_locale_uses_fallback_only_when_it_is_installed ... ok
test frame::checks::query_reply_extension_is_bounded_and_fragment_safe ... ok
test frame::checks::maximum_deferred_frame_retries_without_growing_storage ... ok
test frame::checks::golden::exact_maximum_and_coalesced_frames ... ok
test locale::tests::invalid_shell_expressions_are_ignored ... ok
test locale::tests::missing_lang_preserves_other_locale_values_and_fills_only_lang ... ok
test locale::tests::macos_locale_identifier_gets_a_utf8_codeset ... ok
test pty::child_signal_tests::child_signal_reset_spawn_cost_at_128_children ... ignored, child spawn diagnostic; run locally in a weighted scope without own build overlap
test locale::tests::unsupported_configured_locale_uses_installed_utf8_fallback ... ok
test pty::inherited_descriptor_tests::duplicated_socket_owns_its_descriptor_and_is_close_on_exec ... ok
test locale::tests::configured_locale_is_selected_from_login_locale_files ... ok
test pty::inherited_descriptor_tests::invalid_inherited_descriptors_are_refused ... ok
test locale::tests::non_locale_values_do_not_cross_the_scrubbed_shell_boundary ... ok
test ring::checks::tests::merge_review_head_overflow_does_not_publish_or_discard_bytes ... ok
test ring::checks::tests::wrap_and_exact_offsets ... ok

running 1 test
test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 113 filtered out; finished in 0.00s

test locale::tests::existing_user_locale_values_are_preserved_without_replacement ... ok
test pty::child_environment_tests::spawned_login_shell_receives_selected_environment_without_other_host_variables ... ok
test ring::checks::tests::merge_review_head_and_retained_bytes_match_after_every_append ... ok
test locked_bytes::tests::anonymous_transfer_pages_are_locked_and_excluded_from_core_dumps ... ok
test pty::child_signal_tests::child_policy_closes_the_control_descriptor_before_direct_exec ... ok
test session::inputs::merge_review::refused_first_replies_do_not_promote_or_reset_legacy_state ... ok
test session::inputs::reply_tests::replies_preserve_selected_writer_cursor_and_geometry ... ok
test session::inputs::merge_review::reply_promotion_preserves_staged_legacy_geometry_and_partial_credit ... ok
test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok
test session::inputs::tests::partial_writes_credit_only_the_owner_and_replay_trims_per_writer ... ok
test session::inputs::reply_tests::reply_identity_is_outside_peer_namespace_and_writer_limit ... ok
test session::inputs::merge_review::repeated_reply_registration_adds_exactly_one_identity ... ok
test session::measurements::budgets::input_to_pty_write ... ignored, real-PTY performance measurement; set ZDOTDIR to tests/profile
test session::measurements::poll_storage_measurement ... ignored, release poll-storage allocation measurement
test session::peer_uid_tests::different_uid_shim_socket_peer_is_refused ... ok
test session::resize_checks::resize_refusal_session_probe ... ignored, isolated session probe invoked by its parent with a controlled shell profile
test session::inputs::tests::identity_cap_preserves_all_existing_cursors ... ok
test session::sequenced_checks::new_frames_roundtrip_and_refuse_noncanonical_payloads ... ok
test session::measurements::budgets::allowlisted_signal_after_real_pty_exit_keeps_exit_ack_available ... ok
test session::sequenced_checks::coalesced_ack_never_overwrites_a_partial_output_and_cursors_survive_peer_loss ... ok
test session::sequenced_checks::writer_selection_has_a_frozen_little_endian_layout ... ok
test session::sequenced_checks::trim_duplicates_gaps_overflow_and_capacity_are_transactional ... ok
test session::sequenced_checks::reusable_encoder_retains_capacity_and_refuses_growth_before_mutation ... ok
test sqlite_backup::tests::crash_writer_helper ... ignored, subprocess helper for abrupt-close WAL validation

running 1 test
test session::sequenced_checks::negotiated_queue_deferral_validates_ranges_before_waiting ... ok
test session::sequenced_checks::a_completed_deferred_frame_gives_its_trailing_input_a_fresh_ticket ... ok
test session::sequenced_checks::coalesced_probe_and_input_preserve_the_written_ack_in_both_orders ... ok
test session::inputs::merge_review::interleaved_replies_and_replays_match_partial_write_model ... ok
test terminal::checks::approximate_repaint_keeps_complete_pending_syntax_or_omits_it_whole ... ok
test sqlite_backup::tests::preserved_wal_reads_latest_committed_data_without_sidecar_creation ... ok
test sqlite_backup::tests::abrupt_close_reads_acknowledged_wal_without_creating_or_modifying_files ... ok
test session::sequenced_checks::merge_review_replies_cannot_consume_space_reserved_for_deferred_typing ... ok
test terminal::checks::tests::implicit_hyperlinks_retain_groups_across_rows_and_continuation ... ok
test terminal::checks::tests::margins_tabs_charsets_and_modes_continue ... ok
test terminal::checks::tests::fixtures_and_continuations_repaint ... ok
test terminal::checks::tests::long_unfinished_hyperlink_and_control_strings_continue ... ok
test terminal::checks::tests::alternate_variants_and_nested_switches_repaint ... ok
test terminal::checks::tests::partial_csi_and_utf8_continue ... ok
test terminal::checks::tests::saved_origin_survives_changed_margins ... ok
test sqlite_backup::tests::online_copy_includes_wal_without_sharing_candidate_migrations ... ok
test terminal::fidelity::fidelity_charset_mapped_wide_space_is_explicitly_rejected ... ok
test terminal::fidelity::fidelity_diagnostic_fixture ... ignored, diagnostic replay of an explicitly selected fixture file
test terminal::checks::tests::retained_alternate_saved_cursor_and_keyboard_stack_continue ... ok
test terminal::fidelity::fidelity_extended_nightly ... ignored, nightly expanded differential corpus: 20,000 deterministic cases
test sqlite_backup::tests::successor_sqlx_migration_never_changes_the_predecessor_journal ... ok
test terminal::checks::tests::pending_wrap_and_saved_wrap_continue_with_wide_cells ... ok
test terminal::fidelity::fidelity_fresh_c_redraw_default_is_explicitly_rejected ... ok
test terminal::checks::tests::unfinished_sequence_over_frame_limit_fails_without_losing_runtime_state ... ok
test terminal::checks::tests::byte_budget_prunes_history_and_resize_remains_repaintable ... ok
test terminal::fidelity::fidelity_inherited_protection_off_mode_is_explicitly_rejected ... ok
test session::resize_checks::native_resize_refusal_preserves_peer_and_pty ... ok
test terminal::fidelity::fidelity_cursor ... ok
test sqlite_backup::tests::cancelled_online_copy_finishes_before_either_connection_can_resume ... ok
test terminal::fidelity::fidelity_edge ... ok
test terminal::fidelity::fidelity_iso_protection_erase ... ok
test terminal::fidelity::fidelity_orphaned_spacer_head ... ok
test terminal::fidelity::fidelity_prompt_resize_requires_explicit_rejection ... ok
test terminal::fidelity::fidelity_oracle_observes_archived_cells_with_equal_active_screens ... ok
test terminal::fidelity::fidelity_rejects_unrepresentable_rep_without_mutating_source ... ok
test terminal::fidelity::fidelity_saved_modes_future_restore ... ok
test terminal::fidelity::fidelity_iso_protection_does_not_keep_rep_scratch ... ok
test terminal::fidelity::fidelity_seeded_nightly ... ignored, nightly differential corpus: 20,000 deterministic cases
test terminal::fidelity::fidelity_oracle_detects_hidden_state ... ok
test terminal::fidelity::fidelity_f1_rep ... ok
test terminal::fidelity::fidelity_saved_cursor_over_changed_edge ... ok
test terminal::fidelity::fidelity_snapshot_history_tail_contains_no_padding_rows ... ok
test terminal::fidelity::fidelity_snapshot_resets_stale_viewer_color_overrides ... ok
test terminal::fidelity::fidelity_single_shift_survives_rep_seed ... ok
test terminal::fidelity::fidelity_spacer_head_attributes ... ok
test terminal::fidelity::fidelity_semantic_validation_matches_exported_history_extent ... ok
test terminal::fidelity::fresh_captures::fidelity_fresh_real_program_captures ... ignored, manual fresh capture oracle; set VT_CAPTURE_DIR after real program capture
test terminal::measurements::budgets::snapshot_200x60 ... ignored, performance measurement; run release on the perf host
test terminal::measurements::memory::measured_terminal_rss ... ignored, RSS measurement; run this filter alone in a fresh release process
test terminal::measurements::throughput::measured_parser ... ignored, VT observer and history throughput measurement
test terminal::recovery_measurements::measured_full_ring_reconstruction ... ignored, release reconstruction measurement; old healthy handles permit repeated cleanup
test terminal::resize_recovery::absent_ring_keeps_last_good_size_and_later_output_usable ... ok
test terminal::resize_recovery::complete_ring_restores_screens_mouse_and_unfinished_syntax ... ok
test terminal::checks::approximate_repaint_is_bounded_clips_at_complete_cells_and_preserves_source ... ok
test terminal::resize_recovery::earlier_geometry_changes_require_approximation_even_with_origin_coverage ... ok
test terminal::resize_recovery::ring_gap_requires_clean_approximate_recovery ... ok
test terminal_native::allocation::resize_allocation_refusal_retires_native_handle ... ok
test terminal::fidelity::fidelity_screen_entry_consumes_inherited_shift_before_saving ... ok
test terminal::fidelity::fidelity_variation_tail_attributes ... ok
test terminal::fidelity::fidelity_variation_wrap_attributes ... ok
test terminal::fidelity::fidelity_recorded_corpus ... ok
test terminal::fidelity::fidelity_mouse_effective_fields_follow_order_independently_of_booleans ... ok
test terminal::review_r3_default::review_r3_default_terminal_reflows_long_mixed_history ... ok
test terminal::fidelity::fidelity_handwritten ... ok
test terminal::fidelity::fidelity_extended_smoke ... ok
test terminal::fidelity::fidelity_seeded_smoke ... ok

test result: ok. 100 passed; 0 failed; 14 ignored; 0 measured; 0 filtered out; finished in 53.29s

     Running tests/detach.rs (target/debug/deps/detach-838805459b0210a0)

running 2 tests
test detached_child_restores_default_signals_without_changing_parent ... ok
test closed_standard_descriptors_become_dev_null ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.35s

     Running tests/generation_lock.rs (target/debug/deps/generation_lock-accf86a09c0ffb8e)

running 2 tests
test transferred_lock_child ... ignored, private subprocess descriptor-transfer fixture
test transferred_directory_lock_has_no_second_writer_gap ... ok

test result: ok. 1 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.01s

     Running tests/mouse.rs (target/debug/deps/mouse-6875aedd16fa7eb1)

running 1 test
test faithful_snapshot_preserves_public_mouse_encoder_reports ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.97s

     Running tests/ppu_reliability.rs (target/debug/deps/ppu_reliability-92d223f034ceeac8)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/ppu_reliability_memory.rs (target/debug/deps/ppu_reliability_memory-4ca4bcf22ad9a41b)

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/process_exit_descriptor.rs (target/debug/deps/process_exit_descriptor-cc05b9e1b2f8f4e4)

running 3 tests
test invalid_pid_never_creates_a_descriptor ... ok
test signal_reaches_only_the_described_process_and_then_refuses ... ok
test descriptor_is_cloexec_and_observes_a_real_process_exit ... ok

test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running unittests src/lib.rs (target/debug/deps/infraternal_status-76d7037ceceb2cda)

running 24 tests
test tests::an_unanswering_manager_only_makes_its_own_unit_unknown ... ok
test tests::a_restarting_role_does_not_describe_a_stopped_or_failed_role_as_restarting ... ok
test tests::consecutive_observations_detect_restart_count_and_pid_churn ... ok
test tests::installed_system_server_data_comes_from_its_effective_execstart ... ok
test tests::installed_server_discovery_recognizes_the_running_executable_identity ... ok
test tests::real_user_crash_loop_is_not_running ... ignored, requires the job-owned transient crash-loop user unit
test tests::nothing_installed_says_so ... ok
test tests::production_server_is_a_running_server_with_two_mesh_peers ... ok
test tests::rootless_agent_is_read_from_the_user_manager ... ok
test tests::server_and_host_on_one_machine_is_both ... ok
test tests::snapshot_scan_counts_peers_through_nesting_strings_and_spacing ... ok
test tests::stopped_and_failed_services_keep_distinct_headlines_and_diagnostics ... ok
test tests::stopped_server_unit_is_stopped_not_unknown ... ok
test tests::the_headline_names_what_is_down_and_how_to_look ... ok
test tests::the_headline_says_how_to_join_when_nothing_is_installed ... ok
test tests::a_manager_that_does_not_answer_is_unknown_not_down ... ok
test tests::retained_data_has_an_honest_headline_and_repair_step ... ok
test tests::rootful_agent_is_a_host_with_its_own_state_directory ... ok
test tests::rootful_agent_reads_mesh_peers_from_its_state_directory ... ok
test tests::restart_age_uses_only_comparable_monotonic_microseconds ... ok
test tests::manager_completion_follows_child_exit_even_if_stdout_closes_first ... ok
test tests::manager_properties_report_each_role_and_scope_truthfully ... ok
test tests::configured_role_state_table_controls_headline_and_exit ... ok
test tests::manager_completion_handles_an_already_exited_child_and_a_deadline ... ok

test result: ok. 23 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.07s

     Running tests/independent_units.rs (target/debug/deps/independent_units-0d77efa9b141e1e4)

running 1 test
test stalled_units_preserve_other_units_in_each_manager ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s

     Running tests/query_refusal.rs (target/debug/deps/query_refusal-0e92a44d8fcf0292)

running 1 test
test refused_manager_process_preserves_unknown_and_reason ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s

     Running tests/review_237.rs (target/debug/deps/review_237-ff9bc043d685dadc)

running 4 tests
test older_manager_clients_preserve_failed_service_observation ... ok
test masked_server_with_retained_data_is_not_described_as_running ... ok
test repeated_starts_with_a_future_wall_clock_timestamp_are_not_running ... ok
test unavailable_system_manager_preserves_user_restart_observation ... ok

test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s

     Running tests/review_237_masked_companion.rs (target/debug/deps/review_237_masked_companion-b28dbb049b75e205)

running 1 test
test masked_server_beside_a_running_host_has_a_partial_setup_headline ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_237_r3_masks.rs (target/debug/deps/review_237_r3_masks-1a2bce0a2653e2c7)

running 2 tests
test a_mask_alone_does_not_make_a_down_infraternal_agent ... ok
test a_masked_service_its_manager_reports_running_is_not_stopped ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s

     Running tests/review_237_r3_matrix.rs (target/debug/deps/review_237_r3_matrix-b7a98cb93528482f)

running 1 test
test manager_shaped_answers_follow_every_documented_cell ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.57s

     Running tests/review_237_r3_next_budget.rs (target/debug/deps/review_237_r3_next_budget-d95db5d971309345)

running 1 test
test masked_server_recovery_keeps_next_steps_within_the_cli_limit ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

     Running tests/review_237_resources.rs (target/debug/deps/review_237_resources-d5853ef6d159cadc)

running 1 test
test thread_resource_refusal_preserves_a_status_answer ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s

   Doc-tests infraternal_agent

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_mesh

running 1 test
test crates/infraternal-mesh/src/model.rs - model::LocalPrivateKey (line 20) - compile fail ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s

   Doc-tests infraternal_plugin_api

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_backup

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_canvas

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_host_facts

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_mesh

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_relay

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_release

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_remote

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_plugin_ssh

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_protocol

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_server

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

   Doc-tests infraternal_shim

running 2 tests
test crates/infraternal-shim/src/readiness.rs - readiness::Registration (line 56) - compile fail ... ok
test crates/infraternal-shim/src/readiness.rs - readiness::Registration (line 63) - compile fail ... ok

test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.35s

   Doc-tests infraternal_status

running 0 tests

test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

(test: 824s)

==> SSH inode reuse fixture
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.21s
     Running tests/install.rs (target/debug/deps/install-2006dcdc8e0a17d4)

running 1 test
test review_inode_reuse_after_diagnostics_preserves_live_replacement ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 95 filtered out; finished in 0.45s
(SSH inode reuse fixture: 1s)

==> shim process-per-user
    Finished `test` profile [unoptimized + debuginfo] target(s) in 0.14s
     Running unittests src/lib.rs (target/debug/deps/infraternal_shim-5aed3766a8e67f2d)

running 222 tests
test frame::checks::codec_reuse_measurement ... ignored, release codec and allocation-path measurement
test fixture_state::deep_root_keeps_real_sockets_private_and_cleans_up_on_drop ... ok
test frame::checks::borrowed_and_owned_decoders_agree_at_every_fragment_boundary ... ok
test frame::checks::approximate_snapshot_codec_is_bounded_and_canonical ... ok
test frame::checks::deferred_frame_keeps_its_borrowed_storage_and_ordered_trailing_bytes ... ok
test frame::checks::borrowed_output_keeps_frozen_bytes_and_refuses_before_batch_mutation ... ok
test ended::tests::bounded_record_preserves_status_and_rejects_malformed_or_linked_data ... ok
test frame::checks::shared_writer_selector_is_fixed_length_and_fragment_safe ... ok
test heap_accounting::accounting_keeps_exact_layouts_and_balances_reallocation ... ok
test frame::checks::tests::batch_append_preserves_prefix_and_refuses_invalid_frames ... ok
test frame::checks::tests::golden_and_fragmented ... ok
test frame::checks::tests::invalid_lengths_types_and_utf8 ... ok
test heap_accounting::transient_allocations_are_visible_after_their_storage_is_freed ... ok
test locale::tests::invalid_shell_expressions_are_ignored ... ok
test locale::tests::missing_lang_preserves_other_locale_values_and_fills_only_lang ... ok
test locale::tests::existing_user_locale_values_are_preserved_without_replacement ... ok
test locale::tests::macos_locale_identifier_gets_a_utf8_codeset ... ok
test locale::tests::non_locale_values_do_not_cross_the_scrubbed_shell_boundary ... ok
test locale::tests::unsupported_configured_locale_uses_installed_utf8_fallback ... ok
test locale::tests::configured_locale_is_selected_from_login_locale_files ... ok
test frame::checks::query_reply_extension_is_bounded_and_fragment_safe ... ok

running 1 test
test locale::tests::absent_locale_uses_fallback_only_when_it_is_installed ... ok
test frame::checks::golden::every_frozen_message ... ok
test pty::child_signal_tests::child_signal_reset_spawn_cost_at_128_children ... ignored, child spawn diagnostic; run locally in a weighted scope without own build overlap
test frame::checks::maximum_deferred_frame_retries_without_growing_storage ... ok
test pty::child_signal_tests::child_policy_closes_the_control_descriptor_before_direct_exec ... ok
test pty::child_environment_tests::spawned_login_shell_receives_selected_environment_without_other_host_variables ... ok
test pty::output_readiness_tests::readable_byte_hint_preserves_the_complete_output_stream ... ok
test ring::checks::tests::borrowed_ranges_obey_absolute_offsets_across_physical_wrap ... ok
test ring::checks::tests::empty_append_keeps_lazy_storage_unallocated ... ok
test pty::inherited_descriptor_tests::duplicated_socket_owns_its_descriptor_and_is_close_on_exec ... ok
test pty::inherited_descriptor_tests::invalid_inherited_descriptors_are_refused ... ok

running 1 test
test pty::handoff::tests::oversized_ancillary_batch_refusal_closes_every_received_descriptor ... test ring::checks::tests::merge_review_head_and_retained_bytes_match_after_every_append ... ok
test ring::checks::tests::merge_review_head_overflow_does_not_publish_or_discard_bytes ... ok
test ring::checks::tests::merge_review_pool_refusal_retains_exact_suffix_and_releases_charge ... ok
test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.01s


running 1 test
test pty::handoff::tests::credential_ancillary_refusal_closes_a_kernel_maximum_descriptor_batch ... test ring::checks::tests::shared_history_reservation_never_rounds_past_its_share ... ok
test ring::checks::tests::wrap_and_exact_offsets ... ok
test session::inputs::host_budget_tests::alternating_writers_cannot_expand_shared_host_bookkeeping_without_bound ... ok
test frame::checks::golden::exact_maximum_and_coalesced_frames ... ok
test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok
test session::inputs::reply_tests::reply_identity_is_outside_peer_namespace_and_writer_limit ... ok
test session::inputs::merge_review::reply_promotion_preserves_staged_legacy_geometry_and_partial_credit ... ok
test session::inputs::reply_tests::host_replies_preserve_segment_budget_and_account_for_promoted_storage ... ok
test session::inputs::merge_review::refused_first_replies_do_not_promote_or_reset_legacy_state ... ok
test session::inputs::tests::partial_writes_credit_only_the_owner_and_replay_trims_per_writer ... ok
test session::measurements::budgets::bounded_flush_keeps_partial_frame_and_wire_order ... ok
test session::measurements::budgets::input_to_pty_write ... ignored, real-PTY performance measurement; set ZDOTDIR to tests/profile
test session::measurements::poll_storage_measurement ... ignored, release poll-storage allocation measurement
test session::peer_uid_tests::different_uid_shim_socket_peer_is_refused ... ok
test session::inputs::tests::identity_cap_preserves_all_existing_cursors ... ok
test session::resize_checks::resize_refusal_session_probe ... ignored, isolated session probe invoked by its parent with a controlled shell profile
ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.03s

test pty::handoff::tests::oversized_ancillary_batch_refusal_closes_every_received_descriptor ... ok
test session::sequenced_checks::coalesced_ack_never_overwrites_a_partial_output_and_cursors_survive_peer_loss ... ok
test session::inputs::tests::host_legacy_writer_needs_no_heap_table ... ok
test session::inputs::reply_tests::replies_preserve_selected_writer_cursor_and_geometry ... ok
test session::inputs::merge_review::repeated_reply_registration_adds_exactly_one_identity ... ok
test session::sequenced_checks::new_frames_roundtrip_and_refuse_noncanonical_payloads ... ok
test session::sequenced_checks::negotiated_queue_deferral_validates_ranges_before_waiting ... ok
test session::measurements::budgets::allowlisted_signal_after_real_pty_exit_keeps_exit_ack_available ... ok
test session::sequenced_checks::reusable_encoder_retains_capacity_and_refuses_growth_before_mutation ... ok
test session::sequenced_checks::writer_selection_has_a_frozen_little_endian_layout ... ok
test session::sequenced_checks::a_completed_deferred_frame_gives_its_trailing_input_a_fresh_ticket ... ok
test session::user_host::lazy_bench::geometry_replay_materialization_cost ... ignored, perf VM only: measure cold materialization after bounded geometry replay
test session::sequenced_checks::trim_duplicates_gaps_overflow_and_capacity_are_transactional ... ok
test session::user_host::child_checks::threaded_startup_is_refused_before_creating_session_state ... ok
test session::user_host::reactor::tests::accounting_write_failure_disables_only_the_receipt ... ok
test session::user_host::reactor::tests::actual_output_selector_keeps_a_bulk_turn_after_granted_and_denied_promotions ... ok
test session::user_host::reactor::tests::cheap_replies_share_a_turn_but_expired_output_yields_to_input ... ok
test session::sequenced_checks::coalesced_probe_and_input_preserve_the_written_ack_in_both_orders ... ok
test session::user_host::reactor::tests::cancelled_bulk_membership_reuses_the_existing_deque_entry ... ok
test session::user_host::reactor::tests::inline_and_extra_descriptor_flags_merge_without_losing_generations ... ok
test session::user_host::child_checks::ordinary_housekeeping_does_not_probe_child_status ... ok
ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.13s

test session::user_host::reactor::tests::exit_observed_before_settle_still_queues_one_retention_deadline ... ok
test session::user_host::reactor::tests::ownership_receipt_separates_session_components_and_shared_capacities ... ok
test session::user_host::reactor::tests::one_session_readiness_fits_240_requested_bytes ... ok
test pty::handoff::tests::credential_ancillary_refusal_closes_a_kernel_maximum_descriptor_batch ... ok
test session::user_host::reactor::tests::readiness_membership_stays_within_five_bytes_per_session ... ok
test session::user_host::reactor::tests::readiness_storage_registration_is_at_most_sixteen_bytes ... ok
test session::user_host::reactor::tests::fresh_ack_fallback_avoids_writable_poll_and_finishes_with_new_input ... ok
test session::user_host::reactor::tests::ready_rows_keep_two_descriptor_turns_allocation_free_within_64_bytes_per_slot ... ok
test session::user_host::reactor::tests::readiness_storage_two_descriptors_are_allocation_free ... ok
test session::user_host::reactor::tests::round_reset_and_wrap_preserve_bulk_membership_without_reviving_reads ... ok
test session::user_host::reactor::tests::ready_rows_clear_only_touched_slots_and_fence_round_wrap ... ok
test session::user_host::reactor::tests::input_phase_retires_closed_identity_without_publishing_transient_interest ... ok

running 1 test
test session::user_host::reactor::tests::reused_peer_descriptor_receives_a_new_readiness_identity ... test session::inputs::merge_review::interleaved_replies_and_replays_match_partial_write_model ... ok
test session::user_host::reactor::tests::timer_membership_survives_bulk_promotion_cancellation_and_round_wrap ... ok
test session::user_host::reactor::tests::single_ready_descriptor_needs_no_heap_allocation ... ok
test session::user_host::reactor::tests::short_output_cohort_yields_before_the_next_input_poll ... ok
test session::user_host::reactor::tests::replay_continues_after_its_frame_was_written_inline ... ok
test session::user_host::tests::admission_refuses_foreign_uid_duplicate_ids_and_geometry_before_spawn ... ok
test session::user_host::reactor::tests::queued_data_ack_needs_no_writable_poll_before_pty_service ... ok
test session::user_host::tests::blocked_state_and_output_share_one_ordered_write_batch ... ok
ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.02s

test session::user_host::tests::bulk_turn_advances_sixteen_kib_and_yields_before_the_rest ... ok
test session::user_host::tests::full_pool_reuses_ring_storage_for_newest_output ... ok
test session::user_host::tests::deferred_data_ack_and_available_output_share_one_ordered_batch ... ok
test session::user_host::tests::full_pool_typing_echo_latency ... ignored, timing measurement runs on the perf VM
test session::user_host::tests::data_ack_can_wait_for_a_writable_visit_without_requiring_output ... ok
test session::user_host::tests::full_pool_refuses_new_session_and_keeps_existing_session_working ... ok
test session::user_host::reactor::tests::unchanged_registration_sync_needs_no_heap_allocation ... ok
test session::user_host::tests::idle_session_ownership_ledger ... ignored, perf VM only: per-session requested-byte ownership ledger at scale
test session::user_host::tests::host_pool_scales_with_machine_memory_within_bounds ... ok
test session::user_host::reactor::tests::reused_peer_descriptor_receives_a_new_readiness_identity ... ok

running 1 test
test session::user_host::tests::last_viewer_disconnect_releases_unused_peer_slots ... ok

test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.01s

test session::user_host::tests::last_viewer_disconnect_releases_unused_peer_slots ... ok
test session::user_host::tests::geometry_transcript_materializes_at_its_event_bound ... ok
test session::user_host::tests::malformed_closed_peer_is_retired_once_and_keeps_its_sibling ... ok
test session::user_host::tests::output_bound_replays_retained_geometry_before_new_bytes ... ok
test session::user_host::tests::lazy_prefix_materializes_exactly_before_overflow_and_resize ... ok
test session::user_host::tests::medium_geometry_materializes_before_deferred_cell_work_exceeds_the_bound ... ok
test session::user_host::tests::quiet_geometry_changes_remain_lazy_and_replay_in_order ... ok
test session::user_host::tests::prefix_threshold_preserves_unfinished_sequences ... ok
test session::user_host::tests::session_constructor_retains_only_the_bound_socket_path ... ok
test session::user_host::tests::same_geometry_input_selection_keeps_vt_unallocated ... ok
test session::user_host::tests::steady_replay_needs_no_payload_allocation ... ok
test session::user_host::tests::unchanged_geometry_retains_native_resize_side_effects ... ok
test session::user_host::tests::state_fences_and_input_only_acks_bypass_coalescing ... ok
test session::user_host::tests::writable_peer_receives_state_and_output_before_another_readiness_turn ... ok
test session::user_host::tests::vt_panic_retires_one_real_pty_and_sibling_keeps_its_output ... ok
test session::user_host::tests::zero_ring_capacity_does_not_stall_a_live_pty ... ok
test session::sequenced_checks::merge_review_replies_cannot_consume_space_reserved_for_deferred_typing ... ok
test terminal::checks::snapshot_during_discard_preserves_the_unfinished_string_boundary ... ok
test terminal::checks::approximate_repaint_keeps_complete_pending_syntax_or_omits_it_whole ... ok
test session::resize_checks::native_resize_refusal_preserves_peer_and_pty ... ok
test session::user_host::tests::exhausted_pool_drains_live_ptys_during_random_session_churn ... ok
test terminal::checks::tests::fixtures_and_continuations_repaint ... ok
test terminal::checks::tests::implicit_hyperlinks_retain_groups_across_rows_and_continuation ... ok
test terminal::checks::tests::alternate_variants_and_nested_switches_repaint ... ok
test terminal::checks::tests::margins_tabs_charsets_and_modes_continue ... ok
test terminal::checks::tests::partial_csi_and_utf8_continue ... ok
test terminal::checks::tests::long_unfinished_hyperlink_and_control_strings_continue ... ok
test terminal::checks::tests::retained_alternate_saved_cursor_and_keyboard_stack_continue ... ok
test terminal::checks::tests::saved_origin_survives_changed_margins ... ok
test terminal::fidelity::fidelity_charset_mapped_wide_space_is_explicitly_rejected ... ok
test terminal::checks::tests::pending_wrap_and_saved_wrap_continue_with_wide_cells ... ok
test terminal::fidelity::fidelity_diagnostic_fixture ... ignored, diagnostic replay of an explicitly selected fixture file
test terminal::fidelity::fidelity_cursor ... ok
test terminal::fidelity::fidelity_extended_nightly ... ignored, nightly expanded differential corpus: 20,000 deterministic cases
test session::user_host::tests::large_geometry_cannot_defer_a_long_first_snapshot_reflow_queue ... ok
test terminal::checks::tests::unfinished_sequence_over_frame_limit_fails_without_losing_runtime_state ... ok
test terminal::fidelity::fidelity_fresh_c_redraw_default_is_explicitly_rejected ... ok
test terminal::checks::tests::byte_budget_prunes_history_and_resize_remains_repaintable ... ok
test terminal::fidelity::fidelity_edge ... ok
test terminal::fidelity::fidelity_inherited_protection_off_mode_is_explicitly_rejected ... ok
test terminal::fidelity::fidelity_iso_protection_erase ... ok
test terminal::fidelity::fidelity_f1_rep ... ok
test terminal::fidelity::fidelity_iso_protection_does_not_keep_rep_scratch ... ok
test terminal::fidelity::fidelity_oracle_observes_archived_cells_with_equal_active_screens ... ok
test terminal::fidelity::fidelity_orphaned_spacer_head ... ok
test terminal::fidelity::fidelity_oracle_detects_hidden_state ... ok
test terminal::fidelity::fidelity_prompt_resize_requires_explicit_rejection ... ok
test terminal::fidelity::fidelity_rejects_unrepresentable_rep_without_mutating_source ... ok
test pty::handoff::tests::all_masters_survive_original_owner_drop_with_cloexec ... ok
test terminal::fidelity::fidelity_saved_modes_future_restore ... ok
test terminal::fidelity::fidelity_saved_cursor_over_changed_edge ... ok
test terminal::fidelity::fidelity_seeded_nightly ... ignored, nightly differential corpus: 20,000 deterministic cases
test terminal::fidelity::fidelity_screen_entry_consumes_inherited_shift_before_saving ... ok
test terminal::fidelity::fidelity_mouse_effective_fields_follow_order_independently_of_booleans ... ok
test terminal::fidelity::fidelity_single_shift_survives_rep_seed ... ok
test terminal::fidelity::fidelity_semantic_validation_matches_exported_history_extent ... ok
test terminal::fidelity::fidelity_snapshot_resets_stale_viewer_color_overrides ... ok
test terminal::checks::approximate_repaint_is_bounded_clips_at_complete_cells_and_preserves_source ... ok
test terminal::fidelity::fidelity_snapshot_history_tail_contains_no_padding_rows ... ok
test terminal::fidelity::fidelity_variation_tail_attributes ... ok
test terminal::fidelity::fresh_captures::fidelity_fresh_real_program_captures ... ignored, manual fresh capture oracle; set VT_CAPTURE_DIR after real program capture
test terminal::fidelity::fidelity_spacer_head_attributes ... ok
test terminal::fidelity::fidelity_handwritten ... ok
test terminal::fidelity::fidelity_variation_wrap_attributes ... ok
test terminal::fidelity::fidelity_recorded_corpus ... ok
test terminal::host_budget::erased_history_reset_and_geometry_return_native_memory ... ok
test terminal::host_budget::page_nodes_never_fill_the_ordinary_data_cap ... ok
test session::user_host::tests::geometry_transcript_property_cases_match_eager_native_state ... ok
test terminal::measurements::budgets::snapshot_200x60 ... ignored, performance measurement; run release on the perf host
test terminal::measurements::memory::measured_terminal_rss ... ignored, RSS measurement; run this filter alone in a fresh release process
test terminal::measurements::throughput::measured_parser ... ignored, VT observer and history throughput measurement
test terminal::ppu_memory_bench::fresh_shell_filler_snapshot_gap_is_independent_of_allocator_refusal ... ok
test terminal::ppu_memory_bench::native_session_allocations_settle_after_geometry_warmup ... ignored, perf VM only: native heap/resident accounting; set PPU_VT_ACCOUNT_SESSIONS
test terminal::ppu_memory_bench::quiet_resize_churn_does_not_keep_new_resident_pools ... ignored, perf VM only: sparse resize ownership at 900 quiet sessions
test terminal::ppu_memory_bench::small_history_does_not_retain_megabyte_page_quanta ... ignored, perf VM only: sparse history residency and native ownership
test terminal::recovery_measurements::measured_full_ring_reconstruction ... ignored, release reconstruction measurement; old healthy handles permit repeated cleanup
test terminal::resize_recovery::absent_ring_keeps_last_good_size_and_later_output_usable ... ok
test terminal::resize_recovery::complete_ring_restores_screens_mouse_and_unfinished_syntax ... ok
test terminal::resize_recovery::earlier_geometry_changes_require_approximation_even_with_origin_coverage ... ok
test terminal::resize_recovery::ring_gap_requires_clean_approximate_recovery ... ok
test terminal::host_budget::shared_host_budget_bounds_the_sum_and_keeps_every_terminal_exact ... ok
test terminal::review_r2::review_r2_escape_command_inside_discard_matches_short_string ... ok
test terminal::review_r2::review_r2_escape_high_byte_does_not_start_a_hidden_string ... ok
test terminal::host_budget::report_native_memory_numbers ... ok
test terminal::host_budget::every_history_share_fills_and_recycles_inside_its_reservation ... ok
test terminal::checks::control_strings_cannot_grow_session_carry_without_bound ... ok
test terminal::host_budget::widening_a_full_history_stays_inside_its_share ... ok
test session::user_host::tests::pool_usage_never_exceeds_cap_under_open_write_close_sequences ... ok
test terminal::review_r2::review_r2_resize_with_full_history_share_stays_exact ... ok
test terminal::fidelity::fidelity_extended_smoke ... ok
test terminal::review_r2::review_r2_resize_storm_does_not_ratchet_native_memory ... ok
test terminal::review_r2::review_r2_limiter_is_transparent_for_short_control_mixtures ... ok
test terminal::review_r3::review_r3_four_hundred_laptop_screens_fit_the_host ... ok
test terminal::review_r3::review_r3_bounded_terminal_reflows_long_mixed_history ... ok
test terminal::review_r2::review_r2_host_history_share_fits_the_native_reservation ... ok
test terminal::review_r3::review_r3_host_accounting_balances_through_recovery ... ok
test terminal::review_r3::review_r3_recycled_unwrapped_history_keeps_exact_snapshot ... ok
test terminal::review_r2::review_r2_ground_c1_introducer_stays_within_the_session_share ... ok
test terminal::user_screen_pool_resize::taller_widening_keeps_history_rows_that_move_onto_the_screen ... ok
test terminal_limits::c1_tests::c1_string_inside_csi_has_a_seven_bit_replay_boundary ... ok
test terminal_limits::defensive_tests::executed_c0_between_escape_and_introducer_keeps_the_bound ... ok
test terminal_limits::tests::escape_after_discard_restarts_without_losing_the_next_command ... ok
test terminal_limits::tests::finite_sequences_are_identical_for_every_fragment_boundary ... ok
test terminal_limits::tests::fragmented_overflow_stays_discarded_until_a_real_terminator ... ok
test terminal_memory::payload_tests::oversized_payload_is_refused_before_allocation_while_tagged_pool_is_allowed ... ok
test terminal_memory::payload_tests::residency_query_observes_only_owned_page_mappings_without_faulting_payload ... ok
test terminal_memory::tests::allocation_budget_includes_overhead_and_refusal_is_recoverable ... ok
test terminal_memory::tests::screen_pages_are_zero_filled_and_page_aligned ... ok
test terminal_native::allocation::resize_allocation_refusal_retires_native_handle ... ok
test terminal::review_r3_default::review_r3_default_terminal_reflows_long_mixed_history ... ok
test terminal_native::owned_memory_tests::refused_resize_reclaims_every_owned_native_allocation ... ok
test terminal_native::owned_memory_tests::refusal_inside_reflow_never_touches_freed_pages ... ok
test terminal::host_budget::laptop_screens_come_from_their_floors_not_the_pool ... ok
test terminal::review_r3::review_r3_history_share_without_ris_never_refuses ... ok
test terminal::fidelity::fidelity_seeded_smoke ... ok
test terminal::review_r3::review_r3_recycled_history_matches_unbounded_reference ... ok
test terminal::review_r3::review_r3_noisy_neighbour_does_not_make_quiet_sessions_approximate ... ok
test terminal::review_r3::review_r3_thousand_sessions_and_one_flood ... ok
test terminal::review_r3::review_r3_hundred_laptop_sessions_keep_exact_state ... ok
test terminal::review_r2::review_r2_alternating_oversized_strings_keep_following_output_exact has been running for over 60 seconds
test terminal::review_r2::review_r2_alternating_oversized_strings_keep_following_output_exact ... ok

test result: ok. 203 passed; 0 failed; 19 ignored; 0 measured; 0 filtered out; finished in 154.41s

(shim process-per-user: 154s)

==> cargo-deny
warning[duplicate]: found 2 duplicate entries for crate 'base64'
   ┌─ /home/claude/worktrees/j12b/Cargo.lock:24:1
   │  
24 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index
25 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰───────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ base64 v0.21.7
     ├── base64urlsafedata v0.5.5
     │   ├── webauthn-attestation-ca v0.5.5
     │   │   └── webauthn-rs-core v0.5.5
     │   │       └── webauthn-rs v0.5.5
     │   │           └── infraternal-server v0.1.0
     │   │               ├── infraternal v0.1.0
     │   │               └── infraternal-fuzz v0.1.0
     │   ├── webauthn-rs v0.5.5 (*)
     │   ├── webauthn-rs-core v0.5.5 (*)
     │   └── webauthn-rs-proto v0.5.5
     │       └── webauthn-rs-core v0.5.5 (*)
     ├── webauthn-rs-core v0.5.5 (*)
     └── webauthn-rs-proto v0.5.5 (*)
   ├ base64 v0.22.1
     ├── axum v0.8.9
     │   ├── infraternal-fuzz v0.1.0
     │   └── infraternal-server v0.1.0
     │       ├── infraternal v0.1.0
     │       └── infraternal-fuzz v0.1.0 (*)
     ├── infraternal v0.1.0 (*)
     ├── infraternal-plugin-api v0.1.0
     │   ├── infraternal v0.1.0 (*)
     │   ├── infraternal-agent v0.1.0
     │   │   ├── infraternal v0.1.0 (*)
     │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   ├── infraternal-plugin-ssh v0.1.0
     │   │   │   ├── infraternal v0.1.0 (*)
     │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │   ├── infraternal-server v0.1.0 (*)
     │   │   │   └── infraternal-session v0.1.0
     │   │   └── infraternal-server v0.1.0 (*)
     │   ├── infraternal-fuzz v0.1.0 (*)
     │   ├── infraternal-mesh v0.1.0
     │   │   ├── infraternal v0.1.0 (*)
     │   │   └── infraternal-plugin-mesh v0.1.0
     │   │       ├── infraternal v0.1.0 (*)
     │   │       ├── infraternal-agent v0.1.0 (*)
     │   │       ├── infraternal-fuzz v0.1.0 (*)
     │   │       └── infraternal-server v0.1.0 (*)
     │   ├── infraternal-plugin-backup v0.1.0
     │   │   └── infraternal v0.1.0 (*)
     │   ├── infraternal-plugin-canvas v0.1.0
     │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   └── infraternal-server v0.1.0 (*)
     │   ├── infraternal-plugin-host-facts v0.1.0
     │   │   ├── infraternal v0.1.0 (*)
     │   │   ├── infraternal-agent v0.1.0 (*)
     │   │   └── infraternal-fuzz v0.1.0 (*)
     │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │   ├── infraternal-plugin-relay v0.1.0
     │   │   └── infraternal v0.1.0 (*)
     │   ├── infraternal-plugin-release v0.1.0
     │   │   ├── infraternal v0.1.0 (*)
     │   │   ├── infraternal-agent v0.1.0 (*)
     │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   └── infraternal-server v0.1.0 (*)
     │   ├── infraternal-plugin-remote v0.1.0
     │   │   ├── infraternal v0.1.0 (*)
     │   │   ├── infraternal-agent v0.1.0 (*)
     │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
     │   │   └── infraternal-server v0.1.0 (*)
     │   ├── infraternal-plugin-ssh v0.1.0 (*)
     │   └── infraternal-server v0.1.0 (*)
     ├── (dev) infraternal-plugin-release v0.1.0 (*)
     ├── infraternal-server v0.1.0 (*)
     └── sqlx-core v0.8.6
         ├── sqlx v0.8.6
         │   ├── infraternal v0.1.0 (*)
         │   ├── infraternal-plugin-api v0.1.0 (*)
         │   ├── infraternal-plugin-mesh v0.1.0 (*)
         │   ├── infraternal-plugin-release v0.1.0 (*)
         │   ├── infraternal-server v0.1.0 (*)
         │   └── infraternal-shim v0.1.0
         │       ├── infraternal v0.1.0 (*)
         │       ├── infraternal-agent v0.1.0 (*)
         │       ├── infraternal-fuzz v0.1.0 (*)
         │       ├── infraternal-plugin-remote v0.1.0 (*)
         │       ├── infraternal-plugin-ssh v0.1.0 (*)
         │       ├── infraternal-server v0.1.0 (*)
         │       ├── infraternal-session v0.1.0 (*)
         │       └── infraternal-status v0.1.0
         │           └── infraternal v0.1.0 (*)
         ├── sqlx-macros v0.8.6
         │   └── sqlx v0.8.6 (*)
         ├── sqlx-macros-core v0.8.6
         │   └── sqlx-macros v0.8.6 (*)
         └── sqlx-sqlite v0.8.6
             ├── sqlx v0.8.6 (*)
             └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'cpufeatures'
   ┌─ /home/claude/worktrees/j12b/Cargo.lock:50:1
   │  
50 │ ╭ cpufeatures 0.2.17 registry+https://github.com/rust-lang/crates.io-index
51 │ │ cpufeatures 0.3.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ cpufeatures v0.2.17
     ├── aes v0.8.4
     │   └── aes-gcm v0.10.3
     │       └── (dev) infraternal-server v0.1.0
     │           ├── infraternal v0.1.0
     │           └── infraternal-fuzz v0.1.0
     ├── argon2 v0.5.3
     │   └── infraternal-server v0.1.0 (*)
     ├── polyval v0.6.2
     │   └── ghash v0.5.1
     │       └── aes-gcm v0.10.3 (*)
     ├── sha1 v0.10.7
     │   ├── axum v0.8.9
     │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   └── infraternal-server v0.1.0 (*)
     │   └── tungstenite v0.29.0
     │       └── tokio-tungstenite v0.29.0
     │           ├── axum v0.8.9 (*)
     │           └── (dev) infraternal-server v0.1.0 (*)
     └── sha2 v0.10.9
         ├── infraternal-agent v0.1.0
         │   ├── infraternal v0.1.0 (*)
         │   ├── infraternal-fuzz v0.1.0 (*)
         │   ├── infraternal-plugin-ssh v0.1.0
         │   │   ├── infraternal v0.1.0 (*)
         │   │   ├── infraternal-fuzz v0.1.0 (*)
         │   │   ├── infraternal-server v0.1.0 (*)
         │   │   └── infraternal-session v0.1.0
         │   └── infraternal-server v0.1.0 (*)
         ├── infraternal-plugin-api v0.1.0
         │   ├── infraternal v0.1.0 (*)
         │   ├── infraternal-agent v0.1.0 (*)
         │   ├── infraternal-fuzz v0.1.0 (*)
         │   ├── infraternal-mesh v0.1.0
         │   │   ├── infraternal v0.1.0 (*)
         │   │   └── infraternal-plugin-mesh v0.1.0
         │   │       ├── infraternal v0.1.0 (*)
         │   │       ├── infraternal-agent v0.1.0 (*)
         │   │       ├── infraternal-fuzz v0.1.0 (*)
         │   │       └── infraternal-server v0.1.0 (*)
         │   ├── infraternal-plugin-backup v0.1.0
         │   │   └── infraternal v0.1.0 (*)
         │   ├── infraternal-plugin-canvas v0.1.0
         │   │   ├── infraternal-fuzz v0.1.0 (*)
         │   │   └── infraternal-server v0.1.0 (*)
         │   ├── infraternal-plugin-host-facts v0.1.0
         │   │   ├── infraternal v0.1.0 (*)
         │   │   ├── infraternal-agent v0.1.0 (*)
         │   │   └── infraternal-fuzz v0.1.0 (*)
         │   ├── infraternal-plugin-mesh v0.1.0 (*)
         │   ├── infraternal-plugin-relay v0.1.0
         │   │   └── infraternal v0.1.0 (*)
         │   ├── infraternal-plugin-release v0.1.0
         │   │   ├── infraternal v0.1.0 (*)
         │   │   ├── infraternal-agent v0.1.0 (*)
         │   │   ├── infraternal-fuzz v0.1.0 (*)
         │   │   └── infraternal-server v0.1.0 (*)
         │   ├── infraternal-plugin-remote v0.1.0
         │   │   ├── infraternal v0.1.0 (*)
         │   │   ├── infraternal-agent v0.1.0 (*)
         │   │   ├── infraternal-fuzz v0.1.0 (*)
         │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
         │   │   └── infraternal-server v0.1.0 (*)
         │   ├── infraternal-plugin-ssh v0.1.0 (*)
         │   └── infraternal-server v0.1.0 (*)
         ├── infraternal-plugin-release v0.1.0 (*)
         ├── infraternal-plugin-ssh v0.1.0 (*)
         ├── (build) infraternal-server v0.1.0 (*)
         ├── sqlx-core v0.8.6
         │   ├── sqlx v0.8.6
         │   │   ├── infraternal v0.1.0 (*)
         │   │   ├── infraternal-plugin-api v0.1.0 (*)
         │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
         │   │   ├── infraternal-plugin-release v0.1.0 (*)
         │   │   ├── infraternal-server v0.1.0 (*)
         │   │   └── infraternal-shim v0.1.0
         │   │       ├── infraternal v0.1.0 (*)
         │   │       ├── infraternal-agent v0.1.0 (*)
         │   │       ├── infraternal-fuzz v0.1.0 (*)
         │   │       ├── infraternal-plugin-remote v0.1.0 (*)
         │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
         │   │       ├── infraternal-server v0.1.0 (*)
         │   │       ├── infraternal-session v0.1.0 (*)
         │   │       └── infraternal-status v0.1.0
         │   │           └── infraternal v0.1.0 (*)
         │   ├── sqlx-macros v0.8.6
         │   │   └── sqlx v0.8.6 (*)
         │   ├── sqlx-macros-core v0.8.6
         │   │   └── sqlx-macros v0.8.6 (*)
         │   └── sqlx-sqlite v0.8.6
         │       ├── sqlx v0.8.6 (*)
         │       └── sqlx-macros-core v0.8.6 (*)
         └── sqlx-macros-core v0.8.6 (*)
   ├ cpufeatures v0.3.1
     └── chacha20 v0.10.2
         └── rand v0.10.3
             └── quinn-proto v0.11.19
                 └── quinn v0.11.12
                     ├── infraternal-agent v0.1.0
                     │   ├── infraternal v0.1.0
                     │   ├── infraternal-fuzz v0.1.0
                     │   ├── infraternal-plugin-ssh v0.1.0
                     │   │   ├── infraternal v0.1.0 (*)
                     │   │   ├── infraternal-fuzz v0.1.0 (*)
                     │   │   ├── infraternal-server v0.1.0
                     │   │   │   ├── infraternal v0.1.0 (*)
                     │   │   │   └── infraternal-fuzz v0.1.0 (*)
                     │   │   └── infraternal-session v0.1.0
                     │   └── infraternal-server v0.1.0 (*)
                     ├── infraternal-plugin-remote v0.1.0
                     │   ├── infraternal v0.1.0 (*)
                     │   ├── infraternal-agent v0.1.0 (*)
                     │   ├── infraternal-fuzz v0.1.0 (*)
                     │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
                     │   └── infraternal-server v0.1.0 (*)
                     └── infraternal-server v0.1.0 (*)

warning[duplicate]: found 3 duplicate entries for crate 'getrandom'
   ┌─ /home/claude/worktrees/j12b/Cargo.lock:92:1
   │  
92 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index
93 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index
94 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index
   │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ getrandom v0.2.17
     ├── rand_core v0.6.4
     │   ├── bip39 v2.2.2
     │   │   └── infraternal-server v0.1.0
     │   │       ├── infraternal v0.1.0
     │   │       └── infraternal-fuzz v0.1.0
     │   ├── crypto-common v0.1.7
     │   │   ├── aead v0.5.2
     │   │   │   └── aes-gcm v0.10.3
     │   │   │       └── (dev) infraternal-server v0.1.0 (*)
     │   │   ├── cipher v0.4.4
     │   │   │   ├── aes v0.8.4
     │   │   │   │   └── aes-gcm v0.10.3 (*)
     │   │   │   ├── aes-gcm v0.10.3 (*)
     │   │   │   └── ctr v0.9.2
     │   │   │       └── aes-gcm v0.10.3 (*)
     │   │   ├── digest v0.10.7
     │   │   │   ├── blake2 v0.10.6
     │   │   │   │   └── argon2 v0.5.3
     │   │   │   │       └── infraternal-server v0.1.0 (*)
     │   │   │   ├── hmac v0.12.1
     │   │   │   │   └── hkdf v0.12.4
     │   │   │   │       └── (dev) infraternal-server v0.1.0 (*)
     │   │   │   ├── sha1 v0.10.7
     │   │   │   │   ├── axum v0.8.9
     │   │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │   │   │   └── infraternal-server v0.1.0 (*)
     │   │   │   │   └── tungstenite v0.29.0
     │   │   │   │       └── tokio-tungstenite v0.29.0
     │   │   │   │           ├── axum v0.8.9 (*)
     │   │   │   │           └── (dev) infraternal-server v0.1.0 (*)
     │   │   │   └── sha2 v0.10.9
     │   │   │       ├── infraternal-agent v0.1.0
     │   │   │       │   ├── infraternal v0.1.0 (*)
     │   │   │       │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-ssh v0.1.0
     │   │   │       │   │   ├── infraternal v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-server v0.1.0 (*)
     │   │   │       │   │   └── infraternal-session v0.1.0
     │   │   │       │   └── infraternal-server v0.1.0 (*)
     │   │   │       ├── infraternal-plugin-api v0.1.0
     │   │   │       │   ├── infraternal v0.1.0 (*)
     │   │   │       │   ├── infraternal-agent v0.1.0 (*)
     │   │   │       │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   ├── infraternal-mesh v0.1.0
     │   │   │       │   │   ├── infraternal v0.1.0 (*)
     │   │   │       │   │   └── infraternal-plugin-mesh v0.1.0
     │   │   │       │   │       ├── infraternal v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-agent v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   │       └── infraternal-server v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-backup v0.1.0
     │   │   │       │   │   └── infraternal v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-canvas v0.1.0
     │   │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   │   └── infraternal-server v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-host-facts v0.1.0
     │   │   │       │   │   ├── infraternal v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-agent v0.1.0 (*)
     │   │   │       │   │   └── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-relay v0.1.0
     │   │   │       │   │   └── infraternal v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-release v0.1.0
     │   │   │       │   │   ├── infraternal v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-agent v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   │   └── infraternal-server v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-remote v0.1.0
     │   │   │       │   │   ├── infraternal v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-agent v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
     │   │   │       │   │   └── infraternal-server v0.1.0 (*)
     │   │   │       │   ├── infraternal-plugin-ssh v0.1.0 (*)
     │   │   │       │   └── infraternal-server v0.1.0 (*)
     │   │   │       ├── infraternal-plugin-release v0.1.0 (*)
     │   │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
     │   │   │       ├── (build) infraternal-server v0.1.0 (*)
     │   │   │       ├── sqlx-core v0.8.6
     │   │   │       │   ├── sqlx v0.8.6
     │   │   │       │   │   ├── infraternal v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-plugin-api v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-plugin-release v0.1.0 (*)
     │   │   │       │   │   ├── infraternal-server v0.1.0 (*)
     │   │   │       │   │   └── infraternal-shim v0.1.0
     │   │   │       │   │       ├── infraternal v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-agent v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-fuzz v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-plugin-remote v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-server v0.1.0 (*)
     │   │   │       │   │       ├── infraternal-session v0.1.0 (*)
     │   │   │       │   │       └── infraternal-status v0.1.0
     │   │   │       │   │           └── infraternal v0.1.0 (*)
     │   │   │       │   ├── sqlx-macros v0.8.6
     │   │   │       │   │   └── sqlx v0.8.6 (*)
     │   │   │       │   ├── sqlx-macros-core v0.8.6
     │   │   │       │   │   └── sqlx-macros v0.8.6 (*)
     │   │   │       │   └── sqlx-sqlite v0.8.6
     │   │   │       │       ├── sqlx v0.8.6 (*)
     │   │   │       │       └── sqlx-macros-core v0.8.6 (*)
     │   │   │       └── sqlx-macros-core v0.8.6 (*)
     │   │   └── universal-hash v0.5.1
     │   │       └── polyval v0.6.2
     │   │           └── ghash v0.5.1
     │   │               └── aes-gcm v0.10.3 (*)
     │   ├── password-hash v0.5.0
     │   │   └── argon2 v0.5.3 (*)
     │   ├── rand v0.8.8
     │   │   └── bip39 v2.2.2 (*)
     │   └── rand_chacha v0.3.1
     │       └── rand v0.8.8 (*)
     └── ring v0.17.14
         ├── infraternal-plugin-remote v0.1.0 (*)
         ├── quinn-proto v0.11.19
         │   └── quinn v0.11.12
         │       ├── infraternal-agent v0.1.0 (*)
         │       ├── infraternal-plugin-remote v0.1.0 (*)
         │       └── infraternal-server v0.1.0 (*)
         ├── rustls v0.23.46
         │   ├── infraternal-plugin-remote v0.1.0 (*)
         │   ├── quinn v0.11.12 (*)
         │   └── quinn-proto v0.11.19 (*)
         └── rustls-webpki v0.103.16
             └── rustls v0.23.46 (*)
   ├ getrandom v0.3.4
     └── rand_core v0.9.5
         ├── rand v0.9.5
         │   ├── infraternal-server v0.1.0
         │   │   ├── infraternal v0.1.0
         │   │   └── infraternal-fuzz v0.1.0
         │   ├── tungstenite v0.29.0
         │   │   └── tokio-tungstenite v0.29.0
         │   │       ├── axum v0.8.9
         │   │       │   ├── infraternal-fuzz v0.1.0 (*)
         │   │       │   └── infraternal-server v0.1.0 (*)
         │   │       └── (dev) infraternal-server v0.1.0 (*)
         │   └── webauthn-rs-core v0.5.5
         │       └── webauthn-rs v0.5.5
         │           └── infraternal-server v0.1.0 (*)
         └── rand_chacha v0.9.0
             ├── rand v0.9.5 (*)
             └── webauthn-rs-core v0.5.5 (*)
   ├ getrandom v0.4.3
     ├── jobserver v0.1.35
     │   └── cc v1.6.0
     │       ├── (build) libfuzzer-sys v0.4.13
     │       │   └── infraternal-fuzz v0.1.0
     │       ├── (build) libsqlite3-sys v0.30.1
     │       │   ├── infraternal-shim v0.1.0
     │       │   │   ├── infraternal v0.1.0
     │       │   │   ├── infraternal-agent v0.1.0
     │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   ├── infraternal-plugin-ssh v0.1.0
     │       │   │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   │   ├── infraternal-server v0.1.0
     │       │   │   │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   │   │   └── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   │   └── infraternal-session v0.1.0
     │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-remote v0.1.0
     │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   ├── infraternal-agent v0.1.0 (*)
     │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
     │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
     │       │   │   ├── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-session v0.1.0 (*)
     │       │   │   └── infraternal-status v0.1.0
     │       │   │       └── infraternal v0.1.0 (*)
     │       │   └── sqlx-sqlite v0.8.6
     │       │       ├── sqlx v0.8.6
     │       │       │   ├── infraternal v0.1.0 (*)
     │       │       │   ├── infraternal-plugin-api v0.1.0
     │       │       │   │   ├── infraternal v0.1.0 (*)
     │       │       │   │   ├── infraternal-agent v0.1.0 (*)
     │       │       │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │       │   │   ├── infraternal-mesh v0.1.0
     │       │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │       │   │   │   └── infraternal-plugin-mesh v0.1.0
     │       │       │   │   │       ├── infraternal v0.1.0 (*)
     │       │       │   │   │       ├── infraternal-agent v0.1.0 (*)
     │       │       │   │   │       ├── infraternal-fuzz v0.1.0 (*)
     │       │       │   │   │       └── infraternal-server v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-backup v0.1.0
     │       │       │   │   │   └── infraternal v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-canvas v0.1.0
     │       │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-host-facts v0.1.0
     │       │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │       │   │   │   ├── infraternal-agent v0.1.0 (*)
     │       │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-relay v0.1.0
     │       │       │   │   │   └── infraternal v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-release v0.1.0
     │       │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │       │   │   │   ├── infraternal-agent v0.1.0 (*)
     │       │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
     │       │       │   │   └── infraternal-server v0.1.0 (*)
     │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │       │       │   ├── infraternal-plugin-release v0.1.0 (*)
     │       │       │   ├── infraternal-server v0.1.0 (*)
     │       │       │   └── infraternal-shim v0.1.0 (*)
     │       │       └── sqlx-macros-core v0.8.6
     │       │           └── sqlx-macros v0.8.6
     │       │               └── sqlx v0.8.6 (*)
     │       ├── openssl-src v300.6.1+3.6.3
     │       │   └── (build) openssl-sys v0.9.117
     │       │       ├── axum-server v0.8.0
     │       │       │   └── infraternal-server v0.1.0 (*)
     │       │       ├── openssl v0.10.81
     │       │       │   ├── axum-server v0.8.0 (*)
     │       │       │   ├── infraternal v0.1.0 (*)
     │       │       │   ├── infraternal-agent v0.1.0 (*)
     │       │       │   ├── infraternal-plugin-api v0.1.0 (*)
     │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │       │       │   ├── (dev) infraternal-plugin-release v0.1.0 (*)
     │       │       │   ├── infraternal-plugin-remote v0.1.0 (*)
     │       │       │   ├── infraternal-server v0.1.0 (*)
     │       │       │   ├── infraternal-shim v0.1.0 (*)
     │       │       │   ├── tokio-openssl v0.6.5
     │       │       │   │   ├── axum-server v0.8.0 (*)
     │       │       │   │   ├── infraternal v0.1.0 (*)
     │       │       │   │   ├── infraternal-agent v0.1.0 (*)
     │       │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
     │       │       │   │   └── (dev) infraternal-server v0.1.0 (*)
     │       │       │   ├── webauthn-attestation-ca v0.5.5
     │       │       │   │   └── webauthn-rs-core v0.5.5
     │       │       │   │       └── webauthn-rs v0.5.5
     │       │       │   │           └── infraternal-server v0.1.0 (*)
     │       │       │   └── webauthn-rs-core v0.5.5 (*)
     │       │       ├── tokio-openssl v0.6.5 (*)
     │       │       ├── webauthn-attestation-ca v0.5.5 (*)
     │       │       └── webauthn-rs-core v0.5.5 (*)
     │       ├── (build) openssl-sys v0.9.117 (*)
     │       └── (build) ring v0.17.14
     │           ├── infraternal-plugin-remote v0.1.0 (*)
     │           ├── quinn-proto v0.11.19
     │           │   └── quinn v0.11.12
     │           │       ├── infraternal-agent v0.1.0 (*)
     │           │       ├── infraternal-plugin-remote v0.1.0 (*)
     │           │       └── infraternal-server v0.1.0 (*)
     │           ├── rustls v0.23.46
     │           │   ├── infraternal-plugin-remote v0.1.0 (*)
     │           │   ├── quinn v0.11.12 (*)
     │           │   └── quinn-proto v0.11.19 (*)
     │           └── rustls-webpki v0.103.16
     │               └── rustls v0.23.46 (*)
     ├── quinn-proto v0.11.19 (*)
     ├── rand v0.10.3
     │   └── quinn-proto v0.11.19 (*)
     └── uuid v1.27.0
         ├── infraternal v0.1.0 (*)
         ├── infraternal-agent v0.1.0 (*)
         ├── (dev) infraternal-plugin-api v0.1.0 (*)
         ├── infraternal-plugin-canvas v0.1.0 (*)
         ├── infraternal-plugin-mesh v0.1.0 (*)
         ├── infraternal-plugin-release v0.1.0 (*)
         ├── infraternal-plugin-remote v0.1.0 (*)
         ├── infraternal-plugin-ssh v0.1.0 (*)
         ├── infraternal-server v0.1.0 (*)
         ├── (dev) infraternal-status v0.1.0 (*)
         ├── webauthn-attestation-ca v0.5.5 (*)
         ├── webauthn-rs v0.5.5 (*)
         └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 2 duplicate entries for crate 'hashbrown'
   ┌─ /home/claude/worktrees/j12b/Cargo.lock:98:1
   │  
98 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index
99 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index
   │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
   │  
   ├ hashbrown v0.15.5
     ├── hashlink v0.10.0
     │   └── sqlx-core v0.8.6
     │       ├── sqlx v0.8.6
     │       │   ├── infraternal v0.1.0
     │       │   ├── infraternal-plugin-api v0.1.0
     │       │   │   ├── infraternal v0.1.0 (*)
     │       │   │   ├── infraternal-agent v0.1.0
     │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   ├── infraternal-fuzz v0.1.0
     │       │   │   │   ├── infraternal-plugin-ssh v0.1.0
     │       │   │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   │   ├── infraternal-server v0.1.0
     │       │   │   │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   │   │   └── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   │   └── infraternal-session v0.1.0
     │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   ├── infraternal-mesh v0.1.0
     │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   └── infraternal-plugin-mesh v0.1.0
     │       │   │   │       ├── infraternal v0.1.0 (*)
     │       │   │   │       ├── infraternal-agent v0.1.0 (*)
     │       │   │   │       ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │       └── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-backup v0.1.0
     │       │   │   │   └── infraternal v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-canvas v0.1.0
     │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-host-facts v0.1.0
     │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   ├── infraternal-agent v0.1.0 (*)
     │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-relay v0.1.0
     │       │   │   │   └── infraternal v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-release v0.1.0
     │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   ├── infraternal-agent v0.1.0 (*)
     │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-remote v0.1.0
     │       │   │   │   ├── infraternal v0.1.0 (*)
     │       │   │   │   ├── infraternal-agent v0.1.0 (*)
     │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
     │       │   │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
     │       │   │   │   └── infraternal-server v0.1.0 (*)
     │       │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
     │       │   │   └── infraternal-server v0.1.0 (*)
     │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
     │       │   ├── infraternal-plugin-release v0.1.0 (*)
     │       │   ├── infraternal-server v0.1.0 (*)
     │       │   └── infraternal-shim v0.1.0
     │       │       ├── infraternal v0.1.0 (*)
     │       │       ├── infraternal-agent v0.1.0 (*)
     │       │       ├── infraternal-fuzz v0.1.0 (*)
     │       │       ├── infraternal-plugin-remote v0.1.0 (*)
     │       │       ├── infraternal-plugin-ssh v0.1.0 (*)
     │       │       ├── infraternal-server v0.1.0 (*)
     │       │       ├── infraternal-session v0.1.0 (*)
     │       │       └── infraternal-status v0.1.0
     │       │           └── infraternal v0.1.0 (*)
     │       ├── sqlx-macros v0.8.6
     │       │   └── sqlx v0.8.6 (*)
     │       ├── sqlx-macros-core v0.8.6
     │       │   └── sqlx-macros v0.8.6 (*)
     │       └── sqlx-sqlite v0.8.6
     │           ├── sqlx v0.8.6 (*)
     │           └── sqlx-macros-core v0.8.6 (*)
     └── sqlx-core v0.8.6 (*)
   ├ hashbrown v0.17.1
     └── indexmap v2.14.2
         ├── h2 v0.4.19
         │   ├── hyper v1.11.1
         │   │   ├── axum v0.8.9
         │   │   │   ├── infraternal-fuzz v0.1.0
         │   │   │   └── infraternal-server v0.1.0
         │   │   │       ├── infraternal v0.1.0
         │   │   │       └── infraternal-fuzz v0.1.0 (*)
         │   │   ├── axum-server v0.8.0
         │   │   │   └── infraternal-server v0.1.0 (*)
         │   │   ├── hyper-util v0.1.21
         │   │   │   ├── axum v0.8.9 (*)
         │   │   │   ├── axum-server v0.8.0 (*)
         │   │   │   ├── infraternal v0.1.0 (*)
         │   │   │   └── (dev) infraternal-server v0.1.0 (*)
         │   │   ├── infraternal v0.1.0 (*)
         │   │   └── (dev) infraternal-server v0.1.0 (*)
         │   └── (dev) infraternal-server v0.1.0 (*)
         └── sqlx-core v0.8.6
             ├── sqlx v0.8.6
             │   ├── infraternal v0.1.0 (*)
             │   ├── infraternal-plugin-api v0.1.0
             │   │   ├── infraternal v0.1.0 (*)
             │   │   ├── infraternal-agent v0.1.0
             │   │   │   ├── infraternal v0.1.0 (*)
             │   │   │   ├── infraternal-fuzz v0.1.0 (*)
             │   │   │   ├── infraternal-plugin-ssh v0.1.0
             │   │   │   │   ├── infraternal v0.1.0 (*)
             │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
             │   │   │   │   ├── infraternal-server v0.1.0 (*)
             │   │   │   │   └── infraternal-session v0.1.0
             │   │   │   └── infraternal-server v0.1.0 (*)
             │   │   ├── infraternal-fuzz v0.1.0 (*)
             │   │   ├── infraternal-mesh v0.1.0
             │   │   │   ├── infraternal v0.1.0 (*)
             │   │   │   └── infraternal-plugin-mesh v0.1.0
             │   │   │       ├── infraternal v0.1.0 (*)
             │   │   │       ├── infraternal-agent v0.1.0 (*)
             │   │   │       ├── infraternal-fuzz v0.1.0 (*)
             │   │   │       └── infraternal-server v0.1.0 (*)
             │   │   ├── infraternal-plugin-backup v0.1.0
             │   │   │   └── infraternal v0.1.0 (*)
             │   │   ├── infraternal-plugin-canvas v0.1.0
             │   │   │   ├── infraternal-fuzz v0.1.0 (*)
             │   │   │   └── infraternal-server v0.1.0 (*)
             │   │   ├── infraternal-plugin-host-facts v0.1.0
             │   │   │   ├── infraternal v0.1.0 (*)
             │   │   │   ├── infraternal-agent v0.1.0 (*)
             │   │   │   └── infraternal-fuzz v0.1.0 (*)
             │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
             │   │   ├── infraternal-plugin-relay v0.1.0
             │   │   │   └── infraternal v0.1.0 (*)
             │   │   ├── infraternal-plugin-release v0.1.0
             │   │   │   ├── infraternal v0.1.0 (*)
             │   │   │   ├── infraternal-agent v0.1.0 (*)
             │   │   │   ├── infraternal-fuzz v0.1.0 (*)
             │   │   │   └── infraternal-server v0.1.0 (*)
             │   │   ├── infraternal-plugin-remote v0.1.0
             │   │   │   ├── infraternal v0.1.0 (*)
             │   │   │   ├── infraternal-agent v0.1.0 (*)
             │   │   │   ├── infraternal-fuzz v0.1.0 (*)
             │   │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
             │   │   │   └── infraternal-server v0.1.0 (*)
             │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
             │   │   └── infraternal-server v0.1.0 (*)
             │   ├── infraternal-plugin-mesh v0.1.0 (*)
             │   ├── infraternal-plugin-release v0.1.0 (*)
             │   ├── infraternal-server v0.1.0 (*)
             │   └── infraternal-shim v0.1.0
             │       ├── infraternal v0.1.0 (*)
             │       ├── infraternal-agent v0.1.0 (*)
             │       ├── infraternal-fuzz v0.1.0 (*)
             │       ├── infraternal-plugin-remote v0.1.0 (*)
             │       ├── infraternal-plugin-ssh v0.1.0 (*)
             │       ├── infraternal-server v0.1.0 (*)
             │       ├── infraternal-session v0.1.0 (*)
             │       └── infraternal-status v0.1.0
             │           └── infraternal v0.1.0 (*)
             ├── sqlx-macros v0.8.6
             │   └── sqlx v0.8.6 (*)
             ├── sqlx-macros-core v0.8.6
             │   └── sqlx-macros v0.8.6 (*)
             └── sqlx-sqlite v0.8.6
                 ├── sqlx v0.8.6 (*)
                 └── sqlx-macros-core v0.8.6 (*)

warning[duplicate]: found 2 duplicate entries for crate 'r-efi'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:200:1
    │  
200 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index
201 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ r-efi v5.3.0
      └── getrandom v0.3.4
          └── rand_core v0.9.5
              ├── rand v0.9.5
              │   ├── infraternal-server v0.1.0
              │   │   ├── infraternal v0.1.0
              │   │   └── infraternal-fuzz v0.1.0
              │   ├── tungstenite v0.29.0
              │   │   └── tokio-tungstenite v0.29.0
              │   │       ├── axum v0.8.9
              │   │       │   ├── infraternal-fuzz v0.1.0 (*)
              │   │       │   └── infraternal-server v0.1.0 (*)
              │   │       └── (dev) infraternal-server v0.1.0 (*)
              │   └── webauthn-rs-core v0.5.5
              │       └── webauthn-rs v0.5.5
              │           └── infraternal-server v0.1.0 (*)
              └── rand_chacha v0.9.0
                  ├── rand v0.9.5 (*)
                  └── webauthn-rs-core v0.5.5 (*)
    ├ r-efi v6.0.0
      └── getrandom v0.4.3
          ├── jobserver v0.1.35
          │   └── cc v1.6.0
          │       ├── (build) libfuzzer-sys v0.4.13
          │       │   └── infraternal-fuzz v0.1.0
          │       ├── (build) libsqlite3-sys v0.30.1
          │       │   ├── infraternal-shim v0.1.0
          │       │   │   ├── infraternal v0.1.0
          │       │   │   ├── infraternal-agent v0.1.0
          │       │   │   │   ├── infraternal v0.1.0 (*)
          │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │   │   │   ├── infraternal-plugin-ssh v0.1.0
          │       │   │   │   │   ├── infraternal v0.1.0 (*)
          │       │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │   │   │   │   ├── infraternal-server v0.1.0
          │       │   │   │   │   │   ├── infraternal v0.1.0 (*)
          │       │   │   │   │   │   └── infraternal-fuzz v0.1.0 (*)
          │       │   │   │   │   └── infraternal-session v0.1.0
          │       │   │   │   └── infraternal-server v0.1.0 (*)
          │       │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │   │   ├── infraternal-plugin-remote v0.1.0
          │       │   │   │   ├── infraternal v0.1.0 (*)
          │       │   │   │   ├── infraternal-agent v0.1.0 (*)
          │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │   │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
          │       │   │   │   └── infraternal-server v0.1.0 (*)
          │       │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
          │       │   │   ├── infraternal-server v0.1.0 (*)
          │       │   │   ├── infraternal-session v0.1.0 (*)
          │       │   │   └── infraternal-status v0.1.0
          │       │   │       └── infraternal v0.1.0 (*)
          │       │   └── sqlx-sqlite v0.8.6
          │       │       ├── sqlx v0.8.6
          │       │       │   ├── infraternal v0.1.0 (*)
          │       │       │   ├── infraternal-plugin-api v0.1.0
          │       │       │   │   ├── infraternal v0.1.0 (*)
          │       │       │   │   ├── infraternal-agent v0.1.0 (*)
          │       │       │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │       │   │   ├── infraternal-mesh v0.1.0
          │       │       │   │   │   ├── infraternal v0.1.0 (*)
          │       │       │   │   │   └── infraternal-plugin-mesh v0.1.0
          │       │       │   │   │       ├── infraternal v0.1.0 (*)
          │       │       │   │   │       ├── infraternal-agent v0.1.0 (*)
          │       │       │   │   │       ├── infraternal-fuzz v0.1.0 (*)
          │       │       │   │   │       └── infraternal-server v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-backup v0.1.0
          │       │       │   │   │   └── infraternal v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-canvas v0.1.0
          │       │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │       │   │   │   └── infraternal-server v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-host-facts v0.1.0
          │       │       │   │   │   ├── infraternal v0.1.0 (*)
          │       │       │   │   │   ├── infraternal-agent v0.1.0 (*)
          │       │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-relay v0.1.0
          │       │       │   │   │   └── infraternal v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-release v0.1.0
          │       │       │   │   │   ├── infraternal v0.1.0 (*)
          │       │       │   │   │   ├── infraternal-agent v0.1.0 (*)
          │       │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │       │   │   │   └── infraternal-server v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
          │       │       │   │   └── infraternal-server v0.1.0 (*)
          │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
          │       │       │   ├── infraternal-plugin-release v0.1.0 (*)
          │       │       │   ├── infraternal-server v0.1.0 (*)
          │       │       │   └── infraternal-shim v0.1.0 (*)
          │       │       └── sqlx-macros-core v0.8.6
          │       │           └── sqlx-macros v0.8.6
          │       │               └── sqlx v0.8.6 (*)
          │       ├── openssl-src v300.6.1+3.6.3
          │       │   └── (build) openssl-sys v0.9.117
          │       │       ├── axum-server v0.8.0
          │       │       │   └── infraternal-server v0.1.0 (*)
          │       │       ├── openssl v0.10.81
          │       │       │   ├── axum-server v0.8.0 (*)
          │       │       │   ├── infraternal v0.1.0 (*)
          │       │       │   ├── infraternal-agent v0.1.0 (*)
          │       │       │   ├── infraternal-plugin-api v0.1.0 (*)
          │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
          │       │       │   ├── (dev) infraternal-plugin-release v0.1.0 (*)
          │       │       │   ├── infraternal-plugin-remote v0.1.0 (*)
          │       │       │   ├── infraternal-server v0.1.0 (*)
          │       │       │   ├── infraternal-shim v0.1.0 (*)
          │       │       │   ├── tokio-openssl v0.6.5
          │       │       │   │   ├── axum-server v0.8.0 (*)
          │       │       │   │   ├── infraternal v0.1.0 (*)
          │       │       │   │   ├── infraternal-agent v0.1.0 (*)
          │       │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
          │       │       │   │   └── (dev) infraternal-server v0.1.0 (*)
          │       │       │   ├── webauthn-attestation-ca v0.5.5
          │       │       │   │   └── webauthn-rs-core v0.5.5
          │       │       │   │       └── webauthn-rs v0.5.5
          │       │       │   │           └── infraternal-server v0.1.0 (*)
          │       │       │   └── webauthn-rs-core v0.5.5 (*)
          │       │       ├── tokio-openssl v0.6.5 (*)
          │       │       ├── webauthn-attestation-ca v0.5.5 (*)
          │       │       └── webauthn-rs-core v0.5.5 (*)
          │       ├── (build) openssl-sys v0.9.117 (*)
          │       └── (build) ring v0.17.14
          │           ├── infraternal-plugin-remote v0.1.0 (*)
          │           ├── quinn-proto v0.11.19
          │           │   └── quinn v0.11.12
          │           │       ├── infraternal-agent v0.1.0 (*)
          │           │       ├── infraternal-plugin-remote v0.1.0 (*)
          │           │       └── infraternal-server v0.1.0 (*)
          │           ├── rustls v0.23.46
          │           │   ├── infraternal-plugin-remote v0.1.0 (*)
          │           │   ├── quinn v0.11.12 (*)
          │           │   └── quinn-proto v0.11.19 (*)
          │           └── rustls-webpki v0.103.16
          │               └── rustls v0.23.46 (*)
          ├── quinn-proto v0.11.19 (*)
          ├── rand v0.10.3
          │   └── quinn-proto v0.11.19 (*)
          └── uuid v1.27.0
              ├── infraternal v0.1.0 (*)
              ├── infraternal-agent v0.1.0 (*)
              ├── (dev) infraternal-plugin-api v0.1.0 (*)
              ├── infraternal-plugin-canvas v0.1.0 (*)
              ├── infraternal-plugin-mesh v0.1.0 (*)
              ├── infraternal-plugin-release v0.1.0 (*)
              ├── infraternal-plugin-remote v0.1.0 (*)
              ├── infraternal-plugin-ssh v0.1.0 (*)
              ├── infraternal-server v0.1.0 (*)
              ├── (dev) infraternal-status v0.1.0 (*)
              ├── webauthn-attestation-ca v0.5.5 (*)
              ├── webauthn-rs v0.5.5 (*)
              └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 3 duplicate entries for crate 'rand'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:202:1
    │  
202 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index
203 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index
204 │ │ rand 0.10.3 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand v0.8.8
      └── bip39 v2.2.2
          └── infraternal-server v0.1.0
              ├── infraternal v0.1.0
              └── infraternal-fuzz v0.1.0
    ├ rand v0.9.5
      ├── infraternal-server v0.1.0
      │   ├── infraternal v0.1.0
      │   └── infraternal-fuzz v0.1.0
      ├── tungstenite v0.29.0
      │   └── tokio-tungstenite v0.29.0
      │       ├── axum v0.8.9
      │       │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   └── infraternal-server v0.1.0 (*)
      │       └── (dev) infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5
          └── webauthn-rs v0.5.5
              └── infraternal-server v0.1.0 (*)
    ├ rand v0.10.3
      └── quinn-proto v0.11.19
          └── quinn v0.11.12
              ├── infraternal-agent v0.1.0
              │   ├── infraternal v0.1.0
              │   ├── infraternal-fuzz v0.1.0
              │   ├── infraternal-plugin-ssh v0.1.0
              │   │   ├── infraternal v0.1.0 (*)
              │   │   ├── infraternal-fuzz v0.1.0 (*)
              │   │   ├── infraternal-server v0.1.0
              │   │   │   ├── infraternal v0.1.0 (*)
              │   │   │   └── infraternal-fuzz v0.1.0 (*)
              │   │   └── infraternal-session v0.1.0
              │   └── infraternal-server v0.1.0 (*)
              ├── infraternal-plugin-remote v0.1.0
              │   ├── infraternal v0.1.0 (*)
              │   ├── infraternal-agent v0.1.0 (*)
              │   ├── infraternal-fuzz v0.1.0 (*)
              │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
              │   └── infraternal-server v0.1.0 (*)
              └── infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:205:1
    │  
205 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index
206 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_chacha v0.3.1
      └── rand v0.8.8
          └── bip39 v2.2.2
              └── infraternal-server v0.1.0
                  ├── infraternal v0.1.0
                  └── infraternal-fuzz v0.1.0
    ├ rand_chacha v0.9.0
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   ├── infraternal v0.1.0
      │   │   └── infraternal-fuzz v0.1.0
      │   ├── tungstenite v0.29.0
      │   │   └── tokio-tungstenite v0.29.0
      │   │       ├── axum v0.8.9
      │   │       │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   └── infraternal-server v0.1.0 (*)
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── webauthn-rs-core v0.5.5 (*)

warning[duplicate]: found 3 duplicate entries for crate 'rand_core'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:207:1
    │  
207 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index
208 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index
209 │ │ rand_core 0.10.1 registry+https://github.com/rust-lang/crates.io-index
    │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ rand_core v0.6.4
      ├── bip39 v2.2.2
      │   └── infraternal-server v0.1.0
      │       ├── infraternal v0.1.0
      │       └── infraternal-fuzz v0.1.0
      ├── crypto-common v0.1.7
      │   ├── aead v0.5.2
      │   │   └── aes-gcm v0.10.3
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   ├── cipher v0.4.4
      │   │   ├── aes v0.8.4
      │   │   │   └── aes-gcm v0.10.3 (*)
      │   │   ├── aes-gcm v0.10.3 (*)
      │   │   └── ctr v0.9.2
      │   │       └── aes-gcm v0.10.3 (*)
      │   ├── digest v0.10.7
      │   │   ├── blake2 v0.10.6
      │   │   │   └── argon2 v0.5.3
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── hmac v0.12.1
      │   │   │   └── hkdf v0.12.4
      │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   │   ├── sha1 v0.10.7
      │   │   │   ├── axum v0.8.9
      │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │   │   │   └── infraternal-server v0.1.0 (*)
      │   │   │   └── tungstenite v0.29.0
      │   │   │       └── tokio-tungstenite v0.29.0
      │   │   │           ├── axum v0.8.9 (*)
      │   │   │           └── (dev) infraternal-server v0.1.0 (*)
      │   │   └── sha2 v0.10.9
      │   │       ├── infraternal-agent v0.1.0
      │   │       │   ├── infraternal v0.1.0 (*)
      │   │       │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-ssh v0.1.0
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   │   ├── infraternal-server v0.1.0 (*)
      │   │       │   │   └── infraternal-session v0.1.0
      │   │       │   └── infraternal-server v0.1.0 (*)
      │   │       ├── infraternal-plugin-api v0.1.0
      │   │       │   ├── infraternal v0.1.0 (*)
      │   │       │   ├── infraternal-agent v0.1.0 (*)
      │   │       │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   ├── infraternal-mesh v0.1.0
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   └── infraternal-plugin-mesh v0.1.0
      │   │       │   │       ├── infraternal v0.1.0 (*)
      │   │       │   │       ├── infraternal-agent v0.1.0 (*)
      │   │       │   │       ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   │       └── infraternal-server v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-backup v0.1.0
      │   │       │   │   └── infraternal v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-canvas v0.1.0
      │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-host-facts v0.1.0
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │   │   └── infraternal-fuzz v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-relay v0.1.0
      │   │       │   │   └── infraternal v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-release v0.1.0
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-remote v0.1.0
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │   │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │       │   └── infraternal-server v0.1.0 (*)
      │   │       ├── infraternal-plugin-release v0.1.0 (*)
      │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │       ├── (build) infraternal-server v0.1.0 (*)
      │   │       ├── sqlx-core v0.8.6
      │   │       │   ├── sqlx v0.8.6
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   ├── infraternal-plugin-api v0.1.0 (*)
      │   │       │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │       │   │   ├── infraternal-plugin-release v0.1.0 (*)
      │   │       │   │   ├── infraternal-server v0.1.0 (*)
      │   │       │   │   └── infraternal-shim v0.1.0
      │   │       │   │       ├── infraternal v0.1.0 (*)
      │   │       │   │       ├── infraternal-agent v0.1.0 (*)
      │   │       │   │       ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   │       ├── infraternal-plugin-remote v0.1.0 (*)
      │   │       │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │       │   │       ├── infraternal-server v0.1.0 (*)
      │   │       │   │       ├── infraternal-session v0.1.0 (*)
      │   │       │   │       └── infraternal-status v0.1.0
      │   │       │   │           └── infraternal v0.1.0 (*)
      │   │       │   ├── sqlx-macros v0.8.6
      │   │       │   │   └── sqlx v0.8.6 (*)
      │   │       │   ├── sqlx-macros-core v0.8.6
      │   │       │   │   └── sqlx-macros v0.8.6 (*)
      │   │       │   └── sqlx-sqlite v0.8.6
      │   │       │       ├── sqlx v0.8.6 (*)
      │   │       │       └── sqlx-macros-core v0.8.6 (*)
      │   │       └── sqlx-macros-core v0.8.6 (*)
      │   └── universal-hash v0.5.1
      │       └── polyval v0.6.2
      │           └── ghash v0.5.1
      │               └── aes-gcm v0.10.3 (*)
      ├── password-hash v0.5.0
      │   └── argon2 v0.5.3 (*)
      ├── rand v0.8.8
      │   └── bip39 v2.2.2 (*)
      └── rand_chacha v0.3.1
          └── rand v0.8.8 (*)
    ├ rand_core v0.9.5
      ├── rand v0.9.5
      │   ├── infraternal-server v0.1.0
      │   │   ├── infraternal v0.1.0
      │   │   └── infraternal-fuzz v0.1.0
      │   ├── tungstenite v0.29.0
      │   │   └── tokio-tungstenite v0.29.0
      │   │       ├── axum v0.8.9
      │   │       │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   └── infraternal-server v0.1.0 (*)
      │   │       └── (dev) infraternal-server v0.1.0 (*)
      │   └── webauthn-rs-core v0.5.5
      │       └── webauthn-rs v0.5.5
      │           └── infraternal-server v0.1.0 (*)
      └── rand_chacha v0.9.0
          ├── rand v0.9.5 (*)
          └── webauthn-rs-core v0.5.5 (*)
    ├ rand_core v0.10.1
      ├── chacha20 v0.10.2
      │   └── rand v0.10.3
      │       └── quinn-proto v0.11.19
      │           └── quinn v0.11.12
      │               ├── infraternal-agent v0.1.0
      │               │   ├── infraternal v0.1.0
      │               │   ├── infraternal-fuzz v0.1.0
      │               │   ├── infraternal-plugin-ssh v0.1.0
      │               │   │   ├── infraternal v0.1.0 (*)
      │               │   │   ├── infraternal-fuzz v0.1.0 (*)
      │               │   │   ├── infraternal-server v0.1.0
      │               │   │   │   ├── infraternal v0.1.0 (*)
      │               │   │   │   └── infraternal-fuzz v0.1.0 (*)
      │               │   │   └── infraternal-session v0.1.0
      │               │   └── infraternal-server v0.1.0 (*)
      │               ├── infraternal-plugin-remote v0.1.0
      │               │   ├── infraternal v0.1.0 (*)
      │               │   ├── infraternal-agent v0.1.0 (*)
      │               │   ├── infraternal-fuzz v0.1.0 (*)
      │               │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │               │   └── infraternal-server v0.1.0 (*)
      │               └── infraternal-server v0.1.0 (*)
      ├── getrandom v0.4.3
      │   ├── jobserver v0.1.35
      │   │   └── cc v1.6.0
      │   │       ├── (build) libfuzzer-sys v0.4.13
      │   │       │   └── infraternal-fuzz v0.1.0 (*)
      │   │       ├── (build) libsqlite3-sys v0.30.1
      │   │       │   ├── infraternal-shim v0.1.0
      │   │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
      │   │       │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │       │   │   ├── infraternal-server v0.1.0 (*)
      │   │       │   │   ├── infraternal-session v0.1.0 (*)
      │   │       │   │   └── infraternal-status v0.1.0
      │   │       │   │       └── infraternal v0.1.0 (*)
      │   │       │   └── sqlx-sqlite v0.8.6
      │   │       │       ├── sqlx v0.8.6
      │   │       │       │   ├── infraternal v0.1.0 (*)
      │   │       │       │   ├── infraternal-plugin-api v0.1.0
      │   │       │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-mesh v0.1.0
      │   │       │       │   │   │   ├── infraternal v0.1.0 (*)
      │   │       │       │   │   │   └── infraternal-plugin-mesh v0.1.0
      │   │       │       │   │   │       ├── infraternal v0.1.0 (*)
      │   │       │       │   │   │       ├── infraternal-agent v0.1.0 (*)
      │   │       │       │   │   │       ├── infraternal-fuzz v0.1.0 (*)
      │   │       │       │   │   │       └── infraternal-server v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-backup v0.1.0
      │   │       │       │   │   │   └── infraternal v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-canvas v0.1.0
      │   │       │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │       │   │   │   └── infraternal-server v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-host-facts v0.1.0
      │   │       │       │   │   │   ├── infraternal v0.1.0 (*)
      │   │       │       │   │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-relay v0.1.0
      │   │       │       │   │   │   └── infraternal v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-release v0.1.0
      │   │       │       │   │   │   ├── infraternal v0.1.0 (*)
      │   │       │       │   │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │       │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │       │       │   │   │   └── infraternal-server v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │       │       │   │   └── infraternal-server v0.1.0 (*)
      │   │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │       │       │   ├── infraternal-plugin-release v0.1.0 (*)
      │   │       │       │   ├── infraternal-server v0.1.0 (*)
      │   │       │       │   └── infraternal-shim v0.1.0 (*)
      │   │       │       └── sqlx-macros-core v0.8.6
      │   │       │           └── sqlx-macros v0.8.6
      │   │       │               └── sqlx v0.8.6 (*)
      │   │       ├── openssl-src v300.6.1+3.6.3
      │   │       │   └── (build) openssl-sys v0.9.117
      │   │       │       ├── axum-server v0.8.0
      │   │       │       │   └── infraternal-server v0.1.0 (*)
      │   │       │       ├── openssl v0.10.81
      │   │       │       │   ├── axum-server v0.8.0 (*)
      │   │       │       │   ├── infraternal v0.1.0 (*)
      │   │       │       │   ├── infraternal-agent v0.1.0 (*)
      │   │       │       │   ├── infraternal-plugin-api v0.1.0 (*)
      │   │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │       │       │   ├── (dev) infraternal-plugin-release v0.1.0 (*)
      │   │       │       │   ├── infraternal-plugin-remote v0.1.0 (*)
      │   │       │       │   ├── infraternal-server v0.1.0 (*)
      │   │       │       │   ├── infraternal-shim v0.1.0 (*)
      │   │       │       │   ├── tokio-openssl v0.6.5
      │   │       │       │   │   ├── axum-server v0.8.0 (*)
      │   │       │       │   │   ├── infraternal v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-agent v0.1.0 (*)
      │   │       │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
      │   │       │       │   │   └── (dev) infraternal-server v0.1.0 (*)
      │   │       │       │   ├── webauthn-attestation-ca v0.5.5
      │   │       │       │   │   └── webauthn-rs-core v0.5.5
      │   │       │       │   │       └── webauthn-rs v0.5.5
      │   │       │       │   │           └── infraternal-server v0.1.0 (*)
      │   │       │       │   └── webauthn-rs-core v0.5.5 (*)
      │   │       │       ├── tokio-openssl v0.6.5 (*)
      │   │       │       ├── webauthn-attestation-ca v0.5.5 (*)
      │   │       │       └── webauthn-rs-core v0.5.5 (*)
      │   │       ├── (build) openssl-sys v0.9.117 (*)
      │   │       └── (build) ring v0.17.14
      │   │           ├── infraternal-plugin-remote v0.1.0 (*)
      │   │           ├── quinn-proto v0.11.19 (*)
      │   │           ├── rustls v0.23.46
      │   │           │   ├── infraternal-plugin-remote v0.1.0 (*)
      │   │           │   ├── quinn v0.11.12 (*)
      │   │           │   └── quinn-proto v0.11.19 (*)
      │   │           └── rustls-webpki v0.103.16
      │   │               └── rustls v0.23.46 (*)
      │   ├── quinn-proto v0.11.19 (*)
      │   ├── rand v0.10.3 (*)
      │   └── uuid v1.27.0
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-agent v0.1.0 (*)
      │       ├── (dev) infraternal-plugin-api v0.1.0 (*)
      │       ├── infraternal-plugin-canvas v0.1.0 (*)
      │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       ├── infraternal-plugin-release v0.1.0 (*)
      │       ├── infraternal-plugin-remote v0.1.0 (*)
      │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── (dev) infraternal-status v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       ├── webauthn-rs v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      ├── rand v0.10.3 (*)
      └── rand_pcg v0.10.2
          └── quinn-proto v0.11.19 (*)

warning[duplicate]: found 2 duplicate entries for crate 'syn'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:251:1
    │  
251 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index
252 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ syn v2.0.119
      ├── asn1-rs-derive v0.5.1
      │   └── asn1-rs v0.6.2
      │       ├── der-parser v9.0.0
      │       │   ├── webauthn-rs-core v0.5.5
      │       │   │   └── webauthn-rs v0.5.5
      │       │   │       └── infraternal-server v0.1.0
      │       │   │           ├── infraternal v0.1.0
      │       │   │           └── infraternal-fuzz v0.1.0
      │       │   └── x509-parser v0.16.0
      │       │       └── webauthn-rs-core v0.5.5 (*)
      │       ├── oid-registry v0.7.1
      │       │   └── x509-parser v0.16.0 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── asn1-rs-impl v0.2.0
      │   └── asn1-rs v0.6.2 (*)
      ├── enum-as-inner v0.6.1
      │   └── sysctl v0.7.1
      │       └── infraternal-plugin-host-facts v0.1.0
      │           ├── infraternal v0.1.0 (*)
      │           ├── infraternal-agent v0.1.0
      │           │   ├── infraternal v0.1.0 (*)
      │           │   ├── infraternal-fuzz v0.1.0 (*)
      │           │   ├── infraternal-plugin-ssh v0.1.0
      │           │   │   ├── infraternal v0.1.0 (*)
      │           │   │   ├── infraternal-fuzz v0.1.0 (*)
      │           │   │   ├── infraternal-server v0.1.0 (*)
      │           │   │   └── infraternal-session v0.1.0
      │           │   └── infraternal-server v0.1.0 (*)
      │           └── infraternal-fuzz v0.1.0 (*)
      ├── openssl-macros v0.1.1
      │   └── openssl v0.10.81
      │       ├── axum-server v0.8.0
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-agent v0.1.0 (*)
      │       ├── infraternal-plugin-api v0.1.0
      │       │   ├── infraternal v0.1.0 (*)
      │       │   ├── infraternal-agent v0.1.0 (*)
      │       │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   ├── infraternal-mesh v0.1.0
      │       │   │   ├── infraternal v0.1.0 (*)
      │       │   │   └── infraternal-plugin-mesh v0.1.0
      │       │   │       ├── infraternal v0.1.0 (*)
      │       │   │       ├── infraternal-agent v0.1.0 (*)
      │       │   │       ├── infraternal-fuzz v0.1.0 (*)
      │       │   │       └── infraternal-server v0.1.0 (*)
      │       │   ├── infraternal-plugin-backup v0.1.0
      │       │   │   └── infraternal v0.1.0 (*)
      │       │   ├── infraternal-plugin-canvas v0.1.0
      │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │   └── infraternal-server v0.1.0 (*)
      │       │   ├── infraternal-plugin-host-facts v0.1.0 (*)
      │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │       │   ├── infraternal-plugin-relay v0.1.0
      │       │   │   └── infraternal v0.1.0 (*)
      │       │   ├── infraternal-plugin-release v0.1.0
      │       │   │   ├── infraternal v0.1.0 (*)
      │       │   │   ├── infraternal-agent v0.1.0 (*)
      │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │   └── infraternal-server v0.1.0 (*)
      │       │   ├── infraternal-plugin-remote v0.1.0
      │       │   │   ├── infraternal v0.1.0 (*)
      │       │   │   ├── infraternal-agent v0.1.0 (*)
      │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │       │   │   └── infraternal-server v0.1.0 (*)
      │       │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       ├── (dev) infraternal-plugin-release v0.1.0 (*)
      │       ├── infraternal-plugin-remote v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── infraternal-shim v0.1.0
      │       │   ├── infraternal v0.1.0 (*)
      │       │   ├── infraternal-agent v0.1.0 (*)
      │       │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │   ├── infraternal-server v0.1.0 (*)
      │       │   ├── infraternal-session v0.1.0 (*)
      │       │   └── infraternal-status v0.1.0
      │       │       └── infraternal v0.1.0 (*)
      │       ├── tokio-openssl v0.6.5
      │       │   ├── axum-server v0.8.0 (*)
      │       │   ├── infraternal v0.1.0 (*)
      │       │   ├── infraternal-agent v0.1.0 (*)
      │       │   ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5
      │       │   └── webauthn-rs-core v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      ├── sqlx-macros v0.8.6
      │   └── sqlx v0.8.6
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-plugin-api v0.1.0 (*)
      │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       ├── infraternal-plugin-release v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       └── infraternal-shim v0.1.0 (*)
      ├── sqlx-macros-core v0.8.6
      │   └── sqlx-macros v0.8.6 (*)
      ├── synstructure v0.13.2
      │   └── asn1-rs-derive v0.5.1 (*)
      ├── thiserror-impl v1.0.69
      │   └── thiserror v1.0.69
      │       ├── asn1-rs v0.6.2 (*)
      │       ├── webauthn-rs-core v0.5.5 (*)
      │       └── x509-parser v0.16.0 (*)
      ├── tracing-attributes v0.1.31
      │   └── tracing v0.1.44
      │       ├── axum v0.8.9
      │       │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── axum-core v0.5.6
      │       │   └── axum v0.8.9 (*)
      │       ├── h2 v0.4.19
      │       │   ├── hyper v1.11.1
      │       │   │   ├── axum v0.8.9 (*)
      │       │   │   ├── axum-server v0.8.0 (*)
      │       │   │   ├── hyper-util v0.1.21
      │       │   │   │   ├── axum v0.8.9 (*)
      │       │   │   │   ├── axum-server v0.8.0 (*)
      │       │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │   │   └── (dev) infraternal-server v0.1.0 (*)
      │       │   │   ├── infraternal v0.1.0 (*)
      │       │   │   └── (dev) infraternal-server v0.1.0 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── quinn v0.11.12
      │       │   ├── infraternal-agent v0.1.0 (*)
      │       │   ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── quinn-proto v0.11.19
      │       │   └── quinn v0.11.12 (*)
      │       ├── quinn-udp v0.5.16
      │       │   └── quinn v0.11.12 (*)
      │       ├── sqlx-core v0.8.6
      │       │   ├── sqlx v0.8.6 (*)
      │       │   ├── sqlx-macros v0.8.6 (*)
      │       │   ├── sqlx-macros-core v0.8.6 (*)
      │       │   └── sqlx-sqlite v0.8.6
      │       │       ├── sqlx v0.8.6 (*)
      │       │       └── sqlx-macros-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── tracing-subscriber v0.3.23
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       ├── webauthn-rs v0.5.5 (*)
      │       └── webauthn-rs-core v0.5.5 (*)
      └── zerocopy-derive v0.8.60
          └── zerocopy v0.8.60
              ├── half v2.7.1
              │   ├── ciborium-ll v0.2.2
              │   │   └── ciborium v0.2.2
              │   │       └── criterion v0.7.0
              │   │           └── (dev) infraternal-protocol v0.1.0
              │   │               ├── infraternal-agent v0.1.0 (*)
              │   │               ├── infraternal-fuzz v0.1.0 (*)
              │   │               ├── infraternal-plugin-api v0.1.0 (*)
              │   │               ├── infraternal-plugin-canvas v0.1.0 (*)
              │   │               ├── (dev) infraternal-plugin-host-facts v0.1.0 (*)
              │   │               ├── infraternal-plugin-mesh v0.1.0 (*)
              │   │               ├── infraternal-plugin-release v0.1.0 (*)
              │   │               ├── infraternal-plugin-remote v0.1.0 (*)
              │   │               └── infraternal-server v0.1.0 (*)
              │   └── serde_cbor_2 v0.13.0
              │       ├── infraternal-server v0.1.0 (*)
              │       └── webauthn-rs-core v0.5.5 (*)
              └── ppv-lite86 v0.2.21
                  ├── rand_chacha v0.3.1
                  │   └── rand v0.8.8
                  │       └── bip39 v2.2.2
                  │           └── infraternal-server v0.1.0 (*)
                  └── rand_chacha v0.9.0
                      ├── rand v0.9.5
                      │   ├── infraternal-server v0.1.0 (*)
                      │   ├── tungstenite v0.29.0
                      │   │   └── tokio-tungstenite v0.29.0
                      │   │       ├── axum v0.8.9 (*)
                      │   │       └── (dev) infraternal-server v0.1.0 (*)
                      │   └── webauthn-rs-core v0.5.5 (*)
                      └── webauthn-rs-core v0.5.5 (*)
    ├ syn v3.0.6
      ├── clap_derive v4.6.7
      │   └── clap v4.6.7
      │       ├── criterion v0.7.0
      │       │   └── (dev) infraternal-protocol v0.1.0
      │       │       ├── infraternal-agent v0.1.0
      │       │       │   ├── infraternal v0.1.0
      │       │       │   ├── infraternal-fuzz v0.1.0
      │       │       │   ├── infraternal-plugin-ssh v0.1.0
      │       │       │   │   ├── infraternal v0.1.0 (*)
      │       │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │       │   │   ├── infraternal-server v0.1.0
      │       │       │   │   │   ├── infraternal v0.1.0 (*)
      │       │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
      │       │       │   │   └── infraternal-session v0.1.0
      │       │       │   └── infraternal-server v0.1.0 (*)
      │       │       ├── infraternal-fuzz v0.1.0 (*)
      │       │       ├── infraternal-plugin-api v0.1.0
      │       │       │   ├── infraternal v0.1.0 (*)
      │       │       │   ├── infraternal-agent v0.1.0 (*)
      │       │       │   ├── infraternal-fuzz v0.1.0 (*)
      │       │       │   ├── infraternal-mesh v0.1.0
      │       │       │   │   ├── infraternal v0.1.0 (*)
      │       │       │   │   └── infraternal-plugin-mesh v0.1.0
      │       │       │   │       ├── infraternal v0.1.0 (*)
      │       │       │   │       ├── infraternal-agent v0.1.0 (*)
      │       │       │   │       ├── infraternal-fuzz v0.1.0 (*)
      │       │       │   │       └── infraternal-server v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-backup v0.1.0
      │       │       │   │   └── infraternal v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-canvas v0.1.0
      │       │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │       │   │   └── infraternal-server v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-host-facts v0.1.0
      │       │       │   │   ├── infraternal v0.1.0 (*)
      │       │       │   │   ├── infraternal-agent v0.1.0 (*)
      │       │       │   │   └── infraternal-fuzz v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-relay v0.1.0
      │       │       │   │   └── infraternal v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-release v0.1.0
      │       │       │   │   ├── infraternal v0.1.0 (*)
      │       │       │   │   ├── infraternal-agent v0.1.0 (*)
      │       │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │       │   │   └── infraternal-server v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-remote v0.1.0
      │       │       │   │   ├── infraternal v0.1.0 (*)
      │       │       │   │   ├── infraternal-agent v0.1.0 (*)
      │       │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │       │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │       │       │   │   └── infraternal-server v0.1.0 (*)
      │       │       │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │       │   └── infraternal-server v0.1.0 (*)
      │       │       ├── infraternal-plugin-canvas v0.1.0 (*)
      │       │       ├── (dev) infraternal-plugin-host-facts v0.1.0 (*)
      │       │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       │       ├── infraternal-plugin-release v0.1.0 (*)
      │       │       ├── infraternal-plugin-remote v0.1.0 (*)
      │       │       └── infraternal-server v0.1.0 (*)
      │       ├── infraternal v0.1.0 (*)
      │       └── infraternal-shim v0.1.0
      │           ├── infraternal v0.1.0 (*)
      │           ├── infraternal-agent v0.1.0 (*)
      │           ├── infraternal-fuzz v0.1.0 (*)
      │           ├── infraternal-plugin-remote v0.1.0 (*)
      │           ├── infraternal-plugin-ssh v0.1.0 (*)
      │           ├── infraternal-server v0.1.0 (*)
      │           ├── infraternal-session v0.1.0 (*)
      │           └── infraternal-status v0.1.0
      │               └── infraternal v0.1.0 (*)
      ├── displaydoc v0.2.7
      │   ├── asn1-rs v0.6.2
      │   │   ├── der-parser v9.0.0
      │   │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   │   └── webauthn-rs v0.5.5
      │   │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   │   └── x509-parser v0.16.0
      │   │   │       └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── oid-registry v0.7.1
      │   │   │   └── x509-parser v0.16.0 (*)
      │   │   └── x509-parser v0.16.0 (*)
      │   ├── der-parser v9.0.0 (*)
      │   ├── icu_collections v2.3.0
      │   │   ├── icu_normalizer v2.3.0
      │   │   │   └── idna_adapter v1.2.2
      │   │   │       └── idna v1.1.0
      │   │   │           └── url v2.5.8
      │   │   │               ├── infraternal v0.1.0 (*)
      │   │   │               ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │   │               ├── infraternal-server v0.1.0 (*)
      │   │   │               ├── sqlx-core v0.8.6
      │   │   │               │   ├── sqlx v0.8.6
      │   │   │               │   │   ├── infraternal v0.1.0 (*)
      │   │   │               │   │   ├── infraternal-plugin-api v0.1.0 (*)
      │   │   │               │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │   │               │   │   ├── infraternal-plugin-release v0.1.0 (*)
      │   │   │               │   │   ├── infraternal-server v0.1.0 (*)
      │   │   │               │   │   └── infraternal-shim v0.1.0 (*)
      │   │   │               │   ├── sqlx-macros v0.8.6
      │   │   │               │   │   └── sqlx v0.8.6 (*)
      │   │   │               │   ├── sqlx-macros-core v0.8.6
      │   │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │   │   │               │   └── sqlx-sqlite v0.8.6
      │   │   │               │       ├── sqlx v0.8.6 (*)
      │   │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-macros-core v0.8.6 (*)
      │   │   │               ├── sqlx-sqlite v0.8.6 (*)
      │   │   │               ├── webauthn-rs v0.5.5 (*)
      │   │   │               ├── webauthn-rs-core v0.5.5 (*)
      │   │   │               └── webauthn-rs-proto v0.5.5
      │   │   │                   └── webauthn-rs-core v0.5.5 (*)
      │   │   └── icu_properties v2.3.0
      │   │       └── idna_adapter v1.2.2 (*)
      │   ├── icu_locale_core v2.3.0
      │   │   ├── icu_properties v2.3.0 (*)
      │   │   └── icu_provider v2.3.1
      │   │       ├── icu_normalizer v2.3.0 (*)
      │   │       └── icu_properties v2.3.0 (*)
      │   ├── icu_properties v2.3.0 (*)
      │   ├── icu_provider v2.3.1 (*)
      │   ├── tinystr v0.8.4
      │   │   └── icu_locale_core v2.3.0 (*)
      │   └── zerotrie v0.2.5
      │       ├── icu_properties v2.3.0 (*)
      │       └── icu_provider v2.3.1 (*)
      ├── futures-macro v0.3.34
      │   └── futures-util v0.3.34
      │       ├── axum v0.8.9
      │       │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── futures-executor v0.3.34
      │       │   └── sqlx-sqlite v0.8.6 (*)
      │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── js-sys v0.3.106
      │       │   ├── getrandom v0.2.17
      │       │   │   ├── rand_core v0.6.4
      │       │   │   │   ├── bip39 v2.2.2
      │       │   │   │   │   └── infraternal-server v0.1.0 (*)
      │       │   │   │   ├── crypto-common v0.1.7
      │       │   │   │   │   ├── aead v0.5.2
      │       │   │   │   │   │   └── aes-gcm v0.10.3
      │       │   │   │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │       │   │   │   │   ├── cipher v0.4.4
      │       │   │   │   │   │   ├── aes v0.8.4
      │       │   │   │   │   │   │   └── aes-gcm v0.10.3 (*)
      │       │   │   │   │   │   ├── aes-gcm v0.10.3 (*)
      │       │   │   │   │   │   └── ctr v0.9.2
      │       │   │   │   │   │       └── aes-gcm v0.10.3 (*)
      │       │   │   │   │   ├── digest v0.10.7
      │       │   │   │   │   │   ├── blake2 v0.10.6
      │       │   │   │   │   │   │   └── argon2 v0.5.3
      │       │   │   │   │   │   │       └── infraternal-server v0.1.0 (*)
      │       │   │   │   │   │   ├── hmac v0.12.1
      │       │   │   │   │   │   │   └── hkdf v0.12.4
      │       │   │   │   │   │   │       └── (dev) infraternal-server v0.1.0 (*)
      │       │   │   │   │   │   ├── sha1 v0.10.7
      │       │   │   │   │   │   │   ├── axum v0.8.9 (*)
      │       │   │   │   │   │   │   └── tungstenite v0.29.0
      │       │   │   │   │   │   │       └── tokio-tungstenite v0.29.0
      │       │   │   │   │   │   │           ├── axum v0.8.9 (*)
      │       │   │   │   │   │   │           └── (dev) infraternal-server v0.1.0 (*)
      │       │   │   │   │   │   └── sha2 v0.10.9
      │       │   │   │   │   │       ├── infraternal-agent v0.1.0 (*)
      │       │   │   │   │   │       ├── infraternal-plugin-api v0.1.0 (*)
      │       │   │   │   │   │       ├── infraternal-plugin-release v0.1.0 (*)
      │       │   │   │   │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │   │   │   │   │       ├── (build) infraternal-server v0.1.0 (*)
      │       │   │   │   │   │       ├── sqlx-core v0.8.6 (*)
      │       │   │   │   │   │       └── sqlx-macros-core v0.8.6 (*)
      │       │   │   │   │   └── universal-hash v0.5.1
      │       │   │   │   │       └── polyval v0.6.2
      │       │   │   │   │           └── ghash v0.5.1
      │       │   │   │   │               └── aes-gcm v0.10.3 (*)
      │       │   │   │   ├── password-hash v0.5.0
      │       │   │   │   │   └── argon2 v0.5.3 (*)
      │       │   │   │   ├── rand v0.8.8
      │       │   │   │   │   └── bip39 v2.2.2 (*)
      │       │   │   │   └── rand_chacha v0.3.1
      │       │   │   │       └── rand v0.8.8 (*)
      │       │   │   └── ring v0.17.14
      │       │   │       ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   │       ├── quinn-proto v0.11.19
      │       │   │       │   └── quinn v0.11.12
      │       │   │       │       ├── infraternal-agent v0.1.0 (*)
      │       │   │       │       ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   │       │       └── infraternal-server v0.1.0 (*)
      │       │   │       ├── rustls v0.23.46
      │       │   │       │   ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   │       │   ├── quinn v0.11.12 (*)
      │       │   │       │   └── quinn-proto v0.11.19 (*)
      │       │   │       └── rustls-webpki v0.103.16
      │       │   │           └── rustls v0.23.46 (*)
      │       │   ├── getrandom v0.4.3
      │       │   │   ├── jobserver v0.1.35
      │       │   │   │   └── cc v1.6.0
      │       │   │   │       ├── (build) libfuzzer-sys v0.4.13
      │       │   │   │       │   └── infraternal-fuzz v0.1.0 (*)
      │       │   │   │       ├── (build) libsqlite3-sys v0.30.1
      │       │   │   │       │   ├── infraternal-shim v0.1.0 (*)
      │       │   │   │       │   └── sqlx-sqlite v0.8.6 (*)
      │       │   │   │       ├── openssl-src v300.6.1+3.6.3
      │       │   │   │       │   └── (build) openssl-sys v0.9.117
      │       │   │   │       │       ├── axum-server v0.8.0
      │       │   │   │       │       │   └── infraternal-server v0.1.0 (*)
      │       │   │   │       │       ├── openssl v0.10.81
      │       │   │   │       │       │   ├── axum-server v0.8.0 (*)
      │       │   │   │       │       │   ├── infraternal v0.1.0 (*)
      │       │   │   │       │       │   ├── infraternal-agent v0.1.0 (*)
      │       │   │   │       │       │   ├── infraternal-plugin-api v0.1.0 (*)
      │       │   │   │       │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │       │   │   │       │       │   ├── (dev) infraternal-plugin-release v0.1.0 (*)
      │       │   │   │       │       │   ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   │   │       │       │   ├── infraternal-server v0.1.0 (*)
      │       │   │   │       │       │   ├── infraternal-shim v0.1.0 (*)
      │       │   │   │       │       │   ├── tokio-openssl v0.6.5
      │       │   │   │       │       │   │   ├── axum-server v0.8.0 (*)
      │       │   │   │       │       │   │   ├── infraternal v0.1.0 (*)
      │       │   │   │       │       │   │   ├── infraternal-agent v0.1.0 (*)
      │       │   │   │       │       │   │   ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   │   │       │       │   │   └── (dev) infraternal-server v0.1.0 (*)
      │       │   │   │       │       │   ├── webauthn-attestation-ca v0.5.5
      │       │   │   │       │       │   │   └── webauthn-rs-core v0.5.5 (*)
      │       │   │   │       │       │   └── webauthn-rs-core v0.5.5 (*)
      │       │   │   │       │       ├── tokio-openssl v0.6.5 (*)
      │       │   │   │       │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       │   │   │       │       └── webauthn-rs-core v0.5.5 (*)
      │       │   │   │       ├── (build) openssl-sys v0.9.117 (*)
      │       │   │   │       └── (build) ring v0.17.14 (*)
      │       │   │   ├── quinn-proto v0.11.19 (*)
      │       │   │   ├── rand v0.10.3
      │       │   │   │   └── quinn-proto v0.11.19 (*)
      │       │   │   └── uuid v1.27.0
      │       │   │       ├── infraternal v0.1.0 (*)
      │       │   │       ├── infraternal-agent v0.1.0 (*)
      │       │   │       ├── (dev) infraternal-plugin-api v0.1.0 (*)
      │       │   │       ├── infraternal-plugin-canvas v0.1.0 (*)
      │       │   │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       │   │       ├── infraternal-plugin-release v0.1.0 (*)
      │       │   │       ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │   │       ├── infraternal-server v0.1.0 (*)
      │       │   │       ├── (dev) infraternal-status v0.1.0 (*)
      │       │   │       ├── webauthn-attestation-ca v0.5.5 (*)
      │       │   │       ├── webauthn-rs v0.5.5 (*)
      │       │   │       └── webauthn-rs-core v0.5.5 (*)
      │       │   ├── web-sys v0.3.106
      │       │   │   └── plotters v0.3.7
      │       │   │       └── criterion v0.7.0 (*)
      │       │   └── web-time v1.1.0
      │       │       ├── quinn v0.11.12 (*)
      │       │       ├── quinn-proto v0.11.19 (*)
      │       │       └── rustls-pki-types v1.15.1
      │       │           ├── quinn-proto v0.11.19 (*)
      │       │           ├── rustls v0.23.46 (*)
      │       │           └── rustls-webpki v0.103.16 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── tokio-tungstenite v0.29.0 (*)
      │       ├── tower v0.5.3
      │       │   ├── axum v0.8.9 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       └── tower-http v0.6.11
      │           └── infraternal-server v0.1.0 (*)
      ├── serde_derive v1.0.229
      │   ├── serde v1.0.229
      │   │   ├── base64urlsafedata v0.5.5
      │   │   │   ├── webauthn-attestation-ca v0.5.5 (*)
      │   │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   │   └── webauthn-rs-proto v0.5.5 (*)
      │   │   ├── bip39 v2.2.2 (*)
      │   │   ├── ciborium v0.2.2
      │   │   │   └── criterion v0.7.0 (*)
      │   │   ├── criterion v0.7.0 (*)
      │   │   ├── either v1.18.0
      │   │   │   ├── axum-server v0.8.0 (*)
      │   │   │   ├── itertools v0.13.0
      │   │   │   │   ├── criterion v0.7.0 (*)
      │   │   │   │   └── criterion-plot v0.6.0
      │   │   │   │       └── criterion v0.7.0 (*)
      │   │   │   ├── rayon v1.12.0
      │   │   │   │   └── criterion v0.7.0 (*)
      │   │   │   ├── sqlx-core v0.8.6 (*)
      │   │   │   └── sqlx-macros-core v0.8.6 (*)
      │   │   ├── infraternal v0.1.0 (*)
      │   │   ├── infraternal-agent v0.1.0 (*)
      │   │   ├── infraternal-mesh v0.1.0 (*)
      │   │   ├── infraternal-plugin-api v0.1.0 (*)
      │   │   ├── infraternal-plugin-canvas v0.1.0 (*)
      │   │   ├── infraternal-plugin-host-facts v0.1.0 (*)
      │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │   ├── infraternal-plugin-release v0.1.0 (*)
      │   │   ├── infraternal-plugin-remote v0.1.0 (*)
      │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │   ├── infraternal-server v0.1.0 (*)
      │   │   ├── serde_cbor_2 v0.13.0
      │   │   │   ├── infraternal-server v0.1.0 (*)
      │   │   │   └── webauthn-rs-core v0.5.5 (*)
      │   │   ├── serde_urlencoded v0.7.1
      │   │   │   └── sqlx-sqlite v0.8.6 (*)
      │   │   ├── sqlx-core v0.8.6 (*)
      │   │   ├── sqlx-macros-core v0.8.6 (*)
      │   │   ├── sqlx-sqlite v0.8.6 (*)
      │   │   ├── tinytemplate v1.2.1
      │   │   │   └── criterion v0.7.0 (*)
      │   │   ├── tracing-serde v0.2.0
      │   │   │   └── tracing-subscriber v0.3.23
      │   │   │       └── infraternal-server v0.1.0 (*)
      │   │   ├── tracing-subscriber v0.3.23 (*)
      │   │   ├── url v2.5.8 (*)
      │   │   ├── webauthn-attestation-ca v0.5.5 (*)
      │   │   ├── webauthn-rs v0.5.5 (*)
      │   │   ├── webauthn-rs-core v0.5.5 (*)
      │   │   ├── webauthn-rs-proto v0.5.5 (*)
      │   │   └── zeroize v1.9.0
      │   │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │       ├── infraternal-plugin-remote v0.1.0 (*)
      │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │       ├── infraternal-server v0.1.0 (*)
      │   │       ├── rustls v0.23.46 (*)
      │   │       └── rustls-pki-types v1.15.1 (*)
      │   └── url v2.5.8 (*)
      ├── synstructure v0.14.0
      │   ├── yoke-derive v0.8.4
      │   │   └── yoke v0.8.3
      │   │       ├── icu_collections v2.3.0 (*)
      │   │       ├── icu_provider v2.3.1 (*)
      │   │       ├── zerotrie v0.2.5 (*)
      │   │       └── zerovec v0.11.8
      │   │           ├── icu_collections v2.3.0 (*)
      │   │           ├── icu_locale_core v2.3.0 (*)
      │   │           ├── icu_normalizer v2.3.0 (*)
      │   │           ├── icu_properties v2.3.0 (*)
      │   │           ├── icu_provider v2.3.1 (*)
      │   │           ├── potential_utf v0.1.6
      │   │           │   └── icu_collections v2.3.0 (*)
      │   │           └── tinystr v0.8.4 (*)
      │   └── zerofrom-derive v0.1.8
      │       └── zerofrom v0.1.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── yoke v0.8.3 (*)
      │           ├── zerotrie v0.2.5 (*)
      │           └── zerovec v0.11.8 (*)
      ├── thiserror-impl v2.0.21
      │   └── thiserror v2.0.21
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-mesh v0.1.0 (*)
      │       ├── infraternal-plugin-api v0.1.0 (*)
      │       ├── infraternal-server v0.1.0 (*)
      │       ├── quinn v0.11.12 (*)
      │       ├── quinn-proto v0.11.19 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-sqlite v0.8.6 (*)
      │       ├── sysctl v0.7.1
      │       │   └── infraternal-plugin-host-facts v0.1.0 (*)
      │       └── tungstenite v0.29.0 (*)
      ├── tokio-macros v2.7.2
      │   └── tokio v1.53.3
      │       ├── axum v0.8.9 (*)
      │       ├── axum-server v0.8.0 (*)
      │       ├── fs-err v3.3.2
      │       │   └── axum-server v0.8.0 (*)
      │       ├── h2 v0.4.19
      │       │   ├── hyper v1.11.1
      │       │   │   ├── axum v0.8.9 (*)
      │       │   │   ├── axum-server v0.8.0 (*)
      │       │   │   ├── hyper-util v0.1.21
      │       │   │   │   ├── axum v0.8.9 (*)
      │       │   │   │   ├── axum-server v0.8.0 (*)
      │       │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │   │   └── (dev) infraternal-server v0.1.0 (*)
      │       │   │   ├── infraternal v0.1.0 (*)
      │       │   │   └── (dev) infraternal-server v0.1.0 (*)
      │       │   └── (dev) infraternal-server v0.1.0 (*)
      │       ├── hyper v1.11.1 (*)
      │       ├── hyper-util v0.1.21 (*)
      │       ├── (dev) infraternal v0.1.0 (*)
      │       ├── (dev) infraternal-agent v0.1.0 (*)
      │       ├── infraternal-plugin-api v0.1.0 (*)
      │       ├── infraternal-plugin-canvas v0.1.0 (*)
      │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │       ├── infraternal-plugin-release v0.1.0 (*)
      │       ├── (dev) infraternal-plugin-remote v0.1.0 (*)
      │       ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │       ├── (dev) infraternal-server v0.1.0 (*)
      │       ├── infraternal-shim v0.1.0 (*)
      │       ├── quinn v0.11.12 (*)
      │       ├── sqlx-core v0.8.6 (*)
      │       ├── sqlx-macros-core v0.8.6 (*)
      │       ├── tokio-openssl v0.6.5 (*)
      │       ├── tokio-stream v0.1.19
      │       │   └── sqlx-core v0.8.6 (*)
      │       ├── tokio-tungstenite v0.29.0 (*)
      │       ├── tokio-util v0.7.19
      │       │   ├── h2 v0.4.19 (*)
      │       │   └── tower-http v0.6.11 (*)
      │       ├── tower v0.5.3 (*)
      │       └── tower-http v0.6.11 (*)
      ├── wasm-bindgen-macro-support v0.2.129
      │   └── wasm-bindgen-macro v0.2.129
      │       └── wasm-bindgen v0.2.129
      │           ├── getrandom v0.2.17 (*)
      │           ├── getrandom v0.4.3 (*)
      │           ├── js-sys v0.3.106 (*)
      │           ├── plotters v0.3.7 (*)
      │           ├── web-sys v0.3.106 (*)
      │           └── web-time v1.1.0 (*)
      ├── yoke-derive v0.8.4 (*)
      ├── zerofrom-derive v0.1.8 (*)
      └── zerovec-derive v0.11.6
          └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'synstructure'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:254:1
    │  
254 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index
255 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index
    │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ synstructure v0.13.2
      └── asn1-rs-derive v0.5.1
          └── asn1-rs v0.6.2
              ├── der-parser v9.0.0
              │   ├── webauthn-rs-core v0.5.5
              │   │   └── webauthn-rs v0.5.5
              │   │       └── infraternal-server v0.1.0
              │   │           ├── infraternal v0.1.0
              │   │           └── infraternal-fuzz v0.1.0
              │   └── x509-parser v0.16.0
              │       └── webauthn-rs-core v0.5.5 (*)
              ├── oid-registry v0.7.1
              │   └── x509-parser v0.16.0 (*)
              └── x509-parser v0.16.0 (*)
    ├ synstructure v0.14.0
      ├── yoke-derive v0.8.4
      │   └── yoke v0.8.3
      │       ├── icu_collections v2.3.0
      │       │   ├── icu_normalizer v2.3.0
      │       │   │   └── idna_adapter v1.2.2
      │       │   │       └── idna v1.1.0
      │       │   │           └── url v2.5.8
      │       │   │               ├── infraternal v0.1.0
      │       │   │               ├── infraternal-plugin-ssh v0.1.0
      │       │   │               │   ├── infraternal v0.1.0 (*)
      │       │   │               │   ├── infraternal-fuzz v0.1.0
      │       │   │               │   ├── infraternal-server v0.1.0
      │       │   │               │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   └── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   └── infraternal-session v0.1.0
      │       │   │               ├── infraternal-server v0.1.0 (*)
      │       │   │               ├── sqlx-core v0.8.6
      │       │   │               │   ├── sqlx v0.8.6
      │       │   │               │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   ├── infraternal-plugin-api v0.1.0
      │       │   │               │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-agent v0.1.0
      │       │   │               │   │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │   │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │   │               │   │   │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-mesh v0.1.0
      │       │   │               │   │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   │   │   └── infraternal-plugin-mesh v0.1.0
      │       │   │               │   │   │   │       ├── infraternal v0.1.0 (*)
      │       │   │               │   │   │   │       ├── infraternal-agent v0.1.0 (*)
      │       │   │               │   │   │   │       ├── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │   │   │       └── infraternal-server v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-backup v0.1.0
      │       │   │               │   │   │   │   └── infraternal v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-canvas v0.1.0
      │       │   │               │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │   │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-host-facts v0.1.0
      │       │   │               │   │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   │   │   ├── infraternal-agent v0.1.0 (*)
      │       │   │               │   │   │   │   └── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-relay v0.1.0
      │       │   │               │   │   │   │   └── infraternal v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-release v0.1.0
      │       │   │               │   │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   │   │   ├── infraternal-agent v0.1.0 (*)
      │       │   │               │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │   │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-remote v0.1.0
      │       │   │               │   │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │               │   │   │   │   ├── infraternal-agent v0.1.0 (*)
      │       │   │               │   │   │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │   │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │       │   │               │   │   │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   │   │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │   │               │   │   │   └── infraternal-server v0.1.0 (*)
      │       │   │               │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │       │   │               │   │   ├── infraternal-plugin-release v0.1.0 (*)
      │       │   │               │   │   ├── infraternal-server v0.1.0 (*)
      │       │   │               │   │   └── infraternal-shim v0.1.0
      │       │   │               │   │       ├── infraternal v0.1.0 (*)
      │       │   │               │   │       ├── infraternal-agent v0.1.0 (*)
      │       │   │               │   │       ├── infraternal-fuzz v0.1.0 (*)
      │       │   │               │   │       ├── infraternal-plugin-remote v0.1.0 (*)
      │       │   │               │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │       │   │               │   │       ├── infraternal-server v0.1.0 (*)
      │       │   │               │   │       ├── infraternal-session v0.1.0 (*)
      │       │   │               │   │       └── infraternal-status v0.1.0
      │       │   │               │   │           └── infraternal v0.1.0 (*)
      │       │   │               │   ├── sqlx-macros v0.8.6
      │       │   │               │   │   └── sqlx v0.8.6 (*)
      │       │   │               │   ├── sqlx-macros-core v0.8.6
      │       │   │               │   │   └── sqlx-macros v0.8.6 (*)
      │       │   │               │   └── sqlx-sqlite v0.8.6
      │       │   │               │       ├── sqlx v0.8.6 (*)
      │       │   │               │       └── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-macros-core v0.8.6 (*)
      │       │   │               ├── sqlx-sqlite v0.8.6 (*)
      │       │   │               ├── webauthn-rs v0.5.5
      │       │   │               │   └── infraternal-server v0.1.0 (*)
      │       │   │               ├── webauthn-rs-core v0.5.5
      │       │   │               │   └── webauthn-rs v0.5.5 (*)
      │       │   │               └── webauthn-rs-proto v0.5.5
      │       │   │                   └── webauthn-rs-core v0.5.5 (*)
      │       │   └── icu_properties v2.3.0
      │       │       └── idna_adapter v1.2.2 (*)
      │       ├── icu_provider v2.3.1
      │       │   ├── icu_normalizer v2.3.0 (*)
      │       │   └── icu_properties v2.3.0 (*)
      │       ├── zerotrie v0.2.5
      │       │   ├── icu_properties v2.3.0 (*)
      │       │   └── icu_provider v2.3.1 (*)
      │       └── zerovec v0.11.8
      │           ├── icu_collections v2.3.0 (*)
      │           ├── icu_locale_core v2.3.0
      │           │   ├── icu_properties v2.3.0 (*)
      │           │   └── icu_provider v2.3.1 (*)
      │           ├── icu_normalizer v2.3.0 (*)
      │           ├── icu_properties v2.3.0 (*)
      │           ├── icu_provider v2.3.1 (*)
      │           ├── potential_utf v0.1.6
      │           │   └── icu_collections v2.3.0 (*)
      │           └── tinystr v0.8.4
      │               └── icu_locale_core v2.3.0 (*)
      └── zerofrom-derive v0.1.8
          └── zerofrom v0.1.8
              ├── icu_collections v2.3.0 (*)
              ├── icu_provider v2.3.1 (*)
              ├── yoke v0.8.3 (*)
              ├── zerotrie v0.2.5 (*)
              └── zerovec v0.11.8 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:257:1
    │  
257 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index
258 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror v1.0.69
      ├── asn1-rs v0.6.2
      │   ├── der-parser v9.0.0
      │   │   ├── webauthn-rs-core v0.5.5
      │   │   │   └── webauthn-rs v0.5.5
      │   │   │       └── infraternal-server v0.1.0
      │   │   │           ├── infraternal v0.1.0
      │   │   │           └── infraternal-fuzz v0.1.0
      │   │   └── x509-parser v0.16.0
      │   │       └── webauthn-rs-core v0.5.5 (*)
      │   ├── oid-registry v0.7.1
      │   │   └── x509-parser v0.16.0 (*)
      │   └── x509-parser v0.16.0 (*)
      ├── webauthn-rs-core v0.5.5 (*)
      └── x509-parser v0.16.0 (*)
    ├ thiserror v2.0.21
      ├── infraternal v0.1.0
      ├── infraternal-mesh v0.1.0
      │   ├── infraternal v0.1.0 (*)
      │   └── infraternal-plugin-mesh v0.1.0
      │       ├── infraternal v0.1.0 (*)
      │       ├── infraternal-agent v0.1.0
      │       │   ├── infraternal v0.1.0 (*)
      │       │   ├── infraternal-fuzz v0.1.0
      │       │   ├── infraternal-plugin-ssh v0.1.0
      │       │   │   ├── infraternal v0.1.0 (*)
      │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │       │   │   ├── infraternal-server v0.1.0
      │       │   │   │   ├── infraternal v0.1.0 (*)
      │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
      │       │   │   └── infraternal-session v0.1.0
      │       │   └── infraternal-server v0.1.0 (*)
      │       ├── infraternal-fuzz v0.1.0 (*)
      │       └── infraternal-server v0.1.0 (*)
      ├── infraternal-plugin-api v0.1.0
      │   ├── infraternal v0.1.0 (*)
      │   ├── infraternal-agent v0.1.0 (*)
      │   ├── infraternal-fuzz v0.1.0 (*)
      │   ├── infraternal-mesh v0.1.0 (*)
      │   ├── infraternal-plugin-backup v0.1.0
      │   │   └── infraternal v0.1.0 (*)
      │   ├── infraternal-plugin-canvas v0.1.0
      │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── infraternal-plugin-host-facts v0.1.0
      │   │   ├── infraternal v0.1.0 (*)
      │   │   ├── infraternal-agent v0.1.0 (*)
      │   │   └── infraternal-fuzz v0.1.0 (*)
      │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   ├── infraternal-plugin-relay v0.1.0
      │   │   └── infraternal v0.1.0 (*)
      │   ├── infraternal-plugin-release v0.1.0
      │   │   ├── infraternal v0.1.0 (*)
      │   │   ├── infraternal-agent v0.1.0 (*)
      │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── infraternal-plugin-remote v0.1.0
      │   │   ├── infraternal v0.1.0 (*)
      │   │   ├── infraternal-agent v0.1.0 (*)
      │   │   ├── infraternal-fuzz v0.1.0 (*)
      │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │   │   └── infraternal-server v0.1.0 (*)
      │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │   └── infraternal-server v0.1.0 (*)
      ├── infraternal-server v0.1.0 (*)
      ├── quinn v0.11.12
      │   ├── infraternal-agent v0.1.0 (*)
      │   ├── infraternal-plugin-remote v0.1.0 (*)
      │   └── infraternal-server v0.1.0 (*)
      ├── quinn-proto v0.11.19
      │   └── quinn v0.11.12 (*)
      ├── sqlx-core v0.8.6
      │   ├── sqlx v0.8.6
      │   │   ├── infraternal v0.1.0 (*)
      │   │   ├── infraternal-plugin-api v0.1.0 (*)
      │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │   │   ├── infraternal-plugin-release v0.1.0 (*)
      │   │   ├── infraternal-server v0.1.0 (*)
      │   │   └── infraternal-shim v0.1.0
      │   │       ├── infraternal v0.1.0 (*)
      │   │       ├── infraternal-agent v0.1.0 (*)
      │   │       ├── infraternal-fuzz v0.1.0 (*)
      │   │       ├── infraternal-plugin-remote v0.1.0 (*)
      │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
      │   │       ├── infraternal-server v0.1.0 (*)
      │   │       ├── infraternal-session v0.1.0 (*)
      │   │       └── infraternal-status v0.1.0
      │   │           └── infraternal v0.1.0 (*)
      │   ├── sqlx-macros v0.8.6
      │   │   └── sqlx v0.8.6 (*)
      │   ├── sqlx-macros-core v0.8.6
      │   │   └── sqlx-macros v0.8.6 (*)
      │   └── sqlx-sqlite v0.8.6
      │       ├── sqlx v0.8.6 (*)
      │       └── sqlx-macros-core v0.8.6 (*)
      ├── sqlx-sqlite v0.8.6 (*)
      ├── sysctl v0.7.1
      │   └── infraternal-plugin-host-facts v0.1.0 (*)
      └── tungstenite v0.29.0
          └── tokio-tungstenite v0.29.0
              ├── axum v0.8.9
              │   ├── infraternal-fuzz v0.1.0 (*)
              │   └── infraternal-server v0.1.0 (*)
              └── (dev) infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:259:1
    │  
259 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index
260 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index
    │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ thiserror-impl v1.0.69
      └── thiserror v1.0.69
          ├── asn1-rs v0.6.2
          │   ├── der-parser v9.0.0
          │   │   ├── webauthn-rs-core v0.5.5
          │   │   │   └── webauthn-rs v0.5.5
          │   │   │       └── infraternal-server v0.1.0
          │   │   │           ├── infraternal v0.1.0
          │   │   │           └── infraternal-fuzz v0.1.0
          │   │   └── x509-parser v0.16.0
          │   │       └── webauthn-rs-core v0.5.5 (*)
          │   ├── oid-registry v0.7.1
          │   │   └── x509-parser v0.16.0 (*)
          │   └── x509-parser v0.16.0 (*)
          ├── webauthn-rs-core v0.5.5 (*)
          └── x509-parser v0.16.0 (*)
    ├ thiserror-impl v2.0.21
      └── thiserror v2.0.21
          ├── infraternal v0.1.0
          ├── infraternal-mesh v0.1.0
          │   ├── infraternal v0.1.0 (*)
          │   └── infraternal-plugin-mesh v0.1.0
          │       ├── infraternal v0.1.0 (*)
          │       ├── infraternal-agent v0.1.0
          │       │   ├── infraternal v0.1.0 (*)
          │       │   ├── infraternal-fuzz v0.1.0
          │       │   ├── infraternal-plugin-ssh v0.1.0
          │       │   │   ├── infraternal v0.1.0 (*)
          │       │   │   ├── infraternal-fuzz v0.1.0 (*)
          │       │   │   ├── infraternal-server v0.1.0
          │       │   │   │   ├── infraternal v0.1.0 (*)
          │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
          │       │   │   └── infraternal-session v0.1.0
          │       │   └── infraternal-server v0.1.0 (*)
          │       ├── infraternal-fuzz v0.1.0 (*)
          │       └── infraternal-server v0.1.0 (*)
          ├── infraternal-plugin-api v0.1.0
          │   ├── infraternal v0.1.0 (*)
          │   ├── infraternal-agent v0.1.0 (*)
          │   ├── infraternal-fuzz v0.1.0 (*)
          │   ├── infraternal-mesh v0.1.0 (*)
          │   ├── infraternal-plugin-backup v0.1.0
          │   │   └── infraternal v0.1.0 (*)
          │   ├── infraternal-plugin-canvas v0.1.0
          │   │   ├── infraternal-fuzz v0.1.0 (*)
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── infraternal-plugin-host-facts v0.1.0
          │   │   ├── infraternal v0.1.0 (*)
          │   │   ├── infraternal-agent v0.1.0 (*)
          │   │   └── infraternal-fuzz v0.1.0 (*)
          │   ├── infraternal-plugin-mesh v0.1.0 (*)
          │   ├── infraternal-plugin-relay v0.1.0
          │   │   └── infraternal v0.1.0 (*)
          │   ├── infraternal-plugin-release v0.1.0
          │   │   ├── infraternal v0.1.0 (*)
          │   │   ├── infraternal-agent v0.1.0 (*)
          │   │   ├── infraternal-fuzz v0.1.0 (*)
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── infraternal-plugin-remote v0.1.0
          │   │   ├── infraternal v0.1.0 (*)
          │   │   ├── infraternal-agent v0.1.0 (*)
          │   │   ├── infraternal-fuzz v0.1.0 (*)
          │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── infraternal-plugin-ssh v0.1.0 (*)
          │   └── infraternal-server v0.1.0 (*)
          ├── infraternal-server v0.1.0 (*)
          ├── quinn v0.11.12
          │   ├── infraternal-agent v0.1.0 (*)
          │   ├── infraternal-plugin-remote v0.1.0 (*)
          │   └── infraternal-server v0.1.0 (*)
          ├── quinn-proto v0.11.19
          │   └── quinn v0.11.12 (*)
          ├── sqlx-core v0.8.6
          │   ├── sqlx v0.8.6
          │   │   ├── infraternal v0.1.0 (*)
          │   │   ├── infraternal-plugin-api v0.1.0 (*)
          │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
          │   │   ├── infraternal-plugin-release v0.1.0 (*)
          │   │   ├── infraternal-server v0.1.0 (*)
          │   │   └── infraternal-shim v0.1.0
          │   │       ├── infraternal v0.1.0 (*)
          │   │       ├── infraternal-agent v0.1.0 (*)
          │   │       ├── infraternal-fuzz v0.1.0 (*)
          │   │       ├── infraternal-plugin-remote v0.1.0 (*)
          │   │       ├── infraternal-plugin-ssh v0.1.0 (*)
          │   │       ├── infraternal-server v0.1.0 (*)
          │   │       ├── infraternal-session v0.1.0 (*)
          │   │       └── infraternal-status v0.1.0
          │   │           └── infraternal v0.1.0 (*)
          │   ├── sqlx-macros v0.8.6
          │   │   └── sqlx v0.8.6 (*)
          │   ├── sqlx-macros-core v0.8.6
          │   │   └── sqlx-macros v0.8.6 (*)
          │   └── sqlx-sqlite v0.8.6
          │       ├── sqlx v0.8.6 (*)
          │       └── sqlx-macros-core v0.8.6 (*)
          ├── sqlx-sqlite v0.8.6 (*)
          ├── sysctl v0.7.1
          │   └── infraternal-plugin-host-facts v0.1.0 (*)
          └── tungstenite v0.29.0
              └── tokio-tungstenite v0.29.0
                  ├── axum v0.8.9
                  │   ├── infraternal-fuzz v0.1.0 (*)
                  │   └── infraternal-server v0.1.0 (*)
                  └── (dev) infraternal-server v0.1.0 (*)

warning[duplicate]: found 2 duplicate entries for crate 'windows-sys'
    ┌─ /home/claude/worktrees/j12b/Cargo.lock:317:1
    │  
317 │ ╭ windows-sys 0.52.0 registry+https://github.com/rust-lang/crates.io-index
318 │ │ windows-sys 0.61.2 registry+https://github.com/rust-lang/crates.io-index
    │ ╰────────────────────────────────────────────────────────────────────────┘ lock entries
    │  
    ├ windows-sys v0.52.0
      └── ring v0.17.14
          ├── infraternal-plugin-remote v0.1.0
          │   ├── infraternal v0.1.0
          │   ├── infraternal-agent v0.1.0
          │   │   ├── infraternal v0.1.0 (*)
          │   │   ├── infraternal-fuzz v0.1.0
          │   │   ├── infraternal-plugin-ssh v0.1.0
          │   │   │   ├── infraternal v0.1.0 (*)
          │   │   │   ├── infraternal-fuzz v0.1.0 (*)
          │   │   │   ├── infraternal-server v0.1.0
          │   │   │   │   ├── infraternal v0.1.0 (*)
          │   │   │   │   └── infraternal-fuzz v0.1.0 (*)
          │   │   │   └── infraternal-session v0.1.0
          │   │   └── infraternal-server v0.1.0 (*)
          │   ├── infraternal-fuzz v0.1.0 (*)
          │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
          │   └── infraternal-server v0.1.0 (*)
          ├── quinn-proto v0.11.19
          │   └── quinn v0.11.12
          │       ├── infraternal-agent v0.1.0 (*)
          │       ├── infraternal-plugin-remote v0.1.0 (*)
          │       └── infraternal-server v0.1.0 (*)
          ├── rustls v0.23.46
          │   ├── infraternal-plugin-remote v0.1.0 (*)
          │   ├── quinn v0.11.12 (*)
          │   └── quinn-proto v0.11.19 (*)
          └── rustls-webpki v0.103.16
              └── rustls v0.23.46 (*)
    ├ windows-sys v0.61.2
      ├── anstyle-query v1.1.5
      │   └── anstream v1.0.0
      │       └── clap_builder v4.6.7
      │           └── clap v4.6.7
      │               ├── criterion v0.7.0
      │               │   └── (dev) infraternal-protocol v0.1.0
      │               │       ├── infraternal-agent v0.1.0
      │               │       │   ├── infraternal v0.1.0
      │               │       │   ├── infraternal-fuzz v0.1.0
      │               │       │   ├── infraternal-plugin-ssh v0.1.0
      │               │       │   │   ├── infraternal v0.1.0 (*)
      │               │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │               │       │   │   ├── infraternal-server v0.1.0
      │               │       │   │   │   ├── infraternal v0.1.0 (*)
      │               │       │   │   │   └── infraternal-fuzz v0.1.0 (*)
      │               │       │   │   └── infraternal-session v0.1.0
      │               │       │   └── infraternal-server v0.1.0 (*)
      │               │       ├── infraternal-fuzz v0.1.0 (*)
      │               │       ├── infraternal-plugin-api v0.1.0
      │               │       │   ├── infraternal v0.1.0 (*)
      │               │       │   ├── infraternal-agent v0.1.0 (*)
      │               │       │   ├── infraternal-fuzz v0.1.0 (*)
      │               │       │   ├── infraternal-mesh v0.1.0
      │               │       │   │   ├── infraternal v0.1.0 (*)
      │               │       │   │   └── infraternal-plugin-mesh v0.1.0
      │               │       │   │       ├── infraternal v0.1.0 (*)
      │               │       │   │       ├── infraternal-agent v0.1.0 (*)
      │               │       │   │       ├── infraternal-fuzz v0.1.0 (*)
      │               │       │   │       └── infraternal-server v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-backup v0.1.0
      │               │       │   │   └── infraternal v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-canvas v0.1.0
      │               │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │               │       │   │   └── infraternal-server v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-host-facts v0.1.0
      │               │       │   │   ├── infraternal v0.1.0 (*)
      │               │       │   │   ├── infraternal-agent v0.1.0 (*)
      │               │       │   │   └── infraternal-fuzz v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-relay v0.1.0
      │               │       │   │   └── infraternal v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-release v0.1.0
      │               │       │   │   ├── infraternal v0.1.0 (*)
      │               │       │   │   ├── infraternal-agent v0.1.0 (*)
      │               │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │               │       │   │   └── infraternal-server v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-remote v0.1.0
      │               │       │   │   ├── infraternal v0.1.0 (*)
      │               │       │   │   ├── infraternal-agent v0.1.0 (*)
      │               │       │   │   ├── infraternal-fuzz v0.1.0 (*)
      │               │       │   │   ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │               │       │   │   └── infraternal-server v0.1.0 (*)
      │               │       │   ├── infraternal-plugin-ssh v0.1.0 (*)
      │               │       │   └── infraternal-server v0.1.0 (*)
      │               │       ├── infraternal-plugin-canvas v0.1.0 (*)
      │               │       ├── (dev) infraternal-plugin-host-facts v0.1.0 (*)
      │               │       ├── infraternal-plugin-mesh v0.1.0 (*)
      │               │       ├── infraternal-plugin-release v0.1.0 (*)
      │               │       ├── infraternal-plugin-remote v0.1.0 (*)
      │               │       └── infraternal-server v0.1.0 (*)
      │               ├── infraternal v0.1.0 (*)
      │               └── infraternal-shim v0.1.0
      │                   ├── infraternal v0.1.0 (*)
      │                   ├── infraternal-agent v0.1.0 (*)
      │                   ├── infraternal-fuzz v0.1.0 (*)
      │                   ├── infraternal-plugin-remote v0.1.0 (*)
      │                   ├── infraternal-plugin-ssh v0.1.0 (*)
      │                   ├── infraternal-server v0.1.0 (*)
      │                   ├── infraternal-session v0.1.0 (*)
      │                   └── infraternal-status v0.1.0
      │                       └── infraternal v0.1.0 (*)
      ├── anstyle-wincon v3.0.11
      │   └── anstream v1.0.0 (*)
      ├── errno v0.3.14
      │   └── signal-hook-registry v1.4.8
      │       └── tokio v1.53.3
      │           ├── axum v0.8.9
      │           │   ├── infraternal-fuzz v0.1.0 (*)
      │           │   └── infraternal-server v0.1.0 (*)
      │           ├── axum-server v0.8.0
      │           │   └── infraternal-server v0.1.0 (*)
      │           ├── fs-err v3.3.2
      │           │   └── axum-server v0.8.0 (*)
      │           ├── h2 v0.4.19
      │           │   ├── hyper v1.11.1
      │           │   │   ├── axum v0.8.9 (*)
      │           │   │   ├── axum-server v0.8.0 (*)
      │           │   │   ├── hyper-util v0.1.21
      │           │   │   │   ├── axum v0.8.9 (*)
      │           │   │   │   ├── axum-server v0.8.0 (*)
      │           │   │   │   ├── infraternal v0.1.0 (*)
      │           │   │   │   └── (dev) infraternal-server v0.1.0 (*)
      │           │   │   ├── infraternal v0.1.0 (*)
      │           │   │   └── (dev) infraternal-server v0.1.0 (*)
      │           │   └── (dev) infraternal-server v0.1.0 (*)
      │           ├── hyper v1.11.1 (*)
      │           ├── hyper-util v0.1.21 (*)
      │           ├── (dev) infraternal v0.1.0 (*)
      │           ├── (dev) infraternal-agent v0.1.0 (*)
      │           ├── infraternal-plugin-api v0.1.0 (*)
      │           ├── infraternal-plugin-canvas v0.1.0 (*)
      │           ├── infraternal-plugin-mesh v0.1.0 (*)
      │           ├── infraternal-plugin-release v0.1.0 (*)
      │           ├── (dev) infraternal-plugin-remote v0.1.0 (*)
      │           ├── (dev) infraternal-plugin-ssh v0.1.0 (*)
      │           ├── (dev) infraternal-server v0.1.0 (*)
      │           ├── infraternal-shim v0.1.0 (*)
      │           ├── quinn v0.11.12
      │           │   ├── infraternal-agent v0.1.0 (*)
      │           │   ├── infraternal-plugin-remote v0.1.0 (*)
      │           │   └── infraternal-server v0.1.0 (*)
      │           ├── sqlx-core v0.8.6
      │           │   ├── sqlx v0.8.6
      │           │   │   ├── infraternal v0.1.0 (*)
      │           │   │   ├── infraternal-plugin-api v0.1.0 (*)
      │           │   │   ├── infraternal-plugin-mesh v0.1.0 (*)
      │           │   │   ├── infraternal-plugin-release v0.1.0 (*)
      │           │   │   ├── infraternal-server v0.1.0 (*)
      │           │   │   └── infraternal-shim v0.1.0 (*)
      │           │   ├── sqlx-macros v0.8.6
      │           │   │   └── sqlx v0.8.6 (*)
      │           │   ├── sqlx-macros-core v0.8.6
      │           │   │   └── sqlx-macros v0.8.6 (*)
      │           │   └── sqlx-sqlite v0.8.6
      │           │       ├── sqlx v0.8.6 (*)
      │           │       └── sqlx-macros-core v0.8.6 (*)
      │           ├── sqlx-macros-core v0.8.6 (*)
      │           ├── tokio-openssl v0.6.5
      │           │   ├── axum-server v0.8.0 (*)
      │           │   ├── infraternal v0.1.0 (*)
      │           │   ├── infraternal-agent v0.1.0 (*)
      │           │   ├── infraternal-plugin-remote v0.1.0 (*)
      │           │   └── (dev) infraternal-server v0.1.0 (*)
      │           ├── tokio-stream v0.1.19
      │           │   └── sqlx-core v0.8.6 (*)
      │           ├── tokio-tungstenite v0.29.0
      │           │   ├── axum v0.8.9 (*)
      │           │   └── (dev) infraternal-server v0.1.0 (*)
      │           ├── tokio-util v0.7.19
      │           │   ├── h2 v0.4.19 (*)
      │           │   └── tower-http v0.6.11
      │           │       └── infraternal-server v0.1.0 (*)
      │           ├── tower v0.5.3
      │           │   ├── axum v0.8.9 (*)
      │           │   └── (dev) infraternal-server v0.1.0 (*)
      │           └── tower-http v0.6.11 (*)
      ├── mio v1.2.4
      │   └── tokio v1.53.3 (*)
      ├── nu-ansi-term v0.50.3
      │   └── tracing-subscriber v0.3.23
      │       └── infraternal-server v0.1.0 (*)
      ├── quinn-udp v0.5.16
      │   └── quinn v0.11.12 (*)
      ├── socket2 v0.6.5
      │   ├── quinn v0.11.12 (*)
      │   ├── quinn-udp v0.5.16 (*)
      │   └── tokio v1.53.3 (*)
      ├── tokio v1.53.3 (*)
      └── winapi-util v0.1.11
          ├── same-file v1.0.6
          │   └── walkdir v2.5.0
          │       ├── criterion v0.7.0 (*)
          │       └── sysctl v0.7.1
          │           └── infraternal-plugin-host-facts v0.1.0 (*)
          └── walkdir v2.5.0 (*)

advisories ok, bans ok, licenses ok, sources ok
(cargo-deny: 2s)

==> gate architecture
x86_64 final: native tests run; static dispatch PASS
x86_64 iterate: native tests run; static dispatch PASS
aarch64 final: native tests run; static dispatch PASS
aarch64 iterate: native tests run; static dispatch PASS
x86_64: native CLI/key-memory execution; foreign runtime skips PASS
aarch64: native CLI/key-memory execution; foreign runtime skips PASS
static build failure: rejected before artifact reporting PASS
(gate architecture: 0s)

==> static builds
x86_64-unknown-linux-musl: exact define removed; build directories remapped; explicit paths preserved; target override refused
aarch64-unknown-linux-musl: exact define removed; build directories remapped; explicit paths preserved; target override refused
x86_64 OpenSSL source: AVX-512 GCM dispatch removed idempotently
native compiler metadata: path independent; platform/date retained; unexpected syntax refused
Rust remapping: differently named checkout roots produce identical stripped artifacts
.
----------------------------------------------------------------------
Ran 1 test in 0.002s

OK
    Finished `release` profile [optimized] target(s) in 0.34s
AES-128-GCM NIST vector encrypt/decrypt passed
production trust: PASS (staging-trust authority absent)
/home/claude/worktrees/j12b/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
PT_INTERP: absent; size: 22534600 bytes; baseline 21443824; delta +1090776 bytes (report only, D243 amended 2026-11-01)
key memory: x86_64-unknown-linux-musl; memlock=8388608 bytes
Key memory initialization=1; locked pages and dump exclusion enabled
    Finished `release` profile [optimized] target(s) in 0.54s
production trust: PASS (staging-trust authority absent)
/home/claude/worktrees/j12b/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped
PT_INTERP: absent; size: 20589768 bytes; baseline 19629240; delta +960528 bytes (report only, D243 amended 2026-11-01)
SKIP key memory: aarch64-unknown-linux-musl (host x86_64; native execution required)
x86_64-unknown-linux-musl: +102400 bytes accepted with delta; zero/negative deltas reported; missing/wrong/dynamic/PT_INTERP/inspection defects rejected PASS
aarch64-unknown-linux-musl: +102400 bytes accepted with delta; zero/negative deltas reported; missing/wrong/dynamic/PT_INTERP/inspection defects rejected PASS
unsupported target: rejected PASS
bun test v1.4.2 (744846f84)

scripts/release/static-metadata-review.test.ts:
(pass) x86_64-unknown-linux-musl compiler metadata is independent of the checkout location [54.67ms]
(pass) aarch64-unknown-linux-musl compiler metadata is independent of the checkout location [47.15ms]

 2 pass
 0 fail
 14 expect() calls
Ran 2 tests across 1 file. [432.00ms]
server subcommand: exit 2, versioned JSON unavailable result
agent group: exit 0, one parsed versioned JSON listing of its commands
(static builds: 7s)

+---------------------------+--------------+
| Rust gate                 | Result       |
+---------------------------+--------------+
| fmt                       | PASS         |
| VT native fmt             | PASS         |
| CLI plugin compile-out    | PASS         |
| clippy                    | PASS         |
| SSH runtime test helper   | PASS         |
| real-binary fixture paths | PASS         |
| test                      | PASS         |
| SSH inode reuse fixture   | PASS         |
| shim process-per-user     | PASS         |
| cargo-deny                | PASS         |
| gate architecture         | PASS         |
| static builds             | PASS         |
+---------------------------+--------------+

==> Compiler metadata generator checks
bun test v1.4.2 (744846f84)

scripts/release/build-metadata.test.ts:
(pass) native metadata canonicalization retains version fields and refuses changed syntax [169.91ms]
(pass) Rust and cached target compiles receive every environment remap [1235.55ms]

 2 pass
 0 fail
 121 expect() calls
Ran 2 tests across 1 file. [1.93s]

==> Vendored Ghostty artifact checksums
dist/ghostty-web.js: OK
dist/ghostty-vt.wasm: OK
dist/index.d.ts: OK

==> TypeScript protocol compiler
Saved lockfile

==> Tracer compiler, precompression and bundle transfer budget
bun install v1.4.2 (744846f84)

+ @types/bun@1.3.8
+ @types/node@22.19.0
+ @types/ws@8.5.10
+ playwright@1.61.1
+ typescript@5.9.3
+ ws@8.18.3
+ @scure/bip39@2.2.0
+ geist@1.7.2

38 packages installed [522.00ms]
$ bun x tsc --project tsconfig.json
bun test v1.4.2 (744846f84)

precompress.test.ts:
(pass) text sidecars round-trip deterministically; compressed formats remain identity [25.21ms]

browser-build.test.ts:
(pass) the browser renderer has no unresolved Vite Node-file shim request [33.97ms]
(pass) layout review fixtures ship only in explicitly enabled preview builds [7625.67ms]

src/perf-detector.test.ts:
(pass) FrameDetector > estimates the refresh from the median and snaps it [0.66ms]
(pass) FrameDetector > nothing is a drop before the rate is known [0.05ms]
(pass) FrameDetector > a drop is over 1.5 refresh intervals, a freeze over 100 ms [0.12ms]
(pass) FrameDetector > the refresh only goes up: a slow page is not a slower display [0.19ms]
(pass) FrameDetector > the first frame after a pause is not an interval [0.11ms]
(pass) FrameDetector > fps, p95 and window read the ring [0.30ms]
(pass) FrameDetector > a throttled page (one frame a second) is neither a drop nor a freeze, and neither is its return [0.38ms]
(pass) FrameDetector > a lone long stall is still a freeze and is not a throttled run [0.06ms]

src/stale-screen.test.ts:
(pass) a program that redraws after reattach never shows the note, not for a frame [0.31ms]
(pass) a redraw that arrived before the replay painted needs no wait at all [0.04ms]
(pass) a shell that stays silent shows the note once the wait has run out [0.06ms]
(pass) output that arrives later clears the note [0.03ms]
(pass) an idle shell reattached at the same size is correctly silent and never shows the note [0.03ms]
(pass) a shell that stays silent after the attach resized it shows the note [0.03ms]
(pass) a resized program that repaints never shows the note, not for a frame [0.03ms]
(pass) one changed dimension is a resize [0.03ms]
(pass) output after the note, on a resized reattach, clears it [0.03ms]
(pass) a server that reports no size keeps the wait [0.03ms]
(pass) the replay fence reports a size only when both fields are usable [0.18ms]
(pass) a dropped link takes the note down and cancels a wait that has not ended [0.04ms]
(pass) the wait grows with the round trip and stays bounded [0.09ms]

src/synchronized-output.test.ts:
(pass) synchronized terminal output > recognizes a private mode split across byte and string writes [0.75ms]
(pass) synchronized terminal output > preserves mode transitions for every pair of input chunk boundaries [2.08ms]
(pass) synchronized terminal output > ignores CSI-looking bytes inside control strings and other mode numbers [0.13ms]
(pass) synchronized terminal output > RIS clears an active mode [0.13ms]
(pass) synchronized terminal output > bounds an unfinished control sequence [0.35ms]
(pass) synchronized terminal output > paints queued output on the first frame after reset and timeout release [0.65ms]

src/terminal-fit-lifecycle.test.ts:
(pass) a queued fit stops when the terminal becomes closed [0.58ms]
(pass) a queued fit stops when the terminal becomes suspended [0.04ms]
(pass) a queued fit stops when the terminal becomes frozen [0.04ms]

src/account-storage.test.ts:
(pass) clearing one account leaves a second account and device preferences alone [1.16ms]
(pass) the last-account pointer of another account stays [0.08ms]
(pass) an unknown account clears every account's data and keeps preferences [0.17ms]
(pass) account notifications cannot write before or after disposal [0.30ms]
(pass) legacy generation sweep is account scoped and reports refused erasure [0.39ms]
(pass) R2: 21 legacy generations survive refused cleanup and disappear only after a successful retry [0.67ms]

src/hints.test.ts:
(pass) sign-ins 1 to 5 show a hint once each; the sixth never does [0.51ms]
(pass) a reload inside a sign-in does not show the hint again, and different hints are independent and accounts share anonymous device counters [0.06ms]
(pass) an account without a counter is in its first sign-in [0.09ms]
(pass) storage that throws or holds junk shows nothing and never throws [0.32ms]

test/layout-coalescing-review.test.ts:
(pass) distinct view and column identifiers cannot supersede each other's unsent weights [5.44ms]

test/layout-identity-review.test.ts:
(pass) sign-in and layout-close hints cannot retain the account identifier after sign-out [0.56ms]

real/attachment-bookkeeping.test.ts:
(pass) server-restored streams count without a new client AttachTerm and deduplicate both paths [0.48ms]
(pass) control, malformed and unrelated events cannot invent a real attachment [0.16ms]

real/restart-namespace.test.ts:
(pass) only an explicit private tmpfs runtime qualifies [0.43ms]

src/offline-drawing.test.ts:
(pass) warming the shell never accesses private browser storage [0.16ms]

src/session-notifications.test.ts:
(pass) notifications validate account/lifetime messages and dispose callbacks [0.65ms]
(pass) missing or failed notification channels do not prevent confirmed local teardown [0.28ms]

src/sign-out.test.ts:
(pass) a late successful logout cannot forget or announce revocation for a newer signed-in screen [1.10ms]
(pass) a late failed logout does not thaw the replacement screen [0.39ms]
(pass) new screen logout has its own request and old completion cannot clear its deduplication [0.56ms]
(pass) default lifetime still deduplicates one failed logout and restores its screen [0.31ms]

src/canvas/recency.test.ts:
(pass) touch moves an item to the front and never duplicates it [0.37ms]
(pass) repeating the front item changes nothing [0.09ms]
(pass) the list is capped, so the oldest items fall off [0.14ms]
(pass) top skips items that are no longer live, without losing them [0.09ms]
(pass) recentRows: five used windows in reverse order of use, from 54 windows [0.37ms]
(pass) recentRows: a view with three windows and no use shows them in order [0.07ms]
(pass) recentRows: used windows lead, the rest fill up to five in window order [0.13ms]

src/canvas/status.test.ts:
(pass) a lost server connection is an error toast, never a success tick [0.71ms]
(pass) routine connection states stay out of the toast [0.11ms]
(pass) repeated connection closes do not reopen the persistent reason toast [0.19ms]
(pass) a repeated close does not retake the shared toast after a newer message replaces it [0.28ms]
(pass) a close reason stays visible through a quick reconnect and clears after a stable attach [676.09ms]

src/canvas/toolbar/palette-actions.test.ts:
(pass) a deferred split:right selection retains its original window [0.48ms]
(pass) a deferred new:below selection retains its original window [0.06ms]
(pass) a deferred close selection retains its original window [0.04ms]

src/canvas/windows/details-facts.test.ts:
(pass) host facts become plain-language details rows [1.20ms]
(pass) unknown optional host facts stay absent instead of appearing as placeholders [0.27ms]
(pass) by default the machine tab shows the D126 facts under System, Resources and Access, with no More section [0.41ms]
(pass) extended info adds only init, virtualization, how it is reached, shell and locale [0.27ms]
(pass) facts the host did not report are omitted by default, not shown as unknown [0.20ms]
(pass) the header follows the machine's own facts, not the platform the host list guessed [0.17ms]
(pass) before facts arrive the host's platform names the header [0.07ms]
(pass) a reported system with no platform mark still names the header and shows no mark [0.07ms]

src/canvas/windows/session-hooks.test.ts:
(pass) a failed idle warm-up shows no toast and retries when the browser is back online [11.08ms]
(pass) a failed open shows the toast, and opening again after the network returns succeeds [10.77ms]
(pass) an open that joins a failing idle warm-up still shows the toast [5.31ms]

src/canvas/windows/link.test.ts:
(pass) a healthy attached window is connected and live [0.26ms]
(pass) the first attach is connecting; a lost link after that is reconnecting, with the keys kept meanwhile [0.07ms]
(pass) a window with no binding yet is live (nothing is known to be wrong) [0.03ms]
(pass) coming back is a moment: resumed for 1.8 s, a rebuilt screen for 3.2 s, then connected again [0.12ms]
(pass) an ended session and a refused shell are offline, each in its own words, and win over the link [0.07ms]

src/canvas/mesh/api-retry-budget.test.ts:
(pass) a retained watch outage bounds retry requests over two logical minutes [2.56ms]

src/canvas/mesh/layout-model.test.ts:
(pass) a pin moved by another device invalidates a same-count pin cache [1.51ms]
(pass) a recovered graph owns its node positions independently [0.18ms]
(pass) a negative pin is drawn by shifting the whole graph by whole grid cells; no pin is rewritten [0.16ms]
(pass) with no negative pin the origin is zero and nothing shifts [0.08ms]

src/canvas/mesh/protocol.test.ts:
(pass) the server's own list becomes nodes, tags and grants, by name [0.84ms]
(pass) without `access` (today's server) the person may view and may not edit [0.45ms]
(pass) fields the server does not send are absent, never invented [0.22ms]
(pass) a node the server sees passing traffic is online, on its path, under its machine's name [0.09ms]
(pass) anything that is not a list is refused, whole [3.93ms]
(pass) a node's own tag list and the tag table agree even when a server sends only one [0.27ms]
(pass) the subscription's events: a pushed list, a revision that invalidates, and the end of the subscription [0.43ms]
(pass) answers carry the new revision, and a create the new arrow's id [0.09ms]
(pass) endpoints go out as the server writes them: a node by id, a tag by name [0.14ms]

src/canvas/mesh/api-recovery.test.ts:
(pass) failed watch refreshes retain one subscription through retry and release it on disposal [1.68ms]
(pass) a synchronous subscription refusal leaves retry able to install a new watch [0.50ms]
(pass) a changed Mesh revision refreshes a renamed host in the existing view model [0.63ms]
(pass) a pushed recovery cancels the scheduled retry [0.40ms]
(pass) a pushed recovery supersedes an outstanding retry failure [0.47ms]
(pass) a retry snapshot at revision 1 is ordered against a pushed recovery [0.46ms]
(pass) a retry snapshot at revision 3 is ordered against a pushed recovery [0.13ms]
(pass) a pushed liveness expiry supersedes an equal-revision retry snapshot [0.55ms]
(pass) a forbidden withdrawal cancels retry work from the retained watch [0.44ms]
(pass) a withdrawn view ignores an earlier outstanding retry result [0.57ms]
(pass) initial Mesh list handles closed transport [0.32ms]
(pass) initial Mesh list handles liveness deadline [0.07ms]
(pass) initial Mesh list handles unreadable JSON [0.07ms]
(pass) initial Mesh list handles unavailable storage [0.11ms]
(pass) initial Mesh list handles forbidden action [0.11ms]
(pass) initial Mesh list handles invalid stored host [0.12ms]
(pass) Mesh watch withdrawal handles forbidden [0.19ms]
(pass) Mesh watch withdrawal handles mesh unavailable [0.03ms]
(pass) Mesh watch withdrawal handles plugin unavailable [0.08ms]

src/canvas/mesh/layout.test.ts:
(pass) a small mesh keeps the approved arrangement: tags down the left, hosts two to a row [0.33ms]
(pass) the layout is deterministic and does not depend on input order [3.91ms]
(pass) no two cards overlap, and every card lies inside the graph [7.75ms]
(pass) the sheet is wider than tall, roughly 16:10 [1.78ms]
(pass) a pinned node stays where it was put and the others do not move [2.38ms]
(pass) a pin beyond the sheet grows the graph [0.37ms]
(pass) a host's other tags do not move it; a tag nobody carries still has its node [0.20ms]
(pass) 1,000 nodes lay out in a few milliseconds [13.97ms]

src/canvas/layout/stops.test.ts:
(pass) a view that fits the viewport has one stop, centred [0.43ms]
(pass) a wide view has one stop per column and the last stop ends at the right edge [0.28ms]
(pass) a view taller than the viewport is scaled down so it fits [0.04ms]
(pass) nearestStop picks the stop whose centre is closest [0.18ms]
(pass) a big graph opens fitted whole, in one stop, and its canvas is free [0.31ms]
(pass) a small graph keeps one stop per node column [0.10ms]
(pass) on a narrow screen a big graph does not shrink past where its names can be read: it starts at the top left [0.09ms]
(pass) centred stops (a phone's strip) rest every column mid-screen, the first and last included [0.10ms]
(pass) D309: with a floor, a narrow column gets a stop of its drawn width and each column is reachable [0.15ms]

src/canvas/layout/grid.test.ts:
(pass) split right in a stacked column makes a group: the window's column halves, its neighbours span both halves [1.59ms]
(pass) closing the new half gives the layout back exactly, in the model [1.39ms]
(pass) closing the window it came from makes the new half take its band, and the layout is one column again [0.46ms]
(pass) split right of a spanning window halves its span inside the existing columns, with the footprint unchanged [0.30ms]
(pass) split down in a group divides only the window's band: the partner window grows to keep its height [0.57ms]
(pass) closing the window split down gives its band back to the window above and to the partner [0.47ms]
(pass) a window split down in a plain column stacks under it and moves the windows below down [0.18ms]
(pass) new window right opens a full-size column after the whole group, never inside it [0.35ms]
(pass) runs: adjacent columns linked by a spanning window form one group, the rest stay plain [0.11ms]
(pass) spans are clamped to the columns that exist and a stale row is re-placed, never overlapped [0.17ms]
(pass) random sequences of split right, split down, new window right and close never break the grid [50.32ms]
(pass) closing every window of a group returns the view to nothing, with no problem on the way [0.57ms]
(pass) a full-width band under a group moves nothing and extends the group by one band [0.22ms]
(pass) a band inserted between two bands of one column grows the windows beside it and moves the rest [0.16ms]
(pass) a narrow right split grows both drawn tracks to the canonical minimum [0.09ms]

src/canvas/layout/geometry.test.ts:
(pass) a dropped view pushes the one it lands on along the axis of least overlap, never itself [0.68ms]
(pass) a chain of neighbours is pushed in turn [0.11ms]
(pass) display settlement clears disconnected overlaps while keeping its one anchor fixed [0.47ms]
(pass) review: a viewport width increase after settlement keeps the Settings anchor clear [0.56ms]
(pass) snapping rounds to whole cells [0.05ms]
(pass) reach follows grants through tags and keeps the relay [0.33ms]
(pass) phone edge to edge: a lone window is the whole area, in a strip it leaves the gap and PEEK px of each neighbour; full width is the whole area always [0.11ms]
(pass) comfortable phones: a column in a strip leaves PEEK px of each neighbour; a lone one keeps the screen less the margins [0.06ms]
(pass) a desktop column is the same alone and in a strip [0.03ms]
(pass) D309: a touch screen draws every column at least MIN_TOUCH_COLUMN wide, never wider than a lone column; a fine pointer has no floor [0.10ms]
(pass) D309: the content is as wide as the drawn columns, so the camera reaches every column [0.09ms]
(pass) a desktop column is never drawn wider than the screen; a phone strip has no ceiling and the saved width is untouched [0.07ms]

src/canvas/sessions/startup-toast.test.ts:
(pass) a closing notice cannot hide its replacement before the next animation frame [1.81ms]

src/canvas/sessions/live-inventory.test.ts:
(pass) a shared manual name pins an existing record and survives later attach hints [1.04ms]
(pass) choosing the current automatic name still pins it [0.12ms]
(pass) a host snapshot replaces in-memory session rows without rewriting legacy storage [1.61ms]
(pass) an unavailable agent hides remembered rows without ending them, then restores verified sessions [0.29ms]
(pass) inventory keeps a remote session per tab and refuses a cross-host attach [0.23ms]
(pass) superseded status snapshots release records for sessions this device never opened [1.28ms]
(pass) superseding a sidecar preserves status for a window opened on this device [0.18ms]
(pass) a census predating a new shell does not permanently retire its confirmed live ID [0.17ms]
(pass) a final Close before the first positive census never revives a new ID [0.11ms]
(pass) a later absence retires a new ID after its first positive census [0.11ms]
(pass) another host's census cannot clear a new shell's census fence [0.08ms]
(pass) another host's close cannot clear a new shell's census fence [0.02ms]
(pass) shared membership marks windows open without any local attachment [0.27ms]

src/canvas/sessions/details-live.test.ts:
(pass) a refused host facts action stops its recurring timer [1.17ms]
(pass) a detected operating system supplies the live popover mark [1.08ms]

src/canvas/sessions/startup-hints.test.ts:
(pass) the offer asks in the owner's words and offers ✓, ✗ and ? with a name each [2.06ms]
(pass) each multiplexer is named as people know it [0.05ms]
(pass) discovery and cancelling confirmation never change startup; accepting offers a precise undo [3.10ms]
(pass) ✗ changes nothing and ? opens the docs without closing the question [0.66ms]
(pass) with no recognised startup line, ✓ copies the line instead of editing a file [1.62ms]
(pass) saving a hint switch never sends a startup-file edit [0.48ms]
(pass) disposing a pending detection never shows its late notice [0.27ms]
(pass) a newly seen host reads its saved override before showing its switch [1.55ms]

src/canvas/sessions/live.test.ts:
(pass) the toolbar sessions seam exposes admitted host state and routes by identity [0.96ms]
(pass) an enrolled host opens by UUID and splits keep that authority [0.25ms]
(pass) an authoritative snapshot keeps an unjoined host visible while setup continues [0.23ms]
(pass) unknown and ambiguous labels never open an embedded shell [0.16ms]
(pass) removed hosts disappear from inventory and cannot route a new shell [0.17ms]
(pass) an authoritative host snapshot replaces admission with one notification [0.23ms]
(pass) the embedded inventory identity still opens locally beside an equally named remote [0.07ms]
(pass) the embedded host's mark does not wait for an account name, and no account is invented [0.06ms]

src/canvas/sessions/hosts.test.ts:
(pass) fresh storage lists an offline host added by another browser [0.91ms]
(pass) every welcome reconciles without duplicate subscriptions or hosts [0.19ms]
(pass) a removal in another browser withdraws the host [0.25ms]
(pass) a malformed page cannot partially replace the authoritative inventory [0.28ms]
(pass) a socket-authority refusal withdraws previously admitted hosts [0.38ms]
(pass) an invalidated read cannot enqueue an unsent call while the socket is down [0.55ms]

src/canvas/sessions/gone-review.test.ts:
(pass) selecting a known gone session keeps its final exited state [0.19ms]
(pass) a known retired status survives repeated selection and generic ended answers [0.10ms]

src/canvas/sessions/hosts-scale-review.test.ts:
(pass) a fresh browser discovers 10000 admitted offline hosts from complete bounded pages [17.87ms]
(pass) a fresh browser discovers 10001 admitted offline hosts from complete bounded pages [8.95ms]

src/canvas/sessions/open-refusal.test.ts:
(pass) memory refusal retains the reason and current counters [1.15ms]
(pass) legacy refusals still work and malformed counters never reach the message [0.57ms]
(pass) product copy names the host and counters and never renders untrusted server text [0.39ms]
(pass) oversized refusal JSON is ignored before parsing [1.23ms]

src/canvas/sessions/focus-intent.test.ts:
(pass) focusin supersedes every older focus intent [0.56ms]
(pass) pointerdown supersedes every older focus intent [0.04ms]
(pass) keydown supersedes every older focus intent [0.02ms]
(pass) input supersedes every older focus intent [0.02ms]

src/canvas/version/source.test.ts:
(pass) checks real server state and reported host versions together, keeping unknown hosts unknown [1.89ms]
(pass) a ready server release comes from verified backend state [0.18ms]
(pass) malformed backend state fails a check without inventing a running version [0.20ms]
(pass) subscribes after capability discovery and removes listeners on disposal [1.66ms]
(pass) disposing a view fences late facts without changing the check result into unknown [0.37ms]

src/canvas/version/updates.test.ts:
(pass) lag shows by itself > a host whose version differs from the server's is an update; an unknown version never is [0.31ms]
(pass) lag shows by itself > no lag leaves the settled state alone; work in progress and failures are never replaced [0.07ms]
(pass) lag shows by itself > a check's targets and the lagging hosts are merged by name [0.15ms]
(pass) the Updates value is the whole conversation > a press on 'Up to date' checks, shows the spinner, and settles [1.04ms]
(pass) the Updates value is the whole conversation > a check that finds updates asks 'proceed?', and a second press proceeds then checks again [0.47ms]
(pass) the Updates value is the whole conversation > lag that is already known is answered by one press: proceed, no check first [0.25ms]
(pass) the Updates value is the whole conversation > a press while work runs does nothing [0.19ms]
(pass) the Updates value is the whole conversation > a source that cannot check says why, in its own words; any other failure is a plain sentence [0.38ms]
(pass) the Updates value is the whole conversation > a source with no way to update never offers it as done; the failure is kept for the person to read [0.15ms]
(pass) the Updates value is the whole conversation > an update that does not start leaves the choice where it was and says so once [0.33ms]
(pass) the Updates value is the whole conversation > the spinner stays at least as long as asked, even when the answer is instant [0.15ms]
(pass) the source is the truth about what it retains > a new retained update state replaces what the row showed; an unrelated change keeps what a press found [0.36ms]
(pass) checkFleet asks every host together > every probe has started before any has answered [0.63ms]
(pass) checkFleet asks every host together > the answer lists exactly the targets that need an update [0.25ms]
(pass) checkFleet asks every host together > one host that cannot answer makes the whole answer a failure instead of leaving it out [0.14ms]

src/canvas/version/words.test.ts:
(pass) the Updates value > each state says one thing, and a press is named by the tooltip [0.13ms]
(pass) the Updates value > the count agrees with its noun and the question is asked once [0.22ms]
(pass) the Updates value > the tooltip names what a press will update, with this server first-class [0.05ms]
(pass) the Updates value > no value repeats its key, and 'Hosts' is not a second key for the same thing [0.21ms]
(pass) the pill > up to date is a tick, an update is an exclamation, a failed check is a cross, and nothing known shows no mark [0.29ms]
(pass) the pill > the tip and the spoken name carry the status and the edition in words [0.09ms]
(pass) the pill > a licence about to end tints the edition and the tip says when [0.14ms]
(pass) the licence lines > the section is titled by the edition, and the heading says the version once [0.15ms]
(pass) the licence lines > a licence says when it ends in plain words [4.20ms]
(pass) the licence lines > no prices anywhere in the wording [0.28ms]

src/canvas/model/server-store.test.ts:
(pass) a negative drop on a 1,025-node mesh writes one pin, and the peer ends with every pin (#24) [36.40ms]
(pass) repeated pin moves reach both coordinate limits; the next move is refused and rolled back [2.38ms]
(pass) event before Result and duplicate events do not apply an optimistic edit twice [1.17ms]
(pass) reconnect retries the exact request and an old receipt removes its optimistic overlay [0.90ms]
(pass) legacy import remains intact until canonical confirmation even if another device initialized [0.65ms]
(pass) dispose cancels late callbacks after sign-out [0.39ms]
(pass) a pending reference preserves unrelated edits across remote paints and is never sent [2.24ms]
(pass) closing an unsent shell removes its unresolved birth without blocking surviving children [0.69ms]
(pass) an acknowledgement after its ordered event does not repaint the same layout [0.40ms]
(pass) a bootstrap receipt before its canonical snapshot keeps the legacy layout drawable without rewriting its source [0.47ms]
(pass) ready edits share one network round trip with a bounded in-flight window [1.14ms]
(pass) the optimistic semantic projection paints before any server receipt [0.57ms]
(pass) a no-op drawing capture does not trigger another paint [0.29ms]
(pass) review: a refused structural edit cannot strand later valid edits [0.60ms]
(pass) a definitive refusal paints rollback in memory and never retries after reconnect [0.51ms]
(pass) a stale refusal cannot discard a new-connection retry [0.39ms]
(pass) review r2: refusal drains independent edits waiting behind four in-flight requests [1.89ms]
(pass) a normal reconnect snapshot arrives before any replacement is requested [0.66ms]
(pass) legacy import retires only after receipt and canonical coverage, receipt first=false [0.56ms]
(pass) legacy import retires only after receipt and canonical coverage, receipt first=true [0.14ms]
(pass) refused import and refused cleanup preserve their legacy source until confirmed removal succeeds [0.99ms]
(pass) reference completion during failed logout is retained without sending until edits resume [1.02ms]

src/canvas/model/lifetime.test.ts:
(pass) logout freezes the initiating account; failure preserves its queue; success forgets only that lifetime [0.32ms]
(pass) dropping a session clears canonical drawing, placeholders and pending callbacks permanently [0.55ms]

src/canvas/model/review-null.test.ts:
(pass) a mixed nullable resize cannot invalidate the canonical drawing document [0.24ms]

src/canvas/model/per-tab.test.ts:
(pass) Hunt 1 / R1 adoption: online peers cannot overwrite or retire a live offline queue [1.10ms]
(pass) R1 failed replacement / R2 unreadable source / 33+33 legacy columns: sources never retire without import confirmation [0.79ms]
(pass) R2 full-history flush / R3 refused cleanup: 8192 queued intents do zero storage work [473.46ms]
(pass) R2 full-history flush / R3 refused cleanup: 32768 queued intents do zero storage work [2820.32ms]
(pass) R2 concurrent first tabs / failed marker / R3 missing locks: no lifetime creation or lock fallback exists [1.04ms]
(pass) R2 sign-out between check/write / R3 delayed startup: teardown invalidates old callbacks before later login [0.74ms]
(pass) R2 completed capture before 300 ms: unconfirmed tab loss is explicit; confirmed state restores from server [0.53ms]
(pass) R2 100 snapshots and 50 ms do not establish a receipt identity or expire uncertainty [62.49ms]
(pass) absent, throwing and recovered storage cannot change live edit acceptance [1.51ms]
(pass) refused individual intents leave independent tabs and later edits live [0.50ms]
(pass) R1 stale unresolved duplicate cannot suppress a completed same-tab birth [0.81ms]

src/canvas/model/operations.test.ts:
(pass) independent resize and move commute; close survives a stale move [0.55ms]
(pass) right split of a stack preserves the upper band [0.21ms]
(pass) reorder uses stable neighbours and emits no document [0.64ms]
(pass) a completed split emits its semantic intent rather than intermediate sizing edits [0.27ms]
(pass) a three-window reorder sends one semantic move [0.24ms]
(pass) a split before the first reference is journalled opens its anchor before splitting [0.29ms]
(pass) a drop sends the moved membership once, without derived neighbour geometry [0.35ms]
(pass) a narrow right split widens first so both halves remain valid [0.36ms]
(pass) a short down split grows the anchor first so both halves meet the height floor [0.47ms]

src/canvas/model/queue-budget.test.ts:
(pass) adjacent same-field unsent edits coalesce; sent requests retain identical identity and input [0.63ms]
(pass) byte backpressure reports refusal before changing projection or silently dropping older work [0.49ms]
(pass) rejected placeholder cancellation preserves the accepted birth and unresolved dependency [0.75ms]
(pass) completed reference size counts toward backpressure without mutating a refused completion [0.51ms]

src/canvas/model/document.test.ts:
(pass) a document holds references and layout, never content [0.38ms]
(pass) manual-name pins survive document serialization while old targets stay unpinned [0.37ms]
(pass) a document survives JSON and rebuilds the same columns [0.50ms]
(pass) a target that no longer exists is dropped, and an emptied column with it [0.17ms]
(pass) parseDocument rejects anything that is not a document of this format [0.42ms]
(pass) remote affinity survives reload and invalid UUIDs cannot become local references [0.32ms]
(pass) a version 1 document from before D212 loads, with its split pair and a full-size window [0.37ms]
(pass) a grouped view saves its spans and bands and loads back to the same grid (D212) [0.46ms]
(pass) a plain view is saved without spans or bands, exactly as before D212 [0.09ms]
(pass) D309: the saved weights do not depend on how a touch screen draws the columns [0.30ms]
(pass) D309: a view this device pushed clear for display is saved where the layout has it [0.14ms]
(pass) an offscreen graph keeps its shared pins before any nodes are rendered [0.07ms]
(pass) a captured graph document is independent of the next pin drag [0.06ms]

src/canvas/model/sync.test.ts:
(pass) a pending session never delays other edits or waits for a network receipt [0.81ms]
(pass) inventory includes shared memberships that this device cannot render [0.88ms]
(pass) temporary flow windows are never treated as unsubmitted shared windows [0.18ms]

src/canvas/model/review-span.test.ts:
(pass) a down split shifts every column in a transitively connected group [0.27ms]

src/canvas/model/reducer-property.test.ts:
layout property: 32 seeds, 4096 operations, 4015 accepted, zero divergences
(pass) property: accepted random operation sequences match the real server reducer [9235.23ms]

src/canvas/model/session-incarnation.test.ts:
(pass) reconnect original fences unsent work before the snapshot pump [1.01ms]
(pass) reconnect replacement fences unsent work before the snapshot pump [0.39ms]
(pass) queued work with no original binding cannot adopt a later incarnation [0.56ms]
(pass) a session-incarnation change ends the old canvas and refuses later edits [0.30ms]
(pass) a revoked store does not adopt a replacement account snapshot [0.10ms]
(pass) R250-R3-01: a server-confirmed edit is never reported as lost on session replacement [10.38ms]
(pass) a sent edit without a receipt is reported as uncertain, not lost [0.46ms]

src/canvas/model/review-boundary-r2.test.ts:
review r2 boundary comparison: 8 seeds, 4096 operations, 3198 accepted
(pass) review r2: longer boundary-weighted sequences preserve every accepted projection [1849.82ms]

src/canvas/model/reconcile.test.ts:
(pass) review: removing the current shared view selects a surviving camera anchor [1.72ms]
(pass) a remote negative pin and node update preserve the world position of an unchanged card [3.18ms]

src/canvas/model/journal-confirmation.test.ts:
(pass) hunt 2: uncertain sent edit stays hidden over a newer snapshot until its receipt [0.41ms]
(pass) R1 held notification: a receipt above canonical explicitly reveals the overlay [0.27ms]
(pass) R2 receiptless identity survives 100 matching snapshots without silent confirmation [6.75ms]
(pass) R1 covered receipt is pruned before projecting canonical revision 3 [0.50ms]
(pass) duplicate event then late refusal cannot discard independent work [0.21ms]

src/canvas/model/server-store-p3-review.test.ts:
(pass) review: two successive gaps coalesce while each snapshot is outstanding [1.39ms]
(pass) review: a snapshot arriving after newer deltas never rolls back canonical state [0.29ms]
(pass) review: outage edits wait for snapshot then send each identity once in order [1.10ms]
(pass) review: a 3 s RTT fresh route stays quiet until its complete recovery budget [0.44ms]
(pass) review: changed RTT reschedules the notice and successful recovery cancels future notices [0.47ms]
(pass) review: recovery before the budget remains quiet across repeated drops and disposal frees timers [4.33ms]
(pass) review: an edit first made while offline eventually emits the calm notice [0.48ms]
(pass) review: a first-connect outage with no RTT sample cannot hide pending edits forever [0.42ms]
(pass) hunt 4: slow snapshots own one watchdog; bounded retries pause offline and disposal cancels them [0.50ms]

src/canvas/model/journal.test.ts:
(pass) an offline birth keeps its identity through same-tab reference completion [0.43ms]

src/canvas/account/words.test.ts:
(pass) a value says the state, and a concern says itself > a recovery key verified recently is just "Set up"; there is no "checked N days ago" line anywhere [0.61ms]
(pass) a value says the state, and a concern says itself > a recovery key that is not set up, never verified, or stale says so in its value, with the way out [0.66ms]
(pass) a value says the state, and a concern says itself > passkeys: the number when there are two or more, the concern when there are fewer [0.12ms]
(pass) a value says the state, and a concern says itself > a row whose fact the server cannot say yet is not drawn (the product knows only the name and the username today) [0.09ms]
(pass) a value says the state, and a concern says itself > the pill's amber mark follows the values: the recovery key first, then the passkeys, and only when a value is a concern [0.42ms]
(pass) a value says the state, and a concern says itself > dates [0.25ms]
(pass) logs in as > the row is a chip per account with its host count, the biggest first, never more than three, then +N [1.45ms]
(pass) logs in as > each tag has its own group; the biggest first, then by name; the untagged last [0.28ms]
(pass) logs in as > a machine with several tags is in each of its tags' groups, once in each, and keeps all its tags [1.14ms]
(pass) logs in as > no tags at all is one untagged group; no machines is none [0.08ms]
(pass) the rest > numbers carry separators and a name falls back to the username [0.10ms]
(pass) the rest > the pill's spoken name says the person, then Account, then what needs attention [0.10ms]
(pass) the rest > email check [0.15ms]

src/canvas/addhost/setup-feed.test.ts:
(pass) createSetupFeed > subscribes with the host and window, then hands over events in order [0.90ms]
(pass) createSetupFeed > a failure after the prompt, and a retry on the same socket [0.20ms]
(pass) createSetupFeed > a dropped socket resumes after the last sequence and repeats nothing [20.66ms]
(pass) createSetupFeed > a retry asked while offline is sent when the socket is back [22.04ms]
(pass) createSetupFeed > a resync resets the view; an error before any event reports the status lost, after one it is ignored [0.47ms]
(pass) createSetupFeed > gives up after the backoff is spent, and a release closes the socket [46.28ms]
(pass) review reconnect budget survives sockets that open then close without events [46.24ms]
(pass) review explicit retry resumes after the setup feed stops [46.29ms]

src/canvas/addhost/wizard.breakit2.test.ts:
(pass) breakit2 an explicit port on a listed host survives chip resolution [0.87ms]
(pass) breakit2 malformed bracketed IPv6 waits for correction [0.15ms]
(pass) listed host plus port retains its saved user in the serialized destination [0.17ms]
(pass) review listed inventory name plus port retains its resolved address [0.24ms]

src/canvas/addhost/setup-stages.test.ts:
(pass) parseSetupEvent > reads a well-formed event [0.11ms]
(pass) parseSetupEvent > drops anything malformed [0.08ms]
(pass) parseSetupEvent > ignores a failed step on a non-failure and an unknown step on a failure [0.05ms]
(pass) foldSetup > stages before the event's are done, later ones pending [0.17ms]
(pass) foldSetup > a stage that reports done alone still finishes [0.04ms]
(pass) foldSetup > ready done completes the run [0.05ms]
(pass) foldSetup > a failure marks the stage its step belongs to, and a retry clears it [0.17ms]
(pass) foldSetup > uploading belongs to install and the readiness check to ready [0.07ms]
(pass) setupGuide > says the other sessions keep working and what to do next, in plain words [0.15ms]
(pass) review malformed setup fields are dropped without coercion errors [0.13ms]
(pass) exhausted setup preserves eligibility and explains a new setup [0.16ms]

src/canvas/addhost/real.test.ts:
(pass) parsing the server's data > a discovery row keeps only known fields and valid ids [0.42ms]
(pass) parsing the server's data > the server key needs its public key and fingerprint [0.09ms]
(pass) parsing the server's data > an install command needs a lifetime [0.06ms]
(pass) a server that lacks an endpoint > serving the web app (200, HTML) for an unknown path is 'not available' [1.55ms]
(pass) a server that lacks an endpoint > 404 discovery is an empty list; 500 discovery is an error to show [0.34ms]
(pass) a server that lacks an endpoint > private sign-in stays local until a target-bound socket start [1.21ms]
(pass) a server that lacks an endpoint > a wrong target consumes the reference without sending private input [0.21ms]
(pass) a server that lacks an endpoint > a local reference cannot change SSH address while keeping the target id [0.20ms]
(pass) a server that lacks an endpoint > closing before open discards queued sign-in even if a late open fires [0.11ms]
(pass) a server that lacks an endpoint > pre-open commands stay bounded and events after close cannot revive a run [0.23ms]
(pass) a server that lacks an endpoint > trust waits for the exact acknowledgement, and ignores another target [0.32ms]
(pass) bootstrap failure parsing > an already-added failure keeps its existing host id [0.26ms]
(pass) bootstrap failure parsing > host ids are ignored on other failures and when malformed [0.14ms]

src/canvas/addhost/authority.on-demand.test.ts:
(pass) CA wrapping matches the contract's HKDF domain and separates generations [0.88ms]

src/canvas/addhost/model.test.ts:
(pass) stagesOf > a host with no event is waiting everywhere [0.27ms]
(pass) stagesOf > check before sign-in is detecting how to sign in [0.28ms]
(pass) stagesOf > the sign-in report finishes detect and starts the system check [0.20ms]
(pass) stagesOf > install, facts and connect map to install, enrol and first session [0.17ms]
(pass) stagesOf > an auth failure before sign-in fails detect and says it in plain words, not the server's [0.31ms]
(pass) stagesOf > an unsupported host fails the system check, after sign-in [0.06ms]
(pass) stagesOf > an install failure fails the install stage and keeps the earlier ones done [0.09ms]
(pass) stagesOf > a new attempt starts over and forgets the old sign-in [0.13ms]
(pass) authLabel > names the method and a trusted network provider only [0.06ms]
(pass) guideFor > installation failures never claim that incomplete cleanup succeeded [0.22ms]
(pass) guideFor > each failure kind names its fix [0.08ms]
(pass) guideFor > mesh-policy words say possible, not certain [0.02ms]
(pass) parseTarget > reads user, host and port [0.07ms]
(pass) parseTarget > reads a pasted ssh command into the same fields [0.17ms]
(pass) parseTarget > reads an ssh:// address [0.07ms]
(pass) parseTarget > refuses garbage around an ssh command [0.08ms]
(pass) parseTarget > refuses what cannot name a host [0.03ms]
(pass) parseSshConfig > reads aliases with HostName, User and Port, skipping wildcards and Match [0.43ms]
(pass) parseSshConfig > recognises config text [0.06ms]
(pass) parseSshConfig > a hostname that is an option is dropped [0.03ms]
(pass) plain words > an unknown or missing failure gets the generic sentence, never the server's text [0.05ms]
(pass) plain words > no headline carries an arrow, an id or an API noun [0.10ms]
(pass) only a completed canonical host identity becomes terminal authority [0.09ms]
(pass) parseTarget > accepts user@host, host, user@host:port, IPv4 and bracketed IPv6 with an optional port [0.13ms]
(pass) parseTarget > rejects partial and malformed tokens, so they wait or show the hint [0.04ms]
(pass) matchListed > a name that is exactly one host's id or address names that host [0.04ms]
(pass) matchListed > a name that is also the start of another host's name is named but still prefixed [0.02ms]
(pass) matchListed > a partial name that starts several hosts names none and waits [0.02ms]
(pass) matchListed > a new name that starts no host is neither named nor waiting [0.02ms]
(pass) install diagnostics name the failed step and public host error [0.06ms]
(pass) missing payload tells the operator the architecture and expected server path [0.03ms]
(pass) an already added host says so and offers opening its existing terminal [0.18ms]
(pass) release payload verification names the architecture step and plain reason [0.02ms]
(pass) leftovers pause (#169) > a check event with leftovers pauses the running attempt; the next event clears it [0.08ms]
(pass) leftovers pause (#169) > a pause without leftovers offers nothing to start fresh [0.08ms]
(pass) early terminal publication selects only its canonical host-bound shim session [0.07ms]

src/canvas/addhost/already-added-breakit.test.ts:
(pass) an already-added failure without a host id (older server) still says how to reach the terminal [0.10ms]

src/canvas/addhost/wizard.test.ts:
(pass) a saved-key prompt completing after close never starts an SSH attempt [0.75ms]
(pass) fresh CA requires setup before any SSH attempt and preserves root consent [0.48ms]
(pass) ready CA begins the requested installation mode without another prompt [0.18ms]
(pass) closing during CA confirmation never starts an SSH attempt [0.44ms]
(pass) a typed root login requires explicit consent before any installation [0.27ms]

src/canvas/views/body.test.ts:
(pass) a clean terminal exit keeps the window while host setup can still fail [0.07ms]
(pass) clean exits still close ordinary windows, and failed exits stay visible [0.02ms]

../../packages/ui/src/spring.test.ts:
(pass) a missed frame does not stretch a settled spring [0.53ms]
(pass) motion follows elapsed time across frame rates and damping regimes [1.02ms]

chunk-classes.test.ts:
(pass) the first screen is critical, the canvas product module and what only it uses are deferred [1.28ms]
(pass) a chunk that both sides use stays critical [0.37ms]
(pass) code only an action loads is on demand, even when the lazy canvas is what loads it [0.39ms]
(pass) post-terminal host inventory entry and its shared canvas imports stay deferred [0.25ms]
(pass) automatic canonical painting loads after the first canvas draw [0.24ms]

test/recovery-ui.test.ts:
(pass) compiled recovery UI mode off obeys its URL boundary [3.45ms]
(pass) compiled recovery UI mode preview obeys its URL boundary [4.13ms]
(pass) compiled recovery UI mode 1 obeys its URL boundary [3.78ms]

test/recovery-crypto.test.ts:
(pass) HKDF siblings match independent implementation and bind unwrap to domain, account, kind and version [14.20ms]
(pass) 100 repeated wrapping operations generate independent salts and nonces [21.42ms]

test/recovery-rotation.test.ts:
(pass) signed-in rotation sends only a local envelope and verifier after acknowledgement [9.38ms]
(pass) abandoned word acknowledgement uploads nothing [5.13ms]
(pass) settled acknowledgement cannot upload later (dismissed) [4.54ms]
(pass) settled acknowledgement cannot upload later (no acknowledgement) [6.86ms]

test/recovery-wait.test.ts:
(pass) server remaining wait 0s is accepted through the capability policy maximum [1.97ms]
(pass) server remaining wait 86400s is accepted through the capability policy maximum [2.52ms]
(pass) server remaining wait 90000s is accepted through the capability policy maximum [2.48ms]
(pass) server remaining wait 172800s is accepted through the capability policy maximum [2.40ms]
(pass) malformed or excessive remaining wait -1 is denied [1.77ms]
(pass) malformed or excessive remaining wait 0.5 is denied [1.01ms]
(pass) malformed or excessive remaining wait 172801 is denied [0.90ms]
(pass) malformed or excessive remaining wait 9007199254740992 is denied [1.45ms]
(pass) malformed or excessive remaining wait 90000 is denied [1.06ms]

test/link-doubt.test.ts:
(pass) a link doubt shows the indicator and keeps live replies and typing flowing [1.61ms]
(pass) recovery clears only its own indicator, and a real reconnect still owns the replay [0.36ms]
(pass) a notice type from a newer server is ignored, not a protocol failure [0.08ms]
(pass) the viewer announces the link-doubt capability in its Hello [2.31ms]

test/close-reasons.test.ts:
(pass) every reason the server and the agent send maps to a plain sentence, and unknown ones fall back [0.21ms]

src/close-reasons.test.ts:
(pass) a missed connection response keeps a plain and stable reason [0.02ms]
(pass) server and host close reasons identify why a terminal reconnects, in plain words [0.21ms]
(pass) routine detach and connection rotation reasons stay neutral [0.02ms]
(pass) a stream close that reattaches never says the terminal ended [0.10ms]
(pass) a recovering server link names its cause as routine status, never as a failure [0.03ms]
(pass) unknown close text is discarded instead of reaching the person or console [0.05ms]
(pass) a storm of closes prints one line per minute and counts the rest [0.39ms]
(pass) counted closes are reported when their window ends, without another close [0.04ms]

src/review-close-log.test.ts:
(pass) a reconnect the server refuses with a named Close frame still prints its console line [1.32ms]
(pass) a close summary does not claim closes from hours ago happened in the previous 60 s [0.05ms]

src/onboarding-load.test.ts:
(pass) a failed load says so in the error line, offers Try again, and mounts nothing [5.49ms]
(pass) the Try again button reloads the page: a failed import stays failed in the module map [5.43ms]
(pass) the online event retries by itself [5.27ms]

 472 pass
 0 fail
 22458 expect() calls
Ran 472 tests across 79 files. [23.69s]
bun test v1.4.2 (744846f84)

src/connection-correlation-review.test.ts:
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) Pongs with a matching nonce and a different timestamp cannot retain readiness [9.26ms]

src/connection-idle.test.ts:
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) healthy idle probes back off independently of 1 streams at RTT 1 [4.55ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) healthy idle probes back off independently of 28 streams at RTT 1 [3.16ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) healthy idle probes back off independently of 1 streams at RTT 150 [1.22ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) healthy idle probes back off independently of 28 streams at RTT 150 [0.92ms]
(pass) unacknowledged input keeps probes fast until the matching stream acknowledges it [4.73ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 0 at RTT 1 [1.28ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 7 at RTT 1 [1.07ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 20 at RTT 1 [1.03ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 39 at RTT 1 [1.11ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 0 at RTT 30 [0.95ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 7 at RTT 30 [0.61ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 20 at RTT 30 [0.57ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 39 at RTT 30 [0.65ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 0 at RTT 150 [0.54ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 7 at RTT 150 [0.35ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 20 at RTT 150 [0.46ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) idle silence deadline survives probe phase 39 at RTT 150 [0.47ms]
(pass) retransmitting an earlier input range cannot forget a later unacknowledged byte [2.02ms]
(pass) a delayed first timer starts unknown-RTT grace when its first probe is issued [3.34ms]
(pass) a healthy idle route tolerates a 20ms RTT step at 1 streams without consuming its scheduling allowance before probing [1.24ms]
(pass) a healthy idle route tolerates a 20ms RTT step at 28 streams without consuming its scheduling allowance before probing [1.23ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a late timer on a fully answered route preserves its reply allowance across 1 streams [0.77ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a late timer on a fully answered route preserves its reply allowance across 28 streams [1.28ms]
(pass) a healthy browser route survives 150ms scheduler delay across 1 streams [1.56ms]
(pass) a healthy browser route survives 150ms scheduler delay across 28 streams [1.70ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a quiet dead browser peer is detected within two 250ms allowances plus one probe interval [1.31ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) browser jitter allowance decays after a stable link returns [8.58ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a queued healthy reply survives a 150ms browser event-loop stall with reply first [1.24ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a queued healthy reply survives a 1000ms browser event-loop stall with reply first [1.41ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a queued healthy reply survives a 60000ms browser event-loop stall with reply first [1.00ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a queued healthy reply survives a 150ms browser event-loop stall with timer first [3.18ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a queued healthy reply survives a 1000ms browser event-loop stall with timer first [1.19ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a queued healthy reply survives a 60000ms browser event-loop stall with timer first [1.67ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a late timer without a reply counts subsequent responsive silence [1.38ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) an outstanding probe gets responsive observation after a renderer stall [6.71ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) retirement gives a queued mismatched pong one task turn [1.10ms]
(pass) retirement gives a queued correlated pong one task turn [1.36ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a dead typing route eventually retires when browser tasks run every 75ms [1.70ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a dead idle route eventually retires when browser tasks run every 1000ms [0.84ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a dead idle route eventually retires when browser tasks run every 60000ms [1.00ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) dead-route stall grace is bounded by two allowances and three 75ms task gaps [1.04ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) dead-route stall grace is bounded by two allowances and three 1000ms task gaps [1.39ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) dead-route stall grace is bounded by two allowances and three 60000ms task gaps [1.37ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) correlated queued replies replenish stall grace across successive healthy stalls [1.06ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) duplicate replies cannot replenish consumed stall grace [0.81ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) wrong timestamp replies cannot replenish consumed stall grace [0.60ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) unknown nonce replies cannot replenish consumed stall grace [0.65ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a queued correlated reply cancels confirmation without letting a duplicate renew it [1.37ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 1
(pass) a replacement route receives its own one-shot local stall grace [1.38ms]
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) continuous typing cannot cancel every silent-route confirmation turn [1.26ms]
(pass) a pending confirmation is reset by reconnect [1.37ms]
Connection to the server closed after the connection was established: closed by the server, code 1001, reason "other", reconnect attempt 0
(pass) a pending confirmation is reset by close [1.14ms]
(pass) a pending confirmation is reset by dispose [1.04ms]
(pass) a stale confirmation from before reconnect cannot close the replacement route [2.22ms]
(pass) a hidden page resumes its lease after 5000ms without retiring queued replies [2.24ms]
(pass) a hidden page resumes its lease after 30000ms without retiring queued replies [1.63ms]
(pass) a socket lost while hidden waits for visibility before reconnecting [1.95ms]
(pass) mobile jitter and one retransmission keep a foreground browser lease [60.01ms]
(pass) visibility notices require both peers to support them: false [0.63ms]
(pass) visibility notices require both peers to support them: true [0.32ms]
(pass) hiding a page cancels a retry scheduled while it was visible [1.01ms]
(pass) review: queued replies cannot retire a restored hidden page when visibility dispatch precedes replies: true [1.09ms]
(pass) review: queued replies cannot retire a restored hidden page when visibility dispatch precedes replies: false [1.11ms]
(pass) a layout subscription starts the connection before any terminal exists [0.43ms]
(pass) resync replaces one subscription ID and disposal prevents later resyncs [1.03ms]
(pass) resync reopens a feature subscription with the same server ID [0.36ms]

src/connection-layout-removal.test.ts:
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) a reconnect snapshot removing the current view sends no unbound Close and moves its camera [15.12ms]

src/connection-layout-session-capability.test.ts:
(pass) layout session incarnation uses Hello capability bit 4 [0.05ms]

src/connection-liveness.test.ts:
Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0
(pass) a retained unresponsive route loses readiness, resumes automatically and ignores its late events [2.19ms]

src/connection-pool.test.ts:
(pass) terminals fill the first socket, then open another, and a released slot is reused first [0.65ms]
(pass) 54 windows need two sockets, and the pool stops opening sockets at its cap [0.66ms]

src/connection-probe-scheduling-review.test.ts:
(pass) a fully answered browser route survives a delayed next probe before a terminal attaches [0.96ms]
(pass) a fully answered browser route survives a delayed next probe with an attachment [0.39ms]

src/connection-query-capabilities.test.ts:
(pass) query replies negotiate independently with Hello caps 0 [0.09ms]
(pass) query replies negotiate independently with Hello caps 4
(pass) query replies negotiate independently with Hello caps 8
(pass) query replies negotiate independently with Hello caps 12

src/connection-query-refusal.test.ts:
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) pending query stays reply-marked through refusal and explicit resend (previously sent: false) [13.64ms]
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) pending query stays reply-marked through refusal and explicit resend (previously sent: true) [3.75ms]

src/connection-restart.test.ts:
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
Connection to the server closed before the connection was established (reconnect failed): closed by the server or network, code 0, reason "none", reconnect attempt 1
(pass) an overnight connection retains its writer and pending input when the server restarts [0.84ms]
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) a second quick server close leaves the fast path and backs off [0.74ms]
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) a failed first recovery handshake exits the one quick retry [0.52ms]
Connection to the server closed after the connection was established: closed by the server, code 1011, reason "connection ended", reconnect attempt 0
(pass) a server close reason survives socket retirement and the next retry [0.53ms]
Connection to the server closed after the connection was established: closed by the server or network, code 1005, reason "none", reconnect attempt 0
(pass) a clean server socket close keeps its fallback reason through the next retry [0.43ms]
Connection to the server closed after the connection was established: closed by the server or network, code 1006, reason "none", reconnect attempt 0
(pass) a prolonged outage inside the fast-recovery window does not leave recovery behind accumulated backoff [9.66ms]
Connection to the server closed after the connection was established: closed by the server or network, code 1006, reason "none", reconnect attempt 0
(pass) online and foreground events cancel delays and preserve handshakes in progress [1.52ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1
(pass) refused handshakes keep growing backoff (online: true, new hint: false, resume first: true) [0.64ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0
(pass) refused handshakes keep growing backoff (online: true, new hint: false, resume first: false) [0.24ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1
(pass) refused handshakes keep growing backoff (online: true, new hint: true, resume first: true) [0.21ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0
(pass) refused handshakes keep growing backoff (online: true, new hint: true, resume first: false) [0.15ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1
(pass) refused handshakes keep growing backoff (online: false, new hint: false, resume first: true) [0.17ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0
(pass) refused handshakes keep growing backoff (online: false, new hint: false, resume first: false) [0.13ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1
(pass) refused handshakes keep growing backoff (online: false, new hint: true, resume first: true) [0.23ms]
Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0
(pass) refused handshakes keep growing backoff (online: false, new hint: true, resume first: false) [0.14ms]

src/connection-review-refusal-input.test.ts:
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) review: refusal fallback preserves typing through explicit resend (previously sent: false) [1.99ms]
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) review: refusal fallback preserves typing through explicit resend (previously sent: true) [0.90ms]

src/connection-review-retained-lifetime.test.ts:
(pass) review: saved typing can be declined without closing the live shell [0.83ms]
(pass) review: new typing reaches the fresh shell while saved typing stays pending [0.25ms]
(pass) review: retained input and consent are local to their terminal window [0.15ms]
(pass) review: selecting a different session removes saved typing and its action [0.13ms]
(pass) review: another refused writer retains pending and unacknowledged fresh typing [0.14ms]
(pass) review: window disposal clears held input and rejects a stale resend action [0.35ms]

src/connection-startup-review.test.ts:
(pass) a healthy startup route can learn an RTT above the initial estimate [3.62ms]

src/connection-unattached-close.test.ts:
(pass) disposing a window before its welcome microtask sends no unbound Close [1.63ms]
Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0
(pass) review #250: disposing a previously attached window during reconnect sends no unbound Close [1.20ms]

 106 pass
 0 fail
 414 expect() calls
Ran 106 tests across 14 files. [289.00ms]
bun test v1.4.2 (744846f84)

src/terminal-queries.test.ts:
(pass) query identity survives split writes and tracks nested ESC independently of a cancelled string [0.55ms]
(pass) all requested query families have identities [0.14ms]
(pass) every split preserves one identity and oversized strings retain nested boundaries without retaining their contents [1.81ms]
(pass) oversized OSC retains BEL termination before a later query [0.12ms]

src/terminal-query-property.test.ts:
[ghostty-vt] warning(stream): invalid device status report command: ESC [ ? { 6 } n
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
[ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13
QUERY_PROPERTY forms=30 splits=515 viewers=3 accepted=1 duplicates=2
(pass) every renderer-answered form produces exactly one admitted reply for every split with three viewers [275.86ms]

src/terminal-query-renderer-review.test.ts:
(pass) review: DECID gives every real renderer response an identity [0.98ms]
(pass) review: zero-padded CPR gives every real renderer response an identity [0.34ms]
(pass) review: CPR with an ignored NUL gives every real renderer response an identity [0.27ms]
(pass) review: three adjacent requests keep distinct identities across different viewer chunking [7.24ms]

src/terminal-write-slices.test.ts:
(pass) every slice split preserves cells, cursor and all renderer answers [41.59ms]
(pass) invalid or incomplete ranges never feed unexpected bytes and leave later writes usable [1.50ms]
(pass) escaped writers cannot access released input and callback failure releases the scope [0.93ms]
(pass) nested writes and memory growth cannot replace borrowed input [0.66ms]
(pass) allocation refusal never writes or frees unowned memory [1.19ms]
(pass) empty scopes accept no input and reject later writer use [0.29ms]
(pass) input views of native memory survive allocation-driven memory growth [0.39ms]
(pass) throwing callbacks release exactly their owned input allocation [0.26ms]

 17 pass
 0 fail
 1794 expect() calls
Ran 17 tests across 4 files. [372.00ms]
$ bun run build.ts
built chunk-hxpqht5z.js, chunk-sc6q4mh2.js, chunk-qkef0g3b.js, chunk-q05myav6.js, chunk-3vz1mvs1.js, chunk-11vqggk9.js, chunk-edqwfpnb.js, chunk-ym90k1dc.js, chunk-a4sk9ck5.js, chunk-ad4qcdh2.js, chunk-n364d0ma.js, chunk-yvq3ah6x.js, chunk-1aev03z9.js, chunk-15bmrhs0.js, chunk-gxvqf3b8.js, chunk-rbh9y7dh.js, chunk-wxtkdvd9.js, chunk-79ryj47h.js, chunk-xtff5f2v.js, chunk-dptcm9dj.js, chunk-e6rx2mjb.js, main.js, chunk-y8w1vzb3.js, chunk-byrpr9mk.js, chunk-4khf8srr.js, chunk-s2vtkxac.js, chunk-46haed2c.js, chunk-g5vca3ey.js, chunk-7nf9g69c.js, chunk-1ta1akps.js, chunk-td9zyz2d.js, chunk-c76h7v56.js, chunk-cbtr2v7m.js, chunk-cm4mv3wz.js, chunk-4t4fzqr3.js, chunk-rpe3vnng.js, chunk-4nrybnaf.js, chunk-h73njt5c.js, chunk-6kfk0v04.js, chunk-4z8s7vkw.js, chunk-ykr0srn0.js, chunk-x98514ar.js, chunk-9rqwp0sh.js, chunk-cn2xs6xv.js, chunk-pgnq38aj.js, chunk-axbkkqp1.js, chunk-62z9d7sf.js, chunk-fxcx7qaa.js, chunk-7q0wa2ty.js, chunk-ary2pa1y.js, chunk-ttd19hwy.js, chunk-2z38rs5p.js, chunk-x8bjsqvz.js, chunk-ybppz2g8.js, chunk-ywfra562.js, chunk-2m0ba5b7.js, chunk-z48tcwe1.js, chunk-vkabh9k4.js, chunk-jk5xheq9.js, chunk-ga7n3p96.js, chunk-1nbd1b7y.js, chunk-evavfw3s.js, chunk-kw785vsh.js, chunk-681097qe.js, chunk-k90t0egs.js, chunk-ewet4ggg.js, chunk-esk6ttbc.js, chunk-gvddkj3j.js, chunk-exbzms9n.js, chunk-mz1hmdma.js, chunk-6hphcpbw.js, chunk-mmvf4v8e.js, offline.worker.js, backdrop.worker.js, faulty-terminal.worker.js, chunk-hn5022gg.js, chunk-6fyye8s6.js, chunk-ff3nvh2r.js, chunk-qpck7njq.js
onDemand chunk-62z9d7sf.js: identity=10904 gzip=4428 brotli=4034 bytes
onDemand chunk-pgnq38aj.js: identity=1026 gzip=622 brotli=498 bytes
onDemand chunk-ykr0srn0.js: identity=5029 gzip=2046 brotli=1808 bytes
onDemand chunk-2z38rs5p.js: identity=1170 gzip=708 brotli=590 bytes
critical chunk-c76h7v56.js: identity=52 gzip=52 brotli=52 bytes
critical chunk-exbzms9n.js: identity=39 gzip=39 brotli=39 bytes
onDemand chunk-z48tcwe1.js: identity=601 gzip=344 brotli=326 bytes
onDemand chunk-cn2xs6xv.js: identity=11126 gzip=4260 brotli=3891 bytes
critical chunk-wxtkdvd9.js: identity=6313 gzip=2675 brotli=2345 bytes
onDemand chunk-rpe3vnng.js: identity=4594 gzip=2014 brotli=1787 bytes
onDemand chunk-vkabh9k4.js: identity=1408 gzip=713 brotli=665 bytes
onDemand chunk-3vz1mvs1.js: identity=6503 gzip=2412 brotli=2149 bytes
onDemand chunk-ary2pa1y.js: identity=33394 gzip=12808 brotli=11519 bytes
deferred chunk-td9zyz2d.js: identity=131938 gzip=44406 brotli=38959 bytes
onDemand chunk-7nf9g69c.js: identity=2557 gzip=1179 brotli=1009 bytes
critical chunk-byrpr9mk.js: identity=1106 gzip=665 brotli=602 bytes
critical faulty-terminal.worker.js: identity=1086 gzip=559 brotli=481 bytes
critical backdrop.worker.js: identity=243 gzip=211 brotli=161 bytes
onDemand chunk-7q0wa2ty.js: identity=6744 gzip=3164 brotli=2876 bytes
onDemand chunk-4nrybnaf.js: identity=2007 gzip=1006 brotli=856 bytes
onDemand chunk-x98514ar.js: identity=7662 gzip=3397 brotli=2972 bytes
onDemand chunk-11vqggk9.js: identity=5812 gzip=2382 brotli=2167 bytes
critical chunk-hxpqht5z.js: identity=2973 gzip=1341 brotli=1213 bytes
onDemand chunk-2m0ba5b7.js: identity=5359 gzip=2575 brotli=2302 bytes
critical chunk-y8w1vzb3.js: identity=5448 gzip=2607 brotli=2373 bytes
deferred offline.worker.js: identity=1340 gzip=682 brotli=591 bytes
critical chunk-esk6ttbc.js: identity=42924 gzip=14638 brotli=13113 bytes
onDemand chunk-ybppz2g8.js: identity=540 gzip=353 brotli=314 bytes
critical chunk-axbkkqp1.js: identity=90 gzip=90 brotli=78 bytes
critical chunk-6fyye8s6.js: identity=9894 gzip=4051 brotli=3493 bytes
onDemand chunk-yvq3ah6x.js: identity=2108 gzip=1038 brotli=870 bytes
critical chunk-15bmrhs0.js: identity=707 gzip=365 brotli=308 bytes
onDemand chunk-1nbd1b7y.js: identity=3109 gzip=1381 brotli=1220 bytes
critical chunk-dptcm9dj.js: identity=13242 gzip=5131 brotli=4568 bytes
onDemand chunk-hn5022gg.js: identity=9158 gzip=3336 brotli=2888 bytes
onDemand chunk-4z8s7vkw.js: identity=10172 gzip=3970 brotli=3570 bytes
critical chunk-1ta1akps.js: identity=2225 gzip=1090 brotli=923 bytes
critical chunk-4khf8srr.js: identity=8377 gzip=3575 brotli=3187 bytes
critical chunk-ff3nvh2r.js: identity=167 gzip=134 brotli=112 bytes
onDemand chunk-edqwfpnb.js: identity=1997 gzip=854 brotli=733 bytes
onDemand chunk-ym90k1dc.js: identity=3891 gzip=1737 brotli=1500 bytes
onDemand chunk-q05myav6.js: identity=191 gzip=167 brotli=130 bytes
critical chunk-e6rx2mjb.js: identity=386 gzip=237 brotli=195 bytes
onDemand chunk-k90t0egs.js: identity=198 gzip=168 brotli=141 bytes
onDemand chunk-cm4mv3wz.js: identity=6148 gzip=2783 brotli=2508 bytes
deferred chunk-h73njt5c.js: identity=1537 gzip=800 brotli=723 bytes
critical chunk-xtff5f2v.js: identity=2155 gzip=993 brotli=839 bytes
critical chunk-79ryj47h.js: identity=15773 gzip=5658 brotli=5024 bytes
critical chunk-sc6q4mh2.js: identity=35411 gzip=10323 brotli=9272 bytes
onDemand chunk-qpck7njq.js: identity=1063 gzip=652 brotli=521 bytes
critical chunk-fxcx7qaa.js: identity=730021 gzip=210599 brotli=171103 bytes
onDemand chunk-6hphcpbw.js: identity=869 gzip=346 brotli=323 bytes
onDemand chunk-x8bjsqvz.js: identity=1649 gzip=776 brotli=675 bytes
critical chunk-mz1hmdma.js: identity=49 gzip=49 brotli=49 bytes
onDemand chunk-mmvf4v8e.js: identity=2723 gzip=1328 brotli=1142 bytes
onDemand chunk-qkef0g3b.js: identity=228 gzip=178 brotli=159 bytes
critical chunk-s2vtkxac.js: identity=1734 gzip=840 brotli=679 bytes
critical chunk-ewet4ggg.js: identity=199 gzip=164 brotli=139 bytes
onDemand chunk-evavfw3s.js: identity=49348 gzip=15461 brotli=13806 bytes
onDemand chunk-6kfk0v04.js: identity=13500 gzip=5380 brotli=4796 bytes
critical chunk-g5vca3ey.js: identity=1188 gzip=690 brotli=590 bytes
critical chunk-681097qe.js: identity=162 gzip=151 brotli=124 bytes
deferred chunk-1aev03z9.js: identity=40754 gzip=14866 brotli=13304 bytes
onDemand chunk-rbh9y7dh.js: identity=4612 gzip=1788 brotli=1592 bytes
onDemand chunk-kw785vsh.js: identity=7011 gzip=3107 brotli=2818 bytes
onDemand chunk-ad4qcdh2.js: identity=2420 gzip=1196 brotli=1079 bytes
critical chunk-a4sk9ck5.js: identity=5890 gzip=2461 brotli=2137 bytes
critical chunk-gxvqf3b8.js: identity=88 gzip=88 brotli=76 bytes
onDemand chunk-cbtr2v7m.js: identity=1691 gzip=872 brotli=746 bytes
critical main.js: identity=105728 gzip=38897 brotli=33660 bytes
onDemand chunk-4t4fzqr3.js: identity=2824 gzip=1386 brotli=1193 bytes
onDemand chunk-ttd19hwy.js: identity=2565 gzip=1149 brotli=978 bytes
critical chunk-46haed2c.js: identity=2693 gzip=1202 brotli=1036 bytes
onDemand chunk-n364d0ma.js: identity=6476 gzip=2179 brotli=1935 bytes
onDemand chunk-jk5xheq9.js: identity=724 gzip=403 brotli=361 bytes
critical chunk-gvddkj3j.js: identity=39 gzip=39 brotli=39 bytes
onDemand chunk-ywfra562.js: identity=11562 gzip=4696 brotli=4283 bytes
onDemand chunk-9rqwp0sh.js: identity=14549 gzip=5411 brotli=4867 bytes
onDemand chunk-ga7n3p96.js: identity=572 gzip=329 brotli=309 bytes
JavaScript transfer, critical: identity=996402 gzip=309614/327680 brotli=258010/273408 bytes
JavaScript transfer, deferred: identity=175569 gzip=60754/61440 brotli=53577/55296 bytes
JavaScript transfer, onDemand: identity=267794 gzip=106482/20480 brotli=94906/18432 bytes
JavaScript transfer, onDemand largest chunk chunk-evavfw3s.js: gzip=15461/20480 brotli=13806/18432 bytes (class total gzip=106482 brotli=94906, not limited)
fonts/monaspace-neon/italic.latin.woff2: identity=44324 gzip=44324 brotli=44324 bytes
fonts/monaspace-neon/roman.latin.woff2: identity=40016 gzip=40016 brotli=40016 bytes
fonts/jetbrains-mono/italic.latin.woff2: identity=36316 gzip=36316 brotli=36316 bytes
fonts/jetbrains-mono/roman.latin.woff2: identity=34068 gzip=34068 brotli=34068 bytes
fonts/source-code-pro/italic.latin.woff2: identity=23612 gzip=23612 brotli=23612 bytes
fonts/source-code-pro/roman.latin.woff2: identity=22872 gzip=22872 brotli=22872 bytes
fonts/geist-mono/italic.latin.woff2: identity=21380 gzip=21380 brotli=21380 bytes
fonts/geist-mono/roman.latin.woff2: identity=19984 gzip=19984 brotli=19981 bytes
fonts/ibm-plex-mono/italic.latin.woff2: identity=22296 gzip=22296 brotli=22296 bytes
fonts/ibm-plex-mono/roman.latin.woff2: identity=19048 gzip=19048 brotli=19047 bytes
fonts/cascadia-code/italic.latin.woff2: identity=44404 gzip=44404 brotli=44404 bytes
fonts/cascadia-code/roman.latin.woff2: identity=40604 gzip=40604 brotli=40604 bytes
fonts/maple-mono-nf/italic.latin.woff2: identity=53444 gzip=53444 brotli=53444 bytes
fonts/maple-mono-nf/roman.latin.woff2: identity=46432 gzip=46432 brotli=46432 bytes
fonts/nerd-symbols.woff2: identity=223748 gzip=223748 brotli=223748 bytes
fonts/fira-code/roman.latin.woff2: identity=36756 gzip=36756 brotli=36756 bytes
fonts/commit-mono/italic-400.latin.woff2: identity=18716 gzip=18716 brotli=18716 bytes
fonts/commit-mono/italic-700.latin.woff2: identity=18352 gzip=18352 brotli=18352 bytes
fonts/commit-mono/roman-400.latin.woff2: identity=17484 gzip=17484 brotli=17484 bytes
fonts/commit-mono/roman-700.latin.woff2: identity=17260 gzip=17260 brotli=17260 bytes
Font transfer: monaspace-neon=84340/88064 jetbrains-mono=70384/75776 source-code-pro=46484/49152 geist-mono=41364/45056 ibm-plex-mono=41344/45056 cascadia-code=85008/88064 maple-mono-nf=99876/106496 (critical 46432/51200) symbols=223748/235520 fira-code=36756/40960 commit-mono=71812/75776 bytes

==> Rust stream oracle (for the differential test)

==> TypeScript protocol tests
bun test v1.4.2 (744846f84)

src/mesh-review-revocation.test.ts:
(pass) review forbidden event cancels pending snapshot publication [5.68ms]
(pass) subscription forbidden ends delivery before a late refresh rejection [1.33ms]
(pass) subscription not found ends delivery before a late refresh rejection [1.27ms]
(pass) subscription invalid input ends delivery before a late refresh rejection [1.18ms]
(pass) subscription mesh unavailable ends delivery before a late refresh rejection [1.14ms]
(pass) synchronous subscription refusal releases the transport exactly once [0.12ms]

src/codec.test.ts:
(pass) wire protocol golden vectors > encodes and decodes each frame exactly as the shared manifest describes [12.32ms]
(pass) wire protocol golden vectors > returns borrowed payload views and writes into reusable buffers [0.21ms]
(pass) wire protocol golden vectors > decodes muxed messages split across WebSocket messages [0.82ms]
(pass) wire protocol golden vectors > rejects oversized, non-canonical, unknown, and malformed frame bytes [0.12ms]
(pass) split mux header preserves trailing Close [0.23ms]
(pass) reply-marked Input uses an additive bounded layout without changing legacy input [0.72ms]
(pass) empty marked input reports the stable invalid-body decoder failure [0.14ms]

src/mesh-review-paged-error.test.ts:
(pass) review earlier snapshot continuation failure cannot replace a newer complete refresh [2.74ms]
(pass) review earlier snapshot continuation cannot overwrite a delivered revision [2.70ms]
(pass) a newer paged event owns publication before an earlier refresh resumes [2.62ms]

src/mesh-review-refresh.test.ts:
(pass) review superseded refresh failure cannot replace authoritative resync [1.57ms]
(pass) superseded failure preserves a newer pending refresh [2.73ms]

src/stream.test.ts:
stream differential: 169 streams, 19929 schedules, zero divergences
(pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [6906.75ms]
(pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [8.04ms]

src/mesh.test.ts:
(pass) Mesh actions map to their typed action IDs and JSON inputs [1.44ms]
(pass) Mesh watch coalesces change bursts and never publishes an older revision [3.93ms]
(pass) Mesh watch forwards server errors and stops delivering after unsubscribe [0.09ms]
(pass) Mesh enrollment carries an explicit authenticated host binding [0.18ms]

src/mesh-review-continuation.test.ts:
(pass) review continuation stops after stop [1.31ms]
(pass) review continuation stops after forbidden [1.16ms]
(pass) review continuation stops after superseded [1.17ms]

src/mesh-pagination.test.ts:
(pass) list assembles bounded pages using the same filter [0.25ms]
(pass) a changed revision discards earlier pages before assembling its restart [0.11ms]
(pass) malformed continuation is refused: {"revision":1,"offset":0} [0.13ms]
(pass) malformed continuation is refused: {"revision":2,"offset":1} [0.02ms]
(pass) malformed continuation is refused: {"revision":1,"offset":2} [0.01ms]
(pass) watch never publishes a partial page; withdrawn=false [1.33ms]
(pass) watch never publishes a partial page; withdrawn=true [1.13ms]
(pass) a superseding equal-revision resync wins over pending page assembly [1.47ms]

src/mesh-review-resync.test.ts:
(pass) review watch applies same-revision authoritative resync [0.18ms]
(pass) authoritative resync keeps priority over an equal-revision pending list [1.39ms]

src/mesh-vectors.test.ts:
(pass) every shared Mesh action vector passes through the typed client unchanged [0.84ms]
(pass) shared Mesh event vectors drive the typed watch adapter [5.45ms]

 39 pass
 0 fail
 59970 expect() calls
Ran 39 tests across 10 files. [7.01s]
J12b exact-head `scripts/verify fast`, full verbatim output. Head `fa875f0b3733ef997b6299d55478b90173b4286b`. Exit status 0. Raw file also attached (asset 30779). <details><summary>complete fast gate output</summary> ```text ==> Repository artifact size gate repository artifact gate: PASS (190 changed path(s), merge base 65d9861914e8) ==> Release deployment functional checks .....Release build failed for aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa; gate log retained .Build deferred: host capacity limit reached ......... ---------------------------------------------------------------------- Ran 15 tests in 0.733s OK . ---------------------------------------------------------------------- Ran 1 test in 0.086s OK bun test v1.4.2 (744846f84) scripts/release/deploy-review.test.ts: REMOTE_ADMISSION unsigned_x86_payload=true refused=true (pass) remote admission refuses an x86 payload outside the signed manifest [281.91ms] {"state": "deployed", "ca_unlocked": true} WEB_ONLY_RECORD candidate_binary_recorded=false (pass) web-only deployment does not record the candidate as the running binary [321.20ms] ALIAS_RECOVERY restart_requests=2 (pass) alias restoration failure still requests the retained warm rollback [310.75ms] 3 pass 0 fail 3 expect() calls Ran 3 tests across 1 file. [921.00ms] PASS proxy_forwarding samples=3 timed=false ==> fmt (fmt: 4s) ==> VT native fmt (VT native fmt: 0s) ==> CLI plugin compile-out disabled CLI plugin dependencies: absent from normal dependency graph warning: function `print_progress` is never used --> crates/infraternal/src/cli/output.rs:597:8 | 597 | pub fn print_progress<T: Serialize>(result: &CommandResult<T>, json: bool, to_stderr: bool) { | ^^^^^^^^^^^^^^ | = note: `#[warn(dead_code)]` (part of `#[warn(unused)]`) on by default warning: `infraternal` (bin "infraternal" test) generated 1 warning Finished `test` profile [unoptimized + debuginfo] target(s) in 0.12s Running unittests src/main.rs (target/debug/deps/infraternal-fb404c5b2aff3832) running 37 tests test cli::actions::tests::agent_session_integration_target_is_gated_by_agent_plugin ... ok test cli::actions::default_build_tests::default_build_registers_no_unbuilt_command ... ok test cli::actions::key_memory_registry_tests::key_memory_diagnostic_follows_remote_feature ... ok test cli::actions::tests::every_registered_action_has_description_and_step_by_step_guidance ... ok test cli::actions::tests::hidden_session_shim_is_registered_to_its_runtime_handler ... ok test cli::actions::tests::no_default_plugins_register_no_component_commands ... ok test cli::actions::tests::server_only_dependencies_are_removed_with_server_plugin ... ok test cli::actions::tests::compiled_out_mesh_has_no_registered_commands ... ok test cli::command_tree::tests::compiled_out_plugin_has_no_help_or_parse_path ... ok test cli::command_tree::tests::node_build_omits_and_refuses_server_commands ... ok test cli::command_tree::tests::hidden_session_shim_parser_uses_the_registered_input_schema ... ok test cli::command_tree::tests::every_command_in_the_tree_takes_json ... ok test cli::command_tree::tests::skill_parser_accepts_a_multi_part_command_and_write_directory ... ok test cli::command_tree::tests::root_help_lines_fit_80_columns ... ok test cli::command_tree::tests::public_help_is_plain_words ... ok test cli::command_tree::tests::root_help_uses_registered_descriptions_and_long_action_guidance ... ok {"schema_version":1,"command":"x","ok":false,"state":"failed","message":"It broke.","next":[],"details":"because","error":{"code":"failed","detail":"because"},"data":{}} {"schema_version":1,"command":"x","ok":true,"state":"ready","message":"Done.","next":[],"data":{}} test cli::output::tests::json_is_one_line_with_stable_fields_and_omits_absent_ones ... ok test cli::output::tests::a_failure_says_why_and_what_to_do ... ok test cli::output::tests::finishing_a_command_stamps_ok_and_the_error_from_the_exit ... ok test cli::output::tests::exit_codes_follow_d303 ... ok test cli::output::tests::plain_text_answers_first_then_aligned_blocks_then_next ... ok test cli::output::tests::registered_action_output_schemas_accept_typed_json_envelopes ... ok test cli::output::tests::tables_omit_empty_columns_and_rows_and_single_rows_have_no_header ... ok test cli::command_tree::tests::unbuilt_placeholders_are_neither_shown_nor_parsed ... ok test cli::output::tests::a_body_replaces_the_generic_rendering_of_data ... ok test cli::usage::tests::missing_arguments_are_listed_by_name ... ok test cli::usage::tests::an_unknown_option_is_named_without_its_value ... ok test dispatch_tests::hidden_session_shim_dispatches_from_the_registered_action ... ok test cli::skills::tests::writing_skills_creates_one_file_per_visible_action ... ok test cli::usage::tests::a_wrong_command_names_only_a_plain_word ... ok test cli::output::tests::terminal_output_has_a_mark_and_colour_and_wraps_to_the_width ... ok test failure_data_tests::skill_errors_keep_the_registered_result_data_shape ... ok test failure_data_tests::unavailable_results_keep_registered_data_shapes ... ok test shim_cli::tests::spawned_decode_refuses_changes_to_the_fixed_shape_before_startup ... ok test shim_cli::tests::spawned_shapes_reuse_full_shim_options_and_defaults ... ok test startup_tests::process_dumpability_is_disabled_before_dispatch ... ok test cli::command_tree::tests::packaged_node_dependency_closure_omits_server_storage_and_release ... ok test result: ok. 37 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.38s Finished `test` profile [unoptimized + debuginfo] target(s) in 0.24s Running unittests src/main.rs (target/debug/deps/infraternal-8cd1e3fcf062a008) running 129 tests test cli::actions::tests::every_registered_action_has_description_and_step_by_step_guidance ... ok test cli::actions::tests::enabled_mesh_plugin_registers_its_component_commands ... ok test cli::actions::tests::hidden_ssh_session_bridge_is_registered_to_its_runtime_handler ... ok test cli::actions::tests::hidden_session_shim_is_registered_to_its_runtime_handler ... ok test cli::actions::tests::host_release_commands_are_available_without_creating_a_server ... ok test cli::actions::key_memory_registry_tests::key_memory_diagnostic_follows_remote_feature ... ok test cli::command_tree::tests::hidden_session_shim_parser_uses_the_registered_input_schema ... ok test cli::command_tree::backmerge_tests::removal_and_retention_inputs_keep_the_production_runtime_bindings ... ok test cli::command_tree::backmerge_tests::restart_inherits_private_state_before_or_after_the_command ... ok test cli::actions::tests::registered_actions_include_plugin_permission_contract_fields ... ok test cli::actions::factory_tests::plugin_command_materializes_only_its_owner_and_discovery_remains_complete ... ok test cli::actions::release_tests::server_commands_bind_release_without_losing_hosted_skills ... ok test cli::command_tree::tests::every_command_in_the_tree_takes_json ... ok test cli::command_tree::tests::hidden_ssh_session_action_parses_existing_session_rendezvous ... ok test cli::command_tree::tests::root_help_lines_fit_80_columns ... ok test cli::output::tests::a_body_replaces_the_generic_rendering_of_data ... ok test cli::output::tests::a_failure_says_why_and_what_to_do ... ok test cli::output::tests::exit_codes_follow_d303 ... ok test cli::output::tests::json_is_one_line_with_stable_fields_and_omits_absent_ones ... ok {"schema_version":1,"command":"x","ok":false,"state":"failed","message":"It broke.","next":[],"details":"because","error":{"code":"failed","detail":"because"},"data":{}} {"schema_version":1,"command":"x","ok":true,"state":"ready","message":"Done.","next":[],"data":{}} test cli::output::tests::finishing_a_command_stamps_ok_and_the_error_from_the_exit ... ok test cli::output::tests::plain_text_answers_first_then_aligned_blocks_then_next ... ok test cli::command_tree::tests::parser_uses_plugin_inputs_and_accepts_json_after_a_leaf_command ... ok test cli::output::tests::tables_omit_empty_columns_and_rows_and_single_rows_have_no_header ... ok test cli::output::tests::terminal_output_has_a_mark_and_colour_and_wraps_to_the_width ... ok test cli::output::tests::registered_action_output_schemas_accept_typed_json_envelopes ... ok test cli::skills::tests::generated_skill_contains_front_matter_inputs_outputs_and_safety ... ok test cli::actions::hosted_tests::production_descriptors_share_cli_registry_and_skills ... ok test cli::command_tree::tests::unbuilt_placeholders_are_neither_shown_nor_parsed ... ok test cli::usage::tests::a_wrong_command_names_only_a_plain_word ... ok test cli::command_tree::tests::server_init_parses_confirmation_plan_and_server_configuration ... ok test cli::usage::tests::missing_arguments_are_listed_by_name ... ok test embedded_cli::tests::dispatch_keeps_public_help_operator_modes_and_foreign_commands ... ok test component_cli::host_release_metadata_tests::host_release_cli_has_a_pure_presenter_without_installing_an_embedded_receiver ... ok test cli::usage::tests::an_unknown_option_is_named_without_its_value ... ok test cli::skills::tests::writing_skills_creates_one_file_per_visible_action ... ok test dispatch_tests::hidden_session_shim_dispatches_from_the_registered_action ... ok test failure_data_tests::server_errors_keep_the_registered_result_data_shapes ... ok test cli::command_tree::tests::root_help_uses_registered_descriptions_and_long_action_guidance ... ok test cli::command_tree::tests::skill_parser_accepts_a_multi_part_command_and_write_directory ... ok test generation_cli::tests::boot_configuration_round_trips_and_serves_from_the_generation_state ... ok test generation_cli::tests::boot_configuration_refuses_unknown_relative_or_oversized_input ... ok test failure_data_tests::skill_errors_keep_the_registered_result_data_shape ... ok test cli::command_tree::tests::public_help_is_plain_words ... ok test generation_cli::tests::trial_accepts_only_an_inherited_seqpacket_channel_and_closes_its_number ... ok test generation_cli::tests::generation_entries_are_recognized_only_with_their_exact_shape ... ok running 1 test test failure_data_tests::unavailable_results_keep_registered_data_shapes ... ok test generation_watchdog::tests::abandoned_armed_handoff_keeps_the_recovering_process_alive ... ok test generation_update::tests::staging_copies_a_bounded_private_set_and_authenticates_it_first ... ok test generation_watchdog::tests::candidate_exit_before_health_ends_supervision_without_selection ... ok test generation_watchdog::tests::frames_are_bounded_and_identifiers_strict ... ok test generation_watchdog::tests::health_for_another_candidate_is_refused_and_stopped ... ok test generation_watchdog::tests::health_from_the_live_candidate_commits_once_and_hands_it_the_installation ... ok test generation_watchdog::tests::closed_channel_before_health_stops_the_candidate ... ok test generation_watchdog::tests::predecessor_changed_during_trial_cannot_commit ... ok test generation_watchdog::tests::unarmed_watchdog_exits_when_preparation_is_cancelled ... ok test generation_watchdog::tests::unarmed_watchdog_is_joined_when_preparation_is_abandoned ... ok test generation_watchdog::tests::watchdog_death_ends_the_trial_and_releases_the_installation ... ok test host_update::tests::local_host_switches_refuse_foreign_and_unsafe_installation_state ... ok test install::tests::dry_run_prints_a_process_surviving_user_unit ... ok test install::tests::system_units_mark_the_scope_used_by_first_run_status ... ok test embedded_cli::tests::inherited_flags_keep_public_parser_validation_and_values ... ok test generation_watchdog::tests::refused_exec_stands_the_watchdog_down_without_stopping_the_recovering_service ... ok test remote::tests::join_dns_failure_reports_resolution_instead_of_generic_refusal ... ok test host_update::tests::local_host_switches_persist_and_invalidate_old_admission_epochs ... ok test remote::tests::local_identity_load_refuses_symlink_and_shared_file ... ok test remote::tests::join_refuses_the_same_host_id_from_another_server ... ok test remote::tests::oversized_or_invalid_invitation_fails_before_local_state_is_created ... ok test remote::tests::preparation_refuses_shared_and_symlinked_data_directories ... ok test remote::tests::ordinary_join_keeps_the_foreground_connection_default ... ok test remote::tests::publication_is_private_and_never_replaces_existing_identity ... ok test remote::tests::join_re_enrolls_for_a_moved_server_but_not_a_renamed_one ... ok test remote::tests::ssh_installation_can_enroll_before_starting_the_service ... ok test remote::tests::uid_and_privilege_mismatch_fails_before_key_generation ... ok test remote::tests::join_re_enrolls_the_same_hosts_identity_and_refuses_another_host ... ok test remote_server::tests::failed_cold_configuration_still_disposes_handoff_stdin ... ok test remote::tests::renewal_publication_replaces_only_certificate_and_preserves_private_metadata ... ok test remote_server::tests::missing_ca_refuses_before_database_or_listener_creation ... ok test remote::tests::replace_aborts_when_the_identity_changed_since_it_was_read ... ok test remote_server::tests::service_dry_run_preserves_remote_listener_and_private_trust_path ... ok test remote_server::tests::failed_restart_endpoint_does_not_prevent_http_serving ... ok test remote_server::tests::independent_review_remote_operator_commands_accept_json_output ... ok test remote_server::tests::remote_activation_is_explicit_and_ca_override_requires_listener ... ok test generation_update::tests::drained_copy_keeps_every_acknowledged_write_and_leaves_a_self_contained ... ok test remote_service::tests::successful_link_return_is_a_service_failure ... ok test generation_update::tests::historical_copy_keeps_the_snapshot_immutable_and_discards_later_authority_edits ... ok test cli::command_tree::tests::packaged_node_dependency_closure_omits_server_storage_and_release ... ok test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 128 filtered out; finished in 0.70s test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok test generation_watchdog::tests::health_deadline_stops_the_candidate_and_keeps_the_known_good_selection ... ok test restart::tests::early_hangup_is_queued_until_control_installs_its_handler ... ok test restart::tests::private_control_endpoint_cannot_be_stolen_or_created_by_a_client ... ok test restart::tests::private_path_prefix_cannot_authorize_a_parent_directory_escape ... ok test remote_service::tests::link_failure_does_not_wait_forever_for_blocking_work ... ok test remote_service::tests::polling_panic_reaches_bounded_shutdown ... ok test restart::tests::replacement_never_exports_to_a_general_purpose_binary ... ok test restart::tests::path_review::late_recovery_from_path_invocation_keeps_install_target ... ok test restart::tests::reload_reopens_install_path_when_the_running_inode_was_replaced ... ok test restart::tests::reviewer_fifo_replacement_is_refused_without_waiting_for_a_writer ... ok test restart::tests::root_owned_marked_target_requires_protected_root_parents ... ok test restart::tests::default_restart_opens_the_receiver_target_exactly_once ... ok test restart::tests::runtime_directory_symlinks_and_public_permissions_are_refused ... ok test restart::tests::real_fd_exec_pins_replacement_and_cold_rollback_uses_null_stdin ... ok test restart::tests::restart_requests_use_the_servers_binary_and_reject_untrusted_paths ... ok test restart::tests::restart_request_logs_kernel_peer_target_and_cold_outcome ... ok test restart_binary::audit_tests::symlink_parent_escape_and_writable_candidates_are_refused ... ok test restart::tests::cold_exec_with_closed_stdin_keeps_the_image_pinned_and_maps_null ... ok test restart_binary::audit_tests::unusable_admitted_image_keeps_the_existing_service_running ... ok test restart_binary::audit_tests::verification_twenty_megabytes ... ignored, optimized weighted 20 MiB signature and admission measurement test restart_binary::audit_tests::unsigned_or_tampered_replacement_is_refused_before_exec ... ok test restart_image::tests::snapshot_refuses_every_mutation_and_preserves_source_offset ... ok test server_data_resolution_tests::explicit_data_directory_wins_over_the_installed_service ... ok test server_data_resolution_tests::installed_service_data_directory_is_selected_when_no_override_is_given ... ok test server_data_resolution_tests::missing_install_uses_the_existing_default_directory ... ok test setup_token_tests::setup_token_command_reads_only_the_expected_socket_response ... ok test shim_cli::tests::spawned_decode_refuses_changes_to_the_fixed_shape_before_startup ... ok test shim_cli::tests::spawned_shapes_reuse_full_shim_options_and_defaults ... ok test ssh_internal::tests::connect_requires_exactly_a_host_and_numeric_port ... ok test ssh_internal::tests::connector_is_available_only_on_the_initiating_build ... ok test ssh_internal::tests::session_accepts_only_the_two_spawned_shapes ... ok test startup_tests::process_dumpability_is_disabled_before_dispatch ... ok test startup_tests::shared_reactor_preserves_borrows_errors_and_panic_cleanup ... ok test restart::tests::rootless_even_marked_replacement_is_cold_and_open_fd_pins_the_inode ... ok test restart_image::tests::probe_never_inherits_the_control_descriptor ... ok test restart::tests::deleted_path_review::relative_recovery_after_atomic_install_keeps_live_install_path ... ok test restart::tests::runtime_shutdown_never_waits_forever_on_a_blocking_waiter ... ok test restart::tests::closed_reply_and_missing_reload_target_do_not_end_restart_control ... ok test generation_update::tests::copy_refusals_abort_before_trial_and_leave_a_usable ... ok test restart_binary::audit_tests::admitted_inode_cannot_change_in_place_before_execution ... ok test restart_binary::audit_tests::pathname_replacement_keeps_the_admitted_inode ... ok test restart::recovery_tests::verified_exec_and_late_refusal_preserve_listener_and_ca ... ok test result: ok. 128 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 12.19s Finished `test` profile [unoptimized + debuginfo] target(s) in 0.14s Running unittests src/lib.rs (target/debug/deps/infraternal_agent-91a6a2a28aa23421) running 1 test test cli::tests::agent_actions_are_complete_and_unavailable_until_lifecycle_exists ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 92 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_mesh-de37f027424e663d) running 1 test test cli::tests::mesh_actions_are_complete_with_optional_ssh_connectivity ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_backup-61ccebc6320c477e) running 1 test test cli::tests::backup_actions_are_complete_and_unavailable_until_runtime_exists ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_relay-a3947e601fdae371) running 1 test test cli::tests::relay_actions_are_complete_and_unavailable_until_runtime_exists ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-865357dcee79bc13) running 1 test test cli::tests::ssh_actions_are_complete_and_marked_unavailable ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 46 filtered out; finished in 0.01s (CLI plugin compile-out: 13s) ==> clippy Checking infraternal-server v0.1.0 (/home/claude/worktrees/j12b/crates/infraternal-server) Finished `dev` profile [unoptimized + debuginfo] target(s) in 38.75s (clippy: 39s) ==> SSH runtime test helper Finished `dev` profile [unoptimized + debuginfo] target(s) in 0.24s (SSH runtime test helper: 1s) ==> real-binary fixture paths .... ---------------------------------------------------------------------- Ran 4 tests in 0.016s OK (real-binary fixture paths: 0s) ==> test Compiling infraternal-server v0.1.0 (/home/claude/worktrees/j12b/crates/infraternal-server) Finished `test` profile [unoptimized + debuginfo] target(s) in 1m 30s Running unittests src/main.rs (target/debug/deps/infraternal-25458fcc450f3d55) running 129 tests test cli::actions::key_memory_registry_tests::key_memory_diagnostic_follows_remote_feature ... ok test cli::actions::tests::host_release_commands_are_available_without_creating_a_server ... ok test cli::actions::tests::enabled_mesh_plugin_registers_its_component_commands ... ok test cli::actions::tests::every_registered_action_has_description_and_step_by_step_guidance ... ok test cli::actions::release_tests::server_commands_bind_release_without_losing_hosted_skills ... ok test cli::command_tree::tests::hidden_session_shim_parser_uses_the_registered_input_schema ... ok test cli::command_tree::tests::every_command_in_the_tree_takes_json ... ok test cli::command_tree::backmerge_tests::restart_inherits_private_state_before_or_after_the_command ... ok test cli::actions::tests::hidden_ssh_session_bridge_is_registered_to_its_runtime_handler ... ok test cli::command_tree::backmerge_tests::removal_and_retention_inputs_keep_the_production_runtime_bindings ... ok test cli::actions::tests::registered_actions_include_plugin_permission_contract_fields ... ok test cli::actions::factory_tests::plugin_command_materializes_only_its_owner_and_discovery_remains_complete ... ok test cli::actions::default_build_tests::default_build_registers_no_unbuilt_command ... ok test cli::command_tree::tests::parser_uses_plugin_inputs_and_accepts_json_after_a_leaf_command ... ok test cli::command_tree::tests::hidden_ssh_session_action_parses_existing_session_rendezvous ... ok test cli::output::tests::a_body_replaces_the_generic_rendering_of_data ... ok test cli::output::tests::a_failure_says_why_and_what_to_do ... ok test cli::command_tree::tests::root_help_lines_fit_80_columns ... ok test cli::output::tests::json_is_one_line_with_stable_fields_and_omits_absent_ones ... ok test cli::output::tests::plain_text_answers_first_then_aligned_blocks_then_next ... ok test cli::actions::tests::hidden_session_shim_is_registered_to_its_runtime_handler ... ok test cli::output::tests::exit_codes_follow_d303 ... ok {"schema_version":1,"command":"x","ok":false,"state":"failed","message":"It broke.","next":[],"details":"because","error":{"code":"failed","detail":"because"},"data":{}} {"schema_version":1,"command":"x","ok":true,"state":"ready","message":"Done.","next":[],"data":{}} test cli::output::tests::finishing_a_command_stamps_ok_and_the_error_from_the_exit ... ok test cli::command_tree::tests::public_help_is_plain_words ... ok test cli::command_tree::tests::server_init_parses_confirmation_plan_and_server_configuration ... ok test cli::output::tests::terminal_output_has_a_mark_and_colour_and_wraps_to_the_width ... ok test cli::usage::tests::a_wrong_command_names_only_a_plain_word ... ok test cli::usage::tests::an_unknown_option_is_named_without_its_value ... ok test cli::skills::tests::generated_skill_contains_front_matter_inputs_outputs_and_safety ... ok test cli::usage::tests::missing_arguments_are_listed_by_name ... ok test cli::output::tests::registered_action_output_schemas_accept_typed_json_envelopes ... ok test cli::output::tests::tables_omit_empty_columns_and_rows_and_single_rows_have_no_header ... ok test component_cli::host_release_metadata_tests::host_release_cli_has_a_pure_presenter_without_installing_an_embedded_receiver ... ok test embedded_cli::tests::dispatch_keeps_public_help_operator_modes_and_foreign_commands ... ok test cli::command_tree::tests::root_help_uses_registered_descriptions_and_long_action_guidance ... ok test cli::command_tree::tests::unbuilt_placeholders_are_neither_shown_nor_parsed ... ok test cli::command_tree::tests::skill_parser_accepts_a_multi_part_command_and_write_directory ... ok test failure_data_tests::unavailable_results_keep_registered_data_shapes ... ok test generation_cli::tests::generation_entries_are_recognized_only_with_their_exact_shape ... ok test generation_cli::tests::boot_configuration_refuses_unknown_relative_or_oversized_input ... ok test generation_cli::tests::boot_configuration_round_trips_and_serves_from_the_generation_state ... ok test dispatch_tests::hidden_session_shim_dispatches_from_the_registered_action ... ok test failure_data_tests::skill_errors_keep_the_registered_result_data_shape ... ok test generation_cli::tests::trial_accepts_only_an_inherited_seqpacket_channel_and_closes_its_number ... ok test generation_update::tests::staging_copies_a_bounded_private_set_and_authenticates_it_first ... ok test generation_watchdog::tests::abandoned_armed_handoff_keeps_the_recovering_process_alive ... ok running 1 test test generation_watchdog::tests::candidate_exit_before_health_ends_supervision_without_selection ... ok test generation_watchdog::tests::frames_are_bounded_and_identifiers_strict ... ok test generation_watchdog::tests::closed_channel_before_health_stops_the_candidate ... ok test generation_watchdog::tests::health_for_another_candidate_is_refused_and_stopped ... ok test embedded_cli::tests::inherited_flags_keep_public_parser_validation_and_values ... ok test generation_watchdog::tests::predecessor_changed_during_trial_cannot_commit ... ok test cli::skills::tests::writing_skills_creates_one_file_per_visible_action ... ok test failure_data_tests::server_errors_keep_the_registered_result_data_shapes ... ok test generation_watchdog::tests::health_from_the_live_candidate_commits_once_and_hands_it_the_installation ... ok test generation_watchdog::tests::unarmed_watchdog_exits_when_preparation_is_cancelled ... ok test generation_watchdog::tests::unarmed_watchdog_is_joined_when_preparation_is_abandoned ... ok test generation_watchdog::tests::watchdog_death_ends_the_trial_and_releases_the_installation ... ok test install::tests::dry_run_prints_a_process_surviving_user_unit ... ok test install::tests::system_units_mark_the_scope_used_by_first_run_status ... ok test host_update::tests::local_host_switches_refuse_foreign_and_unsafe_installation_state ... ok test generation_watchdog::tests::refused_exec_stands_the_watchdog_down_without_stopping_the_recovering_service ... ok test remote::tests::join_dns_failure_reports_resolution_instead_of_generic_refusal ... ok test remote::tests::join_refuses_the_same_host_id_from_another_server ... ok test remote::tests::local_identity_load_refuses_symlink_and_shared_file ... ok test remote::tests::ordinary_join_keeps_the_foreground_connection_default ... ok test remote::tests::oversized_or_invalid_invitation_fails_before_local_state_is_created ... ok test remote::tests::preparation_refuses_shared_and_symlinked_data_directories ... ok test host_update::tests::local_host_switches_persist_and_invalidate_old_admission_epochs ... ok test remote::tests::join_re_enrolls_for_a_moved_server_but_not_a_renamed_one ... ok test remote::tests::join_re_enrolls_the_same_hosts_identity_and_refuses_another_host ... ok test remote::tests::ssh_installation_can_enroll_before_starting_the_service ... ok test remote::tests::uid_and_privilege_mismatch_fails_before_key_generation ... ok test remote::tests::publication_is_private_and_never_replaces_existing_identity ... ok test remote_server::tests::failed_cold_configuration_still_disposes_handoff_stdin ... ok test remote_server::tests::failed_restart_endpoint_does_not_prevent_http_serving ... ok test remote_server::tests::missing_ca_refuses_before_database_or_listener_creation ... ok test remote_server::tests::remote_activation_is_explicit_and_ca_override_requires_listener ... ok test remote_server::tests::service_dry_run_preserves_remote_listener_and_private_trust_path ... ok test remote_server::tests::independent_review_remote_operator_commands_accept_json_output ... ok test remote::tests::renewal_publication_replaces_only_certificate_and_preserves_private_metadata ... ok test remote_service::tests::successful_link_return_is_a_service_failure ... ok test remote::tests::replace_aborts_when_the_identity_changed_since_it_was_read ... ok test generation_update::tests::drained_copy_keeps_every_acknowledged_write_and_leaves_a_self_contained ... ok test cli::command_tree::tests::packaged_node_dependency_closure_omits_server_storage_and_release ... ok test generation_update::tests::historical_copy_keeps_the_snapshot_immutable_and_discards_later_authority_edits ... ok test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 128 filtered out; finished in 0.62s test generation_update::tests::drained_entry_prepares_one_pointer_arms_the_watchdog_and_commits_on_health ... ok test restart::tests::early_hangup_is_queued_until_control_installs_its_handler ... ok test generation_watchdog::tests::health_deadline_stops_the_candidate_and_keeps_the_known_good_selection ... ok test restart::tests::private_control_endpoint_cannot_be_stolen_or_created_by_a_client ... ok test restart::tests::private_path_prefix_cannot_authorize_a_parent_directory_escape ... ok test remote_service::tests::link_failure_does_not_wait_forever_for_blocking_work ... ok test remote_service::tests::polling_panic_reaches_bounded_shutdown ... ok test restart::tests::replacement_never_exports_to_a_general_purpose_binary ... ok test restart::tests::path_review::late_recovery_from_path_invocation_keeps_install_target ... ok test restart::tests::default_restart_opens_the_receiver_target_exactly_once ... ok test restart::tests::reviewer_fifo_replacement_is_refused_without_waiting_for_a_writer ... ok test restart::tests::root_owned_marked_target_requires_protected_root_parents ... ok test restart::tests::reload_reopens_install_path_when_the_running_inode_was_replaced ... ok test restart::tests::runtime_directory_symlinks_and_public_permissions_are_refused ... ok test restart::tests::real_fd_exec_pins_replacement_and_cold_rollback_uses_null_stdin ... ok test restart::tests::restart_requests_use_the_servers_binary_and_reject_untrusted_paths ... ok test restart::tests::cold_exec_with_closed_stdin_keeps_the_image_pinned_and_maps_null ... ok test restart_binary::audit_tests::symlink_parent_escape_and_writable_candidates_are_refused ... ok test restart::tests::restart_request_logs_kernel_peer_target_and_cold_outcome ... ok test restart_binary::audit_tests::unusable_admitted_image_keeps_the_existing_service_running ... ok test restart_binary::audit_tests::verification_twenty_megabytes ... ignored, optimized weighted 20 MiB signature and admission measurement test restart_binary::audit_tests::unsigned_or_tampered_replacement_is_refused_before_exec ... ok test restart_image::tests::snapshot_refuses_every_mutation_and_preserves_source_offset ... ok test server_data_resolution_tests::explicit_data_directory_wins_over_the_installed_service ... ok test server_data_resolution_tests::installed_service_data_directory_is_selected_when_no_override_is_given ... ok test server_data_resolution_tests::missing_install_uses_the_existing_default_directory ... ok test setup_token_tests::setup_token_command_reads_only_the_expected_socket_response ... ok test shim_cli::tests::spawned_decode_refuses_changes_to_the_fixed_shape_before_startup ... ok test shim_cli::tests::spawned_shapes_reuse_full_shim_options_and_defaults ... ok test ssh_internal::tests::connect_requires_exactly_a_host_and_numeric_port ... ok test ssh_internal::tests::connector_is_available_only_on_the_initiating_build ... ok test ssh_internal::tests::session_accepts_only_the_two_spawned_shapes ... ok test startup_tests::process_dumpability_is_disabled_before_dispatch ... ok test startup_tests::shared_reactor_preserves_borrows_errors_and_panic_cleanup ... ok test restart::tests::rootless_even_marked_replacement_is_cold_and_open_fd_pins_the_inode ... ok test restart::tests::closed_reply_and_missing_reload_target_do_not_end_restart_control ... ok test restart::tests::deleted_path_review::relative_recovery_after_atomic_install_keeps_live_install_path ... ok test restart_image::tests::probe_never_inherits_the_control_descriptor ... ok test restart_binary::audit_tests::admitted_inode_cannot_change_in_place_before_execution ... ok test restart::tests::runtime_shutdown_never_waits_forever_on_a_blocking_waiter ... ok test restart_binary::audit_tests::pathname_replacement_keeps_the_admitted_inode ... ok test restart::recovery_tests::verified_exec_and_late_refusal_preserve_listener_and_ca ... ok test generation_update::tests::copy_refusals_abort_before_trial_and_leave_a_usable ... ok test result: ok. 128 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 10.18s Running tests/agent_daemon.rs (target/debug/deps/agent_daemon-310ae250182580e9) running 1 test test real_binary_preserves_input_and_output_across_24_abrupt_stops ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 33.69s Running tests/agent_queues.rs (target/debug/deps/agent_queues-fb844b642b243cfa) running 1 test test saturated_terminal_queues_preserve_every_byte_and_daemon_liveness ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 39.13s Running tests/agent_review.rs (target/debug/deps/agent_review-139a088f6597e3a1) running 8 tests test reaped_shim_exit_survives_credit_after_starvation_deadline ... ok test last_typist_selects_its_own_real_pty_dimensions ... ok test stalled_terminal_never_delays_control_or_sibling_dispatch ... ok test initial_attach_requires_explicit_credit_before_replay ... ok test retained_unwritten_input_survives_interleaved_ack_restart ... ok test two_writers_keep_independent_ack_and_exact_input_after_restart ... ok test local_session_counts_and_memory_refusals_follow_real_lifecycle ... ok test repeated_tiny_credit_pauses_preserve_shell_progress ... ok test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.78s Running tests/agent_sessions.rs (target/debug/deps/agent_sessions-54af51157c7587d4) running 4 tests test fixture_state::deep_root_keeps_real_sockets_private_and_cleans_up_on_drop ... ok test detached_shim_is_discovered_and_replays_from_the_last_observed_offset ... ok test latency_fixture_accepts_the_unsolicited_startup_inventory ... ok test restart_discovery_keeps_a_live_shim_and_drops_clean_exit_and_sigkill ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.85s Running tests/cli_envelope.rs (target/debug/deps/cli_envelope-d2a343ba0d781d22) running 8 tests test a_missing_server_is_not_found_exit_4 ... ok test status_exits_0_on_a_machine_with_nothing_installed ... ok test an_unknown_command_is_a_usage_envelope_that_does_not_echo_odd_input ... ok test bare_infraternal_is_the_overview_and_points_to_help ... ok test component_commands_fail_in_the_envelope_when_the_agent_is_not_there ... ok test status_exits_5_when_something_that_should_run_is_down ... ok test read_only_commands_answer_in_the_envelope ... ok test every_command_reports_a_usage_error_in_the_envelope_naming_the_argument ... ok test result: ok. 8 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.34s Running tests/cli_review.rs (target/debug/deps/cli_review-ef1c24e02ea22921) running 17 tests test a_dry_run_plan_keeps_its_line_breaks ... ok test a_group_with_one_command_says_so_in_the_singular ... ok test a_failing_command_in_json_mode_prints_exactly_one_envelope ... ok test a_missing_runtime_directory_is_not_called_a_bad_reply ... ok test no_compiled_python_is_tracked ... ok test a_usage_error_in_text_mode_does_not_echo_the_odd_input ... ok test an_unknown_skill_is_not_found_exit_4 ... ok test root_help_fits_80_columns ... ok test a_malformed_host_id_is_a_usage_error_exit_2 ... ok test root_help_lists_server_init ... ok test json_help_and_version_are_envelopes_too ... ok test a_dumb_terminal_gets_neither_colour_nor_marks ... ok test user_facing_text_never_says_agent_alone ... ok test status_is_not_down_when_the_service_manager_cannot_be_asked ... ok test a_subcommand_does_not_advertise_options_it_ignores ... ok test an_empty_no_color_is_ignored ... ok test ctrl_c_in_json_mode_ends_with_an_interrupted_envelope_and_exit_130 ... ok test result: ok. 17 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.83s Running tests/cli_review_r2.rs (target/debug/deps/cli_review_r2-dee3eec26bce7a83) running 11 tests test three_pages_preserve_order_and_only_the_final_cursor ... ok test a_paged_listing_is_still_one_envelope ... ok test status_text_does_not_call_an_unanswered_unit_not_running ... ok test an_unknown_skill_does_not_echo_what_was_typed ... ok test a_failed_later_page_emits_only_the_failure_envelope ... ok test a_later_runtime_handler_is_not_bypassed_by_the_interrupt_handler ... ok test usage_errors_under_json_are_one_envelope_and_exit_2 ... ok test help_and_version_under_json_are_one_envelope_and_exit_0 ... ok test a_mistyped_word_that_looks_like_a_token_is_not_echoed ... ok test ctrl_c_in_a_script_loop_stops_the_loop ... ok test ctrl_c_while_the_result_is_being_written_never_leaves_a_broken_line ... ok test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.01s Running tests/cli_review_r3.rs (target/debug/deps/cli_review_r3-26df53f57990ed19) running 4 tests test signal_fixture ... ok test a_pending_blocked_interrupt_emits_notice_and_terminates_by_sigint ... ok test a_pending_interrupt_during_final_output_preserves_result_and_sigint_status ... ok test inherited_ignored_sigint_stays_ignored_during_cli_output ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s Running tests/cli_review_r3_arguments.rs (target/debug/deps/cli_review_r3_arguments-cd5aa22ec36b5fca) running 1 test test inherited_fd_is_rejected_instead_of_ignored_by_remote_commands ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s Running tests/cli_sessions.rs (target/debug/deps/cli_sessions-fa0c3e0c997a60d4) running 7 tests test generated_sessions_skill_does_not_expose_the_private_list_cursor ... ok test sessions_never_accept_attach ... ok test sessions_read_requires_last_before_connecting ... ok test sessions_invalid_targets_have_usage_envelope_and_fix ... ok test literal_program_pipe_rejects_invalid_input_before_startup ... ok test sessions_commands_are_registered_and_have_generated_skills ... ok test saved_shell_automation_uses_an_owner_only_socket_directory ... ok test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.27s Running tests/idle_canary.rs (target/debug/deps/idle_canary-19c3b762e6c29083) running 1 test test one_hertz_wakeup_is_detected_past_the_legacy_half_second_window ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.11s Running tests/key_memory.rs (target/debug/deps/key_memory-9849bd2bae091d09) running 1 test test diagnostic_requires_locked_pages_and_supports_json_without_public_help ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s Running tests/remote_output.rs (target/debug/deps/remote_output-b21573144a7812bd) running 1 test test remote_refusal_matches_its_declared_cli_output ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/replay_size.rs (target/debug/deps/replay_size-36edce63d6e02425) running 1 test test replay_fences_report_pre_resize_geometry_across_viewers ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.53s Running tests/replay_size_review.rs (target/debug/deps/replay_size_review-1628616ffcee501e) running 1 test test adopted_raw_and_snapshot_replays_keep_pre_resize_geometry ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.08s Running tests/session_bounds_review.rs (target/debug/deps/session_bounds_review-0899089f32f63ead) running 1 test test attached_window_recovers_final_output_and_exit_after_shim_link_detaches ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.01s Running tests/session_exit_events.rs (target/debug/deps/session_exit_events-583999bf2a00d621) running 1 test test idle_daemon_discovers_unattached_and_adopted_shim_exit_without_requests ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.46s Running tests/session_retention.rs (target/debug/deps/session_retention-ff4e034d9f8c8fda) running 1 test test bounded_owned_exit_reconnects_as_ended_with_status ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.64s Running tests/setup_output.rs (target/debug/deps/setup_output-e0fd218c7b486c95) running 6 tests test unreadable_system_service_data_prints_one_sudo_command_line ... ok test setup_output_keeps_legacy_and_versioned_readers ... ok test setup_token_permission_hint_covers_a_private_socket_in_a_readable_directory ... ok test setup_token_finds_the_data_dir_from_a_system_service_without_flags ... ok test setup_token_reads_a_traversable_directory_without_listing_access ... ok test setup_token_discovers_a_service_installed_through_a_versioned_binary_symlink ... ok test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s Running tests/shim.rs (target/debug/deps/shim-199a435a9f7a2bb8) running 24 tests test disallowed_signal_only_disconnects_peer ... ok test double_fork_survives_parent_death ... ok test malformed_shared_successor_does_not_evict_the_live_shared_peer ... ok test detached_shell_exit_reaps_even_with_a_live_background_descendant ... ok test detached_shell_exit_reaps_shim_within_one_second ... ok test parked_shared_writer_does_not_stop_detached_pty_progress ... ok test independent_shared_writers_wait_for_the_same_global_queue ... ok test attached_backpressure_and_detached_progress ... ok test dropped_deferred_peers_release_slots_before_the_pty_drains ... ok test replacement_connection_and_malformed_limit ... ok test shared_writer_refusals_and_full_peer_limit_preserve_the_live_writer ... ok test delivered_exit_cannot_release_another_owning_window ... ok test real_shell_reconnect_resize_and_delivered_exit ... ok test fresh_shared_peer_negotiates_while_another_shared_input_is_deferred ... ok test shared_writer_coexists_and_replayed_input_is_written_once ... ok test writer_replacement_is_per_mode_and_fresh_ordinary_writers_stay_optional ... ok test shared_writer_restores_durable_geometry_after_another_writer_types ... ok test unowned_normal_exit_retires_promptly_and_records_status ... ok test owned_exit_releases_promptly_on_window_close ... ok active test user_scope_survives_parent_unit_stop ... ok test shared_input_waits_for_global_queue_space_without_losing_the_suffix ... ok test owned_exit_maximum_retires_with_status_even_with_an_unread_data_peer ... ok test legacy_output_subscription_unblocks_deferred_shared_input ... ok test ring_wrap_snapshot_repaints_real_vim ... ok test result: ok. 24 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.59s Running tests/ssh_askpass.rs (target/debug/deps/ssh_askpass-1f659a54851bb0ab) running 4 tests test encrypted_key_without_passphrase_never_prompts_on_a_controlling_terminal ... ignored, run under the disposable controlling-terminal harness test common::deep_scratch_fallback_is_private_short_and_owned ... ok test real_cli_askpass_refuses_unregistered_parent_and_cleans_helper ... ok test real_cli_unlocks_an_encrypted_synthetic_key_on_private_pipes ... ok test result: ok. 3 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 1.33s Running tests/ssh_connector_policy.rs (target/debug/deps/ssh_connector_policy-1cc966f4e059d4ca) running 1 test test connector_preserves_configured_bind_address_refusal ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 8.01s Running tests/status_restart.rs (target/debug/deps/status_restart-5436d652e5de306a) running 1 test test service_states_are_truthful_in_text_and_json ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.09s Running tests/user_host.rs (target/debug/deps/user_host-1d74198984b655c9) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/vt_credit.rs (target/debug/deps/vt_credit-ace287a28420d63f) running 1 test test unaffordable_repaints_park_until_sufficient_credit ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 19.81s Running tests/vt_reconnect.rs (target/debug/deps/vt_reconnect-18de3902538e2af8) running 1 test test snapshot_limits_never_close_live_reconnect ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 16.58s Running unittests src/lib.rs (target/debug/deps/infraternal_agent-c1440fea876b55cc) running 198 tests test automation::operations::tests::private_names_keep_the_existing_shape_and_strict_validation ... ok test automation::tests::cross_account_session_name_has_the_same_not_found_reply_as_absent ... ok test automation::operations::tests::read_last_line_keeps_a_trailing_blank_line ... ok test automation::tests::reply_decoder_keeps_additive_fields_and_refuses_malformed_fields ... ok test cli::tests::agent_actions_are_complete_and_unavailable_until_lifecycle_exists ... ok test daemon::gone_tests::scale_review::two_hundred_vanished_sessions_preserve_the_same_channel ... ignored, scale measurement; run alone under CPUWeight=10000 test daemon::authenticated_tests::authenticated_uid_refusal_precedes_state_and_io ... ok test automation::tests::caller_tree_is_kernel_derived_and_account_scoped ... ok test automation::tests::rejects_unknown_fields_types_bounds_and_path_names ... ok test daemon::readiness_tests::a_saturated_census_queue_cannot_establish_the_open_fence ... ok test daemon::census_retry_tests::full_control_lane_retries_retirement_census_on_capacity_without_requests ... ok test daemon::gone_tests::a_vanished_session_gets_a_final_close_and_the_channel_stays_up ... ok test daemon::readiness_tests::census_and_open_result_share_fifo_order ... ok test daemon::readiness_tests::control_precedes_bulk_without_reordering_snapshot_notice ... ok test daemon::readiness_tests::replay_complete_preserves_the_full_output_cursor_as_decimal ... ok test daemon::readiness_tests::replay_geometry_is_frozen_before_queued_resize_and_delayed_output ... ok test daemon::readiness_tests::replay_prefix_stops_at_the_shim_hello_head ... ok test daemon::readiness_tests::reply_lane_memory_at_1000_channels ... ignored, queue-only scale diagnostic; run alone without build/browser overlap, not whole-daemon memory test daemon::liveness_tests::terminal_probe_waits_for_the_shim_fence_and_keeps_stream_identity ... ok test daemon::liveness_tests::input_state_probe_preserves_written_ack_before_input ... ok test daemon::liveness_tests::input_state_probe_preserves_written_ack_after_input ... ok test daemon::readiness_tests::uninstall_handoff_runs_only_after_a_successful_real_socket_write ... ok test daemon::liveness_tests::detached_ping_preserves_written_ack_without_output_credit ... ok test daemon::readiness_tests::a_shut_down_peer_refuses_the_write_while_a_forked_copy_holds_it ... ok test daemon::liveness_tests::frozen_terminal_input_keeps_its_sequence_until_preparation_releases_it ... ok test daemon::readiness_exit_tests::ownership_eof_does_not_discard_private_terminal_output ... ok test daemon::readiness_tests::saturated_action_replies_preserve_connection ... ok test daemon::readiness_tests::saturated_ping_replies_preserve_connection ... ok test daemon::remote_tests::cancelling_remote_dispatch_retires_the_borrowed_authenticated_channel ... ok test daemon::remote_tests::authenticated_machine_exchange_releases_effect_only_after_written_reply ... ok test daemon::readiness_tests::fixture_fence_processes_messages_before_the_control_pong ... ok test daemon::session_commands::measurements::command_coordination_cost_against_existing_fifo ... ignored, release command coordination diagnostic, not end-to-end throughput; run without own build overlap test daemon::session_commands::reply_capacity_tests::full_reply_reservations_cannot_spend_keyboard_capacity ... ok test daemon::session_commands::reply_capacity_tests::sixteen_replies_and_eight_typing_commands_retain_their_order ... ok test daemon::session_commands::tests::credit_allowance_does_not_cross_ordered_command_barriers ... ok test daemon::session_commands::tests::credit_bursts_do_not_consume_ordered_input_capacity ... ok test daemon::session_commands::tests::input_and_resize_keep_their_shared_fifo_order_around_credit ... ok test daemon::session_commands::tests::probe_at_full_command_capacity_preserves_accepted_input ... ok test daemon::session_commands::tests::review_reply_at_full_command_capacity_preserves_accepted_input ... ok test daemon::session_commands::tests::zero_credit_is_idle_and_overflow_refuses_without_mutating_accounting ... ok test daemon::stream_memory_tests::terminal_stream_memory_at_200 ... ignored, weighted release measurement of 200 idle relay tasks test daemon::session_commands::tests::credit_above_one_wire_word_is_exact_and_idle_after_drain ... ok test daemon::terminal_events::tests::ordinary_exit_omits_retired_and_snapshot_sequences_stay_numeric ... ok test daemon::terminal_events::tests::census_uses_uuid_strings_and_replay_keeps_all_cursor_bits ... ok test daemon::remote_tests::reattach_dispatch_serves_while_another_runtime_holds_the_lifetime_lock ... ok test daemon::remote_tests::unnegotiated_machine_frame_never_reaches_enabled_feature ... ok test daemon::terminal_events::tests::reply_compatibility_notice_contains_only_session_identity ... ok test lifecycle::tests::window_ownership_and_process_identity_bound_live_counts ... ok test lifecycle::tests::directory_inode_changes_do_not_retire_the_same_process ... ok test daemon::remote_tests::wrong_enrolled_uid_is_refused_before_state_creation ... ok test lifecycle::tests::process_birth_parser_handles_command_bytes_and_numeric_bounds ... ok test plugin_control::local_owner_tests::lost_local_owner_reply_never_runs_its_restart_effect ... ok test plugin_control::shutdown_tests::shutdown_joins_an_entered_synchronous_callback_before_returning ... ok test plugin_control::shutdown_tests::shutting_down_an_unpolled_surface_never_constructs_its_plugins ... ok test plugin_control::local_owner_tests::local_owner_action_keeps_remote_refusal_and_runs_only_after_socket_write ... ok test plugin_control::tests::dropping_a_listener_does_not_unlink_a_replacement_file ... ok test lifecycle::tests::nondumpable_process_keeps_its_authenticated_lifetime ... ok test plugin_control::tests::empty_catalog_preserves_control_contract_without_an_os_worker ... ok test plugin_control::tests::admission_observes_the_same_plugin_settings_as_actions ... ok test plugin_control::recovery_tests::recovery_service_uses_existing_read_only_lock_without_local_socket_allocation ... ok test plugin_control::tests::retained_runtime_registry_keeps_lifetime_ownership_after_listener_abort ... ok test plugin_control::tests::local_public_actions_refuse_controls_and_active_socket_replacement ... ok test plugin_control::tests::retained_path_and_observed_transport_cross_the_lazy_worker ... ok test plugin_control::tests::synchronous_plugin_work_does_not_park_the_current_thread_reactor ... ok test process_exits::platform::tests::resource_failures_do_not_silently_disable_exit_tracking ... ok test plugins::host_release_metadata_tests::host_release_authorization_metadata_is_declared_without_a_default_receiver ... ok test plugin_control::tests::local_frame_reader_retains_fragmentation_and_refuses_trailing_frames ... ok test plugin_control::tests::worker_preserves_trusted_context_and_writer_owned_effect ... ok test process_exits_tests::shared_exit_queue_at_200_processes ... ignored, 200 live process lifetimes; run in a weighted benchmark scope test process_exits_tests::process_descriptor_is_cloexec_and_rejects_invalid_pid ... ok test relay::tests::attachment_has_no_implicit_output_or_snapshot_credit ... ok test process_exits_tests::exited_before_registration_is_not_a_live_registration ... ok test relay::tests::input_overlap_gap_and_restart_from_confirmed_offset ... ok test relay::tests::output_partial_credit_and_dedup ... ok test relay::tests::output_payload_move_measurement ... ignored, release ownership versus payload-copy measurement test relay::tests::overflowing_ranges_never_mutate_cursors ... ok test relay::tests::positive_insufficient_credit_arms_a_one_shot_deadline ... ok test relay::tests::returned_credit_cancels_starvation_and_state_has_no_payload_buffer ... ok test relay::tests::starvation_is_one_shot_and_snapshot_length_does_not_advance_sequence ... ok test relay::tests::expired_credit_resumes_retained_bytes_at_the_same_cursor ... ok test remote_client::controlled_tests::admitted_exec_transfers_runtime_ownership_without_an_unlock_window ... ok test remote_client::controlled_tests::inherited_runtime_ownership_refuses_an_unrelated_file_and_invalid_descriptor ... ok test process_exits::platform::tests::unavailable_kernel_has_no_timer_or_descriptor ... ok test remote_client::controlled_tests::controlled_offline_shutdown_unlinks_listener_and_retains_runtime_lock ... ok test remote_client::controlled_tests::stopping_before_first_poll_never_constructs_host_plugins ... ok test remote_client::dial_runtime::tests::owned_driver_clock_advances_with_its_timer_runtime ... ok test remote_client::controlled_tests::refused_exec_resume_keeps_the_same_runtime_owner ... ok test daemon::remote_tests::wrong_open_uid_is_rejected_while_control_remains_usable ... ok test remote_client::server_path::tests::a_future_mesh_lease_and_silent_cut_keep_their_port_reserved ... ok test process_exits_tests::shared_queue_detects_exit_and_does_not_repeat_or_retain_descriptors ... ok test remote_client::server_path::tests::a_latched_mesh_reply_wakes_retry_without_selecting_the_path ... ok test remote_client::server_path::tests::backed_discovery_ends_with_its_owned_session ... ok test remote_client::controlled_tests::read_only_runtime_never_advertises_persistent_certificate_renewal ... ok test remote_client::server_path::tests::backed_candidate_refusal_keeps_new_datagrams_on_mesh_discovery ... ok test remote_client::server_path::tests::backup_published_during_candidate_proof_keeps_enrolled_control_live ... ok test daemon::remote_tests::control_greeting_precedes_actions_and_odd_writers_are_refused ... ok test remote_client::server_path::tests::component_down_activates_the_warm_fallback_without_a_new_connection ... ok test remote_client::server_path::tests::component_down_keeps_its_reason_when_the_mesh_also_stops_answering ... ok test remote_client::server_path::tests::failed_control_worker_returns_to_retry_owner ... ok test remote_client::server_path::tests::healthy_mesh_path_is_never_declared_interrupted ... ignored, Timing assertion: run on the perf VM under the shared benchmark lock. test remote_client::server_path::tests::component_down_returns_the_live_connection_to_the_enrolled_address ... ok test remote_client::server_path::tests::candidate_proof_keeps_probing_after_its_first_packet_is_lost ... ok test remote_client::server_path::tests::invalid_mesh_hint_cannot_complete_fresh_path_proof ... ok test remote_client::server_path::tests::pending_enrolled_proof_does_not_hide_a_latched_mesh_hint ... ok test remote_client::server_path::tests::healthy_mesh_preserves_every_control_reply_on_the_admitted_connection ... ok test remote_client::server_path::tests::pending_enrolled_proof_does_not_hide_the_mesh_discovery_clock ... ok test remote_client::server_path::tests::backed_discovery_keeps_control_cancellation_and_udp_recovery_bounded ... ok test remote_client::server_path::tests::retained_mesh_proposal_connects_when_the_fallback_port_is_unavailable ... ok test remote_client::server_path::tests::review_silent_mesh_interruption_returns_to_fallback_within_local_reconnect_budget ... ignored, Run alone on the perf VM under the shared benchmark lock. test remote_client::server_path::tests::silent_mesh_handshake_keeps_the_shared_timeout_classification ... ok test remote_client::server_path::tests::unadvertised_path_proof_keeps_the_existing_enrolled_connection ... ok test remote_client::server_path::tests::dropped_return_replies_keep_the_admitted_connection ... ok test remote_client::server_path::tests::interrupted_mesh_is_retried_on_the_same_connection ... ok test remote_client::server_path::tests::returning_publishes_the_selected_path_before_its_proof_finishes ... ok test remote_client::server_path::tests::unnegotiated_backup_preserves_the_enrolled_retry_cooling ... ok test remote_client::server_path::tests::unavailable_credentials_do_not_end_server_link ... ok test automation::operations::tests::lists_500_sessions_across_bounded_pages_without_loss ... ok test remote_client::server_path::tests::proposed_mesh_moves_the_live_connection_and_a_silent_cut_returns_it ... ok test remote_client::supervisor::review_tests::six_hour_server_outage_keeps_one_retry_owner_with_bounded_attempts ... ok test remote_client::supervisor::tests::a_burst_then_a_stable_link_is_summarised_by_the_timer ... ok test remote_client::supervisor::tests::every_error_kind_and_successful_return_retries ... ok test remote_client::supervisor::tests::failed_attempt_cost_does_not_extend_the_retry_period ... ok test remote_client::supervisor::tests::healthy_link_has_no_watchdog_deadline ... ok test remote_client::supervisor::tests::link_close_notes_print_once_per_window_and_summarise_repeats ... ok test remote_client::supervisor::tests::watchdog_restarts_a_stalled_offline_attempt ... ok test remote_client::tests::capability_fixture_retries_a_port_held_by_the_other_transport ... ok test remote_client::server_path::tests::unanswered_mesh_address_keeps_the_live_connection ... ok test remote_client::tests::idle_timers::copy_cost::fresh_admission_accepts_dormant_replies_but_refuses_pending_recovery ... ok test remote_client::tests::idle_timers::copy_cost::fresh_copy_from_admission_at_one_thousand_transports ... ignored, Separate fresh-copy cohort on the perf VM under its shared benchmark lock. test remote_client::tests::idle_timers::copy_cost::mesh_probe_and_copy_cost_at_one_thousand_transports ... ignored, Optimized transport-only measurement on the perf VM under its shared benchmark lock. test remote_client::tests::idle_timers::copy_cost::physical_counters_include_both_source_paths ... ok test remote_client::tests::idle_timers::copy_cost::receive_diagnostic::monotonic_origin_bounds_fail_closed_without_losing_receive_receipts ... ok test remote_client::tests::idle_timers::copy_cost::receive_diagnostic::receive_diagnostic_counts_gro_and_only_fixed_sampled_ports ... ok test remote_client::tests::idle_timers::copy_cost::receive_diagnostic::receive_diagnostic_gap_bins_have_explicit_bounds ... ok test remote_client::tests::idle_timers::copy_cost::runtime_configuration_trial_at_one_thousand_transports ... ignored, Explicit runtime scheduling control on the perf VM; ordinary runtime and guards unchanged. test remote_client::tests::idle_timers::copy_cost::socket_configuration_trial_at_one_thousand_transports ... ignored, Explicit socket-configuration diagnostic on the perf VM; ordinary scale gates stay unchanged. test remote_client::tests::idle_timers::copy_cost::udp_drop_receipt_counts_only_owned_live_sockets ... ok test remote_client::tests::idle_timers::mesh_idle_timer_cost_at_one_thousand_connections ... ignored, Release-only perf VM measurement under the shared benchmark lock. test remote_client::server_path::tests::untrusted_server_on_the_mesh_address_never_takes_the_connection ... ok test remote_client::tests::prefixed_control_keeps_coalesced_suffix_and_suppresses_only_its_greeting ... ok test remote_client::tests::rootless_uid_mismatch_is_refused_before_dial ... ok test remote_client::tests::raw_tcp_control_preserves_mux_envelopes_and_buffered_suffix ... ok test remote_client::tests::supervisor_300ms_quic_and_blocked_udp_fallback ... ignored, supervisor establishment diagnostic; run alone without builds or browsers test remote_client::supervisor::review_tests::terminated_factory_is_replaced_without_overlapping_live_workers ... ok test remote_client::tests::tcp_proxy_preserves_spacing_between_packets_already_in_flight ... ok test remote_client::tests::tcp_winner_cancels_silent_udp_drivers_without_waiting_for_drain ... ok test remote_client::tests::server_path_capability_is_advertised_on_native_and_fallback_transports ... ok test remote_client::tests::delayed_proxy_keeps_replies_bound_to_the_original_udp_client ... ok test daemon::readiness_tests::the_unhealthy_handoff_case_survives_concurrent_spawns ... ok test remote_cursor::tests::exact_unsigned_cursor_and_whole_object_are_required ... ok test remote_native_tests::bound_writer_uses_raw_frames_and_rejects_cross_writer_transmit ... ok test remote_native_tests::control_must_be_host_initiated_stream_zero_and_terminal_halves_cannot_impersonate_it ... ok test remote_client::tests::unavailable_local_credentials_retry_without_creating_state ... ok test remote_client::tests::unavailable_udp_does_not_add_seconds_before_tcp_admission ... ok test remote_native_tests::primed::negotiated_connection_keeps_unmarked_new_writers_ordinary ... ok test remote_native_tests::primed::ordinary_native_writer_refuses_the_additive_cursor_request ... ok test remote_native_tests::partial_native_write_cancellation_retires_both_directions ... ok test remote_native_tests::primed::prime_marker_is_canonical_and_requires_negotiated_permission ... ok test remote_native_tests::terminal::gone_review::retired_native_session_delivers_saved_status_then_final_close_before_retirement ... ok test remote_native_tests::primed::primed_writer_acknowledges_before_reading_credit_funded_cursor ... ok test remote_native_tests::terminal::credits::private_credit_burst_waits_for_its_shim_without_retiring_native_stream ... ok test remote_native_tests::terminal::gone_review::retiring_native_handshake_preserves_final_answer_with_inflight_commands ... ok test remote_native_tests::terminal::gone_review::vanished_native_session_delivers_final_close_before_stream_retirement ... ok test remote_native_tests::terminal::real_pty_resumes_native_writer_after_25_connection_replacements ... ignored, real CLI/shim oracle; set INFRATERNAL_TEST_BINARY and run alone under CPUWeight10000 test remote_client::server_path::tests::component_down_proves_tcp_fallback_when_enrolled_udp_is_unavailable ... ok test sessions::tests::borrowed_reader_payload_uses_reusable_cancel_safe_storage ... ok test sessions::tests::cancelled_fragmented_shim_read_retains_header_and_body_progress ... ok test sessions::tests::ordinary_native_writer_negotiates_queue_backpressure_without_shared_selection ... ok test sessions::tests::bounds::discovery_recovers_more_than_128_authenticated_sockets ... ok test sessions::tests::reader_borrow_measurement ... ignored, release borrowed versus owned asynchronous receive measurement test sessions::tests::refused_socket_is_removed_but_insecure_directory_is_rejected ... ok test sessions::tests::sequenced_attach_intersects_caps_and_legacy_attach_stays_zero ... ok test sessions::tests::shared_writer_helper_negotiates_before_sending_its_selector ... ok test sessions::tests::symlink_state_cannot_redirect_private_runtime_storage ... ok test startup_guard::tests::discovery_never_edits_and_exec_is_guarded_in_place ... ok test startup_guard::tests::guard_works_for_shell_variants_and_does_not_rewrite_compound_text ... ok test startup_guard::tests::helper_output_keeps_response_and_exit_status_bounds ... ok test sessions::tests::post_listen_chmod_wakes_a_connection_refused_at_bind ... ok test startup_guard::tests::real_shell_guards_keep_strict_startup_alive_and_manual_invocation_available ... ignored, requires Nix bash, zsh, fish, tmux and zellij; run the D315 shell matrix explicitly test startup_guard::tests::refuses_symlinks_parent_traversal_and_forged_proposals ... ok test remote_client::tests::tcp_proxy_flushes_bounded_flood_before_half_close ... ok test startup_guard::tests::stale_apply_and_ambiguous_undo_leave_files_untouched ... ok test transport::remote_deadline_tests::queued_suffix_cannot_complete_an_expired_cancelled_frame ... ok test startup_guard::tests::inherited_acl_is_refused_without_changing_the_original ... ok test remote_client::tests::winning_quic_drops_the_unfinished_tls_dial_before_control_dispatch ... ok test transport_diagnostics::quic_300ms_and_1000_connection_pairs ... ignored, diagnostic only; run alone without build or browser overlap test transport_diagnostics::quic_bulk_50m_exact_bytes ... ignored, size investigation diagnostic; run alone without build or browser overlap test transport_diagnostics::quic_bulk_50m_kernel_latency ... ignored, Exact 50MiB kernel-latency control on the perf VM in an owned network namespace. test transport_diagnostics::tcp_300ms_and_1000_connection_pairs ... ignored, diagnostic only; run alone without build or browser overlap test transport::remote_deadline_tests::remote_partial_frame_deadline_survives_receive_cancellation ... ok test transport::remote_deadline_tests::coalesced_partial_suffix_keeps_its_arrival_deadline ... ok test transport::remote_deadline_tests::wholly_idle_remote_channel_has_no_frame_expiry ... ok test remote_native_tests::terminal::gone_review::retired_native_status_bounds_final_reply_drain_for_a_stuck_peer ... ok test remote_native_tests::terminal::gone_review::vanished_native_session_bounds_final_reply_drain_for_a_stuck_peer ... ok test remote_client::supervisor::review_tests::durable_state::acknowledged_network_access_survives_superseded_worker_completion ... ok test daemon::remote_tests::silent_authenticated_peer_has_a_greeting_deadline ... ok test remote_client::supervisor::review_tests::watchdog_bounds_workers_when_local_path_discovery_stalls ... ok test plugin_control::tests::accepted_public_transaction_outlives_the_framing_deadline ... ok test result: ok. 177 passed; 0 failed; 21 ignored; 0 measured; 0 filtered out; finished in 11.40s Running tests/transport.rs (target/debug/deps/transport-4502ae5111e1f5af) running 3 tests test oversized_header_and_truncated_frame_are_rejected ... ok test replacing_the_callers_descriptor_cannot_redirect_registered_io ... ok test fragmented_headers_coalesced_frames_and_reusable_transmit ... ok test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running unittests src/lib.rs (target/debug/deps/infraternal_mesh-a04b5a96f95d79a2) running 1 test test cli::tests::mesh_actions_are_complete_with_optional_ssh_connectivity ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/default_arrow.rs (target/debug/deps/default_arrow-7639d45879e9a75b) running 1 test test omitted_arrow_ports_default_to_all_services ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/properties.rs (target/debug/deps/properties-c6a9f9dc8cc13f8c) running 14 tests test exhausted_versions_reject_mutations_without_changing_state ... ok test overlaps_are_reported_without_silent_range_changes ... ok test directional_grants_union_and_minimal_updates ... ok test join_to_same_tag_grants_both_initiation_directions ... ok test names_versions_and_backend_status ... ok test checkpoint_after_suffix_change_restores_without_reallocating_addresses ... ok test arrow_replacement_is_atomic_and_unrelated_nodes_keep_their_versions ... ok test public_checkpoint_preserves_addresses_rules_versions_and_overlap ... ok test private_material_never_enters_debug_or_coordination_serialization ... ok test rotation_waits_for_overlap_and_delivery_and_removal_drops_every_key ... ok test server_rotation_has_continuous_keys_for_every_node_during_delivery ... ok test protocol_port_unions_never_grant_an_unlisted_service ... ok test addresses_are_unique_stable_and_not_recycled ... ok test seeded_random_sequences_equal_full_compile_and_deny_without_grants ... ok test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 6.50s Running tests/rotation_time.rs (target/debug/deps/rotation_time-66d8934728f4dce0) running 1 test test unrepresentable_rotation_overlap_rejects_before_mutation ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_api-1006a5db3e014a93) running 60 tests test action::tests::any_of_permissions_are_machine_readable_and_empty_authority_is_rejected ... ok test action::tests::registry_keeps_plugin_ownership_and_exact_command_paths ... ok test action::tests::registry_rejects_inconsistent_json_schemas ... ok test action::tests::command_result_schema_has_required_stable_fields_and_optional_next_step ... ok test action::tests::command_result_schema_keeps_action_data_typed_inside_stable_envelope ... ok test activity::tests::enabling_observation_starts_fresh_and_tracks_existing_handshakes ... ok test action::tests::registry_rejects_missing_action_guidance_and_command_collisions ... ok test action::tests::only_hidden_internal_routes_may_use_the_reserved_prefix ... ok test activity::tests::input_and_cancelled_connections_postpone_quiet_work ... ok test host_name::tests::addresses_and_hostnames_give_a_machine_name ... ok test host_name::tests::numeric_invalid_and_unnamed_inputs_give_no_name ... ok test host_name::tests::odd_and_overlong_hostnames_give_no_name ... ok test admission::tests::memory_refusal_round_trips_without_losing_legacy_error ... ok test local_actions_tests::local_owner_dispatch_obeys_trial_readiness_before_preparing_any_effect ... ok test local_actions_tests::local_owner_presentation_can_follow_only_a_public_status_read ... ok test component_tests::destructive_actions_require_a_dry_run_and_every_action_has_instructions ... ok test local_actions_tests::owner_action_is_local_only_and_retains_writer_owned_effects ... ok test machine_tests::machine_dispatch_refuses_disabled_or_ambiguous_handlers_before_effects ... ok test machine_tests::machine_update_capability_is_disjoint_from_transport_capabilities ... ok test node_recovery_tests::recovery_defers_route_restore_link_context_and_observation_callbacks ... ok test activity::tests::interrupted_fences_wake_retained_input_and_attach_without_polling ... ok test node_recovery_tests::recovery_refuses_later_registration_of_a_mutating_plugin ... ok test owned_io::tests::cold_image_io_also_works_on_a_current_thread_runtime ... ok test machine_tests::machine_dispatch_bounds_both_input_and_plugin_reply ... ok test present::tests::a_table_has_a_header_only_from_two_rows ... ok test node_recovery_tests::recovery_keeps_safe_reads_but_refuses_writes_terminal_open_and_machine_work ... ok test node_recovery_tests::recovery_retires_plugins_that_did_not_opt_into_read_only_before_any_callback ... ok test present::tests::a_table_fits_its_width_by_wrapping_only_the_last_column ... ok test component_tests::component_declarations_cannot_create_servers ... ok test present::tests::pairs_align_values_and_wrap_under_them ... ok test present::tests::sizes_and_ages_use_units_a_person_would_say ... ok test present::tests::tint_wraps_text_after_padding_is_measured ... ok test present::tests::wide_leading_columns_are_cut_with_an_ellipsis ... ok test release_manifest::tests::noncanonical_or_cross_channel_identity_is_refused ... ok test release_verify::tests::compiled_authorities_keep_production_and_isolate_staging ... ok test owned_io::tests::image_io_keeps_control_progress_and_abort_join_owns_its_completion ... ok test release_verify::tests::verification_twenty_megabytes_fifty_runs ... ignored, run release-profile measurements in a weighted scope test release_version::tests::accepts_only_worker_version_forms ... ok test release_verify::tests::per_run_signature_obeys_the_compiled_feature_boundary ... ok test routing::tests::topic_is_borrowed_and_other_filter_fields_are_left_to_the_plugin ... ok test routing::tests::invalid_or_oversized_topics_are_refused ... ok test runtime_gate_tests::trial_runtime_gate_defers_route_restore_and_observation_callbacks ... ok test local_actions_tests::local_owner_metadata_cannot_alias_a_remotely_declared_action ... ok test release_version::tests::ordered_updates_never_compare_stable_numbers_lexically_or_overflow ... ok test runtime_gate_tests::trial_runtime_gate_keeps_private_health_check_in_available ... ok test storage::tests::writer_begin_at_1000_nodes ... ignored, Measure only on the perf VM under its benchmark lock, 31 batches of 1000 writes. test server_path::tests::legacy_link_omits_the_optional_source_port ... ok test tests::machine_actions_are_declared_without_entering_human_discovery ... ok test runtime_gate_tests::trial_runtime_gate_refuses_public_and_control_actions_before_callbacks ... ok test tests::operator_presentation_cannot_follow_a_private_control_action ... ok test tests::registry_rejects_oversized_json_before_plugin_dispatch ... ok test tests::public_dispatch_cannot_call_a_machine_control_action ... ok test tests::notifications_are_declared_json_bounded_and_drained_once ... ok test tests::registry_routes_only_declared_actions ... ok test activity::tests::exclusive_admission_closes_the_idle_check_race_and_recovers_on_drop ... ok test tests::deferred_plugin_effect_waits_for_successful_reply_and_drops_on_cancellation ... ok test storage::tests::cancelled_begin_never_leaves_an_open_writer_transaction ... ok test release_verify::tests::openssh_signatures_preserve_descriptor_and_reject_every_byte_mutation ... ok test release_verify::tests::trust_namespace_hash_trailing_data_and_manifest_ambiguity_are_refused ... ok test release_manifest::tests::signed_identity_and_exact_bytes_are_required ... ok test result: ok. 58 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.11s Running tests/routing_review.rs (target/debug/deps/routing_review-a11d1d83d5553d48) running 2 tests test review_topic_borrows_plain_and_owns_escaped ... ok test review_topic_refuses_oversize_duplicate_and_deep_input ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_backup-8dfda7c124aad611) running 1 test test cli::tests::backup_actions_are_complete_and_unavailable_until_runtime_exists ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_canvas-c0d30dbb16e448be) running 15 tests test model::tests::graph_pin_coordinates_include_both_limits_but_refuse_the_next_integer ... ok test model::tests::host_id_requires_canonical_lowercase_hyphenated_text ... ok test model::tests::reference_document_has_strict_shape_and_bounds ... ok test reducer::tests::nullable_resize_preserves_existing_values_and_absent_fields ... ok test model::tests::session_name_pin_is_optional_and_boolean ... ok test reducer::tests::view_metadata_targets_and_column_neighbours_are_semantic ... ok test reducer::tests::sample_corpus_preserves_strict_variant_fields_and_round_trips ... ok test reducer::tests::concurrent_builtin_view_creation_preserves_existing_contents ... ok test socket::tests::descriptor_declares_server_only_actions_and_strict_subscription ... ok test socket::tests::session_binding_accepts_json_string_escapes ... ok test reducer::tests::split_divides_only_its_own_band ... ok test socket::tests::result_json_preserves_both_wire_shapes ... ok test socket::tests::ordinary_session_binding_borrows_and_escaped_binding_decodes_identically ... ok test reducer::tests::repeated_open_close_does_not_exhaust_column_capacity ... ok test reducer::tests::independent_edits_commute_and_close_wins_in_both_orders ... ok test result: ok. 15 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_host_facts-0bba384e60ab6feb) running 14 tests test memory::tests::custom_policy_rounds_up_and_validates_all_settings_before_use ... ok test tests::descriptor_declares_default_settings_actions_and_no_hidden_role_dependency ... ok test tests::linux_load_average_text_ignores_proc_metadata_and_rejects_invalid_values ... ok test tests::os_release_uses_distribution_name_and_version_without_shell_evaluation ... ok test session_counts_tests::host_owned_session_counts_are_additive_and_refresh_on_request ... ok test tests::action_decoders_reject_unknown_and_oversized_fields ... ok test tests::runtime_disable_drops_cached_facts_and_reenable_collects_them_again ... ok test tests::macos_load_average_decodes_the_bounded_64_bit_sysctl_shape ... ok test tests::compatibility_fields_are_kept_in_the_rust_shape_and_architecture_on_wire ... ok test tests::os_release_parser_rejects_unbounded_input_and_ignores_untrusted_lines ... ok test tests::static_facts_report_the_machines_hostname ... ok test tests::static_facts_are_cached_and_live_counters_are_collected_only_when_requested ... ok test memory::tests::default_floor_refuses_only_below_headroom_even_above_128_sessions ... ok test tests::configured_memory_floor_refuses_with_current_host_counters ... ok test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_mesh-6802892557379433) running 76 tests test firewall::tests::already_removed_owned_table_does_not_block_component_cleanup ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test firewall::tests::initial_apply_without_adoption_refuses_a_foreign_table ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test firewall::tests::real_nft_ownership_atomicity_and_scaled_apply ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test connection_state::tests::narrowing_depends_on_services_and_direction_not_the_fallback_label ... ok test iptables::tests::real_nf_tables_ownership_partial_family_and_scaled_apply ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test access_updates::tests::malformed_ranges_refuse_before_any_rule_changes ... ok test iptables::tests::initiating_prefixes_cover_only_owned_intervals_even_at_family_boundaries ... ok test access_updates::tests::grouping_never_crosses_an_unchanged_protected_peer ... ok test iptables::tests::replacement_retains_established_rules_and_does_not_duplicate_hooks ... ok test access_updates::tests::compact_rules_reconstruct_the_exact_config_and_preserve_server_access ... ok test netlink::tests::malformed_lengths_and_padding_are_rejected ... ok test netlink::tests::nested_attributes_roundtrip_without_copying_payloads ... ok test netlink::tests::host_prefix_decoder_refuses_ambiguous_or_malformed_ownership ... ok test node::rotation_tests::nf_tables_restart_fences_retained_replacement_address ... ignored, Run in a disposable user/network namespace, #173. test node::rotation_tests::nft_restart_fences_retained_replacement_address ... ignored, Run in a disposable user/network namespace, #173. test access_updates::tests::identity_changes_and_snapshots_keep_the_original_encoding ... ok test node::tests::chunked_snapshot_is_atomic_and_applies_1000_kernel_peers ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN; use release for timing. test netlink::tests::public_host_prefixes_decode_both_families_without_claiming_subnets ... ok test node::tests::explicit_up_recovers_disabled_intent_before_reusing_identity ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test node::tests::externally_removed_interface_does_not_block_down ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test node::tests::server_identity_cannot_change_inside_a_staged_snapshot ... ok test node_actions::identity_upgrade_tests::ordinary_identity_reply_retains_the_legacy_shape ... ok test netlink::tests::connection_tuple_uses_initiating_service_and_refuses_ambiguous_selectors ... ok test node_actions::peer_page_tests::poll_cost ... ignored, measurement test node_actions::tests::applied_server_route_and_observed_link_survive_only_explicit_component_up ... ignored, Run inside a dedicated kernel namespace with CAP_NET_ADMIN. test node_actions::tests::failed_cleanup_reports_stopping_and_reconnect_keeps_explicit_off ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test node_actions::tests::node_actions_refuse_alternate_forms_duplicates_and_unbounded_input ... ok test node_actions::tests::node_actions_register_without_kernel_work_and_hide_machine_calls ... ok test firewall::tests::removal_plan_cannot_add_permissions_or_change_identity ... ok test iptables::tests::contiguous_open_members_use_ranges_without_opening_gaps ... ok test node_coordination::tests::refused_listener_replacement_preserves_the_current_lease ... ok test firewall::tests::rule_count_is_independent_of_membership_and_policy_data_is_in_sets ... ok test node_actions::peer_page_tests::peer_pages_cover_every_peer_once_within_the_frame ... ok test node_coordination::tests::a_reported_hostname_names_a_host_added_by_address ... ok test node_coordination::tests::explicit_off_waits_for_up_and_reconnect_requests_a_snapshot ... ok test node_presentation::tests::a_wide_table_stays_within_the_width ... ok test node_presentation::tests::an_unproven_peer_gets_a_hint_that_names_it ... ok test node_presentation::tests::legacy_status_remains_readable_and_invalid_link_is_refused ... ok test node_presentation::tests::peers_show_units_ages_and_no_hint_when_every_path_is_direct ... ok test node_state::order_tests::accepted_snapshot_persistence_at_1000_peers ... ignored, Run release on the locked performance VM; public-state persistence at 1000 peers. test node_presentation::tests::status_explains_the_observed_server_transport ... ok test node_state::order_tests::exact_legacy_binding_upgrade_preserves_the_revision_fence ... ok test node_state::order_tests::explicit_off_can_replace_a_corrupt_public_snapshot ... ok test node_state::order_tests::stale_and_conflicting_snapshots_cannot_replace_acknowledged_intent ... ok test node_coordination::tests::legacy_host_daemon_and_ip_record_do_not_leave_a_uuid_mesh_name ... ok test node_coordination::tests::peer_route_precedes_configuration_and_retires_with_the_node ... ok test node_state::restore_tests::public_state_restore_at_1000_peers ... ignored, Run only on the perf VM under its lock; INFRATERNAL_STATE_RESTORE_MODE=reader|slice, separate processes. test node_state::restore_tests::restore_rejects_invalid_schema_trailing_data_and_unsafe_descriptors ... ok test node_state::tests::explicit_off_survives_restart_and_snapshot_contains_only_public_fields ... ok test node_state::tests::route_recording_preserves_the_legacy_accepted_state_format ... ok test node_state::tests::unsafe_route_journal_and_existing_temporary_files_are_preserved ... ok test node_state::tests::unsafe_snapshots_and_preexisting_temporary_files_are_not_followed_or_removed ... ok test presence::tests::a_mesh_that_is_off_shows_nobody_online ... ok test presence::tests::a_page_cursor_is_followed ... ok test presence::tests::a_reading_expires_when_the_node_stops_answering ... ok test presence::tests::a_recent_handshake_is_online_on_a_direct_path ... ok test presence::tests::an_unreadable_node_is_no_reading ... ok test presence::tests::no_handshake_a_stale_one_or_a_future_one_is_offline ... ok test presence::tests::nodes_go_offline_twenty_seconds_after_the_last_good_reading ... ok test presence::tests::receiving_a_keepalive_does_not_shorten_the_session_window ... ok test presence::tests::replace_reports_only_visible_changes ... ok test presence::tests::the_edge_of_the_session_window_is_still_online ... ok test node_coordination::tests::a_name_a_person_chose_is_kept ... ok test presence::tests::traffic_proves_a_session_until_it_ends ... ok test presence::tests::the_server_and_a_peer_passing_traffic_are_online ... ok test settings::tests::settings_objects_are_bounded_and_strict_before_storage ... ok test store::naming_tests::a_numeric_or_invalid_address_gives_no_name ... ok test store::naming_tests::an_address_or_hostname_gives_the_machines_name ... ok test node_coordination::tests::placeholder_names_become_the_machines_names ... ok test node_coordination::tests::server_listener_belongs_to_applied_enabled_worker ... ok test node_coordination::tests::removed_binding_can_attach_only_after_authorized_reenrollment ... ok test node_coordination::tests::refused_delta_recovers_immediately_and_closed_channel_retires_worker ... ok test node_state::order_tests::concurrent_workers_serialize_revision_check_and_publication ... ok test node_coordination::tests::two_hosts_reporting_the_same_hostname_receive_distinct_names ... ok test node_state::order_tests::worker_start_stop_apply_interleavings_never_decrease_acknowledged_revision ... ok test node_state::restore_tests::public_restore_retains_large_intent_and_matches_reader ... ok test result: ok. 62 passed; 0 failed; 14 ignored; 0 measured; 0 filtered out; finished in 0.95s Running tests/access_updates.rs (target/debug/deps/access_updates-6c0b75916bade2fb) running 8 tests test nf_tables_compact_delta_preserves_identity_and_refuses_invalid_bases ... ignored, Run in an isolated user/network namespace with CAP_NET_ADMIN. test nft_compact_delta_preserves_identity_and_refuses_invalid_bases ... ignored, Run in an isolated user/network namespace with CAP_NET_ADMIN. test ordinary_up_and_identity_keep_the_legacy_reply_shape ... ignored, requires an isolated user/network namespace test compact_identity_support_requires_an_explicit_strict_probe ... ok test range_objects_reject_unknown_duplicate_and_positional_fields ... ok test default_tightening_at_1000_peers_fits_one_round_trip ... ok test negotiated_access_chunk_is_accepted_by_the_strict_action_parser ... ok test uniform_changes_fit_one_frame_after_churn_with_distinct_kept_services ... ok test result: ok. 5 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/authorized_local_binding.rs (target/debug/deps/authorized_local_binding-b6b26d570b067f6d) running 2 tests test nf_tables_local_binding_and_address_recovery ... ignored, Run in a disposable user/network namespace, #173. test nft_local_binding_and_address_recovery ... ignored, Run in a disposable user/network namespace, #173. test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/canonical_host_binding.rs (target/debug/deps/canonical_host_binding-0ec32ae358bf6ad1) running 1 test test enrollment_requires_canonical_host_uuid_spelling ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.10s Running tests/configuration.rs (target/debug/deps/configuration-0de68586e97bee0e) running 5 tests test edition_default_is_explicit_and_build_selected ... ok test chunks_fit_body_budget_and_one_peer_delta_does_not_repeat_the_snapshot ... ok test port_grant_narrows_allow_opens_deny_and_preserves_direction ... ok test compiled_chunks_identify_the_server_and_old_snapshots_have_no_proposal ... ok test large_valid_port_policy_is_split_without_a_port_count_cap ... ok test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.50s Running tests/kernel.rs (target/debug/deps/kernel-732bb29c82236aac) running 6 tests test bulk_retirement_preserves_identity_and_routes_at_1000_peers ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test created_interface_is_marked_for_restart_adoption ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test policy_table_route_conflict_is_refused ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test real_kernel_chunked_peers ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test real_kernel_ephemeral_identity ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test retired_host_routes_can_be_replayed ... ignored, Run inside a dedicated network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/naming.rs (target/debug/deps/naming-67721c923ce04b05) running 4 tests test a_squatter_yields_to_a_host_added_later_and_the_renames_are_audited ... ok test the_servers_names_are_kept_for_the_server ... ok test a_viewer_without_host_facts_does_not_see_reported_hostnames ... ok test a_person_takes_an_automatic_name_and_the_machine_moves_aside ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s Running tests/policy_enrollment_binding.rs (target/debug/deps/policy_enrollment_binding-84309e9d9646f2a1) running 4 tests test noncanonical_host_binding_is_refused ... ok test host_binding_requires_global_authority_and_existing_unrevoked_host ... ok test refused_enrollment_preserves_removal_and_revision ... ok test explicit_binding_preserves_identity_and_clears_removal_only_on_enrollment ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s Running tests/policy_enrollment_identity.rs (target/debug/deps/policy_enrollment_identity-8f6318f610da3137) running 1 test test unbound_enrollment_public_key_is_not_host_authority ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s Running tests/policy_snapshot_ordering.rs (target/debug/deps/policy_snapshot_ordering-0c4e4947e7b6f346) running 6 tests test nf_tables_equal_version_conflicting_snapshot_is_refused ... ignored, Run in a disposable user/network namespace, #173. test nf_tables_snapshot_cannot_replace_local_node_identity ... ignored, Run in a disposable user/network namespace, #173. test nf_tables_split_snapshot_replay_requires_complete_identical_contents ... ignored, Run in a disposable user/network namespace, #173. test nft_equal_version_conflicting_snapshot_is_refused ... ignored, Run in a disposable user/network namespace, #173. test nft_snapshot_cannot_replace_local_node_identity ... ignored, Run in a disposable user/network namespace, #173. test nft_split_snapshot_replay_requires_complete_identical_contents ... ignored, Run in a disposable user/network namespace, #173. test result: ok. 0 passed; 0 failed; 6 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/presence.rs (target/debug/deps/presence-416ba096352b47ca) running 2 tests test nodes_the_server_sees_are_online_with_their_path_and_named_by_machine ... ok test an_unchanged_reading_is_not_announced_and_a_lost_session_goes_offline ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.17s Running tests/restart_route_ownership.rs (target/debug/deps/restart_route_ownership-50aed494b291fb2d) running 1 test test orphan_route_retirement_preserves_foreign_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_authorized_reenrollment.rs (target/debug/deps/review_authorized_reenrollment-240f0b9bcc475ff4) running 2 tests test nf_tables_authorized_reenrollment_reaches_the_live_node ... ignored, Run in a disposable user/network namespace, #173. test nft_authorized_reenrollment_reaches_the_live_node ... ignored, Run in a disposable user/network namespace, #173. test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_endpoint_transaction.rs (target/debug/deps/review_endpoint_transaction-1d8c533a7bd82181) running 1 test test refused_endpoint_persistence_preserves_kernel_endpoint ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_firewall_marker.rs (target/debug/deps/review_firewall_marker-25ac92a90d00110e) running 2 tests test nf_tables_marker_substring_is_not_chain_ownership ... ignored, Run in a disposable user/network namespace, #173. test nft_marker_substring_is_not_table_ownership ... ignored, Run in a disposable user/network namespace, #173. test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_ingress_translation.rs (target/debug/deps/review_ingress_translation-d9d8ebc8fe85d913) running 2 tests test nf_tables_translated_underlay_ingress_is_refused ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test nft_translated_underlay_ingress_is_refused ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_local_delivery.rs (target/debug/deps/review_local_delivery-e49642105fa6a9b5) running 2 tests test nf_tables_node_local_mesh_delivery_remains_available ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test nft_node_local_mesh_delivery_remains_available ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_mesh_presence_r4.rs (target/debug/deps/review_mesh_presence_r4-ed87dd29fd72e578) running 3 tests test a_counter_reset_discards_the_previous_peers_keepalive_classification ... ok test a_passive_keepalive_does_not_turn_later_silence_into_a_false_offline ... ok test a_peer_with_25_second_keepalives_stays_online_when_server_keepalives_suppress_its_sends ... ok test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_mesh_view_truth.rs (target/debug/deps/review_mesh_view_truth-3c87c5e84e154ac7) running 6 tests test an_address_that_is_an_ip_never_becomes_a_name ... ok test a_hand_set_name_equal_to_the_placeholder_is_kept ... ok test a_remote_machine_cannot_be_called_server ... ok test a_remote_machine_cannot_take_the_servers_hostname ... ok test a_host_record_name_beats_another_machines_reported_hostname ... ok test a_peer_does_not_stay_online_past_its_session_when_the_server_node_stops_answering ... ok test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 11.32s Running tests/review_mesh_view_truth_r2.rs (target/debug/deps/review_mesh_view_truth_r2-3dc0c6323fa7aba1) running 9 tests test a_hex_ipv4_spelling_never_becomes_a_name ... ok test evidence_a_silent_peer_expires_with_its_session_without_flapping ... ok test the_previous_release_starts_on_a_database_this_release_migrated ... ignored, deploy gate, not code: production rollback restores the database copy (#236) test an_idle_healthy_peer_without_its_own_keepalive_stays_online ... ok test no_viewer_sees_a_remote_machine_called_server ... ok test a_node_moved_aside_keeps_its_name_on_its_next_attach ... ok test a_person_can_take_a_name_a_machine_reported ... ok test a_viewer_without_host_facts_still_sees_distinct_names ... ok test evidence_migrations_0026_and_0029_upgrade_a_realistic_database_without_churn ... ok test result: ok. 8 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.30s Running tests/review_mesh_view_truth_r3.rs (target/debug/deps/review_mesh_view_truth_r3-a6fc40ee7cc78c2d) running 5 tests test an_idle_peer_that_started_its_session_stays_online_until_it_rekeys ... ok test a_dead_peer_expires_at_session_end_without_inferring_a_sending_promise ... ok test a_scoped_manager_cannot_rename_a_node_outside_their_scope_by_taking_its_name ... ok test a_non_owner_cannot_confirm_the_servers_hidden_hostname ... ok test a_node_moved_aside_by_a_person_is_audited_under_that_person ... ok test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.26s Running tests/review_mesh_view_truth_r4.rs (target/debug/deps/review_mesh_view_truth_r4-14ae25f6e4aea803) running 7 tests test a_name_chosen_while_rewound_survives_rolling_forward_and_reattaching ... ok test a_global_manager_cannot_probe_a_hidden_name_by_exhausting_move_aside_names ... ok test evidence_server_hostname_moves_only_with_server_rename_authority ... ok test a_scoped_manager_cannot_confirm_a_hidden_reported_hostname ... ok test evidence_a_refused_move_rolls_back_inventory_audit_and_revision ... ok test rewind_reconciles_same_spelling_choices_without_freezing_untouched_names ... ok test hidden_names_are_indistinguishable_for_every_non_global_node_manager ... ok test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.82s Running tests/review_restart_routes.rs (target/debug/deps/review_restart_routes-795ecc3a32dd4868) running 1 test test restart_retires_orphan_peer_host_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_retire_ownership.rs (target/debug/deps/review_retire_ownership-1fe996dbb91c0fcc) running 7 tests test retire_checks_every_object_before_deleting_any ... ignored, Run as root in a disposable network namespace with nft. test retire_decides_every_object_and_leaves_a_foreign_table ... ignored, Run as root in a disposable network namespace with WireGuard and nft. test retire_leaves_a_foreign_interface_without_failing_the_uninstall ... ignored, Run as root in a disposable network namespace. test retire_leaves_a_marked_interface_this_installation_never_recorded ... ignored, Run as root in a disposable network namespace. test retire_leaves_another_installations_interface_and_filter ... ignored, Run as root in a disposable network namespace with WireGuard and nft. test retire_removes_the_interface_and_filter_this_installation_created ... ignored, Run as root in a disposable network namespace with WireGuard and nft. test retire_with_a_record_leaves_a_foreign_interface_and_names_it ... ignored, Run as root in a disposable network namespace with WireGuard and nft. test result: ok. 0 passed; 0 failed; 7 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_reverse_recreation.rs (target/debug/deps/review_reverse_recreation-d57fce130b610727) running 4 tests test nf_tables_ipv4_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173. test nf_tables_ipv6_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173. test nft_ipv4_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173. test nft_ipv6_retired_tcp_stops_after_reverse_traffic ... ignored, Run in a disposable user/network namespace with the kernel_node example built, #173. test result: ok. 0 passed; 0 failed; 4 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_revoked_host_policy.rs (target/debug/deps/review_revoked_host_policy-3915d7cdf7df35ec) running 1 test test revoked_host_is_not_retained_in_compiled_peer_policy ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.13s Running tests/review_route_inventory.rs (target/debug/deps/review_route_inventory-079332a95aa11fed) running 2 tests test refused_recovery_inventory_save_does_not_retire_kernel_peers_or_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test restart_preserves_unrecorded_direct_host_routes ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_route_scope.rs (target/debug/deps/review_route_scope-30e7cc6ce86bb003) running 1 test test restart_preserves_operator_gateway_host_route ... ignored, Run inside a dedicated user/network namespace with CAP_NET_ADMIN. test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_shutdown_budget.rs (target/debug/deps/review_shutdown_budget-3250236508bffc56) running 1 test test shipping_mesh_down_1000_peers_finishes_within_one_second ... ignored, Run in a dedicated user/network namespace under CPUWeight=10000 with INFRATERNAL_BIN pointing to the shipping release binary. test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_shutdown_restart.rs (target/debug/deps/review_shutdown_restart-b0c60e43a05ca892) running 3 tests test crash_child ... ignored, Child-only fixture for the weighted user/network namespace restart proof. test refused_journal_retirement_keeps_stopping_until_explicit_retry ... ignored, Run inside a dedicated user/network namespace under CPUWeight=10000. test restart_finishes_interrupted_down_at_1000_peers ... ignored, Run inside a dedicated user/network namespace under CPUWeight=10000. test result: ok. 0 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/settings.rs (target/debug/deps/settings-5025fdff01951a79) running 1 test test default_switch_requires_owner_freshness_and_the_preview_revision ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s Running tests/store.rs (target/debug/deps/store-20d436fbf2a30450) running 6 tests test required_server_membership_cannot_be_deleted ... ok test absent_discovery_preserves_the_last_known_endpoint ... ok test key_replacement_preserves_identity_and_addresses_after_restart ... ok test removed_host_cannot_restore_membership_without_authorized_enrollment ... ok test scale_preview_pages_do_not_allocate_the_pair_matrix ... ok test attach_cancelled_at_any_await_leaves_the_store_writable ... ok test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.98s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_relay-383c990964aaac19) running 1 test test cli::tests::relay_actions_are_complete_and_unavailable_until_runtime_exists ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_release-5ef5523a0f0a2ea2) running 90 tests test generation::download::tests::invalid_signed_offer_never_acquires_or_modifies_download_storage ... ok test generation::download::tests::signed_version_file_must_bind_the_offered_version_before_acquisition ... ok test generation::download::tests::unsafe_download_entries_are_neither_followed_nor_removed ... ok test generation::download::tests::chunk_gaps_rewinds_excess_and_corrupted_complete_image_are_refused ... ok test generation::download::tests::clear_download_requires_exclusive_ownership_and_preserves_unknown_entries ... ok test generation::download::tests::signed_download_resumes_after_disconnect_without_selecting_or_reading_credentials ... ok test generation::download::tests::interrupted_oversized_or_shared_payload_is_not_repaired_or_resumed ... ok test generation::host_tests::oversized_host_credentials_are_refused_before_adoption_publishes_selection ... ok test generation::host_prepare::tests::host_preparation_rejects_unsigned_or_unrequested_backwards_transitions ... ok test generation::host_prepare::tests::host_preparation_rejects_a_changed_execution_snapshot_before_creating_candidate ... ok test generation::download::tests::a_new_signed_offer_retires_only_the_previous_transfer ... ok test generation::host_prepare::tests::adopting_host_refuses_replacement_and_unauthenticated_images_without_new_generations ... ok test generation::host_prepare::tests::adopting_host_publishes_signed_a_and_retains_live_credential_location ... ok test generation::host_tests::host_adoption_retains_the_live_identity_location_until_preparation ... ok test generation::host_tests::shared_host_identity_cannot_become_a_writable_candidate ... ok test generation::startup::tests::metadata_aliases_and_oversized_signatures_are_refused ... ok test generation::startup::tests::pinned_state_root_supports_private_directory_checks_after_a_rename ... ok test generation::startup::tests::signed_adoption_pins_original_database_and_boot_configuration_independently ... ok test generation::tests::abrupt_owner_process_exit_releases_the_installation_lock ... ok test generation::startup::tests::signed_selection_pins_state_without_creating_or_repairing_files ... ok test generation::host_tests::changed_retained_host_identity_refuses_commit_without_reselecting ... ok test generation::host_prepare::tests::prepared_host_keeps_a_selected_and_uses_independent_credential_inodes ... ok test generation::tests::adoption::installer_publication ... ok test generation::host_tests::host_trial_keeps_known_good_identity_and_selection_until_commit ... ok test generation::startup::tests::trial_entry_binds_only_the_prepared_candidate_while_boot_keeps_the_predecessor ... ok test generation::tests::adoption::typed_original_binding_normalizes_once_and_never_accepts_shared_roots ... ok test generation::tests::adoption::adoption_keeps_original_acknowledged_edits_in_the_selected_pair ... ok test generation::startup::tests::uncommitted_signed_candidate_and_changed_version_file_cannot_boot ... ok test generation::tests::bounded_launch_parser_refuses_unsafe_components_and_ambiguous_objects ... ok test generation::tests::adoption::initial_state_locator_cannot_be_reused_for_a_successor_or_alias ... ok test generation::tests::concurrent_owner_is_refused_and_kernel_releases_abandoned_ownership ... ok test generation::tests::duplicated_lock_descriptor_keeps_installation_owned_until_its_last_close ... ok test generation::tests::a_second_preparation_cannot_replace_the_live_transaction ... ok test generation::tests::exhaustion::candidate_sqlite_full_does_not_require_predecessor_restore_space ... ignored, orchestrator only: disposable 32 MiB / 256 inode filesystem test generation::tests::exhaustion::zero_inodes_need_no_current_partial_or_rollback_receipt ... ignored, orchestrator only: disposable 32 MiB / 256 inode filesystem running 1 test test generation::tests::exhausted_writer_reservation_cannot_admit_a_trial ... ok test generation::tests::adoption::replaced_or_shared_original_state_refuses_boot_without_repair_writes ... ok test generation::tests::candidate_without_signed_metadata_cannot_be_prepared ... ok test generation::tests::adoption::retained_adopted_state_uses_the_original_database_and_generation_configuration ... ok test generation::tests::adoption::installer_publication ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 89 filtered out; finished in 0.11s test generation::tests::candidate_launch_retains_predecessor_database_and_configuration_digests ... ok test generation::tests::failed_validation_never_changes_the_selected_generation ... ok test generation::tests::dropped_trial_and_repeated_recovery_never_publish_or_write_a_selector ... ok test generation::tests::incomplete_next_publication_preserves_selected_pair_and_retained_predecessor ... ok test generation::tests::known_good_remains_selected_until_health_authorizes_one_pointer_commit ... ok test generation::tests::predecessor_changes_and_uncheckpointed_wal_refuse_trial_or_commit ... ok test generation::tests::inspecting_live_selection_preserves_sqlite_process_locks ... ok test generation::tests::unrelated_predecessor_and_aliases_cannot_enter_a_transaction ... ok test generation::trial_tests::transferred_ownership_must_name_this_installation_and_hold_its_lock ... ok test generation::tests::adoption::adoption_and_failed_trial_keep_the_same_live_sqlite_acknowledgments ... ok test generation::tests::selected_authenticates_before_touching_database_or_configuration ... ok test host_receiver::tests::checkin_receipt_requires_the_process_owners_durable_commit ... ok test generation::trial_tests::collection_refuses_without_a_verified_selection_and_deletes_nothing ... ok test host_receiver::tests::corrupt_payload_and_positional_public_actions_are_refused ... ok test host_receiver::tests::disabling_releases_the_transfer_owner_before_durable_partial_cleanup ... ok test host_receiver::tests::down_up_cannot_revive_a_prepared_reply_from_an_old_epoch ... ok test host_receiver::tests::dropped_commit_reply_never_requests_a_handoff ... ok test host_receiver::tests::local_adoption_is_discoverable_locally_but_absent_from_remote_authorization ... ok test host_receiver::tests::local_adoption_refuses_paths_unknown_fields_and_nonobject_envelopes_before_lifecycle ... ok test host_receiver::tests::unadopted_or_paused_hosts_never_acquire_an_image ... ok test host_receiver::tests::epoch_change_during_partial_download_refuses_further_acknowledgement ... ok test generation::trial_tests::abandoned_attempt_is_inferred_from_the_pointer_without_any_write ... ok test host_sender::tests::a_noncontiguous_ack_never_commits ... ok test host_sender::tests::an_unknown_architecture_never_requests_a_payload ... ok test host_sender::tests::disabled_host_reports_its_version_without_claiming_a_failed_transfer ... ok test generation::trial_tests::collection_bounds_retention_to_the_selected_pair_and_its_predecessor ... ok test host_sender::tests::offsets_follow_the_frozen_little_endian_wire_contract ... ok test host_sender::tests::legacy_host_records_manual_update_without_exchange_or_download ... ok test generation::trial_tests::trial_names_only_the_prepared_candidate_of_the_selected_predecessor ... ok test host_sender::tests::temporary_setup_is_not_a_legacy_daemon ... ok test host_receiver::tests::verified_commit_enqueues_only_after_complete_reply_write ... ok test host_sender::tests::transfer_commit_retains_the_old_identity_until_a_new_checkin ... ok test host_sender::tests::unverified_managed_image_requires_owner_adoption_without_seed_offer ... ok test host_sender::tests::sixty_four_connections_share_eight_workers_and_resume_independent_file_offsets ... ok test latest::tests::abandoned_image_staging_is_reclaimed_after_its_owner_dies ... ok test generation::trial_tests::watchdog_resumes_only_the_prepared_trial_and_commits_it_once ... ok test generation::tests::retained_integrity_checks_historical_state_without_freezing_selected_writes ... ok test service::tests::authority_is_rechecked_after_the_setting_write_before_commit ... ok test service::tests::channel_reads_at_fifty_concurrent_callers ... ignored, run alone under CPUWeight=10000; measures SQLite action overhead, not terminal or full authenticated socket latency test service::tests::api_setting_requires_owner_and_current_fresh_session ... ok test service::tests::default_stable_refuses_silent_edge_and_persists_explicit_opt_in ... ok test service::tests::object_input_rejects_duplicates_unknown_fields_and_alternate_representations ... ok test service::tests::disabled_feature_starts_no_lookup_and_rejects_settings ... ok test latest::tests::startup_reclaims_only_owned_inactive_private_metadata ... ok test generation::startup::tests::host_preflight_authenticates_executing_bytes_before_pinning_private_credentials ... ok test generation::startup::tests::changed_executing_image_or_signed_launch_version_is_refused ... ok test latest::tests::cancellation_joins_verification ... ok test host_sender::tests::an_explicit_ack_refusal_waits_for_a_node_event ... ok test host_sender::tests::stopping_a_host_follower_cancels_its_retry ... ok test generation::tests::pointer_rename_and_sync_refusal_reconcile_actual_selection ... ok test host_sender::tests::transient_exchange_recovers_without_a_node_event_and_then_quiesces ... ok test result: ok. 87 passed; 0 failed; 3 ignored; 0 measured; 0 filtered out; finished in 3.47s Running tests/generation_updater.rs (target/debug/deps/generation_updater-482ebb327cb53966) running 25 tests test disabled_worker_performs_no_schema_maintenance_or_discovery ... ok test a_request_trigger_revoking_owner_rolls_back_both_request_and_revocation ... ok test a_ready_image_emits_one_toast_and_keeps_private_paths_out_of_status ... ok test channel_switch_retires_ready_images_and_queued_requests_in_the_same_transaction ... ok test changing_only_the_quiet_window_postpones_and_preserves_the_exact_request ... ok test disabling_the_feature_after_download_refuses_handoff ... ok test discovery_never_stages_an_older_same_channel_release ... ok test an_exact_request_arriving_during_staging_keeps_its_readiness_and_notice ... ok test failed_collection_refuses_new_staging_without_hiding_selected_service ... ok test committed_manual_request_is_retired_before_successor_discovery ... ok test abandoned_trial_pauses_only_that_version_across_a_second_writable_boot ... ok test failed_trial_notice_is_available_before_discovery_runs_again ... ok test retiring_an_unpolled_release_worker_releases_hosts_without_dropping_declarations ... ok test explicit_retry_requires_the_exact_ready_version_and_consumes_the_request_once ... ok test discovery_preserves_a_queued_exact_image_until_its_request_is_admitted ... ok test rollback_discloses_historical_data_and_requires_a_current_fresh_owner ... ok test verification_failure_never_publishes_readiness_or_a_toast ... ok test historical_rollback_reconciles_bookkeeping_without_overlaying_restored_authority ... ok test configuration_changes_during_preparation_refuse_final_handoff ... ok test foreground_postponement_preserves_the_exact_manual_request_for_retry ... ok test handoff_acknowledgement_is_not_a_successful_health_check ... ok test worker_discovers_once_then_wakes_for_an_exact_manual_request ... ok test authority_changes_during_generation_preparation_refuse_final_handoff ... ok test update_subscription_delivers_state_and_one_ready_toast_then_withdraws ... ok test retry_history_stays_bounded_without_retiring_the_live_admission ... ok test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.48s Running tests/host_wire.rs (target/debug/deps/host_wire-9246a9753e4d1ea9) running 4 tests test artifact_names_come_only_from_supported_architectures ... ok test metadata_refuses_positional_unknown_duplicate_and_oversized_bodies ... ok test offsets_keep_the_frozen_nonzero_little_endian_bytes ... ok test maximally_escaped_signed_text_fits_the_frozen_offer_envelope ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s Running tests/review_pool.rs (target/debug/deps/review_pool-c11d6904b63ce4e2) running 1 test test pending_channel_writers_preserve_authority_read_capacity ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 2.60s Running tests/review_restart.rs (target/debug/deps/review_restart-ffcb35acdbfc8d3f) running 4 tests test partial_metadata_restart_child ... ignored, subprocess helper for metadata restart verification test restricted_umask_lookup_child ... ignored, subprocess helper for restricted-umask lookup verification test lookup_creates_private_staging_under_owner_restrictive_umask ... ok test restarted_latest_reclaims_metadata_after_process_stop ... ok test result: ok. 2 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.14s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_remote-c41c172c6167f938) running 122 tests test host_boot::tests::boot_metadata_refuses_noncanonical_home_and_foreign_installation_before_io ... ok test host_boot::tests::boot_metadata_rejects_unknown_fields_and_unsupported_formats ... ok test host_boot::tests::private_boot_metadata_refuses_aliases_shared_modes_and_oversized_input ... ok test host_boot::tests::retained_configuration_keeps_original_owner_and_session_coordinates ... ok test inventory::authority_tests::inventory_events_keep_the_subscription_generation ... ok test inventory::authority_tests::revocation_cancels_a_result_waiting_for_socket_credit ... ok test inventory::tests::inventory_descriptor_is_valid_for_server_startup ... ok test remote_bindings::receive_cost_tests::repeated_mesh_ingress_cost_at_one_thousand_retained_histories ... ignored, Component timing on the authorized perf VM under its fair lock; not transport acceptance. test inventory::tests::list_input_refuses_parallel_authority_and_noncanonical_cursors ... ok test remote_bindings::tests::alias_retirement_restores_the_previous_reply_socket ... ok test remote_bindings::tests::an_encrypted_duplicate_cannot_move_the_reply_route ... ok test remote_bindings::tests::a_negotiated_peer_copies_output_without_a_worker_and_off_cancels_it ... ok test remote_bindings::tests::backup_withdrawal_reconciles_idle_peers_without_canceling_another_return ... ok test remote_bindings::tests::lease_installed_during_a_pending_poll_cannot_lose_the_receive_wakeup ... ok test remote_bindings::tests::dropping_one_peer_removes_alternative_work_while_another_peer_lives ... ok test remote_bindings::tests::enrolled_dual_replies_preserve_primary_and_mesh_sources ... ok test remote_bindings::tests::peer_route_preserves_the_logical_tuple_and_replays_on_return ... ok test remote_bindings::tests::replies_follow_the_last_heard_address_and_leases_retire_their_routes ... ok test remote_bindings::tests::a_lease_added_while_waiting_is_polled_without_another_primary_datagram ... ok test remote_bindings::tests::retiring_mesh_lease_cancels_only_queued_alternative_reply ... ok test remote_path_copies::tests::arming_after_pending_wakes_the_owned_endpoint_and_clear_drops_it ... ok test remote_path_copies::tests::cancelling_retired_work_keeps_the_next_send_receive_wakeup ... ok test remote_path_proof::tests::fixed_header_mac_matches_independent_sha256_vectors ... ok test remote_path_proof::tests::mixed_aggregation_preserves_all_neighboring_quic_bytes ... ok test remote_path_proof::tests::only_current_session_response_answers_a_sent_probe ... ok test remote_bindings::tests::unknown_mesh_reply_waits_for_duplicate_coordinates_and_off_retires_it ... ok test remote_path_socket::tests::a_probe_request_latches_before_its_waiter_is_polled ... ok test remote_path_socket::tests::an_old_ack_only_send_does_not_start_a_backpressured_probe_deadline ... ignored, timed watchdog ordering proof; run under the perf VM benchmark lock test remote_path_socket::tests::an_unrelated_reply_cannot_discard_ciphertext_needed_after_a_cut ... ok test remote_path_socket::tests::backpressure_never_starts_or_replaces_the_probe_send_clock ... ok test remote_bindings::tests::retiring_one_route_preserves_another_peers_enrolled_return ... ok test remote_path_socket::tests::cancelling_old_requests_cannot_clear_a_new_probe_generation ... ok test remote_bindings::tests::wildcard_reply_uses_the_destination_of_the_latest_peer_packet ... ok test remote_path_socket::tests::exporting_path_keys_never_holds_the_receive_proof_lock ... ok test remote_path_socket::tests::dedicated_receive_preserves_segmented_sends_in_single_datagram_buffers ... ok test remote_path_socket::tests::mesh_route_maps_only_the_trusted_tuple_and_resends_unanswered_datagrams ... ok test remote_path_socket::tests::segmented_replay_evicts_enough_old_datagrams_to_keep_the_byte_bound ... ok test remote_peer_routes::bench::complete_tag_lookup_at_1000_peers ... ignored, Measure only on the perf VM under its benchmark lock. test remote_peer_routes::bench::routing_lookup_at_1000_nodes ... ignored, Measure only on the perf VM under its benchmark lock. test remote_peer_routes::copy_scan_tests::copy_poll_cost_at_one_thousand_retained_histories ... ignored, 31 bookkeeping samples per profile on the authorized perf VM under its fair lock; not transport acceptance. test remote_path_socket::tests::send_gate_releases_only_one_successful_transmission ... ok test remote_peer_routes::tests::alternative_admission_never_evicts_pending_enrolled_return ... ok test remote_peer_routes::copy_scan_tests::history_mutation_after_an_idle_poll_still_sends_every_due_datagram ... ok test remote_peer_routes::tests::alternative_backpressure_keeps_one_copy_and_hints_preserve_its_deadline ... ok test remote_peer_routes::tests::ciphertext_history_at_1000_peers ... ignored, Measure only on the perf VM: 31 batches of 20000 fresh/duplicate pairs across 1000 peers. test remote_peer_routes::tests::alternative_queue_shares_bounds_and_never_becomes_return_history ... ok test remote_bindings::tests::a_copy_poll_bounds_work_before_servicing_receive ... ok test remote_peer_routes::tests::completed_return_entries_stay_consumed_when_new_mesh_history_arrives ... ok test remote_peer_routes::tests::completed_backup_copies_cannot_be_replayed_as_a_second_return_burst ... ok test remote_peer_routes::tests::output_evicting_the_oldest_copy_still_copies_one_bounded_batch ... ok test remote_peer_routes::tests::ciphertext_history_normalizes_gro_batches_and_stays_bounded ... ok test remote_peer_routes::tests::retiring_an_old_lease_cannot_remove_a_reused_tuple ... ok test remote_peer_routes::tests::shared_copy_clock_preserves_each_datagrams_deadline ... ok test remote_quic::design_scale_review::authenticated_mesh_health_at_design_scale ... ignored, Perf VM only: distinct physical tuple health at 1000 mTLS connections. test remote_quic::design_scale_review::authenticated_mesh_health_at_design_scale_100ms ... ignored, Perf VM only: authenticated physical health at 100ms cadence. test remote_quic::design_scale_review::review_fast_mesh_health_at_design_scale ... ignored, Perf VM only: fast detector at 1000 mTLS connections. test remote_quic::design_scale_review::review_production_adaptive_health_at_design_scale ... ignored, Perf VM only: production adaptive detector at 1000 mTLS connections. test remote_peer_routes::tests::unsuccessful_backups_preserve_originals_for_explicit_recovery ... ok test remote_peer_routes::tests::replay_is_bounded_for_large_segmented_transmits ... ok test remote_path_socket::tests::negotiated_copies_use_the_enrolled_socket_and_retire_on_return ... ok test remote_quic::probe_tests::copy_first_ack_only_probes_keep_authenticated_mesh_guard_live ... ignored, Physical 15ms/30ms guard comparison on the perf VM under its benchmark lock. test remote_quic::probe_tests::copy_first_ack_only_requested_ack_delay_five_ms_comparison ... ignored, ACK-delay hypothesis comparison on the quiet perf VM under its benchmark lock. test remote_bindings::tests::admitted_path_proofs_survive_mesh_retirement_and_old_key_lease_drop ... ok test remote_bindings::tests::negotiated_enrolled_return_replay_is_bounded_and_consumed_once ... ok test remote_bindings::tests::legacy_enrolled_return_replay_is_bounded_and_consumed_once ... ok test remote_quic::probe_tests::review_invalid_mesh_packets_cannot_borrow_enrolled_authentication ... ignored, Perf VM only: real socket scheduling and path-response deadline. test remote_path_socket::tests::a_delayed_probe_waiter_keeps_first_send_clock_after_ack_only_traffic ... ok test remote_quic::mtu_tests::both_directions_keep_a_mesh_safe_payload_after_discovery ... ok test remote_quic::tests::mesh_liveness_keeps_authentication_and_refuses_invalid_intervals ... ok test remote_path_socket::tests::an_old_ack_only_send_cannot_complete_probe_emission ... ok test remote_quic::probe_tests::lost_path_proof_spends_its_reserved_retry_margin ... ok test remote_quic::tests::wrong_server_name_never_yields_authenticated_connection ... ok test remote_quic::tests::repeated_native_id_has_distinct_server_writer_authority_and_preserves_suffix ... ok test remote_renewal::tests::credential_snapshot_does_not_block_async_reconnect ... ok test remote_quic::tests::host_cannot_open_a_second_server_control_stream ... ok test remote_tls::tests::outgoing_tcp_detects_a_vanished_peer_without_application_traffic ... ok test remote_quic::probe_tests::copy_first_real_mesh_originals_do_not_strand_the_authenticated_mesh_guard ... ok test remote_tls::tests::mutual_tls_delivers_exact_bytes_and_verified_leaf_fingerprints ... ok test remote_bindings::tests::alternating_fresh_hints_cannot_amplify_retained_ciphertext ... ok test remote_tls::tests::untrusted_client_never_reaches_server_admission ... ok test runtime_lock::tests::a_live_legacy_runtime_cannot_publish_an_unheld_lifetime_file ... ok test runtime_lock::tests::cleanup_admission_prevents_starting_even_if_runtime_lock_was_removed ... ok test runtime_lock::tests::dump_datagrams_split_exactly ... ok test runtime_lock::tests::dump_records_accept_only_known_shapes ... ok test runtime_lock::tests::existing_recovery_lock_is_read_only_exclusive_and_never_created ... ok test runtime_lock::tests::fixture_state::deep_root_keeps_real_sockets_private_and_cleans_up_on_drop ... ok test runtime_lock::tests::foreign_inode_twin_inner ... ignored, runs inside the namespace prepared by the foreign-inode test 2 test runtime_lock::tests::internal_dispatch_checks_exact_argument_counts ... ok test runtime_lock::tests::internal_dispatch_reads_only_the_normal_command_name ... ok test remote_quic::probe_tests::healthy_path_proofs_keep_the_configured_polling_interval ... ok test runtime_lock::tests::legacy_inspection_finds_a_real_bound_socket ... ok test runtime_lock::tests::legacy_inspection_is_independent_of_the_bound_name ... ok test runtime_lock::tests::lifetime_contention_preserves_would_block ... ok test runtime_lock::tests::lifetime_precedes_bind_and_survives_until_last_description_closes ... ok test runtime_lock::tests::lock_links_and_replacements_are_refused ... ok test runtime_lock::tests::managed_start_refuses_another_host_and_an_unfinished_receipt ... ok test remote_tls::tests::untrusted_server_or_wrong_server_name_is_refused_before_bytes ... ok test runtime_lock::tests::split_device_inner ... ignored, runs inside the namespace prepared by the split-device test test runtime_lock::tests::session_inspection_finds_bound_endpoints_by_identity ... ok test runtime_lock::tests::unavailable_lock_support_does_not_claim_a_live_holder ... ok test uninstall::tests::a_failed_kernel_check_stops_cleanup_before_the_service ... ok test remote_tls::tests::cancelled_partial_write_cannot_reuse_the_channel ... ok test uninstall::tests::bootstrap_lock_delays_uninstall_without_omitting_its_handler ... ok test uninstall::tests::file_removal_keeps_what_setup_did_not_create ... ok test uninstall::tests::generation_boot_adoption_cleanup_preserves_foreign_updates ... ok running 1 test test runtime_lock::tests::foreign_inode_twin_inner ... running 1 test test runtime_lock::tests::split_device_inner ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 121 filtered out; finished in 0.01s test runtime_lock::tests::legacy_bound_endpoint_on_a_split_device_filesystem_is_kept ... ok test runtime_lock::tests::stale_session_endpoint_is_not_held_live_by_a_foreign_inode_twin ... ok test uninstall::tests::replies_name_the_objects_left_as_valid_json ... ok test uninstall::tests::manual_uninstall_refuses_another_hosts_installation ... ok test uninstall::tests::generation_boot_adoption_preserves_legacy_launcher_and_uninstall_authority ... ok test uninstall::tests::review_planted_plan_is_never_followed ... ok test uninstall::tests::review_failed_launcher_leaves_no_plan ... ok test remote_quic::probe_tests::enrolled_copy_replies_cannot_keep_a_dead_mesh_path_alive ... ok test uninstall::tests::uninstall_never_accepts_request_selected_paths_or_foreign_identity ... ok test uninstall::tests::accepted_handoff_runs_on_a_thread_without_an_async_runtime ... ok test runtime_lock::tests::after_close_waits_for_a_slow_socket_snapshot ... ok test uninstall::tests::retirement_signals_the_shell_after_its_foreground_job_exits ... ok test remote_quic::probe_tests::a_queued_probe_cannot_expire_before_the_socket_emits_it ... ok test remote_quic::tests::acknowledged_idle_survives_and_replayed_packets_cannot_mask_failure ... ok test remote_quic::tests::one_way_authenticated_output_keeps_the_path_fresh ... ok test remote_tls::tests::stalled_write_retires_both_directions_without_idle_polling ... ok test uninstall::tests::uninstall_and_setup_exclude_each_other ... ok test result: ok. 107 passed; 0 failed; 15 ignored; 0 measured; 0 filtered out; finished in 5.38s Running unittests src/lib.rs (target/debug/deps/infraternal_plugin_ssh-8d082a4bdba0dbd9) running 50 tests test auth_evidence::tests::partial_and_malformed_receipts_are_not_method_evidence ... ok test auth_evidence::tests::receipt_is_identical_at_every_chunk_boundary ... ok test auth_evidence::tests::selected_local_authentication_diagnostics_keep_method_at_every_boundary ... ok test auth_evidence::tests::later_local_key_receipt_supersedes_an_earlier_banner ... ok test auth_once::tests::caller_cannot_choose_or_extend_the_expiry_clock ... ok test auth_once::tests::each_method_consumes_once_and_expiry_erases_both_methods ... ok test auth_order::tests::pending_forwards_the_caller_deadline_to_its_selected_session ... ok test auth_order::tests::only_exact_generated_read_only_checks_can_choose_credentials ... ok test auth_once::tests::invalid_material_is_refused_before_any_helper_or_scheduling ... ok test config::tests::flattened_quoted_public_filenames_are_refused_when_existing_trust_would_be_lost ... ok test config::tests::trust_lookup_uses_every_explicit_alias_verbatim ... ok test bootstrap::proof_tests::failed_published_facts_clean_only_the_private_probe_and_never_commit ... ok test bootstrap::proof_tests::published_proofs_start_together_and_commit_requires_both ... ok test config::tests::unresolved_or_relative_public_paths_cannot_admit_first_contact ... ok test install::tests::compaction_drops_only_comment_lines_and_indentation ... ok test bootstrap::proof_tests::review_stopped_commit_channel_finishes_the_private_probe ... ok test install::tests::embedded_setup_programs_have_no_constructs_compaction_would_change ... ok test bootstrap::proof_tests::review_stalled_commit_cannot_outlive_attempt_cap ... ok test bootstrap::proof_tests::review_commit_clamps_outliers_and_releases_immediately ... ok test duplex::tests::duplex_preserves_binary_bytes_in_both_directions ... ok test config::tests::malformed_public_policy_is_refused_before_it_can_change_command_arguments ... ok test cli::tests::ssh_actions_are_complete_and_marked_unavailable ... ok test duplex::tests::closed_receipt_channel_is_reported_as_unreachable ... ok test payload::tests::payload_hash_cache_at_1600_adds ... ignored, #190 public payload hash/cache measurements on the locked perf VM only test install::tests::transfer_caps_accept_only_the_fixed_record ... ok test manifest::tests::node_provisioning_declares_an_existing_server_and_only_node_components ... ok test model::failure_serialization_tests::uuid_reference_uses_the_outcome_specific_wire_key ... ok test model::failure_serialization_tests::wire_format_is_exact_and_failure_stays_small ... ok test payload::tests::concurrent_adds_share_the_cached_digest_allocation ... ok test payload::tests::settings_changes_keep_at_most_four_entries ... ok test config::tests::configured_private_sources_are_excluded_and_public_trust_is_retained ... ok test prompt::tests::reply_fixture ... ignored, private subprocess for the one-reply peer oracle test payload_encoding::tests::small_payloads_retain_raw_streaming ... ok test session_bridge::tests::failed_dispatcher_does_not_publish_a_session ... ok test prompt_image::tests::helper_identity_refuses_in_place_and_path_replacement ... ok test session_bridge::tests::publication_and_dispatcher_greeting_share_the_first_write ... ok test setup::tests::exhausted_setup_failure_retains_reason_without_offering_retry ... ok test setup::tests::host_status_outlives_its_subscriber_and_keeps_exact_identity ... ok test socket_connector::tests::connected_socket_has_nodelay_before_any_application_bytes ... ok test payload::tests::replacement_and_removal_never_reuse_a_path_name_digest ... ok test socket_connector::tests::invalid_endpoint_cannot_send_a_descriptor ... ok test test_common::deep_scratch_fallback_is_private_short_and_owned ... ok test socket_connector::tests::descriptor_delivery_keeps_the_exact_peer_after_helper_copy_closes ... ok test transport::secret_tests::secret_input_has_a_fixed_bound_and_accepts_only_strings ... ok test stdio::tests::pipes_preserve_bytes_and_do_not_escape_into_child_exec ... ok test payload_encoding::tests::binary_replacement_never_reuses_the_previous_encoding ... ok test payload_encoding::tests::gzip_roundtrip_and_repeated_adds_share_one_encoding ... ok test session_bridge::tests::publication_prefix_preserves_every_dispatcher_byte_across_reads ... ok test payload::tests::same_size_in_place_edits_with_restored_mtime_invalidate_the_digest ... ok test prompt::tests::helper_reply_requires_the_registered_parent_and_is_served_once ... ok test result: ok. 48 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.74s Running tests/already_added_breakit.rs (target/debug/deps/already_added_breakit-ce6c620dce3c3962) running 1 test test a_host_key_challenge_never_serializes_as_a_host_id ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/auth_order.rs (target/debug/deps/auth_order-8e85048c5ebab929) running 11 tests test authentication_never_replays_a_mutating_first_command_or_reuses_a_failed_scope ... ok test automatic_checked_channel_selects_bridge_after_read_only_authentication ... ok test later_command_auth_errors_never_restart_the_selected_method_sequence ... ok test manual_hosts_try_available_methods_without_a_separate_none_refusal ... ok test manual_method_trust_refusal_never_loads_later_credentials ... ok test only_exhausted_auth_returns_typed_choose_method ... ok test ownership_checks_authenticate_once_without_replaying_a_different_check ... ok test successful_authentication_is_reported_and_later_secrets_are_never_requested ... ok test ownership_check_fallback_repeats_only_the_allowlisted_read_only_command ... ok test trust_network_and_remote_command_failures_stop_without_loading_local_secrets ... ok test cancelling_authentication_consumes_the_attempt_without_requesting_secrets ... ok test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/build_removal.rs (target/debug/deps/build_removal-30a0cc1acc5feaf3) running 1 test test build_without_default_plugins_excludes_ssh_dependency ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.37s Running tests/concurrency.rs (target/debug/deps/concurrency-bbc1bc9092aff035) running 8 tests test a_thousand_admitted_targets_keep_eight_active_backend_calls ... ignored, explicit CPUWeight10000 scale measurement with a controlled unavailable backend test entire_batch_validates_before_start_and_duplicates_are_refused ... ok test an_interrupted_disable_keeps_admission_closed_until_its_adapter_retires ... ok test common::deep_scratch_fallback_is_private_short_and_owned ... ok test authenticated_batches_retain_an_opaque_session_for_trusted_issuance ... ok test concurrency_is_eight_across_batches_and_all_ten_hosts_fail_independently ... ok test turning_off_drains_queued_work_and_reenable_never_resumes_old_batches ... ok test component_off_retires_a_real_native_helper ... ok test result: ok. 7 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.02s Running tests/config_isolation.rs (target/debug/deps/config_isolation-2da6cb6f83b54eb6) running 3 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test synthetic_master_socket_is_private_at_creation ... ok test configured_identity_paths_are_not_inherited_by_the_command_child ... ok test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s Running tests/credentials.rs (target/debug/deps/credentials-cb856c698b8d8ca2) running 5 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test credential_helper_refuses_host_trust_and_permission_prompts ... ok test password_helpers_prepare_a_fresh_private_root_and_remove_only_their_directory ... ok test password_socket_refuses_an_unrelated_same_user_process ... ok test kernel_running_helper_is_materialized_in_its_private_scope ... ok test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.39s Running tests/diagnostics.rs (target/debug/deps/diagnostics-963255bde00ff4d6) running 12 tests test effective_configuration_never_scans_a_proxy_or_invalid_endpoint ... ok test control_probe_statuses_preserve_actionable_setup_messages ... ok test engine_failures_keep_their_ssh_boundary_without_remote_bytes ... ok test every_failed_step_names_the_step_and_a_next_action ... ok test dynamic_public_trust_is_retained_without_becoming_file_only_admission ... ok test bootstrap_status_mapping_covers_each_step_and_approved_mode ... ok test failed_join_retains_only_the_allowlisted_host_dns_error ... ok test failure_diagnostics_distinguish_auth_trust_transport_and_channel_without_raw_text ... ok test remote_command_text_is_not_ssh_authority_and_never_enters_logs ... ok test status_mapping_preserves_authentication_and_missing_payload_classification ... ok test mesh_policy_requires_both_discovery_facts_and_a_transport_refusal ... ok test script_status_diagnostics_are_honest_for_all_nonzero_codes ... ok test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/event_metadata.rs (target/debug/deps/event_metadata-6c590fa3b00a3c8b) running 1 test test unsupported_host_reports_method_and_retry_never_replays_it_as_current ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/foreground.rs (target/debug/deps/foreground-7c2b761a52f2b118) running 2 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test configured_backgrounding_is_overridden_for_owned_bootstrap_commands ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.11s Running tests/host_trust.rs (target/debug/deps/host_trust-4889cdefe4e54511) running 2 tests test configured_known_hosts_command_revocation_cannot_offer_first_contact ... ignored, run through research/ssh-client/measure.py with its synthetic public host key test first_contact_needs_fresh_authority_and_never_replaces_existing_trust ... ignored, run through research/ssh-client/measure.py --negative-trust-oracle with its memory-held synthetic key test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/install.rs (target/debug/deps/install-d6f01f69ae41df83) running 96 tests test breakit2_stage_refuses_parent_that_cannot_be_rolled_back ... ok test command_failure_names_upload_join_install_and_start_separately ... ok test buffering_setup_reader_receives_no_payload_until_selection ... ok test common::deep_scratch_fallback_is_private_short_and_owned ... ok test acknowledged_linger_noop_does_not_own_later_external_enable ... ok test cleanup_receipt_cannot_authorize_a_replaced_unowned_directory ... ok test active_transaction_is_live_between_ssh_setup_commands ... ok test breakit2_rollback_preserves_foreign_launcher_new ... ok test breakit2_rollback_preserves_foreign_unit_new ... ok test breakit2_interrupted_lock_creation_allows_cleanup_and_retry ... ok test active_service_stop_failure_never_replaces_live_artifacts ... ok test compound_join_failure_preserves_the_original_status_and_boundary ... ok test compound_restaging_refuses_a_foreign_journal_before_upload ... ok test declared_transfer_sends_the_payload_before_any_selection_receipt ... ok test declared_transfer_refuses_a_different_selection_or_a_named_refusal ... ok test duplex_check_refuses_named_failures_and_oversized_records_before_staging ... ok test earlier_attempt_classification_preserves_status_boundary_and_authentication ... ok test earlier_attempt_records_reject_suffixes_truncation_and_unbounded_counts ... ok test compressed_stage_roundtrips_and_rejects_corruption_before_execution ... ok test control_cleanup_never_follows_a_socket_symlink_or_removes_regular_data ... ok test early_staging_preserves_canonical_foreign_root_refusal ... ok test compound_setup_keeps_owned_rollback_and_linger_warning ... ok test every_setup_command_fits_one_kernel_argument_in_both_modes ... ok test commit_signal_retains_journal_until_proof_and_on_cancel ... ok test denied_linger_request_does_not_undo_a_later_external_enable ... ok test checked_staging_survives_a_buffering_payload_reader_and_reuses_the_cache ... ok test foreign_data_refusal_retains_exit_status_and_actionable_directory ... ok test enrollment_process_exit_71_is_not_reported_as_directory_refusal ... ok test framed_receipts_preserve_upload_failures_and_reject_extra_output ... ok test compound_activation_and_start_failures_keep_exact_step_and_rollback ... ok test concurrent_attempts_cannot_replace_or_clean_each_others_transaction ... ok test fresh_cleanup_refuses_a_shared_writable_receipt_parent_before_mutation ... ok test framed_join_refusal_keeps_status_separate_from_upload ... ok test fresh_cleanup_resumes_after_base_removal_and_retires_its_receipt ... ok test foreign_files_and_another_attempt_lock_are_never_removed ... ok test crash_mid_install_can_roll_back_and_retry ... ok test failed_upgrade_preserves_previous_binary_state_and_unit ... ok test fresh_cleanup_resumes_after_owner_marker_removal_with_a_fresh_session ... ok test facts_timeout_retires_stale_plugin_control_socket_before_retry ... ok test fresh_receipt_is_removed_before_transaction_rollback ... ok test fresh_runtime_symlink_never_removes_foreign_empty_directories ... ok test fresh_rollback_resumes_after_transaction_directory_removal ... ok test earlier_binary_cache_is_refreshed_before_owned_recovery ... ok test full_stage_frees_payload_before_allocating_a_cleanup_receipt ... ok test earlier_control_socket_receipt_recovers_before_a_new_setup ... ok test framed_upload_keeps_invitation_after_verified_raw_and_compressed_payloads ... ok test fresh_runtime_empty_directories_do_not_block_rollback_and_retry ... ok test installed_infraternal_agent_always_restarts_without_start_limit ... ok test fresh_runtime_unexpected_data_keeps_ownership_and_cleanup_receipt ... ok test interrupted_acquisition_cleanup_receipt_can_resume ... ok test full_payload_restaging_preserves_the_running_session_build ... ok test interrupted_linger_reply_retains_intent_for_cleanup ... ok test fresh_failure_removes_owned_artifacts_and_success_can_rejoin ... ok test missing_payload_preserves_the_bootstrap_binary_remedy ... ok test linked_owner_marker_is_refused_before_retiring_the_transaction ... ok test interrupted_upgrade_after_acknowledged_stop_restarts_the_previous_service ... ok test interrupted_rollback_never_deletes_already_restored_state_on_retry ... ok test optional_session_payload_is_architecture_scoped_and_refuses_symlinks ... ok test interrupted_restore_recreates_links_without_deleting_the_original ... ok test payload_reuse_never_adopts_a_foreign_cache_directory ... ok test interrupted_control_cleanup_is_resumed_only_by_its_original_attempt ... ok test one_command_channel_carries_check_verified_upload_and_bridge_bytes ... ok test known_failed_setup_finishes_without_a_second_confirmation ... ok test partial_full_upload_rebridges_from_a_verified_image ... ok test linger_policy_denial_is_a_warning_and_owned_changes_are_reversible ... ok test malformed_or_exposed_cleanup_receipts_never_remove_the_owned_root ... ok test reported_cache_digest_selects_reuse_without_sending_payload ... ok test refused_previous_service_stop_only_removes_staging ... ok test review_inode_reuse_after_diagnostics_preserves_live_replacement ... ignored, scripts/test-ssh-inode-reuse reports unsupported filesystems as ignored test pending_fresh_cleanup_refuses_replacement_staging_until_finished ... ok test negotiated_transfer_delivers_the_invitation_after_a_buffering_head ... ok test retry_cleanup_uses_fresh_session_and_preserves_privilege_consent ... ok test review_interrupted_transaction_receipt_allows_owned_cleanup ... ok test review_unrelated_user_relative_socket_does_not_block_stale_cleanup ... ignored, requires sudo -n to create an isolated listener as uid 65534 test rejoin_preserves_existing_host_identity_in_the_private_staging_state ... ok test live_setup_retry_preserves_the_bridge_and_host_identity_state ... ok test setup_receipts_require_exact_order_and_preserve_failure_boundaries ... ok test retry_resends_payload_when_cache_content_changes ... ok test retry_reuses_verified_payload_after_owned_rollback ... ok test review_live_relative_control_socket_preserves_its_receipt ... ok test setup_transaction_holds_a_live_lock_between_shell_commands ... ok test rollback_stop_refusal_retains_artifacts_for_later_cleanup ... ok test session_restaging_uses_one_compound_command ... ok test review_restart_recovers_cleanup_after_base_retirement ... ok test review_restart_recovers_cleanup_after_owner_retirement ... ok test staged_shell_bridge_keeps_protocol_bytes_and_releases_setup_guard ... ok test negotiated_retry_reuses_only_a_verified_cache_after_activation_refusal ... ok test writable_installation_is_refused_before_upload_or_cleanup ... ok test turning_off_paused_host_provisioning_preserves_earlier_leftovers ... ok test streaming::decoded_image_and_hash_advance_before_the_transfer_tail_is_released ... ok test start_fresh_resumes_the_same_attempt_after_owner_confirmation ... ok test streamed_digest_refuses_a_short_file_or_a_changed_stream_before_launch ... ok test stale_previous_attempt_socket_can_be_retired_without_manual_cleanup ... ok test stopped_control_socket_modes_from_service_manager_are_recoverable ... ok test restart_recovers_partial_stage_retirement ... ok test successful_stage_releases_the_parent_lock_from_its_lease_child ... ok test result: ok. 94 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 12.32s Running tests/mesh_ssh.rs (target/debug/deps/mesh_ssh-98605c9c411d4239) running 2 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test network_identity_connect_check_and_changed_key_refusal ... ignored, requires the Go interoperability fixture; run research/ssh-client/mesh-fixture/run test result: ok. 1 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/model.rs (target/debug/deps/model-1f8035fea2f716a8) running 6 tests test addresses_never_become_options_or_shell_syntax ... ok test check_is_exact_bounded_and_rejects_every_truncation ... ok test consent_and_credential_references_are_the_only_request_authority ... ok test start_fresh_is_declared_as_an_owned_host_provisioning_action ... ok test root_consent_is_required_before_ssh_and_uid_zero_cannot_be_rootless ... ok test passwordless_sudo_keeps_default_rootless_without_explicit_consent ... ok test result: ok. 6 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/payload_source.rs (target/debug/deps/payload_source-50a43745d9affa68) running 2 tests test stalled_download_retains_the_named_step_before_the_attempt_deadline ... ok test verification_failure_names_step_and_stops_before_upload ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/previous_attempt_liveness_review.rs (target/debug/deps/previous_attempt_liveness_review-219fee4d1b33b83f) running 2 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test home_alias_keeps_open_setup_descriptor_live ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.23s Running tests/previous_attempt_shell.rs (target/debug/deps/previous_attempt_shell-42d05ae4a42e7c63) running 2 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test shared_ownership_shell_preserves_recovery_and_refusal_invariants ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 7.53s Running tests/probe_check.rs (target/debug/deps/probe_check-5fbb2fac3f3545dc) running 4 tests test breakit2_no_systemd_names_the_required_manager ... ok test common::deep_scratch_fallback_is_private_short_and_owned ... ok test shell_startup_refusal_names_an_interactive_only_remedy ... ok test manager_availability_does_not_request_its_private_environment ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s Running tests/process.rs (target/debug/deps/process-6a3b26d9c4993af7) running 11 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test completed_helper_retires_descendants_with_closed_pipes ... ok test cancellation_retires_the_helper_descendant_too ... ok test review_compound_refusal_preserves_receipt_when_invitation_pipe_closes ... ok test unavailable_negotiated_codec_never_sends_invitation ... ok test oversized_remote_output_is_bounded_and_active_timeout_is_enforced ... ok test negotiated_sources_require_an_exact_receipt_before_private_input ... ok test declared_payload_flows_before_receipts_and_private_input_waits ... ok test reviewer_ssh_helper_does_not_inherit_server_reload_mask ... ok test group_identity_is_retained_until_inherited_pipes_finish ... ok test declared_selection_mismatch_and_missing_verification_withhold_private_input ... ok test result: ok. 11 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 3.03s Running tests/proxy_policy.rs (target/debug/deps/proxy_policy-5a404786fe615a44) running 2 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test unchecked_proxy_hops_are_refused_before_credential_helpers_or_network ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/publication.rs (target/debug/deps/publication-f9f86d5fcda71e08) running 5 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test refused_publication_reports_failure_to_the_waiting_wizard ... ok test encoding_warmup_resolves_admitted_source_images_instead_of_configured_paths ... ok test signed_session_is_typable_before_full_resolution_and_late_failure_retries_the_same_shell ... ok test retry_reopens_ssh_after_transport_loss_and_keeps_the_published_shell ... ok test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s Running tests/real_ssh.rs (target/debug/deps/real_ssh-9bdf06e45ca1ac49) running 1 test test actual_ssh_authentication_check_and_strict_host_key_rejection ... ignored, run through research/ssh-client/measure.py with the synthetic rootless sshd fixture test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/recovery_support.rs (target/debug/deps/recovery_support-310b557e0a74410c) running 13 tests test cleanup_script_requires_the_shipped_helper_level ... ok test common::deep_scratch_fallback_is_private_short_and_owned ... ok test review_stale_receipt_recovers_without_host_python ... ignored, requires sudo -n Docker and the local debian:trixie-slim image test review_cached_helper_without_session_mode_asks_for_a_refresh ... ok test review_live_session_socket_in_plain_home_blocks_cleanup ... ok test legacy_control_socket_in_spaced_home_preserves_receipt ... ok test legacy_control_socket_in_newline_home_preserves_receipt ... ok test review_bound_control_socket_before_listen_preserves_receipt ... ok test review_live_session_socket_in_newline_home_blocks_cleanup ... ok test legacy_control_socket_through_absolute_alias_preserves_receipt ... ok test cleanup_holds_runtime_lock_until_all_receipts_retire ... ok test private_legacy_control_socket_preserves_receipt ... ok test unrelated_same_user_relative_socket_does_not_block_cleanup ... ok test result: ok. 12 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.73s Running tests/shadow_banner.rs (target/debug/deps/shadow_banner-ab487dca6798c1f0) running 2 tests test common::deep_scratch_fallback_is_private_short_and_owned ... ok test a_long_pre_authentication_banner_does_not_refuse_the_host ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.08s Running tests/shell_quoting.rs (target/debug/deps/shell_quoting-42d9866df6c92776) running 1 test test nested_scripts_preserve_bytes_without_expanding_public_text ... ignored, run on the owned disposable target with all supported login shells installed test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/single_connection.rs (target/debug/deps/single_connection-68345a87d0e88e77) running 1 test test one_physical_connection_erases_helpers_and_refuses_reconnect ... ignored, run through the rootless real-sshd fixture, selecting this test only test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/source_completeness.rs (target/debug/deps/source_completeness-858598e4554b88d3) running 1 test test declared_public_modules_have_committed_sources ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/trust_round2.rs (target/debug/deps/trust_round2-50158a5a11224e3b) running 2 tests test long_data_directory_does_not_bound_the_ssh_helper_socket ... ignored, scripts/test-ssh-host-trust.py supplies the real multi-key target test multi_key_target_trusts_once_and_reconnects_without_a_loop ... ignored, scripts/test-ssh-host-trust.py supplies a real multi-key sshd and memory-held credentials test result: ok. 0 passed; 0 failed; 2 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_protocol-219a640828ab7102) running 12 tests test machine_tests::reserved_identity_request_is_decoded_without_changing_protocol_hello ... ok test machine_tests::reserved_chunk_and_metadata_bounds_refuse_oversized_bodies ... ok test machine_tests::split_machine_header_refuses_oversized_chunk_before_body_buffering ... ok test stream_tests::split_mux_header_preserves_trailing_close ... ok test tests::mux_round_trip_and_incremental_decoders_preserve_frame_order ... ok test machine_tests::every_reserved_kind_round_trips_and_requires_stream_zero ... ok test tests::rejects_oversized_noncanonical_and_malformed_frames_before_buffering_body ... ok test tests::marked_input_preserves_legacy_bytes_and_bounds_reply_body ... ok test stream_tests::all_short_frame_splits_match_direct_decoding ... ok test tests::oversized_encode_keeps_the_reusable_output_unchanged ... ok test tests::golden_vectors_encode_and_decode_every_contract_frame ... ok test stream_tests::maximum_sized_fragmented_frame_is_not_rejected ... ok test result: ok. 12 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running unittests src/lib.rs (target/debug/deps/infraternal_server-ec6c22ddc80b7140) running 795 tests test auth::account_events::tests::coalesced_changes_remain_pending_for_each_affected_account ... ok test auth::account_events::tests::a_closed_cursor_cannot_remove_its_replacement_channel ... ok test auth::account_events::tests::last_subscriber_removes_only_its_account ... ok test auth::account_events::tests::many_accounts_do_not_share_generations_or_retain_inactive_entries ... ok test auth::account_events::tests::publication_wakes_outside_the_registry_lock ... ok test auth::account_events::tests::concurrent_final_drops_remove_the_account_before_receiver_fields_drop ... ok test auth::account_events::tests::cancellation_preserves_an_unread_generation ... ok test auth::account_events::tests::a_dropped_source_reports_unavailable_instead_of_consuming_a_change ... ok test auth::cookies::measurement::cookie_latency_at_50_sessions ... ignored, local optimized cookie reader measurement at 50 browser sessions test auth::cookies::tests::joined_split_reordered_and_other_cookies ... ok test auth::cookies::tests::duplicates_missing_invalid_and_nontext_fail_closed ... ok test auth::account_events::tests::refused_transaction_commit_wakes_neither_account_source ... ok test auth::account_events::tests::concurrent_registration_and_cleanup_keep_the_existing_generation ... ok test auth::account_events::tests::cancelled_commit_waiter_still_commits_and_wakes_both_account_sources ... ok test auth::account_events::review_revocation_r2::review_r2_cancelled_refused_commit_never_publishes ... ok test auth::account_events::review_revocation_r2::review_r2_timed_out_commit_waiter_preserves_publication_order ... ok test auth::account_events::review_revocation_r2::review_r2_aborted_commit_task_preserves_publication_order ... ok test auth::account_events::review_revocation_r2::review_r2_panicking_commit_waiter_preserves_publication_order ... ok test auth::migration_compat_tests::dirty_production_migration_is_refused_without_retagging ... ok test auth::http::tests::admission_partitions_reset_without_trusting_forwarded_headers ... ok test auth::http::hostname_tests::authenticated_session_response_includes_system_hostname ... ok test auth::migration_compat_tests::live_production_retirement_history_survives_dev_upgrade ... ok test auth::migration_compat_tests::fresh_history_has_unique_versions_and_both_schemas ... ok test auth::migration_compat_tests::dev_history_keeps_its_mesh_checksum_and_data ... ok test auth::migration_data_tests::original_migration_metadata_and_checksums_are_unchanged ... ok test auth::migration_compat_tests::occupied_destination_leaves_the_production_ledger_unchanged ... ok test auth::migration_data_tests::quoted_text_and_comment_looking_literals_keep_their_values ... ok test auth::migration_compat_tests::committed_retag_can_resume_after_interruption_and_concurrent_startup ... ok test auth::tests::account_identity_migration_backfills_legacy_users ... ok test auth::tests::aaguid_projection_rejects_malformed_cbor_corpus ... ok test auth::migration_compat_tests::unrecognized_checksum_is_refused_without_retagging ... ok test auth::migration_compat_tests::production_history_keeps_index_checksum_and_data ... ok test auth::tests::account_identity_schema_has_unique_usernames_and_display_names ... ok test auth::tests::aaguid_migration_preserves_legacy_credentials_and_sessions ... ok test auth::migration_data_tests::fresh_schemas_defaults_indexes_and_foreign_keys_match_original_sql ... ok test auth::migration_data_tests::deployed_histories_upgrade_without_retagging_or_losing_ownership ... ok test auth::crypto::verifier_tests::browser_secret_hashing_is_canonical_and_bounded ... ok test auth::crypto::verifier_tests::fixture_waits_while_production_hashing_refuses_capacity ... ok test auth::tests::ca_administration_tests::actual_ca_unlock_cost_at_1000_administrator_records ... ignored, release real authority diagnostic at1000 memberships/copies; no concurrent own build/browser test auth::crypto::verifier_tests::recovery_capacity_denial_is_not_a_legacy_credential_signal ... ok test auth::tests::ca_administration_tests::actual_passkey_unlocks_cold_ca_once_and_leaves_no_extra_browser_session ... ok test auth::tests::ca_administration_tests::audit_tests::private_copy_persistence_contains_only_ciphertext_and_public_metadata ... ok test auth::tests::ca_administration_tests::audit_tests::unlock_audit_cost_at_1000_memberships ... ignored, real 100-unlock/1000-membership audit formatting diagnostic; no own builds or browsers test auth::tests::ca_administration_tests::administrator_with_stale_tap_must_make_a_new_verified_proof_to_unlock ... ok test auth::tests::ca_administration_tests::audit_tests::unlock_audit_records_principal_time_outcome_without_material ... ok test auth::tests::account_logout_does_not_notify_another_account ... ok test auth::tests::ca_administration_tests::bootstrap_requires_a_fresh_real_proof_and_publishes_only_wrapped_ca_material ... ok test auth::tests::ca_administration_tests::concurrent_bootstrap_ceremonies_retain_one_issuer_and_replay_is_refused ... ok test auth::tests::audit_ceremony_browser_binding ... ok test auth::tests::ca_administration_tests::foreign_browser_cannot_consume_the_original_ca_unlock_ceremony ... ok test auth::tests::ca_administration_tests::http_tests::ca_body_admission_at_1000_requests ... ignored, 1000-request body admission diagnostic; run alone without builds test auth::tests::ca_administration_tests::http_tests::audit_tests::ca_start_budget_is_shared_by_routes_and_cookies_but_not_status_or_finish ... ok test auth::tests::ca_administration_tests::http_tests::audit_tests::sequential_unlock_starts_require_a_temporal_budget ... ok test auth::tests::audit_logout_survives_admission_exhaustion ... ok test auth::tests::ca_administration_tests::http_tests::ca_finish_body_deadline_returns_its_admission_slot ... ok test auth::tests::ca_administration_tests::changed_generation_expired_session_or_removed_credential_cannot_unlock ... ok test auth::tests::ca_administration_tests::http_tests::ca_http_exact_origin_and_live_cookie_are_required ... ok test auth::tests::ca_administration_tests::http_tests::ca_http_parser_is_bounded_and_errors_do_not_reflect_wrapping_material ... ok test auth::tests::ca_administration_tests::http_tests::ca_http_real_passkey_unlock_returns_only_lock_status_without_a_session_cookie ... ok test auth::tests::audit_no_public_credential_listing ... ok test auth::tests::ca_administration_tests::http_tests::ca_http_refuses_origin_and_cookie_before_decoding_wrapping_material ... ok test auth::tests::ca_administration_tests::http_tests::ca_status_distinguishes_initial_setup_from_locked_retained_trust ... ok test auth::tests::ca_administration_tests::http_tests::first_machine_certificate_setup_starts_a_fresh_passkey_ceremony ... ok test auth::tests::ca_administration_tests::http_tests::independent_review_ca_body_reads_share_the_eight_request_admission_limit ... ok test auth::tests::ca_administration_tests::http_tests::independent_review_ca_headers_are_refused_before_reading_an_unfinished_body ... ok test auth::tests::ca_administration_tests::new_administrator_device_rewraps_pending_copy_and_role_generation_never_resurrects_it ... ok test auth::tests::ca_administration_tests::ordinary_login_ceremony_has_no_ca_unlock_purpose ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::bootstrap_cli::fresh_release_bootstrap_join_renew_revoke_cuts_a_live_connection ... ignored, configured release E2E requires INFRATERNAL_REMOTE_TEST_BINARY and exclusive4701/7443 test auth::tests::ca_administration_tests::shipping_cli_tests::configured_release_cli_cold_lock_real_passkey_unlock_and_cold_restart ... ignored, configured release CLI proof needs INFRATERNAL_REMOTE_TEST_BINARY and exclusive4701/7443 test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::attach_ack_survives_later_sibling_ack_before_waiter_polls ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::delayed_ack_preserves_highest_input_offset ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::input_ack_survives_later_sibling_ack_before_waiter_polls ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::pump_attach_waits_for_control_probe_before_next_mutation ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::pump_returns_consumed_output_and_snapshot_credit_to_the_same_stream ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_routes::pump_survives_an_idle_quiet_window_without_application_output ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::generation_update_preserves_passkey_ca_and_all_live_routes ... ignored, exclusive perf VM; requires signed generation fixtures and a scoped release origin test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::signed_deploy_preserves_passkey_ca_and_live_sessions ... ignored, exclusive perf VM staging proof; requires signed run artifacts and systemd test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::staging_browser_services_probes_between_commands ... ignored, root shipping binary functional proof; requires INFRATERNAL_TEST_BINARY and private CA test root test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::staging_root_accepts_legacy_and_job_scoped_roots ... ok test auth::tests::ca_administration_tests::shipping_cli_tests::deploy_staging::staging_root_rejects_unscoped_and_escaping_paths ... ok test auth::tests::audit_recovery_after_page_discard_can_resume_at_original_deadline ... ok test auth::tests::ca_administration_tests::pending_administrator_cannot_replace_the_last_retained_wrapped_copy ... ok test auth::tests::ca_administration_tests::published_issuer_without_memory_projection_is_recovered_as_locked_trust ... ok test auth::tests::ca_administration_tests::role_changes_require_fresh_purpose_bound_proofs_and_recheck_owner_permission ... ok test auth::tests::ca_membership_tests::administrator_guard_cost_at_1000_memberships ... ignored, optimized administrator guard diagnostic at1000 memberships; no own build/browser overlap test auth::tests::ca_administration_tests::role_grant_is_pending_and_revoke_removes_old_copy_without_restoring_old_authority ... ok test auth::tests::ca_membership_tests::administrator_bootstrap_is_explicit_and_owner_flag_cannot_replace_revoked_role ... ok test auth::tests::discoverable_latency_at_pending_capacity ... ignored, run --release --ignored --nocapture without concurrent builds test auth::tests::audit_recovery_pending_is_visible_to_signed_in_device ... ok test auth::tests::ca_membership_tests::administrator_copy_refuses_deleted_passkey_or_session ... ok test auth::tests::ca_membership_tests::administrator_copy_refuses_pending_expired_stale_or_future_session ... ok test auth::tests::ca_administration_tests::revoked_membership_or_original_session_cannot_finish_an_existing_ca_ceremony ... ok test auth::tests::ca_administration_tests::wrong_wrapping_key_or_missing_user_verification_leaves_ca_locked ... ok test auth::tests::logout_commit::logout_publication_measurement ... ignored, measurement only; run on a perf VM under perf-run.sh test auth::tests::audit_recovery_session_expiring_during_verification_keeps_delay ... ok test auth::tests::authenticated_prf_metadata_preserves_legacy_envelopes ... ok test auth::tests::ceremony_prf_wraps_and_optional_second_passkey ... ok test auth::tests::provider_labels_cover_the_cited_registry_without_guessing ... ok test auth::tests::provider_session_latency_at_50_devices ... ignored, local auth session scale measurement; run without concurrent builds test auth::tests::concurrent_owner_and_optional_passkey_enrollment_fail_closed ... ok test auth::tests::discoverable_login_handle_credential_counter_and_replay ... ok test auth::tests::read_only_plugin_tests::recovery_keeps_inventory_but_refuses_feature_switches_without_storage_writes ... ok test auth::tests::enrollment_prf_input_matches_discoverable_login ... ok test auth::tests::read_only_tests::read_only_auth_opens_without_migrations_and_preserves_session_expiry ... ok test auth::tests::host_facts_review_tests::pending_host_facts_read_keeps_control_ping_responsive ... ok test auth::tests::read_only_tests::read_only_auth_refuses_a_changed_or_incomplete_schema_without_repair ... ok test auth::tests::read_only_tests::read_only_http_reads_identity_and_refuses_mutation_without_expiring_the_cookie ... ok test auth::tests::read_only_tests::read_only_pending_cookie_keeps_its_restriction_and_expiry_without_cleanup ... ok test auth::tests::http_csrf_cookie_flags_body_limit_and_latency_evidence ... ok test auth::tests::logout_commit::logout_commit_failure_does_not_publish_revocation_or_report_success ... ok test auth::tests::read_only_tests::read_only_auth_rejects_checksum_mismatch_and_dirty_or_extra_migrations ... ok test auth::tests::logout_commit::review_account_scope_committed_logout_keeps_wake_when_waiter_is_cancelled ... ok test auth::tests::logout_commit::review_account_scope_statement_rollback_is_quiet_and_later_commit_wakes_once ... ok test auth::tests::pending_unlock_expires_without_terminal_authority ... ok test auth::tests::public_status_and_discoverable_http_login ... ok test auth::tests::recovery_session_delay_latency_at_capacity ... ignored, release-only recovery measurement at 50 live sessions; run without concurrent compilation test auth::tests::public_status_result_fields_are_listed_in_the_auth_contract ... ok test auth::tests::read_only_tests::runtime_tests::fallback_router_restarts_without_writes_and_keeps_frozen_or_latest_wal_identity ... ok test auth::tests::recovery_verifier_latency_at_capacity ... ignored, release-only v2 diagnostic at 50 live session rows; record host load separately test auth::tests::recovery_audit_commits_once_with_start_cancel_and_complete ... ok test auth::tests::recovery_delay_cancel_and_replacement_revokes_every_capability ... ok test auth::tests::recovery_expiry_revocation_and_cross_user_isolation ... ok test auth::tests::remote_removal_tests::fresh_removal_revokes_offline_host_and_cannot_replay ... ok test auth::tests::remote_removal_tests::logout_or_role_loss_after_removal_start_preserves_host ... ok test auth::tests::recovery_http_live_same_account_is_immediate ... ok test auth::tests::recovery_http_other_expired_pending_and_missing_sessions_wait ... ok test auth::tests::recovery_live_session_cannot_accelerate_an_active_delayed_request ... ok test auth::tests::recovery_live_session_revoked_during_verification_cannot_waive_delay ... ok test auth::tests::recovery_unknown_identity_pays_the_same_database_and_verifier_work ... ok test auth::tests::recovery_username_identity_is_additive_and_ambiguous_forms_fail ... ok test auth::tests::redacted_unknown_and_failed_registrations_do_not_claim_a_provider ... ok test auth::tests::registration_aaguid_survives_none_attestation_and_binds_session_provider ... ok test auth::tests::rejected_origin_uv_challenge_signature_prf_and_expired_ceremonies ... ok test auth::tests::review3_tests::review3_backend_reply_has_a_deadline ... ok test auth::tests::review3_tests::review3_busy_expiry ... ok test auth::tests::review3_tests::review3_busy_logout ... ok test auth::tests::review3_tests::review3_busy_recovery ... ok test auth::tests::review3_tests::review4_slow_open_at_user_capacity ... ignored, release-only connect scale measurement; run without concurrent builds test auth::tests::review3_tests::review3_completion_and_cleanup_are_transaction_bound ... ok test auth::tests::review3_tests::review3_expired_handshake_must_not_welcome ... ok test auth::tests::review3_tests::review3_identified_privacy_timing_and_binding_replays ... ok test auth::tests::review3_tests::review3_pending_routes_and_idle_expiry_recovery ... ok test auth::tests::review3_tests::review3_revoked_handshake_must_not_welcome ... ok test auth::tests::review3_tests::review3_revoked_resume_must_not_welcome ... ok test auth::tests::review3_tests::review3_unwrap_cannot_be_skipped ... ok test auth::tests::review3_tests::review3_waiting_handshake_loses_authority ... ok test auth::tests::review3_tests::review4_open_reply_and_revocation_preserve_authority ... ok test auth::tests::review_edge_revocation_tests::review_r2_missing_dev_committed_logout_keeps_revocation_wake ... ok test auth::tests::review_invalid_device_polling_exhausts_browser_budget ... ok test auth::tests::review_old_words_race_rotation ... ok test auth::tests::reviewer_tests::reviewer_disk_cancel_complete_races ... ok test auth::tests::reviewer_tests::reviewer_disk_restart_and_concurrent_resume ... ok test auth::tests::reviewer_tests::reviewer_http_denials_and_recovery_admission ... ok test auth::tests::reviewer_tests::reviewer_http_expired_capability_cannot_complete_after_writer_wait ... ok test auth::tests::setup_check_is_non_consuming_and_closes_after_owner_creation ... ok test auth::tests::setup_identity_validation_and_uniqueness ... ok test auth::tests::reviewer_tests::reviewer_http_expired_ceremony_cannot_complete_after_writer_wait ... ok test auth::tests::setup_start_accepts_username_and_display_name ... ok test auth::tests::reviewer_tests::reviewer_server_clock_rollback_retains_deadline_and_reports_more_than_day ... ok test auth::tests::socket_tests::authority_stall_soak::authority_fast_read_echo_rtt ... ignored, measurement for #240; run explicitly on the perf VM test auth::tests::socket_tests::authority_stall_soak::authority_stall_soak ... ignored, measurement for #240; run explicitly on the perf VM test auth::tests::rotation_tests::recovery_phrase_routes_are_removed_and_words_fail_closed ... ok test auth::tests::rotation_tests::recovery_rotation_cannot_follow_a_cookie_account_switch ... ok test auth::tests::rotation_tests::recovery_rotation_denies_pending_expired_and_stale_sessions ... ok test auth::tests::rotation_tests::recovery_rotation_requires_session_and_replaces_legacy_envelope ... ok test auth::tests::rotation_tests::reviewer_concurrent_signed_in_rotations_commit_once ... ok test auth::tests::server_setup_terminal_echo_and_resume_preserve_offsets_once ... ok test auth::tests::sessions_slide_but_fresh_tap_does_not_and_device_keys_are_scoped ... ok test auth::tests::setup_restart_rotation_expiry_and_parallel_redemption ... ok test auth::tests::socket_tests::authenticated_idle_socket_survives_the_former_read_timeout ... ok test auth::tests::socket_tests::canvas::canvas_real_socket_commits_and_runtime_disable_preserve_control ... ok test auth::tests::socket_tests::claude_review_visible_liveness::claude_review_watch_expires_host_made_visible_by_membership_edit ... ok test auth::tests::socket_tests::clean_control_close_is_not_an_internal_error ... ok test auth::tests::socket_tests::close_logging::agent_stream_loss_logs_its_safe_close_reason_and_reaches_the_browser ... ok test auth::tests::socket_tests::close_logging::authority_read_timeout_during_a_frame_logs_authority_unavailable ... ok test auth::tests::socket_tests::close_logging::browser_websocket_close_logs_its_code_and_safe_reason_for_attached_sessions ... ok test auth::tests::socket_tests::close_logging::failed_client_resume_attempt_logs_each_retained_session ... ok test auth::tests::socket_tests::close_logging::revocation_wake_on_busy_store_logs_authority_unavailable_not_resume_refused ... ok test auth::tests::socket_tests::close_logging::revoked_busy_wake_records_stream_end_within_the_existing_wait ... ok test auth::tests::socket_tests::close_logging::revoked_session_during_transient_stall_logs_resume_refused ... ok test auth::tests::socket_tests::mesh_latency::mesh_snapshot_keystroke_latency_at_10000_nodes ... ignored, weighted real-binary 300 ms Mesh/PTY measurement test auth::tests::socket_tests::close_logging::rootless_attach_without_a_live_peer_logs_the_host_and_keeps_the_socket_up ... ok test auth::tests::socket_tests::close_logging::session_lookup_store_error_logs_authority_unavailable ... ok test auth::tests::socket_tests::close_logging::unrelated_logout_during_transient_stall_keeps_the_terminal_socket ... ok test auth::tests::socket_tests::expired_handshake_releases_user_permits ... ok test auth::tests::socket_tests::fragmented_wire_frame_has_a_completion_deadline ... ok test auth::tests::socket_tests::fresh_delete::review_mesh_delete_requires_fresh_passkey_tap ... ok test auth::tests::socket_tests::half_open_sockets_obey_user_limit ... ok test auth::tests::socket_tests::plugin_lifecycle::mesh_destructive_metadata_matches_frozen_confirmation_requirements ... ok test auth::tests::socket_tests::incomplete_rfc_message_still_loses_authority_on_revocation ... ok test auth::tests::socket_tests::mesh_calls_and_subscriptions_deliver_scoped_live_inventory ... ok test auth::tests::socket_tests::plugin_lifecycle::plugin_exchange_correlates_results_after_subscription_events ... ok test auth::tests::socket_tests::non_owner_without_host_configure_permission_is_refused_before_leg_b ... ok running 1 test test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.91s test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok running 1 test test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.94s test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_needing_session_renewal_interrupts_the_database_writer_fence ... ok running 1 test test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::input_during_checkpoint_keeps_the_original_browser_and_exact_bytes ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.74s test auth::tests::socket_tests::restart_open_liveness_review::checkpoint::revoked_session_cannot_release_retained_input_after_preparation ... ok test auth::tests::socket_tests::per_account_revocation::account_logout_wakes_only_its_16_sockets_among_256 ... ok test auth::tests::socket_tests::per_account_revocation::account_recovery_wakes_only_its_16_sockets_among_256 ... ok test auth::tests::socket_tests::per_account_revocation::another_live_session_on_the_affected_account_keeps_its_proof_lease ... ok test auth::tests::socket_tests::per_account_revocation::coalesced_session_logout_cannot_hide_an_earlier_revoked_proof_lease ... ok test auth::tests::socket_tests::plugin_lifecycle::disabling_mesh_joins_pending_writer_and_refuses_nonowner_switches ... ok test auth::tests::socket_tests::plugin_lifecycle::mesh_coordinator_requires_an_existing_server_role ... ok test auth::tests::socket_tests::plugin_lifecycle::mesh_lifecycle_withdrawals_survive_calls_but_never_end_a_replacement ... ok test auth::tests::socket_tests::plugin_lifecycle::mesh_plugin_discovery_disable_and_restart_preserve_control_socket ... ok test auth::tests::socket_tests::recovery_subscription_updates_every_signed_in_socket ... ok test auth::tests::socket_tests::restart_open_liveness_review::responsive_socket_survives_a_held_terminal_open_with_an_existing_attachment ... ok test auth::tests::socket_tests::review_account_scope::account_deletion_retires_open_sockets_without_affecting_other_accounts ... ok test auth::tests::socket_tests::review_account_scope::lagged_cursors_survive_65536_overwrites_and_unknown_scope_wakes_every_account ... ok test auth::tests::socket_tests::review_account_scope::lost_recovery_source_closes_with_1013_without_another_authority_read ... ok test auth::tests::socket_tests::review_account_scope::lost_revocation_source_closes_with_1013_without_another_authority_read ... ok test auth::tests::socket_tests::review_account_scope::reassigned_session_cannot_authorize_work_for_its_former_account ... ok test auth::tests::socket_tests::review_account_scope::review_r2_lost_recovery_source_reports_unavailable_or_reads_authority ... ok test auth::tests::socket_tests::review_account_scope::simultaneous_recovery_a_and_logout_b_preserve_both_scopes ... ok test auth::tests::socket_tests::review_account_scope::two_accounts_revoked_before_either_cursor_runs_both_refuse ... ok test auth::tests::socket_tests::review_authority_cap::every_socket_in_a_full_place_storm_fails_closed_without_a_reply ... ok test auth::tests::socket_tests::review_authority_cap::retries_whose_select_waits_stay_within_the_authority_cap ... ok test auth::tests::socket_tests::review_authority_retry::renewing_retries_do_not_drain_the_pool_during_a_write_stall ... ok test auth::tests::socket_tests::review_authority_retry::session_expiring_during_the_wait_is_not_revived_or_served ... ok test auth::tests::socket_tests::review_busy_wake::idle_busy_revocation_wake_sends_server_busy_close_code ... ok test auth::tests::socket_tests::review_busy_wake::sixteen_woken_sockets_recover_application_authority_after_a_short_stall ... ok test auth::tests::socket_tests::review_close_log::attaches_to_unowned_session_ids_cannot_flood_the_close_log ... ok test auth::tests::socket_tests::review_input_credit::pending_browser_input_counts_against_slots_and_cancels_on_drop ... ok test auth::tests::socket_tests::review_input_credit::pending_browser_input_has_a_wire_byte_bound ... ok test auth::tests::socket_tests::review_control::pending_mesh_writers_preserve_authority_pool_capacity ... ok test auth::tests::socket_tests::review_control::review_pending_mesh_write_keeps_control_dispatch_available ... ok test auth::tests::socket_tests::review_fresh_wait::review_mesh_delete_refused_when_freshness_expires_during_writer_wait ... ok test auth::tests::socket_tests::review_input_credit::browser_input_overload_retires_only_the_terminal_stream ... ok test auth::tests::socket_tests::review_input_credit::browser_output_credit_refusal_logs_the_stream_reason ... ok test auth::tests::socket_tests::review_input_credit::idle_browser_probes_do_not_renew_or_poll_session_authority ... ok test auth::tests::socket_tests::review_input_credit::idle_probe_authority_cancels_waiting_write_on_committed_revocation ... ok test auth::tests::socket_tests::review_input_credit::idle_probe_authority_refreshes_expiry_after_authorized_activity ... ok test auth::tests::socket_tests::review_input_credit::idle_server_probes_do_not_renew_session_authority ... ok test auth::tests::socket_tests::review_input_credit::review_full_input_writer_preserves_browser_control_progress ... ok test auth::tests::socket_tests::review_liveness::review_mesh_watch_reports_liveness_expiry_without_another_edit ... ok test auth::tests::socket_tests::review_mobile_visibility::review_hidden_socket_cannot_park_absolute_session_expiry ... ok test auth::tests::socket_tests::socket_authority_latency_at_user_capacity ... ignored, release-only measurement without concurrent compilation test auth::tests::socket_tests::review_mobile_visibility::review_hidden_socket_cannot_park_logout_revocation ... ok test auth::tests::socket_tests::review_subscription_refusal::oversized_refusal_cannot_reinstall_a_queued_mesh_subscription ... ok test auth::tests::socket_tests::review_subscription_refusal::review_oversized_replacement_ends_the_previous_mesh_subscription ... ok test auth::tests::socket_tests::review_subscription_refusal::saturated_refusal_cannot_reinstall_a_queued_mesh_subscription ... ok test auth::tests::socket_tests::revoked_idle_socket_loses_all_authority ... ok test auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket has been running for over 60 seconds test auth::tests::socket_tests::session_gone::an_ended_or_unknown_session_gets_the_final_close_without_losing_the_socket has been running for over 60 seconds test auth::tests::socket_tests::session_gone::the_infraternal_agent_saying_gone_reaches_the_browser_as_the_final_close has been running for over 60 seconds test auth::tests::socket_tests::session_gone::transient_host_close_absorbs_inflight_credit_resize_and_input has been running for over 60 seconds test auth::tests::socket_tests::startup_guard::startup_guard_refuses_unowned_sessions_and_unconfirmed_edits has been running for over 60 seconds test auth::tests::socket_tests::terminal_exit::retired_exit_preserves_status_without_claiming_final_output_delivery has been running for over 60 seconds test auth::tests::socket_tests::terminal_exit::terminal_exit_persists_once_under_current_ownership_and_session has been running for over 60 seconds test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_beyond_the_wait_still_fails_closed has been running for over 60 seconds test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_shorter_than_the_wait_keeps_the_socket_and_its_order has been running for over 60 seconds test auth::tests::socket_tests::transient_authority_stall::teardown_does_not_renew_the_session has been running for over 60 seconds test auth::tests::socket_tests::scale::review_mesh_headroom_snapshot_does_not_close_shared_socket ... ok test auth::tests::socket_tests::session_gone::an_ended_or_unknown_session_gets_the_final_close_without_losing_the_socket ... ok test auth::tests::socket_tests::session_gone::the_infraternal_agent_saying_gone_reaches_the_browser_as_the_final_close ... ok test auth::tests::socket_tests::session_gone::transient_host_close_absorbs_inflight_credit_resize_and_input ... ok test auth::tests::socket_tests::startup_guard::startup_guard_refuses_unowned_sessions_and_unconfirmed_edits ... ok test auth::tests::socket_tests::terminal_exit::retired_exit_preserves_status_without_claiming_final_output_delivery ... ok test auth::tests::socket_tests::terminal_exit::terminal_exit_persists_once_under_current_ownership_and_session ... ok test auth::tests::verified_passkey_tests::canceled_proof_before_writer_admission_leaves_no_new_session_or_pending_ceremony ... ok test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_beyond_the_wait_still_fails_closed ... ok test auth::tests::verified_passkey_tests::proof_only_ceremony_expiring_during_writer_wait_cannot_commit_a_counter_or_session ... ok test auth::tests::socket_tests::transient_authority_stall::authority_read_stall_shorter_than_the_wait_keeps_the_socket_and_its_order ... ok test auth::tests::verified_passkey_tests::proof_only_verification_preserves_monotone_registered_credential_counter ... ok test auth::tests::socket_tests::transient_authority_stall::teardown_does_not_renew_the_session ... ok test auth::tests::verified_passkey_tests::verified_passkey_has_live_registered_identity_and_creates_no_session ... ok test auth::tests::verified_passkey_tests::proof_only_verification_refuses_missing_uv_or_deleted_credential ... ok test auth::tests::socket_tests::transient_authority_stall::teardown_with_a_busy_store_does_not_wait_for_authority ... ok test auth::tests::socket_tests::transient_authority_stall::terminal_stream_survives_authority_stalls_without_loss_or_reorder ... ok test auth::tests::stale_counters_recovery_cancellation_and_wrap_tampering ... ok test auth::tests::terminal_refusal_tests::memory_refusal_preserves_reason_and_counters_to_browser ... ok test auth::tests::tls_tests::proxy_tls_registration_session_split_cookies ... ok test auth::tests::tls_tests::standalone_tls_registration_session_split_cookies ... ok test bootstrap_api::tests::a_client_request_during_a_pending_confirmation_keeps_the_batch ... ok test bootstrap_api::tests::admission_stream_is_ordered_and_logout_retires_an_idle_socket ... ok test bootstrap_api::tests::bootstrap_logout_before_subscription_closes_idle_upgrade ... ok test bootstrap_api::tests::component_off_interrupts_a_stalled_host_key_confirmation_lookup ... ok test bootstrap_api::tests::component_off_interrupts_a_stalled_progress_send ... ok test bootstrap_api::tests::component_off_retires_idle_sockets_and_refuses_new_admission ... ok test bootstrap_api::tests::control_frames_do_not_cancel_bootstrap_or_starve_progress ... ok test bootstrap_api::tests::host_key_confirmation_rechecks_the_exact_live_owner_capability ... ok test bootstrap_api::tests::logout_interrupts_a_stalled_host_key_confirmation_lookup ... ok test bootstrap_api::tests::origin_owner_unlock_and_whole_request_consent_are_required ... ok test bootstrap_api::tests::review_account_scope_logout_after_subscription_retires_idle_bootstrap ... ok test bootstrap_api::tests::review_account_scope_lost_bootstrap_source_retires_instead_of_spinning ... ok test bootstrap_api::tests::start_fresh_request_is_bound_to_a_target_and_public_challenge ... ok test bootstrap_runtime::failure_log_tests::one_line_contains_only_classified_public_coordinates ... ok test bootstrap_runtime::failure_log_tests::start_fresh_logs_only_the_exact_public_ownership_journal_and_outcome ... ok test bootstrap_api::tests::review_r2_restored_bootstrap_source_still_reports_unavailable ... ok test bootstrap_runtime::remote_backend::admission_tests::installed_admission_waits_for_the_active_route ... ok test bootstrap_runtime::remote_backend::admission_tests::missing_route_uses_link_scaled_bound_without_inventory_extensions ... ok test bootstrap_runtime::remote_backend::admission_tests::review_commit_budget_allows_final_proof_after_both_route_phases ... ok test bootstrap_runtime::remote_backend::admission_tests::review_commit_budget_allows_final_proof_at_600_ms ... ok test bootstrap_runtime::remote_backend::admission_tests::review_commit_budget_is_monotonic_for_zero_and_outlier_samples ... ok test bootstrap_runtime::remote_backend::canary_tests::cancellation_keeps_the_owned_session_available_for_cleanup ... ok test bootstrap_runtime::remote_backend::canary_tests::failed_attachment_finishes_the_private_command ... ok test bootstrap_runtime::remote_backend::canary_tests::private_writers_reserve_the_browser_allocator_without_publishing_sessions ... ok test bootstrap_runtime::remote_backend::canary_tests::readiness_accepts_authoritative_snapshot_output ... ok test bootstrap_runtime::remote_backend::canary_tests::readiness_accepts_primary_exit_without_reattaching_to_a_retired_session ... ok test bootstrap_runtime::remote_backend::canary_tests::readiness_input_preserves_the_terminal_actor_and_host_connection ... ok test bootstrap_runtime::remote_backend::tests::already_added_breakit::a_non_owner_session_never_learns_the_owners_host_id ... ok test bootstrap_runtime::remote_backend::tests::already_added_breakit::a_revoked_host_never_names_its_id ... ok test bootstrap_runtime::remote_backend::tests::already_added_breakit::the_typed_address_decides_which_host_is_named_when_two_match ... ok test bootstrap_runtime::remote_backend::tests::automatic_cleanup_requires_the_exact_failed_server_host_binding ... ok test bootstrap_runtime::remote_backend::tests::breakit2_concurrent_same_destination_issues_only_one_invitation ... ok test bootstrap_runtime::remote_backend::tests::breakit2_live::breakit2_live_ssh_install_join_and_terminal ... ignored, #169 live disposable Docker target; invoke docs/verification/addhost-breakit2/measure.py test bootstrap_runtime::remote_backend::tests::breakit2_live::compound_retry_fixture_reaches_install_boundary ... ok test bootstrap_runtime::remote_backend::tests::breakit2_live::live_fixture_keeps_authority_after_connection_retirement ... ok test bootstrap_runtime::remote_backend::tests::breakit2_live::live_fixture_keeps_the_full_image_and_selects_the_explicit_session_image ... ok test bootstrap_runtime::remote_backend::tests::breakit2_live::provisioning_https_uses_production_tcp_admission ... ok test bootstrap_runtime::remote_backend::tests::breakit2_live::retry_lock_timing_runs_inside_the_nested_setup_shell ... ok test bootstrap_runtime::remote_backend::tests::breakit2_live::retry_setup_timing_preserves_transfer_upload_status ... ok test bootstrap_runtime::remote_backend::tests::breakit2_unpublished_invitation_retires_durable_authority ... ok test bootstrap_api::tests::revocation_interrupts_a_stalled_progress_send ... ok test bootstrap_runtime::remote_backend::tests::cancelled_invitation_after_commit_retires_its_host_record ... ok test bootstrap_runtime::remote_backend::tests::destination_reservation_admission_at_1600_pending_hosts ... ignored, #169 local bounded-journal scale evidence under CPUWeight scope test bootstrap_runtime::remote_backend::tests::cold_ca_refuses_before_invitation_or_upload ... ok test bootstrap_runtime::remote_backend::tests::failed_upload_retires_only_the_new_host ... ok test bootstrap_runtime::remote_backend::tests::foreign_or_revoked_authority_never_opens_ssh ... ok test bootstrap_runtime::remote_backend::tests::readding_a_live_host_reports_already_added_before_issuing_a_certificate ... ok test bootstrap_api::tests::settings_public_key_requires_exact_origin_and_live_unlocked_owner ... ok test bootstrap_runtime::remote_backend::tests::unpublished_attempt_drop_releases_only_its_ownership ... ok test bootstrap_runtime::tests::pending_integration_refuses_enrollment_vault_and_discovery ... ok test ca::tests::signed_identity_has_only_server_constructed_host_authority_and_seven_days ... ok test ca::tests::signing_boundary_at_1000_public_identities ... ignored, explicit signing-boundary diagnostic; not live renewal or connected-agent RSS test ca::tests::source_mismatch_locked_and_uncovered_validity_fail_closed ... ok test ca::wrapping::tests::bounded_decoder_rejects_duplicate_unknown_fields_and_exact_oversize ... ok test ca::wrapping::tests::ciphertext_nonce_salt_and_issuer_tampering_fail_authenticated_decryption ... ok test ca::wrapping::tests::creation_rejects_unbound_membership_and_malformed_copies_cannot_open ... ok test ca::wrapping::tests::encrypted_copy_cost_at_1000_administrators ... ignored, optimized CA copy diagnostic; no own builds/browser overlap test ca::wrapping::tests::invalid_issuer_key_binding_is_refused_before_a_copy_is_persisted ... ok test ca::wrapping::tests::wrapped_seed_roundtrip_validates_the_same_issuer_key ... ok test ca::wrapping::tests::wrong_key_member_epoch_or_issuer_cannot_unwrap_a_copy ... ok test ca_bootstrap::tests::generated_remote_leaf_is_verifiable_after_cold_restart ... ok test ca_copies::tests::copy_store_cost_at_1000_administrators ... ignored, release-only private CA-copy disk diagnostic; no own build/browser overlap test ca_copies::tests::encrypted_copy_is_private_durable_and_bound_to_member_generation ... ok test ca_copies::tests::removal_is_member_generation_scoped_and_idempotent ... ok test ca_copies::tests::unsafe_copy_directory_or_file_is_refused_without_following_symlinks ... ok test ca_handoff::shipping_tests::browser_client::tests::probes_are_answered_without_assertion_reads_and_drop_closes_the_socket ... ok test ca_handoff::shipping_tests::shipping_child ... ok test ca_handoff::shipping_tests::shipping_restart_reload_rollback_and_cold_start ... ignored, explicit shipping-binary integration/benchmark; set INFRATERNAL_TEST_BINARY test ca_handoff::tests::exec_child ... ok test ca_handoff::tests::failed_null_open_or_duplication_closes_private_stdin ... ok test bootstrap_api::tests::setup_logout_before_subscription_closes_idle_upgrade ... ok test ca_handoff::tests::real_exec_failures_and_killed_receiver_never_unlock_a_cold_successor ... ok test ca_handoff::tests::real_exec_retains_unlock_but_another_process_cannot_import_the_channel ... ok test ca_handoff::tests::serialized_seed_frame_is_locked_and_excluded_from_core_dumps ... ok test ca_handoff::tests::socketpair_preserves_unlock_and_cold_start_still_locks ... ok test ca_handoff::tests::truncated_wrong_generation_and_wrong_version_leave_successor_locked ... ok test ca_handoff_binary::tests::listener_capability_is_independent_of_ca_custody ... ok test ca_handoff_binary::tests::marker_is_an_exact_versioned_note_not_a_byte_substring ... ok test ca_http::intake_tests::chunked_intake_is_bounded_before_parsing ... ok test ca_memory::tests::accepted_unlock_notifies_and_memory_handoff_preserves_signing_without_a_timer ... ok test ca_memory::tests::cold_start_retains_public_trust_and_denied_unlock_leaves_signing_locked ... ok test ca_handoff::tests::parser_property_corpus_is_bounded_and_never_accepts_trailing_bytes ... ok test ca_update_audit_tests::every_ciphertext_byte_and_tag_mutation_refuses_without_material_in_errors ... ok test ca_update_audit_tests::handoff_descriptor_is_close_on_exec_and_prepare_failure_preserves_source ... ok test ca_memory::tests::unavailable_secure_heap_refuses_root_and_warns_for_nonroot ... ok test ca_update_audit_tests::handoff_memory_protection_failure_keeps_the_existing_signer ... ok test ca_update_audit_tests::secure_heap_capacity_at_10000_live_keys ... ignored, isolated secure heap sizing at 10000 live keys; run with no own builds/browser overlap test ca_update_audit_tests::unlocked_signer_requires_persistent_locked_pages ... ok test canvas_store::tests::cancelled_commit_still_invalidates_a_durable_change ... ok test canvas_store::tests::cas_retry_and_foreign_account_isolation ... ok test canvas_store::tests::permanent_receipts_keep_the_original_json_digest_recipe ... ok test csr::tests::incomplete_suffix_oversized_forged_and_wrong_algorithm_requests_are_refused ... ok test csr::tests::nonminimal_outer_lengths_and_real_oversized_requests_are_refused ... ok test csr::tests::signed_cached_noncanonical_or_incomplete_shapes_are_refused ... ok test csr::tests::signed_constructed_primitive_attribute_is_refused ... ok test csr::tests::signed_noncanonical_ignored_values_are_refused ... ok test csr::tests::verified_host_key_is_admitted_without_trusting_requested_identity ... ok test embedded::exit_latency_tests::shim_sigkill_to_server_inventory_latency ... ignored, real daemon artifact and 200 shim exits; run with INFRATERNAL_BIN in a weighted scope test embedded::priming::flights::tests::queued_sibling_failure_stays_owned_until_the_actor_observes_it ... ok test embedded::priming::flights::tests::stop_preserves_finished_success_and_identifies_unpolled_cancellation ... ok test embedded::priming::header_tests::blocked_promotion_header_does_not_stop_actor_control_progress ... ok test ca_update_audit_tests::no_timer_locks_signing_and_wrong_issuer_cannot_replace_the_unlocked_source ... ok test embedded::priming::header_tests::promoted_owned_attach_opens_a_missing_native_writer_binding ... ok test embedded::priming::tests::abandoned_preparation_cancels_even_before_the_owned_task_first_polls ... ok test embedded::priming::tests::flow_control_blocked_shadow_does_not_stop_actor_control_progress ... ok test embedded::priming::tests::later_input_is_hedged_without_resending_the_first_suffix ... ok test embedded::priming::tests::overlap_and_stale_snapshot_do_not_spend_browser_credit ... ok test embedded::priming::header_tests::promotion_never_publishes_an_unstarted_shadow_flight_as_credited ... ok test embedded::priming::tests::snapshot_notice_precedes_repaint_and_duplicates_spend_no_browser_credit ... ok test embedded::priming::tests::shadow_input_and_snapshot_credit_have_independent_bounded_windows ... ok test embedded::priming::tests::stream_reuse_waits_for_the_retired_flight_to_join ... ok test embedded::regressions::agent_link_loss_invalidates_the_last_live_session_snapshot ... ok test embedded::regressions::actor_batch_probes_every_ready_route_without_payload_notifications ... ok test embedded::regressions::child_spawn_disposes_inherited_stdin ... ok test embedded::regressions::credited_bulk_output_survives_forwarder_io_pause ... ok test embedded::regressions::credited_output_queue_at_stream_capacity ... ignored, debug actor memory/scheduling measurement; run without concurrent builds test embedded::regressions::expired_route_retires_full_consumer ... ok test embedded::regressions::expired_route_waits_for_browser_authority_before_rebind ... ok test embedded::regressions::full_output_queue_must_not_block_shared_actor ... ok test embedded::regressions::greeted_links_that_die_young_escalate_the_actor_retry_delay ... ok test bootstrap_api::tests::setup_status_tests::late_setup_subscriber_receives_failure_and_retry_completion ... ok test embedded::regressions::healthy_receiver_survives_ready_native_output_burst ... ok test embedded::regressions::credit_tests::retained_input_credit_parks_only_the_full_writer_until_its_ack ... ok test embedded::regressions::idle_route_proofs_do_not_queue_payload_notifications_at_capacity ... ok test embedded::regressions::liveness_doubt_breakit_r2_tests::a_pinned_dead_host_retires_within_two_ceilings_without_doubt ... ok test embedded::regressions::liveness_doubt_breakit_r2_tests::a_window_that_reconnects_mid_doubt_is_told_and_recovered ... ok test embedded::regressions::liveness_doubt_breakit_r2_tests::doubt_retry_sends_one_notice_per_window_per_episode ... ok test embedded::regressions::liveness_doubt_breakit_tests::a_window_full_at_doubt_start_is_told_on_a_later_tick ... ok test embedded::regressions::liveness_doubt_breakit_tests::doubt_and_retire_times_per_rtt ... ok test embedded::regressions::liveness_doubt_breakit_tests::inflated_host_link_still_retires_a_dead_host_within_four_seconds ... ok test embedded::regressions::liveness_doubt_breakit_tests::queued_path_at_the_ceiling_does_not_flap_doubt_every_probe ... ok test bootstrap_api::tests::setup_status_tests::review_account_scope_lost_setup_source_reports_unavailable_and_retires ... ok test embedded::regressions::native_input_retention_leaves_terminal_probes_to_the_route ... ok test embedded::regressions::output_and_snapshot_spend_remaining_restart_credit ... ok test embedded::regressions::path_tests::full_ack_releases_retention_and_duplicate_input_is_not_replayed ... ok test embedded::regressions::path_tests::full_retention_replays_as_legal_frames_with_contiguous_offsets ... ok test embedded::regressions::path_tests::initial_attachment_keeps_input_cut_through_before_its_first_ack ... ok test embedded::regressions::path_tests::input_retention_cost_at_200_terminals ... ignored, Run alone on the perf VM under the shared benchmark lock. test embedded::regressions::path_tests::input_retention_refuses_excess_before_advancing_the_cursor ... ok test embedded::regressions::path_tests::replacement_replays_only_the_unacknowledged_suffix_and_queued_input ... ok test embedded::regressions::path_tests::reply_queue_deadline_and_live_reply_do_not_change_typing_offsets ... ok test embedded::regressions::path_tests::review_pending_input_limit_retires_only_its_attachment ... ok test embedded::regressions::path_tests::review_reply_bypasses_queued_typing_without_losing_its_cursor_or_bytes ... ok test embedded::regressions::plugin_control_notice_preserves_capability_invalidation ... ok test embedded::regressions::query_reply_compatibility_notice_is_strict_and_session_bound ... ok test embedded::regressions::real_agent_canonical_uuid_result_is_accepted ... ok test embedded::regressions::real_agent_open_uses_uid_and_character_dimensions ... ok test embedded::regressions::reattach_must_restore_output_credit ... ok test embedded::regressions::recovered_route_ignores_stale_browser_rebind ... ok test embedded::regressions::recovery_event_then_snapshot_keeps_embedded_connection_live ... ok test embedded::regressions::recovery_notices_preserve_order_credit_and_session_isolation ... ok test embedded::regressions::replay_complete_notices_preserve_optional_geometry_through_server ... ok test embedded::regressions::replay_geometry_rejects_values_outside_u16 ... ok test embedded::regressions::resumed_writer_closes_previous_route_before_shared_stream_reuse ... ok test embedded::regressions::resumed_writer_for_other_session_preserves_live_route ... ok test embedded::regressions::saturated_control_pong_does_not_retire_connection ... ok test embedded::regressions::server_reload_mask_is_not_inherited_by_embedded_children ... ok test embedded::regressions::stream_close_must_not_restart_all_sessions ... ok test embedded::regressions::uncredited_output_or_repaint_is_rejected_before_queueing ... ok test embedded::regressions::healthy_streams_progress_at_user_attachment_capacity ... ok test embedded::reply_order_tests::browser_reply_follows_typing_across_both_forwarding_tasks ... ok test embedded::reply_order_tests::full_reply_reservations_preserve_keyboard_bytes_and_all_eight_slots ... ok test embedded::writes::tests::bounded_lane_metadata_and_flight_sizes ... ok test embedded::writes::tests::cached_promotion_ack_never_replays_inside_the_actor ... ok test embedded::writes::tests::enabling_owned_writes_preserves_unsent_replacement_input ... ok test embedded::writes::tests::full_control_lane_keeps_all_terminal_owner_slots_available ... ok test embedded::writes::tests::promotion_headers_preserve_attach_credit_ack_input_order ... ok test embedded::writes::tests::saturated_control_queue_preserves_fifo_and_shutdown_owns_flights ... ok test embedded::writes::tests::socket_completion_cannot_spend_unacknowledged_writer_credit ... ok test enrollment::authority::tests::admission_uses_enrolled_uid_and_exact_public_identity_validity ... ok test enrollment::authority::tests::renewal_preserves_overlap_and_refuses_changed_key_or_expired_predecessor ... ok test embedded::regressions::liveness_doubt_breakit_tests::retired_doubt_never_confirms_a_replacement_link_mid_replay ... ok test enrollment::authority::tests::revocation_is_owner_bound_and_denies_admission_and_renewal_after_commit ... ok test bootstrap_api::tests::setup_status_tests::review_r2_restored_setup_source_still_reports_unavailable ... ok test enrollment::binding_tests::redemption_binds_only_the_certificate_minted_by_that_consumption ... ok test enrollment::binding_tests::replacement_proof_rechecks_certificate_and_host_validity ... ok test enrollment::binding_tests::replacement_proof_requires_its_consumed_invitation_and_exact_certificate ... ok test enrollment::binding_tests::unknown_historical_consumption_never_proves_replacement ... ok test enrollment::bootstrap_retirement::ownership_regression::retirement_requires_an_unfinished_intent ... ok test enrollment::bootstrap_retirement::tests::proven_completion_is_owner_bound_and_survives_restart ... ok test enrollment::bootstrap_retirement::tests::retirement_consumes_only_its_owned_intent_with_the_tombstone ... ok test enrollment::bootstrap_retirement::tests::startup_preserves_a_published_live_session_and_its_setup_intent ... ok test enrollment::bootstrap_retirement::tests::startup_retires_only_unfinished_provisioning_and_is_idempotent ... ok test enrollment::migration_tests::hostname_migration_allocates_around_retained_names ... ok test enrollment::migration_tests::canvas_layout_migration_upgrades_production_v27_and_fresh_schema_in_order ... ok test enrollment::migration_tests::hostname_migration_upgrades_release6_copy_without_changing_canvas_or_checksums ... ok test embedded::regressions::half_open_infraternal_agent_route_loses_inventory_without_eof ... ok test generation_copy::tests::dropping_copy_request_keeps_io_live_and_fences_owned_until_engine_finishes ... ok test generation_copy::tests::dropping_polled_copy_waiter_keeps_io_live_and_fences_owned_until_engine_finishes ... ok test generation_copy::tests::successful_copy_returns_the_still_owned_fence ... ok running 1 test test enrollment::migration_tests::invitation_certificate_migration_preserves_unknown_history_and_bounds_new_bindings ... ok running 1 test test enrollment::migration_tests::old_uuid_mesh_placeholders_upgrade_to_audited_unnamed_labels ... ok running 1 test test enrollment::migration_tests::remote_identity_and_sessions_upgrade_dev_v11_and_remain_idempotent ... ok test bootstrap_api::tests::setup_status_tests::setup_replay_outlives_its_socket_and_logout_retires_delivery ... ok test generation_writers::tests::ambiguous_or_mistyped_sequence_refuses_admission_without_repair ... ok test generation_writers::tests::committed_reservation_survives_process_death_without_connection_close ... ok test generation_writers::tests::concurrent_reservations_serialize_distinct_committed_intervals ... ok test generation_writers::tests::exhausted_reservation_preserves_previous_sequence ... ok test embedded::regressions::unresponsive_child_is_killed_and_reaped_within_the_shutdown_bound ... ok test generation_runtime::tests::trial_defers_every_public_accept_until_its_commit_opens_the_gate ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.68s test generation_runtime::tests::trial_defers_every_public_accept_until_its_commit_opens_the_gate ... ok test generation_writers::tests::missing_or_regressed_sequence_refuses_to_infer_deleted_writer_history ... ok test generation_writers::tests::nested_or_nondurable_reservation_cannot_claim_commit ... ok test generation_writers::tests::physically_read_only_admission_refuses_reservation_without_file_changes ... ok test generation_writers::tests::historical_rollback_skips_deleted_current_writers_without_changing_snapshot ... ok test generation_writers::tests::writer_reservation_crash_helper ... ignored, private subprocess for committed writer-floor crash validation test listener_handoff::tests::ephemeral_listener_export_is_refused ... ok running 1 test test bootstrap_runtime::remote_backend::tests::review_cleanup::review_cancelled_committed_invitation_survives_temporary_writer_contention ... ok test bootstrap_runtime::remote_backend::tests::retirement_contention::cancelled_invitation_retires_after_sqlite_busy_timeout ... ok running 1 test test liveness::tests::a_doubt_recovered_at_the_ceiling_pins_until_the_path_drains ... ok running 1 test test listener_handoff::tests::listener_survives_exec_after_serving_owner_drops ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.00s test liveness::tests::a_recovered_doubt_below_the_ceiling_keeps_early_notice ... ok test liveness::tests::a_reply_during_doubt_clears_it_and_renews_the_route ... ok test listener_handoff::tests::parent_manifest_is_not_a_child_handoff ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.01s test liveness::tests::an_unanswered_host_link_retires_at_the_startup_grace_without_doubt ... ok test listener_handoff::tests::parent_manifest_is_not_a_child_handoff ... ok test liveness::tests::delayed_server_probe_does_not_expire_an_answered_route ... ok test liveness::tests::healthy_reply_survives_a_150ms_server_stall ... ok test liveness::tests::browser_doubts_one_mobile_delay_and_retires_only_after_two_allowances ... ok test liveness::tests::host_and_browser_allowance_cover_one_loss_recovery ... ok test liveness::tests::host_allowance_has_a_floor_a_settled_long_haul_value_and_a_ceiling ... ok test liveness::tests::jitter_allowance_decays_after_the_link_settles ... ok running 1 test test liveness::tests::host_link_doubts_on_the_first_miss_and_retires_on_the_second ... ok test liveness::tests::missing_replies_expire_even_with_probes_in_flight ... ok test liveness::tests::pipelined_requests_do_not_renew_an_outstanding_deadline ... ok test liveness::tests::quiet_dead_browser_retires_within_two_floors_plus_one_interval ... ok test liveness::tests::ready_reply_only_pulls_forward_an_answered_probe_after_one_tick ... ok test liveness::tests::recent_application_progress_preserves_the_first_tick_cadence ... ok test liveness::tests::restarting_monitoring_never_reuses_an_old_issued_probe ... ok test liveness::tests::serial_probe_accepts_a_timely_rtt_step_without_renewing_unsolicited_replies ... ok test liveness::tests::late_native_probe_keeps_its_unissued_reply_allowance ... ok test liveness::tests::serial_probe_deadline_includes_only_one_gap_and_the_estimated_allowance ... ok test liveness::tests::suspended_browser_keeps_its_lease_and_relearns_the_mobile_path ... ok test liveness::tests::variation_uses_the_previous_smoothed_sample ... ok test liveness::tests::terminal_routes_still_end_their_lease_on_the_first_miss ... ok running 1 test test listener_handoff::tests::listener_survives_exec_after_serving_owner_drops ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.00s test listener_handoff::tests::listener_survives_exec_after_serving_owner_drops ... ok test generation_writers::tests::reservation_is_committed_before_reply_and_survives_reopen ... ok test generation_writers::tests::writable_admission_applies_manifest_floor_without_repeated_reservation ... ok test mesh_api_tests::identity::identity_migration_preserves_inventory_and_retired_audit_ids ... ok test generation_runtime::tests::writable_generation_storage_is_full_retains_wal_and_admits_the_launch_floor ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 1.10s test generation_runtime::tests::writable_generation_storage_is_full_retains_wal_and_admits_the_launch_floor ... ok test generation_runtime::tests::read_only_serving_answers_from_physically_read_only_state_and_creates_nothing ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 1.17s test generation_runtime::tests::read_only_serving_answers_from_physically_read_only_state_and_creates_nothing ... ok test bootstrap_api::tests::split_cookie_fields_preserve_bootstrap_owner_authority ... ok test mesh_api_tests::claude_review::claude_review_late_committing_observation_does_not_rewind_last_seen ... ok test mesh_api_tests::concurrent_tag_edits_serialize_revisions_and_unique_names ... ok test mesh_api_tests::identity::retired_identity_survives_database_reopen_and_exhaustion_is_atomic ... ok test mesh_api_tests::mesh_api_scale_benchmark ... ignored, scale measurement; run on infraternal-dev under the weighted user scope test bootstrap_runtime::key_authority_tests::key_export_rechecks_role_session_and_cold_lock ... ok test mesh_api_tests::claude_review::claude_review_scoped_grant_cannot_target_node_in_unscoped_tag ... ok test mesh_api_tests::parser_rejects_unknown_fields_user_endpoints_and_invalid_bounds ... ok test mesh_api_tests::identity::review_deleted_node_identity_is_not_reused ... ok test mesh_api_tests::invalidation::review_membership_change_notifies_other_visible_tag ... ok test mesh_api_tests::invalidation::filtered_view_invalidations_follow_every_affected_host_tag ... ok test mesh_api_tests::inventory_lifecycle_preserves_policy_identity_and_audits_every_edit ... ok test mesh_api_tests::membership::review_scoped_membership_cannot_claim_hidden_node ... ok test mesh_api_tests::shared_mesh_vectors_cover_each_production_action_and_wire_shape ... ok test mesh_api_tests::pagination::continuation_restarts_on_change_and_rechecks_permissions ... ok test mesh_api_tests::membership::scoped_membership_checks_pre_edit_host_scope ... ok test mesh_api_tests::review_filtered::review_global_viewers_do_not_refresh_unrelated_filtered_inventory ... ok test mesh_api_tests::review_null_policy::review_null_port_policy_does_not_create_unrestricted_grant ... ok test mesh_api_tests::review_null_scope::review_null_role_scopes_preserve_denied_inventory_access ... ok test mesh_api_tests::pagination::an_unsendable_object_returns_a_sanitized_service_error ... ok test generation_writers::tests::cancelled_reservation_never_leaves_a_writer_transaction_without_an_owner ... ok test mesh_api_tests::scoped_grant_role_filters_inventory_and_cannot_cross_tags ... ok test mesh_api_tests::storage_diagnostics::changed_storage_failure_reports_the_previous_count ... ok test mesh_api_tests::storage_diagnostics::coordinator_loading_preserves_missing_server_and_sql_reasons ... ok test mesh_api_tests::storage_diagnostics::invalid_stored_column_is_skipped_without_panicking ... ok test mesh_api_tests::storage_diagnostics::coordinator_clones_share_failure_counts_and_report_recovery ... ok test mesh_api_tests::storage_diagnostics::coordinator_stored_column_refuses_without_panic_and_recovers_after_repair ... ok test mesh_api_tests::storage_diagnostics::invalid_stored_host_is_reported_once_by_id ... ok test mesh_api_tests::watch_deadline::watch_deadline_scale_benchmark ... ignored, weighted local scale measurement; run optimized without concurrent compilation test mesh_api_tests::storage_diagnostics::malformed_host_keeps_healthy_inventory_readable ... ok test mesh_api_tests::review_frame_budget::review_mesh_design_point_frames_fit_shared_socket_budget ... ok test plugins::node_lifecycle::tests::disabling_replacement_and_retirement_join_the_correct_node_worker ... ok test node_bridge::scope_tests::installed_machine_support_ends_with_its_current_authority ... ok test plugins::server_lifecycle_tests::recovery_and_pre_admission_enable_never_launch_server_workers ... ok test plugins::server_lifecycle_tests::server_worker_starts_once_after_listener_admission_and_disable_joins_it ... ok test release_build_tests::release_build_marker_is_explicit ... ok test plugins::server_lifecycle_tests::admitted_handoff_fences_disable_and_an_old_scope_never_revives ... ok test release_host_catalog::tests::host_offer_refuses_other_versions_architectures_tampering_and_unsafe_metadata ... ok test release_host_catalog::tests::runtime_catalog_refuses_unsafe_requests_without_filesystem_or_network_work ... ok test mesh_api_tests::storage_diagnostics::malformed_unrelated_host_preserves_scoped_inventory ... ok test release_host_catalog::tests::signed_host_offer_binds_exact_version_architecture_size_and_independent_file_offsets ... ok test release_http::tests::bounded_body_status_and_existing_destination_are_refused ... ok test node_bridge::scope_tests::peer_bits_cannot_grant_installed_machine_authority ... ok test release_host_catalog::tests::catalog_records_transfer_progress_without_inventing_a_running_identity ... ok test release_http::tests::https_cannot_silently_accept_a_plaintext_bucket ... ok test release_http::tests::unsupported_scheme_credentials_query_and_fragment_never_connect ... ok test release_host_catalog::tests::runtime_catalog_uses_running_selection_and_bounds_cached_and_seed_payloads ... ok running 1 test test release_images::tests::staging_origin_override_is_unavailable_in_shipping_images ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 794 filtered out; finished in 0.00s test release_images::tests::staging_origin_override_is_unavailable_in_shipping_images ... ok test release_images::tests::collection_refuses_aliases_and_preserves_every_explicit_keep ... ok test release_latest::tests::bench_bounded_metadata_verification ... ignored, local weighted-scope verification latency benchmark test release_latest::tests::bench_latest_fifty_callers ... ignored, local weighted-scope 50-caller real-engine RSS measurement test release_images::tests::signed_payload_version_and_source_are_bound_to_the_same_manifest ... ok test release_images::tests::unsafe_metadata_links_permissions_and_sizes_are_refused ... ok test release_latest::tests::edge_pointer_is_verified_in_its_own_channel ... ok test release_latest::tests::stable_empty_reports_opt_in_without_edge_request ... ok test mesh_api_tests::storage_diagnostics::repeated_storage_failure_has_bounded_diagnostics ... ok test release_payload::tests::a_missing_payload_never_enables_development_fallback ... ok test release_payload::tests::a_valid_older_release_replayed_under_the_requested_version_is_refused ... ok test release_payload::tests::cache_symlinks_and_shared_files_are_refused ... ok test release_payload::tests::cross_architecture_cold_and_warm_cache_measurements ... ignored, run release-profile measurements in a weighted scope test release_latest::tests::pointer_authenticates_signed_version_and_refuses_replays_tampering_and_duplicates ... ok test release_payload::tests::concurrent_session_requests_publish_one_verified_artifact ... ok test release_payload::tests::dangling_session_cache_symlink_is_refused_without_publication ... ok test release_payload::tests::development_session_fallback_only_uses_trusted_local_artifacts_for_missing_release ... ok test release_payload::tests::missing_wrong_version_tampered_network_and_development_only_fallback ... ok test release_payload::tests::partial_download_restart_child ... ignored, subprocess helper for release-cache restart verification test release_payload::tests::eight_concurrent_add_hosts_share_one_verified_download ... ok test release_payload::tests::edge_add_host_keeps_exact_server_version_and_verified_cache ... ok test mesh_api_tests::storage_diagnostics::settings_storage_failure_has_a_safe_original_reason ... ok test release_payload::tests::refused_session_release_never_uses_development_fallback ... ok test release_payload::tests::resolver_startup_removes_only_owned_inactive_private_staging ... ok test release_payload::tests::session_staging_cleanup_preserves_active_and_unknown_files ... ok test release_payload::tests::advertised_session_missing_digest_or_signature_never_falls_back ... ok test release_payload::tests::signed_download_cache_hit_offline_and_tampered_cache ... ok test release_payload::tests::signed_session_absence_is_cached_and_reauthenticated_offline ... ok test remote_accept::tests::anonymous_capacity_and_single_source_cannot_consume_known_reserve ... ok test release_payload::tests::session_payloads_are_signed_on_both_architectures_and_reused_offline ... ok test remote_admission::tests::source_admission_cost_at_1000_sources ... ignored, optimized source admission diagnostic; no own build overlap test release_payload::tests::session_cache_refuses_shared_payloads_symlinks_and_unsafe_absence ... ok test remote_admission::tests::ports_do_not_change_source_capacity_and_mapped_addresses_share_it ... ok test release_payload::tests::signed_session_version_replay_and_untrusted_key_are_refused ... ok test mesh_api_tests::storage_diagnostics::unrelated_success_does_not_reset_a_persistent_write_failure ... ok test release_payload::tests::restarted_resolution_reclaims_partial_downloads_after_process_stop ... ok test release_images::tests::image_store_remains_bounded_across_twenty_check_ins ... ok test remote_agent_state::tests::inventory_identity_preserves_convergence_and_changed_versions_need_a_new_check ... ok test remote_agent_state::tests::late_capability_observation_does_not_erase_convergence_and_legacy_is_unknown ... ok test remote_guard::cut_tests::cancellation_survives_last_transport_until_durable_tombstone ... ok test remote_agent_state::tests::malformed_identity_or_phase_preserves_the_last_authenticated_observation ... ok test remote_http::tests::enrollment_api_at_1000_hosts ... ignored, explicit real HTTP-adapter/SQLite signing measurement at 1000 hosts; not transport or whole-daemon evidence test mesh_api_tests::storage_diagnostics::storage_failures_have_safe_reasons_and_recover_after_repair ... ok test remote_agent_state::tests::transfer_receipt_does_not_claim_a_new_running_version_and_revocation_prevents_late_writes ... ok test remote_enrollment::tests::cold_locked_signer_preserves_admission_and_token_until_authenticated_unlock ... ok test remote_guard::cut_tests::provisional_ssh_authority_requires_exact_pending_owner_and_uid ... ok test remote_enrollment::tests::invalid_csr_does_not_burn_token_and_join_returns_only_committed_authority ... ok test remote_agent_state::tests::pre_migration_recovery_inventory_remains_readable_without_schema_writes ... ok test remote_enrollment::tests::invalid_invitations_never_load_the_private_signer ... ok test remote_inventory::measurements::inventory_and_reconnect_at_128_hosts ... ignored, perf VM only: 128-host inventory and durable observation measurement test remote_http::tests::invitation_publication_rechecks_session_after_host_creation ... ok test remote_http::tests::enrollment_http_is_bound_single_use_and_preserves_token_while_locked ... ok test mesh_api_tests::storage_diagnostics::sqlite_admission_failures_have_distinct_safe_reasons ... ok test remote_http::tests::revocation::claude_review_anonymous_stalled_joins_cannot_block_owner_revocation ... ok test remote_http::tests::revocation::permission_revoked_while_waiting_for_sqlite_writer_refuses_tombstone ... ok test remote_http::tests::revocation::cold_signer_does_not_block_owner_revocation_or_cancellation ... ok test remote_inventory::name_tests::an_ip_added_host_uses_its_cached_hostname_and_old_facts_do_not_clear_it ... ok test remote_http::tests::revocation::abandoned_revocation_write_cannot_leave_committed_authority_live ... ok test remote_removal::review_tests::accepted_uninstall_names_the_objects_it_leaves ... ok test remote_removal::review_tests::no_commands_for_a_host_setup_did_not_install ... ok test remote_removal::review_tests::review_manual_commands_are_gated_on_this_hosts_bootstrap_owner ... ok test remote_removal::review_tests::review_manual_commands_stop_only_this_installations_sessions ... ok test remote_removal::review_tests::review_manual_rootful_commands_delete_only_marked_kernel_objects ... ok test remote_removal_http::tests::removal_parsers_refuse_positional_duplicate_and_unbounded_inputs ... ok test remote_http::tests::revocation::revocation_rechecks_locked_expired_logged_out_and_wrong_owner_sessions ... ok test remote_inventory::name_tests::reported_names_yield_to_records_and_collision_suffixes_and_server_identity_hold ... ok test remote_inventory::name_tests::late_hostname_inventory_renames_the_attached_mesh_node_and_notifies_viewers ... ok test remote_inventory::name_tests::inventory_hostname_changes_publish_once_and_preserve_hand_names ... ok test remote_inventory::tests::admitted_hosts_are_account_scoped_offline_and_revocation_filtered ... ok test remote_inventory::tests::unredeemed_invitations_are_not_admitted_and_cursors_are_canonical ... ok test remote_mesh_revocation_tests::committed_host_revocation_pushes_peer_withdrawal_without_polling ... ok test remote_runtime::tests::additional_listeners::additional_listener_refuses_unenrolled_certificate_before_proof_reply ... ok test remote_runtime::tests::cancelled_native_read_retains_dequeued_packet ... ok test remote_runtime::tests::candidate_proofs::quic_candidate_proof_waits_for_hello_and_preserves_its_suffix ... ok test remote_runtime::tests::candidate_proofs::candidate_proof_refuses_a_second_probe_and_invalid_hello ... ok test remote_runtime::tests::candidate_proofs::tls_candidate_proof_waits_for_hello_and_preserves_its_suffix ... ok test remote_runtime::tests::ephemeral_listener_pair_retries_real_udp_collision_without_leaking_tcp ... ok test remote_runtime::tests::explicit_listener_pair_never_moves_an_occupied_operator_port ... ok test remote_runtime::tests::independent_review::admitted_frame_write_fence_cost ... ignored, write-fence CPU diagnostic; run release alone, not whole-transport evidence test remote_runtime::tests::additional_listeners::initial_overlay_admission_has_no_underlay_guess ... ok test remote_runtime::tests::additional_listeners::additional_listener_keeps_underlay_address_and_retires_with_its_lease ... ok test remote_runtime::tests::additional_listeners::admitted_connection_moves_to_a_leased_address_and_back_without_readmission ... ok test remote_runtime::tests::additional_listeners::ipv6_wildcard_listener_reuses_binding_and_preserves_ipv4_discovery ... ok test remote_runtime::tests::late_native_detach_after_peer_stop_keeps_the_control_connection ... ok test remote_runtime::tests::late_native_detach_after_peer_close_keeps_the_control_connection ... ok test remote_runtime::tests::additional_listeners::leased_tcp_admits_current_identity_releases_lease_and_keeps_primary_usable ... ok test remote_runtime::tests::additional_listeners::wildcard_listener_reuses_binding_and_tracks_destination_lease_counts ... ok test remote_runtime::tests::ping_flood::primary_ping_during_terminal_flood ... ignored, 10-minute real PTY measurement; pinned VM lock and INFRATERNAL_PING_BINARY required test remote_runtime::tests::quic_actor_binds_durable_writer_and_recovery_offsets ... ok test remote_runtime::tests::independent_review::review_expired_identity_must_refuse_new_attachment_on_existing_transport ... ok test remote_runtime::tests::remote_peer_routing_capability_does_not_retain_the_host_registry ... ok test remote_runtime::tests::renewal_checks::renewal_refuses_same_issuer_wrong_key_purpose_or_lifetime_before_publication ... ok test remote_runtime::tests::renewal_checks::renewal_validates_host_dates_json_and_durable_publication_before_ack ... ok test remote_runtime::tests::machine::admitted_machine_round_trip_preserves_the_exact_bounded_body ... ok test remote_runtime::tests::machine::cancelled_machine_waiter_cannot_admit_a_second_flight_before_its_reply ... ok test remote_runtime::tests::revocation::guard_bookkeeping_at_1000_hosts ... ignored, guard component diagnostic; run alone without builds or browser measurements test remote_runtime::tests::retired_native_writer_frames_cannot_close_or_ack_its_replacement ... ok test remote_runtime::tests::revocation::retirement::registry_retention_at_1000_actual_tls_hosts ... ignored, 1000-host registry diagnostic; optimized, FD limit8192, no own build/browser overlap test remote_runtime::tests::machine::peer_capability_cannot_turn_provisioning_into_installed_machine_authority ... ok test remote_runtime::tests::claude_review_idle_anonymous_sockets_cannot_starve_host_handshakes ... ok test remote_runtime::tests::independent_review::committed_tombstone_cannot_forward_input_before_finalizer_returns ... ok test remote_runtime::tests::independent_review::review_revocation_must_cancel_input_on_existing_tls_transport ... ok test remote_runtime::tests::revocation::expired_identity_must_refuse_new_attachment_on_existing_transport ... ok test remote_runtime::tests::revocation::revocation_closes_admitted_idle_quic_connection ... ok test remote_runtime::tests::revocation::retirement::revoked_host_releases_its_registry_entry_and_retained_actor ... ok test remote_runtime::tests::ssh_bridge::ssh_greeting_keeps_full_capabilities_and_coalesced_frames ... ok test remote_runtime::tests::ssh_bridge::component_off_retires_ssh_fallback_after_installed_admission ... ok test remote_runtime::tests::ssh_bridge::ssh_bridge_does_not_invent_node_path_capabilities ... ok test remote_runtime::tests::revocation::revocation_must_cancel_input_on_existing_tls_transport ... ok test remote_runtime::tests::ssh_bridge::refused_installed_reattachment_restores_the_ssh_writer ... ok test remote_runtime::tests::standby::control_pause::cancelled_control_packet_survives_pause_and_resumes_before_queued_sibling ... ok test remote_runtime::tests::ssh_bridge::ssh_greeting_refuses_invalid_first_frames_and_releases_its_master ... ok test remote_runtime::tests::ssh_bridge::ssh_bridge_retires_only_after_installed_writer_acknowledges ... ok test remote_runtime::tests::standby::a_second_parked_fallback_cannot_replace_the_first ... ok test remote_runtime::tests::standby::control_queue::saturated_native_control_queue_does_not_hide_primary_terminal_output ... ok test remote_runtime::tests::standby::control_queue::scheduled_probe_preserves_primary_at_full_native_control_capacity ... ok test remote_runtime::tests::revocation::admitted_guard_expires_and_prior_revocation_cannot_reregister ... ok test remote_runtime::tests::standby::parked_fallback_is_cancelled_by_ledger_revocation ... ok test remote_inventory::pagination_tests::long_destinations_stay_bounded_and_all_pages_are_complete ... ok test remote_runtime::tests::standby::primed_fallback_activates_after_the_primary_closes ... ok test remote_runtime::tests::standby::primed_fallback_hedges_when_credit_arrives_behind_a_blocked_primary_write ... ok test remote_runtime::tests::standby::primed_fallback_hedges_while_primary_native_send_buffer_is_full ... ok test remote_standby::tests::bounded_standby_options_reject_ambiguous_or_unrecognized_fields ... ok test remote_standby::tests::cancelled_queue_admission_releases_parking_before_actor_poll ... ok test remote_runtime::tests::tcp_actor_uses_enrolled_uid_and_replays_admission_hello ... ok test remote_standby_request::tests::requests_require_objects_and_exact_fields ... ok test remote_standby::tests::parking_is_per_identity_bounded_and_released_on_drop ... ok test remote_startup::tests::normal_cold_start_uses_public_trust_without_loading_or_generating_ca_key ... ok test remote_startup::tests::symlink_shared_oversized_or_special_trust_files_fail_closed ... ok test remote_runtime::tests::standby::primed_hedge_survives_blocked_control_call ... ok test remote_startup::tests::wrong_issuer_key_name_or_unpinned_https_refuses_startup ... ok test remote_runtime::tests::standby::primed_standby_greets_without_replacing_the_live_actor_before_activation ... ok test runtime::remote_demo_tests::cold_start::normal_cli_cold_start_keeps_enrolled_remote_terminal_while_signing_locked ... ignored, normal CLI cold-start proof requires static INFRATERNAL_REMOTE_TEST_BINARY and exclusive 4701/7443 test runtime::remote_demo_tests::cold_start::release_transition_recovers_enrolled_host_after_long_outage ... ignored, requires isolated release binaries and a ten-minute outage test runtime::remote_demo_tests::real_host::o1_rootless_join_terminal_and_cleanup ... ignored, authorised o1 proof requires pinned INFRATERNAL_O1_KNOWN_HOSTS and aarch64 INFRATERNAL_REMOTE_TEST_BINARY; exclusive 4701/7443 test runtime::remote_demo_tests::real_host::o1_runtime_path_admits_real_unix_socket_address ... ok test runtime::remote_demo_tests::remote_cli_enrollment_and_browser_terminal_two_processes ... ignored, two-process proof requires INFRATERNAL_REMOTE_TEST_BINARY and exclusive port 4701 test runtime::generation_tests::legacy_runtime_remains_normal_and_checkpoints_on_last_close ... ok test remote_runtime::tests::standby::tcp_fallback_parks_without_a_host_actor_and_activates_on_the_existing_tls_channel ... ok test runtime::generation_tests::full_runtime_replacement_preserves_latest_wal_without_restart_writes ... ok test runtime::remote_demo_tests::renewal_cli::cli_live_renewal_cost_and_durable_identity_on_unchanged_transport ... ignored, real CLI renewal measurement requires release binary and exclusive port4701; no own compilation/browser overlap test runtime::remote_demo_tests::renewal_cli::flood::remote_cli_renewal_under_50m_load_preserves_every_byte_and_writer ... ignored, real CLI 50MiB renewal proof: exclusive4701 and release binary; no own build/browser overlap test runtime::remote_demo_tests::shipping_route::independent_review_configured_server_mounts_ca_unlock_routes ... ok test runtime::remote_demo_tests::renewal::half_life_requests_proof_on_live_authenticated_control ... ok test runtime::reviewer_admission::reviewer_recovery_source_limit_covers_all_routes_without_forwarding_bypass ... ok test runtime::temporal_admission_tests::ca_budget_cost_at_capacity ... ignored, isolated debug admission diagnostic at 4096 principals; run without own build overlap test runtime::remote_demo_tests::shipping_route::review_default_server_must_register_remote_join ... ok test runtime::tests::empty_no_color_does_not_disable_terminal_logs ... ok test remote_runtime::tests::standby::detached_primed_writers_release_native_binding_budget ... ok test runtime::tests::proxy_mode_requires_an_explicit_peer_allowlist ... ok test runtime::tests::proxy_networks_match_only_their_address_family_and_prefix ... ok test runtime::remote_demo_tests::renewal_ack::unlock_renews_live_identity_only_after_publication_ack_with_terminal_intact ... ok test runtime::remote_demo_tests::renewal_ack::failed_publication_retains_original_admission_without_interrupting_terminal ... ok test runtime::tests::setup_socket_cleanup_preserves_symlinks_and_regular_files ... ok test runtime::tests::setup_token_socket_is_private_and_requires_explicit_request ... ok test remote_runtime::tests::standby::liveness_doubt::one_missed_primary_reply_shows_reconnecting_and_only_a_second_retires_the_link ... ok test runtime::tests::router_migrates_private_storage_and_serves_health ... ok test server_tls::tests::standalone_https_disables_nagle_before_application_bytes ... ok test runtime::temporal_admission_tests::windows_principals_and_capacity_remain_bounded ... ok test runtime::tests::production_router_exposes_bootstrap_owner_admission ... ok test remote_runtime::tests::revocation::retirement::old_expiry_cannot_remove_a_fresh_tls_replacement ... ok test runtime::tests::startup_with_owner_unlinks_stale_setup_token_socket ... ok test ssh_key::tests::concurrent_initialization_retains_one_identity_and_unwrap_cannot_replace_it ... ok test ssh_key::tests::lock_generation_exhaustion_never_wraps_into_an_unlocked_source ... ok test ssh_key::tests::lock_during_administrator_unwrap_cannot_reinstall_private_material ... ok test stream_close::tests::a_close_naming_no_owned_session_prints_none_for_session_and_host ... ok test stream_close::tests::a_dead_logger_is_counted_and_summarised_by_the_callers ... ok test stream_close::tests::a_full_queue_drops_and_counts_instead_of_blocking ... ok test ssh_key::tests::first_start_is_wrapped_once_and_every_cold_start_is_locked ... ok test stream_close::tests::an_unavailable_agent_stream_is_reported_as_a_link_drop ... ok test ssh_key::tests::malformed_existing_storage_is_refused_without_generating_a_replacement ... ok test stream_close::tests::close_line_has_session_counters_and_never_copies_untrusted_close_text ... ok test stream_close::tests::close_path_cost ... ignored, manual microbenchmark test stream_close::tests::different_accounts_and_reason_categories_each_get_their_first_line ... ok test stream_close::tests::mixed_reasons_and_closers_in_one_window_are_named_as_mixed ... ok test stream_close::tests::one_close_line_and_one_summary_bound_an_account_storm ... ok test stream_close::tests::client_chosen_session_ids_share_their_accounts_window ... ok test terminal_queries::census_tests::census_cleanup_is_host_scoped_and_preserves_detached_live_queries ... ok test stream_close::tests::the_thread_writes_the_first_close_and_summarises_the_rest_on_shutdown ... ok test terminal_queries::lifecycle_tests::ended_sessions_release_query_slots ... ok test terminal_queries::overflow_tests::oversized_osc_does_not_hide_the_next_query ... ok test terminal_queries::review_tests::a_lagging_viewer_cannot_renew_a_deadline_after_the_first_viewer_answered ... ok test stream_close::tests::a_full_table_keeps_rate_limiting_a_storm ... ok test terminal_queries::review_tests::trimmed_output_refuses_its_answer_without_reopening_an_accepted_position ... ok test terminal_queries::review_tests::two_positions_in_one_chunk_are_claimed_in_order_without_reopening_either ... ok test terminal_queries::tests::deadline_includes_incomplete_query ... ok test terminal_queries::tests::every_observed_output_position_can_identify_a_renderer_answer ... ok test terminal_queries::tests::gaps_and_replay_never_authorize_unobserved_or_expired_positions ... ok test ssh_key::tests::material_refuses_invalid_pem_and_non_ed25519_algorithms ... ok test terminal_queries::tests::marked_flood_never_allocates_queries ... ok test terminal_queries::tests::renderer_owns_reply_contents_but_size_and_identity_are_bounded ... ok test terminal_queries::tests::only_one_reply_across_viewers_and_replay ... ok test terminal_queries::tests::review_renderer_supported_query_forms_are_admitted ... ok test terminal_queries::tests::style_controls_cannot_evict_queries_and_live_claims_never_reopen ... ok test terminal_startup::tests::request_decoder_keeps_operation_fields_strict ... ok test ssh_key::tests::unavailable_or_empty_custody_publishes_no_key ... ok test terminal_startup::tests::switches_preserve_account_and_host_scope_across_concurrent_updates ... ok test terminal_startup::tests::only_one_caller_claims_and_disabled_hints_do_not_consume_notice ... ok test websocket::cookie_tests::duplicate_cookie_fields_deny_socket_session ... ok test websocket::cookie_tests::split_cookie_fields_preserve_socket_session ... ok test websocket::link_notice_tests::doubt_notices_reach_only_viewers_that_announced_them_and_never_await_an_ack ... ok test web_assets::tests::encodings_and_identity_have_correct_headers_and_sizes ... ok test web_assets::tests::spa_and_mutable_assets_revalidate_and_missing_brotli_uses_gzip ... ok test websocket::receive_tests::browser_websocket_close_keeps_its_code_and_discards_unknown_reason_text ... ok test ssh_key::tests::update_handoff_preserves_unlocked_identity_but_cold_restart_does_not ... ok test websocket::receive_tests::receive_failures_keep_protocol_size_and_idle_classifications ... ok test websocket::recovery_notification_bench::recovery_notification_state_at_socket_capacity ... ignored, notification state sizing diagnostic, not allocator-inclusive RSS certification test websocket::receive_tests::buffered_control_frames_cannot_monopolize_a_transport_turn ... ok test runtime::key_runtime_tests::configured_startup_generates_once_and_settings_shares_its_cold_lock ... ok test websocket::session_inventory_tests::inventory_reconciliation_at_200_sessions_and_50_accounts ... ignored, independent scale diagnostic; run in a weighted scope test terminal_queries::corpus_tests::output_chunking_preserves_bounded_query_state ... ok test websocket::session_inventory_tests::census_waiting_for_database_does_not_close_a_newly_created_live_session ... ok test websocket::probe_authority::review_r2_restore::review_r2_revoked_lease_with_restored_source_never_polls_work ... ok test websocket::write_tests::a_stalled_group_has_one_absolute_write_budget ... ok test websocket::write_tests::ready_proofs_keep_message_boundaries_and_order_with_one_flush ... ok test websocket::probe_authority::review_closed_watch::closed_revocation_watch_is_unavailable_and_never_polls_the_write ... ok test websocket::session_inventory_tests::pending_agent_inventory_hides_cached_rows_until_the_first_census ... ok test websocket::session_inventory_tests::reconciliation_before_saved_exit_keeps_the_authoritative_exit_status ... ok test websocket::session_inventory_tests::available_snapshot_reports_live_rows_and_bounded_saved_exit_statuses ... ok test websocket::writer_tests::authority_watchdog::authority_deadline_preserves_subsecond_session_expiry ... ok test websocket::writer_tests::authority_watchdog::cap_review_r3::cancelled_storm_returns_every_place_without_duplication ... ok test websocket::session_inventory_tests::restart_reconciliation_keeps_live_rows_and_closes_missing_rows ... ok test websocket::writer_tests::authority_watchdog::cap_review_r3::deadline_storm_retains_exactly_four_places_then_recovers ... ok test runtime::tests::restart_serves_fresh_setup_token_and_completes_owner_enrollment ... ok test websocket::writer_tests::authority_watchdog::cap_review_r3::pool_acquire_timeout_recovers_places_without_releasing_the_connection ... ok test websocket::writer_tests::authority_watchdog::cap_review_r3::ready_result_observed_after_deadline_retries_current_authority ... ok test websocket::writer_tests::authority_watchdog::periodic_authority_read_fails_closed_at_the_bounded_wait ... ok test websocket::writer_tests::authority_watchdog::periodic_authority_read_keeps_its_connection_owner_runnable ... ok test websocket::writer_tests::authority_watchdog::periodic_authority_read_rejects_revocation_committed_by_its_operation ... ok test websocket::writer_tests::authority_watchdog::periodic_authority_read_rejects_expiry_committed_by_its_operation ... ok test websocket::writer_tests::authority_watchdog::periodic_authority_read_stops_side_effects_at_expiry ... ok test websocket::writer_tests::authority_watchdog::periodic_authority_read_stops_side_effects_on_revocation ... ok test websocket::writer_tests::writer_admission_at_user_capacity ... ignored, release-only scale measurement; run without concurrent builds test terminal_queries::review_tests::all_session_tables_remain_bounded_at_the_registry_limit ... ok test websocket_transport::queue_tests::full_browser_transport_proof_queue_keeps_connection_usable ... ok test websocket_transport::queue_tests::full_browser_wire_proof_queue_keeps_connection_usable ... ok test websocket_transport::tests::each_receive_end_has_a_structured_terminal_close_reason ... ok test websocket_transport::tests::no_probe_in_an_active_idle_active_window ... ok test websocket_transport::tests::visibility_notices_are_small_typed_transport_messages ... ok test websocket::writer_tests::second_device_does_not_inherit_first_device_input_ack ... ok test websocket::writer_tests::busy_edges::wall_expiry_and_monotonic_deadlines_keep_their_separate_roles ... ok test websocket::writer_tests::resume_refusals_distinguish_connection_state_and_lost_token_rotation ... ok test websocket::writer_tests::writer_ownership_capacity_unsigned_offsets_and_identity_reuse ... ok test mesh_api_tests::watch_deadline::watch_deadline_matches_complete_filtered_snapshots ... ok test remote_runtime::tests::standby::parked_fallback_survives_greeting_deadline_and_activates_without_another_hello ... ok test websocket::writer_tests::busy_edges::revoked_probe_across_attempt_backoff_and_total_wait_edges ... ok test websocket::writer_tests::busy_edges::expiry_crossing_a_stalled_read_refuses_both_deadline_callers ... ok test websocket::writer_tests::authority_watchdog::cap_review_r3::sqlite_busy_timeout_recovers_detached_storm_without_unlocking ... ok test result: ok. 740 passed; 0 failed; 55 ignored; 0 measured; 0 filtered out; finished in 408.09s Running tests/canvas_convergence.rs (target/debug/deps/canvas_convergence-47a9f10cfa376a13) running 20 tests test competing_bootstraps_merge_targets_and_retry_after_restart ... ok test a_tiled_import_cannot_duplicate_an_existing_graph_kind ... ok test imports_use_account_wide_target_identity_and_keep_spanning_column_geometry ... ok test identical_and_empty_second_devices_do_not_advance_revision ... ok test loading_repairs_only_matching_recovery_views_and_converges_clients ... ok test merge_bounds_refuse_without_losing_the_existing_layout ... ok test initialize_and_apply_repair_before_writing_and_notify_subscribers ... ok test no_op_imports_keep_retry_receipts_and_do_not_clear_operation_history ... ok test importing_an_orphaned_recovery_view_does_not_create_another_recovery_name ... ok test simultaneous_first_devices_merge_disjoint_targets_into_one_view ... ok test import_prefers_matching_names_before_the_first_view_of_its_kind ... ok test session_import_identity_ignores_labels_but_checks_account_ownership ... ok test stale_noop_still_checks_numeric_bounds_before_committing ... ok test owned_session_reference_and_all_bounds_are_transactional ... ok test split_retry_is_durable_and_changed_idempotency_input_is_refused ... ok test permanent_receipts_do_not_copy_large_bootstrap_documents ... ok test two_devices_serialize_stale_edits_and_replay_every_committed_revision ... ok test encoded_document_budget_is_enforced_by_the_host_transaction ... ok test no_op_import_receipts_still_have_a_bounded_quota ... ok test close_beats_move_resize_in_both_orders_and_survives_compaction ... ok test result: ok. 20 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.88s Running tests/canvas_receipt_count.rs (target/debug/deps/canvas_receipt_count-f70e20109308ab77) running 1 test test historical_receipts_backfill_and_follow_transactions_and_account_removal ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s Running tests/canvas_receipt_review.rs (target/debug/deps/canvas_receipt_review-4392b8cc5e7f9212) running 1 test test historical_no_revision_receipts_preserve_replay_and_the_last_real_edit ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 1.34s Running tests/canvas_recovery_review.rs (target/debug/deps/canvas_recovery_review-fbc02020fcb88cc5) running 5 tests test independent_loads_and_base_edit_repair_exactly_once ... ok test repair_rebases_a_cursor_that_already_names_its_next_revision ... ok test queued_close_of_unique_recovered_window_survives_repair ... ok test queued_resize_keeps_its_membership_after_a_separate_read_repair ... ok test recovery_at_column_capacity_keeps_the_account_readable ... ok test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.07s Running tests/canvas_replay_noop.rs (target/debug/deps/canvas_replay_noop-a84933d472e1ae44) running 1 test test committed_noop_is_explicit_without_sending_all_closed_ids_to_clients ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s Running tests/canvas_retired_reference.rs (target/debug/deps/canvas_retired_reference-1e95d5ff57d72ba7) running 2 tests test retired_reference_does_not_block_an_unrelated_edit ... ok test retarget_checks_account_ownership_even_after_close ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s Running tests/canvas_socket.rs (target/debug/deps/canvas_socket-87aa76da1f60dd7a) running 1 test test snapshot_then_ordered_commit_events_and_revocation_cancel_output ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.02s Running tests/canvas_text_bounds.rs (target/debug/deps/canvas_text_bounds-2114018d89bcf99b) running 2 tests test text_uses_the_browser_utf16_bound ... ok test imported_name_respects_the_browser_utf16_bound ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/catalog_startup.rs (target/debug/deps/catalog_startup-c30b8dd5906b186b) running 1 test test explicit_catalog_startup_remains_public_and_validates_before_storage ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.12s Running tests/enrollment.rs (target/debug/deps/enrollment-a0b41c51d00e71d8) running 6 tests test enrollment_storage_at_500_hosts ... ignored, explicit 500-host storage measurement; not a remote transport budget test malformed_capabilities_and_certificate_overflow_are_refused_before_mutation ... ok test invitation_is_hashed_replaced_and_bound_to_owner_host_mode_and_exact_expiry ... ok test invalid_certificate_and_failed_insert_preserve_the_invitation ... ok test concurrent_redemption_has_one_winner_and_one_certificate ... ok test revocation_tombstone_refuses_existing_and_new_invitations_after_restart ... ok test result: ok. 5 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.30s Running tests/generation_storage_fixture.rs (target/debug/deps/generation_storage_fixture-172f80ec5c0500b9) running 1 test test retained_wal_marker ... ignored, orchestrator only: disposable bounded systemd installation test result: ok. 0 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/mesh_parser.rs (target/debug/deps/mesh_parser-5549003fbc7ccdd7) running 2 tests test review_grant_parser_rejects_unknown_nested_port_fields ... ok test nested_endpoint_and_policy_fields_are_strict_without_rejecting_valid_ports ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/mesh_review_plugin.rs (target/debug/deps/mesh_review_plugin-165dd8c08d59e990) running 1 test test review_mesh_dependency_is_removable_at_build_time ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.04s Running tests/mesh_review_policy.rs (target/debug/deps/mesh_review_policy-42d39494f3c4cd12) running 1 test test review_null_port_policy_is_refused ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/mesh_review_role_scope.rs (target/debug/deps/mesh_review_role_scope-b668bf71ee899387) running 2 tests test review_explicit_null_role_scopes_do_not_become_global_authority ... ok test role_scopes_require_an_array_when_provided ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/native_probe_correlation_review.rs (target/debug/deps/native_probe_correlation_review-2a578093d866dbca) running 25 tests test liveness::tests::healthy_reply_survives_a_150ms_server_stall ... ok test liveness::tests::a_recovered_doubt_below_the_ceiling_keeps_early_notice ... ok test liveness::tests::delayed_server_probe_does_not_expire_an_answered_route ... ok test liveness::tests::an_unanswered_host_link_retires_at_the_startup_grace_without_doubt ... ok test liveness::tests::a_doubt_recovered_at_the_ceiling_pins_until_the_path_drains ... ok test liveness::tests::a_reply_during_doubt_clears_it_and_renews_the_route ... ok test liveness::tests::browser_doubts_one_mobile_delay_and_retires_only_after_two_allowances ... ok test liveness::tests::pipelined_requests_do_not_renew_an_outstanding_deadline ... ok test liveness::tests::ready_reply_only_pulls_forward_an_answered_probe_after_one_tick ... ok test liveness::tests::quiet_dead_browser_retires_within_two_floors_plus_one_interval ... ok test liveness::tests::recent_application_progress_preserves_the_first_tick_cadence ... ok test liveness::tests::host_and_browser_allowance_cover_one_loss_recovery ... ok test liveness::tests::serial_probe_accepts_a_timely_rtt_step_without_renewing_unsolicited_replies ... ok test liveness::tests::host_link_doubts_on_the_first_miss_and_retires_on_the_second ... ok test liveness::tests::suspended_browser_keeps_its_lease_and_relearns_the_mobile_path ... ok test liveness::tests::serial_probe_deadline_includes_only_one_gap_and_the_estimated_allowance ... ok test unissued_native_probe_reply_cannot_extend_readiness ... ok test liveness::tests::jitter_allowance_decays_after_the_link_settles ... ok test liveness::tests::late_native_probe_keeps_its_unissued_reply_allowance ... ok test liveness::tests::missing_replies_expire_even_with_probes_in_flight ... ok test liveness::tests::restarting_monitoring_never_reuses_an_old_issued_probe ... ok test liveness::tests::terminal_routes_still_end_their_lease_on_the_first_miss ... ok test liveness::tests::variation_uses_the_previous_smoothed_sample ... ok test liveness::tests::host_allowance_has_a_floor_a_settled_long_haul_value_and_a_ceiling ... ok test healthy_real_socket_survives_a_150ms_server_stall ... ok test result: ok. 25 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.16s Running tests/plugin_host_review.rs (target/debug/deps/plugin_host_review-1d5f6bb39dba7846) running 7 tests test review_core_topic_remains_core_owned_even_when_declared ... ok test review_undeclared_topic_is_left_to_the_core ... ok test review_completed_call_survives_normal_worker_exit ... ok test review_reenable_preserves_cancelled_calls_until_delivery ... ok test review_disable_withdraws_view_and_keeps_socket ... ok test review_disable_answers_inflight_call ... ok test review_exited_worker_ends_its_subscriptions ... ok test result: ok. 7 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.51s Running tests/plugin_settings_review.rs (target/debug/deps/plugin_settings_review-d06d01ab81cf5c3e) running 3 tests test plugin_settings_enforce_boolean_and_role_plugin_identity ... ok test failed_plugin_save_restores_previous_state_without_workers ... ok test plugin_switches_survive_database_reopen ... ok test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.64s Running tests/remote_plugin_contract.rs (target/debug/deps/remote_plugin_contract-c9821223920a5fb2) running 1 test test independent_review_core_build_without_features_omits_remote_transport ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.44s Running tests/review_mesh_host_removal.rs (target/debug/deps/review_mesh_host_removal-ecc8b31c20ea04b8) running 1 test test revoked_remote_host_is_withdrawn_from_mesh_peer_policy ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s Running unittests src/main.rs (target/debug/deps/infraternal_session-9eac3c8a322fcdd7) running 2 tests test tests::unsupported_commands_cannot_start_operator_roles_or_open_state ... ok running 1 test test tests::fresh_exec_closes_dumpability_before_private_startup ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 1 filtered out; finished in 0.00s test tests::fresh_exec_closes_dumpability_before_private_startup ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_shim-7416a2c023fe6f4f) running 114 tests test frame::checks::codec_reuse_measurement ... ignored, release codec and allocation-path measurement test frame::checks::golden::every_frozen_message ... ok test frame::checks::tests::invalid_lengths_types_and_utf8 ... ok test frame::checks::approximate_snapshot_codec_is_bounded_and_canonical ... ok test frame::checks::shared_writer_selector_is_fixed_length_and_fragment_safe ... ok test frame::checks::tests::golden_and_fragmented ... ok test ended::tests::bounded_record_preserves_status_and_rejects_malformed_or_linked_data ... ok test frame::checks::borrowed_and_owned_decoders_agree_at_every_fragment_boundary ... ok test frame::checks::deferred_frame_keeps_its_borrowed_storage_and_ordered_trailing_bytes ... ok test locale::tests::absent_locale_uses_fallback_only_when_it_is_installed ... ok test frame::checks::query_reply_extension_is_bounded_and_fragment_safe ... ok test frame::checks::maximum_deferred_frame_retries_without_growing_storage ... ok test frame::checks::golden::exact_maximum_and_coalesced_frames ... ok test locale::tests::invalid_shell_expressions_are_ignored ... ok test locale::tests::missing_lang_preserves_other_locale_values_and_fills_only_lang ... ok test locale::tests::macos_locale_identifier_gets_a_utf8_codeset ... ok test pty::child_signal_tests::child_signal_reset_spawn_cost_at_128_children ... ignored, child spawn diagnostic; run locally in a weighted scope without own build overlap test locale::tests::unsupported_configured_locale_uses_installed_utf8_fallback ... ok test pty::inherited_descriptor_tests::duplicated_socket_owns_its_descriptor_and_is_close_on_exec ... ok test locale::tests::configured_locale_is_selected_from_login_locale_files ... ok test pty::inherited_descriptor_tests::invalid_inherited_descriptors_are_refused ... ok test locale::tests::non_locale_values_do_not_cross_the_scrubbed_shell_boundary ... ok test ring::checks::tests::merge_review_head_overflow_does_not_publish_or_discard_bytes ... ok test ring::checks::tests::wrap_and_exact_offsets ... ok running 1 test test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 113 filtered out; finished in 0.00s test locale::tests::existing_user_locale_values_are_preserved_without_replacement ... ok test pty::child_environment_tests::spawned_login_shell_receives_selected_environment_without_other_host_variables ... ok test ring::checks::tests::merge_review_head_and_retained_bytes_match_after_every_append ... ok test locked_bytes::tests::anonymous_transfer_pages_are_locked_and_excluded_from_core_dumps ... ok test pty::child_signal_tests::child_policy_closes_the_control_descriptor_before_direct_exec ... ok test session::inputs::merge_review::refused_first_replies_do_not_promote_or_reset_legacy_state ... ok test session::inputs::reply_tests::replies_preserve_selected_writer_cursor_and_geometry ... ok test session::inputs::merge_review::reply_promotion_preserves_staged_legacy_geometry_and_partial_credit ... ok test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok test session::inputs::tests::partial_writes_credit_only_the_owner_and_replay_trims_per_writer ... ok test session::inputs::reply_tests::reply_identity_is_outside_peer_namespace_and_writer_limit ... ok test session::inputs::merge_review::repeated_reply_registration_adds_exactly_one_identity ... ok test session::measurements::budgets::input_to_pty_write ... ignored, real-PTY performance measurement; set ZDOTDIR to tests/profile test session::measurements::poll_storage_measurement ... ignored, release poll-storage allocation measurement test session::peer_uid_tests::different_uid_shim_socket_peer_is_refused ... ok test session::resize_checks::resize_refusal_session_probe ... ignored, isolated session probe invoked by its parent with a controlled shell profile test session::inputs::tests::identity_cap_preserves_all_existing_cursors ... ok test session::sequenced_checks::new_frames_roundtrip_and_refuse_noncanonical_payloads ... ok test session::measurements::budgets::allowlisted_signal_after_real_pty_exit_keeps_exit_ack_available ... ok test session::sequenced_checks::coalesced_ack_never_overwrites_a_partial_output_and_cursors_survive_peer_loss ... ok test session::sequenced_checks::writer_selection_has_a_frozen_little_endian_layout ... ok test session::sequenced_checks::trim_duplicates_gaps_overflow_and_capacity_are_transactional ... ok test session::sequenced_checks::reusable_encoder_retains_capacity_and_refuses_growth_before_mutation ... ok test sqlite_backup::tests::crash_writer_helper ... ignored, subprocess helper for abrupt-close WAL validation running 1 test test session::sequenced_checks::negotiated_queue_deferral_validates_ranges_before_waiting ... ok test session::sequenced_checks::a_completed_deferred_frame_gives_its_trailing_input_a_fresh_ticket ... ok test session::sequenced_checks::coalesced_probe_and_input_preserve_the_written_ack_in_both_orders ... ok test session::inputs::merge_review::interleaved_replies_and_replays_match_partial_write_model ... ok test terminal::checks::approximate_repaint_keeps_complete_pending_syntax_or_omits_it_whole ... ok test sqlite_backup::tests::preserved_wal_reads_latest_committed_data_without_sidecar_creation ... ok test sqlite_backup::tests::abrupt_close_reads_acknowledged_wal_without_creating_or_modifying_files ... ok test session::sequenced_checks::merge_review_replies_cannot_consume_space_reserved_for_deferred_typing ... ok test terminal::checks::tests::implicit_hyperlinks_retain_groups_across_rows_and_continuation ... ok test terminal::checks::tests::margins_tabs_charsets_and_modes_continue ... ok test terminal::checks::tests::fixtures_and_continuations_repaint ... ok test terminal::checks::tests::long_unfinished_hyperlink_and_control_strings_continue ... ok test terminal::checks::tests::alternate_variants_and_nested_switches_repaint ... ok test terminal::checks::tests::partial_csi_and_utf8_continue ... ok test terminal::checks::tests::saved_origin_survives_changed_margins ... ok test sqlite_backup::tests::online_copy_includes_wal_without_sharing_candidate_migrations ... ok test terminal::fidelity::fidelity_charset_mapped_wide_space_is_explicitly_rejected ... ok test terminal::fidelity::fidelity_diagnostic_fixture ... ignored, diagnostic replay of an explicitly selected fixture file test terminal::checks::tests::retained_alternate_saved_cursor_and_keyboard_stack_continue ... ok test terminal::fidelity::fidelity_extended_nightly ... ignored, nightly expanded differential corpus: 20,000 deterministic cases test sqlite_backup::tests::successor_sqlx_migration_never_changes_the_predecessor_journal ... ok test terminal::checks::tests::pending_wrap_and_saved_wrap_continue_with_wide_cells ... ok test terminal::fidelity::fidelity_fresh_c_redraw_default_is_explicitly_rejected ... ok test terminal::checks::tests::unfinished_sequence_over_frame_limit_fails_without_losing_runtime_state ... ok test terminal::checks::tests::byte_budget_prunes_history_and_resize_remains_repaintable ... ok test terminal::fidelity::fidelity_inherited_protection_off_mode_is_explicitly_rejected ... ok test session::resize_checks::native_resize_refusal_preserves_peer_and_pty ... ok test terminal::fidelity::fidelity_cursor ... ok test sqlite_backup::tests::cancelled_online_copy_finishes_before_either_connection_can_resume ... ok test terminal::fidelity::fidelity_edge ... ok test terminal::fidelity::fidelity_iso_protection_erase ... ok test terminal::fidelity::fidelity_orphaned_spacer_head ... ok test terminal::fidelity::fidelity_prompt_resize_requires_explicit_rejection ... ok test terminal::fidelity::fidelity_oracle_observes_archived_cells_with_equal_active_screens ... ok test terminal::fidelity::fidelity_rejects_unrepresentable_rep_without_mutating_source ... ok test terminal::fidelity::fidelity_saved_modes_future_restore ... ok test terminal::fidelity::fidelity_iso_protection_does_not_keep_rep_scratch ... ok test terminal::fidelity::fidelity_seeded_nightly ... ignored, nightly differential corpus: 20,000 deterministic cases test terminal::fidelity::fidelity_oracle_detects_hidden_state ... ok test terminal::fidelity::fidelity_f1_rep ... ok test terminal::fidelity::fidelity_saved_cursor_over_changed_edge ... ok test terminal::fidelity::fidelity_snapshot_history_tail_contains_no_padding_rows ... ok test terminal::fidelity::fidelity_snapshot_resets_stale_viewer_color_overrides ... ok test terminal::fidelity::fidelity_single_shift_survives_rep_seed ... ok test terminal::fidelity::fidelity_spacer_head_attributes ... ok test terminal::fidelity::fidelity_semantic_validation_matches_exported_history_extent ... ok test terminal::fidelity::fresh_captures::fidelity_fresh_real_program_captures ... ignored, manual fresh capture oracle; set VT_CAPTURE_DIR after real program capture test terminal::measurements::budgets::snapshot_200x60 ... ignored, performance measurement; run release on the perf host test terminal::measurements::memory::measured_terminal_rss ... ignored, RSS measurement; run this filter alone in a fresh release process test terminal::measurements::throughput::measured_parser ... ignored, VT observer and history throughput measurement test terminal::recovery_measurements::measured_full_ring_reconstruction ... ignored, release reconstruction measurement; old healthy handles permit repeated cleanup test terminal::resize_recovery::absent_ring_keeps_last_good_size_and_later_output_usable ... ok test terminal::resize_recovery::complete_ring_restores_screens_mouse_and_unfinished_syntax ... ok test terminal::checks::approximate_repaint_is_bounded_clips_at_complete_cells_and_preserves_source ... ok test terminal::resize_recovery::earlier_geometry_changes_require_approximation_even_with_origin_coverage ... ok test terminal::resize_recovery::ring_gap_requires_clean_approximate_recovery ... ok test terminal_native::allocation::resize_allocation_refusal_retires_native_handle ... ok test terminal::fidelity::fidelity_screen_entry_consumes_inherited_shift_before_saving ... ok test terminal::fidelity::fidelity_variation_tail_attributes ... ok test terminal::fidelity::fidelity_variation_wrap_attributes ... ok test terminal::fidelity::fidelity_recorded_corpus ... ok test terminal::fidelity::fidelity_mouse_effective_fields_follow_order_independently_of_booleans ... ok test terminal::review_r3_default::review_r3_default_terminal_reflows_long_mixed_history ... ok test terminal::fidelity::fidelity_handwritten ... ok test terminal::fidelity::fidelity_extended_smoke ... ok test terminal::fidelity::fidelity_seeded_smoke ... ok test result: ok. 100 passed; 0 failed; 14 ignored; 0 measured; 0 filtered out; finished in 53.29s Running tests/detach.rs (target/debug/deps/detach-838805459b0210a0) running 2 tests test detached_child_restores_default_signals_without_changing_parent ... ok test closed_standard_descriptors_become_dev_null ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 5.35s Running tests/generation_lock.rs (target/debug/deps/generation_lock-accf86a09c0ffb8e) running 2 tests test transferred_lock_child ... ignored, private subprocess descriptor-transfer fixture test transferred_directory_lock_has_no_second_writer_gap ... ok test result: ok. 1 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.01s Running tests/mouse.rs (target/debug/deps/mouse-6875aedd16fa7eb1) running 1 test test faithful_snapshot_preserves_public_mouse_encoder_reports ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.97s Running tests/ppu_reliability.rs (target/debug/deps/ppu_reliability-92d223f034ceeac8) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/ppu_reliability_memory.rs (target/debug/deps/ppu_reliability_memory-4ca4bcf22ad9a41b) running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/process_exit_descriptor.rs (target/debug/deps/process_exit_descriptor-cc05b9e1b2f8f4e4) running 3 tests test invalid_pid_never_creates_a_descriptor ... ok test signal_reaches_only_the_described_process_and_then_refuses ... ok test descriptor_is_cloexec_and_observes_a_real_process_exit ... ok test result: ok. 3 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running unittests src/lib.rs (target/debug/deps/infraternal_status-76d7037ceceb2cda) running 24 tests test tests::an_unanswering_manager_only_makes_its_own_unit_unknown ... ok test tests::a_restarting_role_does_not_describe_a_stopped_or_failed_role_as_restarting ... ok test tests::consecutive_observations_detect_restart_count_and_pid_churn ... ok test tests::installed_system_server_data_comes_from_its_effective_execstart ... ok test tests::installed_server_discovery_recognizes_the_running_executable_identity ... ok test tests::real_user_crash_loop_is_not_running ... ignored, requires the job-owned transient crash-loop user unit test tests::nothing_installed_says_so ... ok test tests::production_server_is_a_running_server_with_two_mesh_peers ... ok test tests::rootless_agent_is_read_from_the_user_manager ... ok test tests::server_and_host_on_one_machine_is_both ... ok test tests::snapshot_scan_counts_peers_through_nesting_strings_and_spacing ... ok test tests::stopped_and_failed_services_keep_distinct_headlines_and_diagnostics ... ok test tests::stopped_server_unit_is_stopped_not_unknown ... ok test tests::the_headline_names_what_is_down_and_how_to_look ... ok test tests::the_headline_says_how_to_join_when_nothing_is_installed ... ok test tests::a_manager_that_does_not_answer_is_unknown_not_down ... ok test tests::retained_data_has_an_honest_headline_and_repair_step ... ok test tests::rootful_agent_is_a_host_with_its_own_state_directory ... ok test tests::rootful_agent_reads_mesh_peers_from_its_state_directory ... ok test tests::restart_age_uses_only_comparable_monotonic_microseconds ... ok test tests::manager_completion_follows_child_exit_even_if_stdout_closes_first ... ok test tests::manager_properties_report_each_role_and_scope_truthfully ... ok test tests::configured_role_state_table_controls_headline_and_exit ... ok test tests::manager_completion_handles_an_already_exited_child_and_a_deadline ... ok test result: ok. 23 passed; 0 failed; 1 ignored; 0 measured; 0 filtered out; finished in 0.07s Running tests/independent_units.rs (target/debug/deps/independent_units-0d77efa9b141e1e4) running 1 test test stalled_units_preserve_other_units_in_each_manager ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.09s Running tests/query_refusal.rs (target/debug/deps/query_refusal-0e92a44d8fcf0292) running 1 test test refused_manager_process_preserves_unknown_and_reason ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s Running tests/review_237.rs (target/debug/deps/review_237-ff9bc043d685dadc) running 4 tests test older_manager_clients_preserve_failed_service_observation ... ok test masked_server_with_retained_data_is_not_described_as_running ... ok test repeated_starts_with_a_future_wall_clock_timestamp_are_not_running ... ok test unavailable_system_manager_preserves_user_restart_observation ... ok test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s Running tests/review_237_masked_companion.rs (target/debug/deps/review_237_masked_companion-b28dbb049b75e205) running 1 test test masked_server_beside_a_running_host_has_a_partial_setup_headline ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_237_r3_masks.rs (target/debug/deps/review_237_r3_masks-1a2bce0a2653e2c7) running 2 tests test a_mask_alone_does_not_make_a_down_infraternal_agent ... ok test a_masked_service_its_manager_reports_running_is_not_stopped ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.03s Running tests/review_237_r3_matrix.rs (target/debug/deps/review_237_r3_matrix-b7a98cb93528482f) running 1 test test manager_shaped_answers_follow_every_documented_cell ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.57s Running tests/review_237_r3_next_budget.rs (target/debug/deps/review_237_r3_next_budget-d95db5d971309345) running 1 test test masked_server_recovery_keeps_next_steps_within_the_cli_limit ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Running tests/review_237_resources.rs (target/debug/deps/review_237_resources-d5853ef6d159cadc) running 1 test test thread_resource_refusal_preserves_a_status_answer ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.06s Doc-tests infraternal_agent running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_mesh running 1 test test crates/infraternal-mesh/src/model.rs - model::LocalPrivateKey (line 20) - compile fail ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s Doc-tests infraternal_plugin_api running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_backup running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_canvas running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_host_facts running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_mesh running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_relay running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_release running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_remote running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_plugin_ssh running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_protocol running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_server running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s Doc-tests infraternal_shim running 2 tests test crates/infraternal-shim/src/readiness.rs - readiness::Registration (line 56) - compile fail ... ok test crates/infraternal-shim/src/readiness.rs - readiness::Registration (line 63) - compile fail ... ok test result: ok. 2 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.35s Doc-tests infraternal_status running 0 tests test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s (test: 824s) ==> SSH inode reuse fixture Finished `test` profile [unoptimized + debuginfo] target(s) in 0.21s Running tests/install.rs (target/debug/deps/install-2006dcdc8e0a17d4) running 1 test test review_inode_reuse_after_diagnostics_preserves_live_replacement ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 95 filtered out; finished in 0.45s (SSH inode reuse fixture: 1s) ==> shim process-per-user Finished `test` profile [unoptimized + debuginfo] target(s) in 0.14s Running unittests src/lib.rs (target/debug/deps/infraternal_shim-5aed3766a8e67f2d) running 222 tests test frame::checks::codec_reuse_measurement ... ignored, release codec and allocation-path measurement test fixture_state::deep_root_keeps_real_sockets_private_and_cleans_up_on_drop ... ok test frame::checks::borrowed_and_owned_decoders_agree_at_every_fragment_boundary ... ok test frame::checks::approximate_snapshot_codec_is_bounded_and_canonical ... ok test frame::checks::deferred_frame_keeps_its_borrowed_storage_and_ordered_trailing_bytes ... ok test frame::checks::borrowed_output_keeps_frozen_bytes_and_refuses_before_batch_mutation ... ok test ended::tests::bounded_record_preserves_status_and_rejects_malformed_or_linked_data ... ok test frame::checks::shared_writer_selector_is_fixed_length_and_fragment_safe ... ok test heap_accounting::accounting_keeps_exact_layouts_and_balances_reallocation ... ok test frame::checks::tests::batch_append_preserves_prefix_and_refuses_invalid_frames ... ok test frame::checks::tests::golden_and_fragmented ... ok test frame::checks::tests::invalid_lengths_types_and_utf8 ... ok test heap_accounting::transient_allocations_are_visible_after_their_storage_is_freed ... ok test locale::tests::invalid_shell_expressions_are_ignored ... ok test locale::tests::missing_lang_preserves_other_locale_values_and_fills_only_lang ... ok test locale::tests::existing_user_locale_values_are_preserved_without_replacement ... ok test locale::tests::macos_locale_identifier_gets_a_utf8_codeset ... ok test locale::tests::non_locale_values_do_not_cross_the_scrubbed_shell_boundary ... ok test locale::tests::unsupported_configured_locale_uses_installed_utf8_fallback ... ok test locale::tests::configured_locale_is_selected_from_login_locale_files ... ok test frame::checks::query_reply_extension_is_bounded_and_fragment_safe ... ok running 1 test test locale::tests::absent_locale_uses_fallback_only_when_it_is_installed ... ok test frame::checks::golden::every_frozen_message ... ok test pty::child_signal_tests::child_signal_reset_spawn_cost_at_128_children ... ignored, child spawn diagnostic; run locally in a weighted scope without own build overlap test frame::checks::maximum_deferred_frame_retries_without_growing_storage ... ok test pty::child_signal_tests::child_policy_closes_the_control_descriptor_before_direct_exec ... ok test pty::child_environment_tests::spawned_login_shell_receives_selected_environment_without_other_host_variables ... ok test pty::output_readiness_tests::readable_byte_hint_preserves_the_complete_output_stream ... ok test ring::checks::tests::borrowed_ranges_obey_absolute_offsets_across_physical_wrap ... ok test ring::checks::tests::empty_append_keeps_lazy_storage_unallocated ... ok test pty::inherited_descriptor_tests::duplicated_socket_owns_its_descriptor_and_is_close_on_exec ... ok test pty::inherited_descriptor_tests::invalid_inherited_descriptors_are_refused ... ok running 1 test test pty::handoff::tests::oversized_ancillary_batch_refusal_closes_every_received_descriptor ... test ring::checks::tests::merge_review_head_and_retained_bytes_match_after_every_append ... ok test ring::checks::tests::merge_review_head_overflow_does_not_publish_or_discard_bytes ... ok test ring::checks::tests::merge_review_pool_refusal_retains_exact_suffix_and_releases_charge ... ok test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.01s running 1 test test pty::handoff::tests::credential_ancillary_refusal_closes_a_kernel_maximum_descriptor_batch ... test ring::checks::tests::shared_history_reservation_never_rounds_past_its_share ... ok test ring::checks::tests::wrap_and_exact_offsets ... ok test session::inputs::host_budget_tests::alternating_writers_cannot_expand_shared_host_bookkeeping_without_bound ... ok test frame::checks::golden::exact_maximum_and_coalesced_frames ... ok test pty::child_signal_tests::child_reset_restores_ignored_dispositions_and_leaves_parent_mask ... ok test session::inputs::reply_tests::reply_identity_is_outside_peer_namespace_and_writer_limit ... ok test session::inputs::merge_review::reply_promotion_preserves_staged_legacy_geometry_and_partial_credit ... ok test session::inputs::reply_tests::host_replies_preserve_segment_budget_and_account_for_promoted_storage ... ok test session::inputs::merge_review::refused_first_replies_do_not_promote_or_reset_legacy_state ... ok test session::inputs::tests::partial_writes_credit_only_the_owner_and_replay_trims_per_writer ... ok test session::measurements::budgets::bounded_flush_keeps_partial_frame_and_wire_order ... ok test session::measurements::budgets::input_to_pty_write ... ignored, real-PTY performance measurement; set ZDOTDIR to tests/profile test session::measurements::poll_storage_measurement ... ignored, release poll-storage allocation measurement test session::peer_uid_tests::different_uid_shim_socket_peer_is_refused ... ok test session::inputs::tests::identity_cap_preserves_all_existing_cursors ... ok test session::resize_checks::resize_refusal_session_probe ... ignored, isolated session probe invoked by its parent with a controlled shell profile ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.03s test pty::handoff::tests::oversized_ancillary_batch_refusal_closes_every_received_descriptor ... ok test session::sequenced_checks::coalesced_ack_never_overwrites_a_partial_output_and_cursors_survive_peer_loss ... ok test session::inputs::tests::host_legacy_writer_needs_no_heap_table ... ok test session::inputs::reply_tests::replies_preserve_selected_writer_cursor_and_geometry ... ok test session::inputs::merge_review::repeated_reply_registration_adds_exactly_one_identity ... ok test session::sequenced_checks::new_frames_roundtrip_and_refuse_noncanonical_payloads ... ok test session::sequenced_checks::negotiated_queue_deferral_validates_ranges_before_waiting ... ok test session::measurements::budgets::allowlisted_signal_after_real_pty_exit_keeps_exit_ack_available ... ok test session::sequenced_checks::reusable_encoder_retains_capacity_and_refuses_growth_before_mutation ... ok test session::sequenced_checks::writer_selection_has_a_frozen_little_endian_layout ... ok test session::sequenced_checks::a_completed_deferred_frame_gives_its_trailing_input_a_fresh_ticket ... ok test session::user_host::lazy_bench::geometry_replay_materialization_cost ... ignored, perf VM only: measure cold materialization after bounded geometry replay test session::sequenced_checks::trim_duplicates_gaps_overflow_and_capacity_are_transactional ... ok test session::user_host::child_checks::threaded_startup_is_refused_before_creating_session_state ... ok test session::user_host::reactor::tests::accounting_write_failure_disables_only_the_receipt ... ok test session::user_host::reactor::tests::actual_output_selector_keeps_a_bulk_turn_after_granted_and_denied_promotions ... ok test session::user_host::reactor::tests::cheap_replies_share_a_turn_but_expired_output_yields_to_input ... ok test session::sequenced_checks::coalesced_probe_and_input_preserve_the_written_ack_in_both_orders ... ok test session::user_host::reactor::tests::cancelled_bulk_membership_reuses_the_existing_deque_entry ... ok test session::user_host::reactor::tests::inline_and_extra_descriptor_flags_merge_without_losing_generations ... ok test session::user_host::child_checks::ordinary_housekeeping_does_not_probe_child_status ... ok ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.13s test session::user_host::reactor::tests::exit_observed_before_settle_still_queues_one_retention_deadline ... ok test session::user_host::reactor::tests::ownership_receipt_separates_session_components_and_shared_capacities ... ok test session::user_host::reactor::tests::one_session_readiness_fits_240_requested_bytes ... ok test pty::handoff::tests::credential_ancillary_refusal_closes_a_kernel_maximum_descriptor_batch ... ok test session::user_host::reactor::tests::readiness_membership_stays_within_five_bytes_per_session ... ok test session::user_host::reactor::tests::readiness_storage_registration_is_at_most_sixteen_bytes ... ok test session::user_host::reactor::tests::fresh_ack_fallback_avoids_writable_poll_and_finishes_with_new_input ... ok test session::user_host::reactor::tests::ready_rows_keep_two_descriptor_turns_allocation_free_within_64_bytes_per_slot ... ok test session::user_host::reactor::tests::readiness_storage_two_descriptors_are_allocation_free ... ok test session::user_host::reactor::tests::round_reset_and_wrap_preserve_bulk_membership_without_reviving_reads ... ok test session::user_host::reactor::tests::ready_rows_clear_only_touched_slots_and_fence_round_wrap ... ok test session::user_host::reactor::tests::input_phase_retires_closed_identity_without_publishing_transient_interest ... ok running 1 test test session::user_host::reactor::tests::reused_peer_descriptor_receives_a_new_readiness_identity ... test session::inputs::merge_review::interleaved_replies_and_replays_match_partial_write_model ... ok test session::user_host::reactor::tests::timer_membership_survives_bulk_promotion_cancellation_and_round_wrap ... ok test session::user_host::reactor::tests::single_ready_descriptor_needs_no_heap_allocation ... ok test session::user_host::reactor::tests::short_output_cohort_yields_before_the_next_input_poll ... ok test session::user_host::reactor::tests::replay_continues_after_its_frame_was_written_inline ... ok test session::user_host::tests::admission_refuses_foreign_uid_duplicate_ids_and_geometry_before_spawn ... ok test session::user_host::reactor::tests::queued_data_ack_needs_no_writable_poll_before_pty_service ... ok test session::user_host::tests::blocked_state_and_output_share_one_ordered_write_batch ... ok ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.02s test session::user_host::tests::bulk_turn_advances_sixteen_kib_and_yields_before_the_rest ... ok test session::user_host::tests::full_pool_reuses_ring_storage_for_newest_output ... ok test session::user_host::tests::deferred_data_ack_and_available_output_share_one_ordered_batch ... ok test session::user_host::tests::full_pool_typing_echo_latency ... ignored, timing measurement runs on the perf VM test session::user_host::tests::data_ack_can_wait_for_a_writable_visit_without_requiring_output ... ok test session::user_host::tests::full_pool_refuses_new_session_and_keeps_existing_session_working ... ok test session::user_host::reactor::tests::unchanged_registration_sync_needs_no_heap_allocation ... ok test session::user_host::tests::idle_session_ownership_ledger ... ignored, perf VM only: per-session requested-byte ownership ledger at scale test session::user_host::tests::host_pool_scales_with_machine_memory_within_bounds ... ok test session::user_host::reactor::tests::reused_peer_descriptor_receives_a_new_readiness_identity ... ok running 1 test test session::user_host::tests::last_viewer_disconnect_releases_unused_peer_slots ... ok test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 221 filtered out; finished in 0.01s test session::user_host::tests::last_viewer_disconnect_releases_unused_peer_slots ... ok test session::user_host::tests::geometry_transcript_materializes_at_its_event_bound ... ok test session::user_host::tests::malformed_closed_peer_is_retired_once_and_keeps_its_sibling ... ok test session::user_host::tests::output_bound_replays_retained_geometry_before_new_bytes ... ok test session::user_host::tests::lazy_prefix_materializes_exactly_before_overflow_and_resize ... ok test session::user_host::tests::medium_geometry_materializes_before_deferred_cell_work_exceeds_the_bound ... ok test session::user_host::tests::quiet_geometry_changes_remain_lazy_and_replay_in_order ... ok test session::user_host::tests::prefix_threshold_preserves_unfinished_sequences ... ok test session::user_host::tests::session_constructor_retains_only_the_bound_socket_path ... ok test session::user_host::tests::same_geometry_input_selection_keeps_vt_unallocated ... ok test session::user_host::tests::steady_replay_needs_no_payload_allocation ... ok test session::user_host::tests::unchanged_geometry_retains_native_resize_side_effects ... ok test session::user_host::tests::state_fences_and_input_only_acks_bypass_coalescing ... ok test session::user_host::tests::writable_peer_receives_state_and_output_before_another_readiness_turn ... ok test session::user_host::tests::vt_panic_retires_one_real_pty_and_sibling_keeps_its_output ... ok test session::user_host::tests::zero_ring_capacity_does_not_stall_a_live_pty ... ok test session::sequenced_checks::merge_review_replies_cannot_consume_space_reserved_for_deferred_typing ... ok test terminal::checks::snapshot_during_discard_preserves_the_unfinished_string_boundary ... ok test terminal::checks::approximate_repaint_keeps_complete_pending_syntax_or_omits_it_whole ... ok test session::resize_checks::native_resize_refusal_preserves_peer_and_pty ... ok test session::user_host::tests::exhausted_pool_drains_live_ptys_during_random_session_churn ... ok test terminal::checks::tests::fixtures_and_continuations_repaint ... ok test terminal::checks::tests::implicit_hyperlinks_retain_groups_across_rows_and_continuation ... ok test terminal::checks::tests::alternate_variants_and_nested_switches_repaint ... ok test terminal::checks::tests::margins_tabs_charsets_and_modes_continue ... ok test terminal::checks::tests::partial_csi_and_utf8_continue ... ok test terminal::checks::tests::long_unfinished_hyperlink_and_control_strings_continue ... ok test terminal::checks::tests::retained_alternate_saved_cursor_and_keyboard_stack_continue ... ok test terminal::checks::tests::saved_origin_survives_changed_margins ... ok test terminal::fidelity::fidelity_charset_mapped_wide_space_is_explicitly_rejected ... ok test terminal::checks::tests::pending_wrap_and_saved_wrap_continue_with_wide_cells ... ok test terminal::fidelity::fidelity_diagnostic_fixture ... ignored, diagnostic replay of an explicitly selected fixture file test terminal::fidelity::fidelity_cursor ... ok test terminal::fidelity::fidelity_extended_nightly ... ignored, nightly expanded differential corpus: 20,000 deterministic cases test session::user_host::tests::large_geometry_cannot_defer_a_long_first_snapshot_reflow_queue ... ok test terminal::checks::tests::unfinished_sequence_over_frame_limit_fails_without_losing_runtime_state ... ok test terminal::fidelity::fidelity_fresh_c_redraw_default_is_explicitly_rejected ... ok test terminal::checks::tests::byte_budget_prunes_history_and_resize_remains_repaintable ... ok test terminal::fidelity::fidelity_edge ... ok test terminal::fidelity::fidelity_inherited_protection_off_mode_is_explicitly_rejected ... ok test terminal::fidelity::fidelity_iso_protection_erase ... ok test terminal::fidelity::fidelity_f1_rep ... ok test terminal::fidelity::fidelity_iso_protection_does_not_keep_rep_scratch ... ok test terminal::fidelity::fidelity_oracle_observes_archived_cells_with_equal_active_screens ... ok test terminal::fidelity::fidelity_orphaned_spacer_head ... ok test terminal::fidelity::fidelity_oracle_detects_hidden_state ... ok test terminal::fidelity::fidelity_prompt_resize_requires_explicit_rejection ... ok test terminal::fidelity::fidelity_rejects_unrepresentable_rep_without_mutating_source ... ok test pty::handoff::tests::all_masters_survive_original_owner_drop_with_cloexec ... ok test terminal::fidelity::fidelity_saved_modes_future_restore ... ok test terminal::fidelity::fidelity_saved_cursor_over_changed_edge ... ok test terminal::fidelity::fidelity_seeded_nightly ... ignored, nightly differential corpus: 20,000 deterministic cases test terminal::fidelity::fidelity_screen_entry_consumes_inherited_shift_before_saving ... ok test terminal::fidelity::fidelity_mouse_effective_fields_follow_order_independently_of_booleans ... ok test terminal::fidelity::fidelity_single_shift_survives_rep_seed ... ok test terminal::fidelity::fidelity_semantic_validation_matches_exported_history_extent ... ok test terminal::fidelity::fidelity_snapshot_resets_stale_viewer_color_overrides ... ok test terminal::checks::approximate_repaint_is_bounded_clips_at_complete_cells_and_preserves_source ... ok test terminal::fidelity::fidelity_snapshot_history_tail_contains_no_padding_rows ... ok test terminal::fidelity::fidelity_variation_tail_attributes ... ok test terminal::fidelity::fresh_captures::fidelity_fresh_real_program_captures ... ignored, manual fresh capture oracle; set VT_CAPTURE_DIR after real program capture test terminal::fidelity::fidelity_spacer_head_attributes ... ok test terminal::fidelity::fidelity_handwritten ... ok test terminal::fidelity::fidelity_variation_wrap_attributes ... ok test terminal::fidelity::fidelity_recorded_corpus ... ok test terminal::host_budget::erased_history_reset_and_geometry_return_native_memory ... ok test terminal::host_budget::page_nodes_never_fill_the_ordinary_data_cap ... ok test session::user_host::tests::geometry_transcript_property_cases_match_eager_native_state ... ok test terminal::measurements::budgets::snapshot_200x60 ... ignored, performance measurement; run release on the perf host test terminal::measurements::memory::measured_terminal_rss ... ignored, RSS measurement; run this filter alone in a fresh release process test terminal::measurements::throughput::measured_parser ... ignored, VT observer and history throughput measurement test terminal::ppu_memory_bench::fresh_shell_filler_snapshot_gap_is_independent_of_allocator_refusal ... ok test terminal::ppu_memory_bench::native_session_allocations_settle_after_geometry_warmup ... ignored, perf VM only: native heap/resident accounting; set PPU_VT_ACCOUNT_SESSIONS test terminal::ppu_memory_bench::quiet_resize_churn_does_not_keep_new_resident_pools ... ignored, perf VM only: sparse resize ownership at 900 quiet sessions test terminal::ppu_memory_bench::small_history_does_not_retain_megabyte_page_quanta ... ignored, perf VM only: sparse history residency and native ownership test terminal::recovery_measurements::measured_full_ring_reconstruction ... ignored, release reconstruction measurement; old healthy handles permit repeated cleanup test terminal::resize_recovery::absent_ring_keeps_last_good_size_and_later_output_usable ... ok test terminal::resize_recovery::complete_ring_restores_screens_mouse_and_unfinished_syntax ... ok test terminal::resize_recovery::earlier_geometry_changes_require_approximation_even_with_origin_coverage ... ok test terminal::resize_recovery::ring_gap_requires_clean_approximate_recovery ... ok test terminal::host_budget::shared_host_budget_bounds_the_sum_and_keeps_every_terminal_exact ... ok test terminal::review_r2::review_r2_escape_command_inside_discard_matches_short_string ... ok test terminal::review_r2::review_r2_escape_high_byte_does_not_start_a_hidden_string ... ok test terminal::host_budget::report_native_memory_numbers ... ok test terminal::host_budget::every_history_share_fills_and_recycles_inside_its_reservation ... ok test terminal::checks::control_strings_cannot_grow_session_carry_without_bound ... ok test terminal::host_budget::widening_a_full_history_stays_inside_its_share ... ok test session::user_host::tests::pool_usage_never_exceeds_cap_under_open_write_close_sequences ... ok test terminal::review_r2::review_r2_resize_with_full_history_share_stays_exact ... ok test terminal::fidelity::fidelity_extended_smoke ... ok test terminal::review_r2::review_r2_resize_storm_does_not_ratchet_native_memory ... ok test terminal::review_r2::review_r2_limiter_is_transparent_for_short_control_mixtures ... ok test terminal::review_r3::review_r3_four_hundred_laptop_screens_fit_the_host ... ok test terminal::review_r3::review_r3_bounded_terminal_reflows_long_mixed_history ... ok test terminal::review_r2::review_r2_host_history_share_fits_the_native_reservation ... ok test terminal::review_r3::review_r3_host_accounting_balances_through_recovery ... ok test terminal::review_r3::review_r3_recycled_unwrapped_history_keeps_exact_snapshot ... ok test terminal::review_r2::review_r2_ground_c1_introducer_stays_within_the_session_share ... ok test terminal::user_screen_pool_resize::taller_widening_keeps_history_rows_that_move_onto_the_screen ... ok test terminal_limits::c1_tests::c1_string_inside_csi_has_a_seven_bit_replay_boundary ... ok test terminal_limits::defensive_tests::executed_c0_between_escape_and_introducer_keeps_the_bound ... ok test terminal_limits::tests::escape_after_discard_restarts_without_losing_the_next_command ... ok test terminal_limits::tests::finite_sequences_are_identical_for_every_fragment_boundary ... ok test terminal_limits::tests::fragmented_overflow_stays_discarded_until_a_real_terminator ... ok test terminal_memory::payload_tests::oversized_payload_is_refused_before_allocation_while_tagged_pool_is_allowed ... ok test terminal_memory::payload_tests::residency_query_observes_only_owned_page_mappings_without_faulting_payload ... ok test terminal_memory::tests::allocation_budget_includes_overhead_and_refusal_is_recoverable ... ok test terminal_memory::tests::screen_pages_are_zero_filled_and_page_aligned ... ok test terminal_native::allocation::resize_allocation_refusal_retires_native_handle ... ok test terminal::review_r3_default::review_r3_default_terminal_reflows_long_mixed_history ... ok test terminal_native::owned_memory_tests::refused_resize_reclaims_every_owned_native_allocation ... ok test terminal_native::owned_memory_tests::refusal_inside_reflow_never_touches_freed_pages ... ok test terminal::host_budget::laptop_screens_come_from_their_floors_not_the_pool ... ok test terminal::review_r3::review_r3_history_share_without_ris_never_refuses ... ok test terminal::fidelity::fidelity_seeded_smoke ... ok test terminal::review_r3::review_r3_recycled_history_matches_unbounded_reference ... ok test terminal::review_r3::review_r3_noisy_neighbour_does_not_make_quiet_sessions_approximate ... ok test terminal::review_r3::review_r3_thousand_sessions_and_one_flood ... ok test terminal::review_r3::review_r3_hundred_laptop_sessions_keep_exact_state ... ok test terminal::review_r2::review_r2_alternating_oversized_strings_keep_following_output_exact has been running for over 60 seconds test terminal::review_r2::review_r2_alternating_oversized_strings_keep_following_output_exact ... ok test result: ok. 203 passed; 0 failed; 19 ignored; 0 measured; 0 filtered out; finished in 154.41s (shim process-per-user: 154s) ==> cargo-deny warning[duplicate]: found 2 duplicate entries for crate 'base64' ┌─ /home/claude/worktrees/j12b/Cargo.lock:24:1 │ 24 │ ╭ base64 0.21.7 registry+https://github.com/rust-lang/crates.io-index 25 │ │ base64 0.22.1 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────┘ lock entries │ ├ base64 v0.21.7 ├── base64urlsafedata v0.5.5 │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-fuzz v0.1.0 │ ├── webauthn-rs v0.5.5 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-proto v0.5.5 │ └── webauthn-rs-core v0.5.5 (*) ├── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-proto v0.5.5 (*) ├ base64 v0.22.1 ├── axum v0.8.9 │ ├── infraternal-fuzz v0.1.0 │ └── infraternal-server v0.1.0 │ ├── infraternal v0.1.0 │ └── infraternal-fuzz v0.1.0 (*) ├── infraternal v0.1.0 (*) ├── infraternal-plugin-api v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ └── infraternal-session v0.1.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-mesh v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-plugin-mesh v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-backup v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-canvas v0.1.0 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-host-facts v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ └── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-relay v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── (dev) infraternal-plugin-release v0.1.0 (*) ├── infraternal-server v0.1.0 (*) └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-plugin-api v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ └── infraternal-shim v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── infraternal-session v0.1.0 (*) │ └── infraternal-status v0.1.0 │ └── infraternal v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'cpufeatures' ┌─ /home/claude/worktrees/j12b/Cargo.lock:50:1 │ 50 │ ╭ cpufeatures 0.2.17 registry+https://github.com/rust-lang/crates.io-index 51 │ │ cpufeatures 0.3.1 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries │ ├ cpufeatures v0.2.17 ├── aes v0.8.4 │ └── aes-gcm v0.10.3 │ └── (dev) infraternal-server v0.1.0 │ ├── infraternal v0.1.0 │ └── infraternal-fuzz v0.1.0 ├── argon2 v0.5.3 │ └── infraternal-server v0.1.0 (*) ├── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── sha1 v0.10.7 │ ├── axum v0.8.9 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ └── tungstenite v0.29.0 │ └── tokio-tungstenite v0.29.0 │ ├── axum v0.8.9 (*) │ └── (dev) infraternal-server v0.1.0 (*) └── sha2 v0.10.9 ├── infraternal-agent v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ └── infraternal-session v0.1.0 │ └── infraternal-server v0.1.0 (*) ├── infraternal-plugin-api v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-mesh v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ └── infraternal-plugin-mesh v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-backup v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-canvas v0.1.0 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-host-facts v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ └── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-relay v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── infraternal-plugin-release v0.1.0 (*) ├── infraternal-plugin-ssh v0.1.0 (*) ├── (build) infraternal-server v0.1.0 (*) ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ └── infraternal-shim v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── infraternal-session v0.1.0 (*) │ │ └── infraternal-status v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) ├ cpufeatures v0.3.1 └── chacha20 v0.10.2 └── rand v0.10.3 └── quinn-proto v0.11.19 └── quinn v0.11.12 ├── infraternal-agent v0.1.0 │ ├── infraternal v0.1.0 │ ├── infraternal-fuzz v0.1.0 │ ├── infraternal-plugin-ssh v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-session v0.1.0 │ └── infraternal-server v0.1.0 (*) ├── infraternal-plugin-remote v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) └── infraternal-server v0.1.0 (*) warning[duplicate]: found 3 duplicate entries for crate 'getrandom' ┌─ /home/claude/worktrees/j12b/Cargo.lock:92:1 │ 92 │ ╭ getrandom 0.2.17 registry+https://github.com/rust-lang/crates.io-index 93 │ │ getrandom 0.3.4 registry+https://github.com/rust-lang/crates.io-index 94 │ │ getrandom 0.4.3 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────┘ lock entries │ ├ getrandom v0.2.17 ├── rand_core v0.6.4 │ ├── bip39 v2.2.2 │ │ └── infraternal-server v0.1.0 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-fuzz v0.1.0 │ ├── crypto-common v0.1.7 │ │ ├── aead v0.5.2 │ │ │ └── aes-gcm v0.10.3 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ ├── cipher v0.4.4 │ │ │ ├── aes v0.8.4 │ │ │ │ └── aes-gcm v0.10.3 (*) │ │ │ ├── aes-gcm v0.10.3 (*) │ │ │ └── ctr v0.9.2 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── digest v0.10.7 │ │ │ ├── blake2 v0.10.6 │ │ │ │ └── argon2 v0.5.3 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── hmac v0.12.1 │ │ │ │ └── hkdf v0.12.4 │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ ├── sha1 v0.10.7 │ │ │ │ ├── axum v0.8.9 │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ └── tungstenite v0.29.0 │ │ │ │ └── tokio-tungstenite v0.29.0 │ │ │ │ ├── axum v0.8.9 (*) │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ └── sha2 v0.10.9 │ │ │ ├── infraternal-agent v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ │ └── infraternal-session v0.1.0 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ ├── (build) infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ │ └── infraternal-shim v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ │ ├── infraternal-session v0.1.0 (*) │ │ │ │ │ └── infraternal-status v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── universal-hash v0.5.1 │ │ └── polyval v0.6.2 │ │ └── ghash v0.5.1 │ │ └── aes-gcm v0.10.3 (*) │ ├── password-hash v0.5.0 │ │ └── argon2 v0.5.3 (*) │ ├── rand v0.8.8 │ │ └── bip39 v2.2.2 (*) │ └── rand_chacha v0.3.1 │ └── rand v0.8.8 (*) └── ring v0.17.14 ├── infraternal-plugin-remote v0.1.0 (*) ├── quinn-proto v0.11.19 │ └── quinn v0.11.12 │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── rustls v0.23.46 │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── quinn v0.11.12 (*) │ └── quinn-proto v0.11.19 (*) └── rustls-webpki v0.103.16 └── rustls v0.23.46 (*) ├ getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-fuzz v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ getrandom v0.4.3 ├── jobserver v0.1.35 │ └── cc v1.6.0 │ ├── (build) libfuzzer-sys v0.4.13 │ │ └── infraternal-fuzz v0.1.0 │ ├── (build) libsqlite3-sys v0.30.1 │ │ ├── infraternal-shim v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ ├── infraternal-agent v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-session v0.1.0 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-session v0.1.0 (*) │ │ │ └── infraternal-status v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ └── infraternal-shim v0.1.0 (*) │ │ └── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── openssl-src v300.6.1+3.6.3 │ │ └── (build) openssl-sys v0.9.117 │ │ ├── axum-server v0.8.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── openssl v0.10.81 │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── (dev) infraternal-plugin-release v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-shim v0.1.0 (*) │ │ │ ├── tokio-openssl v0.6.5 │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── tokio-openssl v0.6.5 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── (build) openssl-sys v0.9.117 (*) │ └── (build) ring v0.17.14 │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── quinn-proto v0.11.19 │ │ └── quinn v0.11.12 │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── rustls v0.23.46 │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── quinn v0.11.12 (*) │ │ └── quinn-proto v0.11.19 (*) │ └── rustls-webpki v0.103.16 │ └── rustls v0.23.46 (*) ├── quinn-proto v0.11.19 (*) ├── rand v0.10.3 │ └── quinn-proto v0.11.19 (*) └── uuid v1.27.0 ├── infraternal v0.1.0 (*) ├── infraternal-agent v0.1.0 (*) ├── (dev) infraternal-plugin-api v0.1.0 (*) ├── infraternal-plugin-canvas v0.1.0 (*) ├── infraternal-plugin-mesh v0.1.0 (*) ├── infraternal-plugin-release v0.1.0 (*) ├── infraternal-plugin-remote v0.1.0 (*) ├── infraternal-plugin-ssh v0.1.0 (*) ├── infraternal-server v0.1.0 (*) ├── (dev) infraternal-status v0.1.0 (*) ├── webauthn-attestation-ca v0.5.5 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 2 duplicate entries for crate 'hashbrown' ┌─ /home/claude/worktrees/j12b/Cargo.lock:98:1 │ 98 │ ╭ hashbrown 0.15.5 registry+https://github.com/rust-lang/crates.io-index 99 │ │ hashbrown 0.17.1 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ hashbrown v0.15.5 ├── hashlink v0.10.0 │ └── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-session v0.1.0 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ └── infraternal-shim v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── infraternal-session v0.1.0 (*) │ │ └── infraternal-status v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) └── sqlx-core v0.8.6 (*) ├ hashbrown v0.17.1 └── indexmap v2.14.2 ├── h2 v0.4.19 │ ├── hyper v1.11.1 │ │ ├── axum v0.8.9 │ │ │ ├── infraternal-fuzz v0.1.0 │ │ │ └── infraternal-server v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ ├── axum-server v0.8.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hyper-util v0.1.21 │ │ │ ├── axum v0.8.9 (*) │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ ├── infraternal v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── (dev) infraternal-server v0.1.0 (*) └── sqlx-core v0.8.6 ├── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-plugin-api v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ └── infraternal-session v0.1.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-mesh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ └── infraternal-shim v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── infraternal-session v0.1.0 (*) │ └── infraternal-status v0.1.0 │ └── infraternal v0.1.0 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) └── sqlx-sqlite v0.8.6 ├── sqlx v0.8.6 (*) └── sqlx-macros-core v0.8.6 (*) warning[duplicate]: found 2 duplicate entries for crate 'r-efi' ┌─ /home/claude/worktrees/j12b/Cargo.lock:200:1 │ 200 │ ╭ r-efi 5.3.0 registry+https://github.com/rust-lang/crates.io-index 201 │ │ r-efi 6.0.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────┘ lock entries │ ├ r-efi v5.3.0 └── getrandom v0.3.4 └── rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-fuzz v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ r-efi v6.0.0 └── getrandom v0.4.3 ├── jobserver v0.1.35 │ └── cc v1.6.0 │ ├── (build) libfuzzer-sys v0.4.13 │ │ └── infraternal-fuzz v0.1.0 │ ├── (build) libsqlite3-sys v0.30.1 │ │ ├── infraternal-shim v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ ├── infraternal-agent v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-session v0.1.0 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-session v0.1.0 (*) │ │ │ └── infraternal-status v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ └── infraternal-shim v0.1.0 (*) │ │ └── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── openssl-src v300.6.1+3.6.3 │ │ └── (build) openssl-sys v0.9.117 │ │ ├── axum-server v0.8.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── openssl v0.10.81 │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── (dev) infraternal-plugin-release v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-shim v0.1.0 (*) │ │ │ ├── tokio-openssl v0.6.5 │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ └── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── tokio-openssl v0.6.5 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── (build) openssl-sys v0.9.117 (*) │ └── (build) ring v0.17.14 │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── quinn-proto v0.11.19 │ │ └── quinn v0.11.12 │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── rustls v0.23.46 │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── quinn v0.11.12 (*) │ │ └── quinn-proto v0.11.19 (*) │ └── rustls-webpki v0.103.16 │ └── rustls v0.23.46 (*) ├── quinn-proto v0.11.19 (*) ├── rand v0.10.3 │ └── quinn-proto v0.11.19 (*) └── uuid v1.27.0 ├── infraternal v0.1.0 (*) ├── infraternal-agent v0.1.0 (*) ├── (dev) infraternal-plugin-api v0.1.0 (*) ├── infraternal-plugin-canvas v0.1.0 (*) ├── infraternal-plugin-mesh v0.1.0 (*) ├── infraternal-plugin-release v0.1.0 (*) ├── infraternal-plugin-remote v0.1.0 (*) ├── infraternal-plugin-ssh v0.1.0 (*) ├── infraternal-server v0.1.0 (*) ├── (dev) infraternal-status v0.1.0 (*) ├── webauthn-attestation-ca v0.5.5 (*) ├── webauthn-rs v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 3 duplicate entries for crate 'rand' ┌─ /home/claude/worktrees/j12b/Cargo.lock:202:1 │ 202 │ ╭ rand 0.8.8 registry+https://github.com/rust-lang/crates.io-index 203 │ │ rand 0.9.5 registry+https://github.com/rust-lang/crates.io-index 204 │ │ rand 0.10.3 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 ├── infraternal v0.1.0 └── infraternal-fuzz v0.1.0 ├ rand v0.9.5 ├── infraternal-server v0.1.0 │ ├── infraternal v0.1.0 │ └── infraternal-fuzz v0.1.0 ├── tungstenite v0.29.0 │ └── tokio-tungstenite v0.29.0 │ ├── axum v0.8.9 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ └── (dev) infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 └── webauthn-rs v0.5.5 └── infraternal-server v0.1.0 (*) ├ rand v0.10.3 └── quinn-proto v0.11.19 └── quinn v0.11.12 ├── infraternal-agent v0.1.0 │ ├── infraternal v0.1.0 │ ├── infraternal-fuzz v0.1.0 │ ├── infraternal-plugin-ssh v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-session v0.1.0 │ └── infraternal-server v0.1.0 (*) ├── infraternal-plugin-remote v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) └── infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'rand_chacha' ┌─ /home/claude/worktrees/j12b/Cargo.lock:205:1 │ 205 │ ╭ rand_chacha 0.3.1 registry+https://github.com/rust-lang/crates.io-index 206 │ │ rand_chacha 0.9.0 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_chacha v0.3.1 └── rand v0.8.8 └── bip39 v2.2.2 └── infraternal-server v0.1.0 ├── infraternal v0.1.0 └── infraternal-fuzz v0.1.0 ├ rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-fuzz v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── webauthn-rs-core v0.5.5 (*) warning[duplicate]: found 3 duplicate entries for crate 'rand_core' ┌─ /home/claude/worktrees/j12b/Cargo.lock:207:1 │ 207 │ ╭ rand_core 0.6.4 registry+https://github.com/rust-lang/crates.io-index 208 │ │ rand_core 0.9.5 registry+https://github.com/rust-lang/crates.io-index 209 │ │ rand_core 0.10.1 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ rand_core v0.6.4 ├── bip39 v2.2.2 │ └── infraternal-server v0.1.0 │ ├── infraternal v0.1.0 │ └── infraternal-fuzz v0.1.0 ├── crypto-common v0.1.7 │ ├── aead v0.5.2 │ │ └── aes-gcm v0.10.3 │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── cipher v0.4.4 │ │ ├── aes v0.8.4 │ │ │ └── aes-gcm v0.10.3 (*) │ │ ├── aes-gcm v0.10.3 (*) │ │ └── ctr v0.9.2 │ │ └── aes-gcm v0.10.3 (*) │ ├── digest v0.10.7 │ │ ├── blake2 v0.10.6 │ │ │ └── argon2 v0.5.3 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── hmac v0.12.1 │ │ │ └── hkdf v0.12.4 │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ ├── sha1 v0.10.7 │ │ │ ├── axum v0.8.9 │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── tungstenite v0.29.0 │ │ │ └── tokio-tungstenite v0.29.0 │ │ │ ├── axum v0.8.9 (*) │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── sha2 v0.10.9 │ │ ├── infraternal-agent v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ └── infraternal-session v0.1.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── (build) infraternal-server v0.1.0 (*) │ │ ├── sqlx-core v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ └── infraternal-shim v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-session v0.1.0 (*) │ │ │ │ └── infraternal-status v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ └── universal-hash v0.5.1 │ └── polyval v0.6.2 │ └── ghash v0.5.1 │ └── aes-gcm v0.10.3 (*) ├── password-hash v0.5.0 │ └── argon2 v0.5.3 (*) ├── rand v0.8.8 │ └── bip39 v2.2.2 (*) └── rand_chacha v0.3.1 └── rand v0.8.8 (*) ├ rand_core v0.9.5 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-fuzz v0.1.0 │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 │ └── webauthn-rs v0.5.5 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ rand_core v0.10.1 ├── chacha20 v0.10.2 │ └── rand v0.10.3 │ └── quinn-proto v0.11.19 │ └── quinn v0.11.12 │ ├── infraternal-agent v0.1.0 │ │ ├── infraternal v0.1.0 │ │ ├── infraternal-fuzz v0.1.0 │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-session v0.1.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── getrandom v0.4.3 │ ├── jobserver v0.1.35 │ │ └── cc v1.6.0 │ │ ├── (build) libfuzzer-sys v0.4.13 │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ ├── (build) libsqlite3-sys v0.30.1 │ │ │ ├── infraternal-shim v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-session v0.1.0 (*) │ │ │ │ └── infraternal-status v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ ├── sqlx v0.8.6 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ └── infraternal-shim v0.1.0 (*) │ │ │ └── sqlx-macros-core v0.8.6 │ │ │ └── sqlx-macros v0.8.6 │ │ │ └── sqlx v0.8.6 (*) │ │ ├── openssl-src v300.6.1+3.6.3 │ │ │ └── (build) openssl-sys v0.9.117 │ │ │ ├── axum-server v0.8.0 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── openssl v0.10.81 │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ ├── (dev) infraternal-plugin-release v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ ├── infraternal-shim v0.1.0 (*) │ │ │ │ ├── tokio-openssl v0.6.5 │ │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ │ └── webauthn-rs-core v0.5.5 │ │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ ├── tokio-openssl v0.6.5 (*) │ │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── (build) openssl-sys v0.9.117 (*) │ │ └── (build) ring v0.17.14 │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── quinn-proto v0.11.19 (*) │ │ ├── rustls v0.23.46 │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ ├── quinn v0.11.12 (*) │ │ │ └── quinn-proto v0.11.19 (*) │ │ └── rustls-webpki v0.103.16 │ │ └── rustls v0.23.46 (*) │ ├── quinn-proto v0.11.19 (*) │ ├── rand v0.10.3 (*) │ └── uuid v1.27.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── (dev) infraternal-plugin-api v0.1.0 (*) │ ├── infraternal-plugin-canvas v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── (dev) infraternal-status v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 (*) │ ├── webauthn-rs v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) ├── rand v0.10.3 (*) └── rand_pcg v0.10.2 └── quinn-proto v0.11.19 (*) warning[duplicate]: found 2 duplicate entries for crate 'syn' ┌─ /home/claude/worktrees/j12b/Cargo.lock:251:1 │ 251 │ ╭ syn 2.0.119 registry+https://github.com/rust-lang/crates.io-index 252 │ │ syn 3.0.6 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────┘ lock entries │ ├ syn v2.0.119 ├── asn1-rs-derive v0.5.1 │ └── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ └── infraternal-fuzz v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── asn1-rs-impl v0.2.0 │ └── asn1-rs v0.6.2 (*) ├── enum-as-inner v0.6.1 │ └── sysctl v0.7.1 │ └── infraternal-plugin-host-facts v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ └── infraternal-session v0.1.0 │ │ └── infraternal-server v0.1.0 (*) │ └── infraternal-fuzz v0.1.0 (*) ├── openssl-macros v0.1.1 │ └── openssl v0.10.81 │ ├── axum-server v0.8.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-plugin-api v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-mesh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-host-facts v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ └── infraternal v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── (dev) infraternal-plugin-release v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── infraternal-shim v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── infraternal-session v0.1.0 (*) │ │ └── infraternal-status v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── tokio-openssl v0.6.5 │ │ ├── axum-server v0.8.0 (*) │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 │ │ └── webauthn-rs-core v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) ├── sqlx-macros v0.8.6 │ └── sqlx v0.8.6 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-plugin-api v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ └── infraternal-shim v0.1.0 (*) ├── sqlx-macros-core v0.8.6 │ └── sqlx-macros v0.8.6 (*) ├── synstructure v0.13.2 │ └── asn1-rs-derive v0.5.1 (*) ├── thiserror-impl v1.0.69 │ └── thiserror v1.0.69 │ ├── asn1-rs v0.6.2 (*) │ ├── webauthn-rs-core v0.5.5 (*) │ └── x509-parser v0.16.0 (*) ├── tracing-attributes v0.1.31 │ └── tracing v0.1.44 │ ├── axum v0.8.9 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── axum-core v0.5.6 │ │ └── axum v0.8.9 (*) │ ├── h2 v0.4.19 │ │ ├── hyper v1.11.1 │ │ │ ├── axum v0.8.9 (*) │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── hyper-util v0.1.21 │ │ │ │ ├── axum v0.8.9 (*) │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── infraternal v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── quinn v0.11.12 │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── quinn-proto v0.11.19 │ │ └── quinn v0.11.12 (*) │ ├── quinn-udp v0.5.16 │ │ └── quinn v0.11.12 (*) │ ├── sqlx-core v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ ├── sqlx-macros v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── tracing-subscriber v0.3.23 │ │ └── infraternal-server v0.1.0 (*) │ ├── webauthn-attestation-ca v0.5.5 (*) │ ├── webauthn-rs v0.5.5 (*) │ └── webauthn-rs-core v0.5.5 (*) └── zerocopy-derive v0.8.60 └── zerocopy v0.8.60 ├── half v2.7.1 │ ├── ciborium-ll v0.2.2 │ │ └── ciborium v0.2.2 │ │ └── criterion v0.7.0 │ │ └── (dev) infraternal-protocol v0.1.0 │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ ├── infraternal-plugin-canvas v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-host-facts v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ └── serde_cbor_2 v0.13.0 │ ├── infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── ppv-lite86 v0.2.21 ├── rand_chacha v0.3.1 │ └── rand v0.8.8 │ └── bip39 v2.2.2 │ └── infraternal-server v0.1.0 (*) └── rand_chacha v0.9.0 ├── rand v0.9.5 │ ├── infraternal-server v0.1.0 (*) │ ├── tungstenite v0.29.0 │ │ └── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── webauthn-rs-core v0.5.5 (*) └── webauthn-rs-core v0.5.5 (*) ├ syn v3.0.6 ├── clap_derive v4.6.7 │ └── clap v4.6.7 │ ├── criterion v0.7.0 │ │ └── (dev) infraternal-protocol v0.1.0 │ │ ├── infraternal-agent v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ ├── infraternal-fuzz v0.1.0 │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-session v0.1.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-canvas v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-host-facts v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal v0.1.0 (*) │ └── infraternal-shim v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── infraternal-session v0.1.0 (*) │ └── infraternal-status v0.1.0 │ └── infraternal v0.1.0 (*) ├── displaydoc v0.2.7 │ ├── asn1-rs v0.6.2 │ │ ├── der-parser v9.0.0 │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ └── x509-parser v0.16.0 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── oid-registry v0.7.1 │ │ │ └── x509-parser v0.16.0 (*) │ │ └── x509-parser v0.16.0 (*) │ ├── der-parser v9.0.0 (*) │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ │ └── infraternal-shim v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── tinystr v0.8.4 │ │ └── icu_locale_core v2.3.0 (*) │ └── zerotrie v0.2.5 │ ├── icu_properties v2.3.0 (*) │ └── icu_provider v2.3.1 (*) ├── futures-macro v0.3.34 │ └── futures-util v0.3.34 │ ├── axum v0.8.9 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── futures-executor v0.3.34 │ │ └── sqlx-sqlite v0.8.6 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── js-sys v0.3.106 │ │ ├── getrandom v0.2.17 │ │ │ ├── rand_core v0.6.4 │ │ │ │ ├── bip39 v2.2.2 │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ ├── crypto-common v0.1.7 │ │ │ │ │ ├── aead v0.5.2 │ │ │ │ │ │ └── aes-gcm v0.10.3 │ │ │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ │ │ ├── cipher v0.4.4 │ │ │ │ │ │ ├── aes v0.8.4 │ │ │ │ │ │ │ └── aes-gcm v0.10.3 (*) │ │ │ │ │ │ ├── aes-gcm v0.10.3 (*) │ │ │ │ │ │ └── ctr v0.9.2 │ │ │ │ │ │ └── aes-gcm v0.10.3 (*) │ │ │ │ │ ├── digest v0.10.7 │ │ │ │ │ │ ├── blake2 v0.10.6 │ │ │ │ │ │ │ └── argon2 v0.5.3 │ │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── hmac v0.12.1 │ │ │ │ │ │ │ └── hkdf v0.12.4 │ │ │ │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── sha1 v0.10.7 │ │ │ │ │ │ │ ├── axum v0.8.9 (*) │ │ │ │ │ │ │ └── tungstenite v0.29.0 │ │ │ │ │ │ │ └── tokio-tungstenite v0.29.0 │ │ │ │ │ │ │ ├── axum v0.8.9 (*) │ │ │ │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ │ │ │ └── sha2 v0.10.9 │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ │ ├── (build) infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── sqlx-core v0.8.6 (*) │ │ │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ │ │ └── universal-hash v0.5.1 │ │ │ │ │ └── polyval v0.6.2 │ │ │ │ │ └── ghash v0.5.1 │ │ │ │ │ └── aes-gcm v0.10.3 (*) │ │ │ │ ├── password-hash v0.5.0 │ │ │ │ │ └── argon2 v0.5.3 (*) │ │ │ │ ├── rand v0.8.8 │ │ │ │ │ └── bip39 v2.2.2 (*) │ │ │ │ └── rand_chacha v0.3.1 │ │ │ │ └── rand v0.8.8 (*) │ │ │ └── ring v0.17.14 │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ ├── quinn-proto v0.11.19 │ │ │ │ └── quinn v0.11.12 │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── rustls v0.23.46 │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ ├── quinn v0.11.12 (*) │ │ │ │ └── quinn-proto v0.11.19 (*) │ │ │ └── rustls-webpki v0.103.16 │ │ │ └── rustls v0.23.46 (*) │ │ ├── getrandom v0.4.3 │ │ │ ├── jobserver v0.1.35 │ │ │ │ └── cc v1.6.0 │ │ │ │ ├── (build) libfuzzer-sys v0.4.13 │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── (build) libsqlite3-sys v0.30.1 │ │ │ │ │ ├── infraternal-shim v0.1.0 (*) │ │ │ │ │ └── sqlx-sqlite v0.8.6 (*) │ │ │ │ ├── openssl-src v300.6.1+3.6.3 │ │ │ │ │ └── (build) openssl-sys v0.9.117 │ │ │ │ │ ├── axum-server v0.8.0 │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ ├── openssl v0.10.81 │ │ │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ │ │ ├── (dev) infraternal-plugin-release v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-shim v0.1.0 (*) │ │ │ │ │ │ ├── tokio-openssl v0.6.5 │ │ │ │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── webauthn-attestation-ca v0.5.5 │ │ │ │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ │ │ ├── tokio-openssl v0.6.5 (*) │ │ │ │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ │ │ ├── (build) openssl-sys v0.9.117 (*) │ │ │ │ └── (build) ring v0.17.14 (*) │ │ │ ├── quinn-proto v0.11.19 (*) │ │ │ ├── rand v0.10.3 │ │ │ │ └── quinn-proto v0.11.19 (*) │ │ │ └── uuid v1.27.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── (dev) infraternal-plugin-api v0.1.0 (*) │ │ │ ├── infraternal-plugin-canvas v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── (dev) infraternal-status v0.1.0 (*) │ │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── web-sys v0.3.106 │ │ │ └── plotters v0.3.7 │ │ │ └── criterion v0.7.0 (*) │ │ └── web-time v1.1.0 │ │ ├── quinn v0.11.12 (*) │ │ ├── quinn-proto v0.11.19 (*) │ │ └── rustls-pki-types v1.15.1 │ │ ├── quinn-proto v0.11.19 (*) │ │ ├── rustls v0.23.46 (*) │ │ └── rustls-webpki v0.103.16 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── tokio-tungstenite v0.29.0 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── tower-http v0.6.11 │ └── infraternal-server v0.1.0 (*) ├── serde_derive v1.0.229 │ ├── serde v1.0.229 │ │ ├── base64urlsafedata v0.5.5 │ │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ │ ├── webauthn-rs v0.5.5 (*) │ │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 (*) │ │ ├── bip39 v2.2.2 (*) │ │ ├── ciborium v0.2.2 │ │ │ └── criterion v0.7.0 (*) │ │ ├── criterion v0.7.0 (*) │ │ ├── either v1.18.0 │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── itertools v0.13.0 │ │ │ │ ├── criterion v0.7.0 (*) │ │ │ │ └── criterion-plot v0.6.0 │ │ │ │ └── criterion v0.7.0 (*) │ │ │ ├── rayon v1.12.0 │ │ │ │ └── criterion v0.7.0 (*) │ │ │ ├── sqlx-core v0.8.6 (*) │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ ├── infraternal-plugin-canvas v0.1.0 (*) │ │ ├── infraternal-plugin-host-facts v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── serde_cbor_2 v0.13.0 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ ├── serde_urlencoded v0.7.1 │ │ │ └── sqlx-sqlite v0.8.6 (*) │ │ ├── sqlx-core v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ ├── tinytemplate v1.2.1 │ │ │ └── criterion v0.7.0 (*) │ │ ├── tracing-serde v0.2.0 │ │ │ └── tracing-subscriber v0.3.23 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── tracing-subscriber v0.3.23 (*) │ │ ├── url v2.5.8 (*) │ │ ├── webauthn-attestation-ca v0.5.5 (*) │ │ ├── webauthn-rs v0.5.5 (*) │ │ ├── webauthn-rs-core v0.5.5 (*) │ │ ├── webauthn-rs-proto v0.5.5 (*) │ │ └── zeroize v1.9.0 │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── rustls v0.23.46 (*) │ │ └── rustls-pki-types v1.15.1 (*) │ └── url v2.5.8 (*) ├── synstructure v0.14.0 │ ├── yoke-derive v0.8.4 │ │ └── yoke v0.8.3 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── zerotrie v0.2.5 (*) │ │ └── zerovec v0.11.8 │ │ ├── icu_collections v2.3.0 (*) │ │ ├── icu_locale_core v2.3.0 (*) │ │ ├── icu_normalizer v2.3.0 (*) │ │ ├── icu_properties v2.3.0 (*) │ │ ├── icu_provider v2.3.1 (*) │ │ ├── potential_utf v0.1.6 │ │ │ └── icu_collections v2.3.0 (*) │ │ └── tinystr v0.8.4 (*) │ └── zerofrom-derive v0.1.8 │ └── zerofrom v0.1.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── yoke v0.8.3 (*) │ ├── zerotrie v0.2.5 (*) │ └── zerovec v0.11.8 (*) ├── thiserror-impl v2.0.21 │ └── thiserror v2.0.21 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-mesh v0.1.0 (*) │ ├── infraternal-plugin-api v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── quinn v0.11.12 (*) │ ├── quinn-proto v0.11.19 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-sqlite v0.8.6 (*) │ ├── sysctl v0.7.1 │ │ └── infraternal-plugin-host-facts v0.1.0 (*) │ └── tungstenite v0.29.0 (*) ├── tokio-macros v2.7.2 │ └── tokio v1.53.3 │ ├── axum v0.8.9 (*) │ ├── axum-server v0.8.0 (*) │ ├── fs-err v3.3.2 │ │ └── axum-server v0.8.0 (*) │ ├── h2 v0.4.19 │ │ ├── hyper v1.11.1 │ │ │ ├── axum v0.8.9 (*) │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── hyper-util v0.1.21 │ │ │ │ ├── axum v0.8.9 (*) │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── hyper v1.11.1 (*) │ ├── hyper-util v0.1.21 (*) │ ├── (dev) infraternal v0.1.0 (*) │ ├── (dev) infraternal-agent v0.1.0 (*) │ ├── infraternal-plugin-api v0.1.0 (*) │ ├── infraternal-plugin-canvas v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 (*) │ ├── (dev) infraternal-plugin-remote v0.1.0 (*) │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ ├── (dev) infraternal-server v0.1.0 (*) │ ├── infraternal-shim v0.1.0 (*) │ ├── quinn v0.11.12 (*) │ ├── sqlx-core v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 (*) │ ├── tokio-openssl v0.6.5 (*) │ ├── tokio-stream v0.1.19 │ │ └── sqlx-core v0.8.6 (*) │ ├── tokio-tungstenite v0.29.0 (*) │ ├── tokio-util v0.7.19 │ │ ├── h2 v0.4.19 (*) │ │ └── tower-http v0.6.11 (*) │ ├── tower v0.5.3 (*) │ └── tower-http v0.6.11 (*) ├── wasm-bindgen-macro-support v0.2.129 │ └── wasm-bindgen-macro v0.2.129 │ └── wasm-bindgen v0.2.129 │ ├── getrandom v0.2.17 (*) │ ├── getrandom v0.4.3 (*) │ ├── js-sys v0.3.106 (*) │ ├── plotters v0.3.7 (*) │ ├── web-sys v0.3.106 (*) │ └── web-time v1.1.0 (*) ├── yoke-derive v0.8.4 (*) ├── zerofrom-derive v0.1.8 (*) └── zerovec-derive v0.11.6 └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'synstructure' ┌─ /home/claude/worktrees/j12b/Cargo.lock:254:1 │ 254 │ ╭ synstructure 0.13.2 registry+https://github.com/rust-lang/crates.io-index 255 │ │ synstructure 0.14.0 registry+https://github.com/rust-lang/crates.io-index │ ╰─────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ synstructure v0.13.2 └── asn1-rs-derive v0.5.1 └── asn1-rs v0.6.2 ├── der-parser v9.0.0 │ ├── webauthn-rs-core v0.5.5 │ │ └── webauthn-rs v0.5.5 │ │ └── infraternal-server v0.1.0 │ │ ├── infraternal v0.1.0 │ │ └── infraternal-fuzz v0.1.0 │ └── x509-parser v0.16.0 │ └── webauthn-rs-core v0.5.5 (*) ├── oid-registry v0.7.1 │ └── x509-parser v0.16.0 (*) └── x509-parser v0.16.0 (*) ├ synstructure v0.14.0 ├── yoke-derive v0.8.4 │ └── yoke v0.8.3 │ ├── icu_collections v2.3.0 │ │ ├── icu_normalizer v2.3.0 │ │ │ └── idna_adapter v1.2.2 │ │ │ └── idna v1.1.0 │ │ │ └── url v2.5.8 │ │ │ ├── infraternal v0.1.0 │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 │ │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-session v0.1.0 │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ ├── sqlx-core v0.8.6 │ │ │ │ ├── sqlx v0.8.6 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-agent v0.1.0 │ │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ │ └── infraternal-shim v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ │ │ ├── infraternal-session v0.1.0 (*) │ │ │ │ │ └── infraternal-status v0.1.0 │ │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ │ ├── sqlx-macros v0.8.6 │ │ │ │ │ └── sqlx v0.8.6 (*) │ │ │ │ ├── sqlx-macros-core v0.8.6 │ │ │ │ │ └── sqlx-macros v0.8.6 (*) │ │ │ │ └── sqlx-sqlite v0.8.6 │ │ │ │ ├── sqlx v0.8.6 (*) │ │ │ │ └── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-macros-core v0.8.6 (*) │ │ │ ├── sqlx-sqlite v0.8.6 (*) │ │ │ ├── webauthn-rs v0.5.5 │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── webauthn-rs-core v0.5.5 │ │ │ │ └── webauthn-rs v0.5.5 (*) │ │ │ └── webauthn-rs-proto v0.5.5 │ │ │ └── webauthn-rs-core v0.5.5 (*) │ │ └── icu_properties v2.3.0 │ │ └── idna_adapter v1.2.2 (*) │ ├── icu_provider v2.3.1 │ │ ├── icu_normalizer v2.3.0 (*) │ │ └── icu_properties v2.3.0 (*) │ ├── zerotrie v0.2.5 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ └── zerovec v0.11.8 │ ├── icu_collections v2.3.0 (*) │ ├── icu_locale_core v2.3.0 │ │ ├── icu_properties v2.3.0 (*) │ │ └── icu_provider v2.3.1 (*) │ ├── icu_normalizer v2.3.0 (*) │ ├── icu_properties v2.3.0 (*) │ ├── icu_provider v2.3.1 (*) │ ├── potential_utf v0.1.6 │ │ └── icu_collections v2.3.0 (*) │ └── tinystr v0.8.4 │ └── icu_locale_core v2.3.0 (*) └── zerofrom-derive v0.1.8 └── zerofrom v0.1.8 ├── icu_collections v2.3.0 (*) ├── icu_provider v2.3.1 (*) ├── yoke v0.8.3 (*) ├── zerotrie v0.2.5 (*) └── zerovec v0.11.8 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror' ┌─ /home/claude/worktrees/j12b/Cargo.lock:257:1 │ 257 │ ╭ thiserror 1.0.69 registry+https://github.com/rust-lang/crates.io-index 258 │ │ thiserror 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰──────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ └── infraternal-fuzz v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror v2.0.21 ├── infraternal v0.1.0 ├── infraternal-mesh v0.1.0 │ ├── infraternal v0.1.0 (*) │ └── infraternal-plugin-mesh v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-session v0.1.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── infraternal-plugin-api v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-mesh v0.1.0 (*) │ ├── infraternal-plugin-backup v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-canvas v0.1.0 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-host-facts v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ └── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-relay v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── infraternal-server v0.1.0 (*) ├── quinn v0.11.12 │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── quinn-proto v0.11.19 │ └── quinn v0.11.12 (*) ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ └── infraternal-shim v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── infraternal-session v0.1.0 (*) │ │ └── infraternal-status v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) ├── sqlx-sqlite v0.8.6 (*) ├── sysctl v0.7.1 │ └── infraternal-plugin-host-facts v0.1.0 (*) └── tungstenite v0.29.0 └── tokio-tungstenite v0.29.0 ├── axum v0.8.9 │ ├── infraternal-fuzz v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) └── (dev) infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'thiserror-impl' ┌─ /home/claude/worktrees/j12b/Cargo.lock:259:1 │ 259 │ ╭ thiserror-impl 1.0.69 registry+https://github.com/rust-lang/crates.io-index 260 │ │ thiserror-impl 2.0.21 registry+https://github.com/rust-lang/crates.io-index │ ╰───────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ thiserror-impl v1.0.69 └── thiserror v1.0.69 ├── asn1-rs v0.6.2 │ ├── der-parser v9.0.0 │ │ ├── webauthn-rs-core v0.5.5 │ │ │ └── webauthn-rs v0.5.5 │ │ │ └── infraternal-server v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ └── infraternal-fuzz v0.1.0 │ │ └── x509-parser v0.16.0 │ │ └── webauthn-rs-core v0.5.5 (*) │ ├── oid-registry v0.7.1 │ │ └── x509-parser v0.16.0 (*) │ └── x509-parser v0.16.0 (*) ├── webauthn-rs-core v0.5.5 (*) └── x509-parser v0.16.0 (*) ├ thiserror-impl v2.0.21 └── thiserror v2.0.21 ├── infraternal v0.1.0 ├── infraternal-mesh v0.1.0 │ ├── infraternal v0.1.0 (*) │ └── infraternal-plugin-mesh v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-session v0.1.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── infraternal-plugin-api v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-mesh v0.1.0 (*) │ ├── infraternal-plugin-backup v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-canvas v0.1.0 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-host-facts v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ └── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-relay v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── infraternal-server v0.1.0 (*) ├── quinn v0.11.12 │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── quinn-proto v0.11.19 │ └── quinn v0.11.12 (*) ├── sqlx-core v0.8.6 │ ├── sqlx v0.8.6 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ └── infraternal-shim v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ ├── infraternal-server v0.1.0 (*) │ │ ├── infraternal-session v0.1.0 (*) │ │ └── infraternal-status v0.1.0 │ │ └── infraternal v0.1.0 (*) │ ├── sqlx-macros v0.8.6 │ │ └── sqlx v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 │ │ └── sqlx-macros v0.8.6 (*) │ └── sqlx-sqlite v0.8.6 │ ├── sqlx v0.8.6 (*) │ └── sqlx-macros-core v0.8.6 (*) ├── sqlx-sqlite v0.8.6 (*) ├── sysctl v0.7.1 │ └── infraternal-plugin-host-facts v0.1.0 (*) └── tungstenite v0.29.0 └── tokio-tungstenite v0.29.0 ├── axum v0.8.9 │ ├── infraternal-fuzz v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) └── (dev) infraternal-server v0.1.0 (*) warning[duplicate]: found 2 duplicate entries for crate 'windows-sys' ┌─ /home/claude/worktrees/j12b/Cargo.lock:317:1 │ 317 │ ╭ windows-sys 0.52.0 registry+https://github.com/rust-lang/crates.io-index 318 │ │ windows-sys 0.61.2 registry+https://github.com/rust-lang/crates.io-index │ ╰────────────────────────────────────────────────────────────────────────┘ lock entries │ ├ windows-sys v0.52.0 └── ring v0.17.14 ├── infraternal-plugin-remote v0.1.0 │ ├── infraternal v0.1.0 │ ├── infraternal-agent v0.1.0 │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ └── infraternal-session v0.1.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── quinn-proto v0.11.19 │ └── quinn v0.11.12 │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ └── infraternal-server v0.1.0 (*) ├── rustls v0.23.46 │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── quinn v0.11.12 (*) │ └── quinn-proto v0.11.19 (*) └── rustls-webpki v0.103.16 └── rustls v0.23.46 (*) ├ windows-sys v0.61.2 ├── anstyle-query v1.1.5 │ └── anstream v1.0.0 │ └── clap_builder v4.6.7 │ └── clap v4.6.7 │ ├── criterion v0.7.0 │ │ └── (dev) infraternal-protocol v0.1.0 │ │ ├── infraternal-agent v0.1.0 │ │ │ ├── infraternal v0.1.0 │ │ │ ├── infraternal-fuzz v0.1.0 │ │ │ ├── infraternal-plugin-ssh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── infraternal-server v0.1.0 │ │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-session v0.1.0 │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ ├── infraternal-plugin-api v0.1.0 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── infraternal-plugin-mesh v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-backup v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-canvas v0.1.0 │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-host-facts v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ └── infraternal-fuzz v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-relay v0.1.0 │ │ │ │ └── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-remote v0.1.0 │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ ├── infraternal-agent v0.1.0 (*) │ │ │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ │ │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ │ │ │ └── infraternal-server v0.1.0 (*) │ │ │ ├── infraternal-plugin-ssh v0.1.0 (*) │ │ │ └── infraternal-server v0.1.0 (*) │ │ ├── infraternal-plugin-canvas v0.1.0 (*) │ │ ├── (dev) infraternal-plugin-host-facts v0.1.0 (*) │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── infraternal v0.1.0 (*) │ └── infraternal-shim v0.1.0 │ ├── infraternal v0.1.0 (*) │ ├── infraternal-agent v0.1.0 (*) │ ├── infraternal-fuzz v0.1.0 (*) │ ├── infraternal-plugin-remote v0.1.0 (*) │ ├── infraternal-plugin-ssh v0.1.0 (*) │ ├── infraternal-server v0.1.0 (*) │ ├── infraternal-session v0.1.0 (*) │ └── infraternal-status v0.1.0 │ └── infraternal v0.1.0 (*) ├── anstyle-wincon v3.0.11 │ └── anstream v1.0.0 (*) ├── errno v0.3.14 │ └── signal-hook-registry v1.4.8 │ └── tokio v1.53.3 │ ├── axum v0.8.9 │ │ ├── infraternal-fuzz v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── axum-server v0.8.0 │ │ └── infraternal-server v0.1.0 (*) │ ├── fs-err v3.3.2 │ │ └── axum-server v0.8.0 (*) │ ├── h2 v0.4.19 │ │ ├── hyper v1.11.1 │ │ │ ├── axum v0.8.9 (*) │ │ │ ├── axum-server v0.8.0 (*) │ │ │ ├── hyper-util v0.1.21 │ │ │ │ ├── axum v0.8.9 (*) │ │ │ │ ├── axum-server v0.8.0 (*) │ │ │ │ ├── infraternal v0.1.0 (*) │ │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ │ ├── infraternal v0.1.0 (*) │ │ │ └── (dev) infraternal-server v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── hyper v1.11.1 (*) │ ├── hyper-util v0.1.21 (*) │ ├── (dev) infraternal v0.1.0 (*) │ ├── (dev) infraternal-agent v0.1.0 (*) │ ├── infraternal-plugin-api v0.1.0 (*) │ ├── infraternal-plugin-canvas v0.1.0 (*) │ ├── infraternal-plugin-mesh v0.1.0 (*) │ ├── infraternal-plugin-release v0.1.0 (*) │ ├── (dev) infraternal-plugin-remote v0.1.0 (*) │ ├── (dev) infraternal-plugin-ssh v0.1.0 (*) │ ├── (dev) infraternal-server v0.1.0 (*) │ ├── infraternal-shim v0.1.0 (*) │ ├── quinn v0.11.12 │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── infraternal-server v0.1.0 (*) │ ├── sqlx-core v0.8.6 │ │ ├── sqlx v0.8.6 │ │ │ ├── infraternal v0.1.0 (*) │ │ │ ├── infraternal-plugin-api v0.1.0 (*) │ │ │ ├── infraternal-plugin-mesh v0.1.0 (*) │ │ │ ├── infraternal-plugin-release v0.1.0 (*) │ │ │ ├── infraternal-server v0.1.0 (*) │ │ │ └── infraternal-shim v0.1.0 (*) │ │ ├── sqlx-macros v0.8.6 │ │ │ └── sqlx v0.8.6 (*) │ │ ├── sqlx-macros-core v0.8.6 │ │ │ └── sqlx-macros v0.8.6 (*) │ │ └── sqlx-sqlite v0.8.6 │ │ ├── sqlx v0.8.6 (*) │ │ └── sqlx-macros-core v0.8.6 (*) │ ├── sqlx-macros-core v0.8.6 (*) │ ├── tokio-openssl v0.6.5 │ │ ├── axum-server v0.8.0 (*) │ │ ├── infraternal v0.1.0 (*) │ │ ├── infraternal-agent v0.1.0 (*) │ │ ├── infraternal-plugin-remote v0.1.0 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── tokio-stream v0.1.19 │ │ └── sqlx-core v0.8.6 (*) │ ├── tokio-tungstenite v0.29.0 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ ├── tokio-util v0.7.19 │ │ ├── h2 v0.4.19 (*) │ │ └── tower-http v0.6.11 │ │ └── infraternal-server v0.1.0 (*) │ ├── tower v0.5.3 │ │ ├── axum v0.8.9 (*) │ │ └── (dev) infraternal-server v0.1.0 (*) │ └── tower-http v0.6.11 (*) ├── mio v1.2.4 │ └── tokio v1.53.3 (*) ├── nu-ansi-term v0.50.3 │ └── tracing-subscriber v0.3.23 │ └── infraternal-server v0.1.0 (*) ├── quinn-udp v0.5.16 │ └── quinn v0.11.12 (*) ├── socket2 v0.6.5 │ ├── quinn v0.11.12 (*) │ ├── quinn-udp v0.5.16 (*) │ └── tokio v1.53.3 (*) ├── tokio v1.53.3 (*) └── winapi-util v0.1.11 ├── same-file v1.0.6 │ └── walkdir v2.5.0 │ ├── criterion v0.7.0 (*) │ └── sysctl v0.7.1 │ └── infraternal-plugin-host-facts v0.1.0 (*) └── walkdir v2.5.0 (*) advisories ok, bans ok, licenses ok, sources ok (cargo-deny: 2s) ==> gate architecture x86_64 final: native tests run; static dispatch PASS x86_64 iterate: native tests run; static dispatch PASS aarch64 final: native tests run; static dispatch PASS aarch64 iterate: native tests run; static dispatch PASS x86_64: native CLI/key-memory execution; foreign runtime skips PASS aarch64: native CLI/key-memory execution; foreign runtime skips PASS static build failure: rejected before artifact reporting PASS (gate architecture: 0s) ==> static builds x86_64-unknown-linux-musl: exact define removed; build directories remapped; explicit paths preserved; target override refused aarch64-unknown-linux-musl: exact define removed; build directories remapped; explicit paths preserved; target override refused x86_64 OpenSSL source: AVX-512 GCM dispatch removed idempotently native compiler metadata: path independent; platform/date retained; unexpected syntax refused Rust remapping: differently named checkout roots produce identical stripped artifacts . ---------------------------------------------------------------------- Ran 1 test in 0.002s OK Finished `release` profile [optimized] target(s) in 0.34s AES-128-GCM NIST vector encrypt/decrypt passed production trust: PASS (staging-trust authority absent) /home/claude/worktrees/j12b/target/x86_64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped PT_INTERP: absent; size: 22534600 bytes; baseline 21443824; delta +1090776 bytes (report only, D243 amended 2026-11-01) key memory: x86_64-unknown-linux-musl; memlock=8388608 bytes Key memory initialization=1; locked pages and dump exclusion enabled Finished `release` profile [optimized] target(s) in 0.54s production trust: PASS (staging-trust authority absent) /home/claude/worktrees/j12b/target/aarch64-unknown-linux-musl/release/infraternal: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, stripped PT_INTERP: absent; size: 20589768 bytes; baseline 19629240; delta +960528 bytes (report only, D243 amended 2026-11-01) SKIP key memory: aarch64-unknown-linux-musl (host x86_64; native execution required) x86_64-unknown-linux-musl: +102400 bytes accepted with delta; zero/negative deltas reported; missing/wrong/dynamic/PT_INTERP/inspection defects rejected PASS aarch64-unknown-linux-musl: +102400 bytes accepted with delta; zero/negative deltas reported; missing/wrong/dynamic/PT_INTERP/inspection defects rejected PASS unsupported target: rejected PASS bun test v1.4.2 (744846f84) scripts/release/static-metadata-review.test.ts: (pass) x86_64-unknown-linux-musl compiler metadata is independent of the checkout location [54.67ms] (pass) aarch64-unknown-linux-musl compiler metadata is independent of the checkout location [47.15ms] 2 pass 0 fail 14 expect() calls Ran 2 tests across 1 file. [432.00ms] server subcommand: exit 2, versioned JSON unavailable result agent group: exit 0, one parsed versioned JSON listing of its commands (static builds: 7s) +---------------------------+--------------+ | Rust gate | Result | +---------------------------+--------------+ | fmt | PASS | | VT native fmt | PASS | | CLI plugin compile-out | PASS | | clippy | PASS | | SSH runtime test helper | PASS | | real-binary fixture paths | PASS | | test | PASS | | SSH inode reuse fixture | PASS | | shim process-per-user | PASS | | cargo-deny | PASS | | gate architecture | PASS | | static builds | PASS | +---------------------------+--------------+ ==> Compiler metadata generator checks bun test v1.4.2 (744846f84) scripts/release/build-metadata.test.ts: (pass) native metadata canonicalization retains version fields and refuses changed syntax [169.91ms] (pass) Rust and cached target compiles receive every environment remap [1235.55ms] 2 pass 0 fail 121 expect() calls Ran 2 tests across 1 file. [1.93s] ==> Vendored Ghostty artifact checksums dist/ghostty-web.js: OK dist/ghostty-vt.wasm: OK dist/index.d.ts: OK ==> TypeScript protocol compiler Saved lockfile ==> Tracer compiler, precompression and bundle transfer budget bun install v1.4.2 (744846f84) + @types/bun@1.3.8 + @types/node@22.19.0 + @types/ws@8.5.10 + playwright@1.61.1 + typescript@5.9.3 + ws@8.18.3 + @scure/bip39@2.2.0 + geist@1.7.2 38 packages installed [522.00ms] $ bun x tsc --project tsconfig.json bun test v1.4.2 (744846f84) precompress.test.ts: (pass) text sidecars round-trip deterministically; compressed formats remain identity [25.21ms] browser-build.test.ts: (pass) the browser renderer has no unresolved Vite Node-file shim request [33.97ms] (pass) layout review fixtures ship only in explicitly enabled preview builds [7625.67ms] src/perf-detector.test.ts: (pass) FrameDetector > estimates the refresh from the median and snaps it [0.66ms] (pass) FrameDetector > nothing is a drop before the rate is known [0.05ms] (pass) FrameDetector > a drop is over 1.5 refresh intervals, a freeze over 100 ms [0.12ms] (pass) FrameDetector > the refresh only goes up: a slow page is not a slower display [0.19ms] (pass) FrameDetector > the first frame after a pause is not an interval [0.11ms] (pass) FrameDetector > fps, p95 and window read the ring [0.30ms] (pass) FrameDetector > a throttled page (one frame a second) is neither a drop nor a freeze, and neither is its return [0.38ms] (pass) FrameDetector > a lone long stall is still a freeze and is not a throttled run [0.06ms] src/stale-screen.test.ts: (pass) a program that redraws after reattach never shows the note, not for a frame [0.31ms] (pass) a redraw that arrived before the replay painted needs no wait at all [0.04ms] (pass) a shell that stays silent shows the note once the wait has run out [0.06ms] (pass) output that arrives later clears the note [0.03ms] (pass) an idle shell reattached at the same size is correctly silent and never shows the note [0.03ms] (pass) a shell that stays silent after the attach resized it shows the note [0.03ms] (pass) a resized program that repaints never shows the note, not for a frame [0.03ms] (pass) one changed dimension is a resize [0.03ms] (pass) output after the note, on a resized reattach, clears it [0.03ms] (pass) a server that reports no size keeps the wait [0.03ms] (pass) the replay fence reports a size only when both fields are usable [0.18ms] (pass) a dropped link takes the note down and cancels a wait that has not ended [0.04ms] (pass) the wait grows with the round trip and stays bounded [0.09ms] src/synchronized-output.test.ts: (pass) synchronized terminal output > recognizes a private mode split across byte and string writes [0.75ms] (pass) synchronized terminal output > preserves mode transitions for every pair of input chunk boundaries [2.08ms] (pass) synchronized terminal output > ignores CSI-looking bytes inside control strings and other mode numbers [0.13ms] (pass) synchronized terminal output > RIS clears an active mode [0.13ms] (pass) synchronized terminal output > bounds an unfinished control sequence [0.35ms] (pass) synchronized terminal output > paints queued output on the first frame after reset and timeout release [0.65ms] src/terminal-fit-lifecycle.test.ts: (pass) a queued fit stops when the terminal becomes closed [0.58ms] (pass) a queued fit stops when the terminal becomes suspended [0.04ms] (pass) a queued fit stops when the terminal becomes frozen [0.04ms] src/account-storage.test.ts: (pass) clearing one account leaves a second account and device preferences alone [1.16ms] (pass) the last-account pointer of another account stays [0.08ms] (pass) an unknown account clears every account's data and keeps preferences [0.17ms] (pass) account notifications cannot write before or after disposal [0.30ms] (pass) legacy generation sweep is account scoped and reports refused erasure [0.39ms] (pass) R2: 21 legacy generations survive refused cleanup and disappear only after a successful retry [0.67ms] src/hints.test.ts: (pass) sign-ins 1 to 5 show a hint once each; the sixth never does [0.51ms] (pass) a reload inside a sign-in does not show the hint again, and different hints are independent and accounts share anonymous device counters [0.06ms] (pass) an account without a counter is in its first sign-in [0.09ms] (pass) storage that throws or holds junk shows nothing and never throws [0.32ms] test/layout-coalescing-review.test.ts: (pass) distinct view and column identifiers cannot supersede each other's unsent weights [5.44ms] test/layout-identity-review.test.ts: (pass) sign-in and layout-close hints cannot retain the account identifier after sign-out [0.56ms] real/attachment-bookkeeping.test.ts: (pass) server-restored streams count without a new client AttachTerm and deduplicate both paths [0.48ms] (pass) control, malformed and unrelated events cannot invent a real attachment [0.16ms] real/restart-namespace.test.ts: (pass) only an explicit private tmpfs runtime qualifies [0.43ms] src/offline-drawing.test.ts: (pass) warming the shell never accesses private browser storage [0.16ms] src/session-notifications.test.ts: (pass) notifications validate account/lifetime messages and dispose callbacks [0.65ms] (pass) missing or failed notification channels do not prevent confirmed local teardown [0.28ms] src/sign-out.test.ts: (pass) a late successful logout cannot forget or announce revocation for a newer signed-in screen [1.10ms] (pass) a late failed logout does not thaw the replacement screen [0.39ms] (pass) new screen logout has its own request and old completion cannot clear its deduplication [0.56ms] (pass) default lifetime still deduplicates one failed logout and restores its screen [0.31ms] src/canvas/recency.test.ts: (pass) touch moves an item to the front and never duplicates it [0.37ms] (pass) repeating the front item changes nothing [0.09ms] (pass) the list is capped, so the oldest items fall off [0.14ms] (pass) top skips items that are no longer live, without losing them [0.09ms] (pass) recentRows: five used windows in reverse order of use, from 54 windows [0.37ms] (pass) recentRows: a view with three windows and no use shows them in order [0.07ms] (pass) recentRows: used windows lead, the rest fill up to five in window order [0.13ms] src/canvas/status.test.ts: (pass) a lost server connection is an error toast, never a success tick [0.71ms] (pass) routine connection states stay out of the toast [0.11ms] (pass) repeated connection closes do not reopen the persistent reason toast [0.19ms] (pass) a repeated close does not retake the shared toast after a newer message replaces it [0.28ms] (pass) a close reason stays visible through a quick reconnect and clears after a stable attach [676.09ms] src/canvas/toolbar/palette-actions.test.ts: (pass) a deferred split:right selection retains its original window [0.48ms] (pass) a deferred new:below selection retains its original window [0.06ms] (pass) a deferred close selection retains its original window [0.04ms] src/canvas/windows/details-facts.test.ts: (pass) host facts become plain-language details rows [1.20ms] (pass) unknown optional host facts stay absent instead of appearing as placeholders [0.27ms] (pass) by default the machine tab shows the D126 facts under System, Resources and Access, with no More section [0.41ms] (pass) extended info adds only init, virtualization, how it is reached, shell and locale [0.27ms] (pass) facts the host did not report are omitted by default, not shown as unknown [0.20ms] (pass) the header follows the machine's own facts, not the platform the host list guessed [0.17ms] (pass) before facts arrive the host's platform names the header [0.07ms] (pass) a reported system with no platform mark still names the header and shows no mark [0.07ms] src/canvas/windows/session-hooks.test.ts: (pass) a failed idle warm-up shows no toast and retries when the browser is back online [11.08ms] (pass) a failed open shows the toast, and opening again after the network returns succeeds [10.77ms] (pass) an open that joins a failing idle warm-up still shows the toast [5.31ms] src/canvas/windows/link.test.ts: (pass) a healthy attached window is connected and live [0.26ms] (pass) the first attach is connecting; a lost link after that is reconnecting, with the keys kept meanwhile [0.07ms] (pass) a window with no binding yet is live (nothing is known to be wrong) [0.03ms] (pass) coming back is a moment: resumed for 1.8 s, a rebuilt screen for 3.2 s, then connected again [0.12ms] (pass) an ended session and a refused shell are offline, each in its own words, and win over the link [0.07ms] src/canvas/mesh/api-retry-budget.test.ts: (pass) a retained watch outage bounds retry requests over two logical minutes [2.56ms] src/canvas/mesh/layout-model.test.ts: (pass) a pin moved by another device invalidates a same-count pin cache [1.51ms] (pass) a recovered graph owns its node positions independently [0.18ms] (pass) a negative pin is drawn by shifting the whole graph by whole grid cells; no pin is rewritten [0.16ms] (pass) with no negative pin the origin is zero and nothing shifts [0.08ms] src/canvas/mesh/protocol.test.ts: (pass) the server's own list becomes nodes, tags and grants, by name [0.84ms] (pass) without `access` (today's server) the person may view and may not edit [0.45ms] (pass) fields the server does not send are absent, never invented [0.22ms] (pass) a node the server sees passing traffic is online, on its path, under its machine's name [0.09ms] (pass) anything that is not a list is refused, whole [3.93ms] (pass) a node's own tag list and the tag table agree even when a server sends only one [0.27ms] (pass) the subscription's events: a pushed list, a revision that invalidates, and the end of the subscription [0.43ms] (pass) answers carry the new revision, and a create the new arrow's id [0.09ms] (pass) endpoints go out as the server writes them: a node by id, a tag by name [0.14ms] src/canvas/mesh/api-recovery.test.ts: (pass) failed watch refreshes retain one subscription through retry and release it on disposal [1.68ms] (pass) a synchronous subscription refusal leaves retry able to install a new watch [0.50ms] (pass) a changed Mesh revision refreshes a renamed host in the existing view model [0.63ms] (pass) a pushed recovery cancels the scheduled retry [0.40ms] (pass) a pushed recovery supersedes an outstanding retry failure [0.47ms] (pass) a retry snapshot at revision 1 is ordered against a pushed recovery [0.46ms] (pass) a retry snapshot at revision 3 is ordered against a pushed recovery [0.13ms] (pass) a pushed liveness expiry supersedes an equal-revision retry snapshot [0.55ms] (pass) a forbidden withdrawal cancels retry work from the retained watch [0.44ms] (pass) a withdrawn view ignores an earlier outstanding retry result [0.57ms] (pass) initial Mesh list handles closed transport [0.32ms] (pass) initial Mesh list handles liveness deadline [0.07ms] (pass) initial Mesh list handles unreadable JSON [0.07ms] (pass) initial Mesh list handles unavailable storage [0.11ms] (pass) initial Mesh list handles forbidden action [0.11ms] (pass) initial Mesh list handles invalid stored host [0.12ms] (pass) Mesh watch withdrawal handles forbidden [0.19ms] (pass) Mesh watch withdrawal handles mesh unavailable [0.03ms] (pass) Mesh watch withdrawal handles plugin unavailable [0.08ms] src/canvas/mesh/layout.test.ts: (pass) a small mesh keeps the approved arrangement: tags down the left, hosts two to a row [0.33ms] (pass) the layout is deterministic and does not depend on input order [3.91ms] (pass) no two cards overlap, and every card lies inside the graph [7.75ms] (pass) the sheet is wider than tall, roughly 16:10 [1.78ms] (pass) a pinned node stays where it was put and the others do not move [2.38ms] (pass) a pin beyond the sheet grows the graph [0.37ms] (pass) a host's other tags do not move it; a tag nobody carries still has its node [0.20ms] (pass) 1,000 nodes lay out in a few milliseconds [13.97ms] src/canvas/layout/stops.test.ts: (pass) a view that fits the viewport has one stop, centred [0.43ms] (pass) a wide view has one stop per column and the last stop ends at the right edge [0.28ms] (pass) a view taller than the viewport is scaled down so it fits [0.04ms] (pass) nearestStop picks the stop whose centre is closest [0.18ms] (pass) a big graph opens fitted whole, in one stop, and its canvas is free [0.31ms] (pass) a small graph keeps one stop per node column [0.10ms] (pass) on a narrow screen a big graph does not shrink past where its names can be read: it starts at the top left [0.09ms] (pass) centred stops (a phone's strip) rest every column mid-screen, the first and last included [0.10ms] (pass) D309: with a floor, a narrow column gets a stop of its drawn width and each column is reachable [0.15ms] src/canvas/layout/grid.test.ts: (pass) split right in a stacked column makes a group: the window's column halves, its neighbours span both halves [1.59ms] (pass) closing the new half gives the layout back exactly, in the model [1.39ms] (pass) closing the window it came from makes the new half take its band, and the layout is one column again [0.46ms] (pass) split right of a spanning window halves its span inside the existing columns, with the footprint unchanged [0.30ms] (pass) split down in a group divides only the window's band: the partner window grows to keep its height [0.57ms] (pass) closing the window split down gives its band back to the window above and to the partner [0.47ms] (pass) a window split down in a plain column stacks under it and moves the windows below down [0.18ms] (pass) new window right opens a full-size column after the whole group, never inside it [0.35ms] (pass) runs: adjacent columns linked by a spanning window form one group, the rest stay plain [0.11ms] (pass) spans are clamped to the columns that exist and a stale row is re-placed, never overlapped [0.17ms] (pass) random sequences of split right, split down, new window right and close never break the grid [50.32ms] (pass) closing every window of a group returns the view to nothing, with no problem on the way [0.57ms] (pass) a full-width band under a group moves nothing and extends the group by one band [0.22ms] (pass) a band inserted between two bands of one column grows the windows beside it and moves the rest [0.16ms] (pass) a narrow right split grows both drawn tracks to the canonical minimum [0.09ms] src/canvas/layout/geometry.test.ts: (pass) a dropped view pushes the one it lands on along the axis of least overlap, never itself [0.68ms] (pass) a chain of neighbours is pushed in turn [0.11ms] (pass) display settlement clears disconnected overlaps while keeping its one anchor fixed [0.47ms] (pass) review: a viewport width increase after settlement keeps the Settings anchor clear [0.56ms] (pass) snapping rounds to whole cells [0.05ms] (pass) reach follows grants through tags and keeps the relay [0.33ms] (pass) phone edge to edge: a lone window is the whole area, in a strip it leaves the gap and PEEK px of each neighbour; full width is the whole area always [0.11ms] (pass) comfortable phones: a column in a strip leaves PEEK px of each neighbour; a lone one keeps the screen less the margins [0.06ms] (pass) a desktop column is the same alone and in a strip [0.03ms] (pass) D309: a touch screen draws every column at least MIN_TOUCH_COLUMN wide, never wider than a lone column; a fine pointer has no floor [0.10ms] (pass) D309: the content is as wide as the drawn columns, so the camera reaches every column [0.09ms] (pass) a desktop column is never drawn wider than the screen; a phone strip has no ceiling and the saved width is untouched [0.07ms] src/canvas/sessions/startup-toast.test.ts: (pass) a closing notice cannot hide its replacement before the next animation frame [1.81ms] src/canvas/sessions/live-inventory.test.ts: (pass) a shared manual name pins an existing record and survives later attach hints [1.04ms] (pass) choosing the current automatic name still pins it [0.12ms] (pass) a host snapshot replaces in-memory session rows without rewriting legacy storage [1.61ms] (pass) an unavailable agent hides remembered rows without ending them, then restores verified sessions [0.29ms] (pass) inventory keeps a remote session per tab and refuses a cross-host attach [0.23ms] (pass) superseded status snapshots release records for sessions this device never opened [1.28ms] (pass) superseding a sidecar preserves status for a window opened on this device [0.18ms] (pass) a census predating a new shell does not permanently retire its confirmed live ID [0.17ms] (pass) a final Close before the first positive census never revives a new ID [0.11ms] (pass) a later absence retires a new ID after its first positive census [0.11ms] (pass) another host's census cannot clear a new shell's census fence [0.08ms] (pass) another host's close cannot clear a new shell's census fence [0.02ms] (pass) shared membership marks windows open without any local attachment [0.27ms] src/canvas/sessions/details-live.test.ts: (pass) a refused host facts action stops its recurring timer [1.17ms] (pass) a detected operating system supplies the live popover mark [1.08ms] src/canvas/sessions/startup-hints.test.ts: (pass) the offer asks in the owner's words and offers ✓, ✗ and ? with a name each [2.06ms] (pass) each multiplexer is named as people know it [0.05ms] (pass) discovery and cancelling confirmation never change startup; accepting offers a precise undo [3.10ms] (pass) ✗ changes nothing and ? opens the docs without closing the question [0.66ms] (pass) with no recognised startup line, ✓ copies the line instead of editing a file [1.62ms] (pass) saving a hint switch never sends a startup-file edit [0.48ms] (pass) disposing a pending detection never shows its late notice [0.27ms] (pass) a newly seen host reads its saved override before showing its switch [1.55ms] src/canvas/sessions/live.test.ts: (pass) the toolbar sessions seam exposes admitted host state and routes by identity [0.96ms] (pass) an enrolled host opens by UUID and splits keep that authority [0.25ms] (pass) an authoritative snapshot keeps an unjoined host visible while setup continues [0.23ms] (pass) unknown and ambiguous labels never open an embedded shell [0.16ms] (pass) removed hosts disappear from inventory and cannot route a new shell [0.17ms] (pass) an authoritative host snapshot replaces admission with one notification [0.23ms] (pass) the embedded inventory identity still opens locally beside an equally named remote [0.07ms] (pass) the embedded host's mark does not wait for an account name, and no account is invented [0.06ms] src/canvas/sessions/hosts.test.ts: (pass) fresh storage lists an offline host added by another browser [0.91ms] (pass) every welcome reconciles without duplicate subscriptions or hosts [0.19ms] (pass) a removal in another browser withdraws the host [0.25ms] (pass) a malformed page cannot partially replace the authoritative inventory [0.28ms] (pass) a socket-authority refusal withdraws previously admitted hosts [0.38ms] (pass) an invalidated read cannot enqueue an unsent call while the socket is down [0.55ms] src/canvas/sessions/gone-review.test.ts: (pass) selecting a known gone session keeps its final exited state [0.19ms] (pass) a known retired status survives repeated selection and generic ended answers [0.10ms] src/canvas/sessions/hosts-scale-review.test.ts: (pass) a fresh browser discovers 10000 admitted offline hosts from complete bounded pages [17.87ms] (pass) a fresh browser discovers 10001 admitted offline hosts from complete bounded pages [8.95ms] src/canvas/sessions/open-refusal.test.ts: (pass) memory refusal retains the reason and current counters [1.15ms] (pass) legacy refusals still work and malformed counters never reach the message [0.57ms] (pass) product copy names the host and counters and never renders untrusted server text [0.39ms] (pass) oversized refusal JSON is ignored before parsing [1.23ms] src/canvas/sessions/focus-intent.test.ts: (pass) focusin supersedes every older focus intent [0.56ms] (pass) pointerdown supersedes every older focus intent [0.04ms] (pass) keydown supersedes every older focus intent [0.02ms] (pass) input supersedes every older focus intent [0.02ms] src/canvas/version/source.test.ts: (pass) checks real server state and reported host versions together, keeping unknown hosts unknown [1.89ms] (pass) a ready server release comes from verified backend state [0.18ms] (pass) malformed backend state fails a check without inventing a running version [0.20ms] (pass) subscribes after capability discovery and removes listeners on disposal [1.66ms] (pass) disposing a view fences late facts without changing the check result into unknown [0.37ms] src/canvas/version/updates.test.ts: (pass) lag shows by itself > a host whose version differs from the server's is an update; an unknown version never is [0.31ms] (pass) lag shows by itself > no lag leaves the settled state alone; work in progress and failures are never replaced [0.07ms] (pass) lag shows by itself > a check's targets and the lagging hosts are merged by name [0.15ms] (pass) the Updates value is the whole conversation > a press on 'Up to date' checks, shows the spinner, and settles [1.04ms] (pass) the Updates value is the whole conversation > a check that finds updates asks 'proceed?', and a second press proceeds then checks again [0.47ms] (pass) the Updates value is the whole conversation > lag that is already known is answered by one press: proceed, no check first [0.25ms] (pass) the Updates value is the whole conversation > a press while work runs does nothing [0.19ms] (pass) the Updates value is the whole conversation > a source that cannot check says why, in its own words; any other failure is a plain sentence [0.38ms] (pass) the Updates value is the whole conversation > a source with no way to update never offers it as done; the failure is kept for the person to read [0.15ms] (pass) the Updates value is the whole conversation > an update that does not start leaves the choice where it was and says so once [0.33ms] (pass) the Updates value is the whole conversation > the spinner stays at least as long as asked, even when the answer is instant [0.15ms] (pass) the source is the truth about what it retains > a new retained update state replaces what the row showed; an unrelated change keeps what a press found [0.36ms] (pass) checkFleet asks every host together > every probe has started before any has answered [0.63ms] (pass) checkFleet asks every host together > the answer lists exactly the targets that need an update [0.25ms] (pass) checkFleet asks every host together > one host that cannot answer makes the whole answer a failure instead of leaving it out [0.14ms] src/canvas/version/words.test.ts: (pass) the Updates value > each state says one thing, and a press is named by the tooltip [0.13ms] (pass) the Updates value > the count agrees with its noun and the question is asked once [0.22ms] (pass) the Updates value > the tooltip names what a press will update, with this server first-class [0.05ms] (pass) the Updates value > no value repeats its key, and 'Hosts' is not a second key for the same thing [0.21ms] (pass) the pill > up to date is a tick, an update is an exclamation, a failed check is a cross, and nothing known shows no mark [0.29ms] (pass) the pill > the tip and the spoken name carry the status and the edition in words [0.09ms] (pass) the pill > a licence about to end tints the edition and the tip says when [0.14ms] (pass) the licence lines > the section is titled by the edition, and the heading says the version once [0.15ms] (pass) the licence lines > a licence says when it ends in plain words [4.20ms] (pass) the licence lines > no prices anywhere in the wording [0.28ms] src/canvas/model/server-store.test.ts: (pass) a negative drop on a 1,025-node mesh writes one pin, and the peer ends with every pin (#24) [36.40ms] (pass) repeated pin moves reach both coordinate limits; the next move is refused and rolled back [2.38ms] (pass) event before Result and duplicate events do not apply an optimistic edit twice [1.17ms] (pass) reconnect retries the exact request and an old receipt removes its optimistic overlay [0.90ms] (pass) legacy import remains intact until canonical confirmation even if another device initialized [0.65ms] (pass) dispose cancels late callbacks after sign-out [0.39ms] (pass) a pending reference preserves unrelated edits across remote paints and is never sent [2.24ms] (pass) closing an unsent shell removes its unresolved birth without blocking surviving children [0.69ms] (pass) an acknowledgement after its ordered event does not repaint the same layout [0.40ms] (pass) a bootstrap receipt before its canonical snapshot keeps the legacy layout drawable without rewriting its source [0.47ms] (pass) ready edits share one network round trip with a bounded in-flight window [1.14ms] (pass) the optimistic semantic projection paints before any server receipt [0.57ms] (pass) a no-op drawing capture does not trigger another paint [0.29ms] (pass) review: a refused structural edit cannot strand later valid edits [0.60ms] (pass) a definitive refusal paints rollback in memory and never retries after reconnect [0.51ms] (pass) a stale refusal cannot discard a new-connection retry [0.39ms] (pass) review r2: refusal drains independent edits waiting behind four in-flight requests [1.89ms] (pass) a normal reconnect snapshot arrives before any replacement is requested [0.66ms] (pass) legacy import retires only after receipt and canonical coverage, receipt first=false [0.56ms] (pass) legacy import retires only after receipt and canonical coverage, receipt first=true [0.14ms] (pass) refused import and refused cleanup preserve their legacy source until confirmed removal succeeds [0.99ms] (pass) reference completion during failed logout is retained without sending until edits resume [1.02ms] src/canvas/model/lifetime.test.ts: (pass) logout freezes the initiating account; failure preserves its queue; success forgets only that lifetime [0.32ms] (pass) dropping a session clears canonical drawing, placeholders and pending callbacks permanently [0.55ms] src/canvas/model/review-null.test.ts: (pass) a mixed nullable resize cannot invalidate the canonical drawing document [0.24ms] src/canvas/model/per-tab.test.ts: (pass) Hunt 1 / R1 adoption: online peers cannot overwrite or retire a live offline queue [1.10ms] (pass) R1 failed replacement / R2 unreadable source / 33+33 legacy columns: sources never retire without import confirmation [0.79ms] (pass) R2 full-history flush / R3 refused cleanup: 8192 queued intents do zero storage work [473.46ms] (pass) R2 full-history flush / R3 refused cleanup: 32768 queued intents do zero storage work [2820.32ms] (pass) R2 concurrent first tabs / failed marker / R3 missing locks: no lifetime creation or lock fallback exists [1.04ms] (pass) R2 sign-out between check/write / R3 delayed startup: teardown invalidates old callbacks before later login [0.74ms] (pass) R2 completed capture before 300 ms: unconfirmed tab loss is explicit; confirmed state restores from server [0.53ms] (pass) R2 100 snapshots and 50 ms do not establish a receipt identity or expire uncertainty [62.49ms] (pass) absent, throwing and recovered storage cannot change live edit acceptance [1.51ms] (pass) refused individual intents leave independent tabs and later edits live [0.50ms] (pass) R1 stale unresolved duplicate cannot suppress a completed same-tab birth [0.81ms] src/canvas/model/operations.test.ts: (pass) independent resize and move commute; close survives a stale move [0.55ms] (pass) right split of a stack preserves the upper band [0.21ms] (pass) reorder uses stable neighbours and emits no document [0.64ms] (pass) a completed split emits its semantic intent rather than intermediate sizing edits [0.27ms] (pass) a three-window reorder sends one semantic move [0.24ms] (pass) a split before the first reference is journalled opens its anchor before splitting [0.29ms] (pass) a drop sends the moved membership once, without derived neighbour geometry [0.35ms] (pass) a narrow right split widens first so both halves remain valid [0.36ms] (pass) a short down split grows the anchor first so both halves meet the height floor [0.47ms] src/canvas/model/queue-budget.test.ts: (pass) adjacent same-field unsent edits coalesce; sent requests retain identical identity and input [0.63ms] (pass) byte backpressure reports refusal before changing projection or silently dropping older work [0.49ms] (pass) rejected placeholder cancellation preserves the accepted birth and unresolved dependency [0.75ms] (pass) completed reference size counts toward backpressure without mutating a refused completion [0.51ms] src/canvas/model/document.test.ts: (pass) a document holds references and layout, never content [0.38ms] (pass) manual-name pins survive document serialization while old targets stay unpinned [0.37ms] (pass) a document survives JSON and rebuilds the same columns [0.50ms] (pass) a target that no longer exists is dropped, and an emptied column with it [0.17ms] (pass) parseDocument rejects anything that is not a document of this format [0.42ms] (pass) remote affinity survives reload and invalid UUIDs cannot become local references [0.32ms] (pass) a version 1 document from before D212 loads, with its split pair and a full-size window [0.37ms] (pass) a grouped view saves its spans and bands and loads back to the same grid (D212) [0.46ms] (pass) a plain view is saved without spans or bands, exactly as before D212 [0.09ms] (pass) D309: the saved weights do not depend on how a touch screen draws the columns [0.30ms] (pass) D309: a view this device pushed clear for display is saved where the layout has it [0.14ms] (pass) an offscreen graph keeps its shared pins before any nodes are rendered [0.07ms] (pass) a captured graph document is independent of the next pin drag [0.06ms] src/canvas/model/sync.test.ts: (pass) a pending session never delays other edits or waits for a network receipt [0.81ms] (pass) inventory includes shared memberships that this device cannot render [0.88ms] (pass) temporary flow windows are never treated as unsubmitted shared windows [0.18ms] src/canvas/model/review-span.test.ts: (pass) a down split shifts every column in a transitively connected group [0.27ms] src/canvas/model/reducer-property.test.ts: layout property: 32 seeds, 4096 operations, 4015 accepted, zero divergences (pass) property: accepted random operation sequences match the real server reducer [9235.23ms] src/canvas/model/session-incarnation.test.ts: (pass) reconnect original fences unsent work before the snapshot pump [1.01ms] (pass) reconnect replacement fences unsent work before the snapshot pump [0.39ms] (pass) queued work with no original binding cannot adopt a later incarnation [0.56ms] (pass) a session-incarnation change ends the old canvas and refuses later edits [0.30ms] (pass) a revoked store does not adopt a replacement account snapshot [0.10ms] (pass) R250-R3-01: a server-confirmed edit is never reported as lost on session replacement [10.38ms] (pass) a sent edit without a receipt is reported as uncertain, not lost [0.46ms] src/canvas/model/review-boundary-r2.test.ts: review r2 boundary comparison: 8 seeds, 4096 operations, 3198 accepted (pass) review r2: longer boundary-weighted sequences preserve every accepted projection [1849.82ms] src/canvas/model/reconcile.test.ts: (pass) review: removing the current shared view selects a surviving camera anchor [1.72ms] (pass) a remote negative pin and node update preserve the world position of an unchanged card [3.18ms] src/canvas/model/journal-confirmation.test.ts: (pass) hunt 2: uncertain sent edit stays hidden over a newer snapshot until its receipt [0.41ms] (pass) R1 held notification: a receipt above canonical explicitly reveals the overlay [0.27ms] (pass) R2 receiptless identity survives 100 matching snapshots without silent confirmation [6.75ms] (pass) R1 covered receipt is pruned before projecting canonical revision 3 [0.50ms] (pass) duplicate event then late refusal cannot discard independent work [0.21ms] src/canvas/model/server-store-p3-review.test.ts: (pass) review: two successive gaps coalesce while each snapshot is outstanding [1.39ms] (pass) review: a snapshot arriving after newer deltas never rolls back canonical state [0.29ms] (pass) review: outage edits wait for snapshot then send each identity once in order [1.10ms] (pass) review: a 3 s RTT fresh route stays quiet until its complete recovery budget [0.44ms] (pass) review: changed RTT reschedules the notice and successful recovery cancels future notices [0.47ms] (pass) review: recovery before the budget remains quiet across repeated drops and disposal frees timers [4.33ms] (pass) review: an edit first made while offline eventually emits the calm notice [0.48ms] (pass) review: a first-connect outage with no RTT sample cannot hide pending edits forever [0.42ms] (pass) hunt 4: slow snapshots own one watchdog; bounded retries pause offline and disposal cancels them [0.50ms] src/canvas/model/journal.test.ts: (pass) an offline birth keeps its identity through same-tab reference completion [0.43ms] src/canvas/account/words.test.ts: (pass) a value says the state, and a concern says itself > a recovery key verified recently is just "Set up"; there is no "checked N days ago" line anywhere [0.61ms] (pass) a value says the state, and a concern says itself > a recovery key that is not set up, never verified, or stale says so in its value, with the way out [0.66ms] (pass) a value says the state, and a concern says itself > passkeys: the number when there are two or more, the concern when there are fewer [0.12ms] (pass) a value says the state, and a concern says itself > a row whose fact the server cannot say yet is not drawn (the product knows only the name and the username today) [0.09ms] (pass) a value says the state, and a concern says itself > the pill's amber mark follows the values: the recovery key first, then the passkeys, and only when a value is a concern [0.42ms] (pass) a value says the state, and a concern says itself > dates [0.25ms] (pass) logs in as > the row is a chip per account with its host count, the biggest first, never more than three, then +N [1.45ms] (pass) logs in as > each tag has its own group; the biggest first, then by name; the untagged last [0.28ms] (pass) logs in as > a machine with several tags is in each of its tags' groups, once in each, and keeps all its tags [1.14ms] (pass) logs in as > no tags at all is one untagged group; no machines is none [0.08ms] (pass) the rest > numbers carry separators and a name falls back to the username [0.10ms] (pass) the rest > the pill's spoken name says the person, then Account, then what needs attention [0.10ms] (pass) the rest > email check [0.15ms] src/canvas/addhost/setup-feed.test.ts: (pass) createSetupFeed > subscribes with the host and window, then hands over events in order [0.90ms] (pass) createSetupFeed > a failure after the prompt, and a retry on the same socket [0.20ms] (pass) createSetupFeed > a dropped socket resumes after the last sequence and repeats nothing [20.66ms] (pass) createSetupFeed > a retry asked while offline is sent when the socket is back [22.04ms] (pass) createSetupFeed > a resync resets the view; an error before any event reports the status lost, after one it is ignored [0.47ms] (pass) createSetupFeed > gives up after the backoff is spent, and a release closes the socket [46.28ms] (pass) review reconnect budget survives sockets that open then close without events [46.24ms] (pass) review explicit retry resumes after the setup feed stops [46.29ms] src/canvas/addhost/wizard.breakit2.test.ts: (pass) breakit2 an explicit port on a listed host survives chip resolution [0.87ms] (pass) breakit2 malformed bracketed IPv6 waits for correction [0.15ms] (pass) listed host plus port retains its saved user in the serialized destination [0.17ms] (pass) review listed inventory name plus port retains its resolved address [0.24ms] src/canvas/addhost/setup-stages.test.ts: (pass) parseSetupEvent > reads a well-formed event [0.11ms] (pass) parseSetupEvent > drops anything malformed [0.08ms] (pass) parseSetupEvent > ignores a failed step on a non-failure and an unknown step on a failure [0.05ms] (pass) foldSetup > stages before the event's are done, later ones pending [0.17ms] (pass) foldSetup > a stage that reports done alone still finishes [0.04ms] (pass) foldSetup > ready done completes the run [0.05ms] (pass) foldSetup > a failure marks the stage its step belongs to, and a retry clears it [0.17ms] (pass) foldSetup > uploading belongs to install and the readiness check to ready [0.07ms] (pass) setupGuide > says the other sessions keep working and what to do next, in plain words [0.15ms] (pass) review malformed setup fields are dropped without coercion errors [0.13ms] (pass) exhausted setup preserves eligibility and explains a new setup [0.16ms] src/canvas/addhost/real.test.ts: (pass) parsing the server's data > a discovery row keeps only known fields and valid ids [0.42ms] (pass) parsing the server's data > the server key needs its public key and fingerprint [0.09ms] (pass) parsing the server's data > an install command needs a lifetime [0.06ms] (pass) a server that lacks an endpoint > serving the web app (200, HTML) for an unknown path is 'not available' [1.55ms] (pass) a server that lacks an endpoint > 404 discovery is an empty list; 500 discovery is an error to show [0.34ms] (pass) a server that lacks an endpoint > private sign-in stays local until a target-bound socket start [1.21ms] (pass) a server that lacks an endpoint > a wrong target consumes the reference without sending private input [0.21ms] (pass) a server that lacks an endpoint > a local reference cannot change SSH address while keeping the target id [0.20ms] (pass) a server that lacks an endpoint > closing before open discards queued sign-in even if a late open fires [0.11ms] (pass) a server that lacks an endpoint > pre-open commands stay bounded and events after close cannot revive a run [0.23ms] (pass) a server that lacks an endpoint > trust waits for the exact acknowledgement, and ignores another target [0.32ms] (pass) bootstrap failure parsing > an already-added failure keeps its existing host id [0.26ms] (pass) bootstrap failure parsing > host ids are ignored on other failures and when malformed [0.14ms] src/canvas/addhost/authority.on-demand.test.ts: (pass) CA wrapping matches the contract's HKDF domain and separates generations [0.88ms] src/canvas/addhost/model.test.ts: (pass) stagesOf > a host with no event is waiting everywhere [0.27ms] (pass) stagesOf > check before sign-in is detecting how to sign in [0.28ms] (pass) stagesOf > the sign-in report finishes detect and starts the system check [0.20ms] (pass) stagesOf > install, facts and connect map to install, enrol and first session [0.17ms] (pass) stagesOf > an auth failure before sign-in fails detect and says it in plain words, not the server's [0.31ms] (pass) stagesOf > an unsupported host fails the system check, after sign-in [0.06ms] (pass) stagesOf > an install failure fails the install stage and keeps the earlier ones done [0.09ms] (pass) stagesOf > a new attempt starts over and forgets the old sign-in [0.13ms] (pass) authLabel > names the method and a trusted network provider only [0.06ms] (pass) guideFor > installation failures never claim that incomplete cleanup succeeded [0.22ms] (pass) guideFor > each failure kind names its fix [0.08ms] (pass) guideFor > mesh-policy words say possible, not certain [0.02ms] (pass) parseTarget > reads user, host and port [0.07ms] (pass) parseTarget > reads a pasted ssh command into the same fields [0.17ms] (pass) parseTarget > reads an ssh:// address [0.07ms] (pass) parseTarget > refuses garbage around an ssh command [0.08ms] (pass) parseTarget > refuses what cannot name a host [0.03ms] (pass) parseSshConfig > reads aliases with HostName, User and Port, skipping wildcards and Match [0.43ms] (pass) parseSshConfig > recognises config text [0.06ms] (pass) parseSshConfig > a hostname that is an option is dropped [0.03ms] (pass) plain words > an unknown or missing failure gets the generic sentence, never the server's text [0.05ms] (pass) plain words > no headline carries an arrow, an id or an API noun [0.10ms] (pass) only a completed canonical host identity becomes terminal authority [0.09ms] (pass) parseTarget > accepts user@host, host, user@host:port, IPv4 and bracketed IPv6 with an optional port [0.13ms] (pass) parseTarget > rejects partial and malformed tokens, so they wait or show the hint [0.04ms] (pass) matchListed > a name that is exactly one host's id or address names that host [0.04ms] (pass) matchListed > a name that is also the start of another host's name is named but still prefixed [0.02ms] (pass) matchListed > a partial name that starts several hosts names none and waits [0.02ms] (pass) matchListed > a new name that starts no host is neither named nor waiting [0.02ms] (pass) install diagnostics name the failed step and public host error [0.06ms] (pass) missing payload tells the operator the architecture and expected server path [0.03ms] (pass) an already added host says so and offers opening its existing terminal [0.18ms] (pass) release payload verification names the architecture step and plain reason [0.02ms] (pass) leftovers pause (#169) > a check event with leftovers pauses the running attempt; the next event clears it [0.08ms] (pass) leftovers pause (#169) > a pause without leftovers offers nothing to start fresh [0.08ms] (pass) early terminal publication selects only its canonical host-bound shim session [0.07ms] src/canvas/addhost/already-added-breakit.test.ts: (pass) an already-added failure without a host id (older server) still says how to reach the terminal [0.10ms] src/canvas/addhost/wizard.test.ts: (pass) a saved-key prompt completing after close never starts an SSH attempt [0.75ms] (pass) fresh CA requires setup before any SSH attempt and preserves root consent [0.48ms] (pass) ready CA begins the requested installation mode without another prompt [0.18ms] (pass) closing during CA confirmation never starts an SSH attempt [0.44ms] (pass) a typed root login requires explicit consent before any installation [0.27ms] src/canvas/views/body.test.ts: (pass) a clean terminal exit keeps the window while host setup can still fail [0.07ms] (pass) clean exits still close ordinary windows, and failed exits stay visible [0.02ms] ../../packages/ui/src/spring.test.ts: (pass) a missed frame does not stretch a settled spring [0.53ms] (pass) motion follows elapsed time across frame rates and damping regimes [1.02ms] chunk-classes.test.ts: (pass) the first screen is critical, the canvas product module and what only it uses are deferred [1.28ms] (pass) a chunk that both sides use stays critical [0.37ms] (pass) code only an action loads is on demand, even when the lazy canvas is what loads it [0.39ms] (pass) post-terminal host inventory entry and its shared canvas imports stay deferred [0.25ms] (pass) automatic canonical painting loads after the first canvas draw [0.24ms] test/recovery-ui.test.ts: (pass) compiled recovery UI mode off obeys its URL boundary [3.45ms] (pass) compiled recovery UI mode preview obeys its URL boundary [4.13ms] (pass) compiled recovery UI mode 1 obeys its URL boundary [3.78ms] test/recovery-crypto.test.ts: (pass) HKDF siblings match independent implementation and bind unwrap to domain, account, kind and version [14.20ms] (pass) 100 repeated wrapping operations generate independent salts and nonces [21.42ms] test/recovery-rotation.test.ts: (pass) signed-in rotation sends only a local envelope and verifier after acknowledgement [9.38ms] (pass) abandoned word acknowledgement uploads nothing [5.13ms] (pass) settled acknowledgement cannot upload later (dismissed) [4.54ms] (pass) settled acknowledgement cannot upload later (no acknowledgement) [6.86ms] test/recovery-wait.test.ts: (pass) server remaining wait 0s is accepted through the capability policy maximum [1.97ms] (pass) server remaining wait 86400s is accepted through the capability policy maximum [2.52ms] (pass) server remaining wait 90000s is accepted through the capability policy maximum [2.48ms] (pass) server remaining wait 172800s is accepted through the capability policy maximum [2.40ms] (pass) malformed or excessive remaining wait -1 is denied [1.77ms] (pass) malformed or excessive remaining wait 0.5 is denied [1.01ms] (pass) malformed or excessive remaining wait 172801 is denied [0.90ms] (pass) malformed or excessive remaining wait 9007199254740992 is denied [1.45ms] (pass) malformed or excessive remaining wait 90000 is denied [1.06ms] test/link-doubt.test.ts: (pass) a link doubt shows the indicator and keeps live replies and typing flowing [1.61ms] (pass) recovery clears only its own indicator, and a real reconnect still owns the replay [0.36ms] (pass) a notice type from a newer server is ignored, not a protocol failure [0.08ms] (pass) the viewer announces the link-doubt capability in its Hello [2.31ms] test/close-reasons.test.ts: (pass) every reason the server and the agent send maps to a plain sentence, and unknown ones fall back [0.21ms] src/close-reasons.test.ts: (pass) a missed connection response keeps a plain and stable reason [0.02ms] (pass) server and host close reasons identify why a terminal reconnects, in plain words [0.21ms] (pass) routine detach and connection rotation reasons stay neutral [0.02ms] (pass) a stream close that reattaches never says the terminal ended [0.10ms] (pass) a recovering server link names its cause as routine status, never as a failure [0.03ms] (pass) unknown close text is discarded instead of reaching the person or console [0.05ms] (pass) a storm of closes prints one line per minute and counts the rest [0.39ms] (pass) counted closes are reported when their window ends, without another close [0.04ms] src/review-close-log.test.ts: (pass) a reconnect the server refuses with a named Close frame still prints its console line [1.32ms] (pass) a close summary does not claim closes from hours ago happened in the previous 60 s [0.05ms] src/onboarding-load.test.ts: (pass) a failed load says so in the error line, offers Try again, and mounts nothing [5.49ms] (pass) the Try again button reloads the page: a failed import stays failed in the module map [5.43ms] (pass) the online event retries by itself [5.27ms] 472 pass 0 fail 22458 expect() calls Ran 472 tests across 79 files. [23.69s] bun test v1.4.2 (744846f84) src/connection-correlation-review.test.ts: Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) Pongs with a matching nonce and a different timestamp cannot retain readiness [9.26ms] src/connection-idle.test.ts: Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) healthy idle probes back off independently of 1 streams at RTT 1 [4.55ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) healthy idle probes back off independently of 28 streams at RTT 1 [3.16ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) healthy idle probes back off independently of 1 streams at RTT 150 [1.22ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) healthy idle probes back off independently of 28 streams at RTT 150 [0.92ms] (pass) unacknowledged input keeps probes fast until the matching stream acknowledges it [4.73ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 0 at RTT 1 [1.28ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 7 at RTT 1 [1.07ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 20 at RTT 1 [1.03ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 39 at RTT 1 [1.11ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 0 at RTT 30 [0.95ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 7 at RTT 30 [0.61ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 20 at RTT 30 [0.57ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 39 at RTT 30 [0.65ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 0 at RTT 150 [0.54ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 7 at RTT 150 [0.35ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 20 at RTT 150 [0.46ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) idle silence deadline survives probe phase 39 at RTT 150 [0.47ms] (pass) retransmitting an earlier input range cannot forget a later unacknowledged byte [2.02ms] (pass) a delayed first timer starts unknown-RTT grace when its first probe is issued [3.34ms] (pass) a healthy idle route tolerates a 20ms RTT step at 1 streams without consuming its scheduling allowance before probing [1.24ms] (pass) a healthy idle route tolerates a 20ms RTT step at 28 streams without consuming its scheduling allowance before probing [1.23ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a late timer on a fully answered route preserves its reply allowance across 1 streams [0.77ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a late timer on a fully answered route preserves its reply allowance across 28 streams [1.28ms] (pass) a healthy browser route survives 150ms scheduler delay across 1 streams [1.56ms] (pass) a healthy browser route survives 150ms scheduler delay across 28 streams [1.70ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a quiet dead browser peer is detected within two 250ms allowances plus one probe interval [1.31ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) browser jitter allowance decays after a stable link returns [8.58ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a queued healthy reply survives a 150ms browser event-loop stall with reply first [1.24ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a queued healthy reply survives a 1000ms browser event-loop stall with reply first [1.41ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a queued healthy reply survives a 60000ms browser event-loop stall with reply first [1.00ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a queued healthy reply survives a 150ms browser event-loop stall with timer first [3.18ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a queued healthy reply survives a 1000ms browser event-loop stall with timer first [1.19ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a queued healthy reply survives a 60000ms browser event-loop stall with timer first [1.67ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a late timer without a reply counts subsequent responsive silence [1.38ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) an outstanding probe gets responsive observation after a renderer stall [6.71ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) retirement gives a queued mismatched pong one task turn [1.10ms] (pass) retirement gives a queued correlated pong one task turn [1.36ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a dead typing route eventually retires when browser tasks run every 75ms [1.70ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a dead idle route eventually retires when browser tasks run every 1000ms [0.84ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a dead idle route eventually retires when browser tasks run every 60000ms [1.00ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) dead-route stall grace is bounded by two allowances and three 75ms task gaps [1.04ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) dead-route stall grace is bounded by two allowances and three 1000ms task gaps [1.39ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) dead-route stall grace is bounded by two allowances and three 60000ms task gaps [1.37ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) correlated queued replies replenish stall grace across successive healthy stalls [1.06ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) duplicate replies cannot replenish consumed stall grace [0.81ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) wrong timestamp replies cannot replenish consumed stall grace [0.60ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) unknown nonce replies cannot replenish consumed stall grace [0.65ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a queued correlated reply cancels confirmation without letting a duplicate renew it [1.37ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 1 (pass) a replacement route receives its own one-shot local stall grace [1.38ms] Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) continuous typing cannot cancel every silent-route confirmation turn [1.26ms] (pass) a pending confirmation is reset by reconnect [1.37ms] Connection to the server closed after the connection was established: closed by the server, code 1001, reason "other", reconnect attempt 0 (pass) a pending confirmation is reset by close [1.14ms] (pass) a pending confirmation is reset by dispose [1.04ms] (pass) a stale confirmation from before reconnect cannot close the replacement route [2.22ms] (pass) a hidden page resumes its lease after 5000ms without retiring queued replies [2.24ms] (pass) a hidden page resumes its lease after 30000ms without retiring queued replies [1.63ms] (pass) a socket lost while hidden waits for visibility before reconnecting [1.95ms] (pass) mobile jitter and one retransmission keep a foreground browser lease [60.01ms] (pass) visibility notices require both peers to support them: false [0.63ms] (pass) visibility notices require both peers to support them: true [0.32ms] (pass) hiding a page cancels a retry scheduled while it was visible [1.01ms] (pass) review: queued replies cannot retire a restored hidden page when visibility dispatch precedes replies: true [1.09ms] (pass) review: queued replies cannot retire a restored hidden page when visibility dispatch precedes replies: false [1.11ms] (pass) a layout subscription starts the connection before any terminal exists [0.43ms] (pass) resync replaces one subscription ID and disposal prevents later resyncs [1.03ms] (pass) resync reopens a feature subscription with the same server ID [0.36ms] src/connection-layout-removal.test.ts: Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) a reconnect snapshot removing the current view sends no unbound Close and moves its camera [15.12ms] src/connection-layout-session-capability.test.ts: (pass) layout session incarnation uses Hello capability bit 4 [0.05ms] src/connection-liveness.test.ts: Connection to the server closed after the connection was established: closed by this page, code 4000, reason "connection unresponsive", reconnect attempt 0 (pass) a retained unresponsive route loses readiness, resumes automatically and ignores its late events [2.19ms] src/connection-pool.test.ts: (pass) terminals fill the first socket, then open another, and a released slot is reused first [0.65ms] (pass) 54 windows need two sockets, and the pool stops opening sockets at its cap [0.66ms] src/connection-probe-scheduling-review.test.ts: (pass) a fully answered browser route survives a delayed next probe before a terminal attaches [0.96ms] (pass) a fully answered browser route survives a delayed next probe with an attachment [0.39ms] src/connection-query-capabilities.test.ts: (pass) query replies negotiate independently with Hello caps 0 [0.09ms] (pass) query replies negotiate independently with Hello caps 4 (pass) query replies negotiate independently with Hello caps 8 (pass) query replies negotiate independently with Hello caps 12 src/connection-query-refusal.test.ts: Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) pending query stays reply-marked through refusal and explicit resend (previously sent: false) [13.64ms] Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) pending query stays reply-marked through refusal and explicit resend (previously sent: true) [3.75ms] src/connection-restart.test.ts: Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 Connection to the server closed before the connection was established (reconnect failed): closed by the server or network, code 0, reason "none", reconnect attempt 1 (pass) an overnight connection retains its writer and pending input when the server restarts [0.84ms] Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) a second quick server close leaves the fast path and backs off [0.74ms] Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) a failed first recovery handshake exits the one quick retry [0.52ms] Connection to the server closed after the connection was established: closed by the server, code 1011, reason "connection ended", reconnect attempt 0 (pass) a server close reason survives socket retirement and the next retry [0.53ms] Connection to the server closed after the connection was established: closed by the server or network, code 1005, reason "none", reconnect attempt 0 (pass) a clean server socket close keeps its fallback reason through the next retry [0.43ms] Connection to the server closed after the connection was established: closed by the server or network, code 1006, reason "none", reconnect attempt 0 (pass) a prolonged outage inside the fast-recovery window does not leave recovery behind accumulated backoff [9.66ms] Connection to the server closed after the connection was established: closed by the server or network, code 1006, reason "none", reconnect attempt 0 (pass) online and foreground events cancel delays and preserve handshakes in progress [1.52ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1 (pass) refused handshakes keep growing backoff (online: true, new hint: false, resume first: true) [0.64ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0 (pass) refused handshakes keep growing backoff (online: true, new hint: false, resume first: false) [0.24ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1 (pass) refused handshakes keep growing backoff (online: true, new hint: true, resume first: true) [0.21ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0 (pass) refused handshakes keep growing backoff (online: true, new hint: true, resume first: false) [0.15ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1 (pass) refused handshakes keep growing backoff (online: false, new hint: false, resume first: true) [0.17ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0 (pass) refused handshakes keep growing backoff (online: false, new hint: false, resume first: false) [0.13ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 1 (pass) refused handshakes keep growing backoff (online: false, new hint: true, resume first: true) [0.23ms] Connection to the server closed before the connection was established (reconnect failed): closed by the server, code 1008, reason "the server refused to resume the connection", reconnect attempt 0 (pass) refused handshakes keep growing backoff (online: false, new hint: true, resume first: false) [0.14ms] src/connection-review-refusal-input.test.ts: Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) review: refusal fallback preserves typing through explicit resend (previously sent: false) [1.99ms] Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) review: refusal fallback preserves typing through explicit resend (previously sent: true) [0.90ms] src/connection-review-retained-lifetime.test.ts: (pass) review: saved typing can be declined without closing the live shell [0.83ms] (pass) review: new typing reaches the fresh shell while saved typing stays pending [0.25ms] (pass) review: retained input and consent are local to their terminal window [0.15ms] (pass) review: selecting a different session removes saved typing and its action [0.13ms] (pass) review: another refused writer retains pending and unacknowledged fresh typing [0.14ms] (pass) review: window disposal clears held input and rejects a stale resend action [0.35ms] src/connection-startup-review.test.ts: (pass) a healthy startup route can learn an RTT above the initial estimate [3.62ms] src/connection-unattached-close.test.ts: (pass) disposing a window before its welcome microtask sends no unbound Close [1.63ms] Connection to the server closed after the connection was established: closed by the server or network, code 0, reason "none", reconnect attempt 0 (pass) review #250: disposing a previously attached window during reconnect sends no unbound Close [1.20ms] 106 pass 0 fail 414 expect() calls Ran 106 tests across 14 files. [289.00ms] bun test v1.4.2 (744846f84) src/terminal-queries.test.ts: (pass) query identity survives split writes and tracks nested ESC independently of a cancelled string [0.55ms] (pass) all requested query families have identities [0.14ms] (pass) every split preserves one identity and oversized strings retain nested boundaries without retaining their contents [1.81ms] (pass) oversized OSC retains BEL termination before a later query [0.12ms] src/terminal-query-property.test.ts: [ghostty-vt] warning(stream): invalid device status report command: ESC [ ? { 6 } n [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x11 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 [ghostty-vt] warning(stream): invalid C0 character, ignoring: 0x13 QUERY_PROPERTY forms=30 splits=515 viewers=3 accepted=1 duplicates=2 (pass) every renderer-answered form produces exactly one admitted reply for every split with three viewers [275.86ms] src/terminal-query-renderer-review.test.ts: (pass) review: DECID gives every real renderer response an identity [0.98ms] (pass) review: zero-padded CPR gives every real renderer response an identity [0.34ms] (pass) review: CPR with an ignored NUL gives every real renderer response an identity [0.27ms] (pass) review: three adjacent requests keep distinct identities across different viewer chunking [7.24ms] src/terminal-write-slices.test.ts: (pass) every slice split preserves cells, cursor and all renderer answers [41.59ms] (pass) invalid or incomplete ranges never feed unexpected bytes and leave later writes usable [1.50ms] (pass) escaped writers cannot access released input and callback failure releases the scope [0.93ms] (pass) nested writes and memory growth cannot replace borrowed input [0.66ms] (pass) allocation refusal never writes or frees unowned memory [1.19ms] (pass) empty scopes accept no input and reject later writer use [0.29ms] (pass) input views of native memory survive allocation-driven memory growth [0.39ms] (pass) throwing callbacks release exactly their owned input allocation [0.26ms] 17 pass 0 fail 1794 expect() calls Ran 17 tests across 4 files. [372.00ms] $ bun run build.ts built chunk-hxpqht5z.js, chunk-sc6q4mh2.js, chunk-qkef0g3b.js, chunk-q05myav6.js, chunk-3vz1mvs1.js, chunk-11vqggk9.js, chunk-edqwfpnb.js, chunk-ym90k1dc.js, chunk-a4sk9ck5.js, chunk-ad4qcdh2.js, chunk-n364d0ma.js, chunk-yvq3ah6x.js, chunk-1aev03z9.js, chunk-15bmrhs0.js, chunk-gxvqf3b8.js, chunk-rbh9y7dh.js, chunk-wxtkdvd9.js, chunk-79ryj47h.js, chunk-xtff5f2v.js, chunk-dptcm9dj.js, chunk-e6rx2mjb.js, main.js, chunk-y8w1vzb3.js, chunk-byrpr9mk.js, chunk-4khf8srr.js, chunk-s2vtkxac.js, chunk-46haed2c.js, chunk-g5vca3ey.js, chunk-7nf9g69c.js, chunk-1ta1akps.js, chunk-td9zyz2d.js, chunk-c76h7v56.js, chunk-cbtr2v7m.js, chunk-cm4mv3wz.js, chunk-4t4fzqr3.js, chunk-rpe3vnng.js, chunk-4nrybnaf.js, chunk-h73njt5c.js, chunk-6kfk0v04.js, chunk-4z8s7vkw.js, chunk-ykr0srn0.js, chunk-x98514ar.js, chunk-9rqwp0sh.js, chunk-cn2xs6xv.js, chunk-pgnq38aj.js, chunk-axbkkqp1.js, chunk-62z9d7sf.js, chunk-fxcx7qaa.js, chunk-7q0wa2ty.js, chunk-ary2pa1y.js, chunk-ttd19hwy.js, chunk-2z38rs5p.js, chunk-x8bjsqvz.js, chunk-ybppz2g8.js, chunk-ywfra562.js, chunk-2m0ba5b7.js, chunk-z48tcwe1.js, chunk-vkabh9k4.js, chunk-jk5xheq9.js, chunk-ga7n3p96.js, chunk-1nbd1b7y.js, chunk-evavfw3s.js, chunk-kw785vsh.js, chunk-681097qe.js, chunk-k90t0egs.js, chunk-ewet4ggg.js, chunk-esk6ttbc.js, chunk-gvddkj3j.js, chunk-exbzms9n.js, chunk-mz1hmdma.js, chunk-6hphcpbw.js, chunk-mmvf4v8e.js, offline.worker.js, backdrop.worker.js, faulty-terminal.worker.js, chunk-hn5022gg.js, chunk-6fyye8s6.js, chunk-ff3nvh2r.js, chunk-qpck7njq.js onDemand chunk-62z9d7sf.js: identity=10904 gzip=4428 brotli=4034 bytes onDemand chunk-pgnq38aj.js: identity=1026 gzip=622 brotli=498 bytes onDemand chunk-ykr0srn0.js: identity=5029 gzip=2046 brotli=1808 bytes onDemand chunk-2z38rs5p.js: identity=1170 gzip=708 brotli=590 bytes critical chunk-c76h7v56.js: identity=52 gzip=52 brotli=52 bytes critical chunk-exbzms9n.js: identity=39 gzip=39 brotli=39 bytes onDemand chunk-z48tcwe1.js: identity=601 gzip=344 brotli=326 bytes onDemand chunk-cn2xs6xv.js: identity=11126 gzip=4260 brotli=3891 bytes critical chunk-wxtkdvd9.js: identity=6313 gzip=2675 brotli=2345 bytes onDemand chunk-rpe3vnng.js: identity=4594 gzip=2014 brotli=1787 bytes onDemand chunk-vkabh9k4.js: identity=1408 gzip=713 brotli=665 bytes onDemand chunk-3vz1mvs1.js: identity=6503 gzip=2412 brotli=2149 bytes onDemand chunk-ary2pa1y.js: identity=33394 gzip=12808 brotli=11519 bytes deferred chunk-td9zyz2d.js: identity=131938 gzip=44406 brotli=38959 bytes onDemand chunk-7nf9g69c.js: identity=2557 gzip=1179 brotli=1009 bytes critical chunk-byrpr9mk.js: identity=1106 gzip=665 brotli=602 bytes critical faulty-terminal.worker.js: identity=1086 gzip=559 brotli=481 bytes critical backdrop.worker.js: identity=243 gzip=211 brotli=161 bytes onDemand chunk-7q0wa2ty.js: identity=6744 gzip=3164 brotli=2876 bytes onDemand chunk-4nrybnaf.js: identity=2007 gzip=1006 brotli=856 bytes onDemand chunk-x98514ar.js: identity=7662 gzip=3397 brotli=2972 bytes onDemand chunk-11vqggk9.js: identity=5812 gzip=2382 brotli=2167 bytes critical chunk-hxpqht5z.js: identity=2973 gzip=1341 brotli=1213 bytes onDemand chunk-2m0ba5b7.js: identity=5359 gzip=2575 brotli=2302 bytes critical chunk-y8w1vzb3.js: identity=5448 gzip=2607 brotli=2373 bytes deferred offline.worker.js: identity=1340 gzip=682 brotli=591 bytes critical chunk-esk6ttbc.js: identity=42924 gzip=14638 brotli=13113 bytes onDemand chunk-ybppz2g8.js: identity=540 gzip=353 brotli=314 bytes critical chunk-axbkkqp1.js: identity=90 gzip=90 brotli=78 bytes critical chunk-6fyye8s6.js: identity=9894 gzip=4051 brotli=3493 bytes onDemand chunk-yvq3ah6x.js: identity=2108 gzip=1038 brotli=870 bytes critical chunk-15bmrhs0.js: identity=707 gzip=365 brotli=308 bytes onDemand chunk-1nbd1b7y.js: identity=3109 gzip=1381 brotli=1220 bytes critical chunk-dptcm9dj.js: identity=13242 gzip=5131 brotli=4568 bytes onDemand chunk-hn5022gg.js: identity=9158 gzip=3336 brotli=2888 bytes onDemand chunk-4z8s7vkw.js: identity=10172 gzip=3970 brotli=3570 bytes critical chunk-1ta1akps.js: identity=2225 gzip=1090 brotli=923 bytes critical chunk-4khf8srr.js: identity=8377 gzip=3575 brotli=3187 bytes critical chunk-ff3nvh2r.js: identity=167 gzip=134 brotli=112 bytes onDemand chunk-edqwfpnb.js: identity=1997 gzip=854 brotli=733 bytes onDemand chunk-ym90k1dc.js: identity=3891 gzip=1737 brotli=1500 bytes onDemand chunk-q05myav6.js: identity=191 gzip=167 brotli=130 bytes critical chunk-e6rx2mjb.js: identity=386 gzip=237 brotli=195 bytes onDemand chunk-k90t0egs.js: identity=198 gzip=168 brotli=141 bytes onDemand chunk-cm4mv3wz.js: identity=6148 gzip=2783 brotli=2508 bytes deferred chunk-h73njt5c.js: identity=1537 gzip=800 brotli=723 bytes critical chunk-xtff5f2v.js: identity=2155 gzip=993 brotli=839 bytes critical chunk-79ryj47h.js: identity=15773 gzip=5658 brotli=5024 bytes critical chunk-sc6q4mh2.js: identity=35411 gzip=10323 brotli=9272 bytes onDemand chunk-qpck7njq.js: identity=1063 gzip=652 brotli=521 bytes critical chunk-fxcx7qaa.js: identity=730021 gzip=210599 brotli=171103 bytes onDemand chunk-6hphcpbw.js: identity=869 gzip=346 brotli=323 bytes onDemand chunk-x8bjsqvz.js: identity=1649 gzip=776 brotli=675 bytes critical chunk-mz1hmdma.js: identity=49 gzip=49 brotli=49 bytes onDemand chunk-mmvf4v8e.js: identity=2723 gzip=1328 brotli=1142 bytes onDemand chunk-qkef0g3b.js: identity=228 gzip=178 brotli=159 bytes critical chunk-s2vtkxac.js: identity=1734 gzip=840 brotli=679 bytes critical chunk-ewet4ggg.js: identity=199 gzip=164 brotli=139 bytes onDemand chunk-evavfw3s.js: identity=49348 gzip=15461 brotli=13806 bytes onDemand chunk-6kfk0v04.js: identity=13500 gzip=5380 brotli=4796 bytes critical chunk-g5vca3ey.js: identity=1188 gzip=690 brotli=590 bytes critical chunk-681097qe.js: identity=162 gzip=151 brotli=124 bytes deferred chunk-1aev03z9.js: identity=40754 gzip=14866 brotli=13304 bytes onDemand chunk-rbh9y7dh.js: identity=4612 gzip=1788 brotli=1592 bytes onDemand chunk-kw785vsh.js: identity=7011 gzip=3107 brotli=2818 bytes onDemand chunk-ad4qcdh2.js: identity=2420 gzip=1196 brotli=1079 bytes critical chunk-a4sk9ck5.js: identity=5890 gzip=2461 brotli=2137 bytes critical chunk-gxvqf3b8.js: identity=88 gzip=88 brotli=76 bytes onDemand chunk-cbtr2v7m.js: identity=1691 gzip=872 brotli=746 bytes critical main.js: identity=105728 gzip=38897 brotli=33660 bytes onDemand chunk-4t4fzqr3.js: identity=2824 gzip=1386 brotli=1193 bytes onDemand chunk-ttd19hwy.js: identity=2565 gzip=1149 brotli=978 bytes critical chunk-46haed2c.js: identity=2693 gzip=1202 brotli=1036 bytes onDemand chunk-n364d0ma.js: identity=6476 gzip=2179 brotli=1935 bytes onDemand chunk-jk5xheq9.js: identity=724 gzip=403 brotli=361 bytes critical chunk-gvddkj3j.js: identity=39 gzip=39 brotli=39 bytes onDemand chunk-ywfra562.js: identity=11562 gzip=4696 brotli=4283 bytes onDemand chunk-9rqwp0sh.js: identity=14549 gzip=5411 brotli=4867 bytes onDemand chunk-ga7n3p96.js: identity=572 gzip=329 brotli=309 bytes JavaScript transfer, critical: identity=996402 gzip=309614/327680 brotli=258010/273408 bytes JavaScript transfer, deferred: identity=175569 gzip=60754/61440 brotli=53577/55296 bytes JavaScript transfer, onDemand: identity=267794 gzip=106482/20480 brotli=94906/18432 bytes JavaScript transfer, onDemand largest chunk chunk-evavfw3s.js: gzip=15461/20480 brotli=13806/18432 bytes (class total gzip=106482 brotli=94906, not limited) fonts/monaspace-neon/italic.latin.woff2: identity=44324 gzip=44324 brotli=44324 bytes fonts/monaspace-neon/roman.latin.woff2: identity=40016 gzip=40016 brotli=40016 bytes fonts/jetbrains-mono/italic.latin.woff2: identity=36316 gzip=36316 brotli=36316 bytes fonts/jetbrains-mono/roman.latin.woff2: identity=34068 gzip=34068 brotli=34068 bytes fonts/source-code-pro/italic.latin.woff2: identity=23612 gzip=23612 brotli=23612 bytes fonts/source-code-pro/roman.latin.woff2: identity=22872 gzip=22872 brotli=22872 bytes fonts/geist-mono/italic.latin.woff2: identity=21380 gzip=21380 brotli=21380 bytes fonts/geist-mono/roman.latin.woff2: identity=19984 gzip=19984 brotli=19981 bytes fonts/ibm-plex-mono/italic.latin.woff2: identity=22296 gzip=22296 brotli=22296 bytes fonts/ibm-plex-mono/roman.latin.woff2: identity=19048 gzip=19048 brotli=19047 bytes fonts/cascadia-code/italic.latin.woff2: identity=44404 gzip=44404 brotli=44404 bytes fonts/cascadia-code/roman.latin.woff2: identity=40604 gzip=40604 brotli=40604 bytes fonts/maple-mono-nf/italic.latin.woff2: identity=53444 gzip=53444 brotli=53444 bytes fonts/maple-mono-nf/roman.latin.woff2: identity=46432 gzip=46432 brotli=46432 bytes fonts/nerd-symbols.woff2: identity=223748 gzip=223748 brotli=223748 bytes fonts/fira-code/roman.latin.woff2: identity=36756 gzip=36756 brotli=36756 bytes fonts/commit-mono/italic-400.latin.woff2: identity=18716 gzip=18716 brotli=18716 bytes fonts/commit-mono/italic-700.latin.woff2: identity=18352 gzip=18352 brotli=18352 bytes fonts/commit-mono/roman-400.latin.woff2: identity=17484 gzip=17484 brotli=17484 bytes fonts/commit-mono/roman-700.latin.woff2: identity=17260 gzip=17260 brotli=17260 bytes Font transfer: monaspace-neon=84340/88064 jetbrains-mono=70384/75776 source-code-pro=46484/49152 geist-mono=41364/45056 ibm-plex-mono=41344/45056 cascadia-code=85008/88064 maple-mono-nf=99876/106496 (critical 46432/51200) symbols=223748/235520 fira-code=36756/40960 commit-mono=71812/75776 bytes ==> Rust stream oracle (for the differential test) ==> TypeScript protocol tests bun test v1.4.2 (744846f84) src/mesh-review-revocation.test.ts: (pass) review forbidden event cancels pending snapshot publication [5.68ms] (pass) subscription forbidden ends delivery before a late refresh rejection [1.33ms] (pass) subscription not found ends delivery before a late refresh rejection [1.27ms] (pass) subscription invalid input ends delivery before a late refresh rejection [1.18ms] (pass) subscription mesh unavailable ends delivery before a late refresh rejection [1.14ms] (pass) synchronous subscription refusal releases the transport exactly once [0.12ms] src/codec.test.ts: (pass) wire protocol golden vectors > encodes and decodes each frame exactly as the shared manifest describes [12.32ms] (pass) wire protocol golden vectors > returns borrowed payload views and writes into reusable buffers [0.21ms] (pass) wire protocol golden vectors > decodes muxed messages split across WebSocket messages [0.82ms] (pass) wire protocol golden vectors > rejects oversized, non-canonical, unknown, and malformed frame bytes [0.12ms] (pass) split mux header preserves trailing Close [0.23ms] (pass) reply-marked Input uses an additive bounded layout without changing legacy input [0.72ms] (pass) empty marked input reports the stable invalid-body decoder failure [0.14ms] src/mesh-review-paged-error.test.ts: (pass) review earlier snapshot continuation failure cannot replace a newer complete refresh [2.74ms] (pass) review earlier snapshot continuation cannot overwrite a delivered revision [2.70ms] (pass) a newer paged event owns publication before an earlier refresh resumes [2.62ms] src/mesh-review-refresh.test.ts: (pass) review superseded refresh failure cannot replace authoritative resync [1.57ms] (pass) superseded failure preserves a newer pending refresh [2.73ms] src/stream.test.ts: stream differential: 169 streams, 19929 schedules, zero divergences (pass) Rust and TypeScript preserve every frame at all boundaries and random multi-splits [6906.75ms] (pass) maximum frame size and fragmented oversized prefix obey the allocation boundary [8.04ms] src/mesh.test.ts: (pass) Mesh actions map to their typed action IDs and JSON inputs [1.44ms] (pass) Mesh watch coalesces change bursts and never publishes an older revision [3.93ms] (pass) Mesh watch forwards server errors and stops delivering after unsubscribe [0.09ms] (pass) Mesh enrollment carries an explicit authenticated host binding [0.18ms] src/mesh-review-continuation.test.ts: (pass) review continuation stops after stop [1.31ms] (pass) review continuation stops after forbidden [1.16ms] (pass) review continuation stops after superseded [1.17ms] src/mesh-pagination.test.ts: (pass) list assembles bounded pages using the same filter [0.25ms] (pass) a changed revision discards earlier pages before assembling its restart [0.11ms] (pass) malformed continuation is refused: {"revision":1,"offset":0} [0.13ms] (pass) malformed continuation is refused: {"revision":2,"offset":1} [0.02ms] (pass) malformed continuation is refused: {"revision":1,"offset":2} [0.01ms] (pass) watch never publishes a partial page; withdrawn=false [1.33ms] (pass) watch never publishes a partial page; withdrawn=true [1.13ms] (pass) a superseding equal-revision resync wins over pending page assembly [1.47ms] src/mesh-review-resync.test.ts: (pass) review watch applies same-revision authoritative resync [0.18ms] (pass) authoritative resync keeps priority over an equal-revision pending list [1.39ms] src/mesh-vectors.test.ts: (pass) every shared Mesh action vector passes through the typed client unchanged [0.84ms] (pass) shared Mesh event vectors drive the typed watch adapter [5.45ms] 39 pass 0 fail 59970 expect() calls Ran 39 tests across 10 files. [7.01s] ``` </details>
kayg commented 2026-11-01 20:51:59 +00:00
Author
Owner
Copy link

J12b matched production static size receipt, exact head fa875f0b3733ef997b6299d55478b90173b4286b versus dev 65d9861914e8cd4a734d533d64ed1f4ea5c34119. Both controls built sequentially in the same acquired compute01 slot, same pinned recipe/profile/default release identity and target, with release stamps and staging key unset. Both architectures passed production-trust checks and had no PT_INTERP.

  • x86_64: dev 21,642,416 B; head 22,534,600 B; delta +892,184 B.
  • aarch64: dev 19,794,088 B; head 20,589,768 B; delta +795,680 B.

PAIRED_STATIC_SIZES_EXIT=0. These are whole-branch costs, not attributed helper costs or runtime performance measurements. Raw receipts and image hashes will be attached with the functional proof log. VM worktree restored to exact head before the staging build.

J12b matched production static size receipt, exact head `fa875f0b3733ef997b6299d55478b90173b4286b` versus dev `65d9861914e8cd4a734d533d64ed1f4ea5c34119`. Both controls built sequentially in the same acquired compute01 slot, same pinned recipe/profile/default release identity and target, with release stamps and staging key unset. Both architectures passed production-trust checks and had no PT_INTERP. - x86_64: dev 21,642,416 B; head 22,534,600 B; delta +892,184 B. - aarch64: dev 19,794,088 B; head 20,589,768 B; delta +795,680 B. `PAIRED_STATIC_SIZES_EXIT=0`. These are whole-branch costs, not attributed helper costs or runtime performance measurements. Raw receipts and image hashes will be attached with the functional proof log. VM worktree restored to exact head before the staging build.
kayg commented 2026-11-01 20:57:31 +00:00
Author
Owner
Copy link

J12b qualification blocker on compute01, head fa875f0b3733ef997b6299d55478b90173b4286b: each of the exact-head systemd, bounded-storage and updater proof runners was refused before execution by sudo -n: sudo: a password is required. sudo -n -l is refused too; current uid is claude/1500. This is NOT a failing product assertion and NOT a passed proof. No root unit/mount was created by these invocations. Noninteractive approved root execution is needed from the orchestrator for the existing disposable runners. No credentials requested in chat, no privilege workaround attempted.

Exact-head fast is already green and quoted in full above; matched static controls passed. The same acquired lease is preparing the signed public offline perf kits. I will preserve the three refusal receipts, finish the kit validation, release the lease and delete only J12b target unless the orchestrator supplies an approved root path during packaging. Existing historical systemd results do not qualify this final head.

J12b qualification blocker on compute01, head `fa875f0b3733ef997b6299d55478b90173b4286b`: each of the exact-head systemd, bounded-storage and updater proof runners was refused before execution by `sudo -n`: `sudo: a password is required`. `sudo -n -l` is refused too; current uid is claude/1500. This is NOT a failing product assertion and NOT a passed proof. No root unit/mount was created by these invocations. Noninteractive approved root execution is needed from the orchestrator for the existing disposable runners. No credentials requested in chat, no privilege workaround attempted. Exact-head fast is already green and quoted in full above; matched static controls passed. The same acquired lease is preparing the signed public offline perf kits. I will preserve the three refusal receipts, finish the kit validation, release the lease and delete only J12b target unless the orchestrator supplies an approved root path during packaging. Existing historical systemd results do not qualify this final head.
kayg commented 2026-11-01 21:09:50 +00:00
Author
Owner
Copy link

J12b implementation handoff. Branch j12b-edge-update, pushed head fa875f0b3733ef997b6299d55478b90173b4286b; rebased base 65d9861914e8cd4a734d533d64ed1f4ea5c34119. Control and VM source worktrees are clean. No deployment, signer deployment, perf VM contact, shared-machine reboot or power cut.

Implemented the remaining host lifecycle integration and recovery/publication/adoption fences, connected the version pill/Updates row to authenticated backend calls/events/paginated inventory, and repaired inherited/current-dev integration regressions with observed failing tests first. Atomic commits and slice receipts are recorded above. No new foundational engine selected.

Exact-head scripts/verify fast: EXIT 0. Full 537611-byte output is quoted verbatim in the preceding complete-gate comment and attached: https://git.kayg.org/attachments/a2362ca4-98dd-42dd-901e-dd596b822802 . Every Rust gate row PASS; server library 740 passed/0 failed/55 ignored. Final verbatim output:

 39 pass
 0 fail
 59970 expect() calls
Ran 39 tests across 10 files. [7.01s]

Matched same-machine, recipe/profile/release-identity production static controls against the rebased dev:

  • x86_64: 21,642,416 → 22,534,600 B, +892,184 B.
  • aarch64: 19,794,088 → 20,589,768 B, +795,680 B.
    Both production trust checks passed; neither image has PT_INTERP. Whole-branch costs, no per-helper attribution or runtime performance claim.

Evidence index attached as EVIDENCE.json (30790), raw paired-build/proof/kit log attached (30791). Seven exact-head offline kits passed hash/script validation: updates, transport128, reconnect, retention, deploy, latency, inventory. On compute01: /home/claude/.cache/j12b-evidence/perf-<case>-fa875f0b3733ef997b6299d55478b90173b4286b. measurements_performed=false; inventory measures128 durable rows/observations, not128 running daemons. Signed system proof bundles, staging image and pinned storage fixture remain in the same evidence directory outside the deleted target.

Qualification is incomplete: all three exact-head systemd/storage/updater runners were refused before execution with sudo: a password is required. Zero cases counted as passed. PROOFS_EXIT=1 / J12B_FINAL_RUN_EXIT=1 preserve that blocker. Approved root execution is required for those existing runners. Enrolled-host signed-upgrade E2E, perf measurements, full power-cut/reboot/resource-refusal matrix and independent visual review also remain pending. Earlier UI production-browser tests passed15/15 with attached desktop/phone screenshots, but use mock protocol replies and are not real backend E2E evidence.

How to test:

  1. Run the existing exact-head generation-proof, generation-storage-proof and generation-updater-proof with the retained bundles under approved root execution on the assigned VM.
  2. Have the orchestrator run the prepared kits through the pinned perf-run guard; perform the isolated-machine failure matrix separately.
  3. In an approved preview, open the version pill and Updates, request a check, and compare displayed server/host versions with authenticated backend observations; review the attached phone/desktop captures independently.

Cleanup: acquired build lease and runner exited; own compute01 target deleted and ARM Rust target absent; no remaining own build/test/browser process or bounded mount. Evidence retained outside checkout. Issue remains open for qualification and independent review.

J12b implementation handoff. Branch `j12b-edge-update`, pushed head `fa875f0b3733ef997b6299d55478b90173b4286b`; rebased base `65d9861914e8cd4a734d533d64ed1f4ea5c34119`. Control and VM source worktrees are clean. No deployment, signer deployment, perf VM contact, shared-machine reboot or power cut. Implemented the remaining host lifecycle integration and recovery/publication/adoption fences, connected the version pill/Updates row to authenticated backend calls/events/paginated inventory, and repaired inherited/current-dev integration regressions with observed failing tests first. Atomic commits and slice receipts are recorded above. No new foundational engine selected. Exact-head `scripts/verify fast`: EXIT 0. Full 537611-byte output is quoted verbatim in the preceding complete-gate comment and attached: https://git.kayg.org/attachments/a2362ca4-98dd-42dd-901e-dd596b822802 . Every Rust gate row PASS; server library 740 passed/0 failed/55 ignored. Final verbatim output: ```text 39 pass 0 fail 59970 expect() calls Ran 39 tests across 10 files. [7.01s] ``` Matched same-machine, recipe/profile/release-identity production static controls against the rebased dev: - x86_64: 21,642,416 → 22,534,600 B, +892,184 B. - aarch64: 19,794,088 → 20,589,768 B, +795,680 B. Both production trust checks passed; neither image has PT_INTERP. Whole-branch costs, no per-helper attribution or runtime performance claim. Evidence index attached as `EVIDENCE.json` (30790), raw paired-build/proof/kit log attached (30791). Seven exact-head offline kits passed hash/script validation: updates, transport128, reconnect, retention, deploy, latency, inventory. On compute01: `/home/claude/.cache/j12b-evidence/perf-<case>-fa875f0b3733ef997b6299d55478b90173b4286b`. `measurements_performed=false`; inventory measures128 durable rows/observations, not128 running daemons. Signed system proof bundles, staging image and pinned storage fixture remain in the same evidence directory outside the deleted target. Qualification is incomplete: all three exact-head systemd/storage/updater runners were refused before execution with `sudo: a password is required`. Zero cases counted as passed. `PROOFS_EXIT=1` / `J12B_FINAL_RUN_EXIT=1` preserve that blocker. Approved root execution is required for those existing runners. Enrolled-host signed-upgrade E2E, perf measurements, full power-cut/reboot/resource-refusal matrix and independent visual review also remain pending. Earlier UI production-browser tests passed15/15 with attached desktop/phone screenshots, but use mock protocol replies and are not real backend E2E evidence. How to test: 1. Run the existing exact-head generation-proof, generation-storage-proof and generation-updater-proof with the retained bundles under approved root execution on the assigned VM. 2. Have the orchestrator run the prepared kits through the pinned perf-run guard; perform the isolated-machine failure matrix separately. 3. In an approved preview, open the version pill and Updates, request a check, and compare displayed server/host versions with authenticated backend observations; review the attached phone/desktop captures independently. Cleanup: acquired build lease and runner exited; own compute01 target deleted and ARM Rust target absent; no remaining own build/test/browser process or bounded mount. Evidence retained outside checkout. Issue remains open for qualification and independent review.
kayg commented 2026-11-01 21:12:28 +00:00
Author
Owner
Copy link

J12b lean qualification follow-up, unchanged head fa875f0b37. Plan/estimate:60–90 minutes plus build-slot queue. (1) Cross-build signed ARM proof image and static pinned-engine/32MiB exhaustion harnesses on compute01, since dev-02 has only29GB free; transfer public artifacts to cua on dev-02. (2) Through dev-02 shared build-slot, run existing disposable systemd7/storage4/updater2 plus the two existing32MiB/256-inode exhaustion regressions under approved root; inspect and quote exact owned-unit/mount/process cleanup. No whole-machine reboot/power cut. (3) Rebuild same-recipe x86 head/base retaining symbols, attribute section/symbol delta by crate/feature, report inexpensive reduction candidates only. Enrolled-host E2E and perf skipped as requested. No product changes, gate not rerun unless code changes. One compute01 target; delete it at finish.

J12b lean qualification follow-up, unchanged head fa875f0b3733ef997b6299d55478b90173b4286b. Plan/estimate:60–90 minutes plus build-slot queue. (1) Cross-build signed ARM proof image and static pinned-engine/32MiB exhaustion harnesses on compute01, since dev-02 has only29GB free; transfer public artifacts to cua on dev-02. (2) Through dev-02 shared build-slot, run existing disposable systemd7/storage4/updater2 plus the two existing32MiB/256-inode exhaustion regressions under approved root; inspect and quote exact owned-unit/mount/process cleanup. No whole-machine reboot/power cut. (3) Rebuild same-recipe x86 head/base retaining symbols, attribute section/symbol delta by crate/feature, report inexpensive reduction candidates only. Enrolled-host E2E and perf skipped as requested. No product changes, gate not rerun unless code changes. One compute01 target; delete it at finish.
kayg commented 2026-11-01 21:19:55 +00:00
Author
Owner
Copy link

J12b follow-up checkpoint: compute01 acquired slot and ARM image is at final optimized link; unchanged head fa875f0b37. dev-02 free space has dropped from29GB to23GB, below mandatory25GB build-slot floor, before our artifacts are transferred. No Rust target is being created there. Root proof queue may wait for other jobs cleanup; not bypassing the floor or removing others files. Resource runner uses only disposable service cgroups for candidate OOM/process refusal/descriptor admission; existing bounded32MiB tests prepared. One compute target ~/worktrees/j12b/target. Enrolled-host E2E/perf skipped as requested.

J12b follow-up checkpoint: compute01 acquired slot and ARM image is at final optimized link; unchanged head fa875f0b3733ef997b6299d55478b90173b4286b. dev-02 free space has dropped from29GB to23GB, below mandatory25GB build-slot floor, before our artifacts are transferred. No Rust target is being created there. Root proof queue may wait for other jobs cleanup; not bypassing the floor or removing others files. Resource runner uses only disposable service cgroups for candidate OOM/process refusal/descriptor admission; existing bounded32MiB tests prepared. One compute target ~/worktrees/j12b/target. Enrolled-host E2E/perf skipped as requested.
kayg commented 2026-11-01 21:37:47 +00:00
Author
Owner
Copy link

J12b qualification checkpoint, unchanged fa875f0b37. ARM static staging image and both harnesses built successfully on compute01 and transferred to cua/dev-02. Local public fixtures signed there; temporary private signing key deleted. Root proof coordinator PID1376164 now queues first with a claude-owned slot lease. Earlier root waiter1349264 was live but its ticket was absent: peers' kill-0 stale check cannot see another UID's process; stopped only our waiter and retained shared tool unchanged. Scratch coordinator keeps FIFO/slot ownership as claude and executes only this job's proof command as root. No product/infrastructure changes.

Compute01 same acquired lease continues paired x86 symbol-retaining attribution builds. One target ~/worktrees/j12b/target. Dev-02 recovered above floor (>50GB), no target there. Raw logs: compute01 ~/.cache/j12b-evidence/qualification-build.log; dev-02/cua ~/.cache/j12b-qualification/root-qualification-retry.log. No root case completed yet. Enrolled-host E2E/perf remain skipped.

J12b qualification checkpoint, unchanged fa875f0b3733ef997b6299d55478b90173b4286b. ARM static staging image and both harnesses built successfully on compute01 and transferred to cua/dev-02. Local public fixtures signed there; temporary private signing key deleted. Root proof coordinator PID1376164 now queues first with a claude-owned slot lease. Earlier root waiter1349264 was live but its ticket was absent: peers' kill-0 stale check cannot see another UID's process; stopped only our waiter and retained shared tool unchanged. Scratch coordinator keeps FIFO/slot ownership as claude and executes only this job's proof command as root. No product/infrastructure changes. Compute01 same acquired lease continues paired x86 symbol-retaining attribution builds. One target ~/worktrees/j12b/target. Dev-02 recovered above floor (>50GB), no target there. Raw logs: compute01 ~/.cache/j12b-evidence/qualification-build.log; dev-02/cua ~/.cache/j12b-qualification/root-qualification-retry.log. No root case completed yet. Enrolled-host E2E/perf remain skipped.
kayg commented 2026-11-01 21:51:08 +00:00
Author
Owner
Copy link

J12b size attribution, report only; unchanged head fa875f0b37 versus dev65d9861914e8cd4a734d533d64ed1f4ea5c34119. Raw attribution JSON attached30797; demangled nm listings, sections and module JSON archive30798. Pinned production recipe/LTO/optimization retained, only strip=none for symbol ownership. Re-stripped symbol builds measure22,536,872/21,647,848 B, delta889,024; actual production pair22,534,600/21,642,416 B, delta892,184. Probe-vs-production delta difference3,160 B; ownership totals below are approximate LTO attribution, not independent feature ablation.

crate/symbol family base text B head text B delta text B
infraternal CLI 431036 663458 +232422
release plugin 33682 217477 +183795
server 2243364 2339437 +96073
host daemon 649797 708474 +58677
plugin API 170107 208282 +38175
remote plugin 212906 239199 +26293
other symbol families, net 12506297 12580806 +74509
all attributed text 16247189 16957133 +709944

Actual production sections account for +713792 B .text, +128388 B unwind/exception tables, +33568 B .rodata, +16256 B writable/relocated data, +180 B net remaining file layout. This sums to892184 B; .bss is not charged as file bytes. No panic/LTO/profile change proposed.

Largest application module deltas: release generation+71942, CLI generation_update+63791, release updater+58190, CLI generation_cli+56065, server remote_runtime+47184, CLI restart+37646, daemon+32851, release_http+29491, host_update+26763, remote uninstall+24427. Names/closure renumbering and cross-crate generic inlining prevent treating these as additive causal feature costs.

Cheap-cut candidates, unmeasured and not implemented: first inspect the duplicated generic host daemon channel loop (real Socket and ControlChannel specializations) and extract the new transport-independent control/lifecycle work into shared non-generic functions. Its daemon module is+32851 B, so this is a plausible small cut, not an892KB solution or a savings promise. Then inspect repeated generation/boot configuration serialization and CLI rendering in the +232422 B CLI and +183795 B release plugin; share existing helpers where equivalent while preserving ownership/signature/durability invariants. I found no duplicate new third-party package/version to remove: Cargo.lock adds dependency edges to existing libraries only. Source inspection also rules out dropping a second plaintext release HTTP transport from production: that branch is already test/staging-only. New async HTTP streaming/control paths are real functionality, not evidence of a redundant engine. No reduction work performed.

J12b size attribution, report only; unchanged head fa875f0b3733ef997b6299d55478b90173b4286b versus dev65d9861914e8cd4a734d533d64ed1f4ea5c34119. Raw attribution JSON attached30797; demangled nm listings, sections and module JSON archive30798. Pinned production recipe/LTO/optimization retained, only strip=none for symbol ownership. Re-stripped symbol builds measure22,536,872/21,647,848 B, delta889,024; actual production pair22,534,600/21,642,416 B, delta892,184. Probe-vs-production delta difference3,160 B; ownership totals below are approximate LTO attribution, not independent feature ablation. | crate/symbol family | base text B | head text B | delta text B | | --- | ---: | ---: | ---: | | infraternal CLI | 431036 | 663458 | +232422 | | release plugin | 33682 | 217477 | +183795 | | server | 2243364 | 2339437 | +96073 | | host daemon | 649797 | 708474 | +58677 | | plugin API | 170107 | 208282 | +38175 | | remote plugin | 212906 | 239199 | +26293 | | other symbol families, net | 12506297 | 12580806 | +74509 | | all attributed text | 16247189 | 16957133 | +709944 | Actual production sections account for +713792 B .text, +128388 B unwind/exception tables, +33568 B .rodata, +16256 B writable/relocated data, +180 B net remaining file layout. This sums to892184 B; .bss is not charged as file bytes. No panic/LTO/profile change proposed. Largest application module deltas: release generation+71942, CLI generation_update+63791, release updater+58190, CLI generation_cli+56065, server remote_runtime+47184, CLI restart+37646, daemon+32851, release_http+29491, host_update+26763, remote uninstall+24427. Names/closure renumbering and cross-crate generic inlining prevent treating these as additive causal feature costs. Cheap-cut candidates, unmeasured and not implemented: first inspect the duplicated generic host daemon channel loop (real Socket and ControlChannel specializations) and extract the new transport-independent control/lifecycle work into shared non-generic functions. Its daemon module is+32851 B, so this is a plausible small cut, not an892KB solution or a savings promise. Then inspect repeated generation/boot configuration serialization and CLI rendering in the +232422 B CLI and +183795 B release plugin; share existing helpers where equivalent while preserving ownership/signature/durability invariants. I found no duplicate new third-party package/version to remove: Cargo.lock adds dependency edges to existing libraries only. Source inspection also rules out dropping a second plaintext release HTTP transport from production: that branch is already test/staging-only. New async HTTP streaming/control paths are real functionality, not evidence of a redundant engine. No reduction work performed.
kayg commented 2026-11-01 21:53:31 +00:00
Author
Owner
Copy link

J12b root qualification finding, unchanged fa875f0b37, ARM/dev-02 disposable ext4. Storage is NOT qualified:

  • Original A, zero available blocks: selection stays on A but HTTP service never recovers. Journal repeatedly reports installation not writable; serving read-only error_kind=StorageFull, followed by read-only generation serving stopped error=auth initialization failed; systemd restarted42 times within the retained90s observation. This reached the real full-volume recovery trigger, unlike the earlier setup timeout. P1 qualification blocker pending diagnosis.
  • Original A, zero available inodes: HTTP read-only startup succeeds and identity/WAL checks proceed, but the unchanged file-list oracle fails: read-only recovery created or removed installation files. Need diagnostic path diff before deciding whether a surviving pre-stop child or read-only startup caused it; no oracle weakened.
  • Committed B passes both block and inode exhaustion: latest acknowledged WAL preserved, selected/executing identity verified, fillers retained across3restarts, then a distinct signed update succeeds after capacity restoration.

All32MiB/256-inode storage-primitive regressions passed in the first root attempt. Systemd adoption/healthy/candidate-exit/watchdog-death/owner-busy/repeated-recovery passed; stalled case timed out during setup before its trigger and will be retried unchanged. Updater and scoped resource cases still running. Full raw receipts will be attached after final cleanup. No product code changed or performance claim made; enrolled-host E2E/perf skipped.

J12b root qualification finding, unchanged fa875f0b3733ef997b6299d55478b90173b4286b, ARM/dev-02 disposable ext4. Storage is NOT qualified: - Original A, zero available blocks: selection stays on A but HTTP service never recovers. Journal repeatedly reports `installation not writable; serving read-only error_kind=StorageFull`, followed by `read-only generation serving stopped error=auth initialization failed`; systemd restarted42 times within the retained90s observation. This reached the real full-volume recovery trigger, unlike the earlier setup timeout. P1 qualification blocker pending diagnosis. - Original A, zero available inodes: HTTP read-only startup succeeds and identity/WAL checks proceed, but the unchanged file-list oracle fails: `read-only recovery created or removed installation files`. Need diagnostic path diff before deciding whether a surviving pre-stop child or read-only startup caused it; no oracle weakened. - Committed B passes both block and inode exhaustion: latest acknowledged WAL preserved, selected/executing identity verified, fillers retained across3restarts, then a distinct signed update succeeds after capacity restoration. All32MiB/256-inode storage-primitive regressions passed in the first root attempt. Systemd adoption/healthy/candidate-exit/watchdog-death/owner-busy/repeated-recovery passed; stalled case timed out during setup before its trigger and will be retried unchanged. Updater and scoped resource cases still running. Full raw receipts will be attached after final cleanup. No product code changed or performance claim made; enrolled-host E2E/perf skipped.
kayg commented 2026-11-01 22:12:37 +00:00
Author
Owner
Copy link

J12b follow-up handoff: NOT READY FOR REVIEW. Head remains fa875f0b3733ef997b6299d55478b90173b4286b, branch j12b-edge-update. No product code changed, no reduction work, no new gate run. Prior exact-head fast output remains quoted verbatim above and attached https://git.kayg.org/attachments/a2362ca4-98dd-42dd-901e-dd596b822802 . Both source worktrees clean.

Root qualification on dev-02 as cua/root, through a claude-owned shared build-slot lease:

  • Systemd7/7 across attempts. Stalled case's first setup timeout was retained; unchanged retry reached the trial trigger and recovered after122.3s.
  • Storage3/4 across valid final attempts. Committed B passes real block/inode exhaustion with WAL retention across3restarts and a later signed update after capacity restoration. Original A block retry passes. Its earlier read-only auth-initialization failure is retained, not reproduced on the protected-path retry.
  • Original A inode recovery FAILS reproducibly. Diagnostic kept the exact file-list oracle and found created=[] removed=['d/release-check-21b08061-f6a1-4674-bad0-bd48d692231f']. WAL/database bytes and pinned-engine marker checks pass, but read-only startup deletes abandoned staging. Source path: plugins::compiled_with_mode(read_only) still constructs release_latest::plugin/service; VerifiedLookup::new calls cleanup_abandoned_staging unconditionally (crates/plugins/release/src/latest.rs:95). This is the remaining P1 no-write violation; no fix made in this report-only qualification follow-up.
  • Updater2/2 on protected paths: signed automatic discovery/apply and historical rollback. Earlier /tmp fixture staged replacements beneath a world-writable ancestor, correctly refused by Opened::open; protected /var/lib fixture fixes that setup without weakening admission.
  • Scoped resource3/3: candidate cgroup OOM (watchdog in a different cgroup), cgroup-confirmed process refusal (pids.max events0→1), descriptor admission refusal/recovery. All retain/select/execute A; descriptor case does not claim an admitted update transaction.
  • Existing32MiB/256-inode exhaustion tests2/2, each exactly1 passed/0 failed.

Enrolled-host E2E/perf skipped as requested. Whole-machine reboot/power-cut and complete fsync-boundary matrix skipped on this shared VM under the disposable-units/paths constraint.

Qualification JSON: https://git.kayg.org/attachments/c769dc7a-7b06-476b-a90f-a45c1bffad6e . Raw attempts, diagnostics and cleanup: https://git.kayg.org/attachments/d7e0f1fd-f40c-462a-93e6-754b7419ba76 . Root fixtures/signing key removed; no pending runner/lease. Retained public proof artifacts and receipts are in cua's ~/.cache/j12b-qualification; compute logs/symbol artifacts remain ~/.cache/j12b-evidence/qualification.

Verbatim final cleanup:

OWNED_PROCESSES=[]
OWNED_MOUNTS=[]
PROOF_UNIT_FILES=[]
PROOF_RUNTIME_PROPERTIES=[]
OWNED_LEASE_DIRECTORIES=[]
DISPOSABLE_RUNTIME_CLEANUP=PASS
ROOT_FIXTURE_DIRECTORY_ABSENT=True
TEMP_SIGNING_KEY_ABSENT=True

Separate target verification, verbatim:

COMPUTE_TARGET_ABSENT
ARM_TARGET_ABSENT
ROOT_FIXTURE_ABSENT

Size attribution table and cheap-cut discussion are in the preceding size report; JSON https://git.kayg.org/attachments/6a54f514-571a-41d7-8492-1167619979e9 ; raw nm/section/module evidence https://git.kayg.org/attachments/7930899e-f2ce-4c21-8eb8-2760e72bb6ee . Production x86 delta892184 B; text713792, unwind128388, rodata33568, other16436. Symbol ownership is approximate: symbol-retaining pair re-strips to a889024 B delta,3160 B different from production. Main text contributions: CLI232422, release183795, server96073, host daemon58677, plugin API38175, remote26293, others74509. No newly duplicated dependency version found; modest non-generic channel/control extraction and equivalent serialization/rendering reuse are candidates only, savings unmeasured. No profile, panic mode, dependency or source change made.

J12b follow-up handoff: NOT READY FOR REVIEW. Head remains `fa875f0b3733ef997b6299d55478b90173b4286b`, branch `j12b-edge-update`. No product code changed, no reduction work, no new gate run. Prior exact-head fast output remains quoted verbatim above and attached https://git.kayg.org/attachments/a2362ca4-98dd-42dd-901e-dd596b822802 . Both source worktrees clean. Root qualification on dev-02 as cua/root, through a claude-owned shared build-slot lease: - Systemd7/7 across attempts. Stalled case's first setup timeout was retained; unchanged retry reached the trial trigger and recovered after122.3s. - Storage3/4 across valid final attempts. Committed B passes real block/inode exhaustion with WAL retention across3restarts and a later signed update after capacity restoration. Original A block retry passes. Its earlier read-only auth-initialization failure is retained, not reproduced on the protected-path retry. - Original A inode recovery FAILS reproducibly. Diagnostic kept the exact file-list oracle and found `created=[] removed=['d/release-check-21b08061-f6a1-4674-bad0-bd48d692231f']`. WAL/database bytes and pinned-engine marker checks pass, but read-only startup deletes abandoned staging. Source path: plugins::compiled_with_mode(read_only) still constructs release_latest::plugin/service; VerifiedLookup::new calls cleanup_abandoned_staging unconditionally (crates/plugins/release/src/latest.rs:95). This is the remaining P1 no-write violation; no fix made in this report-only qualification follow-up. - Updater2/2 on protected paths: signed automatic discovery/apply and historical rollback. Earlier /tmp fixture staged replacements beneath a world-writable ancestor, correctly refused by Opened::open; protected /var/lib fixture fixes that setup without weakening admission. - Scoped resource3/3: candidate cgroup OOM (watchdog in a different cgroup), cgroup-confirmed process refusal (pids.max events0→1), descriptor admission refusal/recovery. All retain/select/execute A; descriptor case does not claim an admitted update transaction. - Existing32MiB/256-inode exhaustion tests2/2, each exactly1 passed/0 failed. Enrolled-host E2E/perf skipped as requested. Whole-machine reboot/power-cut and complete fsync-boundary matrix skipped on this shared VM under the disposable-units/paths constraint. Qualification JSON: https://git.kayg.org/attachments/c769dc7a-7b06-476b-a90f-a45c1bffad6e . Raw attempts, diagnostics and cleanup: https://git.kayg.org/attachments/d7e0f1fd-f40c-462a-93e6-754b7419ba76 . Root fixtures/signing key removed; no pending runner/lease. Retained public proof artifacts and receipts are in cua's ~/.cache/j12b-qualification; compute logs/symbol artifacts remain ~/.cache/j12b-evidence/qualification. Verbatim final cleanup: ```text OWNED_PROCESSES=[] OWNED_MOUNTS=[] PROOF_UNIT_FILES=[] PROOF_RUNTIME_PROPERTIES=[] OWNED_LEASE_DIRECTORIES=[] DISPOSABLE_RUNTIME_CLEANUP=PASS ROOT_FIXTURE_DIRECTORY_ABSENT=True TEMP_SIGNING_KEY_ABSENT=True ``` Separate target verification, verbatim: ```text COMPUTE_TARGET_ABSENT ARM_TARGET_ABSENT ROOT_FIXTURE_ABSENT ``` Size attribution table and cheap-cut discussion are in the preceding size report; JSON https://git.kayg.org/attachments/6a54f514-571a-41d7-8492-1167619979e9 ; raw nm/section/module evidence https://git.kayg.org/attachments/7930899e-f2ce-4c21-8eb8-2760e72bb6ee . Production x86 delta892184 B; text713792, unwind128388, rodata33568, other16436. Symbol ownership is approximate: symbol-retaining pair re-strips to a889024 B delta,3160 B different from production. Main text contributions: CLI232422, release183795, server96073, host daemon58677, plugin API38175, remote26293, others74509. No newly duplicated dependency version found; modest non-generic channel/control extraction and equivalent serialization/rendering reuse are candidates only, savings unmeasured. No profile, panic mode, dependency or source change made.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
j470b-server-mesh-rejoin
mesh-compat-382
j444b-d381-key-wins-flood
j461b-macos-utun-reader-thread
j475b-remove-host-motion
fix-reconnect-new-link
j481-d380
dev
j479-mesh-soak
fix/j476-host-facts
j475-motion-pill-split
j470-mac-node-join
root-upgrade-d376
j474-review-merge
latency-targets-120hz
nightly-suite-shards
gotatun-pin-j469
macos-utun-reader-thread
fix-flood-echo-stall
wip/j416
motion-fast-ease-out
mesh-addhost-j259
takeover-close-terminals-d368
kbd-instant-followups
fix-trust-key-double-click
nightly-suite-partial-report
appwin-icons-j207
rusqlite-slice1
swipe-content-first-d374
mesh-mtu-381
addhost-instant-open
glass-contrast-d365-mock
glass-contrast-d365
signout-followups-442
fix-startup-toast-red
research-gotatun-matrix-j317
themes-sync-j304
fix-load-flakes
fix-nix-zig-patch
fix-compute01-browser-baseline
ratchet-size-baseline-419
predict-auto-d130
revoke-coverage-d367
nightly-suite-queue-timeout
nightly-browser-suite
fix-rustsec-2026-0459
fonts-ioskeley-obel
log-retention-d375
fix-kbd-no-anim-427
fix-dev-red-specs-2
takeover-proof-305-j205
wip/j410-server-pump
ui-consistency-d372
fix-osc52-clipboard
libghostty-vt-1.0
forget-retired-host-d369
j404-merge-426
fix-setup-lock-race
fix-touch-select-426
revoke-access-report-ui
fix-predictive-echo-specs
fix-selinux-agent-exec
wip/j395-checkpoint2
wip/j395
j391-review-scratch
ui-consistency-j195-deferred-rebased
fix-rustc-paths-421
decisions-wording-341
fix-install-suite-red
fix-dev-rtt-specs
fix-pending-removal-align
fix-privileged-skip
fix-install-suite-404
review-j368
mesh-dns-j254
revoke-access-report-d356b
revoke-privilege-round5
fix-removal-confirm
review-j360
gotatun-rotation-367
deps-refresh-340
review-j354
review-J351
review-j350
addhost-takeover-d359
revoke-report-items-347
revoke-end-sessions-d362
review-j348
size-mesh-ssh-346
size-trim-337
revoke-access-diff-d356
j259-pre-rebase-b06c5a6
j305-ended-at-start-spec
addhost-sudo-consent
fix-layout-real-specs-411
fix-shell-open-411
fix-console-hosts-373
fix-shell-exit
fuzz-host-name-353
fix-host-details-410
macos-filter-j197
research-gotatun-tricks
revoke-p3-j216l
stale-state-pill
revoke-followups-j216k
revoke-progress-j216e
backup/macos01-20261106/lume/j197
backup/macos01-20261106/lume/appwin-icons-j207-stash0
backup/macos01-20261106/claude/stash-0
backup/macos01-20261106/claude/stash-1
backup/macos01-20261106/claude/J80-macos-s1
backup/macos01-20261106/claude/J80
backup/macos01-20261106/claude/J80-slice1-20261102
backup/macos01-20261106/claude/J16b-appwin-on-dev
backup/macos01-20261106/claude/appwin-launch-idle-146
backup/macos01-20261106/claude/J80-s1-run
wip/j259
trust-285-p3c
runtime-lock-j216f
mesh-ssh-p3-j175
tun-proof-p3b
trust-285-p3
terminal-polish-j271
tun-proof-p3
ssh-install-flakes-j216i
fuzz-fixes-j264
trust-285-a
trust-285-b
restart-oversized-fixture-j198
backup/macos01-20261106/lume/appwin-icons-j207
restart-bound-j216h
up-preflight-p3-j198
backup/macos01-20261106/lume/j251
up-preflight-j198
wip/up-preflight-j198-j245-p2
wip/up-preflight-j198-j245-p1
agent-fsync-offloop-j196
wip/up-preflight-j198-j245
settings-offscreen-j231
wip/up-preflight-j198-j226-inspection
wip/j103f
themes-j206
wip/up-preflight-j198-j226
flakes-j216c
backup/macos01-20261106/claude/j197
flakes-j216b
backup/macos01-20261106/claude/j197-red
wip/up-preflight-j198-review
flakes-j216
backup/macos01-20261106/claude/appwin-icons-j207
engineering-j208b
appwin-mock-j209
toast-stack-j165
engineering-j208
decisions-d351
decisions-d350
decisions-d349
appearance-presets-mock-j129
decisions-d348
docs-audit-spec
doc-coverage-baseline-raise
decisions-d347
decisions-d346b
decisions-d346
j88h-profile
ui-consistency-j195-deferred
ui-consistency-j195
engineering-practices-j194
preferred-login-ui-j166
signin-pools-263-j174
macos-node-265-s1
decisions-d345
decisions-d344
proxy-cgroup-j164
verify-quick-fuzz-329
proxy-start-io-j168
timing-flakes-j163
up-263-s1
mcp-events-j147
verify-quick-fuzz-j158
proxy-p3-j159
agent-resource-j157-detect
wip/j103d-final
remote-cancel-hang-j155
proxy-traefik-281-j62d
j149-verify-quick
proxy-traefik-281-j62b
j150-drop-unnamed
wip/j79d-red-r4
wip/j103d-d332
rootless-toast-j142
wip/j103d-head
wip/j103d
j125c-mcp
macos-build-j136
backup/macos01-20261106/claude/j136
wip/j79d-red-cli
wip/j79d-red-server
j121-link-liveness
j118c-tracer-failures
wip/j79c-head
release-desktop-j131
j124c-signed-macos
wip/j79c-red-p3
wip/j79c-red-p23
wip/j79c-red-p22
merge-j128-check
perf-deferred-j128
sidebar-toggle-260
j127-shortcut-changed-dot
j125-mcp
j118-tracer-failures
j126-account-summary
settings-sections-mock-j92
j120-pinch-lock
sidebar-292
backup/macos01-20261106/claude/j120
taste-2026-11-03
row-actions-242-215
backup/macos01-20261106/claude/stash-0-untracked
backup/macos01-20261106/claude/J80-265-s1-run
backup/macos01-20261106/claude/J80-macos-s1-20261102
j112-canvas-commands
ui-no-overshoot-scroll
fix-recovery-restart
backup/macos01-20261106/claude/stash-1-untracked
taste-2026-11-02
size-baseline-ratchet
machine-cards-structure-j108
j109-boot-copy-mockups
fix-dev-red
wip/up-263-s1
j95b-settings-rows
proxy-traefik-281
j95-option-rows
docs-human-j91
docs-keys-palette
fix-flood-1013-270-j38d
mesh-ssh-s1
mesh-ssh-s0
addhost-d291-tunnel
test-stability-load
mesh-relay-220
repro-296
shim-thp-off-24
mesh-pins-258-v2
mesh-dns
signin-d311-merged
docs-pages
ui-size-283
fix-ui-batch-specs
wip/j12b-edge-update
gate-on-arm
fix-rename-sync-293
trust-285-j60b
fix-focus-ring-clip
integ-ui-1101
edge-update-v2
signin-d311
taste-2026-11-01
layout-per-tab-250
ui-approved-splitopt-224
ui-approved-splitopt-224-on-dev
icon-text-centre-282
ui-approved-189-212-216
research-reverse-proxy
transfer-budget-320
review-mesh-pins-258-r2
sidebar-pill-259
review-mesh-relay-220
wip/j12-edge-update-v2
nix-package
status-crash-loop-237
fix-dev-test-failures
fix-fixture-socket-path
wip/mesh-relay-220-pre-dev-advance-rebase
fix-canvas-side-clip
research-head-to-head
frosted-real-256
review-mesh-pins-258
wip/mesh-relay-220-pre-final-rebase
review-layout-per-tab-250-r2
broad-suite-triage
nix-devshell
review-status-crash-loop-237-r3
wip/nix-devshell-pre-p3
taste-frosted-real
wip/code-serve-demo-2026-10-30
wip/code-serve-glass-2026-10-30
wip/code-serve-clusters-2026-10-30
wip/code-merge-release94-dev-2026-10-30
wip/rproxy-delta-scratch-2026-10-30
wip/stale-note-257-staged-2026-10-30
wip/d241-size-staged-2026-10-30
review-broad-suite-207
wip/mesh-pins-258-pre-split
wip/mesh-relay-220-pre-rebase
mesh-measure-220
plan-211-update
review-edge-autoupdate-r3
perf24-reconnect
review-stale-note-r2
release-prod-live
d241-shell-marker
review-mesh-pins-server-258
review-revocation-r3
review-setup-token-r2
review-sync-journal-r3
wip/review-mesh-pins-258-prune-review-1995fee46
frosted-scroll-256
sync-journal-r3
revocation-per-account-wip
review-tokio-asyncfd-0386
review-sync-p3s
wip/stash-8by64-stash0-2026-10-30
mesh-drag-r2
setup-token-data-wip
release-9-4
auth-busy-1013
mesh-view-overlap
sync-p3s
review-auth-busy-wake
review-readd-r8-wip
mesh-drag-bounds
audit-auth-93
app-windows-stream-start
review-authority-cap-r3
app-windows-r7-measure
readd-minimal-r6
readd-minimal-r5
app-windows-r7-soak
readd-minimal-r4
app-windows-r7
app-windows-r6
readd-minimal-r3
readd-minimal-r2
readd-minimal
merge-release8-dev
review-busy-page-liveness-r2
review-busy-page-liveness
mesh-view-trim
review-authority-read-retry-r2
review-remove-uninstall-r2
release-retry-reattach
release-retry
review-remove-uninstall
review-authority-read-retry
app-windows-ship
mesh-autoswitch-p2
mesh-ssh
mesh-relay
mesh-macos-node
screen-and-control
session-labels
review-real-logins-r5
review-real-logins-r4
review-real-logins-r3
shim-memory-r2
review-real-logins-r2
shim-memory
shadow-addhost-instant
shadow-real-logins
shadow-same-session-flood
shadow-prod-perf-fix
hosts-from-server
app-windows-real
app-windows-transport
release-prod-6w
mesh-policy-verify
quiet-close-toast
dev-merge-r4
review-mesh-agent-transport
review-app-windows-transport
settings-roundtrip
review-release-pipeline-r4
mesh-agent-transport
ended-strip-fix
review-audit-ca-update-d244
settings-rows
phone-width
signout-clear
fix-restart-tests
dev-merge-rp
signer-hardening
review-audit-ca-update
terminal-fidelity
review-audit-ca-update-wip
mesh-integrate
review-mesh-agent-transport-515d3712
review-mesh-dataplane-feec1988
mesh-dataplane
signout
research-canvas-node
wip/review-renderer-cost
wip/review-terminal-fidelity
padlock-glyph
review-release-pipeline-2e95b689
phone-polish
sidebar-polish
inbox-generic
review-mesh-dataplane-378d4055
prod-batch
ui-inbox
ui-ca-unlock
ui-machine-sections
review-mesh-dataplane-a5f744fb
tls-session-prod
session-bounds-prod
fix-dead-session
session-bounds
tls-session
palette-polish
shortcuts-d222
research-appmeta
phone-gutter
ui-centre-button
wip/ui-centre-button
wip/tls-session
review-addhost-breakit
ui-platform
renderer-cost
remote-agents
mesh-api
ssh-bootstrap
prod-hotfix2
prod-fixes
review-remote-agents
review-mesh-dataplane
session-life
research-browser
review-mesh-api
research-capture
review-mesh-api-round3
review-mesh-api-round1
gate-stability
review-gate-stability
review-relay-direct
review-mesh-api-findings
proto-sessions
font-picker
proto-addhost
proto-windows
mesh-core
latency-gate
research-bsd
research-discovery
keytray-mods
mock-core
ui-tweaks
fix-motion-sel
fix-motion
integrate2
fix-robust
t-web
t-server
vt-ghostty
fix-snap-echo
t-web-auth
review-vt2
t-agent
lane-protocol
lane-shim
lane-auth
s1-base
s1-contracts
s1-workspace
No results found.
Labels
Clear labels   
launch-qa
Findings from launch QA.

No labels
launch-qa
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/infraternal#211
No description provided.